o jD@sddlZddlZddlZddlmZddlZddlZddlmZm Z ddl m Z ddl m Z ddlmZddlmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZm Z m!Z!m"Z"m#Z#ddl$m%Z%m&Z&m'Z'm(Z(m)Z)dd l*m+Z+m,Z,m-Z-m.Z.zddl/Z/dd l/m0Z0m1Z1Wn e2d gd Z3d Z4dZ5de4e5fZ6dZ7de6e7fZ8dZ9de6Z:e;dZe;de8e9e:fej=Z?e;de9e:fej=Z@dZAdZBdZCdZDGdddZEGdddeFZGGdd d eHZIGd!d"d"eHZJGd#d$d$eJZKdS)%N) unhexlify)encoderdecoder)SubstrateUnderrunError)noValue)LOG)FilterControlSimplePagedResultsControl ResultCodeScope DerefAliases OperationKNOWN_CONTROLSCONTROL_PAGEDRESULTSNOTIFICATION_DISCONNECTKNOWN_NOTIFICATIONS BindRequest SearchRequestSearchResultDone LDAPMessage AddRequest ModifyRequestModifyDNRequest DelRequest)getNTLMSSPType1getNTLMSSPType3VERSIONhmac_md5NTLMAuthChallenge)SPNEGO_NegTokenInitSPNEGO_NegTokenResp SPNEGOCipher TypesMech)SSLcryptoz*pyOpenSSL is not installed, can't continue)LDAPConnectionLDAPFilterSyntaxErrorLDAPFilterInvalidExceptionLDAPSessionErrorLDAPSearchErrorr r r r r rrrrrz(?:[a-z][a-z0-9\-]*)z)(?:(?:\d|[1-9]\d+)(?:\.(?:\d|[1-9]\d+))*)z (?:%s|%s)z(?:(?:;[a-z0-9\-]+)*)z(%s%s)z(:dn)z (?::(%s))z ([:<>~]?=)z^%s$z ^%s%s?%s?$z ^(){0}%s?%s$c@seZdZd4ddZ  d5ddZd6d d Zd d Zd dZ  d7ddZddZ d8ddZ d9ddZ d:ddZ d9ddZ ddZd9d d!Zd"d#Zd$d%Zd9d&d'Zd(d)Zd*d+Zd,d-Zed.d/Zed0d1Zed2d3ZdS);r&NTc Csvd|_d|_d|_d|_||_||_||_|dr(d|_d|_|dd|_n3|dr>d|_d |_d|_|d d|_n|d rTd |_d|_d|_|d d|_ntd|dd|_ d|_ d|_ d|_ d|_ d|_d|_|jdury|j}n|j}td||j|j|jfzt||jdtjd\}}}} } t||||_Wntjy} z td||jf| d} ~ ww|jdur|j| dSttj} | ddd} | | t| |j|_|j| |jddlm }|j!"d#}t$%|&dd}d}d}d}d|}t'|j(dddd}|}||7}||7}||7}||7}||"|_ dS)z LDAPConnection class :param string url: :param string baseDN: :param string dstIp: :return: a LDAP instance, if not raises a LDAPSessionError exception FrNzldap://izldaps://i|Tzgc://i zUnknown URL prefix: '%s' errorStringz-Connecting to %s, port %d, SSL %s, signing %szConnection error (%s:%d)zALL:@SECLEVEL=0zutf-8i)md5sha256:r.sstls-server-end-point:little byteordersigned))_SSL_dstPort_dstHost_socket_baseDN_dstIp_LDAPConnection__signing startswithr)_LDAPConnection__bindedchannel_binding_valuesequenceNumber_LDAPConnection__auth_type_LDAPConnection__gss_LDAPConnection__sessionKey#_LDAPConnection__spnego_cipher_blobrdebugsocket getaddrinfo SOCK_STREAMerrorconnectr$Context TLS_METHODset_cipher_listencode set_options Connection do_handshakehashlibr4get_peer_certificatedigestdecodebytesfromhexreplacelento_bytes)selfurlbaseDNdstIpsigning targetHostafsocktypeproto_saectx(SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATIONr4peer_cert_digest_strpeer_cert_digest_byteschannel_binding_structinitiator_addressacceptor_addressapplication_data_rawlen_application_dataapplication_datarx/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/impacket/ldap/ldap.py__init__Ns~     "      zLDAPConnection.__init__c 0Cs|dks|dkr0t|drd|}t|drd|}z t|}t|}Wn ty/Ynwddlm} ddlm} m} m}m }m }ddl m }m }m}m}ddlm}m}m}dd lm}dd lm}m}m}dd l}|d usv| d urxd } d |j}| r| |||\}}}} |||jjjd}|d ur| d ur||||||||\}} }!}"n |d}|d} |d}"| d ur|||jj jd}#||#|||| |"\}$} }!}"n | d}$| d} | d}"t!}%t"dg|%d<t#j$|$|dd}$|}&|&%|$d|}'d|'d<t&|j'j j|'d<g}(|(|(|'d<||'d|&j)|})d|)d<||)d<||)d|j*|j+|j,j-}*|*j.