o
    àý°jä¤  ã                
   @   sÖ  d dl mZ d dlZd dlZd dlZd dlZd dlZd dlZd dlm	Z	 d dl
mZmZ d dlmZ d dlmZ d dlmZ d dlmZ d d	lmZmZ d d
lmZmZ d dlmZmZmZmZ d dl m!Z!m"Z"m#Z#m$Z$m%Z%m&Z& ej'dkZ(dZ)dZ*dZ+dZ,dZ-dZ.dZ/dZ0dZ1dZ2G dd„ dƒZ3G dd„ de3ƒZ4G dd„ dƒZ5e6dk�riej7j8du r³e 9d¡ej7ƒe_7e:ej;ƒ G d d!„ d!ej<ƒZ=d"d#„ Z>ej?d$d%d&�Z@e@jAd'd(d)d*� e@jAd+d,d-d*� e@jAd.d,d/d*� e@jAd0d(d1d*� e@ Bd2¡ZCeCjAd3d(d4d5d6� e(�re@jDd7d8d$d9�ZEne@jDd7d8d:�ZEeEjFd;d<d=�ZGe(�r eGjDd>d?d$d9�ZHneGjDd>d?d:�ZHeHjFd@dAd=�ZIeIjAdBd,dCd*� e@jAdDd,dEd*� eHjFdFe=dGdH�ZJeJjAdIg dJ¢dKdLdMdN� eJjAdOd(eKdPdQdRdS� e	�rieJjAdTd(dUd*� n	eJjAdTd(dUe>dV� eJjAdWd(dXd*� eJjAdYdZd[gdKdZd\dN� eJjAd]d(d^d*� eHjFd_e=d`dH�ZLeLjAdWd(dad*� eLjAdbd(dcd*� eLjAdIg dd¢dKdLdedN� eLjAdOd(eKdPdQdRdS� eLjAdYdZd[gdKdZd\dN� eLjAd]d(d^d*� eHjFdfe=dgdH�ZMeMjAdIg dh¢dKdidjdN� eMjAdOd(eKdkdldRdS� eMjAdmd(eKdndodpdS� eMjAdqd(eKdrd dsdS� eMjAdYdZd[gdKdZd\dN� eMjAd]d(d^d*� eNejOƒdtk�r+e@ P¡  e Qdt¡ e@ R¡ ZSe TeSjUeSjV¡ eeSjWƒ\ZXZYZZZ[eXdu �rGduZXeZduk�raeYduk�raeSj\du �rad dvl]m]Z] e]dwƒZZeSj^duk�rqe _dx¡ e Qdt¡ eSj^du �rzdueS_^ze5eXeYeZe[ƒZ`e` aeS¡ W dS  eb�y™   e _dy¡ Y dS  ec�yh Zd zÃdzed Zee fee¡ d{eev �r¼eSjg h¡ dfk�r¼e fd|¡ d}eev �rÖe`jijjjkd$k�rÖeSjg h¡ dfk�rÖe fd|¡ e#eev �röe fd~¡ e fd¡ eSj^duk�rñe fd€¡ ne fd�¡ e%eev �s e$eev �reSj^duk�re fd‚¡ ne fdƒ¡ e!eev �re fd„¡ e"eev �s%e&eev �r*e fd…¡ e"eev �s4e&eev �rGe`jijj l¡ ek�rGeXduk�rGe fd†¡ e&eev �sQe$eev �r]e md‡¡ W Y dZd[ddS W Y dZd[ddS dZd[dww dS )ˆé    )Úprint_functionN)ÚPY3)ÚuuidÚversion)Ú
AUTH_BASIC)Úlogger)Úparse_target)Úparse_bitmask)Ú	transportÚnspi)ÚPR_CONTAINER_FLAGS_VALUESÚMAPI_PROPERTIES)Ú
