o
    jP                     @   s  d dl Z d dlmZ d dlZd dlZd dlmZ d dlmZ d dl	m
Z
 d dlmZ d dlmZ d dlmZ d d	lmZ d d
lmZ d dlmZ d dlmZmZ d dlmZ d dlT d dlmZmZm Z m!Z!m"Z" d dl#m$Z$ e$dddZ%G dd dej&Z'G dd dZ(dS )    N)logger)
DCERPCAuth)DCERPCTarget)SMBConnection)DCERPC5Connection)SMBUserSecrets)FILETIME)SID)NULL)string_to_bin)drsuapisamr)EPM)*)RPC_C_AUTHN_LEVEL_PKT_INTEGRITYRPC_C_AUTHN_LEVEL_PKT_PRIVACYRPC_C_AUTHN_LEVEL_CONNECTDCERPCExceptionRPC_C_AUTHN_GSS_NEGOTIATE)asynccontextmanagerTFc                 C  sT   t j| ||||dI d H \}}|r|z|V  W | I d H  d S | I d H  w )Ndomain
auth_levelopenperform_dummy)
DRSUAPIRPCfrom_smbconnectionclose)
connectionr   r   r   r   instanceerr r!   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/aiosmb/dcerpc/v5/interfaces/drsuapimgr.pydrsuapirpc_from_smb   s   "r#   c                   @   s,   e Zd ZdZdZdZdZdZdZdZ	dZ
d	S )
DS_NAME_ERRORr                        N)__name__
__module____qualname__NO_ERROR	RESOLVING	NOT_FOUND
NOT_UNIQUE
NO_MAPPINGDOMAIN_ONLYNO_SYNTACTICAL_MAPPINGTRUST_REFERRALr!   r!   r!   r"   r$   %   s    r$   c                   @   s   e Zd ZdddZdd Zdd Zedd
ededefddZ	edd
e
dedefddZdd ZdddZejjejjdfddZi fddZdd Zdd ZdS ) r   Nc                 C   sr   || _ tj| _d | _d | _d | _d | _ddddddddd	d
d
| _dddddddddd	| _	dddddd| _
d S )N1.2.840.113556.1.4.6561.2.840.113556.1.4.2211.2.840.113556.1.4.901.2.840.113556.1.4.551.2.840.113556.1.4.941.2.840.113556.1.4.1601.2.840.113556.1.4.1251.2.840.113556.1.4.1461.2.840.113556.1.4.961.2.840.113556.1.4.8
userPrincipalNamesAMAccountName
unicodePwddBCSPwdntPwdHistorylmPwdHistorysupplementalCredentials	objectSid
pwdLastSetuserAccountControli	 i 	 iZ 	 i7 	 i^ 	 i 	 i} 	 i 	 i 	 )	rB   rC   rD   rE   rF   rG   rH   rI   rK   zdec-cbc-crczdes-cbc-md5zaes128-cts-hmac-sha1-96zaes256-cts-hmac-sha1-96rc4_hmac)r%   r'         l   t )
domainnamer   MSRPC_UUID_DRSUAPIservice_uuiddcehandle_DRSUAPIRPC__NtdsDsaObjectGuid_DRSUAPIRPC__ppartialAttrSetATTRTYP_TO_ATTIDNAME_TO_ATTRTYPKERBEROS_TYPE)selfrO   r!   r!   r"   __init__1   sB   zDRSUAPIRPC.__init__c                    s   | S Nr!   )rY   r!   r!   r"   
__aenter__\   s   zDRSUAPIRPC.__aenter__c                    s   |   I d H  dS NTN)r   )rY   exc_typeexc	tracebackr!   r!   r"   	__aexit___   s   zDRSUAPIRPC.__aexit__TFr   r   r   c           	   
      s   zSt |d}| |_|j| |d u r|jt |j I d H \}}|d ur*||jt  jI d H \}}|d ur=||du rP| I d H \}}|d urP||d fW S  tyj } z
d|fW  Y d }~S d }~ww )N)rO   TF)	r   rR   set_auth_levelr   connectbindrQ   r   	Exception)	r   r   r   r   r   service_r    er!   r!   r"   from_rpcconnectionc   s,   

zDRSUAPIRPC.from_rpcconnectionc              
      sD  d}zzm|du r| j j}|du rt}t| }| I dH \}}|dur'||t jI dH \}}|dur9|t	j
|| d}	t| j}
t|
|	}tj|||||dI dH \}}|dur`||dfW W |durq| I dH  S S  ty } zd|fW  Y d}~W |dur| I dH  S S d}~ww |dur| I dH  w w )z
		Creates the connection to the service using an established SMBConnection.
