o j1 @s:ddlmZddlmZddlZddlZddlZddlZddlZddlZddl m Z ddl m Z ddl mZmZddlmZddlmZmZdd lmZdd lmZdd lmZejjZGd d d Zedkre e j!e"Z#e#j$dddde#j$dddddde#j$dde%dde#j$dddde#j$dddd d!e#j$d"dd#de#j$d$dd%ede#&d&Z'e'j$d'dd(d)d*e'j$d+dd,de'j$d-dd.de'j$d/dd0d1d*e'j$d2dd3d4d*e'j$d5dd6de(ej)d7kre#*e+d7e#,Z-e .e-j/e-j0e-j1dur e-j1Znedurd8Ze2d9d:3e-j4dkr,e5d;e+d7ee-j6\Z7Z8Z9Z:e7durdurte-j?durte-j@durtdd=lAmAZAeAd>Z9e-j@dur}de-j@e-j=e-jBd3e-j4e-jCe-jD ZEeEFe:dSdS)?)division)print_functionN)logger)version)tsch transport)NULL)RPC_C_AUTHN_GSS_NEGOTIATERPC_C_AUTHN_LEVEL_PKT_PRIVACY) parse_target)Keytab)PY2c@s*eZdZ  d ddZddZdd ZdS) TSCH_EXECNFc Csd||_||_||_d|_d|_||_||_||_||_| |_ | |_ |dur0| d\|_|_dSdS)Nr:) _TSCH_EXEC__username_TSCH_EXEC__password_TSCH_EXEC__domain_TSCH_EXEC__lmhash_TSCH_EXEC__nthash_TSCH_EXEC__aesKey_TSCH_EXEC__doKerberos_TSCH_EXEC__kdcHost_TSCH_EXEC__command_TSCH_EXEC__silentCommand sessionIdsplit) selfusernamepassworddomainhashesaesKey doKerberoskdcHostcommandr silentCommandr'/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/../../../bin/atexec.py__init__.szTSCH_EXEC.__init__c Csd|}t|}t|dr&||j|j|j|j|j|j | |j |j z| |WdStyk}z1tjtjkrFddl}|t|t|ddkr`tdWYd}~dSWYd}~dSd}~ww)Nzncacn_np:%s[\pipe\atsvc]set_credentialsrSTATUS_OBJECT_NAME_NOT_FOUNDzOWhen STATUS_OBJECT_NAME_NOT_FOUND is received, try running again. It might work)rDCERPCTransportFactoryhasattrr*rrrrrr set_kerberosrrdoStuff Exceptionlogging getLoggerlevelDEBUG traceback print_excerrorstrfindinfo)raddr stringbinding rpctransporter5r'r'r(play?s&   zTSCH_EXEC.playc Csdd}dd}dd}|}|j||jdur!|t||t| t j d d d t d D}|d }|jdurM||j\}} n d }d|j|f} d|jdur`||n|jd|jduro|| n d |jddf} d} zztd|t |d|| t jtt jd} td|d} |jdurt |d|n=zt j|d|t j|jdWn-ty} z!t| ddkst| ddkrtdd} nWYd} ~ nd} ~ ww| std|t |d|}|dddkr d} nt d| rtd|t !|d|d} Wnt j"yB} zt#| | $%WYd} ~ nd} ~ wwW| durQt !|d|n| dur`t !|d|ww|jdurm|&dS|jrw|&dS|'}d} ztd ||(d!d"||Wn>ty} z/t| d#dkrt d$nt| d%dkr|durt d$d}nWYd} ~ nd} ~ wwq~td&||)d!d"||&dS)'NcSsFz t|tWdSty"tdt|jtddYdSw)NzDecoding error detected, consider running chcp.com at the target, map the result with https://docs.python.org/3/library/codecs.html#standard-encodings and then execute atexec.py again with -codec and the corresponding codecreplace)errors)printdecodeCODECUnicodeDecodeErrorr1r7datar'r'r(output_callbackSs   z*TSCH_EXEC.doStuff..output_callbackcs(dddddddfdd |DS) Nz&z"z'z>z<)&"'>dsz8TSCH_EXEC.doStuff..xml_escape..)joinrFr'rQr( xml_escape\sz%TSCH_EXEC.doStuff..xml_escapecSs4|dd}|d}t|dkr|dnd}||gS)N rr)rlen)cmdlinecmdargsr'r'r( cmd_splitfs z$TSCH_EXEC.doStuff..cmd_splitTrcSsg|]}ttjqSr')randomchoicestring ascii_letters)rO_r'r'r( usz%TSCH_EXEC.doStuff..z.tmpzcmd.exez/C %s > %%windir%%\Temp\%s 2>&1al 2015-07-15T20:35:13.2757294 true 1 S-1-5-18 HighestAvailable IgnoreNew false false true false true false true true true false false P3D 7 %s %s FrrVrWzCreating task \%sz\%szRunning task \%s)flagsrERROR_FILE_NOT_FOUND E_INVALIDARGz$The specified session doesn't exist!z$Calling SchRpcGetLastRunInfo for \%s pLastRuntimewYearzDeleting task \%sz!Attempting to read ADMIN$\Temp\%szADMIN$zTemp\%sSHARINGr+zDeleting file ADMIN$\Temp\%s)* get_dce_rpcr*get_credentialsr set_auth_typer connectset_auth_levelr bindrMSRPC_UUID_TSCHSrTrangerrrrr1r:hSchRpcRegisterTask TASK_CREATErTASK_LOGON_NONE hSchRpcRunTASK_RUN_USE_SESSION_IDr0r8r9debughSchRpcGetLastRunInfotimesleep hSchRpcDeleteDCERPCSessionErrorr7 get_packetdump disconnectget_smb_connectiongetFile deleteFile)rr=rHrUr\dcetmpName tmpFileNamerZr[xml taskCreateddoner>resp smbConnectionwaitOncer'r'r(r/Rs       *(, $           zTSCH_EXEC.doStuff) rrrNNFNNNF)__name__ __module__ __qualname__r)r?r/r'r'r'r(r-s   r__main__targetstorez6[[domain/]username[:password]@])actionhelpr%*rVz!command to execute at the target )rnargsdefaultrz -session-idz7an existed logon session to use (no output, no cmd.exe))rtyperz-ts store_truez&adds timestamp to every logging outputz-silentcommandFz9does not execute cmd.exe to run given command (no output))rrrz-debugzTurn DEBUG output ONz-codecaSets encoding used (codec) from the target's output (default "%s"). If errors are detected, run chcp.com at the target, map the result with https://docs.python.org/3/library/codecs.html#standard-encodings and then execute wmiexec.py again with -codec and the corresponding codec authenticationz-hashesz LMHASH:NTHASHz$NTLM hashes, format is LMHASH:NTHASH)rmetavarrz-no-passz&don't ask for password (useful for -k)z-kzUse Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use the ones specified in the command linez-aesKeyzhex keyz= Vistarz)You need to specify a command to execute!T)getpassz Password:)G __future__rrr_sysargparser{r]r1impacket.examplesrimpacketrimpacket.dcerpc.v5rrimpacket.dcerpc.v5.dtypesrimpacket.dcerpc.v5.rpcrtr r impacket.examples.utilsr impacket.krb5.keytabr sixr stdoutencodingrDrrrBBANNERArgumentParserparser add_argumentintadd_argument_groupgrouprXargv print_helpexit parse_argsoptionsinittsrycodecwarningrTr%r7rr rraddresskeytabloadKeysFromKeytabkr!no_passr"rdc_ip session_id silentcommand atsvc_execr?r'r'r'r(s         G           8