o
    jv                     @   sX  d dl Z d dlZd dlZd dlZd dlZd dlmZmZ d dlZd dl	Z	d dl
Z
d dlZd dlmZ d dlmZ d dlmZmZ d dlmZ d dlmZ d dlmZ d d	lmZmZ d d
lmZ d dlmZ e jj Z!G dd deZ"G dd deZ#dZ$dZ%dZ&e Z'G dd dZ(G dd deZ)G dd de)Z*G dd de)Z+G dd dej,Z-G dd de)Z.e/dkr*e0ej1 ej2d d!d"Z3e3j4d#d$d%d& e3j4d'd(d)d*d+ e3j4d,d$d-d.d/ e3j4d0d$d1d& e3j4d2d$d3d& e3j4d4d5d6d& e3j4d7d5d8d& e3j4d9d$d:e! d& e35d;Z6e6j4d<d$d=d>d/ e6j4d?d5d@d& e6j4dAd5dBd& e6j4dCd$dDdEd/ e6j4dFd$dGd& e35dHZ6e6j4dId$dJdKd/ e6j4dLd$dJdMd/ e6j4dNdOdPgdQdPdRdSdT e6j4dUd$dVdWdXdY e6j4dZd$d[dd\dY e7e j8d]kre39  e :d] e3; Z<e=e<j>e<j? e<j@dure<j@Z!ne!du rd^Z!ee<jA\ZBZCZDZEeBdu rdWZBe<jFdureGe<jFeCeBe< d e<_He<jIdu reEe<_IeDdWkreCdWkre<jJdu re<jKd_u re<jLdu rd d`lMmMZM eMdaZDe<jLdurd e<_Hd)Ne<jOZOeOd)krdbZOe(eOe<jPe<jQe<jReSe<jTeCeDeBe<jJe<jLe<jHe<jUe<jVe<jWZXeXYeEe<jI dS dS )c    N)ThreadLock)PY3)logger)versionsmb)SMBConnection)	transport)	Structure)	remcomsvcserviceinstall)parse_target)Keytabc                   @      e Zd ZdZdS )RemComMessage))Commandz4096s="")
WorkingDir260s="")Priorityz<L=0x20)	ProcessIDz<L=0x01)Machiner   )NoWait<L=0N__name__
__module____qualname__	structure r   r   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/../../../bin/psexec.pyr   -       r   c                   @   r   )RemComResponse))	ErrorCoder   )
ReturnCoder   Nr   r   r   r   r   r!   7   r    r!   RemCom_stdoutRemCom_stdinRemCom_stderrc                   @   s4   e Zd Z			dddZdd Zd	d
 Zdd ZdS )PSEXEC   NFc                 C   s|   || _ || _|| _|| _|| _|| _d| _d| _|
| _|| _	|| _
|| _|| _|| _|| _|	d ur<|	d\| _| _d S d S )Nr)   :)_PSEXEC__username_PSEXEC__password_PSEXEC__port_PSEXEC__command_PSEXEC__path_PSEXEC__domain_PSEXEC__lmhash_PSEXEC__nthash_PSEXEC__aesKey_PSEXEC__exeFile_PSEXEC__copyFile_PSEXEC__doKerberos_PSEXEC__kdcHost_PSEXEC__serviceName_PSEXEC__remoteBinaryNamesplit)selfcommandpathexeFilecopyFileportusernamepassworddomainhashesaesKey
doKerberoskdcHostserviceNameremoteBinaryNamer   r   r   __init__D   s$   zPSEXEC.__init__c                 C   s~   d| }t d|  t|}|| j || t|dr0|| j	| j
| j| j| j| j || j| j | | d S )Nzncacn_np:%s[\pipe\svcctl]zStringBinding %sset_credentials)loggingdebugr	   DCERPCTransportFactory	set_dportr-   setRemoteHosthasattrrK   r+   r,   r0   r1   r2   r3   set_kerberosr6   r7   doStuff)r;   
remoteName
remoteHoststringbindingrpctransportr   r   r   runY   s   