		This connection will use the given SMBConnection as transport layer.
		N)smb_connectionr   )targetr   r   r   r   rd   mapr   rQ   r   from_connection_stringr   from_smb_gssapigssapir   rj   
disconnectrf   )r   r   r   r   r   epmrh   r    	constringrl   dcerpc_authrpc_connectionrg   ri   r!   r!   r"   r      sD   


zDRSUAPIRPC.from_smbconnectionc              
      sN  zt  }t j|d< t  }t||d< t jt jB t jB t jB |d< t j	|d< d|d< d|d< d|d< t j	|d	< d
|d< t||d d< t
| |d d< | j|I d H \}}|d ura|t  }d|d d dtt  |d d    }|| |d dkrtjtjkrtd|d   |d |d< t||d d< t
| |d d< | j|I d H \}}|d ur||d | _t | j| j| jdI d H \}}|d ur|tjtjkrtd|   |d d d dkr|d d d d d | _W dS td| j  td ty& } z
d |fW  Y d }~S d }~ww )NpuuidClientDsacbdwFlagsSiteObjGuidr   PiddwReplEpoch
dwFlagsExtConfigObjGUIDl    	dwExtCaps
pextClientrgb    ppextServer    zADC's dwReplEpoch != 0, setting it to %d and calling DRSBind againphDrsr&   z#DRSDomainControllerInfo() answer %spmsgOutV2cItemsrItemsNtdsDsaObjectGuidz"Couldn't get DC info for domain %szFatal, aborting!r^   )r   DRSBindNTDSAPI_CLIENT_GUIDDRS_EXTENSIONS_INTlenDRS_EXT_GETCHGREQ_V6DRS_EXT_GETCHGREPLY_V6DRS_EXT_GETCHGREQ_V8DRS_EXT_STRONG_ENCRYPTIONNULLGUIDlistgetDatarR   requestjoin
fromStringr   levelloggingDEBUGdebugrS   hDRSDomainControllerInforO   dumprT   rf   )rY   r   drsrespr    drsExtensionsIntr   ri   r!   r!   r"   r      sf   




 zDRSUAPIRPC.openc           -         s 
  zddddddddd	d
d
}t |}|d u rN| ddkr'tjjg}n*| ddkr6tjjg}n|ddkrFtjjtjjg}ntj	tjj
g}n|g}d}d }|D ]_}| j|tjj|dI d H \}}|d urn||d d d d d d }|dkrzt|}	d||	jf }W n
   d|df }Y |d d d d d d d d dd }t|dkrqW n|dkrtd| td||f | ||I d H \}
}|d urd |fW S d|
d  }|
d | d dkrtd |
}|
d | d! d" }td#|d | d$ d% d d   t }d }tj|d | d& d' d d( d)d  d*d+d,}|d | d& d' d- d. D ]}zt||d/ }| j}W n( tys } ztd0|  tjd1d2d3 |d/ }| j}W Y d }~nd }~ww ||d4 kr|d5 d6 dkrd7|d5 d8 d d9 }t| j |}t|||_nt !d:|_n||d; kr|d5 d6 dkrd7|d5 d8 d d9 }t| j |}t|||_"nVt !d<|_"nN||d= kr|d5 d6 dkrzd7|d5 d8 d d9 #d>$dd |_%W n$   d |_%Y nd |_%n||d? kr~|d5 d6 dkrgzd7|d5 d8 d d9 #d>|_&W n tyf } zt'd@|d | d$ d% d d   dA|_&W Y d }~nd }~ww t'd@|d | d$ d% d d   dA|_&n||dB kr|d5 d6 dkrt(d7|d5 d8 d d9 |_)nt'dC|d | d$ d% d d   ||_)ny||dD kr|d5 d6 dkrzt*d7|d5 d8 d d9 j+, |_-W nR ty } zt'dE|d | d$ d% d d   d |_-W Y d }~n.d }~ww n(||dF kr0|d5 d6 dkr-tjd7|d5 d8 d d9 d*d+d,|_.nd |_.||dG kr|d5 d6 dkr{d7|d5 d8 d d9 }t| j |}t/dt|dH D ]}t||dH |d dH  |}|j01| q_q;tdI|d | d$ d% d d   q;||dJ kr|d5 d6 dkrd7|d5 d8 d d9 }t| j |}t/dt|dH D ]}t||dH |d dH  |}|j21| qq;tdK|d | d$ d% d d   q;||dL kr>|d5 d6 dkr>d7|d5 d8 d d9 } t| j | }!t|!dMk r!d }!q;zt34|!