o
j! @ s d dl Z d dlZd dlZzd dlmZ W n ey# d dlmZ Y nw d dlmZ d dl m
Z
d dl m Z d dl
mZmZ d dlmZmZmZmZmZ d dlmZ d gZG d
d d e ZdS ) N)HTTPSConnection)unpack)LOG)ProtocolClient)STATUS_SUCCESSSTATUS_ACCESS_DENIED)NTLMAuthChallengeNTLMAuthNegotiateNTLMAuthChallengeResponseNTLMSSP_NEGOTIATE_SIGN NTLMSSP_NEGOTIATE_ALWAYS_SIGN)SPNEGO_NegTokenRespWinRMSRelayClientc @ sL e Zd ZdZdddZdd Zdd Zdd d Zd
d Zdd Z dd Z
d
S )r WINRMSb Tc C s@ t | |||| || _d | _d | _d | _d | _d| _d| _d S )NTz ) r __init__extendedSecuritynegotiateMessageauthenticateMessageBlobserverauthenticationMethod
isFirstNegbasic_xml_data)self serverConfigtarget
targetPortr r /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/impacket/examples/ntlmrelayx/clients/winrmrelayclient.pyr s
zWinRMSRelayClient.__init__c C sp d | _ | jjdkr
d| _n| jj| _zttj}t| j| j|d| _ W dS t
y7 t| j| j| _ Y dS w )N z/wsman)contextT)
lastresultr pathssl
SSLContextPROTOCOL_SSLv23r
targetHostr sessionAttributeError)r
uv_contextr r r initConnection s
z WinRMSRelayClient.initConnectionc
C sl t }|| | jjr(|d t@ r|d tN < |d t@ r(|d tN < | | _|d t@ r8t d t
| j dd}z| j j
d| j|| j d | j }| W n! tyx } ztd| j| jt|f W Y d }~dS d }~ww |jd krtd
|j d z)|d }d
|vrd|vrtd| W dS d
|v rd
| _nd|v rd| _W n$ ttfy td| j | jj rtd d
| _nY dS Y nw t | d}| j d| dt
| j d}| j j
d| j|| j d | j }| z t !| j d|d "d}t #|} t$ }
|
| |
W S t%tt&fy5 td Y dS w )Nflagsz@The client requested signing, relaying to WinRMS might not work!"application/soap+xml;charset=UTF-8Content-Length Content-TypePOSTheadersbodyz Connection to %s:%s failed: %sF zStatus code returned: z/. Authentication does not seem required for URLzWWW-AuthenticateNTLM Negotiatez1NTLM Auth not offered by URL, offered protocols: z2No authentication requested by the server for url zMIIS cert server may allow anonymous authentication, sending NTLM auth anywaysascii
Authorizationr/ r. z ([a-zA-Z0-9+/=]+) z&No NTLM challenge returned from server)'r
fromStringr
remove_micr r getDatar r warninglenr r' requestr" getresponseread Exceptionerrorr& r strstatusinfo getheaderr KeyError TypeError isADCSAttackbase64 b64encodedecoderesearchgroup b64decoder
IndexErrorr( ) r r negoMessager2 rese auth_header negotiateserverChallengeBase64serverChallenge challenger r r
sendNegotiate- sx
z WinRMSRelayClient.sendNegotiateNc
C s t d|d d d tjkrt|}|d }n|}z%t }|| |d }t|dkr=|dd d kr=td
t| W n tyG Y nw t
| d }| j d | d
t| j
d}| jjd| j|| j
d | j } | jdkryd tfS td| j d | | _d tfS )NBr; r
ResponseTokenntlm0 s zUNTLMv2 detected (NT response %d bytes). WinRMS relay may fail due to Channel Binding.r7 r8 r, r9 r0 r1 r4 z HTTP server returned error code z2, this is expected, treating as a successful login)r r
SPNEGO_NEG_TOKEN_RESPr
r< r@ r debugrD rM rN rO r r r' rA r" rB rG r rH rC r! r )
r r r[
respToken2tokenauthMsg nt_responseauthr2 rV r r r sendAutho s4
zWinRMSRelayClient.sendAuthc C s" | j d ur| j d | _ d S d S N)r' closer r r r killConnection s
z WinRMSRelayClient.killConnectionc C s d S rl r rn r r r isAdmin s zWinRMSRelayClient.isAdminc C s> d}t |dd}| jjd| j||d | j }| d S )Na
http://windows-host:5986/wsman
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
uuid:2a8ac24f-00f0-4a87-860c-bf58d33a1e0a
http://schemas.xmlsoap.org/ws/2004/09/transfer/Create
http://schemas.microsoft.com/wbem/wsman/1/windows/shell/cmd
PT20S
153600
FALSE
437
stdin
stdout stderr
r, r- r0 r1 )r@ r' rA r" rB rC )r
heartbeat_xmlr2 rV r r r keepAlive s "
zWinRMSRelayClient.keepAlive)r Trl ) __name__
__module__ __qualname__ PLUGIN_NAMEr r* r] rk ro rp rr r r r r r s
B# )rP r# rM http.clientr ImportErrorhttplibstructr impacketr $impacket.examples.ntlmrelayx.clientsr impacket.nt_errorsr r
impacket.ntlmr r r
r r impacket.spnegor
PROTOCOL_CLIENT_CLASSESr r r r r s