o
    àý°jGW  ã                
   @   s<  d dl mZ d dl mZ d dlZd dlZd dlZd dlZd dlmZm	Z	 d dl
mZ d dlmZ d dlmZ d dlmZ d d	lmZ d d
lmZ d dlmZmZmZmZ d dlmZ d dlmZ d dlm Z  eƒ Z!eƒ Z"da#dBdd„Z$G dd„ dƒZ%e&dkrœe'ej(ƒ e )¡ Z*e*j+dddd e*j+dddd e*j+de ,d¡dd e*j+ddd d e*j+d!e ,d¡d"d e*j+d#d$dd%d& e*j+d'dd(d)d& e*j+d*dd+d,d& e*j+d-d$d.d e*j+d/d$d0d e* -d1¡Z.e.j+d2dd3d4d5 e.j+d6d$d7d e.j+d8d$d9d e.j+d:dd;d<d5 e.j+d=dd>d?d5 e/ej0ƒd@kr"e* 1¡  e 2d@¡ e* 3¡ Z4e 5e4j6e4j7¡ ee4j8e4j9e4j:e4j;e4j<ƒ\Z=Z>Z?Z@Z@e4_<ze%e>e?e=e4j9e4j;e4j<e4ƒZAeA B¡  W n? eCy‚ ZD z e E¡ jFejGkrod dlHZHeH I¡  e JeD¡ eA K¡  W Y dZD[DndZD[Dw eLy”   e MdA¡ eA K¡  Y nw e 2d ¡ dS dS )Cé    )Údivision)Úprint_functionN)ÚThreadÚEvent)ÚQueue)Úsleep)Úlogger)Úparse_identity)Úversion)ÚSessionError)Ú	transportÚwkstÚsrvsÚsamr)ÚNULL)ÚDCERPCException)ÚSTATUS_MORE_ENTRIESFc           	      C   s2  t | ƒ}| }d}|s—| ¡ rd}d S |D ]O}t ¡ }zt |dfd¡}| ¡ d a| ¡  t |¡ W n t	yN } zt
 d||f ¡ W Y d }~nd }~ww t
 d| ¡ | |¡ | ¡ rcd} nqt
 d|t |ƒ t |ƒ|f ¡ |du rzd}|s“td	ƒ t ¡ du r“| t ¡ ¡ t ¡ du s†|r
d S d S )
NFTé½  é   r   z%s: not alive (%s)z
%s: alive!zup: %d, down: %d, total: %dé
   )ÚlenÚis_setÚsocketÚcreate_connectionÚgetsocknameÚmyIPÚcloseÚmachinesAliveQueueÚputÚ	ExceptionÚloggingÚdebugÚremover   ÚmachinesDownQueueÚemptyÚappendÚget)	ÚmachinesÚ	stopEventÚ
singlePassÚorigLenÚdeadMachinesÚdoneÚmachineÚsÚe© r0   ú‡/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/../../../bin/netview.pyÚcheckMachinesN   sD   €þ
þ ÿär2   c                   @   sN   e Zd Zddd„Zdd„ Zdd	„ Zd
d„ Zdd„ Zdd„ Zdd„ Z	dd„ Z
dS )ÚUSERENUMÚ NFc                 C   sˆ   || _ || _|| _d| _d| _|| _|| _|j| _|| _	t
ƒ | _tƒ | _d | _d | _d | _t|jƒ| _|d urB| d¡\| _| _d S d S )Nr4   ú:)Ú_USERENUM__usernameÚ_USERENUM__passwordÚ_USERENUM__domainÚ_USERENUM__lmhashÚ_USERENUM__nthashÚ_USERENUM__aesKeyÚ_USERENUM__doKerberosÚdc_ipÚ_USERENUM__kdcHostÚ_USERENUM__optionsÚlistÚ_USERENUM__machinesListÚdictÚ_USERENUM__targetsÚ_USERENUM__filterUsersÚ_USERENUM__targetsThreadEventÚ_USERENUM__targetsThreadÚintÚmax_connectionsÚ_USERENUM__maxConnectionsÚsplit)ÚselfÚusernameÚpasswordÚdomainÚhashesÚaesKeyÚ
doKerberosÚoptionsr0   r0   r1   Ú__init__r   s$   ÿzUSERENUM.__init__c                 C   sì  | j d ur	| j }n| jdkr| j}ntdƒ‚t d| ¡ tj|dd| j| j| j| j	| j
| j| j| j d}| ¡ }| ¡  | tj¡ zžt |¡}|d }t ||¡}|d d }t d	|d
 d  ¡ t |||d
 d ¡}tj|||d d}|d }t}d
}	|tkràztj||tj|	d}W n  ty± }
 zt|
ƒ d¡d
k r£‚ |
 ¡ }W Y d }
~
nd }
~
ww |d d D ]}| j |d d d… ¡ t d|d |d f ¡ q¸|d }	|d }|tks…W n tyï }
 z|
‚d }
~
ww |  ¡  d S )Nr4   zA domain is needed!zGetting machine's list from %sr   z\samr)rQ   ÚkdcHostÚServerHandleÚBufferzLooking up users in domain %sr   ÚNameÚDomainId)ÚserverHandleÚdomainIdÚDomainHandle)ÚenumerationContextr   éÿÿÿÿzMachine name - rid: %s - %dÚ
RelativeIdÚEnumerationContextÚ	ErrorCode)!r>   r8   r   r    Úinfor   ÚSMBTransportr6   r7   r9   r:   r;   r<   Úget_dce_rpcÚconnectÚbindr   ÚMSRPC_UUID_SAMRÚhSamrConnectÚ hSamrEnumerateDomainsInSamServerÚhSamrLookupDomainInSamServerÚhSamrOpenDomainr   ÚhSamrEnumerateUsersInDomainÚUSER_WORKSTATION_TRUST_ACCOUNTr   ÚstrÚfindÚ
get_packetrA   r%   r!   Ú
disconnect)rK   ÚdomainControllerÚrpctransportÚdceÚresprY   ÚdomainsÚdomainHandleÚstatusr\   r/   Úuserr0   r0   r1   ÚgetDomainMachines…   s^   

