o j @sddlZddlZddlZddlmZddlmZddlmZmZm Z ddl m Z m Z ddl mZmZddlmZddlmZmZddlZGd d d ZGd d d eZGd ddeZGdddeZGdddeZGdddeZddZedkr^eejeZ e!e j"e j#eeeedZ$ze$e j%Z&Wne'ye(de j%e)dYnwee j*\Z+Z,Z-Z.e+se j%dvrdZ+ne.Z+e j/durz e j/0d\Z1Z2Wne3yeZ1e j/Z2YnwdZ1dZ2e-dkre2dkre j4rn(e j5re6dnzed Z-Wne7yee8d!e)d"Ynwe j9durFdZ:ze j90d\Z;Zdurz e j>0d&\Z?Z@Wne3ye+Z?e j>Z@Ynwe jAdurz e jA0d\ZBZCWne3ydZBe jAZCYnwdZBdZCdZDe jEdure jEZDe jEdure jAdure j5se(d'e)dn e+Z?e,Z@e-ZDe1ZBe2ZCe jFZGe j%d(kr eGs e#d)d*ZGe&e.e?e@eDeBeCeGe jHe jId+ ZJe j4r&eJKe,e+e:e;e<ZLn'e?e@fe+e,fkrAe8d,e+d&e,d-e?d&e@d. eJMe,e+e-e:e1e2e;e<ZLeLrWe)ddSe)ddSdS)/N)getpass)version) transportsamrepm) kerberosv5kpasswd)ldapldapasn1)logger) parse_target EMPTY_LM_HASHc@s^eZdZdZ        dddZddZ        dd d Zd d Zdd dZdS)PasswordHandlerzIGeneric interface for all the password protocols supported by this scriptFNc Cs:||_||_||_||_||_||_||_||_| |_dS)a Instantiate password change or reset with the credentials of the account making the changes. It can be the target user, or a privileged account. :param string address: IP address or hostname of the server or domain controller where the password will be changed :param string domain: AD domain where the password will be changed :param string username: account that will attempt the password change or reset on the target(s) :param string password: password of the account that will attempt the password change :param string pwdHashLM: LM hash of the account that will attempt the password change :param string pwdHashNT: NT hash of the account that will attempt the password change :param bool doKerberos: use Kerberos authentication instead of NTLM :param string aesKey: AES key for Kerberos authentication :param string kdcHost: KDC host N) addressdomainusernamepassword pwdHashLM pwdHashNT doKerberosaesKeykdcHost) selfrr authUsername authPassword authPwdHashLM authPwdHashNTrrrr/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/../../../bin/changepasswd.py__init__s zPasswordHandler.__init__c Ct)z#Implementation of a password changeNotImplementedError rtargetUsername targetDomain oldPassword newPassword oldPwdHashLM oldPwdHashNT newPwdHashLM newPwdHashNTrrr_changePasswordszPasswordHandler._changePasswordc Cst|dur#|j}|dur|j}|dur|j}|dur|j}|dur#|j}td|d||||||||||S)a Change the password of a target account, knowing the previous password. :param string targetUsername: account whose password will be changed, if different from the user performing the change :param string targetDomain: domain of the account :param string oldPassword: current password :param string newPassword: new password :param string oldPwdHashLM: current password, as LM hash :param string oldPwdHashMT: current password, as NT hash :param string newPwdHashLM: new password, as LM hash :param string newPwdHashMT: new password, as NT hash :return bool success NzChanging the password of \)rrrrrlogginginfor-r$rrrchangePasswordszPasswordHandler.changePasswordcCr!)z Implementation of a password setr"rr%r&r(r+r,rrr _setPasswordszPasswordHandler._setPasswordc CsF|dur|j}td|d|d|jd|j||||||S)a Set or Reset the password of a target account, with privileges. :param string targetUsername: account whose password will be changed :param string targetDomain: domain of the account :param string newPassword: new password :param string newPwdHashLM: new