diff --git a/tools/windows-mdm/poc-mdm-server/.gitignore b/tools/mdm/windows/poc-mdm-server/.gitignore similarity index 100% rename from tools/windows-mdm/poc-mdm-server/.gitignore rename to tools/mdm/windows/poc-mdm-server/.gitignore diff --git a/tools/windows-mdm/poc-mdm-server/LICENSE b/tools/mdm/windows/poc-mdm-server/LICENSE similarity index 100% rename from tools/windows-mdm/poc-mdm-server/LICENSE rename to tools/mdm/windows/poc-mdm-server/LICENSE diff --git a/tools/windows-mdm/poc-mdm-server/README.md b/tools/mdm/windows/poc-mdm-server/README.md similarity index 100% rename from tools/windows-mdm/poc-mdm-server/README.md rename to tools/mdm/windows/poc-mdm-server/README.md diff --git a/tools/windows-mdm/poc-mdm-server/certs/dev_cert_mdmwindows_com.pfx b/tools/mdm/windows/poc-mdm-server/certs/dev_cert_mdmwindows_com.pfx similarity index 100% rename from tools/windows-mdm/poc-mdm-server/certs/dev_cert_mdmwindows_com.pfx rename to tools/mdm/windows/poc-mdm-server/certs/dev_cert_mdmwindows_com.pfx diff --git a/tools/windows-mdm/poc-mdm-server/go.mod b/tools/mdm/windows/poc-mdm-server/go.mod similarity index 100% rename from tools/windows-mdm/poc-mdm-server/go.mod rename to tools/mdm/windows/poc-mdm-server/go.mod diff --git a/tools/windows-mdm/poc-mdm-server/go.sum b/tools/mdm/windows/poc-mdm-server/go.sum similarity index 100% rename from tools/windows-mdm/poc-mdm-server/go.sum rename to tools/mdm/windows/poc-mdm-server/go.sum diff --git a/tools/windows-mdm/poc-mdm-server/identity/identity.crt b/tools/mdm/windows/poc-mdm-server/identity/identity.crt similarity index 100% rename from tools/windows-mdm/poc-mdm-server/identity/identity.crt rename to tools/mdm/windows/poc-mdm-server/identity/identity.crt diff --git a/tools/windows-mdm/poc-mdm-server/identity/identity.key b/tools/mdm/windows/poc-mdm-server/identity/identity.key similarity index 100% rename from tools/windows-mdm/poc-mdm-server/identity/identity.key rename to tools/mdm/windows/poc-mdm-server/identity/identity.key diff --git a/tools/windows-mdm/poc-mdm-server/main.go b/tools/mdm/windows/poc-mdm-server/main.go similarity index 100% rename from tools/windows-mdm/poc-mdm-server/main.go rename to tools/mdm/windows/poc-mdm-server/main.go diff --git a/tools/windows-mdm/poc-mdm-server/mde_discovery.go b/tools/mdm/windows/poc-mdm-server/mde_discovery.go similarity index 100% rename from tools/windows-mdm/poc-mdm-server/mde_discovery.go rename to tools/mdm/windows/poc-mdm-server/mde_discovery.go diff --git a/tools/windows-mdm/poc-mdm-server/mde_enrollment.go b/tools/mdm/windows/poc-mdm-server/mde_enrollment.go similarity index 100% rename from tools/windows-mdm/poc-mdm-server/mde_enrollment.go rename to tools/mdm/windows/poc-mdm-server/mde_enrollment.go diff --git a/tools/windows-mdm/poc-mdm-server/mde_policy.go b/tools/mdm/windows/poc-mdm-server/mde_policy.go similarity index 100% rename from tools/windows-mdm/poc-mdm-server/mde_policy.go rename to tools/mdm/windows/poc-mdm-server/mde_policy.go diff --git a/tools/windows-mdm/poc-mdm-server/mdm_manage.go b/tools/mdm/windows/poc-mdm-server/mdm_manage.go similarity index 93% rename from tools/windows-mdm/poc-mdm-server/mdm_manage.go rename to tools/mdm/windows/poc-mdm-server/mdm_manage.go index 2177ed87a8..63edf18c10 100644 --- a/tools/windows-mdm/poc-mdm-server/mdm_manage.go +++ b/tools/mdm/windows/poc-mdm-server/mdm_manage.go @@ -64,17 +64,29 @@ func getConfigurationProfiles(cmdIDstart int) string { } var syncmlCommands string - for _, file := range files { - cmdIDstart++ + var tokenCmdID string = "xxcmdidxx" - fmt.Printf("\n--------- Command Request %d ---------\n", cmdIDstart) - fmt.Printf("Command payload retrieved from file %s\n", file.Name()) + for _, file := range files { fileContent, err := os.ReadFile(profileDir + "/" + file.Name()) if err != nil { panic(err) } - syncmlCommands += strings.Replace(string(fileContent), "xxcmdidxx", strconv.Itoa(cmdIDstart), -1) + "\n" + fileContentStr := string(fileContent) + nrTokenOcurrences := strings.Count(fileContentStr, tokenCmdID) + for i := 0; i < nrTokenOcurrences; i++ { + cmdIDstart++ + + fmt.Printf("\n--------- Command Request %d ---------\n", cmdIDstart) + fmt.Printf("Command payload retrieved from file %s\n", file.Name()) + + fileContentStr = strings.Replace(fileContentStr, tokenCmdID, strconv.Itoa(cmdIDstart), 1) + } + + if len(fileContentStr) > 0 { + syncmlCommands += fileContentStr + syncmlCommands += "\n" + } } //input sanitization diff --git a/tools/mdm/windows/poc-mdm-server/misc/mdm_ngrok_comm_dump.txt b/tools/mdm/windows/poc-mdm-server/misc/mdm_ngrok_comm_dump.txt new file mode 100644 index 0000000000..c47c1753e1 --- /dev/null +++ b/tools/mdm/windows/poc-mdm-server/misc/mdm_ngrok_comm_dump.txt @@ -0,0 +1,744 @@ +Starting Windows MDM Demo Server +HTTPS server listening on port 443 + + +============================= Input Request ============================= +----------- Input Header ----------- + GET /EnrollmentServer/Discovery.svc HTTP/1.1 +Host: enterpriseenrollment.fleetdm.ngrok.io +Accept-Encoding: gzip +Cache-Control: no-cache +Pragma: no-cache +User-Agent: ENROLLClient +X-Forwarded-For: 186.12.187.37 +X-Forwarded-Proto: https + + +----------- Empty Input Body ----------- +========================================================================= + + + + +============================= Output Response ============================= +----------- Response Header ----------- + HTTP/1.1 200 OK +Connection: close + + +----------- Empty Response Body ----------- +========================================================================= + + + + +============================= Input Request ============================= +----------- Input Header ----------- + POST /EnrollmentServer/Discovery.svc HTTP/1.1 +Host: enterpriseenrollment.fleetdm.ngrok.io +Accept-Encoding: gzip +Content-Length: 1046 +Content-Type: application/soap+xml; charset=utf-8 +User-Agent: ENROLLClient +X-Forwarded-For: 186.12.187.37 +X-Forwarded-Proto: https + + +----------- Input Body ----------- + + + + http://schemas.microsoft.com/windows/management/2012/01/enrollment/IDiscoveryService/Discover + urn:uuid:748132ec-a575-4329-b01b-6171a9cf8478 + + http://www.w3.org/2005/08/addressing/anonymous + + https://EnterpriseEnrollment.fleetdm.ngrok.io:443/EnrollmentServer/Discovery.svc + + + + + demo@fleetdm.ngrok.io + 4.0 + CIMClient_Windows + 10.0.19043.2364 + 72 + + OnPremise + Federated + + + + + +========================================================================= + + + + +============================= Output Response ============================= +----------- Response Header ----------- + HTTP/1.1 200 OK +Content-Length: 1127 +Content-Type: application/soap+xml; charset=utf-8 + + +----------- Response Body ----------- + + + + + http://schemas.microsoft.com/windows/management/2012/01/enrollment/IDiscoveryService/DiscoverResponse + 8c6060c4-3d78-4d73-ae17-e8bce88426ee + + urn:uuid:748132ec-a575-4329-b01b-6171a9cf8478 + + + + + OnPremise + 4.0 + https://windows.fleetdm.ngrok.io/EnrollmentServer/Policy.svc + https://windows.fleetdm.ngrok.io/EnrollmentServer/Enrollment.svc + + + + +========================================================================= + + + + +============================= Input Request ============================= +----------- Input Header ----------- + POST /EnrollmentServer/Policy.svc HTTP/1.1 +Host: windows.fleetdm.ngrok.io +Accept-Encoding: gzip +Content-Length: 1491 +Content-Type: application/soap+xml; charset=utf-8 +User-Agent: ENROLLClient +X-Forwarded-For: 186.12.187.37 +X-Forwarded-Proto: https + + +----------- Input Body ----------- + + + + http://schemas.microsoft.com/windows/pki/2009/01/enrollmentpolicy/IPolicy/GetPolicies + urn:uuid:72048B64-0F19-448F-8C2E-B4C661860AA0 + + http://www.w3.org/2005/08/addressing/anonymous + + https://windows.fleetdm.ngrok.io/EnrollmentServer/Policy.svc + + + demio + demo + + + + + + + + + + + + + +========================================================================= + + + + +============================= Output Response ============================= +----------- Response Header ----------- + HTTP/1.1 200 OK +Content-Length: 1378 +Content-Type: application/soap+xml; charset=utf-8 + + +----------- Response Body ----------- + + + + + http://schemas.microsoft.com/windows/pki/2009/01/enrollmentpolicy/IPolicy/GetPoliciesResponse + urn:uuid:72048B64-0F19-448F-8C2E-B4C661860AA0 + + + + + + + + 3 + + 2048 + + + + + + + + + + 1.3.6.1.4.1.311.20.2 + 1 + 5 + Certificate Template Name + + + + + +========================================================================= + + + + +============================= Input Request ============================= +----------- Input Header ----------- + POST /EnrollmentServer/Enrollment.svc HTTP/1.1 +Host: windows.fleetdm.ngrok.io +Accept-Encoding: gzip +Content-Length: 4291 +Content-Type: application/soap+xml; charset=utf-8 +User-Agent: ENROLLClient +X-Forwarded-For: 186.12.187.37 +X-Forwarded-Proto: https + + +----------- Input Body ----------- + + + + http://schemas.microsoft.com/windows/pki/2009/01/enrollment/RST/wstep + urn:uuid:0d5a1441-5891-453b-becf-a2e5f6ea3749 + + http://www.w3.org/2005/08/addressing/anonymous + + https://windows.fleetdm.ngrok.io/EnrollmentServer/Enrollment.svc + + + demio + demo + + + + + + http://schemas.microsoft.com/5.0.0.0/ConfigurationManager/Enrollment/DeviceEnrollmentToken + http://docs.oasis-open.org/ws-sx/ws-trust/200512/Issue + MIICzjCCAboCAQAwSzFJMEcGA1UEAxNANTYyQTdGOUEtNkNEOC00MEIwLTlFN0UtMERCREQ4IUI1Qjk1NEU4MUZCQ0I5NEVCNzlCRDA4QkU2MjVGNEVFADCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMvnEuvyyF83tC62/ieHRcvwpOQIY3Kb25QeKF+rdipV+D2v7DkSYTKeM/2fThvr/5ul9c68UF9OOjQoaTrX5n83lzfeWMFeU2BHrl7KyxMzlLQtoD0+CNpfn9VKJRpPy0T34QfUpf1n65rzdSxsLAST/aCN4Yx/cAiy0Q2QC4DmumjemVY19gAMFkhSET+axgwij+XS9IQvkxyiZu56uKuRmOGnvhhQO5xfLmI+40FUEB8xwvYYVxxPsqIJ/s26hVtVzHpV32G5fGvfMqcK1oJFm8r2uGhEtnFoJg9SKKhseDbFRJd2yMBC+XlUhF6AQEnmXa+eZQ/drpE1QV7CTJkCAwEAAaBCMEAGCSqGSIb3DQEJDjEzMDEwLwYKKwYBBAGCN0IBAAQhQjVCOTU0RTgxRkJDQjk0RUI3OUJEMDhCRTYyNUY0RUUAMAkGBSsOAwIdBQADggEBABhELIKSCCrNS9BP9cd7EVLjevQooRvbxAC+SnDV9kUJTqascPJR+U5zZVc8eac7jmvCHoE69CYDvdKe9au/Zftq1vRAxFpj8PKpv0ZmaIFiwkjb2VTXKKqCzAGaiQg9ysLbQ8j+3l2CPMYDN0JPTl+nC8GxUSRMfCisyIEcQS3TtYC8p9PnfZJzUEr0SPIV1FBYAO9+FcGpSZXSm4CN6byZORYE0FgEaPoLHQkI2h1PXkYzalJh6Grv/Lc0+6QpbfWVnjjaCm8CATQHuFcL5FuhvlsggRfAtgTYCk69p705y8EINxUJYQRX4npQbPNekZLfbZnRp7hThYvB61iDrkU= + + + true + + + 3B3ED6D0EA88CBFCF37D36F90F22FE61172348C0162FC3840D6703149870CE76 + + + en-US + + + true + + + 72 + + + DESKTOP-28FGAI6 + + + 00-0C-29-51-60-9D + + + 1A-77-20-52-41-53 + + + 1A-77-20-52-41-53 + + + 00-0C-29-51-60-A7 + + + 18-14-20-52-41-53 + + + 00-0C-29-51-60-93 + + + B5B954E81FBCB94EB79BD08BE625F4EE + + + Full + + + CIMClient_Windows + + + 10.0.19043.2364 + + + 10.0.19043.2364 + + + false + + + + + +========================================================================= + + + + +============================= Output Response ============================= +----------- Response Header ----------- + HTTP/1.1 