o
    Žõ±jP  ã                   @   s  d dl Z d dlmZ d dlZd dlZd dlmZ d dlmZ d dl	m
Z
 d dlmZ d dlmZ d dlmZ d d	lmZ d d
lmZ d dlmZ d dlmZmZ d dlmZ d dlT d dlmZmZm Z m!Z!m"Z" d dl#m$Z$ e$ddd„ƒZ%G dd„ dej&ƒZ'G dd„ dƒZ(dS )é    N)Úlogger)Ú
DCERPCAuth)ÚDCERPCTarget)ÚSMBConnection)ÚDCERPC5Connection)ÚSMBUserSecrets)ÚFILETIME)ÚSID)ÚNULL)Ústring_to_bin)ÚdrsuapiÚsamr)ÚEPM)Ú*)ÚRPC_C_AUTHN_LEVEL_PKT_INTEGRITYÚRPC_C_AUTHN_LEVEL_PKT_PRIVACYÚRPC_C_AUTHN_LEVEL_CONNECTÚDCERPCExceptionÚRPC_C_AUTHN_GSS_NEGOTIATE)ÚasynccontextmanagerTFc                 C  sT   �t j| ||||d�I d H \}}|r|‚z|V  W | ¡ I d H  d S | ¡ I d H  w )N©ÚdomainÚ
auth_levelÚopenÚperform_dummy)Ú
DRSUAPIRPCÚfrom_smbconnectionÚclose)Ú
connectionr   r   r   r   ÚinstanceÚerr© r!   ú™/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/aiosmb/dcerpc/v5/interfaces/drsuapimgr.pyÚdrsuapirpc_from_smb   s   €"r#   c                   @   s,   e Zd ZdZdZdZdZdZdZdZ	dZ
d	S )
ÚDS_NAME_ERRORr   é   é   é   é   é   é   é   N)Ú__name__Ú
__module__Ú__qualname__ÚNO_ERRORÚ	RESOLVINGÚ	NOT_FOUNDÚ
NOT_UNIQUEÚ
NO_MAPPINGÚDOMAIN_ONLYÚNO_SYNTACTICAL_MAPPINGÚTRUST_REFERRALr!   r!   r!   r"   r$   %   s    r$   c                   @   s¤   e Zd Zddd„Zdd„ Zdd„ Zedd
ededefdd„ƒZ	edd
e
dedefdd„ƒZdd„ Zddd„Zejjejjdfdd„Zi fdd„Zdd„ Zdd„ ZdS ) r   Nc                 C   sr   || _ tj| _d | _d | _d | _d | _ddddddddd	d
dœ
| _ddddddddddœ	| _	ddddddœ| _
d S )Nú1.2.840.113556.1.4.656ú1.2.840.113556.1.4.221ú1.2.840.113556.1.4.90ú1.2.840.113556.1.4.55ú1.2.840.113556.1.4.94ú1.2.840.113556.1.4.160ú1.2.840.113556.1.4.125ú1.2.840.113556.1.4.146ú1.2.840.113556.1.4.96ú1.2.840.113556.1.4.8©
ÚuserPrincipalNameÚsAMAccountNameÚ
unicodePwdÚdBCSPwdÚntPwdHistoryÚlmPwdHistoryÚsupplementalCredentialsÚ	objectSidÚ
pwdLastSetÚuserAccountControli�	 iÝ 	 iZ 	 i7 	 i^ 	 i  	 i} 	 i’ 	 i 	 )	rB   rC   rD   rE   rF   rG   rH   rI   rK   zdec-cbc-crczdes-cbc-md5zaes128-cts-hmac-sha1-96zaes256-cts-hmac-sha1-96Úrc4_hmac)r%   r'   é   é   l   tÿ )Ú
domainnamer   ÚMSRPC_UUID_DRSUAPIÚservice_uuidÚdceÚhandleÚ_DRSUAPIRPC__NtdsDsaObjectGuidÚ_DRSUAPIRPC__ppartialAttrSetÚATTRTYP_TO_ATTIDÚNAME_TO_ATTRTYPÚKERBEROS_TYPE)ÚselfrO   r!   r!   r"   Ú__init__1   sB   ö÷ûzDRSUAPIRPC.__init__c                 Ã   s   �| S ©Nr!   )rY   r!   r!   r"   Ú
