o
    j ~                     @   s  d dl Z d dlZd dlmZ d dlmZmZmZmZm	Z	 d dl
mZ d dlmZ d dlmZmZ d dlmZ d dl
mZmZmZmZ G d	d
 d
eZdZdZdZdZdZdZdZdZdZ d Z!dZ"dZ#dZ$d Z%dZ&dZ'dZ(dZ)dZ*dZ+dZ,d Z-dZ.dZ/dZ0dZ1dZ2dZ3dZ4dZ5dZ6dZ7dZ8d Z9d!Z:d"Z;G d#d$ d$eZ<G d%d& d&eZ=G d'd( d(eZ>G d)d* d*eZ?G d+d, d,eZ@G d-d. d.eZAG d/d0 d0eZBG d1d2 d2eZCG d3d4 d4eZDG d5d6 d6eZEG d7d8 d8eZFG d9d: d:eZGG d;d< d<eZHG d=d> d>eZIG d?d@ d@eZJG dAdB dBeZKG dCdD dDeZLG dEdF dFeZMe?e@eAeBeCeDeEeFeGeHeIeJeKeLeMdGZNG dHdI dIeZOG dJdK dKeZPG dLdM dMeZQG dNdO dOeZRG dPdQ dQeZSG dRdS dSeZTeedTfdUdVZUeeefdWdXZVdYdZ ZWd[d\ ZXG d]d^ d^eZYdS )_    N)unpack)uuidntlmsystem_errors	nt_errorsLOG)DCERPCException)
EMPTY_UUID)HTTPClientSecurityProvider
AUTH_BASIC)	Structure)MSRPCHeader	MSRPC_RTSPFC_FIRST_FRAGPFC_LAST_FRAGc                   @   s(   e Zd ZedZdddZdd ZdS )RPCProxyClientExceptionzRPC Error: ([a-fA-F0-9]{1,8})Nc                 C   sT   d }|d ur!z| j |}t|dd}W n
   |d| 7 }Y t| || d S )N      z: )parsersearchintgroupr   __init__)selferror_stringproxy_errorrpc_error_coder    r   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/impacket/dcerpc/v5/rpch.pyr   "   s   z RPCProxyClientException.__init__c                 C   sz   | j d ur:| j }|tjv rtj| d }d| j| j |f S |tjv r2tj| d }d| j| j |f S d| j| j f S | jS )Nr   z%s, code: 0x%x - %sz%s: unknown code: 0x%x)
error_coder   ERROR_MESSAGESr   r   )r   keyerror_msg_shortr   r   r   __str__.   s   


zRPCProxyClientException.__str__)NN)__name__
__module____qualname__recompiler   r   r#   r   r   r   r   r      s    

