o
    àý°jŒs  ã                   @   sä  d dl Z d dlZd dlmZmZ d dlmZmZ d dlm	Z
 d dlmZ d dlmZ d dlmZ d dlmZ d d	lmZ d d
lmZ d dlmZ d dlmZmZmZ d dlmZmZmZm Z m!Z!m"Z" d dl#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z*m+Z+m,Z, d dl-m.Z.m/Z/m0Z0m1Z1m2Z2m3Z3m4Z4m5Z5m6Z6m7Z7m8Z8m9Z9m:Z:m;Z;m<Z<m=Z=m>Z>m?Z?m@Z@mAZAmBZB d dlCmDZDmEZE d dlmZmZmFZFmZm Z mGZGmHZH d dlImJZJmKZKmLZL d dlMmNZN d dlmOZO dZPG dd„ de$ƒZQG dd„ de.ƒZRG dd„ deƒZSdS )é    N)Ú	unhexlifyÚhexlify)ÚunpackÚpack)Úerror)ÚDCERPCException)Únrpc)Ú	transport)ÚNULL)ÚLOG)ÚProtocolClient)ÚKEEP_ALIVE_TIMER)ÚSTATUS_SUCCESSÚSTATUS_ACCESS_DENIEDÚSTATUS_LOGON_FAILURE)ÚNTLMAuthNegotiateÚNTLMSSP_NEGOTIATE_ALWAYS_SIGNÚNTLMAuthChallengeÚNTLMAuthChallengeResponseÚgenerateEncryptedSessionKeyÚhmac_md5)	ÚSMBÚNewSMBPacketÚ
SMBCommandÚ'SMBSessionSetupAndX_Extended_ParametersÚ!SMBSessionSetupAndX_Extended_DataÚ*SMBSessionSetupAndX_Extended_Response_DataÚ0SMBSessionSetupAndX_Extended_Response_ParametersÚSMBSessionSetupAndX_DataÚSMBSessionSetupAndX_Parameters)ÚSMB3ÚSMB2_GLOBAL_CAP_ENCRYPTIONÚSMB2_DIALECT_WILDCARDÚSMB2Negotiate_ResponseÚSMB2_NEGOTIATEÚSMB2NegotiateÚSMB2_DIALECT_002ÚSMB2_DIALECT_21ÚSMB2_DIALECT_30ÚSMB2_GLOBAL_CAP_LEASINGÚ
SMB3PacketÚSMB2_GLOBAL_CAP_LARGE_MTUÚ!SMB2_GLOBAL_CAP_DIRECTORY_LEASINGÚSMB2_GLOBAL_CAP_MULTI_CHANNELÚ"SMB2_GLOBAL_CAP_PERSISTENT_HANDLESÚSMB2_NEGOTIATE_SIGNING_REQUIREDÚ
SMB2PacketÚSMB2SessionSetupÚSMB2_SESSION_SETUPÚSTATUS_MORE_PROCESSING_REQUIREDÚSMB2SessionSetup_Response)ÚSMBConnectionÚSMB_DIALECT)r   r   ÚNTLMSSP_NEGOTIATE_SIGNr   r   ÚNTLMSSP_NEGOTIATE_KEY_EXCHÚNTLMSSP_NEGOTIATE_VERSION)ÚSPNEGO_NegTokenInitÚSPNEGO_NegTokenRespÚ	TypesMech)ÚSMBTransport)ÚscmrÚSMBRelayClientc                   @   ó    e Zd Zddd„Zd	dd„ZdS )
ÚMYSMBé½  TNc                 C   s    || _ tj| |||||d� d S )N)Ú	sess_portÚsessionÚ	negPacket)ÚextendedSecurityr   Ú__init__)ÚselfÚ