þ

ÿ€ýò€€ÿzUSERENUM.getDomainMachinesc                 C   s†   t  d¡ | jjd u r| jjd u r|  ¡  n!| jjd ur/| jj ¡ D ]}| j | 	d¡¡ q"n| j | jj¡ t  dt
| jƒ ¡ d S )NzImporting targetsú 
zGot %d machines)r    ra   r?   ÚtargetÚtargetsry   Ú	readlinesrA   r%   Ústripr   ©rK   Úliner0   r0   r1   Ú
getTargets¸   s   

ÿzUSERENUM.getTargetsc                 C   sn   | j jd urtƒ | _| j | j j¡ d S | j jd ur2tƒ | _| j j ¡ D ]}| j | d¡¡ q$d S d | _d S )Nrz   )r?   rx   r@   rD   r%   Úusersr}   r~   r   r0   r0   r1   ÚfilterUsersÅ   s   ÿ
zUSERENUM.filterUsersc                 C   sJ  |   ¡  |  ¡  tƒ | _| jjdu r#tt| j| jfd| _	| j	 
¡  n	t| j| jdd 	 t ¡ du rnt ¡ }t d| ¡ i | j|< d | j| d< d | j| d< d| j| d< tƒ | j| d	< tƒ | j| d
< t ¡ du s3t| j ¡ ƒD ]Š}z|  |¡ |  |¡ W qu ttfyÏ } z>t|ƒ d¡dkr¢t d| ¡ | j|= n#t|ƒ d¡dkr°| j|= nt|ƒ d¡dkr¾| j|= nt t|ƒ¡ W Y d }~qud }~w tyÖ   ‚  tyÿ } zt|ƒ d¡dkrð| j|= t |¡ nt |¡ W Y d }~qud }~ww | jjdu r	d S t d| jj  ¡ t dt!| jƒ ¡ t"t#| jj ƒƒ q-)NF)r{   ÚargsT)r)   zAdding %s to the up listÚSRVSÚWKSTÚAdminÚSessionsÚLoggedInÚLOGON_FAILUREr   z'STATUS_LOGON_FAILURE for %s, discardingÚINVALID_PARAMETERÚaccess_deniedz	timed outzSleeping for %s secondsz&Currently monitoring %d active targets)$r   rƒ   r   rE   r?   Únoloopr   r2   rA   rF   Ústartr   r$   r&   r    r!   rC   r@   ÚsetÚkeysÚgetSessionsÚgetLoggedInr   r   rm   rn   Úerrorra   ÚKeyboardInterruptr   r#   r   Údelayr   r   rG   )rK   r-   r{   r/   r0   r0   r1   ÚrunÑ   sb   
ø