200 OK +Content-Length: 8626 +Content-Type: application/soap+xml; charset=utf-8 + + +----------- Response Body ----------- + + + + + http://schemas.microsoft.com/windows/pki/2009/01/enrollment/RSTRC/wstep + urn:uuid:0d5a1441-5891-453b-becf-a2e5f6ea3749 + + + 2018-11-30T00:32:59.420Z + 2018-12-30T00:37:59.420Z + + + + + + + http://schemas.microsoft.com/5.0.0.0/ConfigurationManager/Enrollment/DeviceEnrollmentToken + + + PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48d2FwLXByb3Zpc2lvbmluZ2RvYyB2ZXJzaW9uPSIxLjEiPjxjaGFyYWN0ZXJpc3RpYyB0eXBlPSJDZXJ0aWZpY2F0ZVN0b3JlIj48Y2hhcmFjdGVyaXN0aWMgdHlwZT0iUm9vdCI+PGNoYXJhY3RlcmlzdGljIHR5cGU9IlN5c3RlbSI+PGNoYXJhY3RlcmlzdGljIHR5cGU9IkQ5QTg4RTA0QUYxOEE0RDM5OUNFRTYyRjJDNzE0NjlDM0FFMUU2NzUiPjxwYXJtIG5hbWU9IkVuY29kZWRDZXJ0aWZpY2F0ZSIgdmFsdWU9Ik1JSUZUakNDQXphZ0F3SUJBZ0lVQU1sQkJEYjU2bUZGVVpPaDM1TW1QVHVWNkpjd0RRWUpLb1pJaHZjTkFRRUxCUUF3UHpFWk1CY0dBMVVFQ2d3UVRXRjBkSEpoZUNCSlpHVnVkR2wwZVRFaU1DQUdBMVVFQXd3WlYybHVaRzkzY3lCTlJFMGdSR1Z0YnlCSlpHVnVkR2wwZVRBZUZ3MHlNVEF4TURNd01qUTBNREphRncweU5EQXhNRE13TWpRME1ESmFNRDh4R1RBWEJnTlZCQW9NRUUxaGRIUnlZWGdnU1dSbGJuUnBkSGt4SWpBZ0JnTlZCQU1NR1ZkcGJtUnZkM01nVFVSTklFUmxiVzhnU1dSbGJuUnBkSGt3Z2dJaU1BMEdDU3FHU0liM0RRRUJBUVVBQTRJQ0R3QXdnZ0lLQW9JQ0FRQytnNjJHaHNFR2U0WGYvNWw4MG1POEZDOHNNWTZxR0MwZEI4YXZjSlhQdVIxTjREUVpBRkhIS2pnTTFMcFk0NVB6eHhTbUQxWTBSZFF3YUpMejAvV1F6c0RBRmhQRTdCeEI1SjBSVU1ZaVg5Yk01cCsyZmlmMFhua2xCUjE2RG5vNi9aeHdsdnZtMW1TN1RQUkZNcUhGZFB5WW0wZVc4RzAxUXBkMWVhVDdKQVhEcjN1a25yeXpmTjUxN3hzaGxJSmhVYUJtTTZRWng2L3UrS3ZhWkRGWmk1akdTekVJVHFFcy8zcFU4UFcvQm1OR1pYUkNWd2NHVGJwSG9IejczVlg3VlNEb1poWTVQNXp0VzUvZ29wOVJEQ0dxU0lJck5rNGJhOTlGd1liTnJPWDVnYktQOHJJN3VEdXBLRVlTaE5xQ250VC9ETjZXTUVSVWhkYkgzVExXeWhMSzhrbmxQTWVOSG9QTjFXK0pSZUowZVk4d0JWUVBHUENxdmJnZ3lYZ1drOTRHT3ExdDhiTmljSkRXVFpaQy9nTzRlV2FyU0RlVEJoRS80TlhWTDF5YVpkVEY0TUdBa1VLN24xYkJWT0MzTFQ4dzFEWWJIc290NmRvUTNEQ1M3NGVia1d6aHNKbjRxLyswUXFZTkREaG5FRWxRYWhvSmtCNEgrWGxLNktIeE9WNlpQQlpaTVRMVHNLTDZXRjgxb1k5N2lEc3hhNTd0d1J5a04raXoyYkxwQlBTa1I4ajU2Nnhhb3U4VGo4T2t5ODZCeG42V25MWUxvWFpld0M0VkhQRFYwUDRHQXVBeXZhWXpyM3owV20ydW9FZDBBT1Eyb3dteTAwNnduWW1yWVF4NGtqUGZVakF0UExjZE9iallvTWszTzNZaE5iUWU0TUtOWDdXL1R3SURBUUFCbzBJd1FEQU9CZ05WSFE4QkFmOEVCQU1DQVFZd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFRmdRVWNsME15cjlpNjAzKytXM3BPMm5WVlZXdmNZc3dEUVlKS29aSWh2Y05BUUVMQlFBRGdnSUJBR01GQXByVmgrK3dXU0NOakl0RkF6bW5qcFRwRmZuVnpQbHZrNXJyU2xrajVTMHlYbk9hU3VOQ25kekhwdURhYzZLd1IwY0NEUVVXNjdnWEgxdUZ3ZTE0MGtOTy92ajkycFFqcUgzTmR4ek51YkE5cXBsRzFqRXN2NXVyNEpWY1NjT002RzlxY2FHUEhTbTRkRFNBazdBUWFDQnV2RUV6Qno3L2o2QTlqS0Y4RHJ4bzU2MkYxb0xIWHVjdTJIU0VuSXJxZWdadDAwbjg3WEpnUXNVTGxoMHB1ejFkRk9FYWNMZHdvM1oxTnpOOUxEamt2Q01NUi9wbFJZVUx1cGhiaEdaL3JkME0wYzdIT0k5MGMyaS82dFlXeDM2TjZiWC9LMTlzQTE1N2ZjY1piQzhFb05iYVI2RlJzUlpQN25RSGtRR204M29kT0cza2tQelJ4b3lTbStIL1ZhM0YyRVZ6VlhRUk9vRHArMktRSThJUmpRMjVwTWxDSCs1Qm5OVmpSMkZ3cHZFU0FKZ0tWZGQ4RkVPQkJPV0dKZ2xaamx3Rm1ZQnVETWE4UnZmeStEU2NMNGxCYTFPMEx1N0xwRjBpNkRyYUZHajBxS3k5SjRkc1FOaXB5elRsR3dpczF1M0E4RFNSbXphNWxzMEtlalQzaXQ5OWQva1A4L2lVam5XOVdvSDRYcVZMMHlCaDUzMExCV1F3QktBck5zenRSNzAvT01mQ0ZnbWFVOEN3VGdrU0dQNFdyK0UzVXd1QWxhQThnWERTYndmM2x4OGlnTUpmRGtPVDVxNWNrb3BNcHpCMGJrbVhVVk9YcUVCRjVwOTA2c3o1UmNzdTRkNnMwZDQ1MnVPSTJnQTBGOXVrWEFKd1A4UTVlUS9PSnBwanF1S1ByQzJnSzhRTDB1THIiIC8+PC9jaGFyYWN0ZXJpc3RpYz48L2NoYXJhY3RlcmlzdGljPjwvY2hhcmFjdGVyaXN0aWM+PGNoYXJhY3RlcmlzdGljIHR5cGU9Ik15Ij48Y2hhcmFjdGVyaXN0aWMgdHlwZT0iVXNlciI+PGNoYXJhY3RlcmlzdGljIHR5cGU9IjhGMkVCRDEzRjM2MTJEN0M0OEMzMEUyNENDNzNBODg0OTI2MTM4NDkiPjxwYXJtIG5hbWU9IkVuY29kZWRDZXJ0aWZpY2F0ZSIgdmFsdWU9Ik1JSUVMVENDQWhXZ0F3SUJBZ0lCQWpBTkJna3Foa2lHOXcwQkFRVUZBREEvTVJrd0Z3WURWUVFLREJCTllYUjBjbUY0SUVsa1pXNTBhWFI1TVNJd0lBWURWUVFEREJsWGFXNWtiM2R6SUUxRVRTQkVaVzF2SUVsa1pXNTBhWFI1TUI0WERUSXpNREV5TXpJeE1EYzBObG9YRFRJME1ERXlNekl4TURjME5sb3dLekVwTUNjR0ExVUVBeE1nUWpWQ09UVTBSVGd4UmtKRFFqazBSVUkzT1VKRU1EaENSVFl5TlVZMFJVVXdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCRHdBd2dnRUtBb0lCQVFETDV4THI4c2hmTjdRdXR2NG5oMFhMOEtUa0NHTnltOXVVSGloZnEzWXFWZmc5cit3NUVtRXlualA5bjA0YjYvK2JwZlhPdkZCZlRqbzBLR2s2MStaL041YzMzbGpCWGxOZ1I2NWV5c3NUTTVTMExhQTlQZ2phWDUvVlNpVWFUOHRFOStFSDFLWDlaK3VhODNVc2JDd0VrLzJnamVHTWYzQUlzdEVOa0F1QTVycG8zcGxXTmZZQURCWklVaEUvbXNZTUlvL2wwdlNFTDVNY29tYnVlcmlya1pqaHA3NFlVRHVjWHk1aVB1TkJWQkFmTWNMMkdGY2NUN0tpQ2Y3TnVvVmJWY3g2VmQ5aHVYeHIzektuQ3RhQ1Jadks5cmhvUkxaeGFDWVBVaWlvYkhnMnhVU1hkc2pBUXZsNVZJUmVnRUJKNWwydm5tVVAzYTZSTlVGZXdreVpBZ01CQUFHalNEQkdNQTRHQTFVZER3RUIvd1FFQXdJSGdEQVRCZ05WSFNVRUREQUtCZ2dyQmdFRkJRY0RBakFmQmdOVkhTTUVHREFXZ0JSeVhRekt2MkxyVGY3NWJlazdhZFZWVmE5eGl6QU5CZ2txaGtpRzl3MEJBUVVGQUFPQ0FnRUFpbE5JSXd1VnNlQWI2ZmJ3VnE2NDUyK1JZbWlFU2p5ZVppbWY0cjB6WDZNL2l5L0NzQXc1a1hUdmt2elh6MGtzOVJTdkZuMGtPR2xxSzZZYUQ4VUhmY3pRVmNmYjh3ZjhmTXBUNjhUUlNrTVY5UHFNZmh0TnFrZExGV3VOb1hTYUdYdWRWb1UyOFJpb01VVTFuZzV1TE1UaE5OUGg3c1J1SG9aSjlTYldQU09IZGVVQm0vempacFUyNmxncFgwTDBCN2RQNlN1ajBiemdqVEpENzZmK1ltcUJLR0orM3N2ZW1oY1J2TGNaZ3lCWjJwUEwvVW8xSTl3bEhpS1h4cWpBRVdxU3dibVh6blJoSnFmb1VoeC80WW5FSEZ6R25BTVB5RlNRL21kS1RvMzVJWTJZZWgvMy9hYXpuRWFOZ292K0QxWWhuc2N5Vk04bXhKV2lOUjJkTFZMWklIWWFlbFZVNmZKa0pZeDNyaHdGaVRrVzhhM3kzeml1Y3JOYVRFcGQzYURNSjZLMUM4bzIrdjI0STZYeVE2Nkk1cWpWRVZkclZmK2tCQm5zd3BOd3BxM0NoN2VDZHZIVytXTWU5M2R0S1Y0YjFxNkY3WVFkeXA2ampqNTJsUzM2NnRBQjhjMERGSVhvRnZ4MHhCYVdRbHpnc3FkL2VKbjcxNHpaVG96VUI1anhqcUJEUnZjQXVEdkkzZTN5eUlxRHVsN2lGME1jbklSWXZpVWorSUxZUTZiKysxT2pDWGxwZU5pZXhWQTZqS0RPNEdMdlE4TkZjSllKa0FLQ3NJQXZDTmV5eGpuWlBpcElrYm1Vcjg4NDI3WWdMbjh5ajdqbDFFNEdBRzdGOFFCa2FuRDUwdlp6QjZGdnVDOWdnY29DY21NYVhYZ2tzdmwxWjRBVVZrdz0iIC8+PC9jaGFyYWN0ZXJpc3RpYz48Y2hhcmFjdGVyaXN0aWMgdHlwZT0iUHJpdmF0ZUtleUNvbnRhaW5lciIgLz48L2NoYXJhY3