o
    ji                     @   sH  d dl Z d dlZd dlZd dlZd dlmZ d dlmZ d dlm	Z	 d dl
mZ d dlmZ d dlmZ d dlmZmZmZ d d	lmZmZ d d
lmZmZmZmZmZmZmZmZm Z m!Z!m"Z"m#Z# d dl$m%Z%m&Z&m'Z'm(Z( d dl)m*Z*m+Z+m,Z,m-Z-m.Z.m/Z/m0Z0m1Z1m2Z2m3Z3m4Z4m5Z5 d dl$m6Z6m7Z7 d dlm8Z8 dZ9G dd deZ:dS )    N)unpack)hexlify)b)LOG)
SocksRelay)NetBIOSTCPSession)STATUS_MORE_PROCESSING_REQUIREDSTATUS_SUCCESSSTATUS_ACCESS_DENIED)NTLMAuthChallengeResponseNTLMSSP_NEGOTIATE_SIGN)NewSMBPacket
SMBCommandSMBSMBExtended_Security_DataSMBExtended_Security_ParametersSMBNTLMDialect_ParametersSMBNTLMDialect_Data0SMBSessionSetupAndX_Extended_Response_Parameters*SMBSessionSetupAndX_Extended_Response_Data'SMBSessionSetupAndX_Extended_Parameters!SMBSessionSetupAndX_Extended_Data	POSIXtoFT)SPNEGO_NegTokenInit	TypesMechSPNEGO_NegTokenRespASN1_AID)
SMB2PacketSMB2_FLAGS_SERVER_TO_REDIRSMB2_NEGOTIATESMB2Negotiate_ResponseSMB2_SESSION_SETUPSMB2SessionSetup_ResponseSMB2SessionSetupSMB2_LOGOFFSMB2Logoff_ResponseSMB2_DIALECT_WILDCARDSMB2_FLAGS_SIGNEDSMB2_SESSION_FLAG_IS_GUEST)	MechTypesASN1_SUPPORTED_MECH)SMB_DIALECTSMBSocksRelayc                   @   s`   e Zd ZdZdZdd Zedd Zdd Zd	d
 Z	dd Z
dd Zdd Zdd Zdd ZdS )r,   zSMB Socks Pluginr   c                 C   s   t | |||| d | _d| _t| _t| D ])}|dkrA|dkrAd|| v rA|| d j	 | _|| d j	 tu| _ d S qd S )NFdataschemeprotocolClient)
r   __init___SMBSocksRelay__NBSessionisSMB2r+   serverDialectlistkeyssession
getDialect)self
targetHost
targetPortsocksSocketactiveRelayskey r>   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/impacket/examples/ntlmrelayx/servers/socksplugins/smb.pyr0   3   s   zSMBSocksRelay.__init__c                   C   s   dS )Ni  r>   r>   r>   r>   r?   getProtocolPortB   s   zSMBSocksRelay.getProtocolPortc                 C   s   t dd| j| j| jd| _d S )N HOST)	sess_portsock)r   r9   r:   r;   r1   )r8   r>   r>   r?   initConnectionF   s   zSMBSocksRelay.initConnectionc                 C   s   |   \}}t|tdu rG|d tjkr.| |}| j|  | j	r(| 
 S |   \}}|d tjkrE| |\| _| _| jd u rEdS dS |d tkr`| |}| j|  |   \}}|d tkrv| |\| _| _| jd u rvdS dS )NFCommandT)getSMBPacket
isinstancer   r   SMB_COM_NEGOTIATEgetNegoAnswerr1   send_packetgetDatar2   skipAuthenticationSMB_COM_SESSION_SETUP_ANDXprocessSessionSetupclientConnectionusernamer   r!   )r8   packet
smbCommandrespr>   r>   r?   rM   J   s,   



z SMBSocksRelay.skipAuthenticationc              
   C   s4  	 | j   }t|dkr	 dS | jdu rt|d}|d tjkr5t	d| j
| j| jf  | |}n| j j| | j j  }t|d}|d tjks[|d tjkrz	 | j jjdd }| j | |}q] ty } zt|d	dkrn W Y d }~nd }~ww t|dkr	 dS nzt|d}|d
 }d|d< |d  t M  < |d | j jd v du ri | j jd |d < d| j jd |d  d< |d tkrt	d| j
| j| jf  | |}n#| j | | j  }t| dkr	 dS ||d
< | }| j | q)NTr   Fr-   rF   z#SOCKS: Avoiding logoff for %s@%s:%s   )timeoutz	timed out	MessageIDrA   	SignatureFlagsTreeIDTreeConnectTableEncryptData)r1   recv_packetget_trailerlenr2   r   r   SMB_COM_LOGOFF_ANDXr   debugrQ   r9   r:   getLogOffAnswerrP   getSMBServer_sessrK   SMB_COM_TRANSACTIONSMB_COM_TRANSACTION2	Exceptionstrfindr   r'   _Sessionr$   sendSMBrecvSMBrL   )r8   r-   rR   data2eorigIDr>   r>   r?   tunnelConnectionj   sd   C


