o
    j8p                  
   @   s^  d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dlZd dl	m
Z
 d dlmZmZmZ d dlmZ d dlmZmZ d dlmZ d dlmZmZmZmZmZmZmZmZmZmZmZm Z m!Z!m"Z" d dl#T d d	l$m%Z%m&Z&m'Z' d d
l(m)Z)m*Z* d dl+m,Z, d dl-m.Z.m/Z/ d dl0T dZ1G dd dZ2G dd dZ3G dd dZ4G dd dZ5G dd dZ6e7dkre8ej9 ej:dddZ;e;j<dddd e;j<d d!d"d e;j<d#d!d$d e;j<d%dd&d'd( e;j<d)e=d*d+d,d- e;j<d.d/dgd0d1d2d3 e>ej?d4kre;@  eAd4 e;B ZCeDeCjEeCjF eCjGd5kr9eCjHs-deC_HeId6 neCjHd/kr8eId7 neCjHsEd/eC_HeId8 z;eCjJdurZe6eCjJeCjKe=eCjGeCjHZLne6eCjKeCjKe=eCjGeCjHZLeId9eCjKeCjJpreCjKeCjGeCjHf  eLM  W dS  eNy ZO zeP jQejRkrd dlSZSeST  eUeVeO W Y dZO[OdS dZO[Oww dS ):    N)
indexbytes)datetime	timedeltatimezone)version)nmbntlm)logger)SMBNewSMBPacket
SMBCommandSMBNTLMDialect_ParametersSMBNTLMDialect_DataSMBExtended_Security_ParametersSMBExtended_Security_DataUnsupportedFeature!SMBSessionSetupAndX_Extended_Data'SMBSessionSetupAndX_Extended_Parameters0SMBSessionSetupAndX_Extended_Response_Parameters*SMBSessionSetupAndX_Extended_Response_Data&SMBSessionSetupAndXResponse_ParametersSMB_DIALECT)*)SPNEGO_NegTokenInitSPNEGO_NegTokenResp	TypesMech)STATUS_SUCCESSSTATUS_MORE_PROCESSING_REQUIRED)uuidtup_to_bin)	transportepml     }*{Gc                   @   s.   e Zd ZdddZdd Zdd Zd	d
 ZdS )RPCreturnNc                 C   s   d| _ | | d S )Nr   )MaxTrasmitionSize_initializeTransportselftarget r(   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/../../../bin/DumpNTLMInfo.py__init__B   s   zRPC.__init__c                 C   s^   d }|   }| j|  | j }|dkr-t|}t| }|d | _t	
|d }|S )Nr   	max_rfrag	auth_data)_create_bind_request_rpctransportsend
get_packetrecvMSRPCHeaderMSRPCBindAckgetDatar#   r   NTLMAuthChallenge)r&   ntlmChallengepacketbufferresponsebindRespr(   r(   r)   GetChallangeF   s   

zRPC.GetChallangec                 C   s>   t d| | _| jddddd | jd | j  d S )Nzncacn_ip_tcp:%s[135]    )r   DCERPCTransportFactoryr.   set_credentials	set_dportconnectr%   r(   r(   r)   r$   T   s   zRPC._initializeTransportc                 C   s   t  }t }tj|d< td|d< d|d< d|d< || t }t|d< | |d	< d|d
< t	j
ddddd}t }t|d< t|d< d|d< dt| d  d }|dkre|d	  d| 7  < ||d< ||d< ||d< |S )NAbstractSyntax)z$8a885d04-1ceb-11c9-9fe8-08002b104860z2.0TransferSyntaxr   	ContextID   
TransItemstypepduDatacall_idr<   T)signingRequired
use_ntlmv2	auth_type
auth_leveli5 auth_ctx_id      auth_pad_lensec_trailerr,   )	MSRPCBindCtxItemr    MSRPC_UUID_PORTMAPr   
addCtxItemr2   
MSRPC_BINDr4   r   getNTLMSSPType1SEC_TRAILERRPC_C_AUTHN_WINNTRPC_C_AUTHN_LEVEL_PKT_INTEGRITYlenr0   )r&   binditemr7   authrR   padr(   r(   r)   r-   Z   s.   

