o
    jV                  
   @   sr  d dl mZ d dl mZ d dl mZ d dlmZ d dlmZ d dlm	Z	 d dl
mZmZmZ d dlmZmZ d d	lmZmZ d d
lZd d
lZd d
lZd d
lZd d
lZd d
lZd d
lZd dlmZ G dd dZedkreej ej dddZ!ej"j#dkrej"j$dkrej"j%dk re!j&dddd n	e!j&ddddd e!j&ddddd e!j&ddd d!d e!j&d"dd#d$d e!j&d%d&d'd e!j&d(d&d)d e!j&d*d&d+d e!j&d,d&d-d e!j&d.d/d0gd/d1d2 e!j&d3e'g d4d5d6 e!(d7Z)e)j&d8dd9d:d e)j&d;dd<d=d e!(d>Z)e)j&d?dd@dAd e)j&dBd&dCd e)j&dDd&dEd e)j&dFddGdHd e)j&dIddJdKd e)j&dLddMdNd e*ej+dOkrNe!,  e-dO e!. Z/e0e/j1e/j2 e	e/j3e/j4e/j5e/j6e/j7\Z8Z9Z:Z;Z;e/_7e8dPkr}e<dQ e-dO zee9e:e8e/Z=e=>  W d
S  e?y Z@ zeA jBejCkrd d
lDZDeDE  eeFe@ W Y d
Z@[@d
S d
Z@[@ww d
S )R    )division)print_function)unicode_literals)version)logger)parse_identity)samrepm	transport)SPNEGO_NegTokenInit	TypesMech)init_ldap_sessionldap3_kerberos_loginN)	unhexlifyc                   @   sL   e Zd Zdd Zdd Zdd Zdd Zd	d
 Zdd Zdd Z	dd Z
dS )ADDCOMPUTERc                 C   sz  || _ || _|| _|| _d| _d| _|j| _|j| _	|j
| _|j| _|j| _|j| _|j| _|j| _|j| _|j| _|j| _|j| _|j| _|j| _ |j!| _"| jd urW| j| _| jdvrct#d| j | jro|jd u rot#d| jdkrd| jvrt$%d| j  |jd ur|j&d\| _| _| jd u r| jrt#d	| jrt#d
n| jd dkr|  jd7  _| jd u rd'dd t(dD | _| jd u rd| jvrt$%d| j  | j| _| jd u r| jdkrd| _n| jdkrd| _| jd u r| j| _| jdkr%| j d u r%| j&d}d| _ |D ]}|  j d| 7  _ q| j d d | _ | jdkr9| j"d u r;d| j  | _"d S d S d S )N )SAMRLDAPSzUnsupported method %sz?Kerberos auth requires DNS name of the target DC. Use -dc-host.r   .zD'%s' doesn't look like a FQDN. Generating baseDN will probably fail.:z7You have to provide a computer name when using -no-add.z7You have to provide a computer name when using -delete.$c                 s   "    | ]}t tjtj V  qd S N)randomchoicestringascii_lettersdigits.0_ r"   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/../../../bin/addcomputer.py	<genexpr>c        z'ADDCOMPUTER.__init__.<locals>.<genexpr>    zcNo DC host set and '%s' doesn't look like a FQDN. DNS resolution of short names will probably fail.r     |  zdc=%s,zCN=Computers,))options_ADDCOMPUTER__username_ADDCOMPUTER__password_ADDCOMPUTER__domain_ADDCOMPUTER__lmhash_ADDCOMPUTER__nthashhashes_ADDCOMPUTER__hashesaesKey_ADDCOMPUTER__aesKeyk_ADDCOMPUTER__doKerberosdc_host_ADDCOMPUTER__target_ADDCOMPUTER__kdcHostcomputer_name_ADDCOMPUTER__computerNamecomputer_pass_ADDCOMPUTER__computerPasswordmethod_ADDCOMPUTER__methodport_ADDCOMPUTER__portdomain_netbios_ADDCOMPUTER__domainNetbiosno_add_ADDCOMPUTER__noAdddelete_ADDCOMPUTER__deletedc_ip_ADDCOMPUTER__targetIpbaseDN_ADDCOMPUTER__baseDNcomputer_group_ADDCOMPUTER__computerGroup
ValueErrorloggingwarningsplitjoinrange)selfusernamepassworddomaincmdLineOptionsdomainPartsir"   r"   r#   __init__3   sz   










zADDCOMPUTER.__init__c                 C   s   | j d urtj| j tjdd}n
tj| jtjdd}t|}|| j	 | j d ur6|
| j  || j t|drK|| j| j| j| j| j| j || j| j | | d S )Nncacn_np)protocolset_credentials)rG   r	   hept_mapr   MSRPC_UUID_SAMRr6   r
   DCERPCTransportFactory	set_dportr?   setRemoteHostsetRemoteNamehasattrr\   r*   r+   r,   r-   r.   r2   set_kerberosr4   r7   	doSAMRAdd)rR   stringBindingrpctransportr"   r"   r#   run_samr   s   