password, as LM hash :param string newPwdHashMT: new password, as NT hash :return bool success NzSetting the password of r. as )rr/r0rr3r2rrr setPasswords &zPasswordHandler.setPassword)rrrrrFrN)NNNrNNrr)Nrrr) __name__ __module__ __qualname____doc__r r-r1r3r5rrrrrs. % ,rc@s eZdZdZddZddZdS) KPasswordzTUse Kerberos Change-Password or Set-Password protocols (rfc3244) to change passwordsc Cs||jkr tddS|stddSz t|||||||j|jftj|||||||j|jdWntj tj fyT} zt d| WYd} ~ dSd} ~ wwt ddS)NzZKPassword does not support changing the password of another user (try setPassword instead)F0KPassword requires the new password as plaintextrrzPassword not changed: "Password was changed successfully.T) rr/criticaldebugrrrr1r KerberosError KPasswdErrorerrorr0) rr%r&r'r(r)r*r+r,errrr-sF       zKPassword._changePasswordc Cs|s tddSztj|j|j||||j|j|j|j |j d Wn%t j tj fyF}ztd|d|d|WYd}~dSd}~wwtd|d|dd S) Nr;Fr<zPassword not changed for r.: z"Password was set successfully for .T)r/r>rr5rrrrrrrrr@rArBr0)rr%r&r(r+r,rCrrrr3's.   zKPassword._setPasswordN)r6r7r8r9r-r3rrrrr:s )r:c@sreZdZdZdZdZddZdddZddd Zd d Z d d ddZ ddZ ddZ ddZ ddZddZdS) SamrPasswordz>Use MS-SAMR protocol to change or reset the password of a userNFcCr!)zf Return a new transport for our RPC/DCE. :return rpc: RPC transport instance r"rrrr rpctransportHszSamrPassword.rpctransportcCs|}t|dr(|r|jdddddddn|j|j|j|j|j|j|jd|r4d|_ | ddn d|_ | |j |j |rCdn|jd |j}t d ||}||tjt d |S) z Instantiate a new transport and try to authenticate :param bool anonymous: Attempt a null binding :return dce: DCE/RPC, bound to SAMR set_credentialsr)rrrlmhashnthashr)rTFNz null sessionr.zConnecting to DCE/RPC as zSuccessfully bound to SAMR)rHhasattrrIrrrrrr anonymous set_kerberosrrr/r0 get_dce_rpcconnectbindrMSRPC_UUID_SAMRr?)rrMrHas_userdcerrr authenticatePs0    zSamrPassword.authenticatec s:|jrdSz |jdd|_WdStyztfdddDrD|r1td|jdd|_n`tdttWYd dSd tvr]td ttWYd dSd tvrvtd ttWYd dSdtvrtdttWYd dSWYd dSd ww)z Connect to SAMR using our transport protocol. This method must instantiate self.dce :param bool retry_if_expired: Retry as null binding if our password is expired :return bool: success TF)rMc3s|] }|tvVqdS)N)str).0msgrCrr sz'SamrPassword.connect..)STATUS_PASSWORD_MUST_CHANGESTATUS_PASSWORD_EXPIREDzKPassword is expired or must be changed, trying to bind with a null session.zlCannot set new NTLM hashes when current password is expired. Provide a plaintext value for the new password.NSTATUS_LOGON_FAILUREzAAuthentication failure when connecting to RPC: wrong credentials?STATUS_ACCOUNT_RESTRICTIONzAccount restriction: username and credentials are valid, but some other restriction preventsauthentication, like 'Protected Users' group or time-of-day restrictionSTATUS_ACCOUNT_DISABLEDz"The account is currently disabled.) rTrU Exceptionanyr/warningr>r?rV)rretry_if_expiredrrYrrPysD         zSamrPassword.connectc Cs8z?t|j|jdd}t|j||jd}tj|j||dd}t|j||fddd}tj|j||d d }W|St y}zPd t |vr`t d t t |WYd }~dS|jr|dt |vr|t dt t |WYd }~dSdt |vrt dt t |WYd }~dS|d }~ww)z!Open an handle on the target user ServerHandleDomainId)domainId DomainHandle RelativeIdsElementr)userId UserHandleSTATUS_NO_SUCH_DOMAINziWrong realm. Try to set the domain name for the target user account explicitly in format DOMAIN/username.NFSTATUS_ACCESS_DENIEDznOur anonymous session cannot get a handle to the target user. Retry with a user