o
    jp                     @   s  d dl mZ d dl mZ d dlZd dlZd dlZd dlZd dlZd dlZd dl	Z	d dl
mZ d dlmZmZ d dlmZ d dlmZmZmZmZmZmZmZmZ d dlmZmZ d d	lmZmZmZm Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z' d d
l(m)Z) d dl*m+Z+ d dl,m-Z- d dl.m/Z/m0Z0m1Z1m2Z2 d dl3m4Z4 de5e		 dd  Z6ej7j8Z9G dd dZ:G dd dej;Z<G dd de<Z=G dd de>Z?dd Z@eAdkreBejC ejDdddZEeEjFdd d!d" eEjFd#d d$d%d& eEjFd'd(d)d*d& eEjFd+d(d,d" eEjFd-d(d.d" eEjFd/d d0e9 d" eEjFd1g d2d3d4d5d6 eEjFd7d d8d9d: eEjFd;d d<d<d=gd>d? eEjFd@dAdBdCdD eEjFdEd(d)dFd& eEGdGZHeHjFdHd dIdJd: eHjFdKd(dLd" eHjFdMd(dNd" eHjFdOd dPdQd: eHjFdRd dSdTd: eHjFdUd dVdWd: eHjFdXd dYd" eIejJdZkreEK  eLdZ eEM ZNe+OeNjPeNjQ eNjRdureNjRZ9ne9du rd[Z9dBSeNjTdBkreNjUdu reVd\ eLdZ eNjWreNjTdBkreVd] eLdZ eNjXdurzeNjXYd^\ZZZ[e\e]eZe]e[ W n e>y   eVd_ eLdZ Y nw e-eNj^\Z_Z`ZaZbzeNjcdur5e@eNjc\Z_Z`ZaeQd`ede_ede`edeaf  e_du r<daZ_eNjedurNe4feNjee`e_eN deN_geadakrte`dakrteNjhdu rteNjid)u rteNjjdu rtd dblkmkZk ekdcZaeNjjdur}deN_ge:dBSeNjTe`eae_eNjheNjjeNjleNjUeNjgeNjmeNjneNjoZpepqebeNjW W n- e>erfy Zs zet juejvkrd dlwZwewx  eVe5es W Y dZs[sndZs[sww eLd  dS dS )d    )division)print_functionN)	b64encode)PY2PY3)version)IID_IDispatchstring_to_bin	IDispatch
DISPPARAMSDISPATCH_PROPERTYGETVARIANTVARENUMDISPATCH_METHOD)DCOMConnection
COMVERSION)OBJREFFLAGS_OBJREF_CUSTOMOBJREF_CUSTOMOBJREF_HANDLEROBJREF_EXTENDEDOBJREF_STANDARDFLAGS_OBJREF_HANDLERFLAGS_OBJREF_STANDARDFLAGS_OBJREF_EXTENDEDIRemUnknown2	INTERFACE)NULL)logger)parse_target)SMBConnectionSMB_DIALECTSMB2_DIALECT_002SMB2_DIALECT_21)Keytab__   c                   @   s,   e Zd Z		d
ddZdd Zddd	ZdS )DCOMEXEC NFc                 C   sv   || _ || _|| _|| _d| _d| _|| _|| _|| _|	| _	|
| _
|| _|| _d | _|d ur9|d\| _| _d S d S )Nr(   :)_DCOMEXEC__command_DCOMEXEC__username_DCOMEXEC__password_DCOMEXEC__domain_DCOMEXEC__lmhash_DCOMEXEC__nthash_DCOMEXEC__aesKey_DCOMEXEC__share_DCOMEXEC__noOutput_DCOMEXEC__doKerberos_DCOMEXEC__kdcHost_DCOMEXEC__dcomObject_DCOMEXEC__shell_typeshellsplit)selfcommandusernamepassworddomainhashesaesKeysharenoOutput
doKerberoskdcHost
dcomObject
shell_type rF   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/../../../bin/dcomexec.py__init__D   s"   zDCOMEXEC.__init__c              
   C   s   t d|d }d }|tkrtd|}n+|tkr#td|}n|tkr/td|}n|tkr;t	d|}nt
d|  tt| d | |d d |d d |d d | dS )N    flagszUnknown OBJREF Type! 0x%xstdipidoxid)rM   oidtarget)r   joinr   r   r   r   r   r   r   r   loggingerrorr   r   get_cinstanceget_ipidRemUnknown
get_target)r9   	interfaceresp
objRefTypeobjRefrF   rF   rG   getInterfaceW   s"   zDCOMEXEC.getInterfacec                 C   s  | j du r]|du r]t||}| jdu r"|| j| j| j| j| j n|j	| j| j| j| j| j| j
| jd | }|tkrCtd n|tkrMtd n|tkrWtd ntd nd }t|| j| j| j| j| j| j
d| j| jd
}zztd d}t|d	< t|d
< d|d< d|d< | jdkr|tdt}t|}|d}	||	d dt|dg g }	t| ||	d d d d }
|
d}	|
|	d dt|dg g }	d }nb| jdkr|tdt}t|}|d}	||	d dt|dg g }	|dd }n7| jdkr+|tdt}t|}|d}	||	d dt|dg g }	|dd }ntd| j  W d S t| ||	d d d d }| jdkr|d}	||	d dt|dg g }	t| ||	d d d d }|dd }t | j!||f||f|| j"|| _#n9|d}	||	d dt|dg g }	t| ||	d d d d }|d d }t$| j!||f||f|| j"|| _#| j%d!krz	| j#&| j% W n t'y   |sڂ Y nw | j#d ur| j#(d" n| j#)  W nP t*t+fy@ } zAt, j-tj.krdd l/}|0  | j#d ur| j#(d" t1t2| |d ur(|3  |4  t5j67  t58d# W Y d }~nd }~ww |d urJ|3  |4  d S )$NF)rC   zSMBv1 dialect usedzSMBv2.0 dialect usedzSMBv2.1 dialect usedzSMBv3.0 dialect usedT)oxidResolverrB   rC   rgvargrgdispidNamedArgsr   cArgs
cNamedArgsShellWindowsz$9BA05972-F6A8-11CF-A442-00A0C90A8F39)Item	  
pVarResult	_varUnionpdispValabData)DocumentShellBrowserWindowz$C08AFD90-F2A1-11D1-8455-00A0C91F3880)QuitMMC20z$49B2791A-B1AE-4C90-9B8E-E860BA07F889zInvalid object %s)
ActiveView)ExecuteShellCommand)Application)ShellExecute r(      )9r2   r    r3   loginr+   r,   r-   r.   r/   kerberosLoginr0   r4   
getDialectr!   rQ   infor"   r#   r   r   r   r5   CoCreateInstanceExr	   r   r
   GetIDsOfNamesInvoker   rZ   r   fatalRemoteShellMMC20r1   r6   r7   RemoteShellr*   onecmd	TypeErrordo_exitcmdloop	ExceptionKeyboardInterrupt	getLoggerlevelDEBUG	traceback	print_excrR   strlogoff
disconnectsysstdoutflushexit)r9   addrsilentCommandsmbConnectiondialectdcom
dispParams
iInterfaceiMMCrW   iItempQuit	iDocumentiActiveViewpExecuteShellCommander   rF   rF   rG   runk   s   