|)d<|)|*|)d<t/|)d<d |)dd!<|}+d"|+d#<||B|+d$<|j0rg|j1d urg|j1|+d%<|j2r{|+d$| O<|+d$|O<|+3|)dd&<d|)d'<t45|)},| 6|"d(|,d }-t/|'d)<| j7|'d)d*<|-|'d)d<t45|'|%d+<t8}.d,|.d-<d.|.d/<d0|.d1d2d3<|%3|.d1d2d4<|9|.dd5}/|/d6d7t:d8krt;d9|/d6d7<|/d6d:fd;d<|_=d=|_>|j2r|"|_?| | |_@d=S)>a6 logins into the target system explicitly using Kerberos. Hashes are used if RC4_HMAC is supported. :param string user: username :param string password: password for the user :param string domain: domain where the account is valid for (required) :param string lmhash: LMHASH used to authenticate using hashes (password is not used) :param string nthash: NTHASH used to authenticate using hashes (password is not used) :param string aesKey: aes256-cts-hmac-sha1-96 or aes128-cts-hmac-sha1-96 used for Kerberos authentication :param string kdcHost: hostname or IP Address for the KDC. If None, the domain will be used (it needs to resolve tho) :param struct TGT: If there's a TGT available, send the structure here and it will be used :param struct TGS: same for TGS. See smb3.py for the format :param bool useCache: whether or not we should use the ccache for credentials lookup. If TGT or TGS are specified this is False :return: True, raises a LDAPSessionError if error. r.r,0r)CCache)GSSAPIGSS_C_CONF_FLAGGSS_C_INTEG_FLAGGSS_C_SEQUENCE_FLAGGSS_C_REPLAY_FLAG)AP_REQ AuthenticatorTGS_REPseq_set)getKerberosTGTgetKerberosTGS CheckSumField) constants) Principal KerberosTimeTicketNFzldap/%s)typeKDC_REPcipher sessionKeyzMS KRB5 - Microsoft Kerberos 5 MechTypesasn1Specticketr1pvnozmsg-typez ap-optionszauthenticator-vnocrealmcnamecusecctimecksumi cksumtypeLgthFlagsBndchecksumz seq-number authenticatoretype MechTokenr-versionusername GSS-SPNEGOauthenticationsasl mechanism credentials protocolOp bindResponse resultCodesuccessError in bindRequest -> %s: %sdiagnosticMessager2KRB5T)Ar`r TypeErrorimpacket.krb5.ccacher|impacket.krb5.gssapir}r~rrrimpacket.krb5.asn1rrrrimpacket.krb5.kerberosv5rrr impacket.krb5rimpacket.krb5.typesrrrdatetimer? parseFilePrincipalNameType NT_PRINCIPALvalue NT_SRV_INSTr r#rr\ from_asn1intApplicationTagNumbers encodeFlagsto_asn1components_to_asn1nowtimezoneutc microsecondrr=rFrCgetDatarrUencryptenctyper sendReceiver r) prettyPrintrHrErJrI)0rbrpassworddomainlmhashnthashaesKeykdcHostTGTTGSuseCacher|r}r~rrrrrrrrrrrrrrr targetNameuserNametgtr oldSessionKeyr serverNametgsblobrapReqoptsrrchkFieldencodedAuthenticatorencryptedEncodedAuthenticator bindRequestresponserxrxry kerberosLogins                  zLDAPConnection.kerberosLoginrc Cst}d|d<|dkr8d|vr|d||d<n|r#|d||d<n||d<||dd<||d d }n|d krQ||d<d |dd <||d d }n|d kr|d ks]|d krt|drgd|}t|drqd|}z t|}t|}Wn tyYnw||d<td |} | |dd <||d d }|ddtdkrtd|dd |ddfd|dd} d} |j r|j dur|j } t | t | |||||| d\} } | |dd<||d d }n0|dkr|d ks|d kr,t|dr d|}t|drd|}z t|}t|}Wn ty+Ynwd |d<t|_d\|jd<|jd<|jd<td ||jd |jd!} t}td"g|d#<| |d$<d%|ddd&<||ddd'<||d d }|ddtd(krtd|dd |ddfd|dd)}t|}|d*} d} |j r|j dur|j } t | | |||||d+|jd | d, \} } t| | t| | }|| d-<t}| |d*<|jrt| d.