CP_TELETEXÚExchBinaryObjectÚget_guid_from_dnÚget_dn_from_guid)Ú RPC_PROXY_REMOTE_NAME_NEEDED_ERRÚRPC_PROXY_HTTP_IN_DATA_401_ERRÚRPC_PROXY_CONN_A1_0X6BA_ERRÚRPC_PROXY_CONN_A1_404_ERRÚRPC_PROXY_RPC_OUT_DATA_404_ERRÚRPC_PROXY_CONN_A1_401_ERR)é   é   i  6éÿi 0l    ö l    ú l   ø é 0ì   Ú éöz=======================c                   @   sf   e Zd Zdd„ Zdd„ Zdd„ Zdd„ Zddd„Zdd„ Zdd„ Z	dd„ Z
dd„ Zdd„ Zdd„ Zd
S )Ú	Exchangerc                 C   sF   d| _ d| _d| _d| _d| _d| _d| _d | _d | _d | _	d | _
d S )NÚ FÚhex)Ú	_usernameÚ	_passwordÚ_domainÚ_lmhashÚ_nthashÚ_extended_outputÚ_output_typeÚ_stringbindingÚ_rpctransportÚ_Exchanger__outputFileNameÚ_Exchanger__outputFd©Úself© r.   ú‰/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/../../../bin/exchanger.pyÚ__init__A   s   
zExchanger.__init__c                 C   ó   t dƒ‚©Nz,Virtual method. Not implemented in subclass!©ÚNotImplementedErrorr,   r.   r.   r/   Úconenct_mapiQ   ó   zExchanger.conenct_mapic                 C   r1   r2   r3   r,   r.   r.   r/   Úconnect_rpcT   r6   zExchanger.connect_rpcc                 C   r1   )NzNot Implemented!r3   r,   r.   r.   r/   Úload_autodiscoverW   s   zExchanger.load_autodiscoverr   Nc                 C   s@   || _ || _|| _d| _d| _|d ur| d¡\| _| _d S d S )Nr   ú:)r!   r"   r#   r$   r%   Úsplit)r-   ÚusernameÚpasswordÚdomainÚhashesr.   r.   r/   Úset_credentials]   s   ÿzExchanger.set_credentialsc                 C   ó
   || _ d S ©N)r&   )r-   Úoutput_moder.   r.   r/   Úset_extended_outputg   ó   
zExchanger.set_extended_outputc                 C   r@   rA   )r'   )r-   Úoutput_typer.   r.   r/   Úset_output_typej   rD   zExchanger.set_output_typec                 C   s   || _ t| j dƒ| _d S )Nzw+)r*   Úopenr+   )r-   Úfilenamer.   r.   r/   Úset_output_filem   s   zExchanger.set_output_filec                 C   sB   | j d krtr| j  |d ¡ n| j  |d  d¡¡ t|ƒ d S )NÚ
zutf-8)r+   r   ÚwriteÚencodeÚprint)r-   Útextr.   r.   r/   rM   q   s
   
