o
    j[                     @   s  d dl mZmZ d dlmZ d dlmZmZ d dlm	Z	 d dl
mZmZmZmZmZ dZdZdZd	Zd
ZdZd ZdZdZdZdZdZdZdZdZdZdZ dZ!dZ"G dd de	Z#G dd de	Z$G dd de	Z%G dd de	Z&G dd de%Z'G dd de%Z(G dd de%Z)G dd  d eZ*G d!d" d"eZ+G d#d$ d$eZ,e-d%kr}d d&l.Z.d d&l/Z/d d&l0Z0d d&l1Z1d d'l2m3Z3 d d(l4m5Z5 d d)l6m7Z7m8Z8 z
d d*l9m:Z:m;Z; W n   e1<d+ e0=d Y G d,d- d-Z>dHd/d0Z?e@e8jA e/jBd1d2d3ZCeCjDd4d5d6d7 eCjDd8d9d:d;d7 eCjDd<d:d=d7 eCjDd>d:d?d7 eCEd@ZFeFjDdAd5dBdCdD eGe0jHdkr:eCI  e0=d eCJ ZKeLeKjMeKjN eeKjO\ZPZQZRZSePd&u rVdEZPeRdEkrpeQdEkrpeKjTd&u rpd dFlUmUZU eUdGZRe?eSeQeRePeKjTeKjV d&S d&S )I    )packunpack)logger)parse_targetget_connected_socket)	Structure)GSSAPIASN1_SEQUENCEASN1_OCTET_STRING
asn1decode
asn1encode         P   `                     c                   @      e Zd ZdZdS )TPKT))VersionzB=3)ReservedB=0)Lengthz>H=len(TPDU)+4)_TPDUz_-TPDUzself["Length"]-4)TPDU:=""N__name__
__module____qualname__	commonHdr r&   r&   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/../../../bin/rdp_check.pyr   :       r   c                   @      e Zd ZdZdddZdS )r   ))LengthIndicatorzB=len(VariablePart)+1)Coder   )VariablePartr    Nc                 C      t | | d| d< d S )N r,   r   __init__selfdatar&   r&   r'   r0   J      zTPDU.__init__Nr"   r#   r$   r%   r0   r&   r&   r&   r'   r   C   s    r   c                   @   r   )CR_TPDU))zDST-REF<H=0)zSRC-REFr8   )zCLASS-OPTIONr   )Typer   )Flagsr   )r   z<H=8Nr!   r&   r&   r&   r'   r7   N   r(   r7   c                   @   r)   )	DATA_TPDU))EOTzB=0x80)UserDatar    Nc                 C   r-   )Nr.   r=   r/   r1   r&   r&   r'   r0   ^   r4   zDATA_TPDU.__init__r5   r6   r&   r&   r&   r'   r;   X   s    r;   c                   @   r)   )RDP_NEG_REQ))requestedProtocols<LNc                 C   s$   t | | |d u rt| d< d S d S )Nr9   )r7   r0   TYPE_RDP_NEG_REQr1   r&   r&   r'   r0   g   s   zRDP_NEG_REQ.__init__r5   )r"   r#   r$   	structurer0   r&   r&   r&   r'   r>   c   s    r>   c                   @   r   )RDP_NEG_RSP))selectedProtocolsr@   Nr"   r#   r$   rB   r&   r&   r&   r'   rC   l   r(   rC   c                   @   r   )RDP_NEG_FAILURE))failureCoder@   NrE   r&   r&   r&   r'   rF   q   r(   rF   c                   @      e Zd ZdddZdd ZdS )TSPasswordCredsNc                 C      t | | | d= d S NUUIDr   r0   r1   r&   r&   r'   r0   |      
zTSPasswordCreds.__init__c              	   C   s   t dt}|tt ddtt dtt| d d  t dd tt dtt| d d  t dd tt dtt| d d  7 }|S )	NB   
domainNamezutf-16le   userName   password)r   r	   r   r
   encode)r2   ansr&   r&   r'   getData   s&   