 



 
 "
  



zDCOMEXEC.run)r(   r(   r(   r(   NNNFFNNNF)__name__
__module____qualname__rH   rZ   r   rF   rF   rF   rG   r'   C   s    
r'   c                   @   s   e Zd Zd ddZdd Zdd Zdd	 Zd
d Zdd Zdd Z	dd Z
dd Zdd Zdd Zdd Zd!ddZdd ZdS )"rz   Fc                 C   s   t j|  || _dt | _d| _d| _|| _d| _	|| _
|| _|| _|| _d| _d| _d| _| jd urA| jd | d d S d	| _d S )
N\r(   zcmd.exez@powershell.exe -NoP -NoL -sta -NonI -W Hidden -Exec Bypass -Enc zC:\windows\system32Fzg[!] Launching semi-interactive shell - Careful what you execute
[!] Press help for extra shell commandsi T)cmdCmdrH   _shareOUTPUT_FILENAME_output_RemoteShell__outputBuffer_shell_RemoteShell__shell_type_RemoteShell__pwsh_RemoteShell__quit_executeShellCommand_RemoteShell__transferClient_silentCommand_pwd	_noOutputintro
setTimeoutdo_cd)r9   r@   quitexecuteShellCommandr   rE   r   rF   rF   rG   rH      s$   