zExchanger.printc                 C   sX   t r| jdkrdtt |¡dƒ S | jdkrdt |¡ S t r'tt |¡dƒS t |¡S )Nr    z0x%sÚascii)r   r'   ÚstrÚbinasciiÚhexlifyÚbase64Ú	b64encode)r-   Úbytestrr.   r.   r/   Ú_encode_binaryy   s   

zExchanger._encode_binaryc                 C   s   | j d kr
| j  ¡  d | _ d S rA   )r+   Úcloser,   r.   r.   r/   Ú__del__ƒ   s   


zExchanger.__del__)r   r   r   N)Ú__name__Ú
__module__Ú__qualname__r0   r5   r7   r8   r?   rC   rF   rI   rM   rV   rX   r.   r.   r.   r/   r   @   s    


r   c                   @   sÔ   e Zd ZegZg d¢Zeg d¢ ZdZdd„ Zd(dd„Z	d	d
„ Z
dd„ Zdd„ Zdd„ Zdd„ Zedd„ ƒZd)dd„Zdd„ Zd)dd„Zdd„ Zdg dddfd d!„Zdg ddfd"d#„Zd)d$d%„Zg ddfd&d'„ZdS )*ÚNSPIAttacks)i  :i þ9l   N  i@ 0i@ 0r   ):i :l     r   r   i  :i ÿ9l     l    â l    l    –  l   Þ  i 0l    Ò  i &:i *:i (:i ):i 	:i :i:i :i :i :i :i 
:i :i þi  9l    z l    Z  l    \  l    ^  l    `  l    b  l    d  l    f  l    h  l    j  l    l  l    ® l    ° l    ² l    À l    Â l   l l    > l   æ l   , l   ê l    j l    f l    Ä l   v l   à l    "  l   ê l   Ô r   z#ncacn_http:%s[6004,RpcProxy=%s:443]c                 C   s>   t  | ¡ d | _i | _d| _tƒ | _t ¡ | _	tj
| j	d< d S )NéÿÿÿÿÚCodePage)r   r0   Ú_NSPIAttacks__handlerÚhtableÚanyExistingContainerIDÚlistÚpropsr   ÚSTATÚstatr   r,   r.   r.   r/   r0   è   s   

zNSPIAttacks.__init__r   c                 C   sÊ   | j ||f | _t d| j ¡ t | j¡| _| j | j| j	| j
| j| j¡ | j ¡ | _| j | j| j	| j
| j| j¡ tjrD| j t¡ | j d¡ | j ¡  | j tj¡ t | j| j¡}|d | _d S )NzStringBinding %sé   ÚcontextHandle)ÚDEFAULT_STRING_BINDINGr(   ÚloggingÚdebugr
   ÚDCERPCTransportFactoryr)   r?   r!   r"   r#   r$   r%   Úget_dce_rpcÚ_NSPIAttacks__dceÚoptionsÚbasicÚset_auth_typer   Úset_auth_levelÚconnectÚbindr   ÚMSRPC_UUID_NSPIÚ	hNspiBindre   r_   )r-   Ú
remoteNameÚrpcHostnameÚrespr.   r.   r/   r7   ô   s"   ÿÿ
zNSPIAttacks.connect_rpcc                 C   s>   t  ¡ }t|d< t |¡|d< t  | j| j|¡}|d | _d S )Nr^   ÚContainerIDÚpStat)	r   rd   r   r\   Ú_int_to_dwordÚhNspiUpdateStatrm   r_   re   )r-   Ú	table_MIdre   rx   r.   r.   r/   Úupdate_stat  s
   zNSPIAttacks.update_statc                 C   s,   t  | j| j¡}t  |d ¡}|  |¡ d S )NÚppRows)r   ÚhNspiGetSpecialTablerm   r_   ÚsimplifyPropertyRowSetÚ_parse_and_set_htable)r-   rx   Ú
resp_simplr.   r.   r/   Úload_htable  s   zNSPIAttacks.load_htablec                 C   sB   | j D ]}|  |¡ | jd | j | d< | jd | j | d< qd S )NÚ	TotalRecsÚcountÚ
CurrentRecÚ	start_mid)r`   r~   re   ©r-   ÚMIdr.   r.   r/   Úload_htable_stat  s
   

ýzNSPIAttacks.load_htable_statc                 C   sZ   | j dkrd S | ji kr|  ¡  | jD ]}|  |¡ | jd dkr*t |¡| _  d S qd S )Nr]   r‡   r   )ra   r`   r„   r~   re   r\   r{   r‰   r.   r.   r/   Úload_htable_containerid%  s   



