I am trying to get a windows 10 VM to connect over SMB to another windows 10 VM. I am trying to create a named pipe on VM1 that will allow anyone to connect to it with all permissions. I am then trying to connect VM2 to that named pipe.
Currently i am getting some errors over wireshark when trying to make the connection. Below is my server, client, and wireshark errors.
With both the server and client running on the same VM, the connection works fine and i get the message on the server as expected.
What is the simplest way to create an SMB named pipe on VM1 and have VM2 connect to it? Have i over complicated it?
Running accesschk on my named pipe gives this result, which shows read/write to everyone.
Accesschk v6.12 - Reports effective permissions for securable objects
Copyright (C) 2006-2017 Mark Russinovich
Sysinternals - www.sysinternals.com
\\.\Pipe\MyTestPipe
RW Everyone
Wireshark Output with filter tcp.port==445
No. Time Source Destination Protocol Length Info
67 13.039161 fe80::d0ab:b3ed:8e74:a86c fe80::8998:c1e0:9490:26f4 TCP 86 52601 → 445 [SYN] Seq=0 Win=64800 Len=0 MSS=1440 WS=256 SACK_PERM=1
68 13.039260 fe80::8998:c1e0:9490:26f4 fe80::d0ab:b3ed:8e74:a86c TCP 86 445 → 52601 [SYN, ACK] Seq=0 Ack=1 Win=65535 Len=0 MSS=1440 WS=256 SACK_PERM=1
69 13.039659 fe80::d0ab:b3ed:8e74:a86c fe80::8998:c1e0:9490:26f4 TCP 74 52601 → 445 [ACK] Seq=1 Ack=1 Win=2108160 Len=0
70 13.039817 fe80::d0ab:b3ed:8e74:a86c fe80::8998:c1e0:9490:26f4 SMB 147 Negotiate Protocol Request
71 13.040240 fe80::8998:c1e0:9490:26f4 fe80::d0ab:b3ed:8e74:a86c SMB2 526 Negotiate Protocol Response
72 13.040755 fe80::d0ab:b3ed:8e74:a86c fe80::8998:c1e0:9490:26f4 SMB2 252 Negotiate Protocol Request
73 13.041052 fe80::8998:c1e0:9490:26f4 fe80::d0ab:b3ed:8e74:a86c SMB2 586 Negotiate Protocol Response
74 13.042232 fe80::d0ab:b3ed:8e74:a86c fe80::8998:c1e0:9490:26f4 SMB2 240 Session Setup Request, NTLMSSP_NEGOTIATE
75 13.042386 fe80::8998:c1e0:9490:26f4 fe80::d0ab:b3ed:8e74:a86c SMB2 410 Session Setup Response, Error: STATUS_MORE_PROCESSING_REQUIRED, NTLMSSP_CHALLENGE
76 13.042954 fe80::d0ab:b3ed:8e74:a86c fe80::8998:c1e0:9490:26f4 SMB2 717 Session Setup Request, NTLMSSP_AUTH, User: WINDEV1905EVAL2\User
77 13.043497 fe80::8998:c1e0:9490:26f4 fe80::d0ab:b3ed:8e74:a86c SMB2 150 Session Setup Response, Error: STATUS_ACCOUNT_RESTRICTION
78 13.043828 fe80::d0ab:b3ed:8e74:a86c fe80::8998:c1e0:9490:26f4 TCP 74 52601 → 445 [RST, ACK] Seq=1061 Ack=1377 Win=0 Len=0
SMB Server C++
Build with Developer Command Prompt > cl /EHsc smb-server-prototype.cpp /link AdvAPI32.Lib
#include <windows.h>
#include <stdio.h>
int main(void)
{
HANDLE hPipe;
char buffer[1024];
DWORD dwRead;
SECURITY_ATTRIBUTES sa;
ZeroMemory(&sa, sizeof(sa));
sa.nLength = sizeof(sa);
sa.bInheritHandle = false;
bool bInitOk = false;
bool bSetOk = false;
SECURITY_DESCRIPTOR SD;
bInitOk = InitializeSecurityDescriptor(&SD, SECURITY_DESCRIPTOR_REVISION);
if (bInitOk) {
bSetOk = SetSecurityDescriptorDacl(&SD, TRUE, (PACL)NULL, FALSE);
if (bSetOk) {
sa.lpSecurityDescriptor = &SD;
hPipe = CreateNamedPipe(TEXT("\\\\.\\pipe\\MyTestPipe"),
PIPE_ACCESS_DUPLEX,
PIPE_TYPE_BYTE | PIPE_READMODE_BYTE | PIPE_WAIT,
PIPE_UNLIMITED_INSTANCES,
1024 * 1024,
1024 * 1024,
NMPWAIT_USE_DEFAULT_WAIT,
&sa);
while (hPipe != INVALID_HANDLE_VALUE)
{
if (ConnectNamedPipe(hPipe, NULL) != FALSE) // wait for someone to connect to the pipe
{
while (ReadFile(hPipe, buffer, sizeof(buffer) - 1, &dwRead, NULL) != FALSE)
{
/* add terminating zero */
buffer[dwRead] = '\0';
/* do something with data in buffer */
printf("%s", buffer);
}
}
DisconnectNamedPipe(hPipe);
}
}
}
return 0;
}
SMB Client C++
Build with Developer Command Prompt > cl /EHsc smb-client-prototype.cpp /link AdvAPI32.Lib
#include <windows.h>
#include <stdio.h>
int main(void)
{
HANDLE hPipe;
DWORD dwWritten;
hPipe = CreateFile(TEXT("\\\\WINDEV1905EVAL\\pipe\\MyTestPipe"), //WINDEV1905EVAL is the name of the VM serving the named pipe
GENERIC_READ | GENERIC_WRITE,
0,
NULL,
OPEN_EXISTING,
0,
NULL);
if (hPipe != INVALID_HANDLE_VALUE)
{
WriteFile(hPipe,
"Hello Pipe\n",
12, // = length of string + terminating '\0' !!!
&dwWritten,
NULL);
CloseHandle(hPipe);
}
return (0);
}