zRemoteShell.__init__c                 C   s   t | d S N)ossystemr9   srF   rF   rG   do_shell   s   zRemoteShell.do_shellc                 C   s   t d d S )Na  
 lcd {path}                 - changes the current local directory to {path}
 exit                       - terminates the server process (and this session)
 lput {src_file, dst_path}   - uploads a local file to the dst_path (dst_path = default current directory)
 lget {file}                 - downloads pathname to the current local dir
 ! {cmd}                    - executes a local shell cmd
)printr9   linerF   rF   rG   do_help   s   zRemoteShell.do_helpc              
   C   s^   |dkrt t  d S zt| W d S  ty. } ztt| W Y d }~d S d }~ww Nr(   )r   r   getcwdchdirr   rQ   rR   r   )r9   r   r   rF   rF   rG   do_lcd   s   zRemoteShell.do_lcdc           	   
   C   s   z>dd l }||| j|}||\}}||}t|d}td||f  | j	
|d d d ||j |  W d S  ty] } ztt| t| W Y d }~d S d }~ww )Nr   wbzDownloading %s\%s$)ntpathnormpathrP   r   
splitdrivebasenameopenrQ   rt   r   getFilewritecloser   rR   r   r   remove)	r9   src_pathr   newPathdrivetailfilenamefhr   rF   rF   rG   do_lget   s   


zRemoteShell.do_lgetc              
   C   s  zf| d}t|dkr|d }|d }nt|dkr!|d }d}tj|}t|d}|dd}dd l}||| j	||}|
|\}	}
td||f  | j|	d d	 d
 |
|j |  W d S  ty } ztt| W Y d }~d S d }~ww )Nro   rp   r   r(   rb/r   zUploading %s to %sr   r   )r8   lenr   pathr   r   replacer   rP   r   r   rQ   rt   r   putFilereadr   r   criticalr   )r9   r   paramsr   dst_pathsrc_filer   r   pathnamer   r   r   rF   rF   rG   do_lput  s,   


zRemoteShell.do_lputc              	   C   sP   t d d}t|d< t|d< d|d< d|d< | jd | jd dt|dg g  d	S )
NFr\   r]   r   r^   r_   rp   rb   T)r   r   r   rw   r   )r9   r   r   rF   rF   rG   r}   #  s   
zRemoteShell.do_exitc                 C   s   t   | |S r   )r   r}   r   rF   rF   rG   do_EOF.  s   
zRemoteShell.do_EOFc                 C   s   dS )NFrF   r9   rF   rF   rG   	emptyline2  s   zRemoteShell.emptylinec                 C   s   |  d|  t| jddkrt| j d| _d S tr.tt| j	|
tjj| _	ntt| j	|| _	|  d | jd| _	| j	d | _| jdkrXd| j d | _d| _d S )	Ncd 
r   r(   >
powershellPS ro   )execute_remoter   r   stripr   r   r   r   rP   r   decoder   stdinencodingpromptr   r   rF   rF   rG   r   5  s   

"


zRemoteShell.do_cdc                 C   s   t |dkrL|d dkrL| | t | jddkr%t| j d| _d S || _| d | jd| _| jd | _| jd	krGd
| j d | _d| _d S |dkrW| | d S d S )N   rp   r)   r   r   r(   r   r   r   r   ro   )	r   r   r   r   r   r   r   r   	send_datar   rF   rF   rG   defaultF  s   





