o
    àý°j}A  ã                   @   sJ  d dl mZ d dl mZ d dlZd dlZd dlZd dlZd dlZd dlZzd dl	Z	W n e
y7   d dlZ	Y nw d dlZd dlmZ d dlmZ d dlmZ d dlmZ d dlmZmZ d d	lmZmZ d d
lmZ dd dd„ edƒD ƒ¡ ZdZ dZ!ej"j#Z$G dd„ deƒZ%G dd„ dƒZ&G dd„ dej'ƒZ(e)dk�r#e*ej+ƒ e ,¡ Z-e-j.dddd� e-j.ddddd � e-j.d!dd"d#hd#d$d%� e-j.d&d'd(d� e-j.d)d'd*d� e-j.d+dd,e$ d� e-j.d-dd.d.d/gd0d1� e- /d2¡Z0e0j.d3dd4d5d6� e0j.d7dd4d8d6� e0j.d9d:d;gd<d;d=d>d?� e0j.d@ddAdBd6� e- /dC¡Z0e0j.dDddEdFd6� e0j.dGd'dHd� e0j.dId'dJd� e0j.dKddLdMd6� e0j.dNddOd� e1ej2ƒdPk�rVe- 3¡  e 4dP¡ e- 5¡ Z6e 7e6j8e6j9¡ e6j:du�rle6j:Z$ne$du �rsdQZ$ee6j;ƒ\Z<Z=Z>Z?e<du �rƒdZ<e6j@du�r•e Ae6j@e=e<e6¡ dRe6_Be>dk�r»e=dk�r»e6jCdu �r»e6jDdSu �r»e6jEdu �r»d dTlFmFZF eFdUƒZ>e6jGdu �rÄe?e6_Ge6jEdu�rÍdRe6_Bz#e&e=e>e<e6jCe6jEe6jBe6jHe6jIe6jJeKe6jLƒe6jMe6jNƒZOeO Pe?e6jG¡ W n+ eQ�y ZR ze S¡ jTejUk�r
d dlVZVeV W¡  e XeYeRƒ¡ W Y dZR[RndZR[Rww e 4d ¡ dS dS )Vé    )Údivision)Úprint_functionN)ÚThread)Ú	b64encode)Úlogger)Úparse_target)ÚversionÚ	smbserver)Ú	transportÚscmr)ÚKeytabÚ	__output_Ú c                 C   ó   g | ]}t  tj¡‘qS © ©ÚrandomÚchoiceÚstringÚascii_letters©Ú.0Úir   r   ú‡/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/../../../bin/smbexec.pyÚ
<listcomp>;   ó    r   é   Ú__tmpÚTMPc                   @   s,   e Zd Zdd„ Zdd„ Zdd„ Zdd„ Zd	S )
Ú	SMBServerc                 C   s   t  | ¡ d | _d S ©N)r   Ú__init__Úsmb©Úselfr   r   r   r!   A   s   

zSMBServer.__init__c                 C   s   t  d¡ t t¡ d S )NzCleaning up..)ÚloggingÚinfoÚosÚrmdirÚSMBSERVER_DIRr#   r   r   r   Úcleanup_serverE   s   
zSMBServer.cleanup_serverc              
   C   st  t   ¡ }| d¡ | ddd¡ | ddd¡ | ddd¡ | ddd¡ | dd	d
¡ | t¡ | tdd
¡ | tdd¡ | tdd¡ | tdt¡ | d¡ | ddd
¡ | ddd¡ | ddd¡ | ddd
¡ tjd|d�| _t 	d¡ zt
 t¡ W n ty› } zt t|ƒ¡ W Y d }~nd }~ww t 	d¡ | j ¡  t 	d¡ z| j ¡  W d S    Y d S )NÚglobalÚserver_nameÚ	server_osÚUNIXÚserver_domainÚ	WORKGROUPÚlog_fileÚNoneÚcredentials_filer   Úcommentz	read onlyÚnoz
share typeÚ0ÚpathzIPC$ÚyesÚ3)z0.0.0.0é½  )Úconfig_parserzCreating tmp directoryzSetting up SMB ServerzReady to listen...)ÚConfigParserÚadd_sectionÚsetÚDUMMY_SHAREr)   r	   Ú	SMBSERVERr"   r%   r&   r'   ÚmkdirÚ	ExceptionÚcriticalÚstrÚprocessConfigFileÚserve_forever)r$   Ú	smbConfigÚer   r   r   ÚrunI   sB   



