o
    àý°j9M  ã                   @   sz  d dl mZ d dl mZ d dlZd dlZd dlZd dlZd dlZd dlZd dl	Z	d dl
mZ d dlmZ d dlmZ d dlmZ d dlmZmZmZmZ d d	lmZmZ d d
lmZ d dlmZ d dlmZ de e ¡ ƒ Z!ej"j#Z$G dd„ dƒZ%G dd„ dej&ƒZ'G dd„ de(ƒZ)dd„ Z*e+dk�r»e,ej-ƒ ej.ddd�Z/e/j0dddd� e/j0dddd d!� e/j0d"d#d$d%d!� e/j0d&d#d'd� e/j0d(d#d$d)d!� e/j0d*d#d+d� e/j0d,dd-e$ d� e/j0d.dd/d/d0gd1d2� e/j0d3dd4d5d6� e/j0d7d8d9d:d;� e/ 1d<¡Z2e2j0d=dd>d?d6� e2j0d@d#dAd� e2j0dBd#dCd� e2j0dDddEdFd6� e2j0dGddHdId6� e2j0dJddHdKd6� e2j0dLddMdNd6� e2j0dOddPd� e3ej4ƒdQk�rUe/ 5¡  e 6dQ¡ e/ 7¡ Z8e 9e8j:e8j;¡ e8j<du�rke8j<Z$ne$du �rrdRZ$d9 =e8j>¡d9k�r‹e8j?du �r‹e @dS¡ e 6dQ¡ e8jA�rŸe8j>d9k�rŸe @dT¡ e 6dQ¡ e8jBdu�rÎze8jB CdU¡\ZDZEe FeGeDƒeGeEƒ¡ W n e(�yÍ   e @dV¡ e 6dQ¡ Y nw ee8jHƒ\ZIZJZKZLz“e8jMdu�röe*e8jMƒ\ZIZJZKe ;dWeNeIƒeNeJƒeNeKƒf ¡ e8jOdu �rÿeLe8_OeIdu �rdXZIe8jPdu�re Qe8jPeJeIe8¡ de8_ReKdXk�r>eJdXk�r>e8jSdu �r>e8jTd$u �r>e8jUdu �r>d dYlVmVZV eVdZƒZKe8jUdu�rGde8_Re%d9 =e8j>¡eJeKeIe8jSe8jUe8jWe8j?e8jRe8jXe8jOe8jYƒZZeZ [eLe8jA¡ W nI e\�y„ Z] ze @e e]ƒ¡ W Y dZ][]n4dZ][]w e(�y³ Z] z#e ^¡ j_ej`k�r�d dlaZaea b¡  e @e e]ƒ¡ e 6dQ¡ W Y dZ][]ndZ][]ww e 6d ¡ dS dS )[é    )Údivision)Úprint_functionN)Ú	b64encode)Úlogger)Úparse_target)Úversion)ÚSMBConnectionÚSMB_DIALECTÚSMB2_DIALECT_002ÚSMB2_DIALECT_21)ÚDCOMConnectionÚ
COMVERSION)Úwmi)ÚNULL)ÚKeytabÚ__c                   @   s$   e Zd Z		ddd„Zd	dd„ZdS )
ÚWMIEXECÚ NFc                 C   sv   || _ || _|| _|| _d| _d| _|| _|| _|| _|	| _	|
| _
|| _|| _d | _|d ur9| d¡\| _| _d S d S )Nr   ú:)Ú_WMIEXEC__commandÚ_WMIEXEC__usernameÚ_WMIEXEC__passwordÚ_WMIEXEC__domainÚ_WMIEXEC__lmhashÚ_WMIEXEC__nthashÚ_WMIEXEC__aesKeyÚ_WMIEXEC__shareÚ_WMIEXEC__noOutputÚ_WMIEXEC__doKerberosÚ_WMIEXEC__kdcHostÚ_WMIEXEC__remoteHostÚ_WMIEXEC__shell_typeÚshellÚsplit)ÚselfÚcommandÚusernameÚpasswordÚdomainÚhashesÚaesKeyÚshareÚnoOutputÚ
doKerberosÚkdcHostÚ
remoteHostÚ
shell_type© r1   ú‡/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/../../../bin/wmiexec.pyÚ__init__4   s"   ÿzWMIEXEC.__init__c                 C   s  | j du r^|du r^t|| jƒ}| jdu r#| | j| j| j| j| j	¡ n|j
| j| j| j| j| j	| j| jd� | ¡ }|tkrDt d¡ n|tkrNt d¡ n|tkrXt d¡ nt d¡ nd }t|| j| j| j| j| j	| jd| j| j| jd�}z>| tjtj¡}t |¡}| d	tt¡}| ¡  | d
¡\}	}
t| j|	|| j|ƒ| _ | j!dkr°| j  "| j!¡ n| j  #¡  W nA t$t%fy÷ } z3t &¡ j'tj(krÐdd l)}| *¡  t +t,|ƒ¡ |d urß| -¡  | .¡  t/j0 1¡  t/ 2d¡ W Y d }~nd }~ww |d u�r| -¡  | .¡  d S )NF)r.   zSMBv1 dialect usedzSMBv2.0 dialect usedzSMBv2.1 dialect usedzSMBv3.0 dialect usedT)ÚoxidResolverr-   r.   r/   z//./root/cimv2ÚWin32_Processú r   é   )3r   r   r    r   Úloginr   r   r   r   r   ÚkerberosLoginr   r   Ú
getDialectr	   ÚloggingÚinfor
   r   r   ÚCoCreateInstanceExr   ÚCLSID_WbemLevel1LoginÚIID_IWbemLevel1LoginÚIWbemLevel1LoginÚ	NTLMLoginr   Ú
RemReleaseÚ	GetObjectÚRemoteShellr   r!   r"   r   ÚonecmdÚcmdloopÚ	ExceptionÚKeyboardInterruptÚ	getLoggerÚlevelÚDEBUGÚ	tracebackÚ	print_excÚerrorÚstrÚlogoffÚ
disconnectÚsysÚstdoutÚflushÚexit)r$   ÚaddrÚsilentCommandÚsmbConnectionÚdialectÚdcomÚ
iInterfaceÚiWbemLevel1LoginÚiWbemServicesÚwin32ProcessÚ_ÚerL   r1   r1   r2   ÚrunG   sZ   
ÿÿ


