o àý°jzAã @sžddlmZddlmZddlZddlZddlZddlZddlmZddl m Z m Z ddl m Z ddlmZmZddlmZdd lmZmZmZdd lmZdd lmZmZdd lmZdd lmZmZm Z m!Z!m"Z"m#Z#Gdd„dƒZ$e%dkrMe&ej'ƒGdd„dej(ƒZ)ej*de)ddZ+e+j,ddde+j,dddde+j,dddde+j,ddd de+j,d!d"e-d#d$d%e+j,d&d"e-d#d'd%e+j,d(d"e-d)d*d%e+j,d+d"d,de+j,d-dd.de+j,d/dd0de+ .d1¡Z/e/j,d2d"d3d4d5e/j,d6d7d8gd9d8d:d;d<e+ .d=¡Z/e/j,d>d"d?d@dAe/j,dBd"d?d@dAe/j,dCd"dDdEd5e/j,dFd"dDdEd5e/j,dGddHde0ej1ƒdIkr@e+ 2¡e 3dI¡e+ 4¡Z5e  6e5j7e5j8¡e e5j9e5j:e5j;dJdK\ZZ?Z?Z?e e5j@e5jAe5j;dLdK\ZBZCZDZ?Z?Z?e5jEr€e5jFr€e GdM¡e 3dI¡e5jdur‘e He5j¡gZIde5_Jne jKZIz;e$e5jLe5jMe5jJeIe5jEe5jNe5jFe5jOƒZPeP Qe=e>er?r-r=r)r@rrr7Úset_rpc_credentials_s  ÿzRPCMap.set_rpc_credentialscCs8t|jtƒr|r|j |¡|r|j |¡dSdSdSr9)Ú isinstancer+rÚ setRemoteHostÚ set_dport)r.ÚsmbhostÚsmbportrrr7Ú set_smb_infols  üzRPCMap.set_smb_infocCs|j |j¡|j ¡dSr9)r-Úset_auth_levelr"Úconnectr:rrr7rPsszRPCMap.connectcCs|j ¡dSr9)r-Ú disconnectr:rrr7rQwszRPCMap.disconnectc s:z<|j tj¡t |j¡‰|jr| ¡WdSt‡fdd„tˆddƒDƒƒ}|  d¡t |ƒD]}|  |¡q2WdSt yœ}zTt |ƒ d¡dks_t |ƒ d¡dks_t |ƒ d ¡dkrnt d ¡t d ¡| ¡nt |ƒ d ¡r‰|jd kr‰t d¡t d ¡| ¡n‚WYd}~dSWYd}~dSd}~ww)Nc3s.|]}t ˆdd|d ¡¡VqdS)Ú if_id_vectorÚif_idÚDataN)rÚbin_to_uuidtupÚgetData)Ú.0Úindex©Úifidsrr7Ú ˆs €ÿ ÿzRPCMap.do..rRÚcount)z$AFA8BD80-7D8A-11C9-BEF4-08002B102989z1.0Ú nca_s_unk_ifrÚreason_not_specifiedÚabstract_syntax_not_supportedz#Target MGMT interface not availablez3Bruteforcing UUIDs. The result may not be complete.Úrpc_s_access_deniedFzKTarget MGMT interface requires authentication, but no credentials provided.)r-ÚbindrÚMSRPC_UUID_MGMTÚ hinq_if_idsr#Úbruteforce_uuidsÚsetÚrangeÚaddÚsortedÚhandle_discovered_tuprÚstrÚfindÚloggingÚinfor))r.ÚuuidtupsÚtupÚerrYr7Údozs:  þ   ÿ      ú€óz RPCMap.doc CsPg}t|jdƒD]F}t |d|f¡}|j ¡z|j |¡Wn(tyI}zt|ƒ  d¡dkr8|  d¡n|  t|ƒ¡WYd}~q d}~ww|  d¡q t |ƒdkr•|d|dkr•|d}|rv|d|krv|  ¡|rv|d|ksjt |ƒD] \}}td ||fƒqztd t |ƒ|j|fƒdSt |ƒD] \}}td ||fƒq™dS) Néz%d.0r_rz5abstract_syntax_not_supported (version not supported)ÚsuccesséÿÿÿÿéþÿÿÿzVersions %d: %szVersions %d-%d: %s)rfr(rÚuuidtup_to_binr-rPrarrjrkÚappendÚlenÚpopÚ enumerateÚprint)r.Úinterface_uuidÚresultsÚiÚbinuuidrpÚsuffixÚresultrrr7Úbruteforce_versions£s0  €ü ÿÿzRPCMap.bruteforce_versionsc CsVg}t|jdƒD]I}|j ¡|j |¡|j |d¡z|j ¡Wn(tyL}zt|ƒ  d¡dkr;|  d¡n|  t|ƒ¡WYd}~q d}~ww|  d¡q t |ƒdkr˜|d|dkr˜|d}|ry|d|kry|  ¡|ry|d|ksmt |ƒD] \}}td ||fƒq}td t |ƒ|j|fƒdSt |ƒD] \}}td ||fƒqœdS) NrróÚnca_s_op_rng_errorrz$nca_s_op_rng_error (opnum not found)rsrtruz Opnum %d: %szOpnums %d-%d: %s)rfr&r-rPraÚcallÚrecvrrjrkrwrxryrzr{)r.rr}r~rpr€rrrr7Úbruteforce_opnumsÂs2   €ü ÿÿzRPCMap.bruteforce_opnumsc CsÖt|jƒD]Z}|j ¡t |¡}z|j |¡Wn@tjyY}z3t |ƒ  d¡dkr1WYd}~qt |ƒ  d¡dkr@WYd}~qt |ƒ  d¡dkrOWYd}~qWYd}~nd}~ww|  |¡qt   dt|jƒ¡dS)Nr_rÚnca_s_proto_errorr^zTested %d UUID(s))rhr$r-rPrrvrar rrjrkrirlrmrx)r.rorrprrr7rdâs"      ÿ€ø zRPCMap.bruteforce_uuidsc Cs|dtjvrtdtj|dƒntdƒt |¡dd…tvr2tdtt |¡dd…ƒntdƒtd|d|dfƒ|jrL| |d¡|jr{z |  t |¡¡Wn!t yz}zt |ƒ  d ¡dkrotd ƒn‚WYd}~nd}~wwtƒdS) Nrz Protocol: %sz Procotol: N/Aéz Provider: %sz Provider: N/Az UUID: %s v%srrr_zListening: False) r ÚKNOWN_PROTOCOLSr{rrvr r'r‚r%r‡rrjrk)r.rorprrr7riùs(   þ€þ zRPCMap.handle_discovered_tup)rrFrFrFr)rN)NN)Ú__name__Ú __module__Ú __qualname__r8r;rGrHrNrPrQrqr‚r‡rdrirrrr7r8s ÿ  ) rÚ__main__c@seZdZdd„ZdS)ÚSmartFormattercCs*| d¡r |dd… ¡Stj |||¡S)NzR|é)Ú startswithÚ splitlinesÚargparseÚ HelpFormatterÚ _split_lines)r.