o
    j>!                     @   s  d dl mZ d dlmZ d dlmZ d dlmZmZ d dl	m
Z
 d dlmZ d dlmZmZmZmZmZ d dlmZmZmZmZ d d	lmZ d d
lmZmZmZmZmZmZmZmZmZmZm Z m!Z!m"Z"m#Z# dZ$G dd de%Z&G dd deZ'G dd deZ(G dd deZ)dS )    )unpack)LOG)ProtocolClient)STATUS_SUCCESSSTATUS_ACCESS_DENIED)NTLMAuthChallenge)SPNEGO_NegTokenResp)	transportrpcrtepmtschicpr)r	   r
   r   r   )NDRCALL)	DCERPC_v5	MSRPCBindCtxItemMSRPCHeaderSEC_TRAILERMSRPCBindAckMSRPCRespHeaderMSRPCBindNakDCERPCExceptionRPC_C_AUTHN_WINNTRPC_C_AUTHN_LEVEL_CONNECTrpc_status_codesrpc_provider_reasonRPC_C_AUTHN_LEVEL_NONERPCRelayClientc                   @   s   e Zd ZdS )RPCRelayClientExceptionN)__name__
__module____qualname__ r"   r"   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/impacket/examples/ntlmrelayx/clients/rpcrelayclient.pyr   !   s    r   c                   @   s$   e Zd Zdd Zdd Zdd ZdS )MYDCERPC_v5c                 C   s   t | | d S N)r   __init__)selfr	   r"   r"   r#   r&   %   s   zMYDCERPC_v5.__init__c                 C   s  t  }t }||d< | j|d< d|d< d|d< || t }tj|d< | |d< d|d	< t }t	|d
< t
|d< d|d< dt| d  d }|dkr[|d  d| 7  < ||d< ||d< ||d< | j|  | j }|dkryt|}	ndS |	d tjks|	d tjkrt|	 }
nV|	d tjks|	d tjkr|	d tjkrt|	 }	td|	d d d d }n
t|	d }	|	d }|tv rt|d|tv rtdt|  td| td|	d  | |
d  |
S )NAbstractSyntaxTransferSyntaxr   	ContextID   
TransItemstypepduDatacall_id	auth_type
auth_level5 auth_ctx_id      auth_pad_lensec_trailer	auth_dataz<LRejectedReason)
error_codezBind context rejected: %sz'Unknown DCE RPC fault status code: %.8xz(Unknown DCE RPC packet type received: %d	max_rfrag)r   r   transfer_syntax
addCtxItemr   r
   
MSRPC_BINDgetDatar   r   r   len
get_packet
_transportsendrecvMSRPC_BINDACKMSRPC_ALTERCTX_Rr   MSRPC_BINDNAKMSRPC_FAULTr   r   r   r   r   r   set_max_tfrag)r'   
iface_uuidr8   binditempacketr7   padsrespbindRespstatus_coder"   r"   r#   sendBindType1(   sT   





zMYDCERPC_v5.sendBindType1c                 C   sf   t  }t|d< t|d< d|d< t }tj|d< d|d< ||d< ||d	< d
|d< | jj| dd d S )Nr0   r1   r2   r3   r-   s       r.   r7   r8   r   r/   r+   )forceWriteAndx)	r   r   r   r   r
   MSRPC_AUTH3rB   rC   rA   )r'   r8   r7   auth3r"   r"   r#   sendBindType3c   s   
zMYDCERPC_v5.sendBindType3N)r   r    r!   r&   rS   rW   r"   r"   r"   r#   r$   $   s    ;r$   c                   @   s   e Zd ZdZdZdS )DummyOp   r"   N)r   r    r!   opnum	structurer"   r"   r"   r#   rX   w   s    rX   c                   @   sD   e Zd ZdZdddZdd Zdd	 Zdd
dZdd Zdd Z	dS )r   RPCNTc                 C   s   t | |||| |j| _| jdkrtj| _n| jdkr!tj| _nt	d| j
jrD| jdkr4d|j | _| jdkr@d|j | _nt	dtd|j| jf  tj|j| jdd| _td	| j| jf  d S )
NTSCHICPRzNot implemented!zncacn_np:%s[\pipe\atsvc]zncacn_np:%s[\pipe\cert]z@Connecting to ncacn_ip_tcp:%s[135] to determine %s stringbindingncacn_ip_tcp)protocolz%s stringbinding is %s)r   r&   rpc_modeendpointr   MSRPC_UUID_TSCHSendpoint_uuidr   MSRPC_UUID_ICPRNotImplementedErrorserverConfigrpc_use_smbnetlocstringbindingr   debugr   hept_map)r'   rg   target
targetPortextendedSecurityr"   r"   r#   r&      s    





zRPCRelayClient.__init__c                 C   s   t | j}| jjr1td| jj| jj	f  |
| jj| jj| jj| jj| jj || jj	 t|| _| jt | j  | jjrY| jt td| jj| jj	f  n| jt | j  dS )Nz<Authenticating to smb://%s:%d with creds provided in cmdlinez'Authentication to smb://%s:%d succeededT)r	   DCERPCTransportFactoryrj   rg   rh   r   inform   ri   rpc_smb_portset_credentialssmbusersmbpass	smbdomain	smblmhash	smbnthash	set_dportr$   sessionset_auth_levelr   connectr   )r'   rpctransportr"   r"   r#   initConnection   s    


zRPCRelayClient.initConnectionc                 C   s(   | j | j|}t }||d  |S )Nr8   )rz   rS   rd   r   
fromString)r'   r8   rQ   	challenger"   r"   r#   sendNegotiate   s   zRPCRelayClient.sendNegotiatec              
   C   s   t d|d d d tjkrt|}|d }n|}| j| zt }| j| W d S  tys } z<dt|v s?dt|v rId t	fW  Y d }~S dt|v rYd t
fW  Y d }~S td| jt|f  d t
fW  Y d }~S d }~ww )	NBr+   r   ResponseTokennca_s_op_rng_errorRPC_E_INVALID_HEADERrpc_s_access_deniedz(Unexpected rpc code received from %s: %s)r   r   SPNEGO_NEG_TOKEN_RESPrz   rW   rX   requestr   strr   r   r   rq   rj   )r'   authenticateMessageBlobserverChallenge
respToken2r8   reqer"   r"   r#   sendAuth   s"   
zRPCRelayClient.sendAuthc                 C   s&   | j d ur| j    d | _ d S d S r%   )rz   get_rpc_transport
disconnect)r'   r"   r"   r#   killConnection   s   

zRPCRelayClient.killConnectionc              
   C   sZ   zt  }| j| W d S  ty, } zdt|vs dt|vr! W Y d }~d S d }~ww )Nr   r   )rX   rz   r   r   r   )r'   r   r   r"   r"   r#   	keepAlive   s   zRPCRelayClient.keepAlive)NTr%   )
r   r    r!   PLUGIN_NAMEr&   r~   r   r   r   r   r"   r"   r"   r#   r   |   s    

N)*structr   impacketr   $impacket.examples.ntlmrelayx.clientsr   impacket.nt_errorsr   r   impacket.ntlmr   impacket.spnegor   impacket.dcerpc.v5r	   r
   r   r   r   impacket.dcerpc.v5.ndrr   impacket.dcerpc.v5.rpcrtr   r   r   r   r   r   r   r   r   r   r   r   r   r   PROTOCOL_CLIENT_CLASS	Exceptionr   r$   rX   r   r"   r"   r"   r#   <module>   s   @S