o j @sddlmZddlmZddlZddlZddlZddlZddlmZddl m Z ddl m Z ddl mZmZmZddlmZdd lmZdd lmZGd d d Zed krHejjdureedeje_ee jeZej ddddej ddddddej ddddej dddde!dZ"e"j dddd d!e"j d"d#d$gdd$d%d&d'e"j d(dd)de!d*Z"e"j d+dd,d-d!e"j d.dd/de"j d0dd1de#ej$d2kre%e&d2e'Z(e)e(j*e(j+e e(j,\Z-Z.Z/Z0e-durd3Z-e/d3kre.d3kre(j1dure(j2d4urdd5l3m3Z3e3d6Z/e(j4dur%e0e(_4ee.e/e-e5e(j6e(j1e(j7e(j8e(j9Z:z e:;e0e(j4WdSYdSdS)7)division)print_functionN)logger) parse_target)version) transportlsatlsad) SID_NAME_USE)MAXIMUM_ALLOWED)DCERPCExceptionc@s@eZdZdddddddZ  dd d Zd d Zd dZdS) LSALookupSidzncacn_np:%s[\pipe\lsarpc]T)bindstrset_host)iNFc Cs\||_||_||_t||_||_d|_d|_||_||_ |dur,| d\|_|_dSdS)Nr:) _LSALookupSid__username_LSALookupSid__password_LSALookupSid__portint_LSALookupSid__maxRid_LSALookupSid__domain_LSALookupSid__lmhash_LSALookupSid__nthash_LSALookupSid__domain_sids_LSALookupSid__doKerberossplit) selfusernamepassworddomainporthashes domain_sids use_kerberosmaxRidr(/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/../../../bin/lookupsid.py__init__,s zLSALookupSid.__init__c Cstd||j|jd|}td|t|}||j||j|j|jdr6| |t |drI| |j |j |j|j|jz |||jWdStyw}ztjtjkrkddl}|tt|d}~ww)NzBrute forcing SIDs at %srzStringBinding %srset_credentialsr)logginginfoKNOWN_PROTOCOLSrrDCERPCTransportFactory set_dport set_kerberosr setRemoteHosthasattrr+rrrrr_LSALookupSid__bruteForcer Exception getLoggerlevelDEBUG traceback print_exccriticalstr)r remoteName remoteHost stringbinding rpctransporter9r(r(r)dump;s(     zLSALookupSid.dumpc Cs|}g}||tjt|ttjB}|d}|j r4t ||tj j }|ddd }nt ||tj j}|ddd }td|d}d } t|| d D]} ||| dkrk||| } n| } | dkrsnt} t||| D] } | |d | q}z t||| tjjWn4ty}z(t|d dkr|| 7}WYd}~qZt|d dkr|}nWYd}~nd}~wwt|ddD])\}}|dtjkrtd|||dd|dd|dt|dj fq|| 7}qZ|!|S)N PolicyHandlePolicyInformationPolicyPrimaryDomainInfoSidPolicyAccountDomainInfo DomainSidzDomain SID is: %sriz-%dSTATUS_NONE_MAPPEDSTATUS_SOME_NOT_MAPPEDTranslatedNamesNamesUsez%d: %s\%s (%s)ReferencedDomainsDomains DomainIndexName)" get_dce_rpcconnectbindrMSRPC_UUID_LSATr hLsarOpenPolicy2r POLICY_LOOKUP_NAMESrhLsarQueryInformationPolicy2POLICY_INFORMATION_CLASSPolicyPrimaryDomainInformationformatCanonicalPolicyAccountDomainInformationr,r-rangelistappendhLsarLookupSidsLSAP_LOOKUP_LEVELLsapLookupWkstar r<find get_packet enumerater SidTypeUnknownprint enumItemsname disconnect)rr@r'dceentriesresp policyHandle domainSidsoFar SIMULTANEOUSj sidsToChecksidsirAnitemr(r(r) __bruteForceUsZ     " zLSALookupSid.__bruteForce)rrrNNFFr)__name__ __module__ __qualname__r.r*rBr4r(r(r(r)r &s  r __main__utf8targetstorez6[[domain/]username[:password]@])actionhelpr'4000?zmax Rid to check (default 4000))rdefaultnargsrz-debug store_truezTurn DEBUG output ONz-tsz&Adds timestamp to every logging output connectionz -target-ipz ip addresszIP Address of the target machine. If omitted it will use whatever was specified as target. This is useful when target is the NetBIOS name and you cannot resolve it)rmetavarrz-port139445zdestination portz)Destination port to connect to SMB Server)choicesrrrrz -domain-sidsz>Enumerate Domain SIDs (will likely forward requests to the DC)authenticationz-hashesz LMHASH:NTHASHz$NTLM hashes, format is LMHASH:NTHASHz-no-passz?don't ask for password (useful when proxying through smbrelayx)z-kzUse Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use the ones specified in the command linerIrF)getpassz Password:)< __future__rrsysr,argparsecodecsimpacket.examplesrimpacket.examples.utilsrimpacketrimpacket.dcerpc.v5rrr impacket.dcerpc.v5.samrr impacket.dcerpc.v5.dtypesr impacket.dcerpc.v5.rpcrtr r rzstdoutencoding getwriterrhBANNERArgumentParserparser add_argumentadd_argument_groupgrouplenargv print_helpexit parse_argsoptionsinittsdebugrr"r r!r=r$no_passr target_iprr#r%kr'lookuprBr(r(r(r)sl         o     ,  $