o j> @sddlmZddlmZddlZddlZddlZddlZddlZddlZddl m Z ddl m Z ddl mZmZmZmZddlmZddlmZdd lmZdd lmZdd lmZmZdd lmZGd ddZGdddZ e!dkrKej"j#dure$dej"e_"e%e j&ej'dddZ(e(j)dddde(j)dddde(j)dddde(j*dd d!Z+e+j,d"d#d$Z-e-j)d%ddd&d'e-j)d(dd)d*d+d,e-j)d-dd*d*d.d/e-j)d0dd*d1d2e+j,d3d4d$Z,e,j)d%ddd&d'e,j)d(dd)d*d5d,e,j)d6dd7d*d8d9d:e,j)d;dgd:e,j)d?dd*d@d'e+j,dAdBd$Z.e.j)d%ddd&d'e.j)d(dd)d*dCd,e.j)dDdd*dEd'e.j)d-dd*dFd'e+j,dGdHd$Z/e/j)d%ddd&d'e/j)dIdJddKddLdMe+j,dNdOd$Z0e0j)dIdJddKddLdMe(1dPZ2e2j)dQddRdSdTe2j)dUddVde2j)dWddXde2j)dYddZd[dTe(1d\Z2e2j)d]dd^d_dTe2j)d`dd^dadTe2j)dbdcddgdedddfdgdhe3ej4dikre(5e6die(7Z8e9e8j:e8j;ee8j<\Z=Z>Z?Z@e8jAdure@e8_Ae=durdjZ=e8jBdurde8_Ce?djkre>djkre8jDdure8jEd*ure8jBdurddklFmFZFeFdlZ?e e>e?e=e8ZGz eGHe@e8jAWdSeIyJZJzeKeLeJWYdZJ[JdSdZJ[JwwdS)m)division)print_functionN)unpack)version) transportrrpscmrrpcrt)logger) parse_target)ERROR_NO_MORE_ITEMS)hexdump) SMBConnection SessionError) READ_CONTROLc@sNeZdZdddZddZddZdd Zd d Zd d ZddZ ddZ dS)RemoteOperationsNcCsX||_|jdd|_d|_d|_d|_||_||_d|_d|_ d|_ d|_ d|_ dS)Ni,RemoteRegistryzncacn_np:445[\pipe\winreg]Fzncacn_np:445[\pipe\svcctl]) _RemoteOperations__smbConnection setTimeout_RemoteOperations__serviceName&_RemoteOperations__stringBindingWinReg_RemoteOperations__rrp_RemoteOperations__regHandle_RemoteOperations__doKerberos_RemoteOperations__kdcHost_RemoteOperations__disabled_RemoteOperations__shouldStop_RemoteOperations__started&_RemoteOperations__stringBindingSvcCtl_RemoteOperations__scmr)self smbConnection doKerberoskdcHostr$/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/../../../bin/reg.py__init__4s  zRemoteOperations.__init__cCs|jSN)rr r$r$r%getRRPFszRemoteOperations.getRRPcC>t|j}||j||_|j|jt j dSr') rDCERPCTransportFactoryrset_smb_connectionr get_dce_rpcrconnectbindrMSRPC_UUID_SCMRr rpcr$r$r%__connectSvcCtlI    z RemoteOperations.__connectSvcCtlcCr*r') rr+rr,rr-rr.r/rMSRPC_UUID_RRPr1r$r$r% connectWinRegPr4zRemoteOperations.connectWinRegcCs:t|j}|d|_t|j|j|j}|d|_t|j|j}|ddtjkr:t d|jd|_ d|_ n |ddtj krRt d|jd|_ d|_ ntd |d |j durt|j|j}|d d d krt d|jd|_tj|j|jddt d|jt|j|jtddSdS)N lpScHandlelpServiceHandlelpServiceStatusdwCurrentStatezService %s is in stopped stateTFzService %s is already runningz%Unknown service state 0x%x - Aborting CurrentStatelpServiceConfig dwStartTypez#Service %s is disabled, enabling itr=zStarting service %s)rhROpenSCManagerWr"_RemoteOperations__scManagerHandlehROpenServiceWr _RemoteOperations__serviceHandlehRQueryServiceStatusSERVICE_STOPPEDlogginginforrSERVICE_RUNNINGdebug ExceptionhRQueryServiceConfigWrhRChangeServiceConfigWhRStartServiceWtimesleep)r ansr$r$r%__checkServiceStatusWs0    z%RemoteOperations.__checkServiceStatuscCs|||dSr') _RemoteOperations__connectSvcCtl%_RemoteOperations__checkServiceStatusr6r(r$r$r%enableRegistryvs zRemoteOperations.enableRegistrycCsd|jdurtd|jt|j|jtj|j dur0td|jtj |j|jdddSdS)NTzStopping service %sz+Restoring the disabled state for service %sr>r@) rrHrIrrhRControlServicerrESERVICE_CONTROL_STOPrrNr(r$r$r% __restore{s  zRemoteOperations.