<s> import sys <EOL> import os <EOL> import cmd <EOL> import argparse <EOL> import time <EOL> import logging <EOL> import string <EOL> import ntpath <EOL> from impacket . examples import logger <EOL> from impacket import version <EOL> from impacket . smbconnection import SMBConnection , SMB_DIALECT , SMB2_DIALECT_002 , SMB2_DIALECT_21 <EOL> from impacket . dcerpc . v5 . dcomrt import DCOMConnection <EOL> from impacket . dcerpc . v5 . dcom import wmi <EOL> from impacket . dcerpc . v5 . dtypes import NULL <EOL> OUTPUT_FILENAME = '<STR_LIT>' + str ( time . time ( ) ) <EOL> class WMIEXEC : <EOL> def __init__ ( self , command = '<STR_LIT>' , username = '<STR_LIT>' , password = '<STR_LIT>' , domain = '<STR_LIT>' , hashes = None , aesKey = None , share = None , noOutput = False , doKerberos = False ) : <EOL> self . __command = command <EOL> self . __username = username <EOL> self . __password = password <EOL> self . __domain = domain <EOL> self . __lmhash = '<STR_LIT>' <EOL> self . __nthash = '<STR_LIT>' <EOL> self . __aesKey = aesKey <EOL> self . __share = share <EOL> self . __noOutput = noOutput <EOL> self . __doKerberos = doKerberos <EOL> self . shell = None <EOL> if hashes is not None : <EOL> self . __lmhash , self . __nthash = hashes . split ( '<STR_LIT::>' ) <EOL> def run ( self , addr ) : <EOL> if self . __noOutput is False : <EOL> smbConnection = SMBConnection ( addr , addr ) <EOL> if self . __doKerberos is False : <EOL> smbConnection . login ( self . __username , self . __password , self . __domain , self . __lmhash , self . __nthash ) <EOL> else : <EOL> smbConnection . kerberosLogin ( self . __username , self . __password , self . __domain , self . __lmhash , self . __nthash , self . __aesKey ) <EOL> dialect = smbConnection . getDialect ( ) <EOL> if dialect == SMB_DIALECT : <EOL> logging . info ( "<STR_LIT>" ) <EOL> elif dialect == SMB2_DIALECT_002 : <EOL> logging . info ( "<STR_LIT>" ) <EOL> elif dialect == SMB2_DIALECT_21 : <EOL> logging . info ( "<STR_LIT>" ) <EOL> else : <EOL> logging . info ( "<STR_LIT>" ) <EOL> else : <EOL> smbConnection = None <EOL> dcom = DCOMConnection ( addr , self . __username , self . __password , self . __domain , self . __lmhash , self . __nthash , self . __aesKey , oxidResolver = True , doKerberos = self . __doKerberos ) <EOL> iInterface = dcom . CoCreateInstanceEx ( wmi . CLSID_WbemLevel1Login , wmi . IID_IWbemLevel1Login ) <EOL> iWbemLevel1Login = wmi . IWbemLevel1Login ( iInterface ) <EOL> iWbemServices = iWbemLevel1Login . NTLMLogin ( '<STR_LIT>' , NULL , NULL ) <EOL> iWbemLevel1Login . RemRelease ( ) <EOL> win32Process , _ = iWbemServices . GetObject ( '<STR_LIT>' ) <EOL> try : <EOL> self . shell = RemoteShell ( self . __share , win32Process , smbConnection ) <EOL> if self . __command != '<STR_LIT:U+0020>' : <EOL> self . shell . onecmd ( self . __command ) <EOL> else : <EOL> self . shell . cmdloop ( ) <EOL> except ( Exception , KeyboardInterrupt ) , e : <EOL> logging . error ( str ( e ) ) <EOL> if smbConnection is not None : <EOL> smbConnection . logoff ( ) <EOL> dcom . disconnect ( ) <EOL> sys . stdout . flush ( ) <EOL> sys . exit ( <NUM_LIT:1> ) <EOL> if smbConnection is not None : <EOL> smbConnection . logoff ( ) <EOL> dcom . disconnect ( ) <EOL> class RemoteShell ( cmd . Cmd ) : <EOL> def __init__ ( self , share , win32Process , smbConnection ) : <EOL> cmd . Cmd . __init__ ( self ) <EOL> self . __share = share <EOL> self . __output = '<STR_LIT:\\>' + OUTPUT_FILENAME <EOL> self . __outputBuffer = '<STR_LIT>' <EOL> self . __shell = '<STR_LIT>' <EOL> self . __win32Process = win32Process <EOL> self . __transferClient = smbConnection <EOL> self . __pwd = '<STR_LIT>' <EOL> self . __noOutput = False <EOL> self . intro = '<STR_LIT>' <EOL> if self . __transferClient is not None : <EOL> self . __transferClient . setTimeout ( <NUM_LIT> ) <EOL> self . do_cd ( '<STR_LIT:\\>' ) <EOL> else : <EOL> self . __noOutput = True <EOL> def do_shell ( self , s ) : <EOL> os . system ( s ) <EOL> def do_help ( self , line ) : <EOL> print """<STR_LIT>""" <EOL> def do_lcd ( self , s ) : <EOL> if s == '<STR_LIT>' : <EOL> print os . getcwd ( ) <EOL> else : <EOL> try : <EOL> os . chdir ( s ) <EOL> except Exception , e : <EOL> logging . error ( str ( e ) ) <EOL> def do_get ( self , src_path ) : <EOL> try : <EOL> import ntpath <EOL> newPath = ntpath . normpath ( ntpath . join ( self . __pwd , src_path ) ) <EOL> drive , tail = ntpath . splitdrive ( newPath ) <EOL> filename = ntpath . basename ( tail ) <EOL> fh = open ( filename , '<STR_LIT:wb>' ) <EOL> logging . info ( "<STR_LIT>" % ( drive , tail ) ) <EOL> self . __transferClient . getFile ( drive [ : - <NUM_LIT:1> ] + '<STR_LIT:$>' , tail , fh . write ) <EOL> fh . close ( ) <EOL> except Exception , e : <EOL> logging . error ( str ( e ) ) <EOL> os . remove ( filename ) <EOL> pass <EOL> def do_put ( self , s ) : <EOL> try : <EOL> params = s . split ( '<STR_LIT:U+0020>' ) <EOL> if len ( params ) > <NUM_LIT:1> : <EOL> src_path = params [ <NUM_LIT:0> ] <EOL> dst_path = params [ <NUM_LIT:1> ] <EOL> elif len ( params ) == <NUM_LIT:1> : <EOL> src_path = params [ <NUM_LIT:0> ] <EOL> dst_path = '<STR_LIT>' <EOL> src_file = os . path . basename ( src_path ) <EOL> fh = open ( src_path , '<STR_LIT:rb>' ) <EOL> dst_path = string . replace ( dst_path , '<STR_LIT:/>' , '<STR_LIT:\\>' ) <EOL> import ntpath <EOL> pathname = ntpath . join ( ntpath . join ( self . __pwd , dst_path ) , src_file ) <EOL> drive , tail = ntpath . splitdrive ( pathname ) <EOL> logging . info ( "<STR_LIT>" % ( src_file , pathname ) ) <EOL> self . __transferClient . putFile ( drive [ : - <NUM_LIT:1> ] + '<STR_LIT:$>' , tail , fh . read ) <EOL> fh . close ( ) <EOL> except Exception , e : <EOL> logging . critical ( str ( e ) ) <EOL> pass <EOL> def do_exit ( self , s ) : <EOL> return True <EOL> def emptyline ( self ) : <EOL> return False <EOL> def do_cd ( self , s ) : <EOL> self . execute_remote ( '<STR_LIT>' + s ) <EOL> if len ( self . __outputBuffer . strip ( '<STR_LIT:\r\n>' ) ) > <NUM_LIT:0> : <EOL> print self . __outputBuffer <EOL> self . __outputBuffer = '<STR_LIT>' <EOL> else : <EOL> self . __pwd = ntpath . normpath ( ntpath . join ( self . __pwd , s ) ) <EOL> self . execute_remote ( '<STR_LIT>' ) <EOL> self . __pwd = self . __outputBuffer . strip ( '<STR_LIT:\r\n>' ) <EOL> self . prompt = self . __pwd + '<STR_LIT:>>' <EOL> self . __outputBuffer = '<STR_LIT>' <EOL> def default ( self , line ) : <EOL> if len ( line ) == <NUM_LIT:2> and line [ <NUM_LIT:1> ] == '<STR_LIT::>' : <EOL> self . execute_remote ( line ) <EOL> if len ( self . __outputBuffer . strip ( '<STR_LIT:\r\n>' ) ) > <NUM_LIT:0> : <EOL> print self . __outputBuffer <EOL> self . __outputBuffer = '<STR_LIT>' <EOL> else : <EOL> self . __pwd = line <EOL> self . execute_remote ( '<STR_LIT>' ) <EOL> self . __pwd = self . __outputBuffer . strip ( '<STR_LIT:\r\n>' ) <EOL> self . prompt = self . __pwd + '<STR_LIT:>>' <EOL> self . __outputBuffer = '<STR_LIT>' <EOL> else : <EOL> if line != '<STR_LIT>' : <EOL> self . send_data ( line ) <EOL> def get_output ( self ) : <EOL> def output_callback ( data ) : <EOL> self . __outputBuffer += data <EOL> if self . __noOutput is True : <EOL> self . __outputBuffer = '<STR_LIT>' <EOL> return <EOL> while