þýz#NSPIAttacks.load_htable_containeridc                 C   sê   i | _ |D ]m}|t }i | j |< |t | j | d< |dkr%d| j d d< n|t | j | d< t|t ƒ| j | d< t|v rHt|t ƒ| j | d< t|v rV|t | j | d< nd| j | d< t|v rk|t | j | d< qd| j | d< qd S )	NÚflagsr   zDefault Global Address ListÚnameÚguidÚparent_guidÚdepthÚ	is_master)	r`   ÚPR_EMS_AB_CONTAINERIDÚPR_CONTAINER_FLAGSÚPR_DISPLAY_NAMEr   Ú
PR_ENTRYIDÚPR_EMS_AB_PARENT_ENTRYIDÚPR_DEPTHÚPR_EMS_AB_IS_MASTER)r-   r`   ÚabrŠ   r.   r.   r/   r‚   3  s$   
éz!NSPIAttacks._parse_and_set_htablec                 C   s   | dkr| S | d d S )Nr   l        r.   )Únumberr.   r.   r/   r{   O  s   zNSPIAttacks._int_to_dwordNc           	      C   sª  g }| j D ],}|d krd| j | vr| |¡ q|d kr1d| j | v r1| j | d |kr1| |¡ q|D ]¡}| j | }d|d< d|d  }td||d f ƒ d|v r]td	||d f ƒ |d
krst |d ¡ ¡ }td||f ƒ ntd| ƒ |d d
kr…td| ƒ | jrÆt |¡}td|||f ƒ d|v r·t |d ¡}|dkr¬td| ƒ ntd|||d f ƒ t	t
|d ƒ}td||f ƒ tƒ  |d
krÕ| j|d d� q4|d k�rQ| j D ]t}| j | d dk�rPtdƒ td| j | d  ƒ tdt | j | d ¡ ¡  ƒ tdt | j | d ¡ ¡  ƒ |d
k �r#t |¡n|}td||f ƒ t	t
| j | d ƒ}td| ƒ | j | d d
k�rMtd| ƒ tƒ  qÞd S d S )Nr�   TÚprintedz    r‘   z%s%srŽ   r†   z%sTotalRecs: %dr   r�   z
%sGuid: %sz%sGuid: Noner’   z'%sPR_EMS_AB_IS_MASTER attribute is set!z%sAssigned MId: 0x%.08X (%d)rˆ   é   z:%sAssigned first record MId: 0x00000002 (MID_END_OF_TABLE)z)%sAssigned first record MId: 0x%.08X (%d)r�   z%sFlags: %s)r�   FzFound parentless object!zName: %szGuid: %szParent guid: %szAssigned MId: 0x%.08X (%d)z	Flags: %s)r`   ÚappendrM   r   Úbin_to_stringÚlowerr&   r\   r{   r	   r   Úprint_htable)	r-   r�   Ú
MIds_printrŠ   rš   Úindentr�   Údwordr�   r.   r.   r/   r¡   V  sf   
(
€

