o
    àý°j*“  ã                
   @   sd  d dl Z d dlZd dlZd dlZd dlmZ d dlm  mZ d dl	m
Z
 d dlmZ d dlmZ d dlmZ d dlmZ d dlmZ d d	lmZmZmZ d d
lmZmZmZ d dlmZ d dlmZ d dl m!Z!m"Z"m#Z# d dl$Z$G dd„ dƒZ%e&dk�r°ej'j(du rŒe )d¡ej'ƒe_'e*ej+ƒ e j,ddd�Z-e-j.dddd� e-j.dddd� e-j.dddd� e-j/ddd �Z0e0j1d!d"d#�Z2e2j.d$dd%d&d'� e0j1d(d)d#�Z3e3j.d$dd%d&d'� e0j1d*d+d#�Z4e4j.d,dd-e5d.d/� e4j.d0dd1d� e0j1d2d3d#�Z6e6j.d4dd5e5dd6d7� e6j.d8dd5e5dd9d7� e6j.d:de7d;d<d=� e0j1d>d?d#�Z8e8j.d@dd5e5ddAd7� e0j1dBdCd#�Z9e9j.d@dd5e5ddDd7� e0j1dEdFdGdH�Z:e: ;dI¡Z<e<j.dJddKd� e<j.dLddMd� e<j.dNddOd� e<j.dPddQd� e0j1dRdSd#�Z=e=j.d@dd5e5ddTd7� e=j.dUddVe7d;dWd7� e=j.dXddYe7ddZd7� e0j1d[d\d#�Z>e>j.d@dd5e5dd]d7� e>j.d^dd_d� e>j.d`ddad� e>j.dbe7dcddde� e- ;df¡Z?e?j.dgddhdidj� e?j.dkddld� e?j.dmddnd� e?j.doddpdqdj� e- ;dr¡Z?e?j.dsddtdudj� e?j.dvddtdwdj� e?j.dxdydzgd{dzd|d}d~� e@ejAƒdk�re- B¡  e Cd¡ e- D¡ ZEe FeEjGeEjH¡ eEjIdu �r7e- B¡  e Jd€¡ e Cd¡ eeEjKƒ\ZLZMZNZOeEjPdu �rIeOeE_PeLdu �rPd�ZLeEjQdu�rYdeE_ReNd�k�reMd�k�reEjSdu �reEjTd;u �reEjQdu �rd d‚lUmUZU eUdƒƒZNe%eMeNeLeEƒZVz
eV WeOeEjP¡ W dS  eX�y¯ ZY ze$ Z¡  e Je7eYƒ¡ W Y dZY[YdS dZY[Yww dS )„é    N)Útostring)Úunpack)Úversion)Úlogger)Úparse_target)ÚSMBConnection)ÚLOG)Ú	transportÚlsatÚlsad)ÚRPC_C_AUTHN_GSS_NEGOTIATEÚRPC_C_AUTHN_LEVEL_PKT_PRIVACYÚDCERPCException)ÚMAXIMUM_ALLOWED)Útsts)ÚSHADOW_CONTROL_REQUESTÚSHADOW_PERMISSION_REQUESTÚSHADOW_REQUEST_RESPONSEc                   @   s”   e Zd Zdd„ Zdd„ Zdd„ Zdd„ Zd	d
„ Zdd„ Zdd„ Z	dd„ Z
dd„ Zdd„ Zdd„ Zdd„ Zdd„ Zdd„ Zdd„ Zdd „ Zd!d"„ Zd#S )$Ú	TSHandlerc                 C   st   || _ || _|| _|| _|j ¡ | _d| _d| _|j	| _
|j| _|j| _d | _|jd ur8|j d¡\| _| _d S d S )NÚ ú:)Ú_TSHandler__usernameÚ_TSHandler__passwordÚ_TSHandler__domainÚ_TSHandler__optionsÚactionÚlowerÚ_TSHandler__actionÚ_TSHandler__lmhashÚ_TSHandler__nthashÚaesKeyÚ_TSHandler__aesKeyÚkÚ_TSHandler__doKerberosÚdc_ipÚ_TSHandler__kdcHostÚ_TSHandler__smbConnectionÚhashesÚsplit)ÚselfÚusernameÚpasswordÚdomainÚoptions© r.   ú†/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/../../../bin/tstool.pyÚ__init__<   s   