	zTSPasswordCreds.getDatar5   r"   r#   r$   r0   rX   r&   r&   r&   r'   rI   v   s    
rI   c                   @   rH   )TSCredentialsNc                 C   rJ   rK   rM   r1   r&   r&   r'   r0      rN   zTSCredentials.__init__c              
   C   sl   t dd}|tt dtt| d  7 }t dt}|tt ddtt ddtt d| d   | 7 }|S )NrO   rR   credentialsrP   r   credType)r   r   r
   r	   )r2   r[   rW   r&   r&   r'   rX      s   



zTSCredentials.getDatar5   rY   r&   r&   r&   r'   rZ      s    
rZ   c                   @   s(   e Zd ZdddZdddZdd ZdS )		TSRequestNc                 C   rJ   rK   rM   r1   r&   r&   r'   r0      rN   zTSRequest.__init__c                 C   s  t d|d d d }|tkrtd| |dd  }t|\}}t d|d d d }|dkr6td| |dd  }t|\}}t d|dd d dkrUtd| t|dd  \}}t d|d | d	< ||d  }t d|d d d }|d
krt|dd  \}}t d|d d d }|tkrtd| t|dd  \}}t d|d d d }|tkrtd| t|dd  \}}t d|d d d }|dkrtd| t|dd  \}}t d|d d d }|tkrtd| t|dd  \}}|| d< ||d d  }|dkrKt|dd  \}}t d|d d d }|tkr5td| t|dd  \}}|| d< ||d d  }|dkrt|dd  \}}t d|d d d }|tkrptd| t|dd  \}}|| d< d S d S )NrO   r   r   zSEQUENCE expected! (%x)rP   z0xa0 tag not found %xr   zINTEGER tag not found %rr   rR   zASN1_SEQUENCE tag not found %rz0xa0 tag not found %rz"ASN1_OCTET_STRING tag not found %rNegoDatarT   authInfo   
pubKeyAuth)r   r	   	Exceptionr   r
   )r2   r3   	next_bytedecode_datatotal_bytes
next_bytes_decode_data2r&   r&   r'   
fromString   sh   




zTSRequest.fromStringc                 C   s  d| j v rtdd}|ttdtt| d  7 }nd}d| j v r6tdd}|ttdtt| d  7 }nd}d| j v rgtdd}|ttdtttdtttdd	ttdtt| d     7 }nd}tdt}|ttdd	ttdd
ttdd
  | | | 7 }|S )Nra   rO   r`       r_   rT   r^   rR   rP   r   )fieldsr   r   r
   r	   )r2   ra   r_   negoDatarW   r&   r&   r'   rX      sF   















zTSRequest.getDatar5   )r"   r#   r$   r0   ri   rX   r&   r&   r&   r'   r]      s    

Cr]   __main__N)a2b_hex)ARC4)ntlmversion)SSLcryptoz*pyOpenSSL is not installed, can't continuec                   @   s$   e Zd Zdd Zdd Zdd ZdS )SPNEGOCipherc                 C   s   || _ | j tj@ r@t| j || _t| j |d| _t| j || _t| j |d| _t	
| j}|j| _t	
| j}|j| _n|| _|| _|| _|| _t	
| j}|j| _|j| _d| _d S )NServerr   )_SPNEGOCipher__flagsrp   *NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITYSIGNKEY_SPNEGOCipher__clientSigningKey_SPNEGOCipher__serverSigningKeySEALKEY_SPNEGOCipher__clientSealingKey_SPNEGOCipher__serverSealingKeyro   newencrypt"_SPNEGOCipher__clientSealingHandle"_SPNEGOCipher__serverSealingHandle_SPNEGOCipher__sequence)r2   flagsrandomSessionKeycipher3cipher4cipherr&   r&   r'   r0   (  s$   

