o
    àý°jèA  ã                   @   sF   d dl Z d dlZd dlZd dlZd dlZd dlZG dd„ dejƒZdS )é    Nc                   @   s  e Zd ZdDdd„Zdd„ Zdd„ Zd	d
„ Zdd„ Zdd„ Zdd„ Z	dd„ Z
dd„ Zdd„ Zdd„ ZdEdd„Zdd„ Zdd„ Zd d!„ Zd"d#„ Zd$d%„ Zd&d'„ Zd(d)„ Zd*d+„ Zd,d-„ Zd.d/„ Zd0d1„ Zd2d3„ Zd4d5„ Zd6d7„ Zd8d9„ Zd:d;„ Zd<d=„ Zd>d?„ Z d@dA„ Z!dBdC„ Z"dS )FÚSQLSHELLFNc                 C   sz   |d ur"t jj| |j|jd� |jt_|jt_|jt_d| _|| _n	t j | ¡ d | _|| _	|| _
g | _|  ¡  d| _d S )N)ÚstdinÚstdoutFz'[!] Press help for extra shell commands)ÚcmdÚCmdÚ__init__r   r   ÚsysÚstderrÚuse_rawinputÚshellÚsqlÚshow_queriesÚatÚ
set_promptÚintro)ÚselfÚSQLr   ÚtcpShell© r   ú�/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/impacket/examples/mssqlshell.pyr       s   
zSQLSHELL.__init__c                 C   s   | j jttd� d S )N)Úerror_loggerÚinfo_logger)r   ÚprintRepliesÚprint©r   r   r   r   Úprint_replies2   s   zSQLSHELL.print_repliesc                 C   s   t dƒ d S )Naü  
    lcd {path}                 - changes the current local directory to {path}
    exit                       - terminates the server process (and this session)
    enable_xp_cmdshell         - you know what it means
    disable_xp_cmdshell        - you know what it means
    enum_db                    - enum databases
    enum_links                 - enum linked servers
    enum_impersonate           - check logins that can be impersonated
    enum_logins                - enum login users
    enum_users                 - enum current db users
    enum_owner                 - enum db owner
    exec_as_user {user}        - impersonate with execute as user
    exec_as_login {login}      - impersonate with execute as login
    xp_cmdshell {cmd}          - executes cmd using xp_cmdshell
    xp_dirtree {path}          - executes xp_dirtree on the path
    sp_start_job {cmd}         - executes cmd using the sql server agent (blind)
    use_link {link}            - linked server to use (set use_link localhost to go back to local or use_link .. to get back one step)
    enable_rpc {link}          - enable RPC Out for a linked server
    disable_rpc {link}         - disable RPC Out for a linked server
    ! {cmd}                    - executes a local shell cmd
    upload {from} {to}         - uploads file {from} to the SQLServer host {to}
    download {from} {to}       - downloads file from the SQLServer host {from} to {to}
    show_query                 - show query
    mask_query                 - mask query
    )r   ©r   Úliner   r   r   Údo_help6   s   zSQLSHELL.do_helpc                 C   s   |   ¡  |S ©N)r   )r   Ústopr   r   r   r   ÚpostcmdQ   s   zSQLSHELL.postcmdc                 C   s�   z|   dd¡}|d d }W n   d}Y | jd ur=t| jƒdkr=d}| jD ]
\}}|d| 7 }q&d||| jjf | _d S d	|| jjf | _d S )
Nz:select system_user + SPACE(2) + current_user as "username"Fr   Úusernameú-Ú ú>zSQL %s (%s@%s)> zSQL (%s@%s)> )Ú	sql_queryr   Úlenr   Ú	currentDBÚprompt)r   ÚrowÚusername_promptÚ	at_promptr   Úprefixr   r   r   r   U   s   zSQLSHELL.set_promptc                 C   ó
   d| _ d S ©NT©r   ©r   Úsr   r   r   Údo_show_queryc   ó   
zSQLSHELL.do_show_queryc                 C   r.   )NFr0   r1   r   r   r   Údo_mask_queryf   r4   zSQLSHELL.do_mask_queryc                 C   sh   | j d ur)t| j ƒdkr)| j dd … d \}}| j d d… | _ | j  ||f¡ d S |  |¡ |  ¡  d S )Nr   éÿÿÿÿ)r   r'   Úappendr&   r   )r   Úexec_asr   r-   r   r   r   Ú
execute_asi   s   
zSQLSHELL.execute_asc                 C   ó   d| }|   |¡ d S )Nzexecute as login='%s';©r9   ©r   r2   r8   r   r   r   Údo_exec_as_loginr   ó   zSQLSHELL.do_exec_as_loginc                 C   r:   )Nzexecute as user='%s';r;   r<   r   r   r   Údo_exec_as_userv   r>   zSQLSHELL.do_exec_as_userc                 C   st   |dkr	g | _ d S |dkr| j d d… | _ d S | j  |df¡ |  d¡}|  ¡  t|ƒdk r8| j d d… | _ d S d S )NÚ	localhostz..r6   r$   z select system_user as "username"é   )r   r7   r&   r   r'   )r   r2   r*   r   r   r   Údo_use_linkz   s   