r   r      zkBasic authentication in RPC proxy is used, so coudn't obtain a target NetBIOS name from NTLMSSP to connect.zInvalid RPC Portz-RPC Proxy CONN/A1 request failed, code: 0x6baz.CONN/A1 request failed: HTTP/1.1 404 Not Foundz,RPC_OUT_DATA channel: HTTP/1.1 404 Not Foundz1CONN/A1 request failed: HTTP/1.1 401 Unauthorizedz.RPC_IN_DATA channel: HTTP/1.1 401 Unauthorized         r       @            	   
               c                   @      e Zd ZdZdS )	RTSCookie))Cookiez16s=b"\x00"*16Nr$   r%   r&   	structurer   r   r   r   r9   w       r9   c                   @   r8   )EncodedClientAddress))AddressTypez(<L=(0 if len(ClientAddress) == 4 else 1))_ClientAddressz_-ClientAddressz4 if AddressType == 0 else 16)ClientAddress:)Paddingz12s=b"\x00"*12Nr;   r   r   r   r   r>   }   r=   r>   c                   @   s   e Zd ZddddeffZdS )Ack)BytesReceived<L=0)AvailableWindowrF   ChannelCookierB   Nr$   r%   r&   r9   r<   r   r   r   r   rD      s
    rD   c                   @   r8   )ReceiveWindowSize))CommandTyperF   )rJ   z	<L=262144Nr;   r   r   r   r   rJ      r=   rJ   c                   @   s   e Zd ZdddeffZdS )FlowControlAck)rK   <L=1rD   rB   N)r$   r%   r&   rD   r<   r   r   r   r   rL          rL   c                   @   r8   )ConnectionTimeout))rK   z<L=2)rO   z	<L=120000Nr;   r   r   r   r   rO      r=   rO   c                   @      e Zd Zdd deffZdS )r:   )rK   z<L=3rB   NrI   r   r   r   r   r:      rN   r:   c                   @   r8   )ChannelLifetime))rK   z<L=4)rQ   z<L=1073741824Nr;   r   r   r   r   rQ      r=   rQ   c                   @   r8   )ClientKeepalive))rK   z<L=5)rR   z	<L=300000Nr;   r   r   r   r   rR      r=   rR   c                   @   r8   )Version))rK   z<L=6)rS   rM   Nr;   r   r   r   r   rS      r=   rS   c                   @   r8   )Empty))rK   z<L=7Nr;   r   r   r   r   rT      r=   rT   c                   @   r8   )rC   ))rK   z<L=8)ConformanceCountz<L=len(Padding))rC   z*ConformanceCountNr;   r   r   r   r   rC      r=   rC   c                   @   r8   )NegativeANCE))rK   z<L=9Nr;   r   r   r   r   rV      r=   rV   c                   @   r8   )ANCE))rK   z<L=0xANr;   r   r   r   r   rW      r=   rW   c                   @   rP   )rA   )rK   z<L=0xBrB   N)r$   r%   r&   r>   r<   r   r   r   r   rA      rN   rA   c                   @   rP   )AssociationGroupId)rK   z<L=0xCrB   NrI   r   r   r   r   rX      rN   rX   c                   @   r8   )Destination))rK   z<L=0xD)rY   <LNr;   r   r   r   r   rY      r=   rY   c                   @   r8   )PingTrafficSentNotify))rK   z<L=0xE)PingTrafficSentrZ   Nr;   r   r   r   r   r[      r=   r[   )r   r   r)   r*   r+   r/   r0   r1   r,   r2   r3   r4   r5   r6   r7   c                   @   s$   e Zd ZdZejd ZdddZdS )	RTSHeader   ))Flags<H=0)NumberOfCommandsr`   Nr   c                 C   s6   t | || t| d< ttB | d< d| d< d| d< d S )Ntypeflagsr   auth_lengthcall_id)r   r   r   r   r   )r   data	alignmentr   r   r   r     s
   zRTSHeader.__init__)Nr   )r$   r%   r&   _SIZEr   	commonHdrr   r   r   r   r   r]     s    
r]   c                   @   s0   e Zd ZddefddefddefddeffZdS )CONN_A1_RTS_PDUrS   rB   VirtualConnectionCookieOutChannelCookierJ   N)r$   r%   r&   rS   r:   rJ   r<   r   r   r   r   rj   "  s    rj   c                   @   s@   e Zd ZddefddefddefddefddefddeffZdS )	CONN_B1_RTS_PDUrS   rB   rk   INChannelCookierQ   rR   rX   N)	r$   r%   r&   rS   r:   rQ   rR   rX   r<   r   r   r   r   rm   .  s    rm   c                   @   s   e Zd ZddeffZdS )CONN_A3_RTS_PDUrO   rB   N)r$   r%   r&   rO   r<   r   r   r   r   ro   <  s    ro   c                   @   s(   e Zd ZddefddefddeffZdS )CONN_C2_RTS_PDUrS   rB   rJ   rO   N)r$   r%   r&   rS   rJ   rO   r<   r   r   r   r   rp   E  s
    rp   c                   @   s    e Zd ZddefddeffZdS )%FlowControlAckWithDestination_RTS_PDUrY   rB   rL   N)r$   r%   r&   rY   rL   r<   r   r   r   r   rq   M  s    rq      c                 C   s   t  }t |d< t |d< | |d d< t |d< ||d d< t |d< ||d d< t }t|d< t|j|d< | |d< | S )	NrS   rk   r:   rl   rJ   r_   ra   pduData)	rj   rS   r:   rJ   r]   RTS_FLAG_NONElenr<   getData)virtualConnectionCookieoutChannelCookiereceiveWindowSizeconn_a1packetr   r   r   hCONN_A1V  s   



