o
    àý°j¡i  ã                   @   sH  d dl Z d dlZd dlZd dlZd dlmZ d dlmZ d dlm	Z	 d dl
mZ d dlmZ d dlmZ d dlmZmZmZ d d	lmZmZ d d
lmZmZmZmZmZmZmZmZm Z m!Z!m"Z"m#Z# d dl$m%Z%m&Z&m'Z'm(Z( d dl)m*Z*m+Z+m,Z,m-Z-m.Z.m/Z/m0Z0m1Z1m2Z2m3Z3m4Z4m5Z5 d dl$m6Z6m7Z7 d dlm8Z8 dZ9G dd„ deƒZ:dS )é    N)Úunpack)Úhexlify)Úb)ÚLOG)Ú
SocksRelay)ÚNetBIOSTCPSession)ÚSTATUS_MORE_PROCESSING_REQUIREDÚSTATUS_SUCCESSÚSTATUS_ACCESS_DENIED)ÚNTLMAuthChallengeResponseÚNTLMSSP_NEGOTIATE_SIGN)ÚNewSMBPacketÚ
SMBCommandÚSMBÚSMBExtended_Security_DataÚSMBExtended_Security_ParametersÚSMBNTLMDialect_ParametersÚSMBNTLMDialect_DataÚ0SMBSessionSetupAndX_Extended_Response_ParametersÚ*SMBSessionSetupAndX_Extended_Response_DataÚ'SMBSessionSetupAndX_Extended_ParametersÚ!SMBSessionSetupAndX_Extended_DataÚ	POSIXtoFT)ÚSPNEGO_NegTokenInitÚ	TypesMechÚSPNEGO_NegTokenRespÚASN1_AID)Ú
SMB2PacketÚSMB2_FLAGS_SERVER_TO_REDIRÚSMB2_NEGOTIATEÚSMB2Negotiate_ResponseÚSMB2_SESSION_SETUPÚSMB2SessionSetup_ResponseÚSMB2SessionSetupÚSMB2_LOGOFFÚSMB2Logoff_ResponseÚSMB2_DIALECT_WILDCARDÚSMB2_FLAGS_SIGNEDÚSMB2_SESSION_FLAG_IS_GUEST)Ú	MechTypesÚASN1_SUPPORTED_MECH)ÚSMB_DIALECTÚSMBSocksRelayc                   @   s`   e Zd ZdZdZdd„ Zedd„ ƒZdd„ Zd	d
„ Z	dd„ Z
dd„ Zdd„ Zdd„ Zdd„ ZdS )r,   zSMB Socks Pluginr   c                 C   sˆ   t  | ||||¡ d | _d| _t| _t| ¡ ƒD ])}|dkrA|dkrAd|| v rA|| d j 	¡ | _|| d j 	¡ tu| _ d S qd S )NFÚdataÚschemeÚprotocolClient)
r   Ú__init__Ú_SMBSocksRelay__NBSessionÚisSMB2r+   ÚserverDialectÚlistÚkeysÚsessionÚ
getDialect)ÚselfÚ
targetHostÚ
targetPortÚsocksSocketÚactiveRelaysÚkey© r>   ú¨/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/impacket/examples/ntlmrelayx/servers/socksplugins/smb.pyr0   3   s   €ûzSMBSocksRelay.__init__c                   C   s   dS )Ni½  r>   r>   r>   r>   r?   ÚgetProtocolPortB   s   zSMBSocksRelay.getProtocolPortc                 C   s   t dd| j| j| jd�| _d S )NÚ ÚHOST)Ú	sess_portÚsock)r   r9   r:   r;   r1   )r8   r>   r>   r?   ÚinitConnectionF   s   zSMBSocksRelay.initConnectionc                 C   sð   |   ¡ \}}t|tƒdu rG|d tjkr.|  |¡}| j | ¡ ¡ | j	r(|  
¡ S |   ¡ \}}|d tjkrE|  |¡\| _| _| jd u rEdS dS |d tkr`|  |¡}| j | ¡ ¡ |   ¡ \}}|d tkrv|  |¡\| _| _| jd u rvdS dS )NFÚCommandT)ÚgetSMBPacketÚ
isinstancer   r   ÚSMB_COM_NEGOTIATEÚgetNegoAnswerr1   Úsend_packetÚgetDatar2   ÚskipAuthenticationÚSMB_COM_SESSION_SETUP_ANDXÚprocessSessionSetupÚclientConnectionÚusernamer   r!   )r8   ÚpacketÚ
smbCommandÚrespr>   r>   r?   rM   J   s,   