z
PSEXEC.runc                 C   s   d}d}|du r,|dkr,z
| || d}W n   |d8 }td Y |du r,|dks|dkr4td|j|||dd	d
}|S )NF2   r   T      zPipe not ready, aborting@      creationOptionfileAttributes)waitNamedPipetimesleep	ExceptionopenFile)r;   stidpipe
accessMask	pipeReadytriesfidr   r   r   openPipef   s   
	zPSEXEC.openPipec              
   C   s  |  }z|  W n. ty8 } z"t jtjkr"dd l}|  t	t
| td W Y d }~nd }~ww |  azId}| }|d | jd u r`t| t | j| j}n3zt| jd}W n ty } zt	t
| td W Y d }~nd }~ww t| || j| j}| du rW d S | jd ur|  | jd ur|| j| tj | j tj | jd | j! | _!|"d}	| #||	dd	}
t$ }t% }d
&dd t'dD |d< | j(d ur| j(|d< | j!|d< ||d< |)|	|
|*  d
a+t,|dt-|d |d f t.j/t.j0B | }|1  t2|dt3|d |d f t.j4}|1  t5|dt6|d |d f t.j4}|1  |7|	|
d}t8|rgt9|}t:d| j!|d |d f  |;  | jd ur~|<| tj | j d}t|d  W d S  t=y     ty } zEt jtjkrdd l}|  t>t
| |du r|;  | jd ur|<| tj | j tj?@  td W Y d }~d S d }~ww )Nr   rZ   Fi rb IPC$z\RemCom_communicatoni r)   c                 S   s   g | ]}t tjqS r   )randomchoicestringascii_letters).0_r   r   r   
<listcomp>   s    z"PSEXEC.doStuff.<locals>.<listcomp>   r   r   r   r   z\%s%s%d   z6Process %s finished with ErrorCode: %d, ReturnCode: %dr"   r#   T)Aget_dce_rpcconnectrd   rL   	getLoggerlevelDEBUG	traceback	print_exccriticalstrsysexitget_smb_connection
getDialectdialect
setTimeoutr4   r   ServiceInstallr   	RemComSvcr8   r9   openinstallcloser5   	copy_filegetShareosr=   basenamer.   connectTreerm   r   getpidjoinranger/   writeNamedPipegetDataLastDataSentRemoteStdInPipeRemComSTDINr   FILE_WRITE_DATAFILE_APPEND_DATAstartRemoteStdOutPipeRemComSTDOUTFILE_READ_DATARemoteStdErrPipeRemComSTDERRreadNamedPipelenr!   info	uninstall
deleteFile
SystemExitrM   stdoutflush)r;   rW   dceer   unInstalledrf   installServicefrg   fid_mainpacketpid
stdin_pipestdout_pipestderr_pipeansretCoder   r   r   rS   y   s   










zPSEXEC.doStuff)
r(   r)   r)   r)   NNFNNN)r   r   r   rJ   rX   rm   rS   r   r   r   r   r'   C   s    
r'   c                   @      e Zd ZdddZdd ZdS )PipesNc                 C   sR   t |  d| _|| _| | _d| _d| _|| _|	 | _
|| _|| _d| _d S )Nr   T)r   rJ   serverr	   get_credentialscredentialsrg   rl   share	get_dportr@   rh   permissionsdaemon)r;   r	   rh   r   r   r   r   r   rJ      s   



zPipes.__init__c           
      C   s$  zst   t| j  | j  | jtd| _	| j
\}}}}}}}}| j du r>| j	j||||||| j ||d	 n
| j	||||| t   | j	d| _| j	| j| j | j	j| j| j| jddd| _| j	d W d S    t jtjkrd	d l}	|	  td
| j  Y d S )N	sess_portpreferredDialectTrG   TGTTGSrp   r\   r]   r^   i@B r   z9Something wen't wrong connecting the pipes(%s), try again) lockacquirer   r	   r   getRemoteNamegetRemoteHostr@   r   r   r   get_kerberoskerberosLoginget_kdcHostloginreleaser   rg   ra   rh   re   r   rl   r   rL   r|   r}   r~   r   r   error	__class__)
r;   userpasswdrC   lmntrE   r   r   r   r   r   r   connectPipe   s&   &zPipes.connectPipeN)r   r   r   rJ   r   r   r   r   r   r      s    
r   c                   @      e Zd Zdd Zdd ZdS )r   c                 C      t | ||| d S r   r   rJ   r;   r	   rh   permisssionsr   r   r   rJ   
     zRemoteStdOutPipe.__init__c              
   C   s6  |    trd\}}	 z| j| j| jdd}W n   Y nxzs|tkr-t|dkr-||7 }d}tt	
||d u}|dkrD|d }d}nd|v r\|d}d|d d	 d }|d	 }t|dkrztj|t tj  d}W n ty   td
 t|jtdd d}Y nw daW n   Y qd\}}	 z| j| j| jdd}W n   Y nkzW|tkrt|dkr||7 }d}tt	
||d u}|r|d }d}nd|v r|d}d|d d	 d }|d	 }t|dkrtj|t tj  d}ndaW n ty } zW Y d }~nd }~ww q)N    r   Tr      sG   ([a-zA-Z]:[\\\/])((([a-zA-Z0-9 -\.]*)[\\\/]?)+(([a-zA-Z0-9 -\.]+))?)?>$    r      
Decoding error detected, consider running chcp.com at the target,
map the result with https://docs.python.org/3/library/codecs.html#standard-encodings
and then execute smbexec.py again with -codec and the corresponding codecreplaceerrorsr)   r)   zG([a-zA-Z]:[\\\/])((([a-zA-Z0-9 -\.]*)[\\\/]?)+(([a-zA-Z0-9 -\.]+))?)?>$ro   r)   
)r   r   r   readFilerg   rl   r   r   boolrematchr:   r   r   r   writedecodeCODECr   UnicodeDecodeErrorrL   r   printrd   )r;   %_RemoteStdOutPipe__stdoutOutputBuffer_RemoteStdOutPipe__stdoutData
stdout_anspromptRegexendsWithPromptlinesr   r   r   r   rX     s   