remoteNameÚsessPortrF   Ú
nmbSessionrE   © rL   ú¦/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/impacket/examples/ntlmrelayx/clients/smbrelayclient.pyrG   4   s   zMYSMB.__init__c                 C   s   t j| | j|d�S )N)Úextended_securityrE   )r   Úneg_sessionrF   )rH   rE   rL   rL   rM   rO   8   s   zMYSMB.neg_session)rB   TNN©N)Ú__name__Ú
__module__Ú__qualname__rG   rO   rL   rL   rL   rM   rA   3   ó    
rA   c                   @   r@   )
ÚMYSMB3rB   TNc              	   C   s&   || _ tj| ||||t|ƒ|d� d S )N)rC   rD   ÚnegSessionResponseÚpreferredDialect)rF   r    rG   r0   )rH   rI   rJ   rF   rK   rE   rW   rL   rL   rM   rG   <   s    zMYSMB3.__init__c           	      C   sR  d| j d< | jdu rt d¡ d S t| j d< t}|d ur&t|d ƒ}|d }|tkrz|  ¡ }t|d< t	ƒ }| j d |d	< | j d |d< | j
|d
< |d urR|g|d< ntttg|d< t|d ƒ|d< ||d< |  |¡}|  |¡}| t¡rzt|d ƒ}td|d ƒ| j d< td|d ƒ| j d< td|d ƒ| j d< |d | j d< |d | j d< |d | j d< |d	 t@ tkr¼t d¡ d S |d t@ tkrÉd| j d< |d t@ tkrÖd| j d< | j d tk�r't| _|d t@ tkrîd| j d< |d t@ tkrûd| j d< |d t@ tk�r	d| j d< |d t@ tk�rd| j d< |d | j d< |d	 | j d< d S d S )Nr   ÚClientSecurityModeTzQSigning is required, attack won't work unless using -remove-target / --remove-micÚCapabilitiesÚDataÚDialectRevisionÚCommandÚSecurityModeÚ
ClientGuidÚDialectsÚDialectCounti   ÚMaxTransactSizeÚMaxReadSizeÚMaxWriteSizeÚ
ServerGuidÚBufferÚGSSNegotiateTokenÚDialectÚSupportsFileLeasingÚSupportsMultiCreditÚSupportsDirectoryLeasingÚSupportsMultiChannelÚSupportsPersistentHandlesÚSupportsEncryptionÚServerCapabilitiesÚServerSecurityMode)Ú_ConnectionÚRequireMessageSigningr   r   r!   r"   r#   Ú
SMB_PACKETr$   r%   r^   r&   r'   r(   ÚlenÚsendSMBÚrecvSMBÚisValidAnswerr   Úminr/   r)   r+   r*   r,   r-   r.   )	rH   rW   rV   ÚcurrentDialectÚnegRespÚpacketÚ
negSessionÚpacketIDÚansrL   rL   rM   ÚnegotiateSession@   sf   