| d/|_|jjd0d d d1|d2<d%|ddd&<||ddd'<||d d }ntd3|d|ddtdkr@td4|dd |ddfdd5||_d |_d S)6a) logins into the target system :param string user: username :param string password: password for the user :param string domain: domain where the account is valid for :param string lmhash: LMHASH used to authenticate using hashes (password is not used) :param string nthash: NTHASH used to authenticate using hashes (password is not used) :param string authenticationChoice: type of authentication protocol to use (default NTLM) :return: True, raises a LDAPSessionError if error. r-rsimple.@r\rrrsicilyPackageDiscoveryr.sicilyNegotiater,r{rrrzCError in bindRequest during the NTLMAuthNegotiate request -> %s: %srr2 matchedDNr7N)rFsicilyResponser) riaJProductMajorVersionProductMinorVersion ProductBuildT)signingRequired use_ntlmv2rz2NTLMSSP - Microsoft NTLM Security Support ProviderrrrrrsaslBindInProgressserverSaslCreds ResponseTokenldap)servicerrrFMICflags)rrandomSessionKeys0  +7 ) reset_cipher mechListMICz"Unknown authenticationChoice: '%s'rzNTLM-)rrr`rrrrr r)rr=rFrr]rrrCr r#r!asOctetsrrr"rKsignrHrE)rbrrrrrauthenticationChoicerr negotiatetype2rFtype3exportedSessionKeyrrspnegoTokenRespnewmicrxrxryloginBs                 $"   zLDAPConnection.logincCs|jdkr#|j|j||j\}}||}t|jdddd|}|S|jdkrD|j|\}}| |}t|jdddd|}|Sd|jd) Nrr8bigFr: NTLM-saslzEncryption not implemented for protocol) rHrI GSS_Wrap_LDAPrJrGr`rarKrr)rbdata signaturerxrxryrs   zLDAPConnection.encryptcCsl|jdkr|dd}|jj|j|ddd\}}|S|jdkr/|dd}|j|\}}|Sd|jd) Nrr8rinit) directionr zDecryption not implemented for r )rHrIGSS_Unwrap_LDAPrJrKdecrypt)rbrrkrrxrxryrs   zLDAPConnection.decryptrF(objectClass=*)c CsXt|tjstdtjt|f|dur|j}|dur td}|dur(td}|dur.g}t} || d<|| d<|| d<|| d<|| d<|| d <| || d <| d j |d } g} | s| | | }|D]B}|d  }| tr|dtdkr|| |d} qett|dd|d|df| d| dur| |qe| |qe| r]| S)NzsearchFilter must be %s, got %s wholeSubtreeneverDerefAliases baseObjectscope derefAliases sizeLimit timeLimit typesOnlyfilter attributesFrrrcontrolsz Error in searchRequest -> %s: %sr)rPr3answers) isinstancesix text_typer(rrAr r r _parseFilter setComponentsr getComponentisSameTypeWithrr _handleControlsr*rrappend)rb searchBaserrrrr searchFilterrsearchControlsperRecordCallback searchRequestdoner rmessage searchResultrxrxrysearchsP        zLDAPConnection.searchcCsd}|durK|D]B}|durJ|D]9}t|dtkrHt|dtkrGt|ddur8tjt|ttdd}|r>d}| |nq qq|S)NT controlType getCookierrF) strrhasattrrr\rrUrr4 setCookie)rbrequestControlsresponseControlsr/requestControlresponseControlrxrxryr(s*  zLDAPConnection._handleControlsc Cst}||d<d|ddd<|dddj|d}|D]:\}}||d|d<t|trB|d|djdd |Dn|d|dt|trSt|n||d7}q |||dd } | d d td krt t| d d d| d d  d| d dddS)a Add an entry to the LDAP directory. :param dn: Distinguished Name of the entry to add :param objectClass: Tuple or list of object classes for the entry :param attributes: Dictionary of attributes for the entry :param controls: LDAP controls to include in the request :return: True if the entry was added successfully, else raises LDAPSessionError entry objectClassrrrvalsr+css&|]}t|tr t|n|VqdSNr!rr5.0valrxrxry =s$z%LDAPConnection.add..r addResponserrzError