__aenter__\   s   €zDRSUAPIRPC.__aenter__c                 Ã   s   �|   ¡ I d H  dS ©N©TN)r   )rY   Úexc_typeÚexcÚ	tracebackr!   r!   r"   Ú	__aexit___   s   €zDRSUAPIRPC.__aexit__TFr   r   r   c           	   
   Ã   sÖ   �zSt |d�}| |_|j |¡ |d u r|j t¡ |j ¡ I d H \}}|d ur*|‚|j t ƒ j¡I d H \}}|d ur=|‚|du rP| ¡ I d H \}}|d urP|‚|d fW S  tyj } z
d|fW  Y d }~S d }~ww )N)rO   TF)	r   rR   Úset_auth_levelr   ÚconnectÚbindrQ   r   Ú	Exception)	r   r   r   r   r   ÚserviceÚ_r    Úer!   r!   r"   Úfrom_rpcconnectionc   s,   €

€ÿzDRSUAPIRPC.from_rpcconnectionc              
   Ã   sD  �d}z‘zm|du r| j j}|du rt}t | ¡}| ¡ I dH \}}|dur'|‚| tƒ j¡I dH \}}|dur9|‚t	j
|| d�}	t | j¡}
t|
|	ƒ}tj|||||d�I dH \}}|dur`|‚|dfW W |durq| ¡ I dH  S S  ty” } zd|fW  Y d}~W |dur�| ¡ I dH  S S d}~ww |dur¡| ¡ I dH  w w )z–
		Creates the connection to the service using an established SMBConnection.
		This connection will use the given SMBConnection as transport layer.
		N)Úsmb_connectionr   )Útargetr   r   r   r   rd   Úmapr   rQ   r   Úfrom_connection_stringr   Úfrom_smb_gssapiÚgssapir   rj   Ú
disconnectrf   )r   r   r   r   r   Úepmrh   r    Ú	constringrl   Údcerpc_authÚrpc_connectionrg   ri   r!   r!   r"   r      sD   €


ÿýÿ€ýÿzDRSUAPIRPC.from_smbconnectionc              
   Ã   sN  ��zt  ¡ }t j|d< t  ¡ }t|ƒ|d< t jt jB t jB t jB |d< t j	|d< d|d< d|d< d|d< t j	|d	< d
|d< t|ƒ|d d< t
| ¡ ƒ|d d< | j |¡I d H \}}|d ura|‚t  ¡ }d |d d ¡dtt  ¡ ƒ|d d    }| |¡ |d dkr¿tjtjkr–t d|d  ¡ |d |d< t|ƒ|d d< t
| ¡ ƒ|d d< | j |¡I d H \}}|d ur¿|‚|d | _t  | j| j| jd¡I d H \}}|d urÚ|‚tjtjkrét d| ¡  ¡ |d d d dk�r|d d d d d | _W dS t d| j ¡ tdƒ‚ t�y& } z
d |fW  Y d }~S d }~ww )NÚpuuidClientDsaÚcbÚdwFlagsÚSiteObjGuidr   ÚPidÚdwReplEpochÚ
dwFlagsExtÚConfigObjGUIDl   ÿÿ Ú	dwExtCapsÚ
pextClientÚrgbó    ÚppextServeró    zADC's dwReplEpoch != 0, setting it to %d and calling DRSBind againÚphDrsr&   z#DRSDomainControllerInfo() answer %sÚpmsgOutÚV2ÚcItemsÚrItemsÚNtdsDsaObjectGuidz"Couldn't get DC info for domain %szFatal, aborting!r^   )r   ÚDRSBindÚNTDSAPI_CLIENT_GUIDÚDRS_EXTENSIONS_INTÚlenÚDRS_EXT_GETCHGREQ_V6ÚDRS_EXT_GETCHGREPLY_V6ÚDRS_EXT_GETCHGREQ_V8ÚDRS_EXT_STRONG_ENCRYPTIONÚNULLGUIDÚlistÚgetDatarR   ÚrequestÚjoinÚ