r|   c                 C   s   t  }t |d< t |d< | |d d< t |d< ||d d< t |d< t |d< t |d< t |d d< ||d d d< t }t|d< t	|j
|d	< | |d
< | S )NrS   rk   r:   rn   rQ   rR   rX   r_   ra   rs   )rm   rS   r:   rQ   rR   rX   r9   r]   rt   ru   r<   rv   )rw   inChannelCookieassociationGroupIdconn_b1r{   r   r   r   hCONN_B1g  s    





r   c                 C   s   t  }t |d< | |d d< t |d< t |d d< ||d d d< ||d d d< t |d d d< ||d d d d< t }t|d< t|j|d	< |	 |d
< |	 S )NrY   rL   rD   rE   rG   rH   r:   r_   ra   rs   )
rq   rY   rL   rD   r9   r]   RTS_FLAG_OTHER_CMDru   r<   rv   )destinationbytesReceivedavailableWindowchannelCookierts_pdur{   r   r   r   hFlowControlAckWithDestination{  s   

r   c                  C   s   t  } t| d< |  S )Nr_   )r]   RTS_FLAG_PINGrv   )r{   r   r   r   hPing  s   r   c                   @   s   e Zd ZdZdddddddZd:ddZdd Zd;ddZd<ddZdd Z	dd Z
dd Zdd Zdd Zdd Zd d! Zd"d# Zd$d% Zd&d' Zd=d(d)Zd>d+d,Zd?d.d/Zd>d0d1Zd2d3 Zd4d5 Zd6d7 Zd8d9 Zd	S )@RPCProxyClienti    MSRPCzno-cachez
Keep-Alivez100-continuezapplication/rpczNo-cache)z
User-AgentzCache-Control
ConnectionExpectAcceptPragmaNQ  c                 C   s(   t |  || _|| _d | _|   d S N)r
   r   _RPCProxyClient__remoteName_RPCProxyClient__dstport_RPCProxyClient__auth_type
init_state)r   
remoteNamedstportr   r   r   r     s
   
zRPCProxyClient.__init__c                 C   sj   i | _ t | _t | _t | _t | _d | _d | _d| _	| j	| _
d| _d| _d| _d| _d| _d S )Nrr   r   F    )_RPCProxyClient__channelsr   generate _RPCProxyClient__inChannelCookie!_RPCProxyClient__outChannelCookie#_RPCProxyClient__associationGroupId(_RPCProxyClient__virtualConnectionCookie(_RPCProxyClient__serverConnectionTimeout(_RPCProxyClient__serverReceiveWindowSize*_RPCProxyClient__availableWindowAdvertised(_RPCProxyClient__receiverAvailableWindow_RPCProxyClient__bytesReceived_RPCProxyClient__serverChunked_RPCProxyClient__readBuffer_RPCProxyClient__chunkLeftrts_ping_receivedr   r   r   r   r     s   