ÿzTSHandler.__init__c              	   C   sp   || _ t||t| jjƒd�| _| jr'| j | j| j	| j
| j| j| j| j¡ d S | j | j| j	| j
| j| j¡ d S )N)Ú	sess_port)Ú
remoteNamer   Úintr   Úportr&   r#   ÚkerberosLoginr   r   r   r   r   r!   r%   Úlogin©r)   r2   Ú
remoteHostr.   r.   r/   ÚconnectL   s   ÿ"zTSHandler.connectc                 C   sX   | j jdkrttjtjtjtjgƒst 	d¡ t
dƒ |  ||¡ t| d| j ƒƒ  d S )NÚshutdownzGAt least one flag is required: -logoff, -shutdown, -reboot or -poweroffé   Údo_)r   r   Úmaxr-   Úlogoffr:   ÚrebootÚpoweroffr   ÚerrorÚexitr9   Úgetattrr   r7   r.   r.   r/   ÚrunV   s   
zTSHandler.runc                 C   s¼   t  | j| jj| j¡�I}| ¡ }|j|dd�d }| |¡ i | _	|D ](}|d d }t  
t j|d ¡ d¡d }||d	 d
d
d
d
d
d
dœ| j	|d < q#W d   ƒ d S 1 sWw   Y  d S )Nr;   )ÚLevelÚppSessionEnumResultÚSessionInfoÚSessionEnum_Level1ÚStateÚ_éÿÿÿÿÚNamer   )ÚstateÚSessionNameÚRemoteIpÚ
ClientNameÚUsernameÚDomainÚ
ResolutionÚClientTimeZoneÚ	SessionId)ÚTSTSÚTermSrvEnumerationr&   r   Ú	target_ipr#   ÚhRpcOpenEnumÚhRpcGetEnumResultÚhRpcCloseEnumÚsessionsÚ
enum2valueÚWINSTATIONSTATECLASSr(   )r)   ÚlsmÚhandleÚ	rsessionsÚiÚsessrM   r.   r.   r/   Úget_session_list_   s&   
ùý"ûzTSHandler.get_session_listc                 C   sD  t | jƒr t | j| jj| j¡�†}| jD ]y}| |¡}|d ur�|d d | j| d< |d d | j| d< t |d d ƒrQt | j| d ƒsQ|d d | j| d< t |d d ƒrmt | j| d ƒsm|d d | j| d< d 	|d d	 |d d
 ¡| j| d< |d d d | j| d< qW d   ƒ d S 1 s™w   Y  d S d S )NÚppBuffÚClientAddressrO   rP   ÚUserNamerQ   rR   z{}x{}ÚHResÚVResrS   rT   ÚStandardName)
Úlenr\   rV   Ú	RCMPublicr&   r   rX   r#   ÚhRpcGetClientDataÚformat)r)   ÚtermsrvrU   Úrespr.   r.   r/   Úenumerate_sessions_configs   s(   