ÿzSQLSHELL.do_use_linkTc                 C   sx   | j d ur+t| j ƒdkr+| j d d d… D ]\}}d| dd¡ | dd¡ d | }q| jr6|r6td| ƒ | j |¡S )Nr   r6   zEXEC ('ú'z''z') AT z[%%] %s)r   r'   Úreplacer   r   r   r&   )r   ÚqueryÚshowÚlinked_serverr-   r   r   r   r&   †   s   &
zSQLSHELL.sql_queryc                 C   s   t  |¡ d S r   )ÚosÚsystemr1   r   r   r   Údo_shellŽ   s   zSQLSHELL.do_shellc           
   
   C   sR  z�t j|dd�}|d }|d }|  d¡}|d  d¡dkr%tdƒ W d S |  d| d	 ¡}tt|d ƒƒ}|d  |¡dkrFtd
ƒ W d S tdƒ |  d| d ¡}t|ƒdkr`tdƒ W d S tdƒ t|dƒ�}t	 
|d  d¡ ¡ ¡}| |¡ W d   ƒ n1 s…w   Y  tdƒ W d S  ty¨ }	 ztd|	ƒ W Y d }	~	d S d }	~	ww )NF©Úposixr   rA   z\SELECT HAS_PERMS_BY_NAME(NULL, NULL, 'ADMINISTER BULK OPERATIONS') AS HasBulkAdminPermissionÚHasBulkAdminPermissionzF[-] Current user does not have 'ADMINISTER BULK OPERATIONS' permissionz%SELECT * FROM sys.dm_os_file_exists('z')z[-] File does not existz[+] File exists, downloading...z SELECT * FROM OPENROWSET(BULK N'z', SINGLE_BLOB) AS HexContentzD[-] Error downloading file. File is either empty or access is deniedz[+] Writing file to disk...ÚwbÚ
BulkColumnz[+] Downloadedú[-] Unhandled Exception:)ÚshlexÚsplitr&   Úgetr   ÚnextÚiterr'   ÚopenÚbytesÚfromhexÚdecodeÚwriteÚ	Exception)
r   r   ÚargsÚremote_pathÚ
local_pathÚresultÚ	first_keyÚfÚdataÚer   r   r   Údo_download‘   s8   
þ€ÿzSQLSHELL.do_downloadc              
   C   sr  d}�z|   d¡ |   d¡}|   d¡ |d  d¡dkr#tdƒ W d S tj|d	d
�}|d }|d }t|dƒ�}| ¡ }t |¡ 	¡ }	d 
t |¡ ¡ ¡ ¡ }
W d   ƒ n1 sYw   Y  tdt|
ƒd t|	ƒf ƒ tdƒ tdt|
ƒ|ƒD ]}d|
||| …  d | d }|   d| d ¡ qx|   d| d ¡}tt|d ƒƒ}|d  |¡dkrµtdƒ W d S tdƒ d| d | d }|   d| d ¡ td| ƒ d| d }|   d| d ¡ td| ƒ d| d }|   d| d ¡}td| ƒ |d  d ¡ d!d"¡}|	|k�rtd#ƒ W d S td$ƒ td%| ƒ W d S  t�y8 } ztd&|ƒ W Y d }~d S d }~ww )'Ni   zEexec master.dbo.sp_configure 'show advanced options', 1; RECONFIGURE;z*exec master.dbo.sp_configure 'xp_cmdshell'zEexec master.dbo.sp_configure 'show advanced options', 0; RECONFIGURE;r   Ú	run_valuerA   zC[-] xp_cmdshell not enabled. Try running 'enable_xp_cmdshell' firstFrK   Úrbó    z3[+] Data length (b64-encoded): %.2f KB with MD5: %si   z[+] Uploading...zecho z >> "z.b64"zEXEC xp_cmdshell 'rC   zEXEC xp_fileexist 'z.b64'zI[-] Error uploading file. Check permissions in the configured remote pathz[+] Uploadedzcertutil -decode "z.b64" "ú"z[+] zdel "zcertutil -hashfile "z" MD5Úoutputú r$   z[+] MD5 hashes matchz#[-] ERROR! MD5 hashes do NOT match!z[+] Uploaded file MD5: %srP   )r&   rS   r   rQ   rR   rV   ÚreadÚhashlibÚmd5Ú	hexdigestÚjoinÚbase64Ú	b64encoderY   r'   ÚstrÚrangerT   rU   rD   r[   )r   r   ÚBUFFER_SIZEr_   r\   r^   r]   ra   rb   Úmd5sumÚb64enc_dataÚir   r`   Úmd5sum_uploadedrc   r   r   r   Ú	do_upload´   sZ   