zRPCProxyClient.init_state c                 C   s    t d | ||||| d S )NzZDeprecationWarning: Call to deprecated method set_proxy_credentials (use set_credentials).)r   errorset_credentials)r   usernamepassworddomainlmhashnthashr   r   r   set_proxy_credentials  s   
z$RPCProxyClient.set_proxy_credentialsc	           	      C   s   t | ||||||||	 d S r   )r
   r   )	r   r   r   r   r   r   aesKeyTGTTGSr   r   r   r     s   
zRPCProxyClient.set_credentialsc                 C   "   | j  }d|d< | d| d S )N
1073741824Content-LengthRPC_IN_DATAdefault_headerscopycreate_channelr   headersr   r   r   create_rpc_in_channel     
z$RPCProxyClient.create_rpc_in_channelc                 C   r   )N76r   RPC_OUT_DATAr   r   r   r   r   create_rpc_out_channel  r   z%RPCProxyClient.create_rpc_out_channelc                 C   s  t | | jj| jj| j|< t | | j| || jj|d }i }|| || t 	| | _
| js<| j
tkr<tt| js]|  }|tj d d| _| j| j td| j  | jjss| jd t| j }| jj|d| _| jjd | jj }| j| j|||d | | d S )	Nr   r   zutf-16lez$StringBinding has been changed to %srB   )query?)r   )r
   connect_rpcProxyUrlschemenetlocr   get_auth_headerspathupdateget_auth_typer   r   r   r    RPC_PROXY_REMOTE_NAME_NEEDED_ERRget_ntlmssp_infor   NTLMSSP_AV_HOSTNAMEdecode_stringbindingset_network_addressr   debugr   strr   _replacerequest_read_100_continue)r   methodr   auth_headersheaders_finalntlmsspr   r   r   r   r   r     s2   



HzRPCProxyClient.create_channelc              
   C   s   | j | j| j}|ddkr$|| j | j| j7 }|ddks|dd dkrWz|dd jdd	d
}td| j|f |d t	t
tfyV   td| j|f w d S )N   

r2      s   100 Continue
   
r   UTF-8replaceerrorsz8RPC Proxy Client: %s authentication failed in %s channelr   )r   sockrecv	RECV_SIZEfindsplitr   r   r   
IndexErrorKeyErrorAttributeError)r   r   respr   r   r   r   9  s$   	z!RPCProxyClient._read_100_continuec           
   
   C   sb  t | j| j| j}|  | t| j| j| j}| 	 | |  
| j}|ddkr@||  
| j7 }|ddks/|dd dkriz|dd jdd	d
}td|d tttfyh   tdw |jdd	d
}d| v ryd| _||dd d  | _|  }t|d }t|}|d d | _|  }t|d }t|}	|	d d | _d S )Nr   r   r2   r5   s   200r   r   r   r   r   z RPC Proxy CONN/A1 request failedr   ASCIIztransfer-encoding: chunkedTr+   rs   rO   rJ   )r|   r   r   r   get_socket_outsendr   r   r   get_socket_inr   r   r   r   r   r   r   r   r   lowerr   r   rpc_out_read_pktr]   ro   r   rp   r   )
r   r{   r   
resp_asciiconn_a3_rpcconn_a3_pduconn_a3conn_c2_rpcconn_c2_pduconn_c2r   r   r   create_tunnelQ  s6   zRPCProxyClient.create_tunnelc                 C      | j d jS Nr   r   r   r   r   r   r   r   {     zRPCProxyClient.get_socket_inc                 C   r   Nr   r   r   r   r   r   r   ~  r   zRPCProxyClient.get_socket_outc                 C      | j d  S r   r   closer   r   r   r   close_rpc_in_channel     z#RPCProxyClient.close_rpc_in_channelc                 C   r  r  r  r   r   r   r   close_rpc_out_channel  r  z$RPCProxyClient.close_rpc_out_channelc                 C   s    |d d dkrt d|dd S )N   s   HTTP/1.0 503 RPC ErrorzRPC Proxy request failedr   )r   )r   bufferr   r   r   check_http_error  s   zRPCProxyClient.check_http_errorc                 C   s  |   }| jdu r7t| jdkr| j}d| _n|| j}| | t||kr*|S ||d  | _|d | S | jdkrq|| jkrY| jd | j }| j| jd d  | _d| _|S | jd | }| j|d  | _|  j|8  _|S | j}d| _| | |ddkr||| j7 }| | |ddkst	|d |d d}||dd d  }t|d |k r|||t| d 7 }t|d |k st|d |kr||d d  | _|d |d  }t|d |kr|| | _||d  | j | _|d | S |d d S )	NFr   r   r)   r   r   r   )
r   r   ru   r   r   r   r
  r   r   r   )r   amtr   r	  	chunksizer   r   r   rpc_out_recv1  sR   