ózMYSMB3.negotiateSession)rB   TNNN)NN)rQ   rR   rS   rG   r~   rL   rL   rL   rM   rU   ;   rT   rU   c                   @   s�   e Zd ZdZd#dd„Zdd„ Zdd	„ Zd
d„ Zdd„ Zdd„ Z	dd„ Z
dd„ Zdd„ Zdd„ Zd$dd„Zd$dd„Zd$dd„Zdd „ Zd!d"„ ZdS )%r?   r   rB   Tc                 C   sF   t  | ||||¡ || _d | _d | _i | _d | _d | _d | _d| _	d S )Né   )
r   rG   rF   ÚmachineAccountÚmachineHashesÚsessionDataÚnegotiateMessageÚchallengeMessageÚserverChallengeÚkeepAliveHits)rH   ÚserverConfigÚtargetÚ
targetPortrF   rL   rL   rM   rG   †   s   
zSMBRelayClient.__init__c              
   C   s‚  t  d| jj ¡ tƒ }| |¡ | jj d¡\}}|d  d¡}z|d t	|ƒd … }W n   t
 Y S d| jj }t |¡}t	| jjƒdkrR| jj d¡\}	}
nd	}	d	}
t|d
ƒrd| |d	||	|
¡ | ¡ }| ¡  | tj¡ t |t|d d¡}|d }| jjd	kr‰d }nt| jj d¡d ƒ}t d	d||¡}t d|¡}t |t|d tjj|d |d¡ tdtd|ƒd d ƒ}t ¡ }d|d< |d |d< tj j!|d< tj"j#|d< tj"j#|d d< ||d d d d< d|d d d d< |d  d¡|d d d d< d	|d d d d< | j$|d d d< |d |d d d < |d! |d d d"< t %¡ }t ||¡|d#< d|d$< ||d%< d&|d' d#< d|d' d$< d|d(< z| &|¡}W n/ t'�y… } z"t  (¡ j)t j*k�rpdd l+}| ,¡  t  -t.|ƒ¡ | /¡ W  Y d }~S d }~ww t  d)||d  d¡f ¡ |d* }|d+k�r©t0|d, d- d. |ƒ}n|d, d- d. }t  d/t1|ƒ d0¡ ¡ t2|fS )1Nz!Connecting to %s NETLOGON serviceú/Údomain_namezutf-16ler   zncacn_np:%s[\PIPE\netlogon]r   ú:Ú Úset_credentialsú s   12345678ÚServerChallengeiÿÿ`z<Qé
   ÚLogonServerÚComputerNameÚValidationLevelÚ
LogonLevelÚLogonInformationÚtagÚLogonNetworkTransitiveÚIdentityÚLogonDomainNameÚParameterControlÚ	user_nameÚUserNameÚWorkstationÚLmChallengeÚntlmÚNtChallengeResponseÚlanmanÚLmChallengeResponseÚ
CredentialÚ	TimestampÚAuthenticators           ÚReturnAuthenticatorÚ
ExtraFlagsz-%s\%s successfully validated through NETLOGONÚsession_keyó    ÚValidationInformationÚValidationSam4ÚUserSessionKeyzSMB Signing key: %s zutf-8)3ÚloggingÚinfor‡   ÚdomainIpr   Ú
fromStringr€   ÚsplitÚdecoders   r   r	   ÚDCERPCTransportFactoryr�   ÚhasattrrŽ   Úget_dce_rpcÚconnectÚbindr   ÚMSRPC_UUID_NRPCÚhNetrServerReqChallenger
   r   ÚComputeSessionKeyStrongKeyÚComputeNetlogonCredentialÚhNetrServerAuthenticate3ÚNETLOGON_SECURE_CHANNEL_TYPEÚWorkstationSecureChannelr   r   ÚNetrLogonSamLogonWithFlagsÚNETLOGON_VALIDATION_INFO_CLASSÚNetlogonValidationSamInfo4ÚNETLOGON_LOGON_INFO_CLASSÚ$NetlogonNetworkTransitiveInformationr…   ÚNETLOGON_AUTHENTICATORÚrequestr   Ú	getLoggerÚlevelÚDEBUGÚ	tracebackÚ	print_excr   ÚstrÚget_error_coder   r   r   )rH   ÚauthenticateMessageBlobÚauthenticateMessageÚ_r€   Ú
domainNameÚ
serverNameÚstringBindingÚrpctransportÚlmhashÚnthashÚdceÚrespr…   ÚntHashÚ
sessionKeyÚpppÚclientStoredCredentialrÆ   ÚauthenticatorÚerÊ   ÚencryptedSessionKeyÚ
signingKeyrL   rL   rM   ÚnetlogonSessionKey”   sš   