€
€÷
zWMIEXEC.run)r   r   r   r   NNNFFNr   N©F)Ú__name__Ú
__module__Ú__qualname__r3   ra   r1   r1   r1   r2   r   3   s
    
ÿr   c                   @   s€   e Zd Zd dd„Zdd„ Zdd„ Zdd	„ Zd
d„ Zdd„ Zdd„ Z	dd„ Z
dd„ Zdd„ Zdd„ Zdd„ Zd!dd„Zdd„ ZdS )"rD   Fc                 C   s    t j | ¡ || _dt | _tdƒ| _d| _|| _	d| _
|| _|| _|| _tdƒ| _d| _d| _| jd urA| j d¡ |  d¡ nd	| _| jd	u rNd| _d S d S )
Nú\r   zcmd.exe /Q /c z@powershell.exe -NoP -NoL -sta -NonI -W Hidden -Exec Bypass -Enc zC:\Fzg[!] Launching semi-interactive shell - Careful what you execute
[!] Press help for extra shell commandsi † T)ÚcmdÚCmdr3   Ú_RemoteShell__shareÚOUTPUT_FILENAMEÚ_RemoteShell__outputrO   Ú_RemoteShell__outputBufferÚ_RemoteShell__shellÚ_RemoteShell__shell_typeÚ_RemoteShell__pwshÚ_RemoteShell__win32ProcessÚ_RemoteShell__transferClientÚ_RemoteShell__silentCommandÚ_RemoteShell__pwdÚ_RemoteShell__noOutputÚintroÚ
setTimeoutÚdo_cd)r$   r+   r^   rX   r0   rW   r1   r1   r2   r3   |   s(   





