o
    àý°jv  ã                   @   sX  d dl Z d dlZd dlZd dlZd dlZd dlmZmZ d dlZd dl	Z	d dl
Z
d dlZd dlmZ d dlmZ d dlmZmZ d dlmZ d dlmZ d dlmZ d d	lmZmZ d d
lmZ d dlmZ e jj Z!G dd„ deƒZ"G dd„ deƒZ#dZ$dZ%dZ&eƒ Z'G dd„ dƒZ(G dd„ deƒZ)G dd„ de)ƒZ*G dd„ de)ƒZ+G dd„ dej,ƒZ-G dd„ de)ƒZ.e/dk�r*e0ej1ƒ ej2d d!d"�Z3e3j4d#d$d%d&� e3j4d'd(d)d*d+� e3j4d,d$d-d.d/� e3j4d0d$d1d&� e3j4d2d$d3d&� e3j4d4d5d6d&� e3j4d7d5d8d&� e3j4d9d$d:e! d&� e3 5d;¡Z6e6j4d<d$d=d>d/� e6j4d?d5d@d&� e6j4dAd5dBd&� e6j4dCd$dDdEd/� e6j4dFd$dGd&� e3 5dH¡Z6e6j4dId$dJdKd/� e6j4dLd$dJdMd/� e6j4dNdOdPgdQdPdRdSdT� e6j4dUd$dVdWdXdY� e6j4dZd$d[dd\dY� e7e j8ƒd]k�r€e3 9¡  e  :d]¡ e3 ;¡ Z<e =e<j>e<j?¡ e<j@du�r–e<j@Z!ne!du �r�d^Z!ee<jAƒ\ZBZCZDZEeBdu �r­dWZBe<jFdu�r¿e Ge<jFeCeBe<¡ d e<_He<jIdu �rÈeEe<_IeDdWk�rîeCdWk�rîe<jJdu �rîe<jKd_u �rîe<jLdu �rîd d`lMmMZM eMdaƒZDe<jLdu�r÷d e<_Hd) Ne<jO¡ZOeOd)k�rdbZOe(eOe<jPe<jQe<jReSe<jTƒeCeDeBe<jJe<jLe<jHe<jUe<jVe<jWƒZXeX YeEe<jI¡ dS dS )cé    N)ÚThreadÚLock)ÚPY3)Úlogger)ÚversionÚsmb)ÚSMBConnection)Ú	transport)Ú	Structure)Ú	remcomsvcÚserviceinstall)Úparse_target)ÚKeytabc                   @   ó   e Zd ZdZdS )ÚRemComMessage))ÚCommandz4096s="")Ú
WorkingDirú260s="")ÚPriorityz<L=0x20)Ú	ProcessIDz<L=0x01)ÚMachiner   )ÚNoWaitú<L=0N©Ú__name__Ú
__module__Ú__qualname__Ú	structure© r   r   ú†/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/../../../bin/psexec.pyr   -   ó    r   c                   @   r   )ÚRemComResponse))Ú	ErrorCoder   )Ú
ReturnCoder   Nr   r   r   r   r   r!   7   r    r!   ÚRemCom_stdoutÚRemCom_stdinÚRemCom_stderrc                   @   s4   e Zd Z			ddd„Zdd„ Zd	d
„ Zdd„ ZdS )ÚPSEXECé½  Ú NFc                 C   s|   || _ || _|| _|| _|| _|| _d| _d| _|
| _|| _	|| _
|| _|| _|| _|| _|	d ur<|	 d¡\| _| _d S d S )Nr)   ú:)Ú_PSEXEC__usernameÚ_PSEXEC__passwordÚ_PSEXEC__portÚ_PSEXEC__commandÚ_PSEXEC__pathÚ_PSEXEC__domainÚ_PSEXEC__lmhashÚ_PSEXEC__nthashÚ_PSEXEC__aesKeyÚ_PSEXEC__exeFileÚ_PSEXEC__copyFileÚ_PSEXEC__doKerberosÚ_PSEXEC__kdcHostÚ_PSEXEC__serviceNameÚ_PSEXEC__remoteBinaryNameÚsplit)ÚselfÚcommandÚpathÚexeFileÚcopyFileÚportÚusernameÚpasswordÚdomainÚhashesÚaesKeyÚ
doKerberosÚkdcHostÚserviceNameÚremoteBinaryNamer   r   r   Ú__init__D   s$   ÿzPSEXEC.__init__c                 C   s~   d| }t  d| ¡ t |¡}| | j¡ | |¡ t|dƒr0| | j	| j
| j| j| j| j¡ | | j| j¡ |  |¡ d S )Nzncacn_np:%s[\pipe\svcctl]zStringBinding %sÚset_credentials)ÚloggingÚdebugr	   ÚDCERPCTransportFactoryÚ	set_dportr-   ÚsetRemoteHostÚhasattrrK   r+   r,   r0   r1   r2   r3   Úset_kerberosr6   r7   ÚdoStuff)r;   Ú
remoteNameÚ
remoteHostÚstringbindingÚrpctransportr   r   r   ÚrunY   s   