"
zSMBSocksRelay.tunnelConnectionc                 C   s   | j  }zt| d}t|d d }W ||fS  tyX   zt| d}d }W n" tyM } ztjddd t	dt
|  W Y d }~n
d }~ww Y ||fS Y ||fS w )NrU   Datar   z
Exception:T)exc_infoz	SOCKS: %s)r1   r^   r   r_   r   rh   r   r   rb   errorri   )r8   r-   rR   rS   ro   r>   r>   r?   rG      s&   

zSMBSocksRelay.getSMBPacketc           
      C   s  | j du rt|d d }ttj}t }tj|d< |d |d< |d |d< |d |d< |d d}|d	d
 }|d tj@ rytjtj	B tj
B |d< t }d|d< t }td g|d< | |d< t }	tjtjB tjB tjB |	d< d|	d< n"tj	tj
B |d< t }	t }d|d< d|d< d|	d< tjtjB |	d< |	d  tjO  < ||	d< tjtjB |	d< d
|	d< d
|	d< d|	d< d|	d< d|	d < d|	d!< d|	d"< d|	d#< ||d< |	|d$< || |S t }t|d%< t|d&< d
|d'< d
|d(< t|d)< d|d*< d|d+< d|d,< t }d
|d< t|trt |d-< n| j!|d-< |d+ |d+< t"d.#d/d0 t$d1D |d2< d3|d< d|d4< d|d5< d|d6< t%t&'t() |d7< t%t&'t() |d8< d9|d:< t }td g|d< | |d;< t*|d; |d<< ||d< |S )=NFrr   r   Flags1PidTidMid   s   NT LM 0.12 rV   Flags2s   AAAAAAAAAAAAAAAA
ServerGUID2NTLMSSP - Microsoft NTLM Security Support Providerr)   SecurityBlobCapabilitiesChallengeLength    Payloads   "3DUfw	Challenge   DialectIndexSecurityModeMaxMpxCountMaxNumberVcsi   MaxBufferSizei   
MaxRawSize
SessionKeyLowDateTimeHighDateTimeServerTimeZone
ParametersrZ   StatusCreditRequestResponseCreditChargerF   	SessionIDrX   r[   DialectRevisionrA   c                 S   s   g | ]}t tjqS r>   )randomchoicestringascii_letters).0_r>   r>   r?   
<listcomp>  s    z/SMBSocksRelay.getNegoAnswer.<locals>.<listcomp>   
ServerGuid   MaxTransactSizeMaxReadSizeMaxWriteSize
SystemTimeServerStartTime   SecurityBufferOffsetBufferSecurityBufferLength)+r2   r   r   rI   r   FLAGS1_REPLYsplitindexFLAGS2_EXTENDED_SECURITYFLAGS2_NT_STATUSFLAGS2_UNICODEr   r   r   rL   r   CAP_EXTENDED_SECURITYCAP_USE_NT_ERRORSCAP_NT_SMBSCAP_UNICODEr   r   CAP_RPC_REMOTE_APISSECURITY_AUTH_ENCRYPTEDSECURITY_SHARE_USER
addCommandr   r   r	   r   r    rH   r&   r3   r   joinranger   calendartimegmtimegmtimer`   )
r8   
recvPacketrS   respSMBCommandrT   dialectsr   _dialects_datablob_dialects_parametersr>   r>   r?   rJ      s   