ý 
€ÿzSQLSHELL.do_uploadc                 C   ó4   z|   d| ¡ |  ¡  | j ¡  W d S    Y d S )Nz#exec master.sys.xp_dirtree '%s',1,1©r&   r   r   Ú	printRowsr1   r   r   r   Údo_xp_dirtreeí   s   zSQLSHELL.do_xp_dirtreec                 C   sD   z|   d| ¡ |  ¡  d| jjd d< | j ¡  W d S    Y d S )Nzexec master..xp_cmdshell '%s'é    r   ÚTypeData)r&   r   r   ÚcolMetar|   r1   r   r   r   Údo_xp_cmdshellõ   s   zSQLSHELL.do_xp_cmdshellc                 C   rz   )Na�  DECLARE @job NVARCHAR(100);SET @job='IdxDefrag'+CONVERT(NVARCHAR(36),NEWID());EXEC msdb..sp_add_job @job_name=@job,@description='INDEXDEFRAG',@owner_login_name='sa',@delete_level=3;EXEC msdb..sp_add_jobstep @job_name=@job,@step_id=1,@step_name='Defragmentation',@subsystem='CMDEXEC',@command='%s',@on_success_action=1;EXEC msdb..sp_add_jobserver @job_name=@job;EXEC msdb..sp_start_job @job_name=@job;r{   r1   r   r   r   Údo_sp_start_jobþ   s   ùzSQLSHELL.do_sp_start_jobc                 C   s&   |dkrt t ¡ ƒ d S t |¡ d S )Nr$   )r   rH   ÚgetcwdÚchdirr1   r   r   r   Údo_lcd  s   zSQLSHELL.do_lcdc                 C   ó0   z|   d¡ |  ¡  | j ¡  W d S    Y d S )Nz}exec master.dbo.sp_configure 'show advanced options',1;RECONFIGURE;exec master.dbo.sp_configure 'xp_cmdshell', 1;RECONFIGURE;r{   r   r   r   r   Údo_enable_xp_cmdshell  ó   
zSQLSHELL.do_enable_xp_cmdshellc                 C   r†   )Nzjexec sp_configure 'xp_cmdshell', 0 ;RECONFIGURE;exec sp_configure 'show advanced options', 0 ;RECONFIGURE;r{   r   r   r   r   Údo_disable_xp_cmdshell  rˆ   zSQLSHELL.do_disable_xp_cmdshellc                 C   s<   |   d¡ |  ¡  | j ¡  |   d¡ |  ¡  | j ¡  d S )NzEXEC sp_linkedserverszEXEC sp_helplinkedsrvloginr{   r   r   r   r   Údo_enum_links%  s   