""

þ€ó"ÿÿz#TSHandler.enumerate_sessions_configc                 C   sd  t | jƒr°t | j| jj| j¡�–}| j ¡ D ]‡}| 	|¡}t 
tj|d d d ¡}|| j| d< |d d d }t | j| d ƒsMt |ƒrM|| j| d< |d d d }t | j| d ƒsit |ƒri|| j| d< |d d d	 | j| d	< |d d d
 | j| d
< |d d d | j| d< |d d d | j| d< qW d   ƒ d S 1 s©w   Y  d S d S )NÚLSMSessionInfoExPtrÚLSM_SessionInfo_Level1ÚSessionFlagsÚflagsÚ
DomainNamerR   rg   rQ   ÚConnectTimeÚDisconnectTimeÚ	LogonTimeÚLastInputTime)rk   r\   rV   ÚTermSrvSessionr&   r   rX   r#   ÚkeysÚhRpcGetSessionInformationExr]   ÚSESSIONFLAGS)r)   r{   rU   ÚsessdataÚ	sessflagsr,   r*   r.   r.   r/   Úenumerate_sessions_info†   s&   

ó"ÿÿz!TSHandler.enumerate_sessions_infoc              
      sn  ˆ j }ddddœ}ˆ  ¡  tˆ jƒstdƒ d S ˆ  ¡  |jr#ˆ  ¡  t‡ fdd„ˆ jD ƒƒ}tdƒ|k r7|ntdƒd	 }t‡ fd
d„ˆ jD ƒƒd	 }tdƒ|k rS|ntdƒd	 }tdd„ ˆ jD ƒƒ}tdƒ|k rk|ntdƒd	 }t‡ fdd„ˆ jD ƒƒ}tdƒ|k r…|ntdƒd	 }t‡ fdd„ˆ jD ƒƒ}tdƒ|k rŸ|ntdƒd	 }t‡ fdd„ˆ jD ƒƒ}tdƒ|k r¹|ntdƒd	 }d||||f }	d||f }
g }|	j	dddddddd�}|	 
dd¡j	dddddddd�}d}d}|j�r	|
j	ddddd�}|
 
dd¡j	ddddd�}| || ¡ | || d  ¡ ˆ jD ]Ž}ˆ j| d }|jd!k�r0| d"¡nd#}ˆ j| d }|jd!k�rD| d"¡nd#}tˆ j| d ƒ�r`ˆ j| d$ d% ˆ j| d  nd}|	j	ˆ j| d& ||ˆ j| d' |ˆ j| d(  ||d�}d}|j�r¢|
j	ˆ j| d ˆ j| d) ˆ j| d ˆ j| d d�}| || ¡ �q|D ]}t|ƒ �q­d S )*Nr   ÚLockedÚUnlocked)ÚWTS_SESSIONSTATE_UNKNOWNÚWTS_SESSIONSTATE_LOCKÚWTS_SESSIONSTATE_UNLOCKzNo sessions found...c                    ó"   g | ]}t ˆ j| d  ƒd ‘qS )rN   r;   ©rk   r\   ©Ú.0rb   ©r)   r.   r/   Ú
<listcomp>¨   ó   " z(TSHandler.do_qwinsta.<locals>.<listcomp>ÚSESSIONNAMEr;   c                    ó0   g | ]}t ˆ j| d  ˆ j| d  ƒd ‘qS ©rQ   rR   r;   rˆ   r‰   r‹   r.   r/   rŒ   ¬   ó   0 rQ   c                 S   s   g | ]}t t|ƒƒ‘qS r.   )rk   Ústrr‰   r.   r.   r/   rŒ   ±   ó    ÚIDc                    r‡   )rM   r;   rˆ   r‰   r‹   r.   r/   rŒ   ´   r�   ÚSTATEc                    r‡   )rO   r;   rˆ   r‰   r‹   r.   r/   rŒ   ·   r�   ÚRemoteAddressc                    r‡   )rP   r;   rˆ   r‰   r‹   r.   r/   rŒ   º   r�   rP   zg{SESSIONNAME: <%d} {USERNAME: <%d} {ID: <%d} {STATE: <%d} {DSTATE: <9} {CONNTIME: <20} {DISCTIME: <20} zC{CLIENTNAME: <%d} {REMOTEIP: <%d} {RESOLUTION: <11} {TIMEZONE: <15}ÚUSERNAMEÚDesktoprw   rx   )rŽ   r—   r”   r•   ÚDSTATEÚCONNTIMEÚDISCTIMEú <ú=<rS   rT   )Ú
CLIENTNAMEÚREMOTEIPÚ
RESOLUTIONÚTIMEZONEÚ
iA  z%Y/%m/%d %H:%M:%SÚNonerR   ú\rN   rM   ru   rO   )r   rd   rk   r\   Úprintr�   Úverboserq   r=   rn   ÚreplaceÚappendÚyearÚstrftime)r)   r-   Údesktop_statesÚmaxSessionNameLenÚmaxUsernameLenÚmaxIdLenÚmaxStateLenÚmaxRemoteIpÚmaxClientNameÚtemplateÚtemplate_verboseÚresultÚheaderÚheader2Úheader_verboseÚheader2_verboserb   ÚconnectTimeÚdisconnectTimeÚuserNameÚrowÚrow_verboser.   r‹   r/   Ú
do_qwinsta™   sº   ý