ÿzRemoteShell.__init__c                 C   s   t  |¡ d S ©N)ÚosÚsystem©r$   Úsr1   r1   r2   Údo_shell–   s   zRemoteShell.do_shellc                 C   s   t dƒ d S )Na‹  
 lcd {path}                 - changes the current local directory to {path}
 exit                       - terminates the server process (and this session)
 lput {src_file, dst_path}   - uploads a local file to the dst_path (dst_path = default current directory)
 lget {file}                 - downloads pathname to the current local dir
 ! {cmd}                    - executes a local shell cmd
)Úprint©r$   Úliner1   r1   r2   Údo_help™   s   zRemoteShell.do_helpc              
   C   s^   |dkrt t ¡ ƒ d S zt |¡ W d S  ty. } zt t|ƒ¡ W Y d }~d S d }~ww ©Nr   )r~   ry   ÚgetcwdÚchdirrG   r;   rN   rO   )r$   r|   r`   r1   r1   r2   Údo_lcd¢   s   €ÿzRemoteShell.do_lcdc           	   
   C   sÖ   z>dd l }| | | j|¡¡}| |¡\}}| |¡}t|dƒ}t d||f ¡ | j	 
|d d… d ||j¡ | ¡  W d S  tyj } z t t|ƒ¡ tj |¡r_t |¡ W Y d }~d S W Y d }~d S d }~ww )Nr   ÚwbzDownloading %s\%séÿÿÿÿú$)ÚntpathÚnormpathÚjoinrs   Ú
splitdriveÚbasenameÚopenr;   r<   rq   ÚgetFileÚwriteÚcloserG   rN   rO   ry   ÚpathÚexistsÚremove)	r$   Úsrc_pathr‰   ÚnewPathÚdriveÚtailÚfilenameÚfhr`   r1   r1   r2   Údo_lget«   s    

ÿ€ýzRemoteShell.do_lgetc              
   C   s  zf|  d¡}t|ƒdkr|d }|d }nt|ƒdkr!|d }d}tj |¡}t|dƒ}| dd¡}dd l}| | | j	|¡|¡}| 
|¡\}	}
t d||f ¡ | j |	d d	… d
 |
|j¡ | ¡  W d S  ty€ } zt t|ƒ¡ W Y d }~d S d }~ww )Nr6   r7   r   r   Úrbú/rf   zUploading %s to %sr‡   rˆ   )r#   Úlenry   r’   r�   rŽ   Úreplacer‰   r‹   rs   rŒ   r;   r<   rq   ÚputFileÚreadr‘   rG   ÚcriticalrO   )r$   r|   Úparamsr•   Údst_pathÚsrc_filerš   r‰   Úpathnamer—   r˜   r`   r1   r1   r2   Údo_lput½   s,   


€þzRemoteShell.do_lputc                 C   ó   dS )NTr1   r{   r1   r1   r2   Údo_exitÔ   ó   zRemoteShell.do_exitc                 C   s   t ƒ  |  |¡S rx   )r~   r©   r{   r1   r1   r2   Údo_EOF×   s   
zRemoteShell.do_EOFc                 C   r¨   )NFr1   ©r$   r1   r1   r2   Ú	emptylineÛ   rª   zRemoteShell.emptylinec                 C   s”   |   d| ¡ t| j d¡ƒdkrt| jƒ d| _d S t t | j|¡¡| _|   d¡ | j d¡| _| jd | _	| j
dkrEd| j	 d | _	d| _d S )	Núcd ú
r   r   ú>Ú
powershellzPS r6   )Úexecute_remoterž   rl   Ústripr~   r‰   rŠ   r‹   rs   Úpromptrn   r{   r1   r1   r2   rw   Þ   s   




zRemoteShell.do_cdc                 C   s˜   t |ƒdkr?|d dkr?|  |¡ t | j d¡ƒdkr%t| jƒ d| _d S || _|  d¡ | j d¡| _| jd | _d| _d S |dkrJ|  |¡ d S d S )	Né   r7   r   r¯   r   r   r®   r°   )rž   r²   rl   r³   r~   rs   r´   Ú	send_datar   r1   r1   r2   Údefaultì   s   




