o
    àý°jß[  ã                   @   sþ  d dl mZmZ d dlmZ d dlmZmZ d dlm	Z	 d dl
mZmZmZmZmZ dZdZdZd	Zd
ZdZd ZdZdZdZdZdZdZdZdZdZdZ dZ!dZ"G dd„ de	ƒZ#G dd„ de	ƒZ$G dd„ de	ƒZ%G dd„ de	ƒZ&G dd„ de%ƒZ'G dd„ de%ƒZ(G dd„ de%ƒZ)G dd „ d eƒZ*G d!d"„ d"eƒZ+G d#d$„ d$eƒZ,e-d%k�r}d d&l.Z.d d&l/Z/d d&l0Z0d d&l1Z1d d'l2m3Z3 d d(l4m5Z5 d d)l6m7Z7m8Z8 z
d d*l9m:Z:m;Z; W n   e1 <d+¡ e0 =d¡ Y G d,d-„ d-ƒZ>dHd/d0„Z?e@e8jAƒ e/jBd1d2d3�ZCeCjDd4d5d6d7� eCjDd8d9d:d;d7� eCjDd<d:d=d7� eCjDd>d:d?d7� eC Ed@¡ZFeFjDdAd5dBdCdD� eGe0jHƒdk�r:eC I¡  e0 =d¡ eC J¡ ZKe LeKjMeKjN¡ eeKjOƒ\ZPZQZRZSePd&u �rVdEZPeRdEk�rpeQdEk�rpeKjTd&u �rpd dFlUmUZU eUdGƒZRe?eSeQeRePeKjTeKjVƒ d&S d&S )Ié    )ÚpackÚunpack)Úlogger)Úparse_targetÚget_connected_socket)Ú	Structure)ÚGSSAPIÚASN1_SEQUENCEÚASN1_OCTET_STRINGÚ
asn1decodeÚ
asn1encodeéà   éÐ   éð   éP   é`   é   é   é   é   é   é   c                   @   ó   e Zd ZdZdS )ÚTPKT))ÚVersionzB=3)ÚReservedúB=0)ÚLengthz>H=len(TPDU)+4)Ú_TPDUz_-TPDUzself["Length"]-4)ÚTPDUú:=""N©Ú__name__Ú
__module__Ú__qualname__Ú	commonHdr© r&   r&   ú‰/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/../../../bin/rdp_check.pyr   :   ó    r   c                   @   ó   e Zd ZdZddd„ZdS )r   ))ÚLengthIndicatorzB=len(VariablePart)+1)ÚCoder   )ÚVariablePartr    Nc                 C   ó   t  | |¡ d| d< d S )NÚ r,   ©r   Ú__init__©ÚselfÚdatar&   r&   r'   r0   J   ó   zTPDU.__init__©N©r"   r#   r$   r%   r0   r&   r&   r&   r'   r   C   s    r   c                   @   r   )ÚCR_TPDU))zDST-REFú<H=0)zSRC-REFr8   )zCLASS-OPTIONr   )ÚTyper   )ÚFlagsr   )r   z<H=8Nr!   r&   r&   r&   r'   r7   N   r(   r7   c                   @   r)   )Ú	DATA_TPDU))ÚEOTzB=0x80)ÚUserDatar    Nc                 C   r-   )Nr.   r=   r/   r1   r&   r&   r'   r0   ^   r4   zDATA_TPDU.__init__r5   r6   r&   r&   r&   r'   r;   X   s    r;   c                   @   r)   )ÚRDP_NEG_REQ))ÚrequestedProtocolsú<LNc                 C   s$   t  | |¡ |d u rt| d< d S d S )Nr9   )r7   r0   ÚTYPE_RDP_NEG_REQr1   r&   r&   r'   r0   g   s   ÿzRDP_NEG_REQ.__init__r5   )r"   r#   r$   Ú	structurer0   r&   r&   r&   r'   r>   c   s    r>   c                   @   r   )ÚRDP_NEG_RSP))ÚselectedProtocolsr@   N©r"   r#   r$   rB   r&   r&   r&   r'   rC   l   r(   rC   c                   @   r   )ÚRDP_NEG_FAILURE))ÚfailureCoder@   NrE   r&   r&   r&   r'   rF   q   r(   rF   c                   @   ó   e Zd Zddd„Zdd„ ZdS )ÚTSPasswordCredsNc                 C   ó   t  | |¡ | d= d S ©NÚUUID©r   r0   r1   r&   r&   r'   r0   |   ó   
zTSPasswordCreds.__init__c              	   C   s”   t dtƒ}|tt ddƒtt dtƒt| d  d¡ƒ ƒ t ddƒ tt dtƒt| d  d¡ƒ ƒ t ddƒ tt dtƒt| d  d¡ƒ ƒ ƒ7 }|S )	NÚBé    Ú
domainNamezutf-16leé¡   ÚuserNameé¢   Úpassword)r   r	   r   r
   Úencode)r2   Úansr&   r&   r'   ÚgetData€   s&   