úýù
ù
üü
8ù	üÿzTSHandler.do_qwinstac              
   C   s˜  z¾d| j j }t |¡}| | j¡ | ¡ }| jr| t	¡ | 
t¡ | ¡  | tj¡ t| j ¡ ƒ}t|ƒdkr@|d d… }t |ttjB ¡}|d }zt |||tjj¡}W n! tyz } zt|ƒ d¡dkro| ¡ }n‚ W Y d }~nd }~ww t||d d ƒD ]3\}}	|	d }
|
d	krœd
  d|	d ¡| j|< q„|
dkr·d
  |d d |	d  d |	d ¡}|| j|< q„| !¡  W d S    t" #t$ %¡ ¡ Y d S )Nzncacn_np:%s[\pipe\lsarpc]é    ÚPolicyHandleÚSTATUS_SOME_NOT_MAPPEDr   ÚTranslatedNamesÚNamesÚDomainIndexrK   z{}\{}z???rL   ÚReferencedDomainsÚDomains)&r   rX   r	   ÚDCERPCTransportFactoryÚset_smb_connectionr&   Úget_dce_rpcr#   Úset_auth_typer   Úset_auth_levelr   r9   Úbindr
   ÚMSRPC_UUID_LSATÚlistÚsidsr|   rk   r   ÚhLsarOpenPolicy2r   ÚPOLICY_LOOKUP_NAMESÚhLsarLookupSidsÚLSAP_LOOKUP_LEVELÚLsapLookupWkstar   r’   ÚfindÚ
get_packetÚziprn   Ú
disconnectÚloggingÚdebugÚ	tracebackÚ
format_exc)r)   ÚstringbindingÚrpctransportÚdcerÏ   rp   ÚpolicyHandleÚeÚsidÚitemÚdomainIndexÚnamer.   r.   r/   Ú
lookupSids  sF   