ÿz
PSEXEC.runc                 C   s€   d}d}|du r,|dkr,z
|  ||¡ d}W n   |d8 }t d¡ Y |du r,|dks|dkr4tdƒ‚|j|||dd	d
�}|S )NFé2   r   Té   é   zPipe not ready, abortingé@   é€   ©ÚcreationOptionÚfileAttributes)ÚwaitNamedPipeÚtimeÚsleepÚ	ExceptionÚopenFile)r;   ÚsÚtidÚpipeÚ
accessMaskÚ	pipeReadyÚtriesÚfidr   r   r   ÚopenPipef   s   
ù	zPSEXEC.openPipec              
   C   sÈ  |  ¡ }z| ¡  W n. ty8 } z"t ¡ jtjkr"dd l}| ¡  t 	t
|ƒ¡ t d¡ W Y d }~nd }~ww | ¡  ¡ a�zId}| ¡ }| d¡ | jd u r`t | ¡ t ¡ | j| j¡}n3zt| jdƒ}W n ty† } zt 	t
|ƒ¡ t d¡ W Y d }~nd }~ww t | ¡ || j| j¡}| ¡ du rœW d S | jd ur¥| ¡  | jd urÆ| | j| ¡ tj  | j¡¡ tj  | j¡d | j! | _!| "d¡}	|  #||	dd	¡}
t$ƒ }t %¡ }d
 &dd„ t'dƒD ƒ¡|d< | j(d urò| j(|d< | j!|d< ||d< | )|	|
| *¡ ¡ d
a+t,|dt-|d |d f t.j/t.j0B | ¡ ƒ}| 1¡  t2|dt3|d |d f t.j4ƒ}| 1¡  t5|dt6|d |d f t.j4ƒ}| 1¡  | 7|	|
d¡}t8|ƒ�rgt9|ƒ}t :d| j!|d |d f ¡ | ;¡  | jd u�r~| <| ¡ tj  | j¡¡ d}t |d ¡ W d S  t=�y’   ‚  t�yã } zEt ¡ jtjk�r«dd l}| ¡  t >t
|ƒ¡ |du �rÎ| ;¡  | jd u�rÎ| <| ¡ tj  | j¡¡ tj? @¡  t d¡ W Y d }~d S d }~ww )Nr   rZ   Fi † Úrbú úIPC$z\RemCom_communicatoniŸ r)   c                 S   s   g | ]}t  tj¡‘qS r   )ÚrandomÚchoiceÚstringÚascii_letters)Ú.0Ú_r   r   r   Ú
<listcomp>ª   s    z"PSEXEC.doStuff.<locals>.<listcomp>é   r   r   r   r   z\%s%s%dé   z6Process %s finished with ErrorCode: %d, ReturnCode: %dr"   r#   T)AÚget_dce_rpcÚconnectrd   rL   Ú	getLoggerÚlevelÚDEBUGÚ	tracebackÚ	print_excÚcriticalÚstrÚsysÚexitÚget_smb_connectionÚ
getDialectÚdialectÚ
setTimeoutr4   r   ÚServiceInstallr   Ú	RemComSvcr8   r9   ÚopenÚinstallÚcloser5   Ú	copy_fileÚgetShareÚosr=   Úbasenamer.   ÚconnectTreerm   r   ÚgetpidÚjoinÚranger/   ÚwriteNamedPipeÚgetDataÚLastDataSentÚRemoteStdInPipeÚRemComSTDINr   ÚFILE_WRITE_DATAÚFILE_APPEND_DATAÚstartÚRemoteStdOutPipeÚRemComSTDOUTÚFILE_READ_DATAÚRemoteStdErrPipeÚRemComSTDERRÚreadNamedPipeÚlenr!   ÚinfoÚ	uninstallÚ
deleteFileÚ
SystemExitrM   ÚstdoutÚflush)r;   rW   ÚdceÚer   ÚunInstalledrf   ÚinstallServiceÚfrg   Úfid_mainÚpacketÚpidÚ
stdin_pipeÚstdout_pipeÚstderr_pipeÚansÚretCoder   r   r   rS   y   sª   €û