zADDCOMPUTER.run_samrc                 C   s  zLt | j| j| j| j| j| j| j| j| j	d
\}}| j
s | jr| || js1td| j| jf | || j}| jrD||j}d}n||jdtjd| jdgfgi}d}|sy|jd tjjjkrrtd	| j|| jf tt|j| j
rtd
| j| jf  W d S td| j  W d S | jd ur| || jrtd| j n	 |   | _| || jsnq| jd d }d|| j!f }d| d|| jf d| d|| jf g}d|| jf d|| jd| j dd}	|"|g d|	}|s@|jd tjjj#kr't$|jd %dd & d}
|
dkr td| j tt|j|jd tjjjkr9td| j tt|jtd| j| jf  W d S  tyy } zt' j(tj)krgdd l*}|+  t,t| W Y d }~d S d }~ww ) NTzAccount %s not found in %s!rD   
unicodePwdz"{}"z	utf-16-leset password forresult$User %s doesn't have right to %s %s!z%Succesfully set password of %s to %s.zSuccesfully deleted %s.KAccount %s already exists! If you just want to set a password, use -no-add.r   zCN=%s,%szHOST/%sz
HOST/%s.%szRestrictedKrbHost/%szRestrictedKrbHost/%s.%sz%s.%si   z"%s")dnsHostNameuserAccountControlservicePrincipalNamesAMAccountNameri   )toppersonorganizationalPersonusercomputermessager   r      im!  zUser %s machine quota exceeded!z7User %s doesn't have right to create a machine account!7Successfully added machine account %s with password %s.)-r   r,   r*   r+   r-   r.   r4   rG   r6   r2   rC   rE   LDAPComputerExistsr9   	ExceptionrI   LDAPGetComputerrD   entry_dnmodifyldap3MODIFY_REPLACEformatr;   encoderk   coreresults!RESULT_INSUFFICIENT_ACCESS_RIGHTSstrrM   infogenerateComputerNamerK   addRESULT_UNWILLING_TO_PERFORMintrO   strip	getLoggerlevelDEBUG	traceback	print_exccritical)rR   
ldapServerldapConnrv   resrw   computerHostname
computerDnspnsucd
error_codeer   r"   r"   r#   	run_ldaps   st   0*


zADDCOMPUTER.run_ldapsc                 C   s    | | jd|  t|jdkS )N(sAMAccountName=%s)   )searchrI   lenentriesrR   
connectioncomputerNamer"   r"   r#   rz      s   zADDCOMPUTER.LDAPComputerExistsc                 C   s   | | jd|  |jd S )Nr   r   )r   rI   r   r   r"   r"   r#   r|      s   
zADDCOMPUTER.LDAPGetComputerc                 C   s    dd dd tdD d  S )NzDESKTOP-r   c                 s   r   r   )r   r   r   ascii_uppercaser   r   r"   r"   r#   r$      r%   z3ADDCOMPUTER.generateComputerName.<locals>.<genexpr>   r   )rP   rQ   rR   r"   r"   r#   r      s    z ADDCOMPUTER.generateComputerNamec              
      s
  |  }d }d }d }zSz|  |tj t|d j tjtjB }|d }t	||}|d d }t
tdd |}	t|	dkrt
t fdd|}
t|
dkrxtd j td	 |D ]}
td
|
d   qdtd t |
d d }n|	d d }t|||}|d }t jtjkrtd|  t||tjtjB |}|d } js jr#zt|| jg}W n tjy } z|jdkrtd j|f  d }~ww |d d d } jrtj }d}ntj!}d}zt"||||}|d }W n tjy" } z|jdkrtd j#| jf  d }~ww  jd urUzt|| jg}td j  tjyT } z|jdkrJ W Y d }~n<d }~ww d}|s $  _zt|| jg}W n tjy } z|jdkr}d}n W Y d }~nd }~ww |rZt%|| jtj&tj!}|d } jrt'|| td j  d }nYt(|| j)  jrtd j j)f  nAt|| jg}|d d d }t"||tj*|}|d }t+ }tj,j-|d< tj&|d  d!< t.||| td" j j)f  W n+ ty6 } zt jtjkr%dd l/}|0  tt1| W Y d }~nd }~ww W |d urCt2|| |d urNt2|| |d urYt2|| |3  d S |d urjt2|| |d urut2|| |d urt2|| |3  w )#Nz\\%s ServerHandleBufferc                 S   s   | d   dkS )NNamebuiltin)lowerxr"   r"   r#   <lambda>   s    z'ADDCOMPUTER.doSAMRAdd.<locals>.<lambda>r   c                    s   | d    jkS )Nr   )r   rA   r   r   r"   r#   r     s    zAThis server provides multiple domains and '%s' isn't one of them.zAvailable domain(s):z * %sr   zGConsider using -domain-netbios argument to specify which one you meant.r   DomainIdzOpening domain %s...DomainHandlel   s    z"Account %s not found in domain %s!RelativeIdsElementrD   rj   
UserHandlel   "    rl   rm   FTzSuccessfully deleted %s.z&Successfully set password of %s to %s.tagControlUserAccountControlry   )4get_dce_rpcconnectbindr   r^   hSamrConnect5r6   SAM_SERVER_ENUMERATE_DOMAINSSAM_SERVER_LOOKUP_DOMAIN hSamrEnumerateDomainsInSamServerlistfilterr   rM   r   rA   errorr{   hSamrLookupDomainInSamServerr   r   r   r   hSamrOpenDomainDOMAIN_LOOKUPDOMAIN_CREATE_USERrC   rE   hSamrLookupNamesInDomainr9   DCERPCSessionErrorr   DELETEUSER_FORCE_PASSWORD_CHANGEhSamrOpenUserr*   r   hSamrCreateUser2InDomainUSER_WORKSTATION_TRUST_ACCOUNThSamrDeleteUserhSamrSetPasswordInternal4Newr;   MAXIMUM_ALLOWEDSAMPR_USER_INFO_BUFFERUSER_INFORMATION_CLASSUserControlInformationhSamrSetInformationUser2r   r   r   hSamrCloseHandle
disconnect)rR   rg   dce
servHandledomainHandle
userHandlesamrConnectResponsesamrEnumResponsedomainsdomainsWithoutBuiltinrU   selectedDomainsamrLookupDomainResponse	domainSIDsamrOpenDomainResponsecheckForUserr   userRIDaccessrw   openUserfoundUnused
createUserreqr   r"   r   r#   re      s   