þ€þ$
€zTSHandler.lookupSidsc                 C   s(   |d d… dkr|| j v r| j | S |S )Né   úS-)rÏ   )r)   râ   r.   r.   r/   Ú	sidToUser4  s   
zTSHandler.sidToUserc                    sì  ˆ j }t ˆ j|jˆ j¡��]}| ¡ }| |¡}t|ƒs%	 W d   ƒ d S i ˆ _	|D ]}| 
¡ }|d d… dkrB|ˆ j	vrB|ˆ j	|< q*ˆ  ¡  tdd„ |D ƒƒ}tdd„ |D ƒƒ}|j�rˆ  ¡  ˆ  ¡  t‡ fdd„ˆ jD ƒƒd }	|	dk ryd}	d	||	|f }
t|
jd
dddddddd�ƒ t|
 dd¡jddddddddd�d ƒ |D ]f}| ¡ }|d }d}tˆ j| d ƒrÆ|ˆ j| d d 7 }tˆ j| d ƒrØ|ˆ j| d 7 }|
 dd¡j|d  ¡ |d ˆ j| d |d ˆ j| d   d!d"¡ˆ  | 
¡ ¡||d# d$ d%�}t|ƒ q¦nMd&||f }
t|
 d
dd'dd¡ƒ t|
 d(d)¡ ddddd¡d ƒ |D ]0}| ¡ }|
 |d  ¡ |d |d ˆ  | 
¡ ¡d* |d# d$ ¡¡}t|ƒ �q2W d   ƒ d S W d   ƒ d S 1 �sow   Y  d S )+Nrç   rè   c                 S   s    g | ]}t | ¡ d   ¡ ƒ‘qS )Ú	ImageName)rk   ÚgetProcessInfoÚgetValue©rŠ   Úprocess_entryr.   r.   r/   rŒ   I  s     z)TSHandler.do_tasklist.<locals>.<listcomp>c                 S   s   g | ]}t | ¡ ƒ‘qS r.   )rk   ÚgetSidrí   r.   r.   r/   rŒ   J  r“   c                    r�   r�   rˆ   r‰   r‹   r.   r/   rŒ   N  r‘   r;   é   z{{imagename: <%d} {pid: <6} {sessid: <6} {sessionName: <16} {sessstate: <11} {sessionuser: <%d} {sid: <%d} {workingset: <12}z
Image NameÚPIDÚSessNameÚSessIDÚSessUserrI   ÚSIDz	Mem Usage)Ú	imagenameÚpidÚsessionNameÚsessidÚsessionuserÚ	sessstaterâ   Ú
workingsetrœ   r�   r   r¢   rU   rR   r¤   rQ   z{workingset: <12}z{workingset: >10,} Krê   ÚUniqueProcessIdrN   rM   ÚDisconnectedÚDiscÚWorkingSetSizeiè  )rö   r÷   rø   rù   rû   râ   rú   rü   z&{: <%d} {: <8} {: <11} {: <%d} {: >12}zSession#z: z:=z{:,} K)r   rV   Ú	LegacyAPIr&   rX   r#   ÚhRpcWinStationOpenServerÚhRpcWinStationGetAllProcessesrk   rÏ   rï   ræ   r=   r¦   rd   rq   r\   r¥   rn   r§   rë   rì   ré   )r)   r-   Úlegacyr`   Úprocess_entry_listrî   râ   ÚmaxImageNameLenÚ	maxSidLenÚmaxUserNameLenr²   Úprocess_infoÚsessIdÚfullUserNamer¼   r.   r‹   r/   Údo_tasklist9  s¤   
ü
€ù	ùùø

ø

î"
ûàËL$´zTSHandler.do_tasklistc                    sv  | j ‰ ˆ jd u rˆ jd u rt d¡ d S g }t | jˆ j| j	¡�‘}| 
¡ }ˆ jd u reˆ jd ure| |¡}t|ƒsFt d¡ 	 W d   ƒ d S ‡ fdd„|D ƒ}t|ƒsdt dˆ j ¡ 	 W d   ƒ d S nˆ jg}|D ]=}td| dd� z| ||¡d	 rƒtd
ƒ ntdƒ W qk ty¨ } zt d| ¡ t t|ƒ¡ W Y d }~qkd }~ww W d   ƒ d S 1 s´w   Y  d S )Nz-One of the following is required: -pid, -namezCould not get process listc                    s6   g | ]}|  ¡ d   ¡  ¡ ˆ j ¡ kr|  ¡ d ‘qS )rê   rý   )rë   rì   r   rå   r‰   ©r-   r.   r/   rŒ   Ÿ  s    
ÿz)TSHandler.do_taskkill.<locals>.<listcomp>z!Could not find %r in process listzTerminating PID: %d ...r   ©ÚendÚ	ErrorCodeÚOKÚFAILzError terminating pid: %d)r   r÷   rå   r   rA   rV   r  r&   rX   r#   r  r  rk   r¥   ÚhRpcWinStationTerminateProcessÚ	Exceptionr’   )r)   ÚpidListr  r`   Úrr÷   rá   r.   r  r/   Údo_taskkill’  sD   