}W q; ty= } zW Y d }~q;d }~ww q;|d ur|dN }"t/|dO D ]}#t35|"}$|"t|$d  }"|$dP #d>dQkrt !|$dR # }%t36|%}&|&dS }'t/|&dT D ]>}(t37|'})|'t|)d  }'|%|)dU d  d |)dV  }*|)dW | j8v r| j8|)dW  |*f}+nt9|)dW |*f}+|j:1|+ qqO|$dP #d>dXkrt !|$dR #dY},z|,#d>}+W n t;y   |,#dZ}+Y nw |j<1|+ qO|d fW S  ty } z
d |fW  Y d }~S d }~ww )[Nr7   r8   r9   r:   r;   r<   r=   r>   r?   r@   rA   zCN=zS-1-5-@UNKNOWN)namer   V1pResultr   r   statusz%s - %spNamer%   z$User "%s" lookup returned empty GUIDz#User "%s" lookup failed. Reason: %szV%dpdwOutVersioncNumObjectsz)DRSGetNCChanges didn't return any object!PrefixTableSrcpPrefixEntryzDecrypting hash for user: %spNC
StringNamepObjectsEntinfSidlittleF)signed	AttrBlockpAttrattrTypzHFailed to execute OidFromAttid with error %s, fallbacking to fixed tablerf   T)exc_inforE   AttrValvalCountr   pAValpVal aad3b435b51404eeaad3b435b51404eerD    31d6cfe0d16ae931b73c59d7e0c089c0rB   zutf-16lerC   z Cannot get sAMAccountName for %sunknownrI   zCannot get objectSid for %srJ   zCannot get pwdLastSet for %srK   rG      zNo lmPwdHistory for user %srF   zNo ntPwdHistory for user %srH      UserPropertiesPropertyCountPropertyNamezPrimary:Kerberos-Newer-KeysPropertyValueBufferCredentialCount	KeyOffset	KeyLengthKeyTypezPrimary:CLEARTEXTasciizutf-8)=strupperfindr   DS_NAME_FORMATDS_FQDN_1779_NAMEDS_SID_OR_SID_HISTORY_NAMEDS_USER_PRINCIPAL_NAMEDS_SERVICE_PRINCIPAL_NAMEDS_NT4_ACCOUNT_NAME_SANS_DOMAINDS_UNKNOWN_NAMEDRSCrackNamesDS_UNIQUE_ID_NAMEr$   r   r   rf   DRSGetNCChangesr   r   r   int
from_bytesOidFromAttidrV   rW   r   DecryptAttributeValuerR   get_session_keyremoveDESLayerlm_hashbytesfromhexnt_hashdecodesplitr   usernameerrorr	   
object_sidr   datetime	isoformatpwd_last_setuser_account_statusrange
lm_historyappend
nt_historyr   USER_PROPERTIESUSER_PROPERTYKERB_STORED_CREDENTIAL_NEWKERB_KEY_DATA_NEWrX   hexkerberos_keysUnicodeDecodeErrorcleartext_pwds)-rY   r   formatOfferedraformatOffered_listrstatusguidcrackedNamer    s
userRecordreplyVersionrecordprefixTableususer_propertiesridattrattIdLOOKUP_TABLEri   encrypteddBCSPwdencryptedLMHashencryptedUnicodePwdencryptedNTHashencryptedLMHistorytmpLMHistoryiLMHashHistoryencryptedNTHistorytmpNTHistoryNTHashHistoryblobrH   propertiesDatapropertyCountuserPropertypropertyValueBufferkerbStoredCredentialNewdata
credential
keyDataNewkeyValueanswer
encoded_pwr!   r!   r"   get_user_secrets   sl  ,
&0"
2
&&&$&,&	* * *