€þ





þþþ
ÿ

€özPSEXEC.doStuff)
r(   r)   r)   r)   NNFNNN)r   r   r   rJ   rX   rm   rS   r   r   r   r   r'   C   s    
þr'   c                   @   ó   e Zd Zddd„Zdd„ ZdS )ÚPipesNc                 C   sR   t  | ¡ d| _|| _| ¡ | _d| _d| _|| _| 	¡ | _
|| _|| _d| _d S )Nr   T)r   rJ   Úserverr	   Úget_credentialsÚcredentialsrg   rl   ÚshareÚ	get_dportr@   rh   ÚpermissionsÚdaemon)r;   r	   rh   r¿   r½   r   r   r   rJ   ã   s   



zPipes.__init__c           
      C   s$  zst  ¡  t| j ¡  ¡ | j ¡  ¡ | jtd�| _	| j
\}}}}}}}}| j ¡ du r>| j	j||||||| j ¡ ||d�	 n
| j	 |||||¡ t  ¡  | j	 d¡| _| j	 | j| j¡ | j	j| j| j| jddd�| _| j	 d¡ W d S    t ¡ jtjkr‡d	d l}	|	 ¡  t d
| j ¡ Y d S )N©Ú	sess_portÚpreferredDialectT©rG   ÚTGTÚTGSrp   r\   r]   r^   i@B r   z9Something wen't wrong connecting the pipes(%s), try again) ÚlockÚacquirer   r	   r…   ÚgetRemoteNameÚgetRemoteHostr@   r‡   rº   r¼   Úget_kerberosÚkerberosLoginÚget_kdcHostÚloginÚreleaser’   rg   ra   rh   re   r¿   rl   rˆ   rL   r|   r}   r~   r   r€   ÚerrorÚ	__class__)
r;   ÚuserÚpasswdrC   ÚlmÚntrE   rÅ   rÆ   r   r   r   r   ÚconnectPipeð   s&   ÿ&zPipes.connectPipe©N)r   r   r   rJ   rÖ   r   r   r   r   r¹   â   s    
r¹   c                   @   ó   e Zd Zdd„ Zdd„ ZdS )rž   c                 C   ó   t  | |||¡ d S r×   ©r¹   rJ   ©r;   r	   rh   Úpermisssionsr   r   r   rJ   
  ó   zRemoteStdOutPipe.__init__c              
   C   s6  |   ¡  tr—d\}}	 z| j | j| jdd¡}W n   Y nxzs|tkr-t|ƒdkr-||7 }d}tt	 
||¡d uƒ}|dkrD|d }d}nd|v r\| d¡}d |d d	… ¡d }|d	 }t|ƒdkrŽztj | t¡¡ tj ¡  d}W n ty�   t d
¡ t|jtdd�ƒ d}Y nw daW n   Y qd\}}	 z| j | j| jdd¡}W n   Y nkzW|tkr¾t|ƒdkr¾||7 }d}tt	 
||¡d uƒ}|rÓ|d }d}nd|v rë| d¡}d |d d	… ¡d }|d	 }t|ƒdk�rtj | t¡¡ tj ¡  d}ndaW n t�y } zW Y d }~nd }~ww qœ)N©ó    rß   Tr   é   sG   ([a-zA-Z]:[\\\/])((([a-zA-Z0-9 -\.]*)[\\\/]?)+(([a-zA-Z0-9 -\.]+))?)?>$ó    rß   ó   
éÿÿÿÿúàDecoding error detected, consider running chcp.com at the target,
map the result with https://docs.python.org/3/library/codecs.html#standard-encodings
and then execute smbexec.py again with -codec and the corresponding codecÚreplace©Úerrors©r)   r)   zG([a-zA-Z]:[\\\/])((([a-zA-Z0-9 -\.]*)[\\\/]?)+(([a-zA-Z0-9 -\.]+))?)?>$ro   r)   Ú
)rÖ   r   rº   ÚreadFilerg   rl   r˜   r¤   ÚboolÚreÚmatchr:   r”   rƒ   r©   ÚwriteÚdecodeÚCODECrª   ÚUnicodeDecodeErrorrL   rÐ   Úprintrd   )r;   Ú%_RemoteStdOutPipe__stdoutOutputBufferÚ_RemoteStdOutPipe__stdoutDataÚ
stdout_ansÚpromptRegexÚendsWithPromptÚlinesr¬   r   r   r   rX     s„   