þÿÿ€ûÿ
ÿz!SMBRelayClient.netlogonSessionKeyc                 C   sB   | j dt kr| j d¡}| j |¡ d| _ d S |  j d7  _ d S )Néú   zIPC$r   )r†   r   rD   ÚconnectTreeÚdisconnectTree)rH   ÚtidrL   rL   rM   Ú	keepAliveû   s
   
zSMBRelayClient.keepAlivec                 C   s"   | j d ur| j  ¡  d | _ d S d S rP   )rD   Úclose©rH   rL   rL   rM   ÚkillConnection  s   


þzSMBRelayClient.killConnectionc                 C   sN  t | j| j| jdd�| _| jjdu rd}nd}| jdu r&tjtj	B tj
B }ntj	tj
B }z| jjd | j| j| jd| jtjtjB ||d�	}W n" tyg } z| jjsWt d¡ nt d¡ W Y d }~d	S d }~ww |d
d… dkr‰d }| jjrxt}t| j| j| j| j ¡ ||d�}nt| j| j| j| j ¡ |d�}t | j| j| j|dd�| _dS )NT)rC   ÚmanualNegotiatez"NT LM 0.12 SMB 2.002 SMB 2.??? zNT LM 0.12 é<   )Úflags1Úflags2ÚdatazwSMBClient error: Connection was reset. Possibly the target has SMBv1 disabled. Try running ntlmrelayx with -smb2supportz%SMBClient error: Connection was resetFr   r   ó   þ)rK   rE   rW   )rK   rE   )rC   ÚexistingConnectionrê   )r5   Ú
targetHostr‰   rD   r‡   Úsmb2supportrF   r   ÚFLAGS2_EXTENDED_SECURITYÚFLAGS2_NT_STATUSÚFLAGS2_LONG_NAMESÚnegotiateSessionWildcardÚFLAGS1_PATHCASELESSÚFLAGS1_CANONICALIZED_PATHSÚ	Exceptionr   r   Úremove_targetr'   rU   ÚgetNMBServerrA   )rH   rî   rí   rz   rÞ   rW   Ú	smbClientrL   rL   rM   ÚinitConnection  sB   


þ
€ûÿÿÿzSMBRelayClient.initConnectionc                 C   s
   || _ d S rP   )Ú_uid)rH   ÚuidrL   rL   rM   ÚsetUid2  s   
zSMBRelayClient.setUidc                 C   sþ   t ƒ }| |¡ | jjrL|d t@ tkr|d  tN  < |d t@ tkr,|d  tN  < |d t@ tkr<|d  tN  < |d t@ tkrL|d  tN  < | ¡ }t	ƒ }| j
 ¡ tkrc| |  |¡¡ n| |  |¡¡ || _| ¡ | _|| jd< |d | _|S )NÚflagsÚCHALLENGE_MESSAGEÚ	challenge)r   r±   r‡   Ú
remove_micr7   r   r8   r9   ÚgetDatar   rD   Ú
getDialectr6   ÚsendNegotiatev1ÚsendNegotiatev2rƒ   r„   r‚   r…   )rH   rƒ   ÚnegoMessager  rL   rL   rM   ÚsendNegotiate5  s*   



zSMBRelayClient.sendNegotiatec                 C   sˆ   | j  ¡ }tƒ }d|d< t|ƒ|d< ||d< | ¡ }t|d< ||d< | |¡}| |¡}| t	¡rB|d |j
d< t|d ƒ}|d S dS )	Nr   ÚFlagsÚSecurityBufferLengthre   r\   rZ   Ú	SessionIDF)rD   ÚgetSMBServerr1   rs   rr   r2   rt   ru   rv   r3   Ú_Sessionr4   )rH   rƒ   Úv2clientÚsessionSetuprz   r|   r}   ÚsessionSetupResponserL   rL   rM   r  T  s   



