o
    àý°jÆV  ã                
   @   sr  d dl mZ d dl mZ d dl mZ d dlmZ d dlmZ d dlm	Z	 d dl
mZmZmZ d dlmZmZ d d	lmZmZ d d
lZd d
lZd d
lZd d
lZd d
lZd d
lZd d
lZd dlmZ G dd„ dƒZedk�r·eejƒ ej ddd�Z!ej"j#dkr“ej"j$dkr“ej"j%dk r“e!j&dddd� n	e!j&ddddd� e!j&ddddd� e!j&ddd d!d� e!j&d"dd#d$d� e!j&d%d&d'd� e!j&d(d&d)d� e!j&d*d&d+d� e!j&d,d&d-d� e!j&d.d/d0gd/d1d2� e!j&d3e'g d4¢d5d6� e! (d7¡Z)e)j&d8dd9d:d� e)j&d;dd<d=d� e! (d>¡Z)e)j&d?dd@dAd� e)j&dBd&dCd� e)j&dDd&dEd� e)j&dFddGdHd� e)j&dIddJdKd� e)j&dLddMdNd� e*ej+ƒdOk�rNe! ,¡  e -dO¡ e! .¡ Z/e 0e/j1e/j2¡ e	e/j3e/j4e/j5e/j6e/j7ƒ\Z8Z9Z:Z;Z;e/_7e8dPk�r}e <dQ¡ e -dO¡ zee9e:e8e/ƒZ=e= >¡  W d
S  e?�y¶ Z@ ze A¡ jBejCk�r¥d d
lDZDeD E¡  eeFe@ƒƒ W Y d
Z@[@d
S d
Z@[@ww d
S )Ré    )Údivision)Úprint_function)Úunicode_literals)Úversion)Úlogger)Úparse_identity)ÚsamrÚepmÚ	transport)ÚSPNEGO_NegTokenInitÚ	TypesMech)Úinit_ldap_sessionÚldap3_kerberos_loginN)Ú	unhexlifyc                   @   sL   e Zd Zdd„ Zdd„ Zdd„ Zdd„ Zd	d
„ Zdd„ Zdd„ Z	dd„ Z
dS )ÚADDCOMPUTERc                 C   sz  || _ || _|| _|| _d| _d| _|j| _|j| _	|j
| _|j| _|j| _|j| _|j| _|j| _|j| _|j| _|j| _|j| _|j| _|j| _ |j!| _"| jd urW| j| _| jdvrct#d| j ƒ‚| jro|jd u rot#dƒ‚| jdkr�d| jvr�t$ %d| j ¡ |jd ur�|j &d¡\| _| _| jd u r¤| jrœt#d	ƒ‚| jr£t#d
ƒ‚n| jd dkr²|  jd7  _| jd u rÄd 'dd„ t(dƒD ƒ¡| _| jd u rÚd| jvrÖt$ %d| j ¡ | j| _| jd u rð| jdkrèd| _n| jdkrðd| _| jd u rù| j| _| jdk�r%| j d u �r%| j &d¡}d| _ |D ]}|  j d| 7  _ �q| j d d… | _ | jdk�r9| j"d u �r;d| j  | _"d S d S d S )NÚ )ÚSAMRÚLDAPSzUnsupported method %sz?Kerberos auth requires DNS name of the target DC. Use -dc-host.r   Ú.zD'%s' doesn't look like a FQDN. Generating baseDN will probably fail.ú:z7You have to provide a computer name when using -no-add.z7You have to provide a computer name when using -delete.éÿÿÿÿú$c                 s   ó"   � | ]}t  tjtj ¡V  qd S ©N)ÚrandomÚchoiceÚstringÚascii_lettersÚdigits©Ú.0Ú_© r"   ú‹/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/../../../bin/addcomputer.pyÚ	<genexpr>c   ó   €  z'ADDCOMPUTER.__init__.<locals>.<genexpr>é    zcNo DC host set and '%s' doesn't look like a FQDN. DNS resolution of short names will probably fail.r   é½  é|  zdc=%s,zCN=Computers,))ÚoptionsÚ_ADDCOMPUTER__usernameÚ_ADDCOMPUTER__passwordÚ_ADDCOMPUTER__domainÚ_ADDCOMPUTER__lmhashÚ_ADDCOMPUTER__nthashÚhashesÚ_ADDCOMPUTER__hashesÚaesKeyÚ_ADDCOMPUTER__aesKeyÚkÚ_ADDCOMPUTER__doKerberosÚdc_hostÚ_ADDCOMPUTER__targetÚ_ADDCOMPUTER__kdcHostÚcomputer_nameÚ_ADDCOMPUTER__computerNameÚcomputer_passÚ_ADDCOMPUTER__computerPasswordÚmethodÚ_ADDCOMPUTER__methodÚportÚ_ADDCOMPUTER__portÚdomain_netbiosÚ_ADDCOMPUTER__domainNetbiosÚno_addÚ_ADDCOMPUTER__noAddÚdeleteÚ_ADDCOMPUTER__deleteÚdc_ipÚ_ADDCOMPUTER__targetIpÚbaseDNÚ_ADDCOMPUTER__baseDNÚcomputer_groupÚ_ADDCOMPUTER__computerGroupÚ
ValueErrorÚloggingÚwarningÚsplitÚjoinÚrange)ÚselfÚusernameÚpasswordÚdomainÚcmdLineOptionsÚdomainPartsÚir"   r"   r#   Ú__init__3   sz   