û€È:

€€ÿÖzRemoteStdOutPipe.runN©r   r   r   rJ   rX   r   r   r   r   rž   	  ó    rž   c                   @   rØ   )r¡   c                 C   rÙ   r×   rÚ   rÛ   r   r   r   rJ   €  rÝ   zRemoteStdErrPipe.__init__c              
   C   sÊ  |   ¡  trŠd\}}	 z| j | j| jdd¡}W n   Y nkzXt|ƒdkr)||7 }d|v rA| d¡}d |d d… ¡d }|d }t|ƒdkrszt	j
 | t¡¡ t	j
 ¡  d}W n tyr   t d¡ t|jtd	d
�ƒ d}Y nw d}W n tyˆ } zW Y d }~nd }~ww qd\}}	 z| j | j| jdd¡}W n   Y nBz=t|ƒdkr­||7 }d|v rÅ| d¡}d |d d… ¡d }|d }t|ƒdkrÜt	j
 | t¡¡ t	j
 ¡  d}nd}W n   Y q�)NrÞ   Tr   rà   râ   rã   rß   rä   rå   ræ   rè   ré   r)   )rÖ   r   rº   rê   rg   rl   r¤   r:   r”   rƒ   r©   rî   rï   rð   rª   rñ   rL   rÐ   rò   rd   )r;   Ú%_RemoteStdErrPipe__stderrOutputBufferÚ_RemoteStdErrPipe__stderrDataÚ
stderr_ansrø   r˜   r¬   r   r   r   rX   ƒ  sl   


û€€ÿÚ)