zADDCOMPUTER.doSAMRAddc                 C   s0   | j dkr|   d S | j dkr|   d S d S )Nr   r   )r=   rh   r   r   r"   r"   r#   runi  s
   

zADDCOMPUTER.runN)__name__
__module____qualname__rY   rh   r   rz   r|   r   re   r   r"   r"   r"   r#   r   2   s    NPyr   __main__Tz!Adds a computer account to domain)add_helpdescription      rx   accountstorez@[domain/]username[:password] Account used to authenticate to DC.)actionhelpz[domain/]username[:password]z#Account used to authenticate to DC.)r   metavarr   z-domain-netbiosNETBIOSNAMEz=Domain NetBIOS name. Required if the DC has multiple domains.z-computer-namezCOMPUTER-NAME$zNName of computer to add.If omitted, a random DESKTOP-[A-Z0-9]{8} will be used.z-computer-passrT   zMPassword to set to computerIf omitted, a random [A-Za-z0-9]{32} will be used.z-no-add
store_truez8Don't add a computer, only set password on existing one.z-deletezDelete an existing computer.z-tsz&Adds timestamp to every logging outputz-debugzTurn DEBUG output ONz-methodr   r   ztMethod of adding the computer.SAMR works over SMB.LDAPS has some certificate requirementsand isn't always available.)choicesdefaultr   z-port)   r'   r(   zCDestination port to connect to. SAMR defaults to 445, LDAPS to 636.)typer   r   LDAPz-baseDNzDC=test,DC=localzgSet baseDN for LDAP.If ommited, the domain part (FQDN) specified in the account parameter will be used.z-computer-groupzCN=Computers,DC=test,DC=localzOGroup to which the account will be added.If omitted, CN=Computers will be used,authenticationz-hasheszLMHASH:NTHASHz$NTLM hashes, format is LMHASH:NTHASHz-no-passz&don't ask for password (useful for -k)z-kzUse Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on account parameters. If valid credentials cannot be found, it will use the ones specified in the command linez-aesKeyzhex keyz<AES key to use for Kerberos Authentication (128 or 256 bits)z-dc-hosthostnamez|Hostname of the domain controller to use. If ommited, the domain part (FQDN) specified in the account parameter will be usedz-dc-ipipzzIP of the domain controller to use. Useful if you can't translate the FQDN.specified in the account parameter will be usedr   r   zDomain should be specified!)G
__future__r   r   r   impacketr   impacket.examplesr   impacket.examples.utilsr   impacket.dcerpc.v5r   r	   r
   impacket.spnegor   r   r   r   r   argparserM   sysr   r   sslbinasciir   r   r   printBANNERArgumentParserparserversion_infomajorminormicroadd_argumentr   add_argument_groupgroupr   argv
print_helpexit
parse_argsr)   inittsdebugr   r/   no_passr1   r3   rU   rS   rT   r!   r   executerr   r{   r   r   r   r   r   r   r   r"   r"   r"   r#   <module>   s     
@
$


(