€
€ôËzUSERENUM.runc              
   C   sÚ  | j | d d u rEd| }t |¡}t|dƒr/| | j| j| j| j| j	| j
¡ | | j| j¡ | ¡ }| ¡  | tj¡ |  jd8  _n| j | d }z
t |dtd¡}W n+ ty } zt|ƒ d¡dkr|d | j | d< |  jd7  _W Y d }~d S ‚ d }~ww | jdk r| ¡  d| _n|| j | d< tƒ }d	}|d
 d d d D ]r}	|	d d d… }
|	d d d… dd … }d|
|f }d| jtf }| |¡ || j | d vr||kr| j | d  |¡ | jd ur|
| jv rt d||
||	d |	d f ¡ d}q¥t d||
||	d |	d f ¡ d}q¥t | j | d ƒD ]?\}}	|	 !d¡\}
}|	|vr_| j | d |= | jd urS|
| jv rQt d||
|f ¡ d}q!t d||
|f ¡ d}q!|du rkt"ƒ  d S d S )Nr…   zncacn_np:%s[\PIPE\srvsvc]Úset_credentialsé   ú r   úBroken piper   FÚ
InfoStructÚSessionInfoÚLevel10rV   Úsesi10_usernamer]   Úsesi10_cnamer   ú%s%srˆ   z6%s: user %s logged from host %s - active: %d, idle: %dÚsesi10_timeÚsesi10_idle_timeTúz#%s: user %s logged off from host %s)#rC   r   ÚDCERPCTransportFactoryÚhasattrr—   r6   r7   r8   r9   r:   r;   Úset_kerberosr<   r>   rc   rd   re   r   ÚMSRPC_UUID_SRVSrI   ÚhNetrSessionEnumr   r   rm   rn   rp   r@   r   r%   rD   r    ra   Ú	enumeraterJ   Úprint)rK   r{   ÚstringSrvsBindingÚrpctransportSrvsrs   rt   r/   Ú
tmpSessionÚ	printCRLFÚsessionÚuserNameÚsourceIPÚkeyÚmyEntryÚnItemr0   r0   r1   r‘     s‚   