whose password is not expired.z Access denied)r hSamrConnectrTrhSamrLookupDomainInSamServerrhSamrOpenDomainhSamrLookupNamesInDomain hSamrOpenUserr`rVr/r>r?rM)rr serverHandle domainSID domainHandleuserRID userHandlerCrrrrss6   zSamrPassword.hSamrOpenUserT_changec Ostd|jz||jg|Ri|}WnPtyg}zDdt|vr8tdtt|WYd}~dSdt|vra|rFtdn t|jd|jd tt|WYd}~dS|d}~ww|d d krut d d St d| dS)a Handles common errors when changing/resetting the password, regardless of the procedure :param callable samrProcedure: Function that will send the SAMR call args and kwargs are passed verbatim :param bool _change: Used for more precise error reporting, True if it is a password change, False if it is a reset zSending SAMR call STATUS_PASSWORD_RESTRICTIONzSome password update rule has been violated. For example, the password history policy may prohibit the use of recent passwords or the password may not meet length criteria.NFrnz7Target user is not allowed to change their own passwordr.z6 user is not allowed to set the password of the target ErrorCoderr=Tz/Non-zero return code, something weird happened.) r/r?r6rTr`rVr>rrr0rBdump)r samrProcedurerzargskwargsresprCrrr _SamrWrappers2       zSamrPassword._SamrWrapperc Cs|jtjd|||||ddS)NrdTry)rrhSamrUnicodeChangePasswordUser2)rrr'r(r)r*r+r,rrrrsz,SamrPassword.hSamrUnicodeChangePasswordUser2c Cs.||}|s dS|jtj||||||ddS)NFT)r'r(r*r+r,rz)rsrrhSamrChangePasswordUser) rrr'r(r)r*r+r,rxrrrrs z$SamrPassword.hSamrChangePasswordUsercCs(||}|s dS|jtj|||ddS)NFry)rsrrhSamrSetNTInternal1)rrr(r+r,rxrrrhSamrSetInformationUsers z$SamrPassword.hSamrSetInformationUserc CsR|jddsdS|r||||||ddS|||d||||} | r'td| S)NTrcFrztUser might need to change their password at next logon because we set hashes (unless password never expires is set).)rPrrr/rb) rr%r&r'r(r)r*r+r,resrrrr-s  zSamrPassword._changePasswordcCs2|jddsdS|||||}|rtd|S)NFrzWUser no longer has valid AES keys for Kerberos, until they change their password again.)rPrr/rb)rr%r&r(r+r,rrrrr3+s  zSamrPassword._setPassword)F)r6r7r8r9rTrMrHrUrPrsrrrrr-r3rrrrrFAs  )1 & rFcs0eZdZddZfddZfddZZS) RpcPasswordcCs.tj|jtjdd}t|}||j|S)N ncacn_ip_tcp)protocol)rhept_maprrrRrDCERPCTransportFactory setRemoteHost)r stringBindingrHrrrrH7s  zRpcPassword.rpctransportc s(|stdt||||||||S)NzmMS-RPC transport requires new password in plaintext in default Active Directory configuration. Trying anyway.)r/rbsuperr-r$ __class__rrr-=szRpcPassword._changePasswordcstdt|||||S)NzhMS-RPC transport does not allow password reset in default Active Directory configuration. Trying anyway.)r/rbrr3r2rrrr3HszRpcPassword._setPassword)r6r7r8rHr-r3 __classcell__rrrrr6s  rc@seZdZddZdS) SmbPasswordcCstj|jddS)Nz\samr)filename)r SMBTransportrrGrrrrHPszSmbPassword.rpctransportN)r6r7r8rHrrrrrOs rc@sHeZdZdZdZdZddZddZddZd d Z d d Z d dZ dS) LdapPasswordz-Use LDAP to change or reset a user's passwordNc Cs |jrdSd|j}dd|d|_td|d|jd|jz0t ||j|j}|j sA| |j|j |j|j|jn|j|j|j |j|j|j|j|jd Wn+t jtjjfy}ztd |d|jd|jd |WYd }~d Sd }~ww||_dS)z:Connect to LDAPS with the credentials provided in __init__Tzldaps://zDC=z,DC=rEzConnecting to r4r.rzCannot connect to rDNF)ldapConnectionrjoinsplitbaseDNr/r?rrr LDAPConnectionrloginrrr kerberosLoginrrLDAPSessionErrorOpenSSLSSL SysCallErrorrB)rr&ldapURIrrCrrrrPZs4   &zLdapPassword.connectcCsd|ddS)z Encode the password according to Microsoft's specifications Password must