__restorecCs8||jdur|j|jdur|jdSdSr')_RemoteOperations__restorer disconnectrr(r$r$r%finishs    zRemoteOperations.finishr') __name__ __module__ __qualname__r&r)rTr6rUrVrZr\r$r$r$r%r3s  rc@speZdZddZddZddZddZd d Zd d Zd dZ ddZ ddZ ddZ ddZ eddZdS) RegHandlerc Cs||_||_||_||_|j|_d|_d|_|j |_ |j |_ |j |_d|_d|_dddddddd d d |_|jdurH|jd \|_|_dSdS) NREG_NONEREG_SZ REG_EXPAND_SZ REG_BINARY REG_DWORDREG_DWORD_BIG_ENDIANREG_LINK REG_MULTI_SZ REG_QWORD) rrAr?r> :)_RegHandler__username_RegHandler__password_RegHandler__domain_RegHandler__optionsactionupper_RegHandler__action_RegHandler__lmhash_RegHandler__nthashaesKey_RegHandler__aesKeyk_RegHandler__doKerberosdc_ip_RegHandler__kdcHost_RegHandler__smbConnection_RegHandler__remoteOps_RegHandler__regValueshashessplit)r usernamepassworddomainoptionsr$r$r%r&s$   zRegHandler.__init__c Csjt||t|jjd|_|jr$|j|j|j|j |j |j |j |j dS|j|j|j|j |j |j dS)N) sess_port)rintrtportrr} kerberosLoginrqrrrsrxryr{rlogin)r remoteName remoteHostr$r$r%r.s  "zRegHandler.connectc Cs|||t|j|j|j|_z|jWn'ty>}zt t |t d| |j WYd}~nd}~wwzz[|j}|jdkrT|||jjnF|jdkre|||jj|jjn5|jdkrs|||jjn'|jdkr|||jjn|jdkrdD]}|||qntd|jWnttfy}z tt |WYd}~nd}~wwW|jr|jdSdS|jr|jww) NzICannot check RemoteRegistry status. Triggering start trough named pipe...QUERYADDDELETESAVEBACKUP)zHKLM\SAMz HKLM\SYSTEMz HKLM\SECURITYzMethod %s not implemented yet!)r.rrr}rrrVrLrHrKstrwarning triggerWinRegr6r)rwqueryrtkeyNameadd persistentdeletesaveerrorKeyboardInterruptcriticalr\)r rredcehiver$r$r%runsJ         zRegHandler.runcCsH|jd}z |jj|dddddWn tyYnwtddS)NzIPC$z\winregi@)creationOptionfileAttributesrA)r connectTreeopenFilerrPrQ)r tidr$r$r%rs  zRegHandler.triggerWinRegc Cs|||\}}d|jj|f}td|z$tj|||tjtjBtj d}t ||d|t d||fWdSt yW}zt d||fWYd}~dSd}~ww)Nz %s\%s.savezMDumping %s, be patient it can take a while for large hives (e.g. HKLM\SYSTEM) dwOptions samDesired phkResultzSaved %s to %szCouldn't save %s: %s)_RegHandler__strip_root_keyrt outputPathrHrKrhBaseRegOpenKeyREG_OPTION_BACKUP_RESTOREREG_OPTION_OPEN_LINKKEY_READhBaseRegSaveKeyrIrLr)r rrhRootKeysubKeyoutputFileNameans2rr$r$r%rs zRegHandler.savec Csp|||\}}tj|||tjtjBtjBd}|jjrGt|t ||d|jj}td|jjd|j |dddt |ddS|jj rnt|t ||dd}td|j |dddt |ddS|jjr|||d |dddSt||||dd} zt||d|}t|d |d dd |d7}Wn tyYdSwq) Nrr r KEY_NOT_FOUNDrAraz (Default) \T lpNameOut)rrrMAXIMUM_ALLOWEDKEY_ENUMERATE_SUB_KEYSKEY_QUERY_VALUErtvprinthBaseRegQueryValuergetrves*_RegHandler__print_all_subkeys_and_entries_RegHandler__print_key_valueshBaseRegEnumKeyrL) r rrrrrvalueikeyr$r$r%rs4 8,  zRegHandler.querycCs8|||\}}|jjdurb|}d|ddd}tj|||ttjBtj Bd}d}|dur4d}nt dtj ||||ttjBtj Bd} | d dkrVt d |dSt d | d |fdStj|||ttjBtj Bd}t t|jj d} | dus|jj d std |jj | tjkrd|jj} | d} | dd} nBt|jjdkr|jjdnd} | tjtjtjtjtjfvrt| } n| tjkrt| }||d@7}t| |d} n| d} | } t||d|jj| | } | d dkr