€þ


zSMBServer.runc                 C   s*   |   ¡  | jj ¡  | j ¡  |  ¡  d S r    )r*   r"   ÚsocketÚcloseÚserver_closeÚ_Thread__stopr#   r   r   r   Ústopp   s   
zSMBServer.stopN)Ú__name__Ú
__module__Ú__qualname__r!   r*   rI   rN   r   r   r   r   r   @   s
    'r   c                   @   s"   e Zd Z		ddd„Zdd„ ZdS )	ÚCMDEXECr   Nr:   c                 C   s˜   || _ || _|
| _|| _d| _d| _|| _|| _|| _|	| _	|| _
|| _d | _|d ur4| d¡\| _| _|d u rGd dd„ tdƒD ƒ¡| _d S || _d S )Nr   ú:c                 S   r   r   r   r   r   r   r   r   ‹   r   z$CMDEXEC.__init__.<locals>.<listcomp>r   )Ú_CMDEXEC__usernameÚ_CMDEXEC__passwordÚ_CMDEXEC__portÚ_CMDEXEC__domainÚ_CMDEXEC__lmhashÚ_CMDEXEC__nthashÚ_CMDEXEC__aesKeyÚ_CMDEXEC__doKerberosÚ_CMDEXEC__kdcHostÚ_CMDEXEC__shareÚ_CMDEXEC__modeÚ_CMDEXEC__shell_typeÚshellÚsplitÚjoinÚrangeÚ_CMDEXEC__serviceName)r$   ÚusernameÚpasswordÚdomainÚhashesÚaesKeyÚ
doKerberosÚkdcHostÚmodeÚshareÚportÚserviceNameÚ
shell_typer   r   r   r!   w   s$   
zCMDEXEC.__init__c              
   C   sX  d| }t  d| ¡ t |¡}| | j¡ | |¡ t|dƒr0| | j	| j
| j| j| j| j¡ | | j| j¡ d | _z0| jdkrKtƒ }d|_| ¡  t| j|| j| j| jƒ| _| j ¡  | jdkri| ¡  W d S W d S  ttfy« } z2t  ¡ j t j!kr…dd l"}| #¡  t  $t%|ƒ¡ | jd ur–| j &¡  t'j( )¡  t' *d¡ W Y d }~d S d }~ww )Nzncacn_np:%s[\pipe\svcctl]zStringBinding %sÚset_credentialsÚSERVERTr   é   )+r%   Údebugr
   ÚDCERPCTransportFactoryÚ	set_dportrV   ÚsetRemoteHostÚhasattrrq   rT   rU   rW   rX   rY   rZ   Úset_kerberosr[   r\   r`   r^   r   ÚdaemonÚstartÚRemoteShellr]   rd   r_   ÚcmdlooprN   rB   ÚKeyboardInterruptÚ	getLoggerÚlevelÚDEBUGÚ	tracebackÚ	print_excrC   rD   ÚfinishÚsysÚstdoutÚflushÚexit)r$   Ú
remoteNameÚ
remoteHostÚstringbindingÚrpctransportÚserverThreadrH   r‚   r   r   r   rI   �   s@   


ÿ


ÿ


€øzCMDEXEC.run)r   r   r   NNNNNNr:   NN)rO   rP   rQ   r!   rI   r   r   r   r   rR   v   s
    
ÿrR   c                   @   sn   e Zd Zdd„ Zdd„ Zdd„ Zdd„ Zd	d
„ Zdd„ Zdd„ Z	dd„ Z
dd„ Zdd„ Zddd„Zdd„ ZdS )r|   c           
   