ÿÿý
ÿüú
ÿù	zTSPasswordCreds.getDatar5   ©r"   r#   r$   r0   rX   r&   r&   r&   r'   rI   v   s    
rI   c                   @   rH   )ÚTSCredentialsNc                 C   rJ   rK   rM   r1   r&   r&   r'   r0   ’   rN   zTSCredentials.__init__c              
   C   sl   t ddƒ}|tt dtƒt| d ƒ ƒ7 }t dtƒ}|tt ddƒtt ddƒtt d| d ƒƒ ƒ | ƒ7 }|S )NrO   rR   ÚcredentialsrP   r   ÚcredType)r   r   r
   r	   )r2   r[   rW   r&   r&   r'   rX   –   s   

ÿ

ÿÿýzTSCredentials.getDatar5   rY   r&   r&   r&   r'   rZ   �   s    
rZ   c                   @   s(   e Zd Zddd„Zddd„Zdd„ ZdS )	Ú	TSRequestNc                 C   rJ   rK   rM   r1   r&   r&   r'   r0   °   rN   zTSRequest.__init__c                 C   s  t d|d d… ƒd }|tkrtd| ƒ‚|dd … }t|ƒ\}}t d|d d… ƒd }|dkr6td| ƒ‚|dd … }t|ƒ\}}t d|dd… ƒd dkrUtd| ƒ‚t|dd … ƒ\}}t d|ƒd | d	< ||d … }t d|d d… ƒd }|d
k�rt|dd … ƒ\}}t d|d d… ƒd }|tkr�td| ƒ‚t|dd … ƒ\}}t d|d d… ƒd }|tkr¼td| ƒ‚t|dd … ƒ\}}t d|d d… ƒd }|dkrÛtd| ƒ‚t|dd … ƒ\}}t d|d d… ƒd }|tkrútd| ƒ‚t|dd … ƒ\}}|| d< ||d d … }|dk�rKt|dd … ƒ\}}t d|d d… ƒd }|tk�r5td| ƒ‚t|dd … ƒ\}}|| d< ||d d … }|dk�r€t|dd … ƒ\}}t d|d d… ƒd }|tk�rptd| ƒ‚t|dd … ƒ\}}|| d< d S d S )NrO   r   r   zSEQUENCE expected! (%x)rP   z0xa0 tag not found %xr   zINTEGER tag not found %rr   rR   zASN1_SEQUENCE tag not found %rz0xa0 tag not found %rz"ASN1_OCTET_STRING tag not found %rÚNegoDatarT   ÚauthInfoé£   Ú
pubKeyAuth)r   r	   Ú	Exceptionr   r
   )r2   r3   Ú	next_byteÚdecode_dataÚtotal_bytesÚ
next_bytesÚ_Údecode_data2r&   r&   r'   Ú
fromString´   sh   