True : <EOL> try : <EOL> self . __transferClient . getFile ( self . __share , self . __output , output_callback ) <EOL> break <EOL> except Exception , e : <EOL> if str ( e ) . find ( '<STR_LIT>' ) >= <NUM_LIT:0> : <EOL> time . sleep ( <NUM_LIT:1> ) <EOL> pass <EOL> else : <EOL> pass <EOL> self . __transferClient . deleteFile ( self . __share , self . __output ) <EOL> def execute_remote ( self , data ) : <EOL> command = self . __shell + data <EOL> if self . __noOutput is False : <EOL> command += '<STR_LIT>' + '<STR_LIT>' % self . __share + self . __output + '<STR_LIT>' <EOL> self . __win32Process . Create ( command , self . __pwd , None ) <EOL> self . get_output ( ) <EOL> def send_data ( self , data ) : <EOL> self . execute_remote ( data ) <EOL> print self . __outputBuffer <EOL> self . __outputBuffer = '<STR_LIT>' <EOL> if __name__ == '<STR_LIT:__main__>' : <EOL> logger . init ( ) <EOL> print version . BANNER <EOL> parser = argparse . ArgumentParser ( add_help = True , description = "<STR_LIT>" ) <EOL> parser . add_argument ( '<STR_LIT:target>' , action = '<STR_LIT:store>' , help = '<STR_LIT>' ) <EOL> parser . add_argument ( '<STR_LIT>' , action = '<STR_LIT:store>' , default = '<STR_LIT>' , help = '<STR_LIT>' ) <EOL> parser . add_argument ( '<STR_LIT>' , action = '<STR_LIT:store_true>' , default = False , help = '<STR_LIT>' ) <EOL> parser . add_argument ( '<STR_LIT>' , action = '<STR_LIT:store_true>' , help = '<STR_LIT>' ) <EOL> parser . add_argument ( '<STR_LIT>' , nargs = '<STR_LIT:*>' , default = '<STR_LIT:U+0020>' , help = '<STR_LIT>' ) <EOL> group = parser . add_argument_group ( '<STR_LIT>' ) <EOL> group . add_argument ( '<STR_LIT>' , action = "<STR_LIT:store>" , metavar = "<STR_LIT>" , help = '<STR_LIT>' ) <EOL> group . add_argument ( '<STR_LIT>' , action = "<STR_LIT:store_true>" , help = '<STR_LIT>' ) <EOL> group . add_argument ( '<STR_LIT>' , action = "<STR_LIT:store_true>" , help = '<STR_LIT>' ) <EOL> group . add_argument ( '<STR_LIT>' , action = "<STR_LIT:store>" , metavar = "<STR_LIT>" , help = '<STR_LIT>' ) <EOL> if len ( sys . argv ) == <NUM_LIT:1> : <EOL> parser . print_help ( ) <EOL> sys . exit ( <NUM_LIT:1> ) <EOL> options = parser . parse_args ( ) <EOL> if '<STR_LIT:U+0020>' . join ( options . command ) == '<STR_LIT:U+0020>' and options . nooutput is True : <EOL> logging . error ( "<STR_LIT>" ) <EOL> sys . exit ( <NUM_LIT:1> ) <EOL> if options . debug is True : <EOL> logging . getLogger ( ) . setLevel ( logging . DEBUG ) <EOL> else : <EOL> logging . getLogger ( ) . setLevel ( logging . INFO ) <EOL> import re <EOL> domain , username , password , address = re . compile ( '<STR_LIT>' ) . match ( options . target ) . groups ( '<STR_LIT>' ) <EOL> if '<STR_LIT:@>' in address : <EOL> password = password + '<STR_LIT:@>' + address . rpartition ( '<STR_LIT:@>' ) [ <NUM_LIT:0> ] <EOL> address = address . rpartition ( '<STR_LIT:@>' ) [ <NUM_LIT:2> ] <EOL> try : <EOL> if domain is None : <EOL> domain = '<STR_LIT>' <EOL> if password == '<STR_LIT>' and username != '<STR_LIT>' and options . hashes is None and options . no_pass is False and options . aesKey is None : <EOL> from getpass import getpass <EOL> password = getpass ( "<STR_LIT>" ) <EOL> if options . aesKey is not None : <EOL> options . k = True <EOL> executer = WMIEXEC ( '<STR_LIT:U+0020>' . join ( options . command ) , username , password , domain , options . hashes , options . aesKey , options . share , options . nooutput , options . k ) <EOL> executer . run ( address ) <EOL> except ( Exception , KeyboardInterrupt ) , e : <EOL> logging . error ( str ( e ) ) <EOL> sys . exit ( <NUM_LIT:0> ) </s>