€

  €ózNSPIAttacks.print_htablec                 C   s   t  | j| j¡ | j ¡  d S rA   )r   ÚhNspiUnbindrm   r_   Ú
disconnectr,   r.   r.   r/   r¦   —  s   zNSPIAttacks.disconnectc              	   C   sö   d}|D ]c}|d? }|d@ }|dkrq|dkrqd}|t v r9t | d }|d u r.t | d }|d u r8t | d	 }nd
| }| jrFd||f }t|| tƒr\|  d||  || ¡f ¡ q|  d||| f ¡ q|dkrw|d kry|  |¡ d S d S d S )NTé   éÿÿ  é
   é   Fé   é   rf   z0x%.8xz
%s, 0x%.8xz%s: %s)r   r&   Ú
isinstancer   rM   rV   )r-   Ú	row_simplÚ	delimiterÚemptyÚ
aulPropTagÚ
PropertyIdÚPropertyTypeÚproperty_namer.   r.   r/   Ú	print_row›  s2   €ÿzNSPIAttacks.print_rowc                 C   s^   t | jƒdkr	d S t | j| j¡}|d d D ]}|d }|d@ }|dkr&q| j |¡ qd S )Nr   Ú	ppColumnsr±   ÚDatar¨   rª   )Úlenrc   r   ÚhNspiQueryColumnsrm   r_   rž   )r-   rx   ÚpropÚPropertyTagr³   r.   r.   r/   Ú
load_propsÀ  s   øzNSPIAttacks.load_propsé2   Fc              
   C   sæ  d}d}| j dkr|  ¡  |d kr|d krtdƒ‚|d kr%|d kr%tdƒ‚|d kr9|  |¡ | jd tjkr8dS nd}|| jkrF| j}d}n$|| jkrO| j}n|g kre| j	g kr\|  
¡  | j	}tg}d}ntg}d}|rt| j}| j}d}	 |d krÈtj| j| j| j||d�}	|	d | _z	t |	d ¡}
W n ty¯ } z|	 ¡  t t|ƒ¡ td	ƒ‚d }~ww |rÈt|
ƒd
krºdS |
D ]	}d|vrÅ dS q¼dS |�r0|d krÞg }|
D ]	}| |t ¡ qÓn|}tj| j| j| j |||d�}	z	t |	d ¡}
W n t�y } z|	 ¡  t t|ƒ¡ tdƒ‚d }~ww |�r0t|
ƒd
k�r dS |
D ]}d|v�r, dS �q"dS |�rK|
D ]}t|v �rG|t }|  |¡ �q5	 �q5n|
D ]	}|  |t¡ �qM|d k�r^d S | jd tjk�rid S t|
ƒd
k�rrd S qu)NFr]   úWrong arguments!r‡   T)rz   ÚCountÚ	pPropTagsrz   r   ú#NspiQueryRows returned wrong resultr   l   
 Ú )ry   r¿   rÀ   ÚlpETablezCNspiQueryRows returned wrong result while processing explicit table)ra   rŒ   Ú	Exceptionr~   re   r   ÚMID_END_OF_TABLEÚ
PROPS_GUIDÚPROPS_MINUMALrc   r¼   ÚPR_INSTANCE_KEYÚhNspiQueryRowsrm   r_   r�   ÚdumpRawri   ÚerrorrP   r¸   rž   ÚPR_EMS_AB_OBJECT_GUIDrM   rµ   Ú	DELIMITER)r-   r}   Úattrsr†   ÚeTableÚ	onlyCheckÚprintOnlyGUIDsÚuseAsExplicitTableÚfirstReqPropsrx   Ú	resp_rowsÚeÚrowÚ	eTableIntÚ
objectGuidr.   r.   r/   Úreq_print_table_rowsÐ  s¾   

þ


ÿ
€ýÿÿ
ÿ€ý
ÿ
ú
ªz NSPIAttacks.req_print_table_rowsc           
      C   s   |d kr|d krt dƒ‚|d kr|d krt dƒ‚|g kr(| jg kr%|  ¡  | j}|r;|  |g|¡}|dkr9t dƒ‚d S t|dƒ}| ¡ }	 g }|dkrLn.t|ƒD ]}	| ¡ }| ¡ }|dksd|d dkreqP| |¡ qPt	|ƒdkrrqD|  ||t
¡ qE| ¡  d S )Nr¾   r   z%Object with specified GUID not found!ÚrTr   ú#)rÃ   rc   r¼   Ú_req_print_guidrG   ÚreadlineÚrangeÚstriprž   r¸   rÌ   rW   )
r-   r�   rÍ   r†   ÚguidFileÚprintedLinesÚfdÚlineÚguidListÚir.   r.   r/   Úreq_print_guid`  s<   