úõ	
€€þù"ñzTSHandler.do_taskkillc                 C   s�  | j }t | j|j| j¡�±}zcd }td|j|jf dd� z| 	|j¡}W n3 t
yX } z'tdƒ |jdkr?t d|j ¡ nt t|ƒ¡ W Y d }~W W d   ƒ d S d }~ww |j||j|jd�d d	krltd
ƒ ntdƒ W n< t
y­ } z0tdƒ |jdkr‹t d|j ¡ n|jdkrœt d|j|jf ¡ nt t|ƒ¡ W Y d }~nd }~ww W d   ƒ d S W d   ƒ d S 1 sÁw   Y  d S )Nz!Connecting SessionID %d to %d ...r   r  r  ì      z#Could not find source SessionID: %d)ÚhSessionÚTargetSessionIdÚPasswordr  r   r  z(Could not find destination SessionID: %dl   Ÿ  z4Session in the invalid state. Did you mean %d -> %d?)r   rV   r{   r&   rX   r#   r¥   ÚsourceÚdestÚhRpcOpenSessionr  Ú
error_coder   rA   r’   ÚhRpcConnectr+   ©r)   r-   Ú	TSSessionÚsession_handlerá   r.   r.   r/   Údo_tscon²  sP   
ô€þþþ
€

€ù€í€" zTSHandler.do_tsconc                 C   s  | j }t | j|j| j¡�k}z#td|j dd� | |j¡}| 	|¡d dkr,tdƒ ntdƒ W n6 t
yg } z*tdƒ |jdkrHt d	¡ n|jd
krVt d|j ¡ nt t|ƒ¡ W Y d }~nd }~ww W d   ƒ d S W d   ƒ d S 1 s{w   Y  d S )NzDisconnecting SessionID: %d ...r   r  r  r   r  r  r;   z!Maybe it is already disconnected?r  úCould not find SessionID: %d)r   rV   r{   r&   rX   r#   r¥   Úsessionr  ÚhRpcDisconnectr  r  r   rA   r’   r!  r.   r.   r/   Údo_tsdisconÐ  s,   
€

€ù€ø€" zTSHandler.do_tsdisconc                 C   s  | j }t | j|j| j¡�v}z#td|j dd� | |j¡}| 	|¡d dkr,tdƒ ntdƒ W nA t
yr } z5|jdkrOtdƒ W Y d }~W d   ƒ d S tdƒ |jd	krat d
|j ¡ nt t|ƒ¡ W Y d }~nd }~ww W d   ƒ d S W d   ƒ d S 1 s†w   Y  d S )NzSigning-out SessionID: %d ...r   r  r  r   r  r  i   r  r%  )r   rV   r{   r&   rX   r#   r¥   r&  r  Ú
hRpcLogoffr  r  r   rA   r’   r!  r.   r.   r/   Ú	do_logoffã  s0   
€