   C   s.  t j | ¡ || _|| _d| j d t | _d| _d| _d| _	|| _
d| _|| _|| _d| _| ¡ | _z| j ¡  W n tyX } zt t|ƒ¡ t d¡ W Y d }~nd }~ww | ¡ }| d	¡ |d
kry| ¡  ¡  ¡ d }d| j|tf | _| j t j!¡ t  "| j¡}	|	d | _#| ¡ | _$|  %d¡ d S )Nz\\%COMPUTERNAME%\ú\ó    r   z%COMSPEC% /Q /c z@powershell.exe -NoP -NoL -sta -NonI -W Hidden -Exec Bypass -Enc z?[!] Launching semi-interactive shell - Careful what you executers   i † rr   r   zcopy %s \\%s\%sÚ
lpScHandle)&ÚcmdÚCmdr!   Ú_RemoteShell__shareÚ_RemoteShell__modeÚOUTPUT_FILENAMEÚ_RemoteShell__outputÚ_RemoteShell__outputBufferÚ_RemoteShell__commandÚ_RemoteShell__shellÚ_RemoteShell__shell_typeÚ_RemoteShell__pwshÚ_RemoteShell__serviceNameÚ_RemoteShell__rpcÚintroÚget_dce_rpcÚ_RemoteShell__scmrÚconnectrB   r%   rC   rD   r…   rˆ   Úget_smb_connectionÚ
setTimeoutÚgetSMBServerÚ
get_socketÚgetsocknamer?   Ú_RemoteShell__copyBackÚbindr   ÚMSRPC_UUID_SCMRÚhROpenSCManagerWÚ_RemoteShell__scHandleÚtransferClientÚdo_cd)
r$   rm   Úrpcrl   ro   rp   rH   ÚsÚmyIPaddrÚrespr   r   r   r!   °   s<   
€þ


zRemoteShell.__init__c                 C   sÀ   z
| j  | jt¡ W n   Y zE| j ¡ | _| j ¡  | j t	j
¡ t	 | j¡}|d | _t	 | j| j| j¡}|d }t	 | j|¡ t	 | j|t	j¡ t	 | j|¡ W d S  t	jy_   Y d S w )Nr�   ÚlpServiceHandle)r¬   Ú
deleteFiler“   r•   r�   rŸ   r    r¡   r¨   r   r©   rª   r«   ÚhROpenServiceWrœ   ÚhRDeleteServiceÚhRControlServiceÚSERVICE_CONTROL_STOPÚhRCloseServiceHandleÚDCERPCException)r$   r±   Úservicer   r   r   r„   Ó   s$   

ÿzRemoteShell.finishc                 C   s   t  |¡ d S r    )r'   Úsystem©r$   r¯   r   r   r   Údo_shellé   s   zRemoteShell.do_shellc                 C   ó   dS )NTr   r¼   r   r   r   Údo_exitì   ó   zRemoteShell.do_exitc                 C   s   t ƒ  |  |¡S r    )Úprintr¿   r¼   r   r   r   Údo_EOFï   s   
zRemoteShell.do_EOFc                 C   r¾   )NFr   r#   r   r   r   Ú	emptylineó   rÀ   zRemoteShell.emptylinec                 C   sn   t |ƒdkrt d¡ |  d¡ t | jƒdkr5| j ¡  dd¡d | _| jdkr0d| j d	 | _d
| _d S d S )Nr   z+You can't CD under SMBEXEC. Use full paths.zcd z
r   ú>Ú
powershellzPS ú r�   )	Úlenr%   ÚerrorÚexecute_remoter—   ÚdecodeÚreplaceÚpromptrš   r¼   r   r   r   r­   ö   s   