be surrounded by quotes and UTF-16 encoded "z utf-16-le)encode)rrrrrencodeLdapPasswordyszLdapPassword.encodeLdapPasswordcCsF|jjd|d|jdd}|D]}t|tjsqt|dSdS)z Find the DN of the targeted userz(sAMAccountName=))distinguishedName) searchFilter searchBase attributes objectNameN)rsearchr isinstancer SearchResultEntryrV)rr%r&answersitemrrr findTargetDNs  zLdapPassword.findTargetDNc Cs||sdS|||}|stddStd|t}||d<|rktd|ddd<d |ddd d <||ddd d d<td |ddd<d |ddd d <||ddd d d<n!td|ddd<d |ddd d <||ddd d d<tdt||j |d}tdt|t |ddd} tt | } t|ddd} | dkrt d|dS| dkrtd|ddS| dkrtd|d|jd|jd dStd|d!| d"| dS)#NFz&Could not find the target user in LDAPz Found target distinguishedName: objectdeletechangesr operation unicodePwd modificationtypevalsaddreplacez Sending: z Receiving: protocolOpmodifyResponse resultCodediagnosticMessagesuccessz&Password was changed successfully for TconstraintViolationz!Could not change the password of z@, possibly due to the password policy or an invalid oldPassword.insufficientAccessRightszCould not set the password of z, r.z has insufficient rightsz. rD)rPrr/r>r?r ModifyRequest OperationrVr sendReceiveint ResultCoder0rBrr) rchanger%r&oldPasswordEncodednewPasswordEncodedtargetDNrequestresponserresult diagMessagerrr_modifyPasswordsL     "zLdapPassword._modifyPasswordc Cs<|r|s tddS||} ||} |d||| | S)z Change the password of a user. Must send a delete operation with the oldPassword and an add operation with the newPassword in the same modify request. z4LDAP requires the old and new passwords in plaintextFTr/r>rr) rr%r&r'r(r)r*r+r,rrrrrr-s    zLdapPassword._changePasswordcCs.|s tddS||}|d||d|S)z Set the password of a user. Must send a modify operation with the newPassword (must have privileges). z+LDAP requires the new password in plaintextFNr)rr%r&r(r+r,rrrrr3s   zLdapPassword._setPassword) r6r7r8r9rrrPrrrr-r3rrrrrTs5 rcCstjdd}|jdddd|jddd d|jd dd d|d }|}|jd dddd|jdddddd|d}|jdddddd|jdddd|d}|jddddd|}|jddddd|jddddd d|d!}|jd"d#dd$d%d&d'|jd(d)dd*d|jd+d,d}|jd-dd.d|jd/dd0d1d2|jd3dd4d5d2ttjd6kr|t d6| S)7Nz3Change or reset passwords over different protocols.) descriptiontargetstorez4[[domain/]username[:password]@])actionhelpz-ts store_truez&adds timestamp to every logging outputz-debugzturn DEBUG output ONzNew credentials for targetz-newpassz new password)rdefaultrz -newhashesz LMHASH:NTHASHz2new NTLM hashes, format is NTHASH or LMHASH:NTHASH)rrmetavarrz6Authentication (target user whose password is changed)z-hashesz.NTLM hashes, format is NTHASH or LMHASH:NTHASHz-no-passz0Don't ask for password (useful for Kerberos, -k)z@Authentication (optional, privileged user performing the change)z-altuserzAlternative usernamez-altpasszAlternative passwordz-althashz -althashesz6Alternative NT hash, format is NTHASH or LMHASH:NTHASHzMethod of operationsz -protocolz-pz)Protocol to use for password change/resetsmb-samr)rrpc-samrrr )rrrchoicesz-resetz-adminzMTry to reset the password with privileges (may bypass some password policies)zKerberos authenticationzHApplicable to the authenticating user (-altuser if defined, else target)z-kzUse Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use the ones specified in the command linez-aesKeyzhex keyzrrr&r%r'rhashesrr)r* ValueErrorresetno_passr0KeyboardInterruptrb newhashesr(r+r,newpassaltuser authDomainralthashrrraltpasskrrdc_iphandlerr5retr1rrrrs$x   rFv V