zRPCProxyClient.rpc_out_recv1r   c                 C   s   |   | d S r   )r   r   )r   rf   forceWriteAndx	forceRecvr   r   r   r     s   zRPCProxyClient.sendFc                 C   s   	 d}t |tjk r|| tjt | 7 }t |tjk s
t|}|d }t ||k r<|| |t | 7 }t ||k s+|d tkrG| | |du rW|d tkrW| | n|S q)NTr   frag_lenrb   )ru   r   rh   r  r   flow_controlhandle_out_of_sequence_rts)r   
handle_rtsresponse_dataresponse_headerr  r   r   r   r     s    
zRPCProxyClient.rpc_out_read_pktc                 C   s   | j ddS )NT)r  )r   )r   r  countr   r   r   r     r   zRPCProxyClient.recvc                 C   s\   t |}|d tkr!d| _td t }| | | | d S |d tkr+td	 d S )Nr_   Tz6Ping RTS PDU packet received. Is the RPC Server alive?z\The server requested recycling of a virtual OUT channel, but this function is not supported!)	r]   r   r   r   r   r   r   RTS_FLAG_RECYCLE_CHANNELr   )r   r  r{   r   r   r   r    s   


z)RPCProxyClient.handle_out_of_sequence_rtsc                 C   sZ   |  j |7  _ |  j|8  _| j| jd k r+| j| _tt| j | j| j}| | d S d S )Nr)   )r   r   r   r   
FDOutProxyr   r   )r   r  r{   r   r   r   r  A  s   zRPCProxyClient.flow_controlc                 C      |    |   |   d S r   )r   r   r   r   r   r   r   r   K     zRPCProxyClient.connectc                 C   r  r   )r  r  r   r   r   r   r   
disconnectP  r  zRPCProxyClient.disconnect)Nr   )r   r   r   )r   r   r   r   NNr   )r   r   )F)r$   r%   r&   r   r   r   r   r   r   r   r   r   r   r   r   r   r  r  r
  r  r   r   r   r  r  r   r  r   r   r   r   r     s>    



e*

S

(2
r   )Zr'   binasciistructr   impacketr   r   r   r   r   impacket.dcerpc.v5.rpcrtr   impacket.uuidr	   impacket.httpr
   r   impacket.structurer   r   r   r   r   r   RPC_OVER_HTTP_v1RPC_OVER_HTTP_v2r   RPC_PROXY_INVALID_RPC_PORT_ERRRPC_PROXY_CONN_A1_0X6BA_ERRRPC_PROXY_CONN_A1_404_ERRRPC_PROXY_RPC_OUT_DATA_404_ERRRPC_PROXY_CONN_A1_401_ERRRPC_PROXY_HTTP_IN_DATA_401_ERRFDClient	FDInProxyFDServerr  rt   r   r   r  RTS_FLAG_IN_CHANNELRTS_FLAG_OUT_CHANNELRTS_FLAG_EOFRTS_FLAG_ECHORTS_CMD_RECEIVE_WINDOW_SIZERTS_CMD_FLOW_CONTROL_ACKRTS_CMD_CONNECTION_TIMEOUTRTS_CMD_COOKIERTS_CMD_CHANNEL_LIFETIMERTS_CMD_CLIENT_KEEPALIVERTS_CMD_VERSIONRTS_CMD_EMPTYRTS_CMD_PADDINGRTS_CMD_NEGATIVE_ANCERTS_CMD_ANCERTS_CMD_CLIENT_ADDRESSRTS_CMD_ASSOCIATION_GROUP_IDRTS_CMD_DESTINATION RTS_CMD_PING_TRAFFIC_SENT_NOTIFYr9   r>   rD   rJ   rL   rO   r:   rQ   rR   rS   rT   rC   rV   rW   rA   rX   rY   r[   COMMANDSr]   rj   rm   ro   rp   rq   r|   r   r   r   r   r   r   r   r   <module>   s   !				