ô
€ø€÷€" zTSHandler.do_logoffc                 C   sH  | j }t | j|j| j¡��}| ¡ }d}g }|j|j|j	|j
g}t|g d¢ƒD ]\}}|r2| |¡ q'd |¡}t|g d¢ƒD ]
\}}|rI||O }q?z"td| dd� | |d|¡}	|	d rctd	ƒ n|	 ¡  td
ƒ W n ty‰ }
 ztd
ƒ t t|
ƒ¡ W Y d }
~
nd }
~
ww W d   ƒ d S W d   ƒ d S 1 s�w   Y  d S )Nr   )r>   r:   r?   r@   ú|)r;   rç   é   é   zSending shutdown (%s) event ...r   r  r  r  r  )r   rV   r  r&   rX   r#   r  r>   r:   r?   r@   r×   r¨   Újoinr¥   ÚhRpcWinStationShutdownSystemÚdumpr  r   rA   r’   )r)   r-   r  r`   ru   Ú	flagsListÚShutdownFlagsr"   Úvrp   rá   r.   r.   r/   Údo_shutdownø  s@   
€
€
€€þ€ì"êzTSHandler.do_shutdownc                 C   sö   | j }t | j|j| j¡�d}z'td|j dd� | |j¡}| 	||j
|j¡d dkr0tdƒ ntdƒ W n+ ty` } ztdƒ |jdkrOt d	|j ¡ nt t|ƒ¡ W Y d }~nd }~ww W d   ƒ d S W d   ƒ d S 1 stw   Y  d S )
Nz$Sending message to SessionID: %d ...r   r  r  r   r  r  r  r%  )r   rV   r{   r&   rX   r#   r¥   r&  r  ÚhRpcShowMessageBoxÚtitleÚmessager  r  r   rA   r’   r!  r.   r.   r/   Údo_msg  s(   
€
€û€ø€" zTSHandler.do_msgc                 C   sè  | j jrtjjntjj}| j jrtjjntjj	}t
 d| j j› d| j j› d| j j› d�¡ z=t | j| j j| j¡�(}| | j j||d¡}| j jrRt
 d| ¡ › �¡ |d }|d }W d	  ƒ n1 sdw   Y  W n ty… } zt
 d
|› �¡ W Y d	}~d	S d	}~ww |d	ur¬zt t|¡}W n ttfyŸ   d}Y nw t
 d|› d|› d�¡ |tjjjk�rht
 d¡ |sÅt
 d¡ t d¡ t
 dt|ƒ› d�¡ z|  d¡ !¡ }t" #|¡}W nC t"j$�y!   | %d¡�r| &d¡�sd|v �r| 'd¡d }	|d	|	… }zt" #|¡}W n t"j$�y   d	}Y nw d	}nd	}Y nw |�rat(|ddd� )d¡}t
 d¡ t*| j j+ddd��}
|
 ,|¡ t
 d| j j+› d�¡ W d	  ƒ d	S 1 �sZw   Y  d	S t
 d ¡ d	S t
 d!¡ t d¡ d	S )"zŠ
        Request a Remote Connection String to shadow a Remote Desktop Services session.
        Author: Ilya Yatsenko (@fulc2um)
        zCalling RpcShadow2 (SessionId=z
, Control=z, Permission=ú)i    z
Response: ÚpePermissionÚpszInvitationNzRPC Exception: ÚUnknownzPermission: z (zRpcShadow2 call succeeded!z)RpcShadow2 failed: No invitation receivedr;   zInvitation received (z characters)z 
ú<ú>z</E>r,  zutf-8Úxml)ÚencodingÚmethodzInvitation is well-formed XMLÚw)r@  z	Saved to z filez0Invitation does not appear to be well-formed XMLz$RpcShadow2 failed: Permission denied)-r   Úcontrolr   Ú	enumItemsÚ"SHADOW_CONTROL_REQUEST_TAKECONTROLÚSHADOW_CONTROL_REQUEST_VIEWÚpromptr   Ú+SHADOW_PERMISSION_REQUEST_REQUESTPERMISSIONÚ SHADOW_PERMISSION_REQUEST_SILENTr   Úinfor&  rV   ÚSessEnvPublicRpcr&   rX   r#   ÚhRpcShadow2rÚ   ÚgetDatar   rA   r]   r   ÚKeyErrorÚAttributeErrorÚSHADOW_REQUEST_RESPONSE_ALLOWÚvalueÚsysrB   rk   ÚrstripÚstripÚETÚ
fromstringÚ
ParseErrorÚ
startswithÚendswithÚrfindr   ÚdecodeÚopenÚfileÚwrite)r)   rC  ÚpermÚsErpcÚresponseÚ
permissionÚ
invitationrá   ÚdescÚend_posÚfr.   r.   r/   Ú	do_shadow$  s~   
ÿþ
ÿþ*
ù€	€þÿ