ö

z SMBSocksRelay.skipAuthenticationc              
   C   s4  	 | j  ¡  ¡ }t|ƒdkr	 dS | jdu r™t|d�}|d tjkr5t 	d| j
| j| jf ¡ |  |¡}nÞ| j ¡ j |¡ | j ¡ j ¡  ¡ }t|d�}|d tjks[|d tjkr�z	 | j ¡ jjdd� ¡ }| j  |¡ |}q] tyŽ } zt|ƒ d	¡dkrƒn‚ W Y d }~nd }~ww t|ƒdkr˜	 dS nzt|d�}|d
 }d|d< |d  t M  < |d | j ¡ jd v du r×i | j ¡ jd |d < d| j ¡ jd |d  d< |d tkrðt 	d| j
| j| jf ¡ |  |¡}n#| j ¡  |¡ | j ¡  ¡ }t| ¡ ƒdk�r	 dS ||d
< | ¡ }| j  |¡ q)NTr   F©r-   rF   z#SOCKS: Avoiding logoff for %s@%s:%sé   )Útimeoutz	timed outÚ	MessageIDrA   Ú	SignatureÚFlagsÚTreeIDÚTreeConnectTableÚEncryptData)r1   Úrecv_packetÚget_trailerÚlenr2   r   r   ÚSMB_COM_LOGOFF_ANDXr   ÚdebugrQ   r9   r:   ÚgetLogOffAnswerrP   ÚgetSMBServerÚ_sessrK   ÚSMB_COM_TRANSACTIONÚSMB_COM_TRANSACTION2Ú	ExceptionÚstrÚfindr   r'   Ú_Sessionr$   ÚsendSMBÚrecvSMBrL   )r8   r-   rR   Údata2ÚeÚorigIDr>   r>   r?   ÚtunnelConnectionj   sd   C
¿

ûþ€þ"Ý
úºzSMBSocksRelay.tunnelConnectionc                 C   s²   | j  ¡ }zt| ¡ d�}t|d d ƒ}W ||fS  tyX   zt| ¡ d�}d }W n" tyM } ztjddd� t 	dt
|ƒ ¡ W Y d }~n
d }~ww Y ||fS Y ||fS w )NrU   ÚDatar   z
Exception:T)Úexc_infoz	SOCKS: %s)r1   r^   r   r_   r   rh   r   r   rb   Úerrorri   )r8   r-   rR   rS   ro   r>   r>   r?   rG   ·   s&   