ÿzRemoteShell.defaultc              
      sÐ   ‡ fdd„}ˆ j du rdˆ _d S 	 zˆ j ˆ jˆ j|¡ W n? ty[ } z2t|ƒ d¡dkr4t	 
d¡ nt|ƒ d¡dkrQt d	¡ ˆ j ¡  ˆ  ¡ W  Y d }~S W Y d }~nd }~ww qˆ j ˆ jˆ j¡ d S )
Nc              	      sR   zˆ  j |  t¡7  _ W d S  ty(   t d¡ ˆ  j | jtdd�7  _ Y d S w )NzàDecoding error detected, consider running chcp.com at the target,
map the result with https://docs.python.org/3/library/codecs.html#standard-encodings
and then execute wmiexec.py again with -codec and the corresponding codecrŸ   )Úerrors)rl   ÚdecodeÚCODECÚUnicodeDecodeErrorr;   rN   )Údatar¬   r1   r2   Úoutput_callback  s   
üz/RemoteShell.get_output.<locals>.output_callbackTr   ÚSTATUS_SHARING_VIOLATIONr   r7   ÚBrokenz(Connection broken, trying to recreate it)rt   rl   rq   r�   ri   rk   rG   rO   ÚfindÚtimeÚsleepr;   ÚdebugÚ	reconnectÚ
get_outputÚ
deleteFile)r$   r½   r`   r1   r¬   r2   rÅ      s(   
	


€÷üzRemoteShell.get_outputrg   c                 C   sŒ   |dkrd| }| j t| d¡ƒ ¡  }| j| }| jdu r,|dd| j  | j d 7 }| j 	|| j
d ¡}| jdu r@|  ¡  d S | ¡  d S )Nr±   z'$ProgressPreference="SilentlyContinue";zutf-16leFz 1> z\\127.0.0.1\%sz 2>&1)ro   r   Úencoder¹   rm   rt   ri   rk   rp   ÚCreaters   rÅ   ÚprintInformation)r$   r¼   r0   r%   Úresponser1   r1   r2   r²     s   


zRemoteShell.execute_remotec                 C   s"   |   || j¡ t| jƒ d| _d S r‚   )r²   rn   r~   rl   )r$   r¼   r1   r1   r2   r¶   -  s   

zRemoteShell.send_dataNrb   )rg   )rc   rd   re   r3   r}   r�   r…   r›   r§   r©   r«   r­   rw   r·   rÅ   r²   r¶   r1   r1   r1   r2   rD   {   s    
		