ÿ€ô

$þ
zTSHandler.do_shadowN)Ú__name__Ú
__module__Ú__qualname__r0   r9   rD   rd   rq   r�   r¾   ræ   ré   r  r  r$  r(  r*  r4  r8  rg  r.   r.   r.   r/   r   ;   s$    
	v%Y r   Ú__main__Úutf8Tz$Terminal Services manipulation tool.)Úadd_helpÚdescriptionÚtargetÚstorez6[[domain/]username[:password]@]<targetName or address>)r   Úhelpz-debugÚ
store_truezTurn DEBUG output ONz-tsz&Adds timestamp to every logging outputÚactionsr   )rq  r  Úqwinstaz;Display information about Remote Desktop Services sessions.)rq  z-vr¦   zTurn VERBOSE output ON)r   r  rq  Útasklistz<Display a list of currently running processes on the system.Útaskkillz2Terminate tasks by process id (PID) or image name.z-pidrñ   zSpecifies process id (PID))r   ÚmetavarÚtyperq  z-namezdSpecifies process name (ImageName). Internally it willexecute tasklist to retrieve PID by ImageName.Útsconz4Attaches a user session to a remote desktop session.z-sourceÚ	SessionIDzSource SessionId)r   rw  rx  Úrequiredrq  z-destzDestination SessionIdz	-passwordFzDestination Session's password)r   rx  r{  rq  Útsdisconz.Disconnects a Remote Desktop Services session.z-sessionzSessionId to disconnectr>   z+Sign out a Remote Desktop Services session.zSessionId to sign outr:   z:Remote shutdown, affects ALL sessions and logged-in users!zESend Remote Shutdown event. Affects ALL sessions and logged-in users!)rq  rn  z Shutdown Flags [Multiple Choice]z-logoffzForces sessions to logoff.z	-shutdownzShuts down the system.z-rebootzReboots after shutdown.z	-poweroffzPowers off after shutdown.Úmsgz;Send a message to Remote Desktop Services session (MSGBOX).zReceiver SessionIdz-titlez'Your Title'z"Title of the MessageBox [Optional]z-messagez'Your Message'zContents of the MessageBoxÚshadowz)Shadow a Remote Desktop Services session.zSessionId to shadowz-controlz5Request control of the session (default is view only)z-promptz+Request user permission (default is silent)z-filezSave invitation to filezinvite.msrcIncident)rx  rq  ÚdefaultÚauthenticationz-hasheszLMHASH:NTHASHz$NTLM hashes, format is LMHASH:NTHASH)r   rw  rq  z-no-passz&don't ask for password (useful for -k)z-kzÁUse Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use the ones specified in the command linez-aesKeyzhex keyz<AES key to use for Kerberos Authentication (128 or 256 bits)Ú
connectionz-dc-ipz
ip addressztIP Address of the domain controller. If omitted it will use the domain part (FQDN) specified in the target parameterz
-target-ipz£IP Address of the target machine. If omitted it will use whatever was specified as target. This is useful when target is the NetBIOS name and you cannot resolve itz-portÚ139Ú445ú?zdestination portz)Destination port to connect to SMB Server)ÚchoicesÚnargsr  rw  rq  r;   zToo few arguments...r   )Úgetpassz	Password:)[ÚargparseÚcodecsrÙ   rR  Úxml.etree.ElementTreer   ÚetreeÚElementTreerU  Ústructr   Úimpacketr   Úimpacket.examplesr   Úimpacket.examples.utilsr   Úimpacket.smbconnectionr   r   Úimpacket.dcerpc.v5r	   r
   r   Úimpacket.dcerpc.v5.rpcrtr   r   r   Úimpacket.dcerpc.v5.dtypesr   r   rV   Úimpacket.dcerpc.v5.tstsr   r   r   rÛ   r   rh  Ústdoutr@  Ú	getwriterr¥   ÚBANNERÚArgumentParserÚparserÚadd_argumentÚadd_subparsersÚ
subparsersÚ
add_parserÚqwinsta_parserÚtasklist_parserÚtaskkill_parserr3   Útscon_parserr’   Útsdiscon_parserÚlogoff_parserÚshutdown_parserÚadd_argument_groupÚshutdown_parser_groupÚ
msg_parserÚshadow_parserÚgrouprk   ÚargvÚ
print_helprB   Ú
parse_argsr-   ÚinitÚtsrÚ   r   rA   ro  r,   r*   r+   r2   rX   r    r"   r'   Úno_passr‡  Ú	tsHandlerrD   r  rá   Ú	print_excr.   r.   r.   r/   Ú<module>   sÞ        
9
ÿ

ÿ
ÿ

ÿ
ÿÿ



8€þˆ