fromStringr   ÚlevelÚloggingÚDEBUGÚdebugrS   ÚhDRSDomainControllerInforO   ÚdumprT   rf   )rY   r•   ÚdrsÚrespr    ÚdrsExtensionsIntr‚   ri   r!   r!   r"   r   ¥   sf   €
ÿ

ÿ
ÿ
 ý€ÿzDRSUAPIRPC.openc           -      Ã   s 
  ��zöddddddddd	d
dœ
}t |ƒ}|d u rN| ¡  d¡dkr'tjjg}n*| ¡  d¡dkr6tjjg}n| d¡dkrFtjjtjjg}ntj	tjj
g}n|g}d}d }|D ]_}| j|tjj|d�I d H \}}|d urn|‚|d d d d d d }|dkr˜zt|ƒ}	d||	jf }W n
   d|df }Y |d d d d d d d d… dd… }t|ƒdkrµqW n|dkrÁtd| ƒ‚td||f ƒ‚|  ||¡I d H \}
}|d urÝd |fW S d|
d  }|
d | d dkrñtd ƒ‚|
}|
d | d! d" }t d#|d | d$ d% d d…  ¡ tƒ }d }tj|d | d& d' d d( d)d … d*d+d,�}|d | d& d' d- d. D �]}zt ||d/ ¡}| j}W n( t�ys } zt d0| ¡ tjd1d2d3� |d/ }| j}W Y d }~nd }~ww ||d4 k�r«|d5 d6 dk�r£d7 |d5 d8 d d9 ¡}t | j ¡ |¡}t ||¡|_�n�t  !d:¡|_�n…||d; k�râ|d5 d6 dk�rÚd7 |d5 d8 d d9 ¡}t | j ¡ |¡}t ||¡|_"�nVt  !d<¡|_"�nN||d= k�r|d5 d6 dk�rzd7 |d5 d8 d d9 ¡ #d>¡ $d¡d |_%W �n$   d |_%Y �nd |_%�n||d? k�r~|d5 d6 dk�rgzd7 |d5 d8 d d9 ¡ #d>¡|_&W nò t�yf } zt 'd@|d | d$ d% d d…  ¡ dA|_&W Y d }~nÎd }~ww t 'd@|d | d$ d% d d…  ¡ dA|_&n²||dB k�r·|d5 d6 dk�r t( d7 |d5 d8 d d9 ¡¡|_)n�t 'dC|d | d$ d% d d…  ¡ ||_)ny||dD k�r|d5 d6 dk�rzt* d7 |d5 d8 d d9 ¡¡j+ ,¡ |_-W nR t�y } zt 'dE|d | d$ d% d d…  ¡ d |_-W Y d }~n.d }~ww n(||dF k�r0|d5 d6 dk�r-tjd7 |d5 d8 d d9 ¡d*d+d,�|_.nd |_.||dG k�r�|d5 d6 dk�r{d7 |d5 d8 d d9 ¡}t | j ¡ |¡}t/dt|ƒdH ƒD ]}t ||dH |d dH … |¡}|j0 1|¡ �q_�q;t dI|d | d$ d% d d…  ¡ �q;||dJ k�rð|d5 d6 dk�rÛd7 |d5 d8 d d9 ¡}t | j ¡ |¡}t/dt|ƒdH ƒD ]}t ||dH |d dH … |¡}|j2 1|¡ �q¿�q;t dK|d | d$ d% d d…  ¡ �q;||dL k�r>|d5 d6 dk�r>d7 |d5 d8 d d9 ¡} t | j ¡ | ¡}!t|!ƒdMk �r!d }!�q;zt3 4|!¡}W �q; t�y= } zW Y d }~�q;d }~ww �q;|d u�rô|dN }"t/|dO ƒD ]¤}#t3 5|"¡}$|"t|$ƒd … }"|$dP  #d>¡dQk�rÁt  !|$dR  #¡ ¡}%t3 6|%¡}&|&dS }'t/|&dT ƒD ]>}(t3 7|'¡})|'t|)ƒd … }'|%|)dU d … d |)dV … }*|)dW | j8v �r¯| j8|)dW  |*f}+nt9|)dW ƒ|*f}+|j: 1|+¡ �q€�qO|$dP  #d>¡dXk�ròt  !|$dR  #dY¡¡},z|, #d>¡}+W n t;�yë   |, #dZ¡}+Y nw |j< 1|+¡ �qO|d fW S  t�y } z
d |fW  Y d }~S d }~ww )[Nr7   r8   r9   r:   r;   r<   r=   r>   r?   r@   rA   zCN=éÿÿÿÿzS-1-5-ú@ÚUNKNOWN)Únamer…   ÚV1ÚpResultrˆ   r   Ústatusz%s - %sÚpNamer%   z$User "%s" lookup returned empty GUIDz#User "%s" lookup failed. Reason: %szV%dÚpdwOutVersionÚcNumObjectsz)DRSGetNCChanges didn't return any object!ÚPrefixTableSrcÚpPrefixEntryzDecrypting hash for user: %sÚpNCÚ
