<s> import sys <EOL> import logging <EOL> import argparse <EOL> import codecs <EOL> from impacket . examples import logger <EOL> from impacket import version <EOL> from impacket . nt_errors import STATUS_MORE_ENTRIES <EOL> from impacket . dcerpc . v5 import transport , samr <EOL> from impacket . dcerpc . v5 . rpcrt import DCERPCException <EOL> class ListUsersException ( Exception ) : <EOL> pass <EOL> class SAMRDump : <EOL> KNOWN_PROTOCOLS = { <EOL> '<STR_LIT>' : ( r'<STR_LIT>' , <NUM_LIT> ) , <EOL> '<STR_LIT>' : ( r'<STR_LIT>' , <NUM_LIT> ) , <EOL> } <EOL> def __init__ ( self , protocols = None , <EOL> username = '<STR_LIT>' , password = '<STR_LIT>' , domain = '<STR_LIT>' , hashes = None , aesKey = None , doKerberos = False ) : <EOL> if not protocols : <EOL> self . __protocols = SAMRDump . KNOWN_PROTOCOLS . keys ( ) <EOL> else : <EOL> self . __protocols = [ protocols ] <EOL> self . __username = username <EOL> self . __password = password <EOL> self . __domain = domain <EOL> self . __lmhash = '<STR_LIT>' <EOL> self . __nthash = '<STR_LIT>' <EOL> self . __aesKey = aesKey <EOL> self . __doKerberos = doKerberos <EOL> if hashes is not None : <EOL> self . __lmhash , self . __nthash = hashes . split ( '<STR_LIT::>' ) <EOL> def dump ( self , addr ) : <EOL> """<STR_LIT>""" <EOL> logging . info ( '<STR_LIT>' % addr ) <EOL> entries = [ ] <EOL> for protocol in self . __protocols : <EOL> protodef = SAMRDump . KNOWN_PROTOCOLS [ protocol ] <EOL> port = protodef [ <NUM_LIT:1> ] <EOL> logging . info ( "<STR_LIT>" % protocol ) <EOL> rpctransport = transport . SMBTransport ( addr , port , r'<STR_LIT>' , self . __username , self . __password , self . __domain , self . __lmhash , self . __nthash , self . __aesKey , doKerberos = self . __doKerberos ) <EOL> try : <EOL> entries = self . __fetchList ( rpctransport ) <EOL> except Exception , e : <EOL> logging . critical ( str ( e ) ) <EOL> else : <EOL> break <EOL> for entry in entries : <EOL> ( username , uid , user ) = entry <EOL> base = "<STR_LIT>" % ( username , uid ) <EOL> print base + '<STR_LIT>' , user [ '<STR_LIT>' ] <EOL> print base + '<STR_LIT>' , user [ '<STR_LIT>' ] <EOL> print base + '<STR_LIT>' , user [ '<STR_LIT>' ] <EOL> print base + '<STR_LIT>' , user [ '<STR_LIT>' ] <EOL> print base + '<STR_LIT>' , user [ '<STR_LIT>' ] <EOL> if entries : <EOL> num = len ( entries ) <EOL> if <NUM_LIT:1> == num : <EOL> logging . info ( '<STR_LIT>' ) <EOL> else : <EOL> logging . info ( '<STR_LIT>' % num ) <EOL> else : <EOL> logging . info ( '<STR_LIT>' ) <EOL> def __fetchList ( self , rpctransport ) : <EOL> dce = rpctransport . get_dce_rpc ( ) <EOL> entries = [ ] <EOL> dce . connect ( ) <EOL> dce . bind ( samr . MSRPC_UUID_SAMR ) <EOL> try : <EOL> resp = samr . hSamrConnect ( dce ) <EOL> serverHandle = resp [ '<STR_LIT>' ] <EOL> resp = samr . hSamrEnumerateDomainsInSamServer ( dce , serverHandle ) <EOL> domains = resp [ '<STR_LIT>' ] [ '<STR_LIT>' ] <EOL> print '<STR_LIT>' <EOL> for domain in domains : <EOL> print "<STR_LIT>" % domain [ '<STR_LIT:Name>' ] <EOL> logging . info ( "<STR_LIT>" % domains [ <NUM_LIT:0> ] [ '<STR_LIT:Name>' ] ) <EOL> resp = samr . hSamrLookupDomainInSamServer ( dce , serverHandle , domains [ <NUM_LIT:0> ] [ '<STR_LIT:Name>' ] ) <EOL> resp = samr . hSamrOpenDomain ( dce , serverHandle = serverHandle , domainId = resp [ '<STR_LIT>' ] ) <EOL> domainHandle = resp [ '<STR_LIT>' ] <EOL> status = STATUS_MORE_ENTRIES <EOL> enumerationContext = <NUM_LIT:0> <EOL> while status == STATUS_MORE_ENTRIES : <EOL> try : <EOL> resp = samr . hSamrEnumerateUsersInDomain ( dce , domainHandle , enumerationContext = enumerationContext ) <EOL> except DCERPCException , e : <EOL> if str ( e ) . find ( '<STR_LIT>' ) < <NUM_LIT:0> : <EOL> raise <EOL> resp = e . get_packet ( ) <EOL> for user in resp [ '<STR_LIT>' ] [ '<STR_LIT>' ] : <EOL> r = samr . hSamrOpenUser ( dce , domainHandle , samr . MAXIMUM_ALLOWED , user [ '<STR_LIT>' ] ) <EOL> print "<STR_LIT>" % ( user [ '<STR_LIT:Name>' ] , user [ '<STR_LIT>' ] ) <EOL> info = samr . hSamrQueryInformationUser2 ( dce , r [ '<STR_LIT>' ] , samr . USER_INFORMATION_CLASS . UserAllInformation ) <EOL> entry = ( user [ '<STR_LIT:Name>' ] , user [ '<STR_LIT>' ] , info [ '<STR_LIT>' ] [ '<STR_LIT>' ] ) <EOL> entries . append ( entry ) <EOL> samr . hSamrCloseHandle ( dce , r [ '<STR_LIT>' ] ) <EOL> enumerationContext = resp [ '<STR_LIT>' ] <EOL> status = resp [ '<STR_LIT>' ] <EOL> except ListUsersException , e : <EOL> logging . critical ( "<STR_LIT>" % e ) <EOL> dce . disconnect ( ) <EOL> return entries <EOL> if __name__ == '<STR_LIT:__main__>' : <EOL> logger . init ( ) <EOL> if sys . stdout . encoding is None : <EOL> sys . stdout = codecs . getwriter ( '<STR_LIT:utf8>' ) ( sys . stdout ) <EOL> print version . BANNER <EOL> parser = argparse . ArgumentParser ( add_help = True , description = "<STR_LIT>" ) <EOL> parser . add_argument ( '<STR_LIT:target>' , action = '<STR_LIT:store>' , help = '<STR_LIT>' ) <EOL> parser . add_argument ( '<STR_LIT>' , choices = SAMRDump . KNOWN_PROTOCOLS . keys ( ) , nargs = '<STR_LIT:?>' , default = '<STR_LIT>' , help = '<STR_LIT>' ) <EOL> parser . add_argument ( '<STR_LIT>' , action = '<STR_LIT:store_true>' , help = '<STR_LIT>' ) <EOL> group = parser . add_argument_group ( '<STR_LIT>' ) <EOL> group . add_argument ( '<STR_LIT>' , action = "<STR_LIT:store>" , metavar = "<STR_LIT>" , help = '<STR_LIT>' ) <EOL> group . add_argument ( '<STR_LIT>' , action = "<STR_LIT:store_true>" , help = '<STR_LIT>' ) <EOL> group . add_argument ( '<STR_LIT>' , action = "<STR_LIT:store_true>" , help = '<STR_LIT>' ) <EOL> group . add_argument ( '<STR_LIT>' , action = "<STR_LIT:store>" , metavar = "<STR_LIT>" , help = '<STR_LIT>' ) <EOL> if len ( sys . argv ) == <NUM_LIT:1> : <EOL> parser . print_help ( ) <EOL> sys . exit ( <NUM_LIT:1> ) <EOL> options = parser . parse_args ( ) <EOL> if options . debug is True : <EOL> logging . getLogger ( ) . setLevel ( logging . DEBUG ) <EOL> else : <EOL> logging . getLogger ( ) . setLevel ( logging . INFO ) <EOL> import re <EOL> domain , username , password , address = re . compile ( '<STR_LIT>' ) . match ( options . target ) . groups ( '<STR_LIT>' ) <EOL> if '<STR_LIT:@>' in address : <EOL> password = password + '<STR_LIT:@>' + address . rpartition ( '<STR_LIT:@>' ) [ <NUM_LIT:0> ] <EOL> address = address . rpartition ( '<STR_LIT:@>' ) [ <NUM_LIT:2> ] <EOL> if domain is None : <EOL> domain = '<STR_LIT>' <EOL> if options . aesKey is not None : <EOL> options . k = True <EOL> if password == '<STR_LIT>' and username != '<STR_LIT>' and options . hashes is None and options . no_pass is False and options . aesKey is None : <EOL> from getpass import getpass <EOL> password = getpass ( "<STR_LIT>" ) <EOL> dumper = SAMRDump ( options . protocol , username , password , domain , options . hashes , options . aesKey , options . k ) <EOL> dumper . dump ( address ) </s>