zRemoteShell.defaultc              
      s    fdd} j du rd _d S 	 z j j j| W n? ty[ } z2t|ddkr4t	
d nt|ddkrQtd	  j    W  Y d }~S W Y d }~nd }~ww q j j j d S )
Nc              	      sR   z  j | t7  _ W d S  ty(   td   j | jtdd7  _ Y d S w )NzDecoding error detected, consider running chcp.com at the target,
map the result with https://docs.python.org/3/library/codecs.html#standard-encodings
and then execute dcomexec.py again with -codec and the corresponding codecr   )errors)r   r   CODECUnicodeDecodeErrorrQ   rR   )datar   rF   rG   output_callback]  s   
z/RemoteShell.get_output.<locals>.output_callbackTr(   STATUS_SHARING_VIOLATIONr   rp   Brokenz(Connection broken, trying to recreate it)r   r   r   r   r   r   r   r   findtimesleeprQ   debug	reconnect
get_output
deleteFile)r9   r   r   rF   r   rG   r   \  s(   
	


zRemoteShell.get_outputr   c           
   	   C   sp  | j du r| d | _d| dd  }n|dkr,d| }| jt|d  }d| }| jd	u rC|d
d| j	  | j
 d 7 }td|  td d	}t|d< d|d< d|d< td d	}d|d< tj|d< tj|d d< | j|d d d< td d	}d|d< tj|d< tj|d d< tr||d d d< n|tjj|d d d< td d	}d|d< tj|d< tj|d d< | j|d d d< td d	}d|d< tj|d< tj|d d< d|d d d< td d	}	d|	d< tj|	d< tj|	d d< d|	d d d< |d |	 |d | |d | |d | |d | | jd | jd dt|dg g  |   d S )NTr   ro   rp   r   '$ProgressPreference="SilentlyContinue";utf-16le/Q /c F 1> \\127.0.0.1\%s 2>&1zExecuting: %sr]   r&   r^   r_   clSizevtrd   tagbstrValasDatar(   0r\   rb   )r   r8   r   rP   r   r   encoder   r   r   r   rQ   r   r   r   r   r   VT_BSTRr   r   r   r   r   appendr   rw   r   r   )
r9   r   rE   r:   r   arg0arg1arg2arg3arg4rF   rF   rG   r   z  sd   












zRemoteShell.execute_remotec                 C   s"   |  || j t| j d| _d S r   )r   r   r   r   )r9   r   rF   rF   rG   r     s   

zRemoteShell.send_dataNr   r   )r   r   r   rH   r   r   r   r   r   r}   r   r   r   r   r   r   r   rF   rF   rF   rG   rz      s    
		
?rz   c                   @   s   e Zd ZdddZdS )ry   r   c           	   	   C   s  | j du r| d | _d| dd  }n|dkr,d| }| jt|d  }d| }| jd	u rC|d
d| j	  | j
 d 7 }td d	}t|d< d|d< d|d< td d	}d|d< tj|d< tj|d d< | j|d d d< td d	}d|d< tj|d< tj|d d< | j|d d d< td d	}d|d< tj|d< tj|d d< tr||d d d< n|tjj|d d d< td d	}d|d< tj|d< tj|d d< d|d d d< |d | |d | |d | |d | | jd | jd dt|dg g  |   d S )NTr   ro   rp   r   r  r  r  Fr  r  r  r]      r^   r_   r&   r  r	  rd   r
  r  r  7r\   rb   )r   r8   r   rP   r   r   r  r   r   r   r   r   r   r   r   r  r   r   r   r   r   r  r   rw   r   r   )	r9   r   rE   r:   r   r  r  r  r  rF   rF   rG   r     sV   