zSPNEGOCipher.__init__c              	   C   sl   | j tj@ rt| j | j| j||| j| j\}}nt| j | j| j||| j| j\}}|  jd7  _||fS Nr   )rv   rp   rw   SEALry   r|   r   r   )r2   
plain_datasealedMessage	signaturer&   r&   r'   r   ?  s&   
zSPNEGOCipher.encryptc              	   C   sr   | j tj@ rt| j | j| j||| j| j\}}||fS t| j | j| j||| j| j\}}|  jd7  _||fS r   )rv   rp   rw   r   rz   r}   r   r   )r2   answerr   r&   r&   r'   decryptW  s(   zSPNEGOCipher.decryptN)r"   r#   r$   r0   r   r   r&   r&   r&   r'   rt   '  s    rt   Fc           "   
   C   s,  |d ur| d\}}t|}t|}nd}d}t }t }	t }
t|
d< ttB |
d< |
 |	d< t	|	d< |	 |d< t
| d|}||  |d	}|| |	|d  t|	d }|d tkrvt|	d }|  td
 d S |
|	d  ttj}|dd d}|| |tj t||}|  |  tjddddd}t  }| |d< |!|  |d}|| tj"||d |||||dd\}}|# }|$ }t%&t%j'|}|dd  }t(|d |}|)|\}}| |d< | | |d< z|!|  |d}W n) t*yB } zt+|,ddkr2td nt| W Y d }~d S d }~ww t |}|-|d dd  \}}t. }||d< ||d< ||d< t/ } d| d< | | d< |)|  \}}!t  }| |! |d < |!|  |0  t1d! d S )"N:r.   r9   r?   r,   r+   r   i=  i    zWServer doesn't support PROTOCOL_HYBRID, hence we can't use CredSSP to check credentialszALL:@SECLEVEL=0zutf-8i   T)
use_ntlmv2r^   i      r   ra   i   deniedr   zAccess Denied   rQ   rS   rU   r   r\   r[   r_   zAccess Granted)2splitrn   r   r   r>   rA   PROTOCOL_HYBRIDPROTOCOL_SSLrX   TDPU_CONNECTION_REQUESTr   sendallrecvri   r7   TYPE_RDP_NEG_FAILURErF   dumploggingerrorrr   Context
TLS_METHODset_cipher_listrV   set_optionsOP_DONT_INSERT_EMPTY_FRAGMENTS
Connectionset_connect_statedo_handshakerp   getNTLMSSPType1r]   sendgetNTLMSSPType3get_peer_certificate
get_pubkeyrs   dump_publickeyFILETYPE_ASN1rt   r   rb   strfindr   rI   rZ   closeinfo)"hostusernamerU   domainhashesipv6lmhashnthashtpkttpdurdp_negspktcr_tpdurdp_failurectx(SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATIONtlsauth
ts_requestbufftype3exportedSessionKeyserver_certpkeyr   r   r   cripted_keyerr
plain_texttsptsccripted_credsr&   r&   r'   	check_rdpn  s   






"
r   TzKTest whether an account is valid on the target host using the RDP protocol.)add_helpdescriptiontargetstorez6[[domain/]username[:password]@]<targetName or address>)actionhelpz-6z--ipv6
store_truezTest on IPv6z-tsz&Adds timestamp to every logging outputz-debugzTurn DEBUG output ONauthenticationz-hasheszLMHASH:NTHASHz$NTLM hashes, format is LMHASH:NTHASH)r   metavarr   r.   )getpassz	Password:)NF)Wstructr   r   impacket.examplesr   impacket.examples.utilsr   r   impacket.structurer   impacket.spnegor   r	   r
   r   r   r   TPDU_CONNECTION_CONFIRM	TDPU_DATATPDU_REJECTTPDU_DATA_ACKrA   PROTOCOL_RDPr   r   TYPE_RDP_NEG_RSPEXTENDED_CLIENT_DATA_SUPPORTEDDYNVC_GFX_PROTOCOL_SUPPORTEDr   SSL_REQUIRED_BY_SERVERSSL_NOT_ALLOWED_BY_SERVERSSL_CERT_NOT_ON_SERVERINCONSISTENT_FLAGSHYBRID_REQUIRED_BY_SERVER%SSL_WITH_USER_AUTH_REQUIRED_BY_SERVERr   r   r7   r;   r>   rC   rF   rI   rZ   r]   r"   socketargparsesysr   binasciirn   Cryptodome.Cipherro   impacketrp   rq   OpenSSLrr   rs   criticalexitrt   r   printBANNERArgumentParserparseradd_argumentadd_argument_groupgrouplenargv
print_help
parse_argsoptionsinittsdebugr   r   r   rU   addressr   r   r   r&   r&   r&   r'   <module>   s   	
	
t

G 
7


   