zDRSUAPIRPC.get_user_secrets c              
      sl   zt d|  t| j| jd|||fI d H \}}||fW S  ty5 } z
d |fW  Y d }~S d }~ww )NzCalling DRSCrackNames for %sr   )r   r   r   hDRSCrackNamesrR   rS   rf   )rY   r   formatDesiredr   r   r    ri   r!   r!   r"   r     s   $
zDRSUAPIRPC.DRSCrackNamesc           	   
      s0  zt d|  t }| j|d< d|d< d|d d< | j|d d d< | j|d d d	< t }d
|d< t||d< d|d< d
|d< d|d< t|	 |d< ||d d d< d
|d d d d< d
|d d d d< t
|d d d< tjtjB |d d d< d|d d d< d
|d d d< tj|d d d< | jd u rg | _t | _d| jd< t|| jd< t| D ]}| jd t| j| q| j|d d d < t| j|d d d! d"< | j|d d d! d#< t
|d d d$< | j|I d H \}}||fW S  ty } z
d |fW  Y d }~S d }~ww )%NzCalling DRSGetNCChanges for %s hDrs   dwInVersionpmsgIntagV8uuidDsaObjDestuuidInvocIdSrcr   SidLenGuidr!  r   NameLen r   	structLenr   
usnvecFromusnHighObjUpdateusnHighPropUpdatepUpToDateVecDestulFlagsr%   cMaxObjects	cMaxBytesulExtendedOp	dwVersioncAttrsrgPartialAttrpPartialAttrSetPrefixTableDestPrefixCountr   pPartialAttrSetEx1)r   r   r   r   rS   rT   DSNAMEr   r   r   r
   DRS_INIT_SYNCDRS_WRIT_REPEXOP_REPL_OBJrU   _DRSUAPIRPC__prefixTablePARTIAL_ATTR_VECTOR_V1_EXTr   valuesr   	MakeAttidrR   r   rf   )	rY   r   req_attributesr   dsNamer  r  r    ri   r!   r!   r"   r     sR   




zDRSUAPIRPC.DRSGetNCChangesc              
      sj   zt d t| j| jI d H \}}|d ur||d fW S  ty4 } z
d |fW  Y d }~S d }~ww )NzCalling DRSGetNT4ChangeLog)r   r   r   hDRSGetNT4ChangeLogrR   rS   rf   )rY   r   r    ri   r!   r!   r"   DRSGetNT4ChangeLog  s   

zDRSUAPIRPC.DRSGetNT4ChangeLogc              
      s   z/| j rzt| j| j I d H  W n   Y | jr.z| j I d H  W W dS    Y W dS W dS  tyF } z
d |fW  Y d }~S d }~ww r]   )rS   r   
hDRSUnbindrR   rq   rf   )rY   ri   r!   r!   r"   r     s$   zDRSUAPIRPC.closer[   NNTF)r,   r-   r.   rZ   r\   rb   staticmethodr   boolrj   r   r   r   r   r   r   r   r   r   r   rK  r   r!   r!   r!   r"   r   0   s    
+%
? g1
r   rM  ))r   aiosmbr   ra   enum1aiosmb.dcerpc.v5.common.connection.authenticationr   )aiosmb.dcerpc.v5.common.connection.targetr   aiosmb.connectionr   aiosmb.dcerpc.v5.connectionr   aiosmb.dcerpc.v5.common.secretsr   (aiosmb.wintypes.dtyp.structures.filetimer   -aiosmb.wintypes.dtyp.constrcuted_security.sidr	   aiosmb.dcerpc.v5.dtypesr
   aiosmb.dcerpc.v5.uuidr   aiosmb.dcerpc.v5r   r   'aiosmb.dcerpc.v5.interfaces.endpointmgrr   *aiosmb.dcerpc.v5.interfaces.servicemanageraiosmb.dcerpc.v5.rpcrtr   r   r   r   r   
contextlibr   r#   Enumr$   r   r!   r!   r!   r"   <module>   s,   