in addRequest -> : rrPr3T) rr%itemsr!listrr5rr r)r) rbdnr=rr addRequestindexkeyrrrxrxryadd*s$  "( "zLDAPConnection.addc Cs`t}||d<d}|D]p\}}|D]i}|dttttfvr-td|dd|dd|d|d|d<||d|d d <g} t|d trW| d d |d Dn| t|d t rft |d n|d |d|d dj | |d 7}qq |||dd} | ddtdkrtt | ddd| ddd| ddddS)a Modify an entry in the LDAP directory. RFC 4511 Section 4.6 :param dn: Distinguished Name of the entry to modify :param modifications: Dictionary of modifications of form {attribute: [(operation, values), ...]}. Operation: 0 - add, 1 - delete, 2 - replace, 3 - increment. Values: single value or list of values. :param controls: LDAP controls to include in the request :return: True if the entry was modified successfully, else raises LDAPSessionError objectrz Invalid modification operation 'z' for attribute ''r2changes operation modificationrr+cSs"g|] }t|tr t|n|qSrxr@rArxrxry fs"z)LDAPConnection.modify..r>rmodifyResponserrzError in modifyRequest -> rFrrGT)rrH MODIFY_ADD MODIFY_DELETEMODIFY_REPLACEMODIFY_INCREMENTr)r!rIextendr)rr5r%rr r) rbrJ modificationsr modifyRequestidxattropsopr>rrxrxrymodifyJs. ( "zLDAPConnection.modifycCst}||d<||d<||d<|dur||d<|||dd}|dd td krGtt|dd d |dd d |dd ddS)a, Modify the Distinguished Name of an entry in the LDAP directory. RFC 4511 Section 4.9 :param dn: Current Distinguished Name of the entry :param newrdn: New Relative Distinguished Name for the entry :param deleteoldrdn: Whether to delete the old RDN from the entry :param newSuperior: New superior DN if moving the entry to a different container :param controls: LDAP controls to include in the request :return: True if the DN was modified successfully, else raises LDAPSessionError r<newrdn deleteoldrdnN newSuperiorrr modDNResponserrzError in modifyDNRequest -> rFrrGT)rrr r)rr)rbrJrbrcrdrmodifyDNRequestrrxrxry modify_dnts "zLDAPConnection.modify_dncCslt|}|||dd}|ddtdkr4tt|ddd|ddd|ddd d S) a0 Delete an entry from the LDAP directory. RFC 4511 Section 4.8 :param dn: Distinguished Name of the entry to delete :param controls: LDAP controls to include in the request :return: True if the entry was deleted successfully, else raises LDAPSessionError rr delResponserrzError in deleteRequest -> rFrrGT)rrr r)rr)rbrJr deleteRequestrrxrxrydeletes "zLDAPConnection.deletecCs|jdur |jdSdSr?)r@closerbrxrxryrks zLDAPConnection.closecCszt}tdd|d<|d|||dur |dj|t|}|jr7|j r7| |}|j d7_ |j |S)Nr+i messageIDrr)rrandom randrangesetComponentByType getTagSetr%rrUrErCrrGr@sendall)rbrequestrr0rrxrxrysends    zLDAPConnection.sendcCsd}d}d}|s|j|}t||krd}||7}|r|jr[|jr[td|ddd}|t|dkrVd}|sN|j|}t||krHd}||7}|r:|t|dks6||}|S)Ni r7FTz!Ir8r)r@recvr`rErCstructunpackr)rb REQUEST_SIZErr/recvDatamessage_lengthrxrxryrecv_raws,      zLDAPConnection.recv_rawcCsg}|}t|dkrxz tj|td\}}Wnty'||}YnIw|ddkrk|dddp9|d}t|d|}|tkrJ| t t |dddd ||ddd |ddd fd | ||}t|dks |S) Nrrrmr extendedResp responseNamezUnsolicited Notification '%s'rz %s -> %s: %srrG)r{r`rr\rrrgetrrkr)rrr))rbrrr0 remainingr notificationrxrxryrus0     zLDAPConnection.recvcCs||||Sr?)rtru)rbrsrrxrxryrs zLDAPConnection.sendReceivecCs.tt|}||}|rtd|d|S)Nunexpected token: '%s')rIreversed_consumeCompositeFilterr')rb filterStr filterListr+rxrxryr$s  zLDAPConnection._parseFiltercCsz|}Wn tytdw|dkr!