ÿ€ù
	

ÿ€ÿ€
€€

ÿzUSERENUM.getSessionsc              
   C   sø  | j | d du rd S | j | d d u rPd| }t |¡}t|dƒr:| | j| j| j| j| j	| j
¡ | | j| j¡ | ¡ }| ¡  | tj¡ |  jd8  _n| j | d }zt |d¡}W nM ty¬ } zAt|ƒ d¡dkr…d | j | d< |  jd7  _W Y d }~d S t|ƒ ¡  d	¡r§| ¡  |  jd7  _d| j | d< W Y d }~d S ‚ d }~ww | jdk rº| ¡  d| _n|| j | d< tƒ }d}|d
 d d d D ]V}	|	d d d… }
|	d d d… }d|
|f }| |¡ || j | d vr&| j | d  |¡ | jd ur|
| jv rt d|||
f ¡ d}qÐt d|||
f ¡ d}qÐ| j | d  ¡ D ]?}	|	  d¡\}
}|	|vrn| j | d  !|	¡ | jd urb|
| jv r`t d|||
f ¡ d}q0t d|||
f ¡ d}q0|du rzt"ƒ  d S d S )Nr‡   Fr†   zncacn_np:%s[\PIPE\wkssvc]r—   r˜   rš   r   ÚACCESS_DENIEDÚUserInfoÚWkstaUserInfoÚLevel1rV   Úwkui1_usernamer]   Úwkui1_logon_domainr    r‰   z %s: user %s\%s logged in LOCALLYTr£   z!%s: user %s\%s logged off LOCALLY)#rC   r   r¤   r¥   r—   r6   r7   r8   r9   r:   r;   r¦   r<   r>   rc   rd   re   r   ÚMSRPC_UUID_WKSTrI   ÚhNetrWkstaUserEnumr   rm   rn   Úupperrp   r   ÚaddrD   r    ra   ÚcopyrJ   r"   rª   )rK   r{   ÚstringWkstBindingÚrpctransportWkstrs   rt   r/   ÚtmpLoggedUsersr®   r¯   r°   ÚlogonDomainr²   r0   r0   r1   r’   c  s„   

ÿ€ó

€€
€€

ÿzUSERENUM.getLoggedInc                 C   s   | j d ur| j  ¡  d S d S )N)rE   r   )rK   r0   r0   r1   Ústop³  s   
ÿzUSERENUM.stop)r4   r4   r4   NNFN)Ú__name__Ú
__module__Ú__qualname__rS   ry   r   rƒ   r–   r‘   r’   rÄ   r0   r0   r0   r1   r3   q   s    
3FLPr3   Ú__main__ÚidentityÚstorez[domain/]username[:password])ÚactionÚhelpz-userzFilter output by this userz-usersÚrz5input file with list of users to filter to output for)ÚtyperÌ   z-targetzRtarget system to query info from. If not specified script will run in domain mode.z-targetszrinput file with targets system to query info from (one per line). If not specified script will run in domain mode.z-noloopÚ
store_truezStop after the first probe)rË   ÚdefaultrÌ   z-delayÚ10zDseconds delay between starting each batch probe (default 10 seconds)z-max-connectionsÚ1000z7Max amount of connections to keep opened (default 1000)z-tsz&Adds timestamp to every logging outputz-debugzTurn DEBUG output ONÚauthenticationz-hasheszLMHASH:NTHASHz$NTLM hashes, format is LMHASH:NTHASH)rË   ÚmetavarrÌ   z-no-passz&don't ask for password (useful for -k)z-kzÁUse Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use the ones specified in the command linez-aesKeyzhex keyz<AES key to use for Kerberos Authentication (128 or 256 bits)z-dc-ipz
ip addresszoIP Address of the domain controller. If ommited it use the domain part (FQDN) specified in the target parameterr˜   zQuitting.. please wait)F)NÚ
__future__r   r   ÚsysÚargparser    r   Ú	threadingr   r   Úqueuer   Útimer   Úimpacket.examplesr   Úimpacket.examples.utilsr	   Úimpacketr
   Úimpacket.smbconnectionr   Úimpacket.dcerpc.v5r   r   r   r   Úimpacket.dcerpc.v5.ndrr   Úimpacket.dcerpc.v5.rpcrtr   Úimpacket.nt_errorsr   r   r#   r   r2   r3   rÅ   rª   ÚBANNERÚArgumentParserÚparserÚadd_argumentÚFileTypeÚadd_argument_groupÚgroupr   ÚargvÚ
print_helpÚexitÚ
parse_argsrR   ÚinitÚtsr!   rÉ   rO   Úno_passrP   ÚkrN   rL   rM   Ú_Úexecuterr–   r   r/   Ú	getLoggerÚlevelÚDEBUGÚ	tracebackÚ	print_excr“   rÄ   r”   ra   r0   r0   r0   r1   Ú<module>   s‚   4
#  
J


(
€
þÇ