o
    àý°jr/  ã                
   @   sÆ  d dl mZ d dl mZ d dlZd dlZd dlZd dlmZ d dlm	Z	 d dl
mZ d dlmZmZ d dlmZ d d	lmZ G d
d„ dƒZedkráeejƒ ejdddZejdddd ejdddd ejdddd ejddddd ejdddZejd d!d"Zejd#ddd$d% ejd&e d'¡dd(d) ejd*dd+d,d% ejd-dd+d.d% ejd/d0d"Zejd#ddd$d% e  d1¡Z!e!jd2dd3d4d e!jd5dd6d e!jd7dd8d e!jd9dd:d;d e!jd<dd=d>d e"ej#ƒd?krüe $¡  e %d?¡ e &¡ Z'e (e'j)e'j*¡ e'j+dur7ze'j+ ,d@¡\Z-Z.e /e0e-ƒe0e.ƒ¡ W n e1y6   e 2dA¡ e %d?¡ Y nw e'j3 4¡ dBkrae'j5du rKe'j6du sWe'j5durae'j6durae 2dC¡ e %d?¡ e	e'j7ƒ\Z8Z9Z:Z;zDe8du rrdDZ8e'j<dur{de'_=e:dDkr¡e9dDkr¡e'j>du r¡e'j?d+u r¡e'j<du r¡d dEl@m@Z@ e@dFƒZ:ee9e:e8e'ƒZAeA Be;¡ W n+ e1eCfyÙ ZD ze E¡ jFejGkrÊd dlHZHeH I¡  e 2eD¡ W Y dZD[DndZD[Dww e %d ¡ dS dS )Gé    )Údivision)Úprint_functionN)Úlogger)Úparse_target)Úversion)ÚDCOMConnectionÚ
COMVERSION)Úwmi)ÚNULLc                   @   s*   e Zd Zd	dd„Zedd„ ƒZdd„ ZdS )
ÚWMIPERSISTENCEÚ Nc                 C   sJ   || _ || _|| _|| _d| _d| _|jd ur#|j d¡\| _| _d S d S )Nr   ú:)Ú_WMIPERSISTENCE__usernameÚ_WMIPERSISTENCE__passwordÚ_WMIPERSISTENCE__domainÚ_WMIPERSISTENCE__optionsÚ_WMIPERSISTENCE__lmhashÚ_WMIPERSISTENCE__nthashÚhashesÚsplit)ÚselfÚusernameÚpasswordÚdomainÚoptions© r   úŠ/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/../../../bin/wmipersist.pyÚ__init__C   s   
ÿzWMIPERSISTENCE.__init__c                 C   st   |  d¡d@ }|dkr1ddlm} z| |¡j}W n ty$   d}Y nw t d| ||f ¡ d S t d|  ¡ d S )Nr   l   ÿÿ )Ú
WBEMSTATUSÚUnknownz%s - ERROR: %s (0x%08x)z%s - OK)	ÚGetCallStatusÚimpacket.dcerpc.v5.dcom.wmir   Ú	enumItemsÚnameÚ
ValueErrorÚloggingÚerrorÚinfo)ÚbannerÚrespÚcall_statusr   Ú
error_namer   r   r   Ú
checkErrorM   s   ÿzWMIPERSISTENCE.checkErrorc                 C   sÐ  t || j| j| j| j| jtjdtjtj	d
}| 
tjtj¡}t |¡}| dtt¡}| ¡  | jj ¡ dkr|  d| jj | d| jj ¡¡ |  d| jj | d| jj ¡¡ |  d	| jj | d
| jj ¡¡ |  d| jj | d| jj| jjf ¡¡ nã| d¡\}}| ¡ }| jj|_d|_g d¢|_tj ¡ |_|  d| jj |  | !¡ ¡¡ tj"d urâ| d¡\}}| ¡ }d| jj |_g d¢|_tj"|_#d|_$d|_%|  d| jj |  | !¡ ¡¡ nW| d¡\}	}|	 ¡ }	d| jj |	_&t'| jj(ƒ|	_)|  d|  |	 !¡ ¡¡ | d¡\}}| ¡ }d| jj |_g d¢|_d| jj |_#d|_$d|_%|  d| jj |  | !¡ ¡¡ | d¡\}
}|
 ¡ }
d| jj |
_*d| jj |
_+g d¢|
_|  d|  |
 !¡ ¡¡ | ,¡  d S )NF)ÚoxidResolverÚ
doKerberosÚkdcHostz//./root/subscriptionÚREMOVEz%Removing ActiveScriptEventConsumer %sz#ActiveScriptEventConsumer.Name="%s"zRemoving EventFilter EF_%sz__EventFilter.Name="EF_%s"z'Removing IntervalTimerInstruction TI_%sz*__IntervalTimerInstruction.TimerId="TI_%s"z#Removing FilterToConsumerBinding %szp__FilterToConsumerBinding.Consumer="ActiveScriptEventConsumer.Name=\"%s\"",Filter="__EventFilter.Name=\"EF_%s\""ÚActiveScriptEventConsumerÚVBScript)é   é   r   r   r   r   r   é   é    r   r   r   r6   r4   r   r   z#Adding ActiveScriptEventConsumer %sÚ__EventFilterzEF_%sÚWQLz
root\cimv2zAdding EventFilter EF_%sÚ__IntervalTimerInstructionzTI_%szAdding IntervalTimerInstructionz3select * from __TimerEvent where TimerID = "TI_%s" zroot\subscriptionÚ__FilterToConsumerBindingzAdding FilterToConsumerBinding)-r   r   r   r   r   r   r   ÚaesKeyÚkÚdc_ipÚCoCreateInstanceExr	   ÚCLSID_WbemLevel1LoginÚIID_IWbemLevel1LoginÚIWbemLevel1LoginÚ	NTLMLoginr
   Ú
RemReleaser   ÚactionÚupperr,   r#   ÚDeleteInstanceÚ	GetObjectÚSpawnInstanceÚNameÚScriptingEngineÚ
CreatorSIDÚvbsÚreadÚ
ScriptTextÚPutInstanceÚ	marshalMeÚfilterÚQueryÚQueryLanguageÚEventNamespaceÚTimerIdÚintÚtimerÚIntervalBetweenEventsÚFilterÚConsumerÚ
disconnect)r   ÚaddrÚdcomÚ
iInterfaceÚiWbemLevel1LoginÚiWbemServicesÚactiveScriptÚ_ÚeventFilterÚwmiTimerÚfilterBindingr   r   r   ÚrunZ   s’   ÿ
ÿÿ
ÿÿÿÿÿÿ

