o
    àý°j%  ã                   @   s  d dl Z d dlmZ d dlmZ d dlmZmZmZm	Z	m
Z
 d dlmZ z
d dlmZmZ W n eyA   e d¡ e  d¡ Y nw d d	lmZ d d
lmZmZ d dlmZmZmZmZmZmZmZm Z m!Z!m"Z" d dl#m$Z$ ddgZ%G dd„ de&ƒZ'G dd„ deƒZ(G dd„ de(ƒZ)dS )é    N)Úunpack)ÚLOG)ÚServerÚ
ConnectionÚALLÚNTLMÚ
MODIFY_ADD)Úbind)ÚRESULT_SUCCESSÚRESULT_STRONGER_AUTH_REQUIREDzXntlmrelayx requires ldap3 > 2.0. To update, use: 'python -m pip install ldap3 --upgrade'é   )ÚProtocolClient)ÚSTATUS_SUCCESSÚSTATUS_ACCESS_DENIED)
ÚNTLMAuthChallengeÚNTLMSSP_AV_FLAGSÚAV_PAIRSÚNTLMAuthNegotiateÚNTLMSSP_NEGOTIATE_SIGNÚNTLMSSP_NEGOTIATE_SEALÚNTLMSSP_NEGOTIATE_ALWAYS_SIGNÚNTLMAuthChallengeResponseÚNTLMSSP_NEGOTIATE_KEY_EXCHÚNTLMSSP_NEGOTIATE_VERSION)ÚSPNEGO_NegTokenRespÚLDAPRelayClientÚLDAPSRelayClientc                   @   s   e Zd ZdS )ÚLDAPRelayClientExceptionN)Ú__name__Ú
__module__Ú__qualname__© r!   r!   ú§/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/impacket/examples/ntlmrelayx/clients/ldaprelayclient.pyr   2   s    r   c                   @   s`   e Zd ZdZeZddd„Zdd„ Zdd	„ Zd
d„ Zdd„ Z	ddd„Z
dd„ Zdd„ Zdd„ ZdS )r   ÚLDAPé…  Tc                 C   s.   t  | ||||¡ || _d | _d | _d | _d S ©N)r   Ú__init__ÚextendedSecurityÚnegotiateMessageÚauthenticateMessageBlobÚserver©ÚselfÚserverConfigÚtargetÚ
targetPortr'   r!   r!   r"   r&   9   s
   
zLDAPRelayClient.__init__c                 C   s$   | j d ur| j j ¡  d | _ d S d S r%   )ÚsessionÚsocketÚclose©r,   r!   r!   r"   ÚkillConnection@   s   

þzLDAPRelayClient.killConnectionc                 C   ó>   t d| j| jf td�| _t| jddtd�| _| j d¡ dS )Nzldap://%s:%s©Úget_infoÚaÚb©ÚuserÚpasswordÚauthenticationFT©	r   Ú
targetHostr/   r   r*   r   r   r0   Úopenr3   r!   r!   r"   ÚinitConnectionE   ó   zLDAPRelayClient.initConnectionc              	   C   sÞ  t ƒ }| |¡ | jjs| jjr0|d t@ tkr |d  tN  < |d t@ tkr0|d  tN  < | jjrD|d t@ tkrD|d  tN  < | ¡ | _	|d t@ tkrVt
 d¡ | jj�‹ | jjsÕd| j_t | jjd¡}| j | j d|d ¡¡}|d }z|d  d¡ d	¡}W n ty”   td
| ƒ‚w d|v rÑt | jjd| ¡}| j | j d|d ¡¡}|d }|d tkrÐtƒ }| |d ¡ || jd< |W  d   ƒ S ntdƒ‚W d   ƒ d S W d   ƒ d S 1 sèw   Y  d S )NÚflagszsThe client requested signing. Relaying to LDAP will not work! (This usually happens when relaying from SMB to LDAP)TÚSICILY_PACKAGE_DISCOVERYÚbindRequestr   Úserver_credsÚasciiú;z=Could not discover authentication methods, server replied: %sr   ÚSICILY_NEGOTIATE_NTLMÚresultÚCHALLENGE_MESSAGEz)Server did not offer NTLM authentication!)r   Ú
fromStringr-   Ú
remove_micÚremove_sign_sealr   r   r   ÚgetDatar(   r   Úwarningr0   Úconnection_lockÚsasl_in_progressr	   Úbind_operationÚversionÚpost_send_single_responseÚsendÚdecodeÚsplitÚKeyErrorr   r
   r   ÚsessionData)r,   r(   ÚnegoMessageÚrequestÚresponserJ   Úsicily_packagesÚ	challenger!   r!   r"   ÚsendNegotiateK   sP   