ëzNSPIAttacks.req_print_guidc           
   
   C   s¸   g }|D ]}|  t|dd�¡ qtj| j| j||d�}z|d d dkr'W dS t |d ¡}W n tyJ } z| ¡  t	 
t|ƒ¡ tdƒ‚d }~ww |D ]}	|  |	|¡ qM|d d S )NT)Úminimize)rÀ   ÚpaStrr   ÚcRowsr   z'NspiResolveNamesW returned wrong result)rž   r   r   ÚhNspiResolveNamesWrm   r_   r�   rÃ   rÉ   ri   rÊ   rP   rµ   )
r-   rã   rÍ   r¯   ÚlegacyDNListr�   rx   rÓ   rÔ   rÕ   r.   r.   r/   rÛ   Ž  s"   €ýzNSPIAttacks._req_print_guidc                 C   s  |dks|dk s|dk s|dks|dkrt dƒ‚||kr!|}d}n| }d}||7 }|}|| }		 |dkr<|	|kr<|}	n
|dk rF|	|k rF|}	|  d||	| f ¡ |rm| j|t||	|ƒdd�}
|
rl| j|t||	|ƒd	� n| j|t||	|ƒd	� |	|kr~d S ||7 }|	|7 }	q1)
Nr   l   ÿÿ r¾   r«   r]   Tz# MIds %d-%d:)rÍ   rÎ   rÏ   )rÍ   rÎ   )rÃ   rM   rØ   rÝ   )r-   Ú	start_dntÚstop_dntrÍ   r†   ÚcheckIfEmptyÚstepÚrstepÚdnt1Údnt2Úexistsr.   r.   r/   Úreq_print_dnt­  s6   (€ìzNSPIAttacks.req_print_dnt)r   rA   )rY   rZ   r[   rË   rÅ   rÆ   ÚPROPS_EXTENDEDrh   r0   r7   r~   r„   r‹   rŒ   r‚   Ústaticmethodr{   r¡   r¦   rµ   r¼   rØ   rå   rÛ   ró   r.   r.   r.   r/   r\   ˆ   s.    	R


A
% 
.r\   c                   @   sL   e Zd Zdd„ Zdd„ Zdd„ Zdd„ Zd	d
„ Zdd„ Zdd„ Z	dd„ Z
dS )ÚExchangerHelperc                 C   s"   || _ || _|| _|| _d | _d S rA   )Ú_ExchangerHelper__domainÚ_ExchangerHelper__usernameÚ_ExchangerHelper__passwordÚ_ExchangerHelper__remoteNameÚexch)r-   r=   r;   r<   rv   r.   r.   r/   r0   Ó  s
   
zExchangerHelper.__init__c                 C   sD   |j  ¡ }|j ¡ }|dkr|  ||¡ |  ||¡ d S td| ƒ‚)Nr   z%s module not found)Úmoduler    Ú	submoduleÚ
nspi_checkÚnspi_runrÃ   )r-   rn   rü   rý   r.   r.   r/   ÚrunÛ  s   

zExchangerHelper.runc                 C   s¾   t ƒ | _| j | j| j| j|j¡ | j |j¡ |dv r(|j	d kr(| j 
|j	¡ | j | j|j¡ |dkr;|  |¡ n|dkrE|  |¡ n|dkrO|  |¡ n	|dkrX|  |¡ | j ¡  d S )N)údump-tablesú
guid-knownú
dnt-lookupúlist-tablesr  r  r  )r\   rû   r?   rø   rù   r÷   r>   rC   rj   Úoutput_filerI   r7   rú   Úrpc_hostnameÚnspi_list_tablesÚnspi_dump_tablesÚnspi_guid_knownÚnspi_dnt_lookupr¦   ©r-   rý   rn   r.   r.   r/   rÿ   æ  s   
zExchangerHelper.nspi_runc                 C   sÌ   |dkr|j d kr|jd krt ¡  t d¡ |dkr/|j d kr/|jd kr/t d¡ t d¡ |dkrF|jd krF|jd krFt	 ¡  t d¡ |dkr`|jd krb|jd krdt d¡ t d¡ d S d S d S d S )Nr  r«   z"Specify only one of -name or -guidr  z'Specify only one of -guid or -guid-file)
rŽ   r�   Údump_tablesÚ
print_helpÚsysÚexitri   rÊ   Ú	guid_fileÚ
guid_knownr  r.   r.   r/   rþ   û  s   