ÚtextÚwidthrrr7r•s zSmartFormatter._split_linesN)r‹rŒrr•rrrr7rs rTz#Lookups listening MSRPC interfaces.)Úadd_helpÚformatter_classÚ descriptionr/aR|String binding to connect to MSRPC interface, for example: ncacn_ip_tcp:192.168.0.1[135] ncacn_np:192.168.0.1[\pipe\spoolss] ncacn_http:192.168.0.1[593] ncacn_http:[6001,RpcProxy=exchange.contoso.com:443] ncacn_http:localhost[3388,RpcProxy=rds.contoso:443])Úhelpz -brute-uuidsÚ store_truez4Bruteforce UUIDs even if MGMT interface is available)Úactionr›z -brute-opnumsz!Bruteforce opnums for found UUIDsz-brute-versionsz(Bruteforce major versions of found UUIDsz -opnum-maxÚstorerz)Bruteforce opnums from 0 to N, default 64)rÚtypeÚdefaultr›z -version-maxz+Bruteforce versions from 0 to N, default 64z -auth-levelrzJMS-RPCE auth level, from 1 to 6, default 6 (RPC_C_AUTHN_LEVEL_PKT_PRIVACY)z-uuidzTest only this UUIDz-debugzTurn DEBUG output ONz-tsz&Adds timestamp to every logging outputzncacn-np-detailsz -target-ipz ip addressz£IP Address of the target machine. If omitted it will use whatever was specified as target. This is useful when target is the NetBIOS name and you cannot resolve it)rÚmetavarr›z-portÚ139Ú445ú?zdestination portz)Destination port to connect to SMB Server)ÚchoicesÚnargsr r¡r›Úauthenticationz -auth-rpcrz[domain/]username[:password])rr r›z-auth-transportz -hashes-rpcz LMHASH:NTHASHz$NTLM hashes, format is LMHASH:NTHASHz-hashes-transportz-no-passzdon't ask for passwordsrrz!Password for MSRPC communication:)Ú getpass_msgz)Password for RPC transport (SMB or HTTP):z-Specify only -brute-opnums or -brute-versionszProtocol failed: %sz„This usually means the target is a MS Exchange Server, and connections to this rpc port on this host are not allowed (try port 6001)zrThis usually means the target is a MS Exchange Server, and connections to the specified RPC server are not allowedzSThis usually means the target has no ACL to connect to this endpoint using RpcProxyz]RPC proxy basic authentication might require you to specify the domain. Your domain is empty!zBA proxy in front of the target server detected (may be WAF / SIEM)r`zBThis usually means the credentials on the MSRPC level are invalid!)`Ú __future__rrÚreÚsysrlr“Ú impacket.httprÚimpacket.examplesrrÚimpacket.examples.utilsrÚimpacketrr Úimpacket.dcerpc.v5.epmr Úimpacket.dcerpc.v5r r r Úimpacket.dcerpc.v5.rpcrtrÚimpacket.dcerpc.v5.transportrrrÚimpacket.dcerpc.v5.rpchrrrrrrrr‹r{ÚBANNERr”rÚArgumentParserÚparserÚ add_argumentÚintÚadd_argument_groupÚgrouprxÚargvÚ print_helpÚexitÚ parse_argsÚoptionsÚinitÚtsÚdebugÚauth_rpcÚ hashes_rpcÚno_passÚ rpcdomainÚrpcuserÚrpcpassÚ_Úauth_transportÚhashes_transportÚtransportdomainÚ transportuserÚ transportpassÚ brute_opnumsÚbrute_versionsÚerrorÚstring_to_uuidtupr2Ú brute_uuidsÚ uuid_databaser/Ú auth_levelÚ opnum_maxÚ version_maxÚlookuperrHrGrNÚ target_ipÚportrPrqrQrrpÚ error_textÚcriticalr;Ú get_auth_typermrrrr7Ús²        \  ÿ  ""   ÿ             ÿ€â¶