o
    j&                     @   s>  d dl mZ d dlmZ d dlmZ d dlmZ d dlmZ d dl	m
Z
 d dlmZ d dlmZ d dlmZ d d	lmZ d d
lmZ d dlmZ d dlmZmZmZmZmZmZmZmZ d dlmZmZm Z  d dl!m"Z" d dl#m$Z$ d dl%m&Z& e&dddZ'G dd dZ(dd Z)e*dkrd dl+Z+dZ,e+-e)e, dS dS )    )SMBDCEFactory)lsad)lsat)EPM)MAXIMUM_ALLOWED)NTStatus)logger)NULL)SMBConnection)DCERPC5Connection)bin_to_string)RPC_C_AUTHN_LEVEL_NONERPC_C_AUTHN_LEVEL_CONNECTRPC_C_AUTHN_LEVEL_CALLRPC_C_AUTHN_LEVEL_PKTRPC_C_AUTHN_LEVEL_PKT_INTEGRITYRPC_C_AUTHN_LEVEL_PKT_PRIVACYDCERPCExceptionRPC_C_AUTHN_GSS_NEGOTIATE)
cipherMODEDESexpand_DES_key)PREFERRED_BACKUP_KEY)PVKFile)asynccontextmanagerNTFc                 C  sR   t j| |||dI d H \}}|r|z|V  W | I d H  d S | I d H  w )N
auth_levelopenperform_dummy)LSADRPCfrom_smbconnectionclose)
connectionr   r   r   instanceerr r%   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/aiosmb/dcerpc/v5/interfaces/lsatmgr.pylsadrpc_from_smb   s   "r'   c                   @   s   e Zd Zdd Zdd Zdd Zdd Zed*dede	de	fddZ
ed*dede	de	fddZeejB fddZdd Zdd ZejjjfddZdd Zdd Zdd  Zd!d" Zd#d$ Zd%d& Zd'efd(d)Zd	S )+r   c                 C   s*   d| _ tj| _d | _d | _i | _d| _d S )Nz\lsarpcr   )service_pipenamer   MSRPC_UUID_LSATservice_uuiddcehandlepolicy_handlesph_ctrselfr%   r%   r&   __init__%   s   
zLSADRPC.__init__c                    s   | S Nr%   r/   r%   r%   r&   
__aenter__.   s   zLSADRPC.__aenter__c                    s   |   I d H  dS N)TN)r!   )r0   exc_typeexc	tracebackr%   r%   r&   	__aexit__1   s   zLSADRPC.__aexit__c              
      s   z8| j r7| jD ]}zt| j | j| I d H  W q   t  Y qz| j  I d H  W W dS    Y W dS W d S  tyO } z
d |fW  Y d }~S d }~ww r4   )r+   r-   r   
hLsarCloser   	exception
disconnect	Exception)r0   hider%   r%   r&   r!   5   s(   
zLSADRPC.closeNTFr"   r   r   c              
      s   z>t  }| |_|j| |d u r|jt |j I d H \}}|d ur(||jt  jI d H \}}|d ur;||d fW S  tyU } z
d|fW  Y d }~S d }~ww )NF)r   r+   set_auth_levelr   connectbindr*   r<   )r"   r   r   r   service_r$   r>   r%   r%   r&   from_rpcconnectionG   s$   
zLSADRPC.from_rpcconnectionc              
      s   z)t | t jd}|du rt}tj| |||dI dH \}}|dur&||dfW S  ty@ } z
d|fW  Y d}~S d}~ww )z
		Creates the connection to the service using an established SMBConnection.
		This connection will use the given SMBConnection as transport layer.
		)filenameNr   )r   r   r(   r   rD   get_dce_rpcr<   )r"   r   r   r   rpctransportrB   r$   r>   r%   r%   r&   r    ^   s    
zLSADRPC.from_smbconnectionc              
      s   z+t | j|I d H \}}|d ur||d }|| j| j< | j}|  jd7  _|d fW S  tyB } z
d |fW  Y d }~S d }~ww )NPolicyHandle   )r   hLsarOpenPolicy2r+   r-   r.   r<   )r0   permissionsrespr$   phtr>   r%   r%   r&   open_policy2p   s   
zLSADRPC.open_policy2c              
      ~   z't | j| j| t jjI d H \}}|d ur||d d d  }|d fW S  ty> } z
d |fW  Y d }~S d }~ww )NPolicyInformationPolicyPrimaryDomainInfoSid)r   hLsarQueryInformationPolicy2r+   r-   POLICY_INFORMATION_CLASSPolicyPrimaryDomainInformationformatCanonicalr<   )r0   policy_handlerL   r$   
domain_sidr>   r%   r%   r&   get_domain_sid}      $
zLSADRPC.get_domain_sidc              
      rP   )NrQ   PolicyAccountDomainInfo	DomainSid)r   rT   r+   r-   rU   PolicyAccountDomainInformationrW   r<   )r0   rX   rL   r$   host_sidr>   r%   r%   r&   get_host_sid   r[   zLSADRPC.get_host_sidc           
   