zRPC._create_bind_requestr"   N)__name__
__module____qualname__r*   r;   r$   r-   r(   r(   r(   r)   r!   A   s
    
r!   c                   @   sd   e Zd Z		dddZdd Zdd	 Zd
d Zdd Zdd ZdddZ	dd Z
dd Zdd ZdS )SMB1N  <   c                 C   s   d| _ d | _d| _d | _tjtjB | _tjtj	B tj
B | _|| _|| _|| _d | _|d u r:t|||tj|| j| _| || _d S )Nr   F)_uid_dialects_data_SignatureRequired_dialects_parametersr
   FLAGS1_PATHCASELESSFLAGS1_CANONICALIZED_PATHS_SMB1__flags1FLAGS2_EXTENDED_SECURITYFLAGS2_NT_STATUSFLAGS2_LONG_NAMES_SMB1__flags2_SMB1__timeout_session_my_name_authr   NetBIOSTCPSessionTYPE_SERVER_negotiateSession_negotiateResponser&   remote_nameremote_hostmy_name	sess_porttimeoutsessionnegSessionResponser(   r(   r)   r*   x   s   zSMB1.__init__c                 C      | j S Nrz   r&   r(   r(   r)   GetNegotiateResponse      zSMB1.GetNegotiateResponsec                 C   s   t  }| jr|d  tjO  < |  }|| | | |  }|tj	r_|d | _
t|d d }t|d }t|d d}|d |d< ||d  t|d | _t| jd	 }|S d S )
NFlags2UidDatar   
Parameters)flagsSecurityBlobLengthSecurityBlobResponseToken)r   rj   r
   FLAGS2_SMB_SECURITY_SIGNATURE_createSessionSetupRequest
addCommandr/   receiveisValidAnswerSMB_COM_SESSION_SETUP_ANDXrh   r   r   r   
fromStringr   
_respTokenr   r5   )r&   r7   sessionSetupsessionResponsesessionParameterssessionDatar6   r(   r(   r)   r;      s$   


zSMB1.GetChallangec              
   C   s   t j| j| jd ddddddd\}}t }| jr"|d  tjO  < t }|	 |d< | 
 }t||d d< |	 |d d	< || | | |  }z|tjrjt|d d
 }t|d }|d | _W dS W dS    Y dS )Nr   r<   TrK   r   r   r   r   r   r   ActionF)r   getNTLMSSPType3rv   r   r   rj   r
   r   r   r4   r   r\   r   r/   r   r   r   r   r   _action)r&   type3_r7   
respToken2r   r   r   r(   r(   r)   Authenticate   s.   &


zSMB1.Authenticatec                 C   sR   | j |d< t d@ |d< |d  | jO  < |d  | jO  < | j|  d S )Nr     PidFlags1r   )rh   osgetpidrn   rr   rt   send_packetr4   )r&   
negoPacketr(   r(   r)   r/      s
   
z	SMB1.sendc                 C   s   | j | j}t| dS )Ndata)rt   recv_packetrs   r   get_trailer)r&   rr(   r(   r)   r      s   zSMB1.receivec                    sl    fdd}|d u r/t  }ttj} jtjB  _d|d< ||  |   }||S |t |dS )Nc                    s   | d t j@ r  jt jO  _| t jrjt| d d }t|d  _t  _	 jd  j	d<  j	
|d   jd t j@ rZt|d  _t|d  _	 jd t j@ rYd _n jd	 d
kretd |S d S )Nr   r   r   r   ChallengeLengthCapabilitiesSecurityModeTDialectIndexr   z&Remote server does not know NT LM 0.12)r
   FLAGS2_UNICODErr   r   SMB_COM_NEGOTIATEr   r   rk   r   ri   r   CAP_EXTENDED_SECURITYr   r   SECURITY_SIGNATURES_REQUIREDrj   r   _wrapper)r   r   r   r(   r)   parsePacket   s$   
z+SMB1._negotiateSession.<locals>.parsePackets   NT LM 0.12 r   r   )	r   r   r
   r   rr   ro   r   r/   r   )r&   	negPacketr   r   
negSessionr(   r   r)   ry      s   