ÿ
íìÿ"ñzLDAPRelayClient.sendNegotiatec                 C   ó   | j S r%   )r(   r3   r!   r!   r"   Úcreate_negotiate_message|   ó   z(LDAPRelayClient.create_negotiate_messageNc           	      C   s  t d|d d… ƒd tjkrt|ƒ}|d }n|}tƒ }| |¡ | jjry|d t@ tkr5|d  tN  < |d t@ tkrE|d  tN  < |d t	@ t	krU|d  t	N  < |d t
@ t
kre|d  t
N  < d|d< d|d< d|d	< d|d
< | ¡ }| jjr±|d t@ tkr�|d  tN  < |d t@ tkr�|d  tN  < |d t@ tkr­|d  tN  < | ¡ }| jj�% || _t | jjd| d ¡}| j | j d|d ¡¡}|d }W d   ƒ n1 sÝw   Y  d| j_|d tkrùd| j_| j ¡  d tfS |d tk�r
| jdk�r
tdƒ‚d tfS )NÚBr   r   ÚResponseTokenrC   ó    ÚMICÚMICLenÚVersionÚ
VersionLenÚSICILY_RESPONSE_NTLMrE   FrJ   TÚLDAPSz…Server rejected authentication because LDAP signing is enabled. Try connecting with TLS enabled (specify target as ldaps://hostname ))r   r   ÚSPNEGO_NEG_TOKEN_RESPr   rL   r-   rM   r   r   r   r   rO   rN   r   r0   rQ   r)   r	   rS   rT   rU   rV   rR   r
   ÚboundÚrefresh_server_infor   r   ÚPLUGIN_NAMEr   r   )	r,   r)   ÚserverChallengeÚ
respToken2ÚtokenÚauthMessager\   r]   rJ   r!   r!   r"   ÚsendAuth   sT   



ü
zLDAPRelayClient.sendAuthc                 C   ra   r%   )r)   r3   r!   r!   r"   Úcreate_authenticate_message²   rc   z+LDAPRelayClient.create_authenticate_messagec                 C   s   d S r%   r!   )r,   Úmessager!   r!   r"   Úparse_challenge_message¶   s   z'LDAPRelayClient.parse_challenge_messagec                 C   s   | j jddddgd� d S )NÚ z(objectClass=*)ÚBASEÚnamingContexts)Úsearch_baseÚsearch_filterÚsearch_scopeÚ
attributes)r0   Úsearchr3   r!   r!   r"   Ú	keepAlive¹   s
   
ýzLDAPRelayClient.keepAlive)r$   Tr%   )r   r   r    rp   r   r&   r4   rA   r`   rb   ru   rv   rx   r�   r!   r!   r!   r"   r   5   s    
1
3c                   @   s&   e Zd ZdZeZd	dd„Zdd„ ZdS )
r   rl   é|  Tc                 C   s   t  | ||||¡ d S r%   )r   r&   r+   r!   r!   r"   r&   Ä   s   zLDAPSRelayClient.__init__c                 C   r5   )Nzldaps://%s:%sr6   r8   r9   r:   FTr>   r3   r!   r!   r"   rA   Ç   rB   zLDAPSRelayClient.initConnectionN)r‚   T)r   r   r    rp   r   r&   rA   r!   r!   r!   r"   r   À   s
    
)*ÚsysÚstructr   Úimpacketr   Úldap3r   r   r   r   r   Úldap3.operationr	   Úldap3.core.resultsr
   r   ÚImportErrorÚfatalÚexitÚ$impacket.examples.ntlmrelayx.clientsr   Úimpacket.nt_errorsr   r   Úimpacket.ntlmr   r   r   r   r   r   r   r   r   r   Úimpacket.spnegor   ÚPROTOCOL_CLIENT_CLASSESÚ	Exceptionr   r   r   r!   r!   r!   r"   Ú<module>   s(   
þ0 