   C  s   zRt | j| j| ||I dH \}}|dur||t jjjkrLg }|d d D ]	}||d  q(|d d D ]}||d  }||d dfV  q8W dS |dfV  W dS  tyk }	 zd|	fV  W Y d}	~	dS d}	~	ww )z
		sids: list of string sid
		NReferencedDomainsDomainsNameTranslatedNamesNamesDomainIndex)	r   hLsarLookupSidsr+   r-   LSAP_LOOKUP_LEVEL	enumItemsLsapLookupWkstaappendr<   )
r0   rX   sidslookup_levelrL   r$   domainsentrydomainr>   r%   r%   r&   lookup_sids   s&   "
zLSADRPC.lookup_sidsc              
      sv   z#t | j| j| |I d H \}}|d urd |fW S | |}|d fW S  ty: } z
d |fW  Y d }~S d }~ww r2   )r   hLsarRetrievePrivateDatar+   r-   decrypt_secretr<   )r0   rX   key_namerL   r$   secretr>   r%   r%   r&   retrieve_private_data   s    


zLSADRPC.retrieve_private_datac                    s>   t | j| j| |I d H \}}|d urd |fS |d |fS )NSecretHandle)r   hLsarOpenSecretr+   r-   )r0   rX   secret_namerL   r$   r%   r%   r&   open_secret   s
    zLSADRPC.open_secretc                    sN   t | j|I d H \}}|d urd |fS d|d d }| |}||fS )N    EncryptedCurrentValueBuffer)r   hLsarQuerySecretr+   joinrs   )r0   secret_handlerL   r$   
enc_secretru   r%   r%   r&   query_secret   s   
zLSADRPC.query_secretc              
      s2  z|  tjI d H \}}|d ur|i }dD ]f}i }| ||I d H \}}|d ur,|dt| }| ||I d H \}}|d urC|tj|d d ddd}	|	dkr^|dd  }
|
|d< n|	d	kryt|}t	d
|j
}|j}||d< ||d< |||< q|d fW S  ty } z
d |fW  Y d }~S d }~ww )N)zG$BCKUPKEY_PREFERREDzG$BCKUPKEY_PzG$BCKUPKEY_%s   littleF)	byteordersignedrI   	legacykey   RSA2pvkcertificate)rO   r   POLICY_GET_PRIVATE_INFORMATIONrv   r   int
from_bytesr   r   construct_unencryptedkeydatacertdatar<   )r0   rM   r$   resultskeynameres
guid_bytesguid	keystruct
keyversionr   pbkr   r   r>   r%   r%   r&   get_backupkeys   s>   



zLSADRPC.get_backupkeysc           
      C   s   | j  }d}|}tdt|dD ]7}|d d }t|d d }t|tj}|||7 }|dd  }|dd  }t|dk rH|t|d  }qt	
|}	|	d S )Nr{   r         Secret)r+   get_session_keyrangelenr   r   r   ECBdecryptr   LSA_SECRET_XP)
r0   encdatakeydecdatakey0rC   chunktkeyctxru   r%   r%   r&   rs      s   

zLSADRPC.decrypt_secretc              
      s`   zt | jI dH \}}|dur||d dfW S  ty/ } z
d|fW  Y d}~S d}~ww )z(Returns the username of the current userNUserName)r   hLsarGetUserNamer+   r<   )r0   ansr$   r>   r%   r%   r&   get_username   s   zLSADRPC.get_usernameusernamec           
   
      s   zDt | j| j| |gI dH \}}|dur||d d d d }|d d d d  }|d d d d	 }d
||f }|||dfW S  ty_ }	 zt| d|	fW  Y d}	~	S d}	~	ww )z1Returns the SID of the user specified by usernameNra   rb   r   rc   rS   TranslatedSidsSids
RelativeIdz%s-%s)r   hLsarLookupNamesr+   r-   rW   r<   print)
r0   rX   r   r   r$   domain_namerY   user_ridusersidr>   r%   r%   r&   get_sid_for_user   s   "zLSADRPC.get_sid_for_userNTF)__name__
__module____qualname__r1   r3   r8   r!   staticmethodr   boolrD   r
   r    r   r   POLICY_LOOKUP_NAMESrO   rZ   r`   rh   ri   rj   rq   rv   rz   r   r   rs   r   strr   r%   r%   r%   r&   r   $   s(    	


$
r   c                    s  d}d}dd l }dd l}ddlm} ddlm} ddlm} || } | 	 }|
 I d H \}	}
|
d ur;t|
 |
td d }z3t|I d H \}}
|
d ur_t|
 t||
j W d S | I d H \}}
|
d urn|
t| W d S    |  |d ur| I d H  Y d S Y d S )Nz8
	e80089d6f0b1f19e
	c669ca27496f2fc1
	77304427d10d993c
	z9
	1000000001000000 
	0503fa2ece589243
	a8117ee5881c8c25
	r   )SMBConnectionFactory)
SMBMachine)GUIDzSMB Connected!)r7   hashlib!aiosmb.commons.connection.factoryr   !aiosmb.commons.interfaces.machiner   .aiosmb.wintypes.dtyp.constrcuted_security.guidr   from_urlget_connectionloginr   r   r    	format_tb__traceback__r   	print_excr!   )urlenc_desdec_desr7   r   r   r   r   r"   rC   r$   bkeysr%   r%   r&   amain  s>   
r   __main__zRsmb2+ntlm-password://TEST\dadmin:Passw0rd!1alma@win2019ad.test.corp/?dc=10.10.10.2r   ).0aiosmb.dcerpc.v5.common.connection.smbdcefactoryr   aiosmb.dcerpc.v5r   r   'aiosmb.dcerpc.v5.interfaces.endpointmgrr   aiosmb.dcerpc.v5.dtypesr   aiosmb.wintypes.ntstatusr   aiosmbr   r	   aiosmb.connectionr
   aiosmb.dcerpc.v5.connectionr   aiosmb.dcerpc.v5.uuidr   aiosmb.dcerpc.v5.rpcrtr   r   r   r   r   r   r   r   unicrypto.symmetricr   r   r   winacl.dtyp.wcee.backupkeyr   winacl.dtyp.wcee.pvkfiler   
contextlibr   r'   r   r   r   asyncior   runr%   r%   r%   r&   <module>   s6    (
 l0