zSMB1._negotiateSessionc                 C   s   t tj}t |d< t |d< d|d d< d|d d< d|d d< d	|d d
< tjtjB tjB tjB tj	B |d d< t
 }td g|d< tj| jd| jdd| _| j |d< t||d d< |d   | |d d< d|d d< d|d d< |S )Nr   r   i   MaxBufferSize   MaxMpxCountrE   VcNumberr   
SessionKeyr   2NTLMSSP - Microsoft NTLM Security Support Provider	MechTypesr<   Tr   	MechTokenr   r   z
U n i x   NativeOSzS a m b a  NativeLanMan)r   r
   r   r   r   r   CAP_USE_NT_ERRORSCAP_UNICODECAP_LARGE_READXCAP_LARGE_WRITEXr   r   r   rX   ru   rj   rv   r4   r\   )r&   r   blobr(   r(   r)   r      s$   


&zSMB1._createSessionSetupRequestc                 C   s   d|d< t |d< | jd tj@ rt|d< | jr|d  tO  < | jd |d< | jd |d< | | jd | jd |d	< d|d
< |S )Nr   r   DialectRevisionr   MaxReadSizeMaxWriteSizeLowDateTimeHighDateTime
SystemTimeServerStartTime)r   rk   r
   SECURITY_SIGNATURES_ENABLEDSMB2_NEGOTIATE_SIGNING_ENABLEDrj   SMB2_NEGOTIATE_SIGNING_REQUIRED_to_long_filetime)r&   r   r(   r(   r)   r     s   zSMB1._wrapperc                 C   s   |}|dK }||O }|S )N    r(   )r&   dwLowDateTimedwHighDateTime	temp_timer(   r(   r)   r     s   zSMB1._to_long_filetimeNrf   rg   NNr   )rb   rc   rd   r*   r   r;   r   r/   r   ry   r   r   r   r(   r(   r(   r)   re   w   s    

$re   c                   @   sT   e Zd Z		dddZdd Zdd	 Zd
d Zdd Zdd ZdddZ	dd Z
dS )SMB3Nrf   rg   c                 C   s^   || _ d| _d| _|| _d | _|d u r t|||tj||| _ n|  jd7  _| || _	d S )Nr   rE   )
_NetBIOSSession_sequenceWindow
_sessionId_timeoutrv   r   rw   rx   ry   rz   r{   r(   r(   r)   r*     s   zSMB3.__init__c                 C   r   r   r   r   r(   r(   r)   r   %  r   zSMB3.GetNegotiateResponsec                 C   sT   |  | jd }| | |  | _t| jd }t|d | _t	| jd }|S )Nr   r   Bufferr   )
r   rz   r/   r   _answerSMB2SessionSetup_Responser   r   r   r5   )r&   r7   sessionSetupResponser6   r(   r(   r)   r;   (  s   

zSMB3.GetChallangec              	   C   s   t  }|  d tkrt }t|d< | jtre| jd | _t	
| j| jd ddddd\}}t }| |d< t }t|d< t||d< | |d< ||d	< | | |  }z|tW S    Y d
S d S )Nr   Command	SessionIDr   r<   r   SecurityBufferLengthr   r   F)
SMB2Packetr   SMB2_DIALECT_30
SMB3PacketSMB2_SESSION_SETUPr   r   r   r   r   r   rv   r   r   r4   SMB2SessionSetupr   r\   r/   r   r   )r&   r7   r   r   r   r   r(   r(   r)   r   4  s*   "
zSMB3.Authenticatec                 C   sJ   | j |d< |  j d7  _ | j|d< d|d< |d }| }| j| |S )N	MessageIDrE   r   CreditCharge)r   r   r4   r   r   )r&   r7   	messageIdr   r(   r(   r)   r/   O  s   