øzTSRequest.fromStringc                 C   s  d| j v rtddƒ}|ttdtƒt| d ƒ ƒ7 }nd}d| j v r6tddƒ}|ttdtƒt| d ƒ ƒ7 }nd}d| j v rgtddƒ}|ttdtƒttdtƒttdd	ƒttdtƒt| d ƒ ƒ ƒ ƒ ƒ7 }nd}tdtƒ}|ttdd	ƒttdd
ƒttdd
ƒƒ ƒ | | | ƒ7 }|S )Nra   rO   r`   ó    r_   rT   r^   rR   rP   r   )Úfieldsr   r   r
   r	   )r2   ra   r_   ÚnegoDatarW   r&   r&   r'   rX   ÷   sF   



ÿ



ÿ





ÿÿÿ
ÿ
ÿþþþzTSRequest.getDatar5   )r"   r#   r$   r0   ri   rX   r&   r&   r&   r'   r]   £   s    

Cr]   Ú__main__N)Úa2b_hex)ÚARC4)ÚntlmÚversion)ÚSSLÚcryptoz*pyOpenSSL is not installed, can't continuec                   @   s$   e Zd Zdd„ Zdd„ Zdd„ ZdS )ÚSPNEGOCipherc                 C   s¾   || _ | j tj@ r@t | j |¡| _t | j |d¡| _t | j |¡| _t | j |d¡| _t	 
| j¡}|j| _t	 
| j¡}|j| _n|| _|| _|| _|| _t	 
| j¡}|j| _|j| _d| _d S )NÚServerr   )Ú_SPNEGOCipher__flagsrp   Ú*NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITYÚSIGNKEYÚ_SPNEGOCipher__clientSigningKeyÚ_SPNEGOCipher__serverSigningKeyÚSEALKEYÚ_SPNEGOCipher__clientSealingKeyÚ_SPNEGOCipher__serverSealingKeyro   ÚnewÚencryptÚ"_SPNEGOCipher__clientSealingHandleÚ"_SPNEGOCipher__serverSealingHandleÚ_SPNEGOCipher__sequence)r2   ÚflagsÚrandomSessionKeyÚcipher3Úcipher4Úcipherr&   r&   r'   r0   (  s$   

zSPNEGOCipher.__init__c              	   C   sl   | j tj@ rt | j | j| j||| j| j¡\}}nt | j | j| j||| j| j¡\}}|  jd7  _||fS ©Nr   )rv   rp   rw   ÚSEALry   r|   r‚   r€   )r2   Ú
plain_dataÚsealedMessageÚ	signaturer&   r&   r'   r   ?  s&   
úúzSPNEGOCipher.encryptc              	   C   sr   | j tj@ rt | j | j| j||| j| j¡\}}||fS t | j | j| j||| j| j¡\}}|  jd7  _||fS rˆ   )rv   rp   rw   r‰   rz   r}   r‚   r�   )r2   ÚanswerrŒ   r&   r&   r'   ÚdecryptW  s(   ú÷úzSPNEGOCipher.decryptN)r"   r#   r$   r0   r   rŽ   r&   r&   r&   r'   rt   '  s    rt   Fc           "   
   C   s,  |d ur|  d¡\}}t|ƒ}t|ƒ}nd}d}tƒ }tƒ }	tƒ }
t|
d< ttB |
d< |
 ¡ |	d< t	|	d< |	 ¡ |d< t
| d|ƒ}| | ¡ ¡ | d	¡}| |¡ |	 |d ¡ t|	d ƒ}|d tkrvt|	d ƒ}| ¡  t d
¡ d S |
 |	d ¡ t tj¡}| d d¡¡ d}| |¡ | tj¡ t ||¡}| ¡  | ¡  tjddddd�}t ƒ }| ¡ |d< | !| ¡ ¡ | d¡}| |¡ tj"||d |||||dd�\}}| #¡ }| $¡ }t% &t%j'|¡}|dd … }t(|d |ƒ}| )|¡\}}| ¡ |d< | ¡ | |d< z| !| ¡ ¡ | d¡}W n) t*�yB } zt+|ƒ ,d¡dk�r2t d¡ nt |¡ W Y d }~d S d }~ww t |ƒ}| -|d dd … ¡\}}t.ƒ }||d< ||d< ||d< t/ƒ } d| d< | ¡ | d< | )|  ¡ ¡\}}!t ƒ }| ¡ |! |d < | !| ¡ ¡ | 0¡  t 1d!¡ d S )"Nú:r.   r9   r?   r,   r+   r   i=  i    zWServer doesn't support PROTOCOL_HYBRID, hence we can't use CredSSP to check credentialszALL:@SECLEVEL=0zutf-8i   T)Ú
use_ntlmv2r^   i   é   rƒ   ra   i   Údeniedr   zAccess Deniedé   rQ   rS   rU   r   r\   r[   r_   zAccess Granted)2Úsplitrn   r   r   r>   rA   ÚPROTOCOL_HYBRIDÚPROTOCOL_SSLrX   ÚTDPU_CONNECTION_REQUESTr   ÚsendallÚrecvri   r7   ÚTYPE_RDP_NEG_FAILURErF   ÚdumpÚloggingÚerrorrr   ÚContextÚ
TLS_METHODÚset_cipher_listrV   Úset_optionsÚOP_DONT_INSERT_EMPTY_FRAGMENTSÚ
ConnectionÚset_connect_stateÚdo_handshakerp   ÚgetNTLMSSPType1r]   ÚsendÚgetNTLMSSPType3Úget_peer_certificateÚ
get_pubkeyrs   Údump_publickeyÚFILETYPE_ASN1rt   r   rb   ÚstrÚfindrŽ   rI   rZ   ÚcloseÚinfo)"ÚhostÚusernamerU   ÚdomainÚhashesÚipv6ÚlmhashÚnthashÚtpktÚtpduÚrdp_negÚsÚpktÚcr_tpduÚrdp_failureÚctxÚ(SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATIONÚtlsÚauthÚ
ts_requestÚbuffÚtype3ÚexportedSessionKeyÚserver_certÚpkeyr›   r‡   rŒ   Úcripted_keyÚerrÚ
plain_textÚtspÚtscÚcripted_credsr&   r&   r'   Ú	check_rdpn  s”   