:

zRemoteStdOutPipe.runNr   r   r   rJ   rX   r   r   r   r   r   	      r   c                   @   r   )r   c                 C   r   r   r   r   r   r   r   rJ     r   zRemoteStdErrPipe.__init__c              
   C   s  |    trd\}}	 z| j| j| jdd}W n   Y nkzXt|dkr)||7 }d|v rA|d}d|d d d }|d }t|dkrszt	j
|t t	j
  d}W n tyr   td t|jtd	d
 d}Y nw d}W n ty } zW Y d }~nd }~ww qd\}}	 z| j| j| jdd}W n   Y nBz=t|dkr||7 }d|v r|d}d|d d d }|d }t|dkrt	j
|t t	j
  d}nd}W n   Y q)Nr   Tr   r   r   r   r   r   r   r   r   r   r)   )r   r   r   r   rg   rl   r   r:   r   r   r   r   r   r   r   r   rL   r   r   rd   )r;   %_RemoteStdErrPipe__stderrOutputBuffer_RemoteStdErrPipe__stderrData
stderr_ansr   r   r   r   r   r   rX     sl   


)

zRemoteStdErrPipe.runNr   r   r   r   r   r     r   r   c                   @   s^   e Zd Zdd Zdd Zdd Zdd Zd	d
 Zdd Zdd Z	dd Z
dd ZdddZdS )RemoteShellc                 C   sN   t j| d d| _|| _d | _|| _|| _|| _|| _	|| _
|| _d| _d S )NFz'[!] Press help for extra shell commands)cmdCmdrJ   promptr   transferClientrg   rl   r   r   r@   r	   intro)r;   r   r@   r   rg   rl   r   r	   r   r   r   rJ     s   
zRemoteShell.__init__c           	      C   s~   t d| j | jtd| _| j\}}}}}}}}| j du r3| jj	||||||| j
 ||d	 d S | j||||| d S )Nz
*SMBSERVERr   Tr   )r   r   r   r@   r   r  r   r	   r   r   r   r   )	r;   r   r   rC   r   r   rE   r   r   r   r   r   connect_transferClient  s   
z"RemoteShell.connect_transferClientc                 C   s$   t d| j| jf  | dd d S )Na  
 lcd {path}                 - changes the current local directory to {path}
 exit                       - terminates the server process (and this session)
 lput {src_file, dst_path}   - uploads a local file to the dst_path RELATIVE to the connected share (%s)
 lget {file}                 - downloads pathname RELATIVE to the connected share (%s) to the current local dir
 ! {cmd}                    - executes a local shell cmd

F)r   r   	send_datar;   liner   r   r   do_help  s   
zRemoteShell.do_helpc                 C   s   t | | d d S Nr  )r   systemr  r;   rf   r   r   r   do_shell  s   
zRemoteShell.do_shellc              
   C   s   z1| j d u r
|   dd l}||}t|d}td| j|f  | j | j||j	 |
  W n tyJ } ztt| W Y d }~nd }~ww | d d S )Nr   wbzDownloading %s\%sr  )r  r  ntpathr   r   rL   r   r   getFiler   r   rd   r   r   r  )r;   src_pathr  filenamefhr   r   r   r   do_lget  s   