þzExchangerHelper.nspi_checkc                 C   s(   | j  ¡  |jr| j  ¡  | j  ¡  d S rA   )rû   r„   r†   r‹   r¡   )r-   rn   r.   r.   r/   r    s   

z ExchangerHelper.nspi_list_tablesc                 C   s®  | j  |j¡ |jd ks|jdkrtj}n|jdkrtj}n|jdkr'tj}ng }|jd kr=|j 	¡ dv r=t
 d¡ d}n�| j  ¡  |jd krXt
 d|j ¡ t |j¡}d }nd }|j}d}| j jD ]Z}|dkrjqc|d ur”| j j| d |kr“t
 d	||jf ¡ t
 d
| j j| d  ¡ |} n+qc| j j| d |kr½t | j j| d ¡}t
 d	||f ¡ t
 d| ¡ |} nqc|dkrÌt
 d¡ t d¡ | j  |||j¡ d S )NÚMINIMALÚEXTENDEDÚGUIDS)Úgalzdefault global address listzglobal address listzLookuping Global Address Listr   z/Search for an address book with objectGUID = %sr�   z MId %d is assigned for %s objectzLookuping %srŽ   z+Lookuping address book with objectGUID = %sz!Specified address book not found!r«   )rû   rF   rE   Úlookup_typer\   rÆ   rô   rÅ   rŽ   r    ri   Úinfor„   r�   r   Ústring_to_binr`   rj   rŸ   rÊ   r  r  rØ   Úrows_per_request)r-   rn   ÚpropTagsr}   r�   rŽ   rŠ   r.   r.   r/   r    sP   




üû

z ExchangerHelper.nspi_dump_tablesc                 C   sx   | j  |j¡ |jd ks|jdkrtj}n|jdkrtj}ng }|jd kr/| j  |j|¡ d S | j j||j	|j
d� d S )Nr  r  )rÍ   r†   rß   )rû   rF   rE   r  r\   rÆ   rô   r�   rå   r  r  ©r-   rn   r  r.   r.   r/   r	  R  s   

zExchangerHelper.nspi_guid_knownc                 C   sR   |j d ks
|j dkrtj}n|j dkrtj}ng }| jj|j|j||jdd� d S )Nr  r  T)rÍ   r†   rí   )	r  r\   rô   rÅ   rû   ró   rë   rì   r  r  r.   r.   r/   r
  b  s   