ÿ






ÿzADDCOMPUTER.__init__c                 C   s´   | j d urtj| j tjdd�}n
tj| jtjdd�}t |¡}| | j	¡ | j d ur6| 
| j ¡ | | j¡ t|dƒrK| | j| j| j| j| j| j¡ | | j| j¡ |  |¡ d S )NÚncacn_np)ÚprotocolÚset_credentials)rG   r	   Úhept_mapr   ÚMSRPC_UUID_SAMRr6   r
   ÚDCERPCTransportFactoryÚ	set_dportr?   ÚsetRemoteHostÚsetRemoteNameÚhasattrr\   r*   r+   r,   r-   r.   r2   Úset_kerberosr4   r7   Ú	doSAMRAdd)rR   ÚstringBindingÚrpctransportr"   r"   r#   Úrun_samr�   s   



ÿzADDCOMPUTER.run_samrc                 C   sô  �zLt | j| j| j| j| j| j| j| j| j	dƒ
\}}| j
s | jr•|  || j¡s1td| j| jf ƒ‚|  || j¡}| jrD| |j¡}d}n| |jdtjd | j¡ d¡gfgi¡}d}|sy|jd tjjjkrrtd	| j|| jf ƒ‚tt|jƒƒ‚| j
rŠt d
| j| jf ¡ W d S t d| j ¡ W d S | jd ur©|  || j¡r¨td| j ƒ‚n	 |   ¡ | _|  || j¡s·nqª| jd d… }d|| j!f }d| d|| jf d| d|| jf g}d|| jf d|| jd| j  d¡dœ}	| "|g d¢|	¡}|�s@|jd tjjj#k�r't$|jd  %d¡d  &¡ dƒ}
|
dk�r td| j ƒ‚tt|jƒƒ‚|jd tjjjk�r9td| j ƒ‚tt|jƒƒ‚t d| j| jf ¡ W d S  t�yy } zt '¡ j(tj)k�rgdd l*}| +¡  t ,t|ƒ¡ W Y d }~d S d }~ww ) NTzAccount %s not found in %s!rD   Ú
unicodePwdz"{}"z	utf-16-leúset password forÚresultú$User %s doesn't have right to %s %s!z%Succesfully set password of %s to %s.zSuccesfully deleted %s.úKAccount %s already exists! If you just want to set a password, use -no-add.r   zCN=%s,%szHOST/%sz
HOST/%s.%szRestrictedKrbHost/%szRestrictedKrbHost/%s.%sz%s.%si   z"%s")ÚdnsHostNameÚuserAccountControlÚservicePrincipalNameÚsAMAccountNameri   )ÚtopÚpersonÚorganizationalPersonÚuserÚcomputerÚmessager   r   é   im!  zUser %s machine quota exceeded!z7User %s doesn't have right to create a machine account!ú7Successfully added machine account %s with password %s.)-r   r,   r*   r+   r-   r.   r4   rG   r6   r2   rC   rE   ÚLDAPComputerExistsr9   Ú	ExceptionrI   ÚLDAPGetComputerrD   Úentry_dnÚmodifyÚldap3ÚMODIFY_REPLACEÚformatr;   Úencoderk   ÚcoreÚresultsÚ!RESULT_INSUFFICIENT_ACCESS_RIGHTSÚstrrM   ÚinfoÚgenerateComputerNamerK   ÚaddÚRESULT_UNWILLING_TO_PERFORMÚintrO   ÚstripÚ	getLoggerÚlevelÚDEBUGÚ	tracebackÚ	print_excÚcritical)rR   Ú
ldapServerÚldapConnrv   Úresrw   ÚcomputerHostnameÚ
computerDnÚspnsÚucdÚ
error_codeÚer�   r"   r"   r#   Ú	run_ldaps•   st   0*
ÿ
ýüû
€ûzADDCOMPUTER.run_ldapsc                 C   s    |  | jd| ¡ t|jƒdkS )Nú(sAMAccountName=%s)é   )ÚsearchrI   ÚlenÚentries©rR   Ú
connectionÚcomputerNamer"   r"   r#   rz   å   s   zADDCOMPUTER.LDAPComputerExistsc                 C   s   |  | jd| ¡ |jd S )Nr�   r   )rŸ   rI   r¡   r¢   r"   r"   r#   r|   é   s   