RlcmlzdGljPjwvY2hhcmFjdGVyaXN0aWM+PC9jaGFyYWN0ZXJpc3RpYz48Y2hhcmFjdGVyaXN0aWMgdHlwZT0iQVBQTElDQVRJT04iPjxwYXJtIG5hbWU9IkFQUElEIiB2YWx1ZT0idzciIC8+PHBhcm0gbmFtZT0iUFJPVklERVItSUQiIHZhbHVlPSJERU1PIE1ETSIgLz48cGFybSBuYW1lPSJOQU1FIiB2YWx1ZT0iRmxlZXRETSBEZW1vIFNlcnZlciAtIFdpbmRvd3MiIC8+PHBhcm0gbmFtZT0iQUREUiIgdmFsdWU9Imh0dHBzOi8vd2luZG93cy5mbGVldGRtLm5ncm9rLmlvL01hbmFnZW1lbnRTZXJ2ZXIvTURNLnN2YyIgLz48cGFybSBuYW1lPSJTZXJ2ZXJMaXN0IiB2YWx1ZT0iaHR0cHM6Ly93aW5kb3dzLmZsZWV0ZG0ubmdyb2suaW8vTWFuYWdlbWVudFNlcnZlci9TZXJ2ZXJMaXN0LnN2YyIgLz48cGFybSBuYW1lPSJST0xFIiB2YWx1ZT0iNDI5NDk2NzI5NSIgLz48cGFybSBuYW1lPSJCQUNLQ09NUEFUUkVUUllESVNBQkxFRCIgLz48cGFybSBuYW1lPSJERUZBVUxURU5DT0RJTkciIHZhbHVlPSJhcHBsaWNhdGlvbi92bmQuc3luY21sLmRtK3htbCIgLz48Y2hhcmFjdGVyaXN0aWMgdHlwZT0iQVBQQVVUSCI+PHBhcm0gbmFtZT0iQUFVVEhMRVZFTCIgdmFsdWU9IkNMSUVOVCIgLz48cGFybSBuYW1lPSJBQVVUSFRZUEUiIHZhbHVlPSJESUdFU1QiIC8+PHBhcm0gbmFtZT0iQUFVVEhTRUNSRVQiIHZhbHVlPSJkdW1teSIgLz48cGFybSBuYW1lPSJBQVVUSERBVEEiIHZhbHVlPSJub25jZSIgLz48L2NoYXJhY3RlcmlzdGljPjxjaGFyYWN0ZXJpc3RpYyB0eXBlPSJBUFBBVVRIIj48cGFybSBuYW1lPSJBQVVUSExFVkVMIiB2YWx1ZT0iQVBQU1JWIiAvPjxwYXJtIG5hbWU9IkFBVVRIVFlQRSIgdmFsdWU9IkRJR0VTVCIgLz48cGFybSBuYW1lPSJBQVVUSE5BTUUiIHZhbHVlPSJkdW1teSIgLz48cGFybSBuYW1lPSJBQVVUSFNFQ1JFVCIgdmFsdWU9ImR1bW15IiAvPjxwYXJtIG5hbWU9IkFBVVRIREFUQSIgdmFsdWU9Im5vbmNlIiAvPjwvY2hhcmFjdGVyaXN0aWM+PC9jaGFyYWN0ZXJpc3RpYz48Y2hhcmFjdGVyaXN0aWMgdHlwZT0iRE1DbGllbnQiPjxjaGFyYWN0ZXJpc3RpYyB0eXBlPSJQcm92aWRlciI+PGNoYXJhY3RlcmlzdGljIHR5cGU9IkRFTU8gTURNIj48Y2hhcmFjdGVyaXN0aWMgdHlwZT0iUG9sbCI+PHBhcm0gbmFtZT0iTnVtYmVyT2ZGaXJzdFJldHJpZXMiIHZhbHVlPSI4IiBkYXRhdHlwZT0iaW50ZWdlciIgLz48L2NoYXJhY3RlcmlzdGljPjwvY2hhcmFjdGVyaXN0aWM+PC9jaGFyYWN0ZXJpc3RpYz48L2NoYXJhY3RlcmlzdGljPjwvd2FwLXByb3Zpc2lvbmluZ2RvYz4= + + + 0 + + + + + +========================================================================= + + + + +============================= Input Request ============================= +----------- Input Header ----------- + POST /ManagementServer/MDM.svc?mode=Maintenance&Platform=WoA HTTP/1.1 +Host: windows.fleetdm.ngrok.io +Accept: application/vnd.syncml.dm+xml, application/vnd.syncml.dm+wbxml, application/octet-stream +Accept-Charset: UTF-8 +Accept-Encoding: gzip +Client-Request-Id: 0 +Content-Length: 1001 +Content-Type: application/vnd.syncml.dm+xml +Ms-Cv: OTrP9+n7GU+OcSEg.0.0.0 +User-Agent: MSFT OMA DM Client/1.2.0.1 +X-Forwarded-For: 186.12.187.37 +X-Forwarded-Proto: https + + +----------- Input Body ----------- + + + + 1.2 + DM/1.2 + 1 + 1 + + https://windows.fleetdm.ngrok.io/ManagementServer/MDM.svc + + + B5B954E81FBCB94EB79BD08BE625F4EE + + + + + 2 + 1201 + + + 3 + 1224 + + + com.microsoft/MDM/LoginStatus + + user + + + + 4 + + + ./DevInfo/DevId + + B5B954E81FBCB94EB79BD08BE625F4EE + + + + ./DevInfo/Man + + VMware, Inc. + + + + ./DevInfo/Mod + + VMware7,1 + + + + ./DevInfo/DmV + + 1.3 + + + + ./DevInfo/Lang + + en-US + + + + + +========================================================================= + + + +========= New OMA-DM session from Windows Host 186.12.187.37 (MSFT OMA DM Client/1.2.0.1) ========= + + +============================= Output Response ============================= +----------- Response Header ----------- + HTTP/1.1 200 OK +Content-Length: 1075 +Content-Type: application/vnd.syncml.dm+xml + + +----------- Response Body ----------- + + + + + 1.2 + DM/1.2 + 1 + 1 + + B5B954E81FBCB94EB79BD08BE625F4EE + + + https://windows.fleetdm.ngrok.io/ManagementServer/MDM.svc + + + + + 1 + 1 + 0 + SyncHdr + 200 + + + 2 + 1 + 2 + Alert + 200 + + + 3 + 1 + 3 + Alert + 200 + + + 4 + 1 + 4 + Replace + 200 + + + + +========================================================================= + + + + +============================= Input Request ============================= +----------- Input Header ----------- + POST /ManagementServer/MDM.svc?mode=Maintenance&Platform=WoA HTTP/1.1 +Host: windows.fleetdm.ngrok.io +Accept: application/vnd.syncml.dm+xml, application/vnd.syncml.dm+wbxml, application/octet-stream +Accept-Charset: UTF-8 +Accept-Encoding: gzip +Content-Length: 1208 +Content-Type: application/vnd.syncml.dm+xml +Ms-Cv: OTrP9+n7GU+OcSEg.0.0.1 +User-Agent: MSFT OMA DM Client/1.2.0.1 +X-Forwarded-For: 186.12.187.37 +X-Forwarded-Proto: https + + +----------- Input Body ----------- + + + + 1.2 + DM/1.2 + 2 + 1 + + https://windows.fleetdm.ngrok.io/ManagementServer/MDM.svc + + + B5B954E81FBCB94EB79BD08BE625F4EE + + + + + 2 + 1201 + + + 3 + 1224 + + + com.microsoft/MDM/LoginStatus + + user + + + + 4 + 1226 + + + com.microsoft:mdm.unenrollment.userrequest + int + + 1 + + + + 5 + + + ./DevInfo/DevId + + B5B954E81FBCB94EB79BD08BE625F4EE + + + + ./DevInfo/Man + + VMware, Inc. + + + + ./DevInfo/Mod + + VMware7,1 + + + + ./DevInfo/DmV + + 1.3 + + + + ./DevInfo/Lang + + en-US + + + + + +========================================================================= + + + +Windows Device at 186.12.187.37 was removed from MDM! + + + 2 + + + + + + + 1201 + + + 3 + + + + + + + 1224 + + + com.microsoft/MDM/LoginStatus + + + + + user + + + + 4 + + + + + + + 1226 + + + com.microsoft:mdm.unenrollment.userrequest + + + + + 1 + + + + 5 + + + + + + + + + + + + ./DevInfo/DevId + + B5B954E81FBCB94EB79BD08BE625F4EE + + + + + + + ./DevInfo/Man + + VMware, Inc. + + + + + + + ./DevInfo/Mod + + VMware7,1 + + + + + + + ./DevInfo/DmV + + 1.3 + + + + + + + ./DevInfo/Lang + + en-US + + + + +============================= Output Response ============================= +----------- Response Header ----------- + HTTP/1.1 200 OK +Content-Length: 623 +Content-Type: application/vnd.syncml.dm+xml + + +----------- Response Body ----------- + + + + + 1.2 + DM/1.2 + 2 + 1 + + B5B954E81FBCB94EB79BD08BE625F4EE + + + https://windows.fleetdm.ngrok.io/ManagementServer/MDM.svc + + + + + 1 + 1 + 0 + SyncHdr + 200 + + + + +========================================================================= + + diff --git a/tools/windows-mdm/poc-mdm-server/patch/patch.go b/tools/mdm/windows/poc-mdm-server/patch/patch.go similarity index 100% rename from tools/windows-mdm/poc-mdm-server/patch/patch.go rename to tools/mdm/windows/poc-mdm-server/patch/patch.go diff --git a/tools/windows-mdm/poc-mdm-server/sample_syncml_commands/replace_personalization_desktop_image_url.xml b/tools/mdm/windows/poc-mdm-server/profile/replace_personalization_desktop_image_url.xml similarity index 100% rename from tools/windows-mdm/poc-mdm-server/sample_syncml_commands/replace_personalization_desktop_image_url.xml rename to tools/mdm/windows/poc-mdm-server/profile/replace_personalization_desktop_image_url.xml diff --git a/tools/mdm/windows/poc-mdm-server/sample_syncml_commands/atomic_install_msi.xml b/tools/mdm/windows/poc-mdm-server/sample_syncml_commands/atomic_install_msi.xml new file mode 100644 index 0000000000..6c38750699 --- /dev/null +++ b/tools/mdm/windows/poc-mdm-server/sample_syncml_commands/atomic_install_msi.xml @@ -0,0 +1,24 @@ + + 7 + + 5 + + + ./Device/Vendor/MSFT/EnterpriseDesktopAppManagement/MSI/%7B90413BF7-7D99-482E-A7FB-C6616CC871FC%7D/DownloadInstall + + + + + 6 + + + ./Device/Vendor/MSFT/EnterpriseDesktopAppManagement/MSI/%7B90413BF7-7D99-482E-A7FB-C6616CC871FC%7D/DownloadInstall + + + xml + text/plain + + <MsiInstallJob id="{90413BF7-7D99-482E-A7FB-C6616CC871FC}"><Product Version="1.4.0"><Download><ContentURLList><ContentURL>https://mdmwindows.com/static/fleet-osquery.msi</ContentURL></ContentURLList></Download><Validation><FileHash>3B9FD63248465A51500D41DECC794D1149506EB48EEF9D7A733516B482D16ABB</FileHash></Validation><Enforcement><CommandLine>/quiet</CommandLine><RetryCount>5</RetryCount><RetryInterval>3</RetryInterval></Enforcement></Product></MsiInstallJob> + + + \ No newline at end of file diff --git a/tools/mdm/windows/poc-mdm-server/sample_syncml_commands/disable_date_time.xml b/tools/mdm/windows/poc-mdm-server/sample_syncml_commands/disable_date_time.xml new file mode 100644 index 0000000000..eed2a02c1e --- /dev/null +++ b/tools/mdm/windows/poc-mdm-server/sample_syncml_commands/disable_date_time.xml @@ -0,0 +1,13 @@ + + xxcmdidxx + + + ./Device/Vendor/MSFT/Policy/Config/Settings/AllowDateTime + + + int + text/plain + + 0 + + \ No newline at end of file diff --git a/tools/mdm/windows/poc-mdm-server/sample_syncml_commands/disable_defender_realtime_scanning.xml b/tools/mdm/windows/poc-mdm-server/sample_syncml_commands/disable_defender_realtime_scanning.xml new file mode 100644 index 0000000000..bcc1d35ea1 --- /dev/null +++ b/tools/mdm/windows/poc-mdm-server/sample_syncml_commands/disable_defender_realtime_scanning.xml @@ -0,0 +1,13 @@ + + xxcmdidxx + + + ./Device/Vendor/MSFT/Policy/Config/Defender/AllowRealtimeMonitoring + + + int + text/plain + + 0 + + \ No newline at end of file diff --git a/tools/mdm/windows/poc-mdm-server/sample_syncml_commands/disable_firewall.xml b/tools/mdm/windows/poc-mdm-server/sample_syncml_commands/disable_firewall.xml new file mode 100644 index 0000000000..606804e859 --- /dev/null +++ b/tools/mdm/windows/poc-mdm-server/sample_syncml_commands/disable_firewall.xml @@ -0,0 +1,13 @@ + + xxcmdidxx + + + ./Vendor/MSFT/Firewall/MdmStore/PrivateProfile/EnableFirewall + + + bool + text/plain + + false + + \ No newline at end of file diff --git a/tools/mdm/windows/poc-mdm-server/sample_syncml_commands/get_all_installed_certificates.xml b/tools/mdm/windows/poc-mdm-server/sample_syncml_commands/get_all_installed_certificates.xml new file mode 100644 index 0000000000..ffda20da09 --- /dev/null +++ b/tools/mdm/windows/poc-mdm-server/sample_syncml_commands/get_all_installed_certificates.xml @@ -0,0 +1,8 @@ + + xxcmdidxx + + + ./Vendor/MSFT/CertificateStore/Root/System?list=StructData + + + \ No newline at end of file diff --git a/tools/windows-mdm/poc-mdm-server/sample_syncml_commands/get_csp_versions.xml b/tools/mdm/windows/poc-mdm-server/sample_syncml_commands/get_csp_versions.xml similarity index 100% rename from tools/windows-mdm/poc-mdm-server/sample_syncml_commands/get_csp_versions.xml rename to tools/mdm/windows/poc-mdm-server/sample_syncml_commands/get_csp_versions.xml diff --git a/tools/windows-mdm/poc-mdm-server/sample_syncml_commands/get_device_name.xml b/tools/mdm/windows/poc-mdm-server/sample_syncml_commands/get_device_name.xml similarity index 100% rename from tools/windows-mdm/poc-mdm-server/sample_syncml_commands/get_device_name.xml rename to tools/mdm/windows/poc-mdm-server/sample_syncml_commands/get_device_name.xml diff --git a/tools/windows-mdm/poc-mdm-server/sample_syncml_commands/get_hardware_version.xml b/tools/mdm/windows/poc-mdm-server/sample_syncml_commands/get_hardware_version.xml similarity index 88% rename from tools/windows-mdm/poc-mdm-server/sample_syncml_commands/get_hardware_version.xml rename to tools/mdm/windows/poc-mdm-server/sample_syncml_commands/get_hardware_version.xml index 8f1eba04e5..d83fdfe44d 100644 --- a/tools/windows-mdm/poc-mdm-server/sample_syncml_commands/get_hardware_version.xml +++ b/tools/mdm/windows/poc-mdm-server/sample_syncml_commands/get_hardware_version.xml @@ -1,4 +1,4 @@ - + xxcmdidxx diff --git a/tools/windows-mdm/poc-mdm-server/sample_syncml_commands/get_local_time.xml