zSQLSHELL.do_enum_linksc                 C   óD   |st dƒ dS z|  d| ¡ |  ¡  | j ¡  W dS    Y dS )zQEnable RPC Out for a linked server to allow executing stored procedures remotely.z%[-] Usage: enable_rpc <linked_server>NzGEXEC sp_serveroption @server='%s', @optname='rpc out', @optvalue='true'©r   r&   r   r   r|   r1   r   r   r   Údo_enable_rpc-  ó   zSQLSHELL.do_enable_rpcc                 C   r‹   )z$Disable RPC Out for a linked server.z&[-] Usage: disable_rpc <linked_server>NzHEXEC sp_serveroption @server='%s', @optname='rpc out', @optvalue='false'rŒ   r1   r   r   r   Údo_disable_rpc9  rŽ   zSQLSHELL.do_disable_rpcc                 C   s    |   d¡ |  ¡  | j ¡  d S )NzEXEC sp_helpuserr{   r   r   r   r   Údo_enum_usersE  s   
zSQLSHELL.do_enum_usersc                 C   r†   )Nz1select name, is_trustworthy_on from sys.databasesr{   r   r   r   r   Ú
do_enum_dbJ  ó   
zSQLSHELL.do_enum_dbc                 C   r†   )NzISELECT name [Database], suser_sname(owner_sid) [Owner] FROM sys.databasesr{   r   r   r   r   Údo_enum_ownerR  r’   zSQLSHELL.do_enum_ownerc              
   C   s¾   | j j}zRz9|  d¡ g }| j jD ]}|  d|d  d ¡}|r%| |¡ q|  d¡}| |¡ |  ¡  || j _| j  ¡  W n   Y W |  d| ¡ d S W |  d| ¡ d S |  d| ¡ w )Nzselect name from sys.databaseszuse Únamea\  ; SELECT 'USER' as 'execute as', DB_NAME() AS 'database',pe.permission_name,pe.state_desc, pr.name AS 'grantee', pr2.name AS 'grantor' FROM sys.database_permissions pe JOIN sys.database_principals pr ON   pe.grantee_principal_id = pr.principal_Id JOIN sys.database_principals pr2 ON   pe.grantor_principal_id = pr2.principal_Id WHERE pe.type = 'IM'aM  SELECT 'LOGIN' as 'execute as', '' AS 'database',pe.permission_name,pe.state_desc,pr.name AS 'grantee', pr2.name AS 'grantor' FROM sys.server_permissions pe JOIN sys.server_principals pr   ON pe.grantee_principal_id = pr.principal_Id JOIN sys.server_principals pr2   ON pe.grantor_principal_id = pr2.principal_Id WHERE pe.type = 'IM')r   r(   r&   ÚrowsÚextendr   r|   )r   r   Úold_dbr_   r*   Úresult_rowsr   r   r   Údo_enum_impersonateZ  s&   


€

ü"zSQLSHELL.do_enum_impersonatec                 C   r†   )Na  select r.name,r.type_desc,r.is_disabled, sl.sysadmin, sl.securityadmin, sl.serveradmin, sl.setupadmin, sl.processadmin, sl.diskadmin, sl.dbcreator, sl.bulkadmin from  master.sys.server_principals r left join master.sys.syslogins sl on sl.sid = r.sid where r.type in ('S','E','X','U','G')r{   r   r   r   r   Údo_enum_logins|  s   
zSQLSHELL.do_enum_loginsc                 C   s0   z|   |¡ |  ¡  | j ¡  W d S    Y d S r   r{   r   r   r   r   Údefault‡  r’   zSQLSHELL.defaultc                 C   s   d S r   r   r   r   r   r   Ú	emptyline�  s   zSQLSHELL.emptylinec                 C   s   | j d ur
| j  ¡  dS r/   )r   Úcloser   r   r   r   Údo_exit’  s   

zSQLSHELL.do_exit)FN)T)#Ú__name__Ú
__module__Ú__qualname__r   r   r   r!   r   r3   r5   r9   r=   r?   rB   r&   rJ   rd   ry   r}   r�   r‚   r…   r‡   r‰   rŠ   r�   r�   r�   r‘   r“   r™   rš   r›   rœ   rž   r   r   r   r   r      sB    
	
#9			"r   )rH   r   r   rl   rp   rQ   r   r   r   r   r   r   Ú<module>   s   