zADDCOMPUTER.LDAPGetComputerc                 C   s    dd  dd„ tdƒD ƒ¡d  S )NzDESKTOP-r   c                 s   r   r   )r   r   r   Úascii_uppercaser   r   r"   r"   r#   r$   î   r%   z3ADDCOMPUTER.generateComputerName.<locals>.<genexpr>é   r   )rP   rQ   ©rR   r"   r"   r#   rˆ   í   s    z ADDCOMPUTER.generateComputerNamec              
      s
  |  ¡ }d }d }d }�zS�zþ| ¡  | tj¡ t |dˆ j tjtjB ¡}|d }t 	||¡}|d d }t
tdd„ |ƒƒ}	t|	ƒdkrt
t‡ fdd„|ƒƒ}
t|
ƒdkrxt dˆ j¡ t d	¡ |D ]}
t d
|
d  ¡ qdt d¡ tƒ ‚|
d d }n|	d d }t |||¡}|d }t ¡ jtjkrŸt d| ¡ t ||tjtjB |¡}|d }ˆ js¶ˆ j�r#zt ||ˆ jg¡}W n tjyÝ } z|jdkrØtdˆ j|f ƒ‚‚ d }~ww |d d d }ˆ jrïtj }d}ntj!}d}zt "||||¡}|d }W n™ tj�y" } z|jdk�rtdˆ j#|ˆ jf ƒ‚‚ d }~ww ˆ jd u�rUzt ||ˆ jg¡}tdˆ j ƒ‚ tj�yT } z|jdk�rJ‚ W Y d }~n<d }~ww d}|�sŒˆ  $¡ ˆ _zt ||ˆ jg¡}W n tj�yˆ } z|jdk�r}d}n‚ W Y d }~nd }~ww |�rZt %||ˆ jtj&tj!¡}|d }ˆ j�r±t '||¡ t dˆ j ¡ d }nYt (||ˆ j)¡ ˆ j�rÉt dˆ jˆ j)f ¡ nAt ||ˆ jg¡}|d d d }t "||tj*|¡}|d }t +¡ }tj,j-|d< tj&|d  d!< t .|||¡ t d"ˆ jˆ j)f ¡ W n+ t�y6 } zt ¡ jtjk�r%dd l/}| 0¡  t t1|ƒ¡ W Y d }~nd }~ww W |d u�rCt 2||¡ |d u�rNt 2||¡ |d u�rYt 2||¡ | 3¡  d S |d u�rjt 2||¡ |d u�rut 2||¡ |d u�r€t 2||¡ | 3¡  w )#Nz\\%s ÚServerHandleÚBufferc                 S   s   | d   ¡ dkS )NÚNameÚbuiltin)Úlower©Úxr"   r"   r#   Ú<lambda>ÿ   s    z'ADDCOMPUTER.doSAMRAdd.<locals>.<lambda>rž   c                    s   | d   ¡ ˆ jkS )Nrª   )r¬   rA   r­   r§   r"   r#   r¯     s    zAThis server provides multiple domains and '%s' isn't one of them.zAvailable domain(s):z * %srª   zGConsider using -domain-netbios argument to specify which one you meant.r   ÚDomainIdzOpening domain %s...ÚDomainHandlel   s    z"Account %s not found in domain %s!ÚRelativeIdsÚElementrD   rj   Ú
UserHandlel   "    rl   rm   FTzSuccessfully deleted %s.z&Successfully set password of %s to %s.ÚtagÚControlÚUserAccountControlry   )4Úget_dce_rpcÚconnectÚbindr   r^   ÚhSamrConnect5r6   ÚSAM_SERVER_ENUMERATE_DOMAINSÚSAM_SERVER_LOOKUP_DOMAINÚ hSamrEnumerateDomainsInSamServerÚlistÚfilterr    rM   r’   rA   Úerrorr{   ÚhSamrLookupDomainInSamServerr�   rŽ   r�   r‡   ÚhSamrOpenDomainÚDOMAIN_LOOKUPÚDOMAIN_CREATE_USERrC   rE   ÚhSamrLookupNamesInDomainr9   ÚDCERPCSessionErrorrš   ÚDELETEÚUSER_FORCE_PASSWORD_CHANGEÚhSamrOpenUserr*   rˆ   ÚhSamrCreateUser2InDomainÚUSER_WORKSTATION_TRUST_ACCOUNTÚhSamrDeleteUserÚhSamrSetPasswordInternal4Newr;   ÚMAXIMUM_ALLOWEDÚSAMPR_USER_INFO_BUFFERÚUSER_INFORMATION_CLASSÚUserControlInformationÚhSamrSetInformationUser2r�   r‘   r†   ÚhSamrCloseHandleÚ
disconnect)rR   rg   ÚdceÚ
servHandleÚdomainHandleÚ
userHandleÚsamrConnectResponseÚsamrEnumResponseÚdomainsÚdomainsWithoutBuiltinrU   ÚselectedDomainÚsamrLookupDomainResponseÚ	domainSIDÚsamrOpenDomainResponseÚcheckForUserr›   ÚuserRIDÚaccessrw   ÚopenUserÚfoundUnusedÚ
createUserÚreqr�   r"   r§   r#   re   ð   sî   
ÿ