b/tools/mdm/windows/poc-mdm-server/sample_syncml_commands/get_local_time.xml similarity index 100% rename from tools/windows-mdm/poc-mdm-server/sample_syncml_commands/get_local_time.xml rename to tools/mdm/windows/poc-mdm-server/sample_syncml_commands/get_local_time.xml diff --git a/tools/windows-mdm/poc-mdm-server/sample_syncml_commands/get_os_platform.xml b/tools/mdm/windows/poc-mdm-server/sample_syncml_commands/get_os_platform.xml similarity index 100% rename from tools/windows-mdm/poc-mdm-server/sample_syncml_commands/get_os_platform.xml rename to tools/mdm/windows/poc-mdm-server/sample_syncml_commands/get_os_platform.xml diff --git a/tools/windows-mdm/poc-mdm-server/sample_syncml_commands/get_software_version.xml b/tools/mdm/windows/poc-mdm-server/sample_syncml_commands/get_software_version.xml similarity index 100% rename from tools/windows-mdm/poc-mdm-server/sample_syncml_commands/get_software_version.xml rename to tools/mdm/windows/poc-mdm-server/sample_syncml_commands/get_software_version.xml diff --git a/tools/windows-mdm/poc-mdm-server/sample_syncml_commands/get_total_storage.xml b/tools/mdm/windows/poc-mdm-server/sample_syncml_commands/get_total_storage.xml similarity index 100% rename from tools/windows-mdm/poc-mdm-server/sample_syncml_commands/get_total_storage.xml rename to tools/mdm/windows/poc-mdm-server/sample_syncml_commands/get_total_storage.xml diff --git a/tools/mdm/windows/poc-mdm-server/sample_syncml_commands/install_orbit.xml b/tools/mdm/windows/poc-mdm-server/sample_syncml_commands/install_orbit.xml new file mode 100644 index 0000000000..1598df900e --- /dev/null +++ b/tools/mdm/windows/poc-mdm-server/sample_syncml_commands/install_orbit.xml @@ -0,0 +1,38 @@ + + xxcmdidxx + + + ./Device/Vendor/MSFT/EnterpriseDesktopAppManagement/MSI/%7B90413bf7-7d99-482e-a7fb-c6616cc871fc%7D/DownloadInstall + + + + + xxcmdidxx + + + ./Device/Vendor/MSFT/EnterpriseDesktopAppManagement/MSI/%7B90413bf7-7d99-482e-a7fb-c6616cc871fc%7D/DownloadInstall + + <MsiInstallJob id="{90413bf7-7d99-482e-a7fb-c6616cc871fc}"> + <Product Version="1.0.0.0"> + <Download> + <ContentURLList> + <ContentURL>https://mdmwindows.com/static/fleet-osquery.msi</ContentURL> + </ContentURLList> + </Download> + <Validation> + <FileHash>3B9FD63248465A51500D41DECC794D1149506EB48EEF9D7A733516B482D16ABB</FileHash> + </Validation> + <Enforcement> + <CommandLine>/quiet</CommandLine> + <TimeOut>10</TimeOut> + <RetryCount>1</RetryCount> + <RetryInterval>5</RetryInterval> + </Enforcement> + </Product> + </MsiInstallJob> + + text/plain + xml + + + \ No newline at end of file diff --git a/tools/mdm/windows/poc-mdm-server/sample_syncml_commands/replace_personalization_desktop_image_url.xml b/tools/mdm/windows/poc-mdm-server/sample_syncml_commands/replace_personalization_desktop_image_url.xml new file mode 100644 index 0000000000..8cf6d4d389 --- /dev/null +++ b/tools/mdm/windows/poc-mdm-server/sample_syncml_commands/replace_personalization_desktop_image_url.xml @@ -0,0 +1,13 @@ + + xxcmdidxx + + + ./Vendor/MSFT/Personalization/DesktopImageUrl + + + chr + text/plain + + https://fleetdm.com/images/articles/fleet-4.24.0-cover-1600x900@2x.jpg + + \ No newline at end of file diff --git a/tools/windows-mdm/poc-mdm-server/sample_syncml_commands/replace_personalization_lock_screen_image_url.xml b/tools/mdm/windows/poc-mdm-server/sample_syncml_commands/replace_personalization_lock_screen_image_url.xml similarity index 100% rename from tools/windows-mdm/poc-mdm-server/sample_syncml_commands/replace_personalization_lock_screen_image_url.xml rename to tools/mdm/windows/poc-mdm-server/sample_syncml_commands/replace_personalization_lock_screen_image_url.xml diff --git a/tools/windows-mdm/poc-mdm-server/static/hello.txt b/tools/mdm/windows/poc-mdm-server/static/hello.txt similarity index 100% rename from tools/windows-mdm/poc-mdm-server/static/hello.txt rename to tools/mdm/windows/poc-mdm-server/static/hello.txt diff --git a/tools/mdm/windows/programmatic-enrollment/main.go b/tools/mdm/windows/programmatic-enrollment/main.go new file mode 100644 index 0000000000..68606595fb --- /dev/null +++ b/tools/mdm/windows/programmatic-enrollment/main.go @@ -0,0 +1,153 @@ +//go:build windows +// +build windows + +package testenroll + +import ( + "errors" + "flag" + "fmt" + "os" + "syscall" + "unsafe" + + "golang.org/x/sys/windows" +) + +var ( + modmdmregistration *windows.LazyDLL = windows.NewLazySystemDLL("mdmregistration.dll") + + procIsDeviceRegisteredWithManagement *windows.LazyProc = modmdmregistration.NewProc("IsDeviceRegisteredWithManagement") + procRegisterDeviceWithManagement *windows.LazyProc = modmdmregistration.NewProc("RegisterDeviceWithManagement") +) + +const ( + maxBufSize = 2048 // Max Unicode Length for UPN - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adls/63f5e067-d1b3-4e6e-9e53-a92953b6005b +) + +// checking for administrator rights +func checkForAdmin() bool { + f, err := os.Open("\\\\.