zSMBRelayClient.sendNegotiatev2c           	      C   s¨  | j  ¡ }tƒ }tj|d< tj|d< | ¡ r|d  tjO  < | ¡ d }|j	|tj
 @ d� ttjƒ}tƒ |d< tƒ |d< d|d d< d	|d d
< d|d d< d|d d< tjtjB tjB |d d< t|ƒ|d d< |d  ¡  ||d d< d|d d< d|d d< | |¡ | |¡ | ¡ }z| tj¡ W n ty¦   t d¡ ‚ w | |d ¡ t|d d ƒ}t|d ƒ}t|d d�}|d |d< | |d ¡ |d S )NÚFlags1ÚFlags2r   ©rí   Ú
ParametersrZ   éÿÿ  ÚMaxBufferSizeé   ÚMaxMpxCountÚVcNumberr   Ú
SessionKeyrY   ÚSecurityBlobLengthÚSecurityBlobÚUnixÚNativeOSÚSambaÚNativeLanManzSessionSetup Error!ÚUid)r  )rD   r  r   r   r÷   ró   Úis_signing_requiredÚFLAGS2_SMB_SECURITY_SIGNATUREÚ	get_flagsÚ	set_flagsÚFLAGS2_UNICODEr   ÚSMB_COM_SESSION_SETUP_ANDXr   r   ÚCAP_EXTENDED_SECURITYÚCAP_USE_NT_ERRORSÚCAP_UNICODErs   r  Ú
addCommandrt   ru   rv   rù   r   r   Úset_uidr   r   r±   )	rH   rƒ   Úv1clientÚsmbrí   r  ÚsessionResponseÚsessionParametersr‚   rL   rL   rM   r  j  sJ   








þzSMBRelayClient.sendNegotiatev1c                 C   s�  | j  ¡ }| ¡ d }|j|tj @ d� |d dkrÀtƒ }d|d< ttjƒ}t	ƒ |d< t
ƒ |d< d	|d d
< d|d d< t ¡ |d d< |jd |d d< t|d ƒ|d d< t|d ƒ|d d< tj|d d< |d |d d< |d |d d< |d |d d< |d |d d< d|d d< d|d d< | |¡ | |¡ | ¡ }z| tj¡ W n	   d tf Y S | |d ¡ |tfS d }t}||fS )Nr   r  ÚAccountr�   é   r  r  rZ   r  Ú	MaxBufferr  r  ÚVCNumberr  ÚAnsiPwdÚAnsiPwdLengthÚ
UnicodePwdÚUnicodePwdLengthrY   ÚPrimaryDomainr  r   r!  r"  r#  )rD   r  r&  r'  r   ró   r   r   r)  r   r   ÚosÚgetpidÚ_dialects_parametersrs   ÚCAP_RAW_MODEr-  rt   ru   rv   r   r.  r   r   )rH   ÚsessionSetupDatar/  rí   r0  r  ÚclientResponseÚ	errorCoderL   rL   rM   ÚsendStandardSecurityAuth­  sD   





z'SMBRelayClient.sendStandardSecurityAuthNc                 C   sº  | j jr`tƒ }| |¡ |d t@ tkr|d  tN  < |d t@ tkr,|d  tN  < |d t@ tkr<|d  tN  < |d t@ tkrL|d  tN  < d|d< d|d< d|d< d|d< | ¡ }|}d }| j j	r³|}|  
|¡\}}tƒ }| |¡ |dd… d	 |d
d …  }t|| j| j | ƒ}	tƒ }
|dd… |	 |d
d …  |
d< |dd… |	 |d
d …  }| j ¡ tkrÃ|  ||¡\}}n|  ||¡\}}|rÙt d¡ | jj |¡ ||fS )Nr  rª   ÚMICr   ÚMICLenÚVersionÚ
VersionLenéH   s                   éX   ÚResponseTokenzEnabling session signing)r‡   r  r   r±   r7   r   r8   r9   r  rú   rá   r   rƒ   r„   r;   rD   r  r6   Ú
sendAuthv1Ú
sendAuthv2r®   r¯   Ú_SMBConnectionÚset_session_key)rH   rÎ   r…   ÚauthMessageÚauthDatarà   rB  ÚresÚnewAuthBlobÚ	relay_MICÚ
respToken2ÚtokenrL   rL   rM   ÚsendAuthÚ  sF   