ÿzExchangerHelper.nspi_dnt_lookupN)rY   rZ   r[   r0   r   rÿ   rþ   r  r  r	  r
  r.   r.   r.   r/   rö   Ò  s    >rö   Ú__main__Úutf8c                   @   s   e Zd Zdd„ ZdS )ÚSmartFormatterc                 C   s*   |  d¡r|dd …  ¡ S tj | ||¡S )NzR|r�   )Ú
startswithÚ
splitlinesÚargparseÚHelpFormatterÚ_split_lines)r-   rN   Úwidthr.   r.   r/   r#  x  s   
zSmartFormatter._split_linesN)rY   rZ   r[   r#  r.   r.   r.   r/   r  w  s    r  c                 C   s   |   t ¡ ¡}|S rA   )Údecoder  Úgetfilesystemencoding)Ú
bytestringÚunicode_stringr.   r.   r/   Úlocalized_arg~  s   r)  Tz!A tool to abuse Exchange services)Úadd_helpÚdescriptionÚtargetÚstorez6[[domain/]username[:password]@]<targetName or address>)ÚactionÚhelpz-debugÚ
store_truez!Turn DEBUG and EXTENDED output ONz-tsz&Adds timestamp to every logging outputz-rpc-hostnamezoA name of the server in GUID (preferred) or NetBIOS name format (see description in the beggining of this file)Úauthenticationz-hasheszLMHASH:NTHASHz$NTLM hashes, format is LMHASH:NTHASH)r.  Úmetavarr/  zA module namerü   )r/  ÚdestÚrequired)r/  r3  r   zAttack NSPI interface)r/  zA submodule namerý   r  zList Address Booksz-countz-Request total number of records in each tablez-basicz,Authenticate with Basic Auth instead of NTLMr  zDump Address Books)Úformatter_classr/  z-lookup-type)r  r  ÚFULLr  ú?r  z¼R|Lookup type:
  MINIMAL  - Request limited set of fields (default)
  EXTENDED - Request extended set of fields
  FULL     - Request all fields for each row
  GUIDS    - Request only GUIDs)ÚchoicesÚnargsÚdefaultr/  z-rows-per-requestÚ50r½   z$Limit the number of rows per request)r.  Útyper2  r:  r/  z-namez-Dump table with the specified name (inc. GAL))r.  r/  r<  z-guidz"Dump table with the specified GUIDz-output-typer    rS   z Output format for binary objectsz-output-filezOutput filenamer  z1Retrieve Active Directory objects by GUID / GUIDsz#Dump object with the specified GUIDz
-guid-filez"Dump objects using GUIDs from file)r  r  r6  zœR|Lookup type:
  MINIMAL  - Request limited set of fields (default)
  EXTENDED - Request extended set of fields
  FULL     - Request all fields for each rowr  zLookup Distinguished Name Tags)r  r6  r  r  z‘R|Lookup type:
  EXTENDED - Request extended set of fields (default)
  FULL     - Request all fields for each row
  GUIDS    - Request only GUIDsÚ350i^  z
-start-dntÚ500000i ¡ zA DNT to start fromz	-stop-dntÚ0zA DNT to lookup tor«   r   )Úgetpassz	Password:z-rpc-hostname cannot be emptyÚKeyboardInterruptzProtocol failed: %srÁ   a  Most likely ntdsai.dll in lsass.exe has crashed on a Domain Controller while processing a DNT which does not support to be requested via MS-NSPI. The DC is probably rebooting. This can happend in Multi-Tenant Environment. You can try to request different DNT rangezConnection reset by peerzTThis usually means the target has no ACL to connect to this endpoint using RPC ProxyzIs the server a MS Exchange?zLTry to specify -rpc-hostname (see description in the beggining of this file)zYTry to specify different -rpc-hostname, or enumerate endpoints via rpcmap.py / rpcdump.pyzqCannot determine the right RPC Server name. Specify -rpc-hostname (see description in the beggining of this file)zMThe specified RPC Server is incorrect. Try to specify different -rpc-hostnamezESpecify -rpc-hostname (see description in the beggining of this file)zWrong credentials!zlThe server requested Basic authentication which may require you to specify the domain. Your domain is empty!zBA proxy in front of the target server detected (may be WAF / SIEM))nÚ
__future__r   rS   Úcodecsri   r!  rQ   r  Úsixr   Úimpacketr   r   Úimpacket.httpr   Úimpacket.examplesr   Úimpacket.examples.utilsr   Úimpacket.structurer	   Úimpacket.dcerpc.v5r
   r   Úimpacket.mapi_constantsr   r   Úimpacket.dcerpc.v5.nspir   r   r   r   Úimpacket.dcerpc.v5.rpchr   r   r   r   r   r   Úversion_infoÚPY37ORHIGHERr”   r–   r˜   r™   r“   r—   r•   rË   rÇ   rÌ   r   r\   rö   rY   ÚstdoutÚencodingÚ	getwriterrM   ÚBANNERr"  r  r)  ÚArgumentParserÚparserÚadd_argumentÚadd_argument_groupÚgroupÚadd_subparsersÚ
subparsersÚ
add_parserÚnspi_parserÚnspi_attacksÚlist_tablesr  Úintr  Ú
dnt_lookupr¸   Úargvr  r  Ú
parse_argsrn   ÚinitÚtsrj   r,  r=   r;   r<   rv   r>   r@  r  rÊ   Ú
exchHelperr   rA  rÃ   rÔ   Ú
error_textÚcriticalrý   r    rû   r)   Úrts_ping_receivedÚget_auth_typer  r.   r.   r.   r/   Ú<module>   sJ   
H    N 


ÿÿ
ÿÿÿÿÿÿÿÿÿÿÿ

 







	











ÿ€À �ø