ûzRemoteShell.do_cdc                 C   s
   |   |¡S r    )r­   r¼   r   r   r   Údo_CD  s   
zRemoteShell.do_CDc                 C   s   |dkr|   |¡ d S d S )Nr   )Ú	send_data)r$   Úliner   r   r   Údefault  s   ÿzRemoteShell.defaultc                    sx   ‡ fdd„}ˆ j dkrˆ j ˆ jt|¡ ˆ j ˆ jt¡ d S ttd t dƒ}|| ¡ ƒ | 	¡  t
 td t ¡ d S )Nc                    s   ˆ  j | 7  _ d S r    )r—   )Údatar#   r   r   Úoutput_callback  s   z/RemoteShell.get_output.<locals>.output_callbackÚSHAREú/Úrb)r”   r¬   ÚgetFiler“   r•   r³   Úopenr)   ÚreadrK   r'   Úunlink)r$   rÒ   Úfdr   r#   r   Ú
get_output
  s   
zRemoteShell.get_outputr‘   c                 C   s  |dkrd| }| j t| d¡ƒ ¡  }dd dd„ tdƒD ƒ¡ d	 }| jd
 | d | j d | d | j | }| jdkrG|d| j	 7 }|d| 7 }t
 d| ¡ tj| j| j| j| j|tjd�}|d }z	t | j|¡ W n   Y t | j|¡ t | j|¡ |  ¡  d S )NrÅ   z'$ProgressPreference="SilentlyContinue";zutf-16lez%SYSTEMROOT%\r   c                 S   r   r   r   )r   Ú_r   r   r   r     r   z.RemoteShell.execute_remote.<locals>.<listcomp>r   z.batzecho z ^> z
 2^>^&1 > z & rr   z & del zExecuting %s)ÚlpBinaryPathNameÚdwStartTyper²   )r›   r   ÚencoderÊ   rb   rc   r™   r–   r”   r§   r%   rt   r   ÚhRCreateServiceWr    r«   rœ   ÚSERVICE_DEMAND_STARTÚhRStartServiceWrµ   r¸   rÛ   )r$   rÑ   rp   Ú	batchFileÚcommandr±   rº   r   r   r   rÉ     s0    "ÿÿ
ÿzRemoteShell.execute_remotec                 C   s^   |   || j¡ z
t| j t¡ƒ W n ty)   t d¡ t| jjtdd�ƒ Y nw d| _d S )NzàDecoding error detected, consider running chcp.com at the target,
map the result with https://docs.python.org/3/library/codecs.html#standard-encodings
and then execute smbexec.py again with -codec and the corresponding codecrË   )Úerrorsr�   )	rÉ   rš   rÁ   r—   rÊ   ÚCODECÚUnicodeDecodeErrorr%   rÈ   )r$   rÑ   r   r   r   rÎ   2  s   
ü
zRemoteShell.send_dataN)r‘   )rO   rP   rQ   r!   r„   r½   r¿   rÂ   rÃ   r­   rÍ   rÐ   rÛ   rÉ   rÎ   r   r   r   r   r|   ¯   s    #
r|   Ú__main__ÚtargetÚstorez6[[domain/]username[:password]@]<targetName or address>)ÚactionÚhelpz-sharezC$z8share where the output will be grabbed from (default C$))rë   rÐ   rì   z-moderr   rÓ   z/mode to use (default SHARE, SERVER needs root!))rë   ÚchoicesrÐ   rì   z-tsÚ
store_truez&adds timestamp to every logging outputz-debugzTurn DEBUG output ONz-codeca  Sets encoding used (codec) from the target's output (default "%s"). If errors are detected, run chcp.com at the target, map the result with https://docs.python.org/3/library/codecs.html#standard-encodings and then execute smbexec.py again with -codec and the corresponding codec z-shell-typer‘   rÅ   z9choose a command processor for the semi-interactive shell)rë   rÐ   rí   rì   Ú
connectionz-dc-ipz
ip addressztIP Address of the domain controller. If omitted it will use the domain part (FQDN) specified in the target parameter)rë   Úmetavarrì   z
-target-ipz£IP Address of the target machine. If ommited it will use whatever was specified as target. This is useful when target is the NetBIOS name and you cannot resolve itz-portÚ139Ú445ú?zdestination portz)Destination port to connect to SMB Server)rí   ÚnargsrÐ   rð   rì   z-service-nameÚservice_namez2The name of theservice used to trigger the payloadÚauthenticationz-hasheszLMHASH:NTHASHz$NTLM hashes, format is LMHASH:NTHASHz-no-passz&don't ask for password (useful for -k)z-kzÁUse Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use the ones specified in the command linez-aesKeyzhex keyz<AES key to use for Kerberos Authentication (128 or 256 bits)z-keytabz"Read keys for SPN from keytab filers   zutf-8TF)Úgetpassz	Password:)ZÚ
__future__r   r   r…   r'   r   r   r‘   Úargparser<   ÚImportErrorÚconfigparserr%   Ú	threadingr   Úbase64r   Úimpacket.examplesr   Úimpacket.examples.utilsr   Úimpacketr   r	   Úimpacket.dcerpc.v5r
   r   Úimpacket.krb5.keytabr   rb   rc   r•   r)   r?   r†   Úencodingræ   r   rR   r’   r|   rO   rÁ   ÚBANNERÚArgumentParserÚparserÚadd_argumentÚadd_argument_groupÚgrouprÇ   ÚargvÚ
print_helprˆ   Ú
parse_argsÚoptionsÚinitÚtsrt   Úcodecré   rg   re   rf   r‰   ÚkeytabÚloadKeysFromKeytabÚkrh   Úno_passri   r÷   Ú	target_ipÚdc_iprl   rm   Úintrn   rõ   rp   ÚexecuterrI   rB   rH   r   r€   r�   r‚   rƒ   rC   rD   r   r   r   r   Ú<module>   s¸   $ÿ69 

ÿ
ü
ÿ



8ÿ€ü©