\\PHYSICALDRIVE0") + if err != nil { + return false + } + + f.Close() + + return true +} + +// builtin utf16tostring string expects a uint16 array but we have a pointer to a uint16 +// so we need to cast it after converting it to an unsafe pointer +// this is a common pattern though the buffer size varies +// see https://golang.org/pkg/unsafe/#Pointer for more details +func localUTF16toString(ptr unsafe.Pointer) (string, error) { + if ptr == nil { + return "", errors.New("failed UTF16 conversion due to null pointer") + } else { + uint16ptrarr := (*[maxBufSize]uint16)(ptr)[:] + return windows.UTF16ToString(uint16ptrarr), nil + } +} + +// getting the MDM enrollment status by calling into OS API IsDeviceRegisteredWithManagement() +func getEnrollmentInfo() (uint32, string, error) { + // variable to hold the MDM enrollment status + var isDeviceRegisteredWithMDM uint32 = 0 + + // heap-allocated buffer to hold the URI data + buffUriData := make([]uint16, 0, maxBufSize) + if buffUriData == nil { + return 0, "", errors.New("failed to allocate memory for URI data") + } + + // IsDeviceRegisteredWithManagement is going to return the MDM enrollment status + // https://learn.microsoft.com/en-us/windows/win32/api/mdmregistration/nf-mdmregistration-isdeviceregisteredwithmanagement + if returnCode, _, err := procIsDeviceRegisteredWithManagement.Call(uintptr(unsafe.Pointer(&isDeviceRegisteredWithMDM)), maxBufSize, uintptr(unsafe.Pointer(&buffUriData))); returnCode != uintptr(windows.ERROR_SUCCESS) { + return 0, "", fmt.Errorf("there was an error calling IsDeviceRegisteredWithManagement(): %s (0x%X)", err, returnCode) + } else { + + uriData, err := localUTF16toString(unsafe.Pointer(&buffUriData)) + if err != nil { + return 0, "", err + } + + return isDeviceRegisteredWithMDM, uriData, nil + } +} + +// Perform the host MDM enrollment process using MS-MDE protocol +// https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-mde/5c841535-042e-489e-913c-9d783d741267 +func enrollHostToMDM(mdmDiscoveryEndpoint string, mdmUpnUser string) (bool, error) { + // converting go server discovery endpoint string into UTF16 windows string + inputDiscoveryEndpoint := syscall.StringToUTF16Ptr(mdmDiscoveryEndpoint) + + // converting go upn user string into UTF16 windows string + inputMdmUPN := syscall.StringToUTF16Ptr(mdmUpnUser) + + // converting go csr string into UTF16 windows string + // passing empty value to force MDM OS stack to generate a CSR for us + // See here for details of CSR generation https://github.com/Gerenios/AADInternals/blob/2efc23e28dc66135d37eca117f456c64b2e48ea9/MDM_utils.ps1#L84 + // CN should be | + // DeviceClientId value is located at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Provisioning\OMADM\MDMDeviceID + var encodedB64 string = "" + inputCSRreq := syscall.StringToUTF16Ptr(encodedB64) + + // RegisterDeviceWithManagement() registers a device with a MDM service + + // https://learn.microsoft.com/en-us/windows/win32/api/mdmregistration/nf-mdmregistration-registerdevicewithmanagement + if returnCode, _, err := procRegisterDeviceWithManagement.Call(uintptr(unsafe.Pointer(inputMdmUPN)), uintptr(unsafe.Pointer(inputDiscoveryEndpoint)), uintptr(unsafe.Pointer(inputCSRreq))); returnCode != uintptr(windows.ERROR_SUCCESS) { + return false, fmt.Errorf("there was an error calling RegisterDeviceWithManagement(): %s (0x%X)", err, returnCode) + } + + return true, nil +} + +func main() { + targetDiscoveryUrl := flag.String("discovery-url", "", "Target MDM discovery webservice url") + targetUserEmail := flag.String("upn-email", "", "Target email to enroll server") + + flag.Usage = func() { + w := flag.CommandLine.Output() + + fmt.Fprintf(w, "Available Command Line Options\n") + flag.PrintDefaults() + + fmt.Fprintf(w, "\nExample Usage\n%s -discovery-url -upn-email \n", os.Args[0]) + fmt.Fprintf(w, "%s -discovery-url https://mdmwindows.com/EnrollmentServer/Discovery.svc -upn-email demo@mdmwindows.com\n", os.Args[0]) + } + + flag.Parse() + + if len(*targetDiscoveryUrl) == 0 || len(*targetUserEmail) == 0 { + fmt.Printf("There was a problem with provided arguments.") + os.Exit(1) + } + + // Checking if running with admin rights + if !checkForAdmin() { + fmt.Printf("You should have Administrator rights to run the tool.") + os.Exit(1) + } + + // Checking if host is already enrolled + enrollmentStatus, enrollmentUser, err := getEnrollmentInfo() + if err != nil { + fmt.Print(err) + os.Exit(1) + } + + if enrollmentStatus != 0 { + fmt.Printf("Host is already enrolled through user: %s\n", enrollmentUser) + os.Exit(1) + } + + // Perform the actual enrollment + hostEnrolled, err := enrollHostToMDM(*targetDiscoveryUrl, *targetUserEmail) + + if hostEnrolled { + fmt.Printf("Host was successfully enrolled into MDM server %s through user %s\n", *targetDiscoveryUrl, *targetUserEmail) + } else { + fmt.Printf(" There was a problem enrolling into MDM server %s through user %s - Error %s\n", *targetDiscoveryUrl, *targetUserEmail, err) + } +} diff --git a/tools/windows-mdm/poc-mdm-server/certs/dev_cert_mdmwindows_com.key b/tools/windows-mdm/poc-mdm-server/certs/dev_cert_mdmwindows_com.key deleted file mode 100644 index 2b98e1d218..0000000000 --- a/tools/windows-mdm/poc-mdm-server/certs/dev_cert_mdmwindows_com.key +++ /dev/null @@ -1,27 +0,0 @@ ------BEGIN RSA PRIVATE KEY----- -MIIEpAIBAAKCAQEA1RuIhpHWDudu07FfJ2bTAzm8DaD5F9WSxC8cKm6OCttN7tIj -FzyayThorwTZ37+VeJMZ7/bP/bqxTkF7Y59geEsFlDnLvQWm2Hh4f79MV08cWx/T -B3Wqgk6jPfr0dS2sQZv+JiS6/OR0BCTpUPZwM7eQiN3SoPDZEibIaLt53ECVc8ze -mD8cHrNmCk8HIWOmhzP5UzM21pXy8JOo2aEql6iVBoUa0QVfJVX9EHDPnmJmeA6f -d0uDZTvi8YSj+GqcmcBmGTe/rbpfaJjPiaXce0bF2JKjmK38bjgK29fHoEZ+Scw3 -ul160fxMV1bBhIcaJt+uEQyOKkdqLYPZ+lZ+yQIDAQABAoIBAHbGfMZ8G/F8njGQ -53b/gVaH5D84W/0jxURg+XLQ4Yw9hOc56eL2nVLPhNEfhAuILVfhrRAo4O4LEu2J -46q31r3VGovt1pdIwiBerNKOnY8AAc7sIuNCesFb8PIHoB57UUnUFsfNqwZukhcJ -N50vbYP1qLIP6GhZNLNAOGzfKOFPfTA1hpgXkUAYFUC6D5DwIMNuxX/5QYjAw8fK -e0NsehjuzTb+HckazvB/B0SpPZyezQrpJU5AEWzxQgcL+Qx5BdcOPyR83vdH8PoJ -83uj4FhNA16dHmo87AGe6d2FncadCoLpxjcJgjctqcDnJFdAdPcJOcA76qYeDh4E -nkSali0CgYEA4POeRx1RnUI7YN1b4JwY8qTj8ucMTaZk/Kjb1BPXX5rqC6Vx7I4N -UNCLNvPn6U/1W9NXzijamyddxcNtHcy8jXqlYawOebE3MAZvayBlC4yPYCd230LJ -ADl5auQeNj2ktJbJwYgZQcwnMEu3SGYIMvy96pKdWilUenPbfO9pj/cCgYEA8oVr -W17vQJX+8hmItcnqEHoCFXi2hM/vKZCHF/MrknJcpANTo7rRQaxn3xIqZRkt6xJz -vp5yl20pzl/KDSMxLd4H51fKy6Fzk0hvFpdqbsxLidu+rf1o3Nice6WBLqz+XMtV -i/dTqvD9b+CVmnoVmwVHoAja2QTZCAQnLGqCNz8CgYEAwZ7PGFTS/7GXXEuLnmud -SZTFozhdraRP/ez1sbgWQ/MaCkYwJbUrHukxOm57qaUqAgyJ4ifl6W/b1bHdBK5J -iNkM6mHm37W6U7rmQeXTMzqb2d5+AbMBQRE3QdrxaixqzQmQxOR5INowzPAO5OD1 -o7VJXlMt3wH99ZwtSn7jdIcCgYEAzxEDfNwtwyNOrj8G7tAbPT4vEU4j6HnxZbe0 -4MoK5dsnJhKBE0aq7Dvb5CaKdA9vmUoD8Tkv9gKKs14uEdF+Z/8vGGNpDzwmhhZO -YyedBEUCKg6pW70GD6oS0a+aANRLyccCn6LomQdyHFfQ5Dhgwh9b7FQjJzBwbdu9 -5rp5u9kCgYA1KZWTkSxjUEycTNKgQz4MKFCEbYkm8B6lfAY5GYhTI1fsoympgd4d -RYmQUuhHrLHP4s85NOSoRdrMD8MiRyhHna+FoaqIEIW5ErMkNDM9SYs4TyrIxf7l -R42IvNH76CcJpcWYhQ1PCLdsbuyO9lMkXBylPMI1VPZkjUZqj/Ixfw== ------END RSA PRIVATE KEY----- diff --git a/tools/windows-mdm/poc-mdm-server/certs/dev_cert_mdmwindows_com_cert.pem b/tools/windows-mdm/poc-mdm-server/certs/dev_cert_mdmwindows_com_cert.pem deleted file mode 100644 index 1b9ce35969..0000000000 --- a/tools/windows-mdm/poc-mdm-server/certs/dev_cert_mdmwindows_com_cert.pem +++ /dev/null @@ -1,27 +0,0 @@ -Bag Attributes - localKeyID: 01 00 00 00 - friendlyName: mdmwindows.com -subject=CN = *.mdmwindows.com - -issuer=CN = *.mdmwindows.com - ------BEGIN CERTIFICATE----- -MIIDPTCCAiWgAwIBAgIQGQpbyNZeY7hBkxKCbRRfaTANBgkqhkiG9w0BAQsFADAb -MRkwFwYDVQQDDBAqLm1kbXdpbmRvd3MuY29tMB4XDTIyMTIyODE0MTUxMloXDTMy -MTIyODE0MjUxMlowGzEZMBcGA1UEAwwQKi5tZG13aW5kb3dzLmNvbTCCASIwDQYJ -KoZIhvcNAQEBBQADggEPADCCAQoCggEBANUbiIaR1g7nbtOxXydm0wM5vA2g+RfV -ksQvHCpujgrbTe7SIxc8msk4aK8E2d+/lXiTGe/2z/26sU5Be2OfYHhLBZQ5y70F -pth4eH+/TFdPHFsf0wd1qoJOoz369HUtrEGb/iYkuvzkdAQk6VD2cDO3kIjd0qDw -2RImyGi7edxAlXPM3pg/HB6zZgpPByFjpocz+VMzNtaV8vCTqNmhKpeolQaFGtEF -XyVV/RBwz55iZngOn3dLg2U74vGEo/hqnJnAZhk3v626X2iYz4ml3HtGxdiSo5it -/G44CtvXx6BGfknMN7pdetH8TFdWwYSHGibfrhEMjipHai2D2fpWfskCAwEAAaN9 -MHswDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcD -ATArBgNVHREEJDAigg5tZG13aW5kb3dzLmNvbYIQKi5tZG13aW5kb3dzLmNvbTAd -BgNVHQ4EFgQUsFD9edObvrbuLZopzjgGtpr8ZTQwDQYJKoZIhvcNAQELBQADggEB -AEEfa9BS75jG4D2fJ1/Q9Xn/SPsaAtwUYW+ilGCqYBfQ8lBmXGN8z8WETdw5xus3 -FGdIYtw8SKF5fp3TOJlNkiF0LNhAEvwDEkNCtOK9XpqTScjDi2WT1c+gJmPyHj7M -+vn9+gHFI7tUT+JImqU1I6tzD2OsZS5H1Vow+QwD3/DswSoUKM+zQreJGKaKLZqo -i6B/fdS+XkYWymwXmQiu+7D8RwTGEMIrfPFon90I9APrDhOmjiDa7L+xs7zRfT4J -fzIbHn867msNrZzwPAmf3fRhEk8cwHD5jfgnXuoVL4icPG57rUvCfX+QI9FfpjH4 -ZIbwI+HQg86S0hVwqhGs1RI= ------END CERTIFICATE----- diff --git a/tools/windows-mdm/poc-mdm-server/profile/add_download_msi.xml b/tools/windows-mdm/poc-mdm-server/profile/add_download_msi.xml deleted file mode 100644 index 2e5fc95f49..0000000000 --- a/tools/windows-mdm/poc-mdm-server/profile/add_download_msi.xml +++ /dev/null @@ -1,8 +0,0 @@ - - xxcmdidxx - - - ./Device/Vendor/MSFT/EnterpriseDesktopAppManagement/MSI/%7B90413BF7-7D99-482E-A7FB-C6616CC871FC%7D/DownloadInstall - - - \ No newline at end of file diff --git a/tools/windows-mdm/poc-mdm-server/profile/exec_install_msi.xml b/tools/windows-mdm/poc-mdm-server/profile/exec_install_msi.xml deleted file mode 100644 index f2232fe4ec..0000000000 --- a/tools/windows-mdm/poc-mdm-server/profile/exec_install_msi.xml +++ /dev/null @@ -1,31 +0,0 @@ - - xxcmdidxx - - - ./Device/Vendor/MSFT/EnterpriseDesktopAppManagement/MSI/%7B90413BF7-7D99-482E-A7FB-C6616CC871FC%7D/DownloadInstall - - - xml - text/plain - - - <MsiInstallJob id="{90413BF7-7D99-482E-A7FB-C6616CC871FC}"> - <Product Version="1.0.0"> - <Download> - <ContentURLList> - <ContentURL>https://mdmwindows.com/static/fleet-osquery.msi</ContentURL> - </ContentURLList> - </Download> - <Validation> - <FileHash>3B9FD63248465A51500D41DECC794D1149506EB48EEF9D7A733516B482D16ABB</FileHash> - </Validation> - <Enforcement> - <CommandLine>/quiet</CommandLine> - <RetryCount>3</RetryCount> - <RetryInterval>5</RetryInterval> - </Enforcement> - </Product> - </MsiInstallJob> - - - \ No newline at end of file diff --git a/tools/windows-mdm/poc-mdm-server/sample_syncml_commands/add_download_msi.xml b/tools/windows-mdm/poc-mdm-server/sample_syncml_commands/add_download_msi.xml deleted file mode 100644 index 2e5fc95f49..0000000000 --- a/tools/windows-mdm/poc-mdm-server/sample_syncml_commands/add_download_msi.xml +++ /dev/null @@ -1,8 +0,0 @@ - - xxcmdidxx - - - ./Device/Vendor/MSFT/EnterpriseDesktopAppManagement/MSI/%7B90413BF7-7D99-482E-A7FB-C6616CC871FC%7D/DownloadInstall - - - \ No newline at end of file diff --git a/tools/windows-mdm/poc-mdm-server/sample_syncml_commands/exec_install_msi.xml b/tools/windows-mdm/poc-mdm-server/sample_syncml_commands/exec_install_msi.xml deleted file mode 100644 index deb3853a31..0000000000 --- a/tools/windows-mdm/poc-mdm-server/sample_syncml_commands/exec_install_msi.xml +++ /dev/null @@ -1,13 +0,0 @@ - - xxcmdidxx - - - ./Device/Vendor/MSFT/EnterpriseDesktopAppManagement/MSI/%7B90413BF7-7D99-482E-A7FB-C6616CC871FC%7D/DownloadInstall - - - xml - text/plain - - <MsiInstallJob id="{90413BF7-7D99-482E-A7FB-C6616CC871FC}"><Product Version="1.4.0"><Download><ContentURLList><ContentURL>https://mdmwindows.com/static/fleet-osquery.msi</ContentURL></ContentURLList></Download><Validation><FileHash>3B9FD63248465A51500D41DECC794D1149506EB48EEF9D7A733516B482D16ABB</FileHash></Validation><Enforcement><CommandLine>/quiet</CommandLine><RetryCount>5</RetryCount><RetryInterval>3</RetryInterval></Enforcement></Product></MsiInstallJob> - - \ No newline at end of file