StringNameÚpObjectsÚEntinfÚSidéüÿÿÿÚlittleF)ÚsignedÚ	AttrBlockÚpAttrÚattrTypzHFailed to execute OidFromAttid with error %s, fallbacking to fixed tablerf   T)Úexc_inforE   ÚAttrValÚvalCountr�   ÚpAValÚpValÚ aad3b435b51404eeaad3b435b51404eerD   Ú 31d6cfe0d16ae931b73c59d7e0c089c0rB   zutf-16lerC   z Cannot get sAMAccountName for %sÚunknownrI   zCannot get objectSid for %srJ   zCannot get pwdLastSet for %srK   rG   é   zNo lmPwdHistory for user %srF   zNo ntPwdHistory for user %srH   é   ÚUserPropertiesÚPropertyCountÚPropertyNamezPrimary:Kerberos-Newer-KeysÚPropertyValueÚBufferÚCredentialCountÚ	KeyOffsetÚ	KeyLengthÚKeyTypezPrimary:CLEARTEXTÚasciizutf-8)=ÚstrÚupperÚfindr   ÚDS_NAME_FORMATÚDS_FQDN_1779_NAMEÚDS_SID_OR_SID_HISTORY_NAMEÚDS_USER_PRINCIPAL_NAMEÚDS_SERVICE_PRINCIPAL_NAMEÚDS_NT4_ACCOUNT_NAME_SANS_DOMAINÚDS_UNKNOWN_NAMEÚDRSCrackNamesÚDS_UNIQUE_ID_NAMEr$   r¤   r�   rf   ÚDRSGetNCChangesr   r›   r   ÚintÚ
from_bytesÚOidFromAttidrV   rW   r–   ÚDecryptAttributeValuerR   Úget_session_keyÚremoveDESLayerÚlm_hashÚbytesÚfromhexÚnt_hashÚdecodeÚsplitr   ÚusernameÚerrorr	   Ú
object_sidr   ÚdatetimeÚ	isoformatÚpwd_last_setÚuser_account_statusÚrangeÚ
lm_historyÚappendÚ
nt_historyr   ÚUSER_PROPERTIESÚUSER_PROPERTYÚKERB_STORED_CREDENTIAL_NEWÚKERB_KEY_DATA_NEWrX   ÚhexÚkerberos_keysÚUnicodeDecodeErrorÚcleartext_pwds)-rY   rå   ÚformatOfferedÚraÚformatOffered_listÚrstatusÚguidÚcrackedNamer    ÚsÚ
userRecordÚreplyVersionÚrecordÚprefixTableÚusÚuser_propertiesÚridÚattrÚattIdÚLOOKUP_TABLEri   ÚencrypteddBCSPwdÚencryptedLMHashÚencryptedUnicodePwdÚencryptedNTHashÚencryptedLMHistoryÚtmpLMHistoryÚiÚLMHashHistoryÚencryptedNTHistoryÚtmpNTHistoryÚNTHashHistoryÚblobrH   ÚpropertiesDataÚpropertyCountÚuserPropertyÚpropertyValueBufferÚkerbStoredCredentialNewÚdataÚ
credentialÚ
keyDataNewÚkeyValueÚanswerÚ
encoded_pwr!   r!   r"   Úget_user_secretsä   sl  €öý,
&0"
€û2
&&€þ&$&,&€ýü	* þ* þ*€ý€



ôþ€
€ÿzDRSUAPIRPC.get_user_secretsÚ c              
   Ã   sl   �zt  d| ¡ t | j| jd|||f¡I d H \}}||fW S  ty5 } z
d |fW  Y d }~S d }~ww )NzCalling DRSCrackNames for %sr   )r   r›   r   ÚhDRSCrackNamesrR   rS   rf   )rY   rø   ÚformatDesiredr¤   rŸ   r    ri   r!   r!   r"   rÖ   Ê  s   €$
€ÿzDRSUAPIRPC.DRSCrackNamesc           	   
   Ã   s0  �zÿt  d| ¡ t ¡ }| j|d< d|d< d|d d< | j|d d d< | j|d d d	< t ¡ }d