rD   c                   @   s    e Zd ZdZdd„ Zdd„ ZdS )ÚAuthFileSyntaxErrorz}raised by load_smbclient_auth_file if it encounters a syntax error
    while loading the smbclient-style authentication file.c                 C   s   || _ || _|| _d S rx   ©r’   ÚlinenoÚreason)r$   r’   rÍ   rÎ   r1   r1   r2   r3   7  s   
zAuthFileSyntaxError.__init__c                 C   s   d| j | j| jf S )Nz(Syntax error in auth file %s line %d: %srÌ   r¬   r1   r1   r2   Ú__str__<  s   ÿzAuthFileSyntaxError.__str__N)rc   rd   re   Ú__doc__r3   rÏ   r1   r1   r1   r2   rË   3  s    rË   c           	      C   sÆ   d}d}d}d}t | ƒD ]Q}|d7 }| ¡ }| d¡s|dkr q| dd¡}t|ƒdkr2t| |dƒ‚|d  ¡ |d  ¡ }}|d	krF|}q|d
krM|}q|dkrT|}qt| |dt|ƒ ƒ‚|||fS )zËLoad credentials from an smbclient-style authentication file (used by
    smbclient, mount.cifs and others).  returns (domain, username, password)
    or raises AuthFileSyntaxError or any I/O exceptions.r   Nr7   ú#r   ú=rµ   zNo "=" present in liner&   r'   r(   zUnknown option %s)rŽ   r³   Ú
startswithr#   rž   rË   Úrepr)	r’   rÍ   r(   r&   r'   r€   ÚpartsÚkÚvr1   r1   r2   Úload_smbclient_auth_fileA  s*   
rØ   Ú__main__TzKExecutes a semi-interactive shell using Windows Management Instrumentation.)Úadd_helpÚdescriptionÚtargetÚstorez6[[domain/]username[:password]@]<targetName or address>)ÚactionÚhelpz-sharezADMIN$z<share where the output will be grabbed from (default ADMIN$))rÞ   r·   rß   z	-nooutputÚ
store_trueFz>whether or not to print the output (no SMB connection created)z-tsz&Adds timestamp to every logging outputz-silentcommandz9does not execute cmd.exe to run given command (no output)z-debugzTurn DEBUG output ONz-codeca  Sets encoding used (codec) from the target's output (default "%s"). If errors are detected, run chcp.com at the target, map the result with https://docs.python.org/3/library/codecs.html#standard-encodings and then execute wmiexec.py again with -codec and the corresponding codec z-shell-typerg   r±   z9choose a command processor for the semi-interactive shell)rÞ   r·   Úchoicesrß   z-com-versionzMAJOR_VERSION:MINOR_VERSIONz<DCOM version, format is MAJOR_VERSION:MINOR_VERSION e.g. 5.7)rÞ   Úmetavarrß   r%   Ú*r6   zRcommand to execute at the target. If empty it will launch a semi-interactive shell)Únargsr·   rß   Úauthenticationz-hasheszLMHASH:NTHASHz$NTLM hashes, format is LMHASH:NTHASHz-no-passz&don't ask for password (useful for -k)z-kzÁUse Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use the ones specified in the command linez-aesKeyzhex keyz<AES key to use for Kerberos Authentication (128 or 256 bits)z-dc-ipz
ip addresszoIP Address of the domain controller. If ommited it use the domain part (FQDN) specified in the target parameterz
-target-ipz£IP Address of the target machine. If omitted it will use whatever was specified as target. This is useful when target is the NetBIOS name and you cannot resolve itz-AÚauthfilezSsmbclient/mount.cifs-style authentication file. See smbclient man page's -A option.z-keytabz"Read keys for SPN from keytab filer7   zutf-8z4-nooutput switch and interactive shell not supportedz9-silentcommand switch and interactive shell not supportedÚ.z>Wrong COMVERSION format, use dot separated integers e.g. "5.7"z?loaded smbclient auth file: domain=%s, username=%s, password=%sr   )Úgetpassz	Password:)cÚ
__future__r   r   rR   ry   rg   ÚargparserÁ   r;   r‰   Úbase64r   Úimpacket.examplesr   Úimpacket.examples.utilsr   Úimpacketr   Úimpacket.smbconnectionr   r	   r
   r   Úimpacket.dcerpc.v5.dcomrtr   r   Úimpacket.dcerpc.v5.dcomr   Úimpacket.dcerpc.v5.dtypesr   Úimpacket.krb5.keytabr   rO   rj   rS   Úencodingrº   r   rh   rD   rG   rË   rØ   rc   r~   ÚBANNERÚArgumentParserÚparserÚadd_argumentÚadd_argument_groupÚgrouprž   ÚargvÚ
print_helprU   Ú
parse_argsÚoptionsÚinitÚtsrÃ   Úcodecr‹   r%   ÚnooutputrN   ÚsilentcommandÚcom_versionr#   Úmajor_versionÚminor_versionÚset_default_versionÚintrÜ   r(   r&   r'   ÚaddressÚArÔ   Ú	target_ipÚkeytabÚloadKeysFromKeytabrÖ   r)   Úno_passr*   rè   r+   Údc_ipr0   Úexecuterra   rH   r`   rI   rJ   rK   rL   rM   r1   r1   r1   r2   Ú<module>   sì   H 9
$

ÿ
üÿ
ÿ
ÿ
ÿ






þÿ
8ÿ€€úŽ