||td|z|}Wn ty2tdw|dvrC|||g||Sg} z |||Wn tyYYnwqFz|}Wn tyltdw|dkr|||td||||S)NEOL while parsing search filter(r)!&|T))pop IndexErrorr'r)rZ_consumeSimpleFilterr_compileCompositeFilter)rbrcoperatorfiltersrxrxryrsB             z&LDAPConnection._consumeCompositeFiltercCsz|}Wn tytdw|dkr!||td|g} z|}Wn ty5tdw|dkr;n|dkrH||td||q$d|}z t|d\}}}Wn tyktd |w| |||S) NrrrTrzunexpected token: '('r.r+zinvalid filter: '(%s)') rrr'r)join RE_OPERATORsplit ValueErrorr(_compileSimpleFilter)rbrrrr attributerrrxrxryrs:           z#LDAPConnection._consumeSimpleFiltercCst}|dkrt|dkrtd|dj||S|dkr1t|dkr(td|dj||S|d krFt|dkr?td |d j||S) Nrr+z*'not' filter must have exactly one elementnotrrz+'and' filter must have at least one elementandrz*'or' filter must have at least one elementor)rr`r(r%)rrr+rxrxryr5s     z&LDAPConnection._compileCompositeFilterc Cst}|dkrEt|pt|}|std||\}}}|r(||dd<|r2t||dd<|r:||dd<t||dd<|St |sPtd||dkr^|d kr^||d <|Sd|vr|d krd d | dD}|d d  }g} |dr| | d|d|ddD] } | | d| q|dr| | d|d||d d<|d d j| |Sd|vrt|}|d kr|d|||S|dkr|d|||S|dkr|d|||S|dkr|d|||Std|||f)Nz:=zinvalid filter attribute: '%s'extensibleMatchr dnAttributes matchingRule matchValue*=presentcSsg|]}t|qSrx)r&_processLdapString)rB assertionrxrxryrT\sz7LDAPConnection._compileSimpleFilter.. substringsrinitialr+ranyfinal equalityMatchz~= approxMatchz>=greaterOrEqualz<= lessOrEqualzinvalid filter '(%s%s%s)')rRE_EX_ATTRIBUTE_1matchRE_EX_ATTRIBUTE_2r(groupsboolr&r RE_ATTRIBUTErgetComponentTyper)clonesetComponentByNamer%) rrrr+rrJr assertionschoicerrrxrxryrGs^        z#LDAPConnection._compileSimpleFiltercCs dd}td}t|||S)NcSstt|ddS)Nr+r)chrrgroup)rrxrxryreplace_escaped_charsysz@LDAPConnection._processLdapString..replace_escaped_charsz\\([0-9a-fA-F]{2}))recompilesub)clsldapstrr escaped_charsrxrxryrws z!LDAPConnection._processLdapString)r.NT)r.r.r.r.NNNT)r.r.r.r.r.r) NNNrrFrNNN)NNr?)TNN)__name__ __module__ __qualname__rzrr rrr2r(rNrargrjrkrtr{rurr$rr staticmethodrr classmethodrrxrxrxryr&Ms@ ^      2  *   "  /r&c@ eZdZdS)r'Nrrrrxrxrxryr'r'c@r)r(Nrrxrxrxryr(rr(c@s:eZdZdZdddZddZdd Zd d Zd d ZdS)r)z9 This is the exception every client should catch rr.cCs t|||_||_||_dSr?) ExceptionrzrPpacketr3)rbrPrr3rxrxryrzs  zLDAPSessionError.__init__cC|jSr?)rPrlrxrxry getErrorCodezLDAPSessionError.getErrorCodecCrr?)rrlrxrxrygetErrorPacketrzLDAPSessionError.getErrorPacketcCrr?r2rlrxrxrygetErrorStringrzLDAPSessionError.getErrorStringcCrr?r2rlrxrxry__str__rzLDAPSessionError.__str__N)rrr.) rrr__doc__rzrrrrrxrxrxryr)s  r)c@seZdZdddZddZdS) r*rr.NcCs&t|||||durg}||_dSr?)r)rzr )rbrPrr3r rxrxryrzs zLDAPSearchError.__init__cCrr?)r rlrxrxry getAnswersrzLDAPSearchError.getAnswers)rrr.N)rrrrzrrxrxrxryr*s  r*)LrrvrMbinasciirrnr"pyasn1.codec.berrr pyasn1.errorrpyasn1.type.univrimpacketrimpacket.ldap.ldapasn1rr r r r r rrrrrrrrrrrrr impacket.ntlmrrrrrimpacket.spnegor r!r"r#OpenSSLr$r%critical__all__ DESCRIPTION NUMERIC_OIDOIDOPTIONS ATTRIBUTEDN MATCHING_RULErrIrrrrVrWrXrYr& SyntaxErrorr'rr(r)r*rxrxrxrys\    T    9