 
zSMBRelayClient.sendAuthc           	      C   s–   t d|d d… ƒd tjkrt|ƒ}|d }n|}| j ¡ }tƒ }d|d< | ¡ }t|d< ||d< t|ƒ|d< ||d	< | 	|¡}| 
|¡}||d
 fS )NÚBr   r   rJ  r  r\   rZ   r  re   ÚStatus)r   r;   ÚSPNEGO_NEG_TOKEN_RESPrD   r  r1   rr   r2   rs   rt   ru   )	rH   rÎ   r…   Ú	respTokenrP  r  r  rz   r|   rL   rL   rM   rL    s   



zSMBRelayClient.sendAuthv2c           	      C   sj  t d|d d… ƒd tjkrt|ƒ}|d }n|}| j ¡ }tƒ }tj|d< tjtj	B |d< | 
¡ r;|d  tjO  < | ¡ |d< ttjƒ}tƒ |d< tƒ |d	< d
|d d< d|d d< d|d d< d|d d< tjtjB tjB |d d< d|d	 d< d|d	 d< t|ƒ|d d< ||d	 d< | |¡ | |¡ | ¡ }|d d> }||d d> 7 }||d 7 }||fS )NrW  r   r   rJ  r  r  r#  r  rZ   r  r  r  r  r  r  rY   r  r   r!  r"  r  r  Ú	ErrorCodeé   Ú	_reservedr4  Ú
ErrorClass)r   r;   rY  rD   r  r   r   r÷   ró   r(  r$  r%  Úget_uidr   r)  r   r   r*  r+  r,  rs   r-  rt   ru   )	rH   rÎ   r…   rZ  rP  r/  r0  r  rB  rL   rL   rM   rK  /  s<   







zSMBRelayClient.sendAuthv1c                 C   s    | j  ¡ tkr| j  ¡  ¡ S d S rP   )rD   r  r6   r  Úget_encryption_keyrè   rL   rL   rM   ÚgetStandardSecurityChallenge\  s   z+SMBRelayClient.getStandardSecurityChallengec              
   C   s�   t | j ¡ dd| jd�}| ¡ }z| ¡  W n   Y dS | tj¡ zt |d 	| j
j¡dd¡}W dS  tjyG } zW Y d }~dS d }~ww )	NrB   z\svcctl)Úsmb_connectionz{} zServicesActive i?  ÚTRUEÚFALSE)r=   rD   ÚgetRemoteHostr¶   r·   r¸   r>   ÚMSRPC_UUID_SCMRÚhROpenSCManagerWÚformatrˆ   Úhostnamer   )rH   rÔ   r×   r}   rÞ   rL   rL   rM   ÚisAdminb  s    
ø
€þzSMBRelayClient.isAdmin)rB   TrP   )rQ   rR   rS   ÚPLUGIN_NAMErG   rá   ræ   ré   rý   r   r
  r  r  rC  rV  rL  rK  ra  rj  rL   rL   rL   rM   r?   „   s"    
g'C
-
;
-)Tr®   r<  Úbinasciir   r   Ústructr   r   Úsocketr   ÚsocketerrorÚimpacket.dcerpc.v5.rpcrtr   Úimpacket.dcerpc.v5r   r	   Úimpacket.dcerpc.v5.ndrr
   Úimpacketr   Ú$impacket.examples.ntlmrelayx.clientsr   Ú0impacket.examples.ntlmrelayx.servers.socksserverr   Úimpacket.nt_errorsr   r   r   Úimpacket.ntlmr   r   r   r   r   r   Úimpacket.smbr   r   r   r   r   r   r   r   r   Úimpacket.smb3r    r!   r"   r#   r$   r%   r&   r'   r(   r)   r*   r+   r,   r-   r.   r/   r0   r1   r2   r3   r4   Úimpacket.smbconnectionr5   r6   r7   r8   r9   Úimpacket.spnegor:   r;   r<   Úimpacket.dcerpc.v5.transportr=   r>   ÚPROTOCOL_CLIENT_CLASSrA   rU   r?   rL   rL   rL   rM   Ú<module>   s2    ,\$I