z	SMB3.sendc                 C   s   | j | j}t| }|S r   )r   r   r   r   r   )r&   r   r7   r(   r(   r)   r   [  s   zSMB3.receivec                 C   s   t }|d urt|d }|d }|t kr[t }t|d< t }t|d< t|d< ddd td	D |d
< t	t
tg|d< t|d |d< ||d< | | |  }|tr[t|d }|S )Nr   r   r   r   r   r<   c                 S   s   g | ]}t tjqS r(   )randomchoicestringascii_letters).0r   r(   r(   r)   
<listcomp>l  s    z*SMB3._negotiateSession.<locals>.<listcomp>   
ClientGuidDialectsDialectCount)SMB2_DIALECT_WILDCARDSMB2Negotiate_Responser   SMB2_NEGOTIATESMB2Negotiater   SMB2_GLOBAL_CAP_ENCRYPTIONjoinrangeSMB2_DIALECT_002SMB2_DIALECT_21r   r\   r/   r   r   r   )r&   r   currentDialectnegotiateResponser7   r   answerr(   r(   r)   ry   `  s&   

zSMB3._negotiateSessionc                 C   s   t  }d|d< t }td g|d< tddd| _| j |d< t||d< | |d	< t }|t	kr6t
 }t|d
< ||d< |S )Nr   Flagsr   r   r<   Fr   r   r   r   r   )r   r   r   r   rX   rv   r4   r\   r   r   r   r   )r&   dialectr   r   r7   r(   r(   r)   r   x  s   zSMB3._createSessionSetupRequestr   r   )rb   rc   rd   r*   r   r;   r   r/   r   ry   r   r(   r(   r(   r)   r     s    

r   c                   @   sH   e Zd ZdddZdd Zdd Zd	d
 Zdd ZdddZdd Z	dS )SmbConnectionr"   Nc                 C   s6   || _ || _t|| _d| _|  | _d | _d | _d S Nrg   )	r'   hostnameint
_sess_portr   _get_my_name_myName_nmbSession_SMBConnection)r&   ipr
  portr(   r(   r)   r*     s   


zSmbConnection.__init__c              
   C   s   t jt jB }t jt jB t jB }d}d}z| jd|||d W n" ty@ } zdt|v r5d}W Y d }~|S W Y d }~|S d }~ww d}|S )NzNT LM 0.12 FTflags1flags2r   
No answer!)	r
   rl   rm   ro   rp   rq   _negotiateSessionWildcard	Exceptionstr)r&   r  r  smbv1NegoDatasmb1_enableder(   r(   r)   IsSmb1Enabled  s    
zSmbConnection.IsSmb1Enabledc              	   C   s   t jt jB }t jt jB t jB }d}| jtjkrd}| j	d|||d}|dd dkr?t
| j| j| j| j| j| jt|d| _nt| j| j| j| j| j| j|d| _| j S )	Nz"NT LM 0.12 SMB 2.002 SMB 2.??? zNT LM 0.12 SMB 2.002 Tr  r   rE      )r   r   )r
   rl   rm   ro   rp   rq   r  r   NETBIOS_SESSION_PORTr  r   r
  r'   r  r   r  r   r  re   r   )r&   r  r  negoDatar7   r(   r(   r)   NegotiateSession  s   


zSmbConnection.NegotiateSessionc                 C   
   | j  S r   )r  r;   r   r(   r(   r)   r;        
zSmbConnection.GetChallangec                 C   r"  r   )r  r   r   r(   r(   r)   r     r#  zSmbConnection.AuthenticateTr   c           	      C   s
  d}t  }||d< |tjB |d< d }|dk ryt| j| j| jtj| j	| j
| _ttj}|du r9|d  tjO  < ||d< || | j|  z	| j| j
}W n% tjyp   |d  tjtjB tjB O  < g |d< Y nw |d7 }|dk s|d u rtd| S )	Nr   r   r   r   Tr   rE   r  )r   r
   r   r   rw   r  r
  r'   rx   r  r   r  r   r   ro   r   r   r4   r   NetBIOSErrorrp   rq   r  r   )	r&   extended_securityr  r  r   triessmbpr9   r   r(   r(   r)   r    s2   "