€àzRemoteStdErrPipe.runNrù   r   r   r   r   r¡     rú   r¡   c                   @   s^   e Zd Zdd„ Zdd„ Zdd„ Zdd„ Zd	d
„ Zdd„ Zdd„ Z	dd„ Z
dd„ Zddd„ZdS )ÚRemoteShellc                 C   sN   t j | d¡ d| _|| _d | _|| _|| _|| _|| _	|| _
|| _d| _d S )NFúz'[!] Press help for extra shell commands)ÚcmdÚCmdrJ   Úpromptrº   ÚtransferClientrg   rl   r¼   r½   r@   r	   Úintro)r;   rº   r@   r¼   rg   rl   r½   r	   r   r   r   rJ   Ø  s   
zRemoteShell.__init__c           	      C   s~   t d| j ¡ | jtd�| _| j\}}}}}}}}| j ¡ du r3| jj	||||||| j 
¡ ||d�	 d S | j |||||¡ d S )Nz
*SMBSERVERrÁ   TrÄ   )r   rº   rÊ   r@   r‡   r  r¼   r	   rË   rÌ   rÍ   rÎ   )	r;   rÒ   rÓ   rC   rÔ   rÕ   rE   rÅ   rÆ   r   r   r   Úconnect_transferClientå  s   ÿ
ÿz"RemoteShell.connect_transferClientc                 C   s$   t d| j| jf ƒ |  dd¡ d S )Na®  
 lcd {path}                 - changes the current local directory to {path}
 exit                       - terminates the server process (and this session)
 lput {src_file, dst_path}   - uploads a local file to the dst_path RELATIVE to the connected share (%s)
 lget {file}                 - downloads pathname RELATIVE to the connected share (%s) to the current local dir
 ! {cmd}                    - executes a local shell cmd
ú
F)rò   r½   Ú	send_data©r;   Úliner   r   r   Údo_helpð  s   
úzRemoteShell.do_helpc                 C   s   t  |¡ |  d¡ d S ©Nr  )r�   Úsystemr  ©r;   rf   r   r   r   Údo_shellú  s   
zRemoteShell.do_shellc              
   C   s¤   z1| j d u r
|  ¡  dd l}| |¡}t|dƒ}t d| j|f ¡ | j  | j||j	¡ | 
¡  W n tyJ } zt t|ƒ¡ W Y d }~nd }~ww |  d¡ d S )Nr   ÚwbzDownloading %s\%sr  )r  r  Úntpathr‘   r‹   rL   r¥   r½   ÚgetFilerî   r�   rd   r�   r‚   r  )r;   Úsrc_pathr  ÚfilenameÚfhr¬   r   r   r   Údo_lgetþ  s   


€þzRemoteShell.do_lgetc           
   
   C   s  zm| j d u r
|  ¡  | d¡}t|ƒdkr|d }|d }nt|ƒdkr*|d }d}tj |¡}t|dƒ}|d | }| dd¡}t	 
d|| j|f ¡ trY| j  | j||j¡ n| j  | j| tjj¡|j¡ | ¡  W n ty† }	 zt	 t|	ƒ¡ W Y d }	~	nd }	~	ww |  d¡ d S )	Nro   rZ   r   ú/rn   ú\zUploading %s to %s\%sr  )r  r  r:   r¤   r�   r=   r‘   r‹   rå   rL   r¥   r½   r   ÚputFileÚreadrï   rƒ   ÚstdinÚencodingr�   rd   rÐ   r‚   r  )
r;   rf   Úparamsr  Údst_pathÚsrc_filer  r¯   Úpathnamer¬   r   r   r   Údo_lput  s2   