"
€ûrÏ   TzKTest whether an account is valid on the target host using the RDP protocol.)Úadd_helpÚdescriptionÚtargetÚstorez6[[domain/]username[:password]@]<targetName or address>)ÚactionÚhelpz-6z--ipv6Ú
store_truezTest on IPv6z-tsz&Adds timestamp to every logging outputz-debugzTurn DEBUG output ONÚauthenticationz-hasheszLMHASH:NTHASHz$NTLM hashes, format is LMHASH:NTHASH)rÔ   ÚmetavarrÕ   r.   )Úgetpassz	Password:)NF)WÚstructr   r   Úimpacket.examplesr   Úimpacket.examples.utilsr   r   Úimpacket.structurer   Úimpacket.spnegor   r	   r
   r   r   r—   ÚTPDU_CONNECTION_CONFIRMÚ	TDPU_DATAÚTPDU_REJECTÚTPDU_DATA_ACKrA   ÚPROTOCOL_RDPr–   r•   ÚTYPE_RDP_NEG_RSPÚEXTENDED_CLIENT_DATA_SUPPORTEDÚDYNVC_GFX_PROTOCOL_SUPPORTEDrš   ÚSSL_REQUIRED_BY_SERVERÚSSL_NOT_ALLOWED_BY_SERVERÚSSL_CERT_NOT_ON_SERVERÚINCONSISTENT_FLAGSÚHYBRID_REQUIRED_BY_SERVERÚ%SSL_WITH_USER_AUTH_REQUIRED_BY_SERVERr   r   r7   r;   r>   rC   rF   rI   rZ   r]   r"   ÚsocketÚargparseÚsysrœ   Úbinasciirn   ÚCryptodome.Cipherro   Úimpacketrp   rq   ÚOpenSSLrr   rs   ÚcriticalÚexitrt   rÏ   ÚprintÚBANNERÚArgumentParserÚparserÚadd_argumentÚadd_argument_groupÚgroupÚlenÚargvÚ
print_helpÚ
parse_argsÚoptionsÚinitÚtsÚdebugrÒ   r³   r²   rU   Úaddressr´   rÙ   rµ   r&   r&   r&   r'   Ú<module>   s’   	
	
t

G 
7


  � �Ó