z'SmbConnection._negotiateSessionWildcardc                 C   s*   t  }|d}|dkr|d | }|S )N.)socketgethostnamefind)r&   myNameir(   r(   r)   r    s
   
zSmbConnection._get_my_namera   )Tr   r   N)
rb   rc   rd   r*   r  r!  r;   r   r  r  r(   r(   r(   r)   r    s    
	
r  c                   @   sn   e Zd ZdddZdd Zdd Zd	d
 Zdd Zdd Zdd Z	dd Z
dd Zdd Zdd Zdd ZdS )DumpNtlmr"   Nc                 C   s&   || _ || _t|| _|| _d| _d S r	  )r'   r
  r  r  	_protocolr   )r&   r  r
  r  protocolr(   r(   r)   r*     s
   

zDumpNtlm.__init__c                 C   s0   | j dkr|   d S | j dkr|   d S d S )Nr
   r!   )r0  DisplaySmbInfoDisplayRpcInfor   r(   r(   r)   DisplayInfo  s
   

zDumpNtlm.DisplayInfoc                 C   s4   t | j}| }| | | |j|jd d S )N)r   r   )r!   r'   r;   DisplayChallangeInfo	DisplayIor#   )r&   rpcr6   r(   r(   r)   r3    s   

zDumpNtlm.DisplayRpcInfoc                 C   s   t | j| j| j}| }|d }|d }| }| || | | | | | 	| |
 }| | | }| | d S )Nr   r   )r  r'   r
  r  r!  r  DisplayDialectDisplaySigningr6  DisplayTimer;   r5  r   DisplayNullSession)r&   
connectionnegotiationr  secModer  r6   nullSessionr(   r(   r)   r2    s   