€þzRemoteShell.do_lputc                 C   s.   |dkrt t ¡ ƒ nt |¡ |  d¡ d S )Nr)   r  )rò   r�   ÚgetcwdÚchdirr  r  r   r   r   Údo_lcd+  s   
zRemoteShell.do_lcdc                 C   s   |   d¡ d S r  )r  ©r;   r   r   r   Ú	emptyline2  s   
zRemoteShell.emptylinec                 C   s>   t r|  | t¡d ¡ d S |  | tjj¡ t¡d ¡ d S )Ns   
r  )r   r  Úencoderð   rï   rƒ   r  r  r  r   r   r   Údefault6  s   "zRemoteShell.defaultTc                 C   s*   |du r|a nda | j | j| j|¡ d S )NTr)   )r˜   rº   Ú	writeFilerg   rl   )r;   ÚdataÚ
hideOutputr   r   r   r  <  s   zRemoteShell.send_dataN)T)r   r   r   rJ   r  r
  r  r  r   r#  r%  r'  r  r   r   r   r   rþ   ×  s    
rþ   c                   @   r¸   )r™   Nc                 C   s   d | _ t | ||||¡ d S r×   )Úshellr¹   rJ   )r;   r	   rh   rÜ   r½   r   r   r   rJ   E  s   zRemoteStdInPipe.__init__c                 C   s:   |   ¡  t| j| j| j| j| j| j| jƒ| _	| j	 
¡  d S r×   )rÖ   rþ   rº   r@   r¼   rg   rl   r½   r	   r+  Úcmdloopr$  r   r   r   rX   I  s   $zRemoteStdInPipe.runr×   rù   r   r   r   r   r™   D  s    
r™   Ú__main__Tz2PSEXEC like functionality example using RemComSvc.)Úadd_helpÚdescriptionÚtargetÚstorez6[[domain/]username[:password]@]<targetName or address>)ÚactionÚhelpr<   Ú*ro   z\command (or arguments if -c is used) to execute at the target (w/o path) - (default:cmd.exe))Únargsr'  r3  z-cr  zQcopy the filename for later execution, arguments are passed in the command option)r2  Úmetavarr3  z-pathzpath of the command to executez-filez:alternative RemCom binary (be sure it doesn't require CRT)z-tsÚ
store_truez&adds timestamp to every logging outputz-debugzTurn DEBUG output ONz-codeca  Sets encoding used (codec) from the target's output (default "%s"). If errors are detected, run chcp.com at the target, map the result with https://docs.python.org/3/library/codecs.html#standard-encodings and then execute smbexec.py again with -codec and the corresponding codec Úauthenticationz-hasheszLMHASH:NTHASHz$NTLM hashes, format is LMHASH:NTHASHz-no-passz&don't ask for password (useful for -k)z-kzÁUse Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use the ones specified in the command linez-aesKeyzhex keyz<AES key to use for Kerberos Authentication (128 or 256 bits)z-keytabz"Read keys for SPN from keytab fileÚ
connectionz-dc-ipz
ip addressztIP Address of the domain controller. If omitted it will use the domain part (FQDN) specified in the target parameterz
-target-ipz£IP Address of the target machine. If omitted it will use whatever was specified as target. This is useful when target is the NetBIOS name and you cannot resolve itz-portÚ139Ú445ú?zdestination portz)Destination port to connect to SMB Server)Úchoicesr5  r'  r6  r3  z-service-nameÚservice_namer)   z3The name of the service used to trigger the payload)r2  r6  r'  r3  z-remote-binary-nameÚremote_binary_namez>This will be the name of the executable uploaded on the targetrZ   zutf-8F)Úgetpassz	Password:zcmd.exe)Zrƒ   r�   rì   r   rL   Ú	threadingr   r   Úargparserq   rs   rb   Úsixr   Úimpacket.examplesr   Úimpacketr   r   Úimpacket.smbconnectionr   Úimpacket.dcerpc.v5r	   Úimpacket.structurer
   r   r   Úimpacket.examples.utilsr   Úimpacket.krb5.keytabr   r©   r  rð   r   r!   rŸ   rš   r¢   rÇ   r'   r¹   rž   r¡   r  rþ   r™   r   rò   ÚBANNERÚArgumentParserÚparserÚadd_argumentÚadd_argument_groupÚgroupr¤   ÚargvÚ
print_helpr„   Ú
parse_argsÚoptionsÚinitÚtsrM   Úcodecr0  rC   rA   rB   rT   ÚkeytabÚloadKeysFromKeytabÚkÚ	target_iprD   Úno_passrE   r@  r”   r<   r=   ÚfileÚcÚintr@   Údc_ipr>  r?  ÚexecuterrX   r   r   r   r   Ú<module>   s¼   
  'vXm


ü


ÿ
ÿÿ


8
"ÿª