%

 zSMBSocksRelay.getNegoAnswerc                 C   s  | j du rttj}t|d d }|d dkrt }t }| jd }|d  t M  < t }d|d	< t	d
 |d< |
 |d< t|
 |d< |d |d< |
 |d< d|d< d|d< ||d< ||d< t }tj|d< tj|d< |d |d< |d |d< |d |d< d|d< t}	|	d? |d< |	d@ |d< || | j|
  |  \}}t|d }
t }|
d |d< ||d  td|d dd d tkrt|d }|d }n
t|d }|d }t }|| zd |d! d"|d# d"f  }W n ty   d |d! |d# f  }Y nw || jv r7t d$|| j!f  t"}	| j| d% j#}|$ % }nt&d&|| j!f  t'}	d}d }t }|d tjB |d< |d tj(B |d< |d' |d'< |d |d< |d |d< |d |d< ||d< |	d? |d< |	d@ |d< d|d< d|d< |dkrd(|d< d }n&t }d)|d	< t||d< |d |d< |
 |d< ||d< ||d< || | j|
  ||fS t&d* d S t) }t*|d }|d+ }d}td|dd d tkr|t|}|d }t|d, d dkr{|d, d }|t	d
 kr{|t+v rt+| }nt,|}t-d-|  d.}d/|d0< t||d1< ||d+< t. }t/|d2< t"|d3< d|d4< |d5 |d5< |d' |d'< d|d6< |d7 |d7< |d8 |d8< |d9 |d9< ||d< | j|
  |  \}}| 0|S ntd|dd d t1krt|}|d }nd:}|}| jd }|d  t M  < |du rt }d|d	< t	d
 |d< |
 |d< n|}t. }t/|d2< t|d3< d|d4< |d5 |d5< |d' |d'< d|d6< |d7 |d7< |d8 |d8< |d9 |d9< d/|d0< t||d1< |
 |d+< ||d< | j|
  |  \}}t*|d }|d+ }t|}|d }t }|| zd |d! d"|d# d"f  }W n tyW   d |d! |d# f  }Y nw t }|| jv r}t d$|| j!f  t"}	| j| d% j#}|$ j2d6 }nt&d&|| j!f  t'}	d}d }d)|d	< t. }t/|d2< |	|d3< d|d4< |d5 |d5< |d' |d'< ||d6< |d7 |d7< |d8 |d8< |d9 |d9< d/|d0< t3|d;< t||d1< |
 |d+< ||d< | j|
  ||fS )<NFrr   r   	WordCount   CHALLENGE_MESSAGEflags   NegStater|   SupportedMechResponseTokenSecurityBlobLengthr}   rA   NativeOSNativeLanManr   ru   rz   rv   rw   rx   Uidr   	ErrorCode   
ErrorClassBrV   	MechTokenz%s/%sdomain_namezutf-16le	user_namez-SOCKS: Proxying client session for %s@%s(445)r/   z*SOCKS: No session for %s@%s(445) availablerF   s          z4SOCKS: Can't handle standard security at the moment!r   r)   z:Unsupported MechType '%s', we just want NTLMSSP, answerings   0

+7
H   r   r   rZ   r   r   r   r   ReservedrX   r[   TSessionFlags)4r2   r   r   rN   r   r   sessionDatar   r   r   rL   r`   r   r   r   r   r   r1   rK   rG   r   r   
fromStringr   r   r   r   decodeupperUnicodeDecodeErrorr<   r   infor9   r	   r6   rd   get_uidrt   r
   r   r"   r#   r)   r   rb   r   r   rO   r*   rk   r(   )r8   r   r   rS   respParametersrespDatachallengeMessage	respTokenrT   	errorCodesessionSetupParameterssessionSetupDatar   tokenauthenticateMessagerQ   	smbClientuidsecurityBlobrawNTLMmechTypemechStrr>   r>   r?   rO   "  s  
















z!SMBSocksRelay.processSessionSetupc                 C   s   | j du r=ttj}t }tj|d< |d |d< |d |d< |d |d< |d |d< d}d}||d< ||d	< || |S t }t }t	|d
< t
|d< d|d< |d |d< |d |d< |d |d< |d |d< |d |d< |d |d< ||d	< |S )NFru   rv   rw   rx   r   r   r   rr   rZ   r   rV   r   r   rF   r   r   rX   r[   )r2   r   r   ra   r   r   r   r%   r   r   r	   )r8   r   r   rT   r   r   r>   r>   r?   rc   (  s6   



zSMBSocksRelay.getLogOffAnswerN)__name__
__module____qualname__PLUGIN_NAMEPLUGIN_SCHEMEr0   staticmethodr@   rE   rM   rq   rG   rJ   rO   rc   r>   r>   r>   r?   r,   /   s    
 M[  );r   r   r   r   structr   binasciir   sixr   impacketr   0impacket.examples.ntlmrelayx.servers.socksserverr   impacket.nmbr   impacket.nt_errorsr   r	   r
   impacket.ntlmr   r   impacket.smbr   r   r   r   r   r   r   r   r   r   r   r   impacket.spnegor   r   r   r   impacket.smb3r   r   r   r    r!   r"   r#   r$   r%   r&   r'   r(   r)   r*   r+   PLUGIN_CLASSr,   r>   r>   r>   r?   <module>   s&   88