zRemoteShellMMC20.execute_remoteNr  )r   r   r   r   rF   rF   rF   rG   ry     s    ry   c                   @   s    e Zd ZdZdd Zdd ZdS )AuthFileSyntaxErrorz}raised by load_smbclient_auth_file if it encounters a syntax error
    while loading the smbclient-style authentication file.c                 C   s   || _ || _|| _d S r   r   linenoreason)r9   r   r  r  rF   rF   rG   rH     s   
zAuthFileSyntaxError.__init__c                 C   s   d| j | j| jf S )Nz(Syntax error in auth file %s line %d: %sr  r   rF   rF   rG   __str__  s   zAuthFileSyntaxError.__str__N)r   r   r   __doc__rH   r  rF   rF   rF   rG   r    s    r  c           	      C   s   d}d}d}d}t | D ]Q}|d7 }| }|ds|dkr q|dd}t|dkr2t| |d|d  |d  }}|d	krF|}q|d
krM|}q|dkrT|}qt| |dt| |||fS )zLoad credentials from an smbclient-style authentication file (used by
    smbclient, mount.cifs and others).  returns (domain, username, password)
    or raises AuthFileSyntaxError or any I/O exceptions.r   Nrp   #r(   =r   zNo "=" present in liner;   r<   r=   zUnknown option %s)r   r   
startswithr8   r   r  repr)	r   r  r=   r;   r<   r   partskvrF   rF   rG   load_smbclient_auth_file  s*   
r&  __main__TzKExecutes a semi-interactive shell using the ShellBrowserWindow DCOM object.)add_helpdescriptionrO   storez6[[domain/]username[:password]@]<targetName or address>)actionhelpz-sharezADMIN$z<share where the output will be grabbed from (default ADMIN$))r+  r   r,  z	-nooutput
store_trueFz>whether or not to print the output (no SMB connection created)z-tsz&Adds timestamp to every logging outputz-debugzTurn DEBUG output ONz-codeca  Sets encoding used (codec) from the target's output (default "%s"). If errors are detected, run chcp.com at the target, map the result with https://docs.python.org/3/library/codecs.html#standard-encodings and then execute wmiexec.py again with -codec and the corresponding codec z-object)r`   rh   rj   ?r`   zJDCOM object to be used to execute the shell command (default=ShellWindows))choicesnargsr   r,  z-com-versionzMAJOR_VERSION:MINOR_VERSIONz<DCOM version, format is MAJOR_VERSION:MINOR_VERSION e.g. 5.7)r+  metavarr,  z-shell-typer   r   z9choose a command processor for the semi-interactive shell)r+  r   r/  r,  r:   *ro   zRcommand to execute at the target. If empty it will launch a semi-interactive shell)r0  r   r,  z-silentcommandzQdoes not execute cmd.exe to run given command (no output, cannot run dir/cd/etc.)authenticationz-hasheszLMHASH:NTHASHz$NTLM hashes, format is LMHASH:NTHASHz-no-passz&don't ask for password (useful for -k)z-kzUse Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use the ones specified in the command linez-aesKeyzhex keyz<AES key to use for Kerberos Authentication (128 or 256 bits)z-dc-ipz
ip addresszoIP Address of the domain controller. If ommited it use the domain part (FQDN) specified in the target parameterz-AauthfilezSsmbclient/mount.cifs-style authentication file. See smbclient man page's -A option.z-keytabz"Read keys for SPN from keytab filerp   zutf-8z4-nooutput switch and interactive shell not supportedz9-silentcommand switch and interactive shell not supported.z>Wrong COMVERSION format, use dot separated integers e.g. "5.7"z?loaded smbclient auth file: domain=%s, username=%s, password=%sr(   )getpassz	Password:)y
__future__r   r   argparser   rQ   r   r   r   r   base64r   sixr   r   impacketr   impacket.dcerpc.v5.dcom.oautr   r	   r
   r   r   r   r   r   impacket.dcerpc.v5.dcomrtr   r   r   r   r   r   r   r   r   r   r   r   r   impacket.dcerpc.v5.dtypesr   impacket.examplesr   impacket.examples.utilsr   impacket.smbconnectionr    r!   r"   r#   impacket.krb5.keytabr$   r   r   r   r   r   r'   r   rz   ry   r   r  r&  r   r   BANNERArgumentParserparseradd_argumentadd_argument_groupgroupr   argv
print_helpr   
parse_argsoptionsinittsr   codecrP   r:   nooutputrR   silentcommandcom_versionr8   major_versionminor_versionset_default_versionintrO   r=   r;   r<   addressAr"  keytabloadKeysFromKeytabr$  r>   no_passr?   r6  r@   dc_ipobjectrE   executerr   r   r   r   r   r   r   r   rF   rF   rF   rG   <module>   s   &(4  o5
$










 
8