zDumpNtlm.DisplaySmbInfoc                 C   sD   d}|t @ t kr
d}|t@ tkr|d7 }n|d7 }td| d S )Nr<   SIGNING_ENABLEDz | SIGNING_REQUIREDz (not required)z[+] Server Security : {})r   r   printformat)r&   r>  moder(   r(   r)   r9    s   
zDumpNtlm.DisplaySigningc                 C   s   t d| |tkrt d d S |tkrt d d S |tkr%t d d S |tkr/t d d S |tkr9t d d S |tkrCt d d S t|tu rRt d| d S t d| d S )	Nz[+] SMBv1 Enabled   : {0}z[+] Prefered Dialect: SMB 002z[+] Prefered Dialect: SMB 2.1z[+] Prefered Dialect: SMB 3.0z[+] Prefered Dialect: SMB 3.0.2z[+] Prefered Dialect: SMB 3.1.1z[+] Prefered Dialect: {}z[+] Prefered Dialect: 0x{:x})	rA  rB  r  r  r   SMB2_DIALECT_302SMB2_DIALECT_311rG   r  )r&   r  r  r(   r(   r)   r8    s    zDumpNtlm.DisplayDialectc                 C   s@   t d| |d |d  t d| |d |d  d S )Nz#[+] Max Read Size   : {} ({} bytes)r   z#[+] Max Write Size  : {} ({} bytes)r   )rA  rB  _DumpNtlm__convert_size)r&   r  r(   r(   r)   r6  -  s   "zDumpNtlm.DisplayIoc                 C   s   |d dkrdn
|  |d tj}|d dkrdn
|  |d tj}td| |dkrCtd| td||  d S d S )Nr   r   r   z[+] Current Time    : {}z[+] Boot Time       : {}z[+] Server Up Time  : {})_DumpNtlm__filetime_to_dt
astimezoner   utcrA  rB  )r&   r  currentTimebootTimer(   r(   r)   r:  2  s   &&zDumpNtlm.DisplayTimec                 C   s  |d dkrt |d d |d  }|t j d ur0ztd|t j d d W n   Y |t j d urMztd|t j d d W n   Y |t j d urjztd|t j d d W n   Y |t j d urztd	|t j d d W n   Y |t j	 d urztd
|t j	 d d W n   Y d|j
v r|d }t|dkrtddt|dt|dtd|dd d f  d S d S d S d S )NTargetInfoFields_lenr   TargetInfoFieldsz[+] Name            : {}rE   zutf-16lez[+] Domain          : {}z[+] DNS Tree Name   : {}z[+] DNS Domain Name : {}z[+] DNS Host Name   : {}VersionrO   z[+] OS              : {}zWindows NT %d.%d Build %dz<Hr   )r   AV_PAIRSNTLMSSP_AV_HOSTNAMErA  rB  decodeNTLMSSP_AV_DOMAINNAMENTLMSSP_AV_DNS_TREENAMENTLMSSP_AV_DNS_DOMAINNAMENTLMSSP_AV_DNS_HOSTNAMEfieldsr\   r   structunpack)r&   	challangeav_pairsr   r(   r(   r)   r5  ;  sD   """""
<!zDumpNtlm.DisplayChallangeInfoc                 C   s   t d| d S )Nz[+] Null Session    : {})rA  rB  )r&   r?  r(   r(   r)   r;  c  s   zDumpNtlm.DisplayNullSessionc                 C   s"   |t  d }tdddt|d S )N
   i  rE   )microseconds)EPOCH_AS_FILETIMEr   r   )r&   filetimeusr(   r(   r)   __filetime_to_dtg  s   zDumpNtlm.__filetime_to_dtc                 C   sP   |dkrdS d}t tt|d}td|}t|| d}d||| f S )Nr   0B)	BKBMBGBTBPBEBZBYBi   r   z%s %s)r  mathfloorlogpowround)r&   
size_bytes	size_namer.  psr(   r(   r)   __convert_sizem  s   zDumpNtlm.__convert_sizera   )rb   rc   rd   r*   r4  r3  r2  r9  r8  r6  r:  r5  r;  rG  rF  r(   r(   r(   r)   r/    s    
	(r/  __main__Tz-Do ntlm authentication and parse information.)add_helpdescriptionr'   storez<targetName or address>)actionhelpz-debug
store_truezTurn DEBUG output ONz-tsz&Adds timestamp to every logging outputz
-target-ipz
ip addresszIP Address of the target machine. If omitted it will use whatever was specified as target. This is useful when target is the NetBIOS name and you cannot resolve it)ry  metavarrz  z-portrf   zdestination portz-Destination port to connect to SMB/RPC Server)rG   defaultr|  rz  z	-protocolr
   ?r1  zIProtocol to use (SMB or RPC). Default is SMB, port 135 uses RPC normally.)choicesnargsr|  rz  rE   r=   z]Port 135 specified; using RPC protocol by default. Use `-protocol SMB` to force SMB protocol.zRPort 135 specified with SMB protocol. Are you sure you don't want `-protocol RPC`?zDefaulting to SMB protocol.z0Using target: %s, IP: %s, Port: %d, Protocol: %s)Wr   sysargparseloggingrW  r*  rk  r   r   sixr   r   r   r   impacketr   r   r   impacket.examplesr	   impacket.smbr
   r   r   r   r   r   r   r   r   r   r   r   r   r   impacket.smb3structsimpacket.spnegor   r   r   impacket.nt_errorsr   r   impacket.uuidr   impacket.dcerpc.v5r   r    impacket.dcerpc.v5.rpcrtr]  r!   re   r   r  r/  rb   rA  BANNERArgumentParserparseradd_argumentr  r\   argv
print_helpexit
parse_argsoptionsinittsdebugr  r1  info	target_ipr'   dumperr4  r  r  	getLoggerlevelDEBUG	traceback	print_excerrorr  r(   r(   r(   r)   <module>   s   $@6 yU 





&