SMB命名管道，无连接限制

Question

我正在尝试获取Windows 10 VM，以便通过SMB连接到另一个Windows 10 VM。我正在尝试在VM1上创建一个命名管道，该管道将允许任何人以所有权限连接到它。然后，我尝试将VM2连接到该命名管道。

[目前尝试建立连接时，我在wireshark上遇到一些错误。下面是我的服务器，客户端和Wireshark错误。

在服务器和客户端都在同一VM上运行的情况下，连接工作正常，并且我按预期在服务器上收到了消息。

在VM1上创建SMB命名管道并将VM2连接到它的最简单方法是什么？我是否感到复杂？

---

在我的命名管道上运行accesschk给出此结果，向所有人显示读/写。

Accesschk v6.12 - Reports effective permissions for securable objects
Copyright (C) 2006-2017 Mark Russinovich
Sysinternals - www.sysinternals.com

\\.\Pipe\MyTestPipe
  RW Everyone

---

Wireshark输出带过滤器tcp.port==445

No. Time    Source  Destination Protocol    Length  Info
67  13.039161   fe80::d0ab:b3ed:8e74:a86c   fe80::8998:c1e0:9490:26f4   TCP 86  52601 → 445 [SYN] Seq=0 Win=64800 Len=0 MSS=1440 WS=256 SACK_PERM=1
68  13.039260   fe80::8998:c1e0:9490:26f4   fe80::d0ab:b3ed:8e74:a86c   TCP 86  445 → 52601 [SYN, ACK] Seq=0 Ack=1 Win=65535 Len=0 MSS=1440 WS=256 SACK_PERM=1
69  13.039659   fe80::d0ab:b3ed:8e74:a86c   fe80::8998:c1e0:9490:26f4   TCP 74  52601 → 445 [ACK] Seq=1 Ack=1 Win=2108160 Len=0
70  13.039817   fe80::d0ab:b3ed:8e74:a86c   fe80::8998:c1e0:9490:26f4   SMB 147 Negotiate Protocol Request
71  13.040240   fe80::8998:c1e0:9490:26f4   fe80::d0ab:b3ed:8e74:a86c   SMB2    526 Negotiate Protocol Response
72  13.040755   fe80::d0ab:b3ed:8e74:a86c   fe80::8998:c1e0:9490:26f4   SMB2    252 Negotiate Protocol Request
73  13.041052   fe80::8998:c1e0:9490:26f4   fe80::d0ab:b3ed:8e74:a86c   SMB2    586 Negotiate Protocol Response
74  13.042232   fe80::d0ab:b3ed:8e74:a86c   fe80::8998:c1e0:9490:26f4   SMB2    240 Session Setup Request, NTLMSSP_NEGOTIATE
75  13.042386   fe80::8998:c1e0:9490:26f4   fe80::d0ab:b3ed:8e74:a86c   SMB2    410 Session Setup Response, Error: STATUS_MORE_PROCESSING_REQUIRED, NTLMSSP_CHALLENGE
76  13.042954   fe80::d0ab:b3ed:8e74:a86c   fe80::8998:c1e0:9490:26f4   SMB2    717 Session Setup Request, NTLMSSP_AUTH, User: WINDEV1905EVAL2\User
77  13.043497   fe80::8998:c1e0:9490:26f4   fe80::d0ab:b3ed:8e74:a86c   SMB2    150 Session Setup Response, Error: STATUS_ACCOUNT_RESTRICTION
78  13.043828   fe80::d0ab:b3ed:8e74:a86c   fe80::8998:c1e0:9490:26f4   TCP 74  52601 → 445 [RST, ACK] Seq=1061 Ack=1377 Win=0 Len=0

---

SMB服务器C ++

使用开发人员命令提示符进行构建> cl / EHsc smb-server-prototype.cpp / link AdvAPI32.Lib

#include <windows.h>
#include <stdio.h>

int main(void)

{
    HANDLE hPipe;
    char buffer[1024];
    DWORD dwRead;

    SECURITY_ATTRIBUTES sa;
    ZeroMemory(&sa, sizeof(sa));
    sa.nLength = sizeof(sa);
    sa.bInheritHandle = false;
    bool bInitOk = false;
    bool bSetOk = false;
    SECURITY_DESCRIPTOR SD;

    bInitOk = InitializeSecurityDescriptor(&SD, SECURITY_DESCRIPTOR_REVISION);

    if (bInitOk) {
        bSetOk = SetSecurityDescriptorDacl(&SD, TRUE, (PACL)NULL, FALSE);
        if (bSetOk) {

            sa.lpSecurityDescriptor = &SD;

            hPipe = CreateNamedPipe(TEXT("\\\\.\\pipe\\MyTestPipe"),
                PIPE_ACCESS_DUPLEX,
                PIPE_TYPE_BYTE | PIPE_READMODE_BYTE | PIPE_WAIT,
                PIPE_UNLIMITED_INSTANCES,
                1024 * 1024,
                1024 * 1024,
                NMPWAIT_USE_DEFAULT_WAIT,
                &sa);
            while (hPipe != INVALID_HANDLE_VALUE)
            {
                if (ConnectNamedPipe(hPipe, NULL) != FALSE)   // wait for someone to connect to the pipe
                {
                    while (ReadFile(hPipe, buffer, sizeof(buffer) - 1, &dwRead, NULL) != FALSE)
                    {
                        /* add terminating zero */
                        buffer[dwRead] = '\0';

                        /* do something with data in buffer */
                        printf("%s", buffer);
                    }
                }

                DisconnectNamedPipe(hPipe);
            }
        }
    }



    return 0;
}

---

SMB客户端C ++

使用开发人员命令提示符进行构建> cl / EHsc smb-client-prototype.cpp / link AdvAPI32.Lib

#include <windows.h>
#include <stdio.h>

int main(void)
{
    HANDLE hPipe;
    DWORD dwWritten;


    hPipe = CreateFile(TEXT("\\\\WINDEV1905EVAL\\pipe\\MyTestPipe"), //WINDEV1905EVAL is the name of the VM serving the named pipe
        GENERIC_READ | GENERIC_WRITE,
        0,
        NULL,
        OPEN_EXISTING,
        0,
        NULL);
    if (hPipe != INVALID_HANDLE_VALUE)
    {
        WriteFile(hPipe,
            "Hello Pipe\n",
            12,   // = length of string + terminating '\0' !!!
            &dwWritten,
            NULL);

        CloseHandle(hPipe);
    }

    return (0);
}

Answer 1

最后弄清楚了这个问题。托管命名管道的VM需要打开file and print sharing。启用该功能后，一切都开始工作。