÷€þÿþ÷zSMBSocksRelay.getSMBPacketc           
      C   sî  | j du rßt|d d ƒ}ttjƒ}tƒ }tj|d< |d |d< |d |d< |d |d< |d  d¡}| d	¡d
 }|d tj@ rytjtj	B tj
B |d< tƒ }d|d< tƒ }td g|d< | ¡ |d< tƒ }	tjtjB tjB tjB |	d< d|	d< n"tj	tj
B |d< tƒ }	tƒ }d|d< d|d< d|	d< tjtjB |	d< |	d  tjO  < ||	d< tjtjB |	d< d
|	d< d
|	d< d|	d< d|	d< d|	d < d|	d!< d|	d"< d|	d#< ||d< |	|d$< | |¡ |S tƒ }t|d%< t|d&< d
|d'< d
|d(< t|d)< d|d*< d|d+< d|d,< tƒ }d
|d< t|tƒ�rt |d-< n| j!|d-< |d+ |d+< t"d. #d/d0„ t$d1ƒD ƒ¡ƒ|d2< d3|d< d|d4< d|d5< d|d6< t%t& 't( )¡ ¡ƒ|d7< t%t& 't( )¡ ¡ƒ|d8< d9|d:< tƒ }td g|d< | ¡ |d;< t*|d; ƒ|d<< ||d< |S )=NFrr   r   ÚFlags1ÚPidÚTidÚMidó   s   NT LM 0.12 rV   ÚFlags2s   AAAAAAAAAAAAAAAAÚ
ServerGUIDú2NTLMSSP - Microsoft NTLM Security Support Providerr)   ÚSecurityBlobÚCapabilitiesÚChallengeLengthó    ÚPayloads   "3DUfwˆÚ	Challengeé   ÚDialectIndexÚSecurityModeÚMaxMpxCountÚMaxNumberVcsi ú  ÚMaxBufferSizei   Ú
MaxRawSizeÚ
SessionKeyÚLowDateTimeÚHighDateTimeÚServerTimeZoneÚ
ParametersrZ   ÚStatusÚCreditRequestResponseÚCreditChargerF   Ú	SessionIDrX   r[   ÚDialectRevisionrA   c                 S   s   g | ]}t  tj¡‘qS r>   )ÚrandomÚchoiceÚstringÚascii_letters)Ú.0Ú_r>   r>   r?   Ú
<listcomp>  s    z/SMBSocksRelay.getNegoAnswer.<locals>.<listcomp>é   Ú
ServerGuidé   ÚMaxTransactSizeÚMaxReadSizeÚMaxWriteSizeÚ
SystemTimeÚServerStartTimeé€   ÚSecurityBufferOffsetÚBufferÚSecurityBufferLength)+r2   r   r   rI   r   ÚFLAGS1_REPLYÚsplitÚindexÚFLAGS2_EXTENDED_SECURITYÚFLAGS2_NT_STATUSÚFLAGS2_UNICODEr   r   r   rL   r   ÚCAP_EXTENDED_SECURITYÚCAP_USE_NT_ERRORSÚCAP_NT_SMBSÚCAP_UNICODEr   r   ÚCAP_RPC_REMOTE_APISÚSECURITY_AUTH_ENCRYPTEDÚSECURITY_SHARE_USERÚ
addCommandr   r   r	   r   r    rH   r&   r3   r   ÚjoinÚranger   ÚcalendarÚtimegmÚtimeÚgmtimer`   )
r8   Ú
recvPacketrS   ÚrespSMBCommandrT   Údialectsr©   Ú_dialects_dataÚblobÚ_dialects_parametersr>   r>   r?   rJ   Ç   s”   