ÿ

ÿÿ
ÿ
ÿzWMIPERSISTENCE.run)r   r   r   N)Ú__name__Ú
__module__Ú__qualname__r   Ústaticmethodr,   rf   r   r   r   r   r   B   s
    


r   Ú__main__Tz…Creates/Removes a WMI Event Consumer/Filter and link between both to execute Visual Basic based on the WQL filter or timer specified.)Úadd_helpÚdescriptionÚtargetÚstorez([domain/][username[:password]@]<address>)rD   Úhelpz-debugÚ
store_truezTurn DEBUG output ONz-tsz&Adds timestamp to every logging outputz-com-versionzMAJOR_VERSION:MINOR_VERSIONz<DCOM version, format is MAJOR_VERSION:MINOR_VERSION e.g. 5.7)rD   Úmetavarrp   ÚactionsrD   )rp   ÚdestÚinstallz&installs the wmi event consumer/filter)rp   z-namez
event name)rD   Úrequiredrp   z-vbsÚrz2VBS filename containing the script you want to run)Útyperv   rp   z-filterFz2the WQL filter string that will trigger the scriptz-timerz=the amount of milliseconds after the script will be triggeredÚremovez%removes the wmi event consumer/filterÚauthenticationz-hasheszLMHASH:NTHASHz$NTLM hashes, format is LMHASH:NTHASHz-no-passz&don't ask for password (useful for -k)z-kzÁUse Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use the ones specified in the command linez-aesKeyzhex keyz<AES key to use for Kerberos Authentication (128 or 256 bits)z-dc-ipz
ip addresszoIP Address of the domain controller. If ommited it use the domain part (FQDN) specified in the target parameterr3   Ú.z>Wrong COMVERSION format, use dot separated integers e.g. "5.7"ÚINSTALLz;You have to either specify -filter or -timer (and not both)r   )Úgetpassz	Password:)JÚ
__future__r   r   ÚsysÚargparser%   Úimpacket.examplesr   Úimpacket.examples.utilsr   Úimpacketr   Úimpacket.dcerpc.v5.dcomrtr   r   Úimpacket.dcerpc.v5.dcomr	   Úimpacket.dcerpc.v5.dtypesr
   r   rg   ÚprintÚBANNERÚArgumentParserÚparserÚadd_argumentÚadd_subparsersÚ
subparsersÚ
add_parserÚinstall_parserÚFileTypeÚremove_parserÚadd_argument_groupÚgroupÚlenÚargvÚ
print_helpÚexitÚ
parse_argsr   ÚinitÚtsÚdebugÚcom_versionr   Úmajor_versionÚminor_versionÚset_default_versionrV   Ú	Exceptionr&   rD   rE   rQ   rW   rn   r   r   r   Úaddressr;   r<   r   Úno_passr}   Úexecuterrf   ÚKeyboardInterruptÚeÚ	getLoggerÚlevelÚDEBUGÚ	tracebackÚ	print_excr   r   r   r   Ú<module>   sŒ   3
f



þ0


8€ü°