zRemoteShell.do_lgetc           
   
   C   s  zm| j d u r
|   |d}t|dkr|d }|d }nt|dkr*|d }d}tj|}t|d}|d | }|dd}t	
d|| j|f  trY| j | j||j n| j | j|tjj|j |  W n ty }	 zt	t|	 W Y d }	~	nd }	~	ww | d d S )	Nro   rZ   r   /rn   \zUploading %s to %s\%sr  )r  r  r:   r   r   r=   r   r   r   rL   r   r   r   putFilereadr   r   stdinencodingr   rd   r   r   r  )
r;   rf   paramsr  dst_pathsrc_filer  r   pathnamer   r   r   r   do_lput  s2   



zRemoteShell.do_lputc                 C   s.   |dkrt t  nt| | d d S )Nr)   r  )r   r   getcwdchdirr  r  r   r   r   do_lcd+  s   
zRemoteShell.do_lcdc                 C   s   |  d d S r  )r  r;   r   r   r   	emptyline2  s   
zRemoteShell.emptylinec                 C   s>   t r| |td  d S | |tjjtd  d S )Ns   
r  )r   r  encoder   r   r   r  r  r  r   r   r   default6  s   "zRemoteShell.defaultTc                 C   s*   |du r|a nda | j| j| j| d S )NTr)   )r   r   	writeFilerg   rl   )r;   data
hideOutputr   r   r   r  <  s   zRemoteShell.send_dataN)T)r   r   r   rJ   r  r
  r  r  r   r#  r%  r'  r  r   r   r   r   r     s    
r   c                   @   r   )r   Nc                 C   s   d | _ t| |||| d S r   )shellr   rJ   )r;   r	   rh   r   r   r   r   r   rJ   E  s   zRemoteStdInPipe.__init__c                 C   s:   |    t| j| j| j| j| j| j| j| _	| j	
  d S r   )r   r   r   r@   r   rg   rl   r   r	   r+  cmdloopr$  r   r   r   rX   I  s   $zRemoteStdInPipe.runr   r   r   r   r   r   r   D  s    
r   __main__Tz2PSEXEC like functionality example using RemComSvc.)add_helpdescriptiontargetstorez6[[domain/]username[:password]@]<targetName or address>)actionhelpr<   *ro   z\command (or arguments if -c is used) to execute at the target (w/o path) - (default:cmd.exe))nargsr'  r3  z-cr  zQcopy the filename for later execution, arguments are passed in the command option)r2  metavarr3  z-pathzpath of the command to executez-filez:alternative RemCom binary (be sure it doesn't require CRT)z-ts
store_truez&adds timestamp to every logging outputz-debugzTurn DEBUG output ONz-codeca  Sets encoding used (codec) from the target's output (default "%s"). If errors are detected, run chcp.com at the target, map the result with https://docs.python.org/3/library/codecs.html#standard-encodings and then execute smbexec.py again with -codec and the corresponding codec authenticationz-hasheszLMHASH:NTHASHz$NTLM hashes, format is LMHASH:NTHASHz-no-passz&don't ask for password (useful for -k)z-kzUse Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use the ones specified in the command linez-aesKeyzhex keyz<AES key to use for Kerberos Authentication (128 or 256 bits)z-keytabz"Read keys for SPN from keytab file
connectionz-dc-ipz
ip addressztIP Address of the domain controller. If omitted it will use the domain part (FQDN) specified in the target parameterz
-target-ipzIP Address of the target machine. If omitted it will use whatever was specified as target. This is useful when target is the NetBIOS name and you cannot resolve itz-port139445?zdestination portz)Destination port to connect to SMB Server)choicesr5  r'  r6  r3  z-service-nameservice_namer)   z3The name of the service used to trigger the payload)r2  r6  r'  r3  z-remote-binary-nameremote_binary_namez>This will be the name of the executable uploaded on the targetrZ   zutf-8F)getpassz	Password:zcmd.exe)Zr   r   r   r   rL   	threadingr   r   argparserq   rs   rb   sixr   impacket.examplesr   impacketr   r   impacket.smbconnectionr   impacket.dcerpc.v5r	   impacket.structurer
   r   r   impacket.examples.utilsr   impacket.krb5.keytabr   r   r  r   r   r!   r   r   r   r   r'   r   r   r   r  r   r   r   r   BANNERArgumentParserparseradd_argumentadd_argument_groupgroupr   argv
print_helpr   
parse_argsoptionsinittsrM   codecr0  rC   rA   rB   rT   keytabloadKeysFromKeytabk	target_iprD   no_passrE   r@  r   r<   r=   filecintr@   dc_ipr>  r?  executerrX   r   r   r   r   <module>   s   
  'vXm









8
"