€ü€üÿ€ÿ
þ€þü
€€û€



ú


zADDCOMPUTER.doSAMRAddc                 C   s0   | j dkr|  ¡  d S | j dkr|  ¡  d S d S )Nr   r   )r=   rh   rœ   r§   r"   r"   r#   Úruni  s
   

ÿzADDCOMPUTER.runN)Ú__name__Ú
__module__Ú__qualname__rY   rh   rœ   rz   r|   rˆ   re   ré   r"   r"   r"   r#   r   2   s    NPyr   Ú__main__Tz!Adds a computer account to domain)Úadd_helpÚdescriptioné   é   rx   ÚaccountÚstorez@[domain/]username[:password] Account used to authenticate to DC.)ÚactionÚhelpz[domain/]username[:password]z#Account used to authenticate to DC.)rô   Úmetavarrõ   z-domain-netbiosÚNETBIOSNAMEz=Domain NetBIOS name. Required if the DC has multiple domains.z-computer-namezCOMPUTER-NAME$zNName of computer to add.If omitted, a random DESKTOP-[A-Z0-9]{8} will be used.z-computer-passrT   zMPassword to set to computerIf omitted, a random [A-Za-z0-9]{32} will be used.z-no-addÚ
store_truez8Don't add a computer, only set password on existing one.z-deletezDelete an existing computer.z-tsz&Adds timestamp to every logging outputz-debugzTurn DEBUG output ONz-methodr   r   ztMethod of adding the computer.SAMR works over SMB.LDAPS has some certificate requirementsand isn't always available.)ÚchoicesÚdefaultrõ   z-port)é‹   r'   r(   zCDestination port to connect to. SAMR defaults to 445, LDAPS to 636.)Útyperù   rõ   ÚLDAPz-baseDNzDC=test,DC=localzgSet baseDN for LDAP.If ommited, the domain part (FQDN) specified in the account parameter will be used.z-computer-groupzCN=Computers,DC=test,DC=localzOGroup to which the account will be added.If omitted, CN=Computers will be used,Úauthenticationz-hasheszLMHASH:NTHASHz$NTLM hashes, format is LMHASH:NTHASHz-no-passz&don't ask for password (useful for -k)z-kzÂUse Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on account parameters. If valid credentials cannot be found, it will use the ones specified in the command linez-aesKeyzhex keyz<AES key to use for Kerberos Authentication (128 or 256 bits)z-dc-hostÚhostnamez|Hostname of the domain controller to use. If ommited, the domain part (FQDN) specified in the account parameter will be usedz-dc-ipÚipzzIP of the domain controller to use. Useful if you can't translate the FQDN.specified in the account parameter will be usedrž   r   zDomain should be specified!)GÚ
__future__r   r   r   Úimpacketr   Úimpacket.examplesr   Úimpacket.examples.utilsr   Úimpacket.dcerpc.v5r   r	   r
   Úimpacket.spnegor   r   r   r   r   ÚargparserM   Úsysr   r   ÚsslÚbinasciir   r   rê   ÚprintÚBANNERÚArgumentParserÚparserÚversion_infoÚmajorÚminorÚmicroÚadd_argumentr‹   Úadd_argument_groupÚgroupr    ÚargvÚ
print_helpÚexitÚ
parse_argsr)   ÚinitÚtsÚdebugrò   r/   Úno_passr1   r3   rU   rS   rT   r!   r’   Úexecuterré   r{   r›   r�   rŽ   r�   r�   r‘   r†   r"   r"   r"   r#   Ú<module>   s†     
@
$ÿ


(


€ü»