|d< t|ƒ|d< d|d< d
|d< d|d< t| 	¡ ƒ|d< ||d d d< d
|d d d d< d
|d d d d< t
|d d d< tjtjB |d d d< d|d d d< d
|d d d< tj|d d d< | jd u rÈg | _t ¡ | _d| jd< t|ƒ| jd< t| ¡ ƒD ]}| jd  t | j|¡¡ q¸| j|d d d < t| jƒ|d d d! d"< | j|d d d! d#< t
|d d d$< | j |¡I d H \}}||fW S  t�y } z
d |fW  Y d }~S d }~ww )%NzCalling DRSGetNCChanges for %s ÚhDrsé   ÚdwInVersionÚpmsgInÚtagÚV8ÚuuidDsaObjDestÚuuidInvocIdSrcr   ÚSidLenÚGuidr!  r±   ÚNameLenú r®   Ú	structLenr­   Ú
usnvecFromÚusnHighObjUpdateÚusnHighPropUpdateÚpUpToDateVecDestÚulFlagsr%   ÚcMaxObjectsÚ	cMaxBytesÚulExtendedOpÚ	dwVersionÚcAttrsÚrgPartialAttrÚpPartialAttrSetÚPrefixTableDestÚPrefixCountr¬   ÚpPartialAttrSetEx1)r   r›   r   rØ   rS   rT   ÚDSNAMEr   r�   r”   r
   ÚDRS_INIT_SYNCÚDRS_WRIT_REPÚEXOP_REPL_OBJrU   Ú_DRSUAPIRPC__prefixTableÚPARTIAL_ATTR_VECTOR_V1_EXTr“   Úvaluesrî   Ú	MakeAttidrR   r•   rf   )	rY   rü   Úreq_attributesr•   ÚdsNamer  r  r    ri   r!   r!   r"   rØ   Ò  sR   €




€ÿzDRSUAPIRPC.DRSGetNCChangesc              
   Ã   sj   �zt  d¡ t | j| j¡I d H \}}|d ur|‚|d fW S  ty4 } z
d |fW  Y d }~S d }~ww )NzCalling DRSGetNT4ChangeLog)r   r›   r   ÚhDRSGetNT4ChangeLogrR   rS   rf   )rY   rŸ   r    ri   r!   r!   r"   ÚDRSGetNT4ChangeLog  s   €

€ÿzDRSUAPIRPC.DRSGetNT4ChangeLogc              
   Ã   sŽ   �z/| j rzt | j| j ¡I d H  W n   Y | jr.z| j ¡ I d H  W W dS    Y W dS W dS  tyF } z
d |fW  Y d }~S d }~ww r]   )rS   r   Ú
hDRSUnbindrR   rq   rf   )rY   ri   r!   r!   r"   r     s$   €ý€ÿzDRSUAPIRPC.closer[   ©NNTF)r,   r-   r.   rZ   r\   rb   Ústaticmethodr   Úboolrj   r   r   r   r   r   rÏ   rÕ   rÐ   rÖ   rØ   rK  r   r!   r!   r!   r"   r   0   s    
+%
? g1
r   rM  ))r™   Úaiosmbr   ra   ÚenumÚ1aiosmb.dcerpc.v5.common.connection.authenticationr   Ú)aiosmb.dcerpc.v5.common.connection.targetr   Úaiosmb.connectionr   Úaiosmb.dcerpc.v5.connectionr   Úaiosmb.dcerpc.v5.common.secretsr   Ú(aiosmb.wintypes.dtyp.structures.filetimer   Ú-aiosmb.wintypes.dtyp.constrcuted_security.sidr	   Úaiosmb.dcerpc.v5.dtypesr
   Úaiosmb.dcerpc.v5.uuidr   Úaiosmb.dcerpc.v5r   r   Ú'aiosmb.dcerpc.v5.interfaces.endpointmgrr   Ú*aiosmb.dcerpc.v5.interfaces.servicemanagerÚaiosmb.dcerpc.v5.rpcrtr   r   r   r   r   Ú
contextlibr   r#   ÚEnumr$   r   r!   r!   r!   r"   Ú<module>   s,   