o
    àý°j‚2  ã                   @   sØ   d dl Z e  d¡Ze  d¡Zdd„ Zdd„ Zd dlmZmZ d dl	Z	d dl
Z
d d	lmZ d d
lmZmZ d!dd„Zd"dd„Zdd„ Zdd„ Zd dlmZ d dlZd#dd„ZdZd$dd„Zd!dd„Zd dlZd!dd „ZdS )%é    Nz.(?:(?:([^/@:]*)/)?([^@:]*)(?::([^@]*))?@)?(.*)z$(?:(?:([^/:]*)/)?([^:]*)(?::(.*))?)?c                 C   sP   t  | ¡ d¡\}}}}d|v r"|d | d¡d  }| d¡d }||||fS )a1   Helper function to parse target information. The expected format is:

    <DOMAIN></USERNAME><:PASSWORD>@HOSTNAME

    :param target: target to parse
    :type target: string

    :return: tuple of domain, username, password and remote name or IP address
    :rtype: (string, string, string, string)
    Ú ú@r   é   )Útarget_regexÚmatchÚgroupsÚ
rpartition)ÚtargetÚdomainÚusernameÚpasswordÚremote_name© r   úŠ/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/impacket/examples/utils.pyÚparse_target   s
   r   c                 C   s    t  | ¡ d¡\}}}|||fS )a   Helper function to parse credentials information. The expected format is:

    <DOMAIN></USERNAME><:PASSWORD>

    :param credentials: credentials to parse
    :type credentials: string

    :return: tuple of domain, username and password
    :rtype: (string, string, string)
    r   )Úcredential_regexr   r   )Úcredentialsr
   r   r   r   r   r   Úparse_credentials1   s   
r   )ÚSMBConnectionÚSessionError)Ú	unhexlify)ÚSPNEGO_NegTokenInitÚ	TypesMechFc              
   C   s    t | | ƒ}z| dd¡ W n. ty' } zt|ƒ d¡dkr"tdƒ‚‚ d }~w ty;   | ¡ dkr9td|  ƒ‚Y nw | ¡  |rLd| ¡ | ¡ f S | ¡ S )Nr   ÚSTATUS_NOT_SUPPORTEDr   z’The SMB request is not supported. Probably NTLM is disabled. Try to specify corresponding NetBIOS name or FQDN as the value of the -dc-host optionz%Error while anonymous logging into %sz%s.%s)	r   Úloginr   ÚstrÚfindÚ	ExceptionÚgetServerNameÚlogoffÚgetServerDNSDomainName)ÚmachineÚfqdnÚsÚer   r   r   Ú_get_machine_nameH   s"   
€ÿÿr%   r   Tc           ,   	   C   s@  ddl m}m} ddlm} 	 |dks|dkr?t|ƒd r!d| }t|ƒd r+d| }z
t|ƒ}t|ƒ}W n	 ty>   Y nw ddlm	} ddl
m}m}m}m} dd	lm}m} dd
lm} ddlm}m}m} dd l}|	d usu|
d urwd}d| }|rˆ| |||¡\}}}	}
|||jjjd�}|	d u r¨|
d u r§||||||||ƒ\}}}}n|	d }|	d }|	d }|
d u rÏ|||jjjd�} || |||||ƒ\}!}}}n|
d }!|
d }|
d }tƒ }"td g|"d< |j |!|ƒ d�d }!|ƒ }#|# !|!d ¡ |ƒ }$d|$d< t"|j#jjƒ|$d< g }%| $|%¡|$d< ||$d|#j%ƒ |ƒ }&d|&d< ||&d< ||&d|j&ƒ |j '|j(j)¡}'|'j*|&d< | %|'¡|&d< | +|&¡}(| ,|d|(d ¡})||$d < |j-|$d  d!< |)|$d  d< | +|$¡|"d"< t.j/j0 1| j2t.j3|d d#|" 4¡ ¡}*| j5�r~| j6dd$� d%| _7|  8|  9d&|*d ¡¡}+d| _7|+d d' dk�r›t:|+ƒ‚d%| _;d%S )(Nr   )ÚencoderÚdecoder)ÚnoValuer   r   Ú0)ÚCCache)ÚAP_REQÚAuthenticatorÚTGS_REPÚseq_set)ÚgetKerberosTGTÚgetKerberosTGS)Ú	constants)Ú	PrincipalÚKerberosTimeÚTicketFzldap/%s)ÚtypeÚKDC_REPÚcipherÚ
sessionKeyzMS KRB5 - Microsoft Kerberos 5Ú	MechTypes)Úasn1SpecÚticketé   Úpvnozmsg-typez
ap-optionszauthenticator-vnoÚcrealmÚcnameÚcusecÚctimeé   ÚauthenticatorÚetypeÚ	MechTokenz
GSS-SPNEGO)Úread_server_infoTÚbindRequestÚresult)<Úpyasn1.codec.berr&   r'   Úpyasn1.type.univr(   Úlenr   Ú	TypeErrorÚimpacket.krb5.ccacher*   Úimpacket.krb5.asn1r+   r,   r-   r.   Úimpacket.krb5.kerberosv5r/   r0   Úimpacket.krb5r1   Úimpacket.krb5.typesr2   r3   r4   ÚdatetimeÚ	parseFileÚPrincipalNameTypeÚNT_PRINCIPALÚvalueÚNT_SRV_INSTr   r   ÚdecodeÚ	from_asn1ÚintÚApplicationTagNumbersÚencodeFlagsÚto_asn1Úcomponents_to_asn1ÚnowÚtimezoneÚutcÚmicrosecondÚencodeÚencryptÚenctypeÚldap3Ú	operationÚbindÚbind_operationÚversionÚSASLÚgetDataÚclosedÚopenÚsasl_in_progressÚpost_send_single_responseÚsendr   Úbound),Ú
connectionr	   Úuserr   r
   ÚlmhashÚnthashÚaesKeyÚkdcHostÚTGTÚTGSÚuseCacher&   r'   r(   r*   r+   r,   r-   r.   r/   r0   r1   r2   r3   r4   rR   ÚuserNameÚtgtr7   ÚoldSessionKeyr8   Ú
serverNameÚtgsÚblobr;   ÚapReqÚoptsrC   r_   ÚencodedAuthenticatorÚencryptedEncodedAuthenticatorÚrequestÚresponser   r   r   Úldap3_kerberos_login[   s’   ÿ€

 rˆ   c
                 C   sÈ   d||f }
| }|d ur|}|rdnd}t j|t j||d�}|r:t  |¡}| ¡  t|| ||||||	|d�	 ||fS |dkrQ|dkrQt j||
|t jdd�}||fS t j||
|d	 | t jdd�}||fS )
Nz%s\%si|  i…  )Úget_infoÚportÚuse_ssl©rx   r   T)rt   r   ÚauthenticationÚ	auto_bindú:)rf   ÚServerÚALLÚ
Connectionrh   rˆ   ÚNTLM)r	   r‹   r
   r   r   ru   rv   ÚkÚdc_iprw   rt   Ú
connect_torŠ   Úldap_serverÚldap_sessionr   r   r   Ú_init_ldap_connectionÕ   s    
ûþr™   c
                 C   sZ   |r|d ur	|}
n|d urt |ƒ}
nt | ƒ}
n	|d ur|}
n| }
t|
|	| |||||||ƒ
S ©N)r%   r™   )r
   r   r   ru   rv   r”   r•   Údc_hostrw   Ú	use_ldapsr	   r   r   r   Úinit_ldap_sessioné   s   

r�   )Úldapc                 C   sŽ  |d ur|d u s||kr|} n$|d ur|d u s||kr|} n	|d ur%|} n|} |r3t  d¡ t| |ƒ} |r7dnd}z(t ||  ||¡}|durS| |||||	¡ W |S |j|||||	|
|d� W |S  tjyÆ } zXt|ƒ 	d¡dkr—t d|  ||¡}|durŠ| |||||	¡ n1|j|||||	|
|d� nt|ƒ 	d¡dkr¦t  
d	¡ ‚ |d ur³|d ur³t  
d
¡ ‚ W Y d }~|S W Y d }~|S d }~ww )NzGetting machine hostnamez
ldaps://%sz	ldap://%sTrŒ   ÚstrongerAuthRequiredr   ÚNTLMAuthNegotiatez_NTLM negotiation failed. Probably NTLM is disabled. Try to use Kerberos authentication instead.zkIf the credentials are valid, check the hostname and IP address of KDC. They must match exactly each other.)ÚloggingÚinfor%   rž   ÚLDAPConnectionr   ÚkerberosLoginÚLDAPSessionErrorr   r   Úcritical)r	   Úbase_dnÚkdc_ipÚkdc_hostÚdo_kerberosr   r   r
   ru   rv   ÚaeskeyÚ
ldaps_flagÚtarget_domainr"   ÚurlÚldapConnectionr$   r   r   r   Ú
ldap_loginý   sH   

ðñ
þ

ù
ö
€ñr°   Ú AAD3B435B51404EEAAD3B435B51404EEú	Password:c                 C   sœ   t | ƒ\}}}|d u rd}|dkr+|dkr+|d u r+|du r+|d u r+ddlm}	 |	|ƒ}|d ur1d}d}
d}|d urF| d¡\}
}|
dkrFt}
||||
||fS )Nr   Fr   )ÚgetpassTr�   )r   r³   ÚsplitÚEMPTY_LM_HASH)r   ÚhashesÚno_passrw   r”   Úgetpass_msgr
   r   r   r³   ru   rv   r   r   r   Úparse_identity+  s   (r¹   c                 C   sx   | |f}t j}|r8t j}|  d¡}t|ƒdkr|d nd}zt|ƒ}W n ty1   t  |¡}Y nw |d|f }||fS )Nú%r   é   r   )ÚsocketÚAF_INETÚAF_INET6r´   rK   rZ   Ú
ValueErrorÚif_nametoindex)ÚiprŠ   Úipv6ÚaddressÚaddress_familyÚip_partsÚscope_idr   r   r   Úget_addressC  s   
ÿrÇ   c                 C   s4   t   |rt jnt j¡}t| ||ƒ\}}| |¡ |S rš   )r¼   r¾   r½   rÇ   Úconnect)rÁ   rŠ   rÂ   r#   Ú_rÃ   r   r   r   Úget_connected_socketU  s   
rÊ   )F)r   r   r   r   NNNT)FNF)NFNFr²   )ÚreÚcompiler   r   r   r   Úimpacket.smbconnectionr   r   rf   ÚsslÚbinasciir   Úimpacket.spnegor   r   r%   rˆ   r™   r�   Úimpacket.ldaprž   r¡   r°   rµ   r¹   rÇ   r¼   rÊ   r   r   r   r   Ú<module>   s,   



z
-