ÿÿ

%Ý

 zSMBSocksRelay.getNegoAnswerc                 C   sÌ  | j du �rÑttjƒ}t|d d ƒ}|d dk�rÊtƒ }tƒ }| jd }|d  t M  < tƒ }d|d	< t	d
 |d< | 
¡ |d< t| 
¡ ƒ|d< |d |d< | 
¡ |d< d|d< d|d< ||d< ||d< tƒ }tj|d< tj|d< |d |d< |d |d< |d |d< d|d< t}	|	d? |d< |	d@ |d< | |¡ | j | 
¡ ¡ |  ¡ \}}t|d ƒ}
tƒ }|
d |d< | |d ¡ td|d dd… ƒd tkrÙt|d ƒ}|d }n
t|d ƒ}|d }tƒ }| |¡ zd |d!  d"¡|d#  d"¡f  ¡ }W n t�y   d |d! |d# f  ¡ }Y nw || jv �r7t  d$|| j!f ¡ t"}	| j| d% j#}| $¡  %¡ }nt &d&|| j!f ¡ t'}	d}d }tƒ }|d tjB |d< |d tj(B |d< |d' |d'< |d |d< |d |d< |d |d< ||d< |	d? |d< |	d@ |d< d|d< d|d< |dk�r˜d(|d< d }n&tƒ }d)|d	< t|ƒ|d< |d |d< | 
¡ |d< ||d< ||d< | |¡ | j | 
¡ ¡ ||fS t &d*¡ d S t)ƒ }t*|d ƒ}|d+ }d}td|dd… ƒd tk�r|t|ƒ}|d }t|d, d ƒdk�r{|d, d }|t	d
 k�r{|t+v �rt+| }nt,|ƒ}t -d-| ¡ d.}d/|d0< t|ƒ|d1< ||d+< t.ƒ }t/|d2< t"|d3< d|d4< |d5 |d5< |d' |d'< d|d6< |d7 |d7< |d8 |d8< |d9 |d9< ||d< | j | 
¡ ¡ |  ¡ \}}|  0|¡S ntd|dd… ƒd t1k�r“t|ƒ}|d }nd:}|}| jd }|d  t M  < |du �r¾tƒ }d|d	< t	d
 |d< | 
¡ |d< n|}t.ƒ }t/|d2< t|d3< d|d4< |d5 |d5< |d' |d'< d|d6< |d7 |d7< |d8 |d8< |d9 |d9< d/|d0< t|ƒ|d1< | 
¡ |d+< ||d< | j | 
¡ ¡ |  ¡ \}}t*|d ƒ}|d+ }t|ƒ}|d }tƒ }| |¡ zd |d!  d"¡|d#  d"¡f  ¡ }W n t�yW   d |d! |d# f  ¡ }Y nw tƒ }|| jv �r}t  d$|| j!f ¡ t"}	| j| d% j#}| $¡ j2d6 }nt &d&|| j!f ¡ t'}	d}d }d)|d	< t.ƒ }t/|d2< |	|d3< d|d4< |d5 |d5< |d' |d'< ||d6< |d7 |d7< |d8 |d8< |d9 |d9< d/|d0< t3|d;< t|ƒ|d1< | 
¡ |d+< ||d< | j | 
¡ ¡ ||fS )<NFrr   r   Ú	WordCounté   ÚCHALLENGE_MESSAGEÚflagsó   ÚNegStater|   ÚSupportedMechÚResponseTokenÚSecurityBlobLengthr}   rA   ÚNativeOSÚNativeLanManrŽ   ru   rz   rv   rw   rx   ÚUidr›   Ú	ErrorCodeéÿ   Ú
ErrorClassÚBrV   Ú	MechTokenz%s/%sÚdomain_namezutf-16leÚ	user_namez-SOCKS: Proxying client session for %s@%s(445)r/   z*SOCKS: No session for %s@%s(445) availablerF   s      ó    z4SOCKS: Can't handle standard security at the moment!r¥   r)   z:Unsupported MechType '%s', we just want NTLMSSP, answerings   ¡0 
¡
+‚7
éH   r¤   r¦   rZ   r�   r�   r‘   r’   ÚReservedrX   r[   TÚSessionFlags)4r2   r   r   rN   r   r   ÚsessionDatar   r   r   rL   r`   r   r§   r«   r   r´   r1   rK   rG   r   r   Ú
fromStringr   r   r   r   ÚdecodeÚupperÚUnicodeDecodeErrorr<   r   Úinfor9   r	   r6   rd   Úget_uidrt   r
   rª   r"   r#   r)   r   rb   r   r   rO   r*   rk   r(   )r8   r»   r¼   rS   ÚrespParametersÚrespDataÚchallengeMessageÚ	respTokenrT   Ú	errorCodeÚsessionSetupParametersÚsessionSetupDatar¿   ÚtokenÚauthenticateMessagerQ   Ú	smbClientÚuidÚsecurityBlobÚrawNTLMÚmechTypeÚmechStrr>   r>   r?   rO   "  s‚  






ÿÿþ





€



ÿÿþz!SMBSocksRelay.processSessionSetupc                 C   sò   | j du r=ttjƒ}tƒ }tj|d< |d |d< |d |d< |d |d< |d |d< d}d}||d< ||d	< | |¡ |S tƒ }tƒ }t	|d
< t
|d< d|d< |d |d< |d |d< |d |d< |d |d< |d |d< |d |d< ||d	< |S )NFru   rv   rw   rx   rÌ   r€   rŽ   rr   rZ   r�   rV   r�   r‘   rF   r’   rÖ   rX   r[   )r2   r   r   ra   r   r§   r´   r%   r   r   r	   )r8   r»   r¼   rT   rß   rà   r>   r>   r?   rc   (  s6   



òzSMBSocksRelay.getLogOffAnswerN)Ú__name__Ú
__module__Ú__qualname__ÚPLUGIN_NAMEÚPLUGIN_SCHEMEr0   Ústaticmethodr@   rE   rM   rq   rG   rJ   rO   rc   r>   r>   r>   r?   r,   /   s    
 M[  );r·   r¹   r”   r–   Ústructr   Úbinasciir   Úsixr   Úimpacketr   Ú0impacket.examples.ntlmrelayx.servers.socksserverr   Úimpacket.nmbr   Úimpacket.nt_errorsr   r	   r
   Úimpacket.ntlmr   r   Úimpacket.smbr   r   r   r   r   r   r   r   r   r   r   r   Úimpacket.spnegor   r   r   r   Úimpacket.smb3r   r   r   r    r!   r"   r#   r$   r%   r&   r'   r(   r)   r*   r+   ÚPLUGIN_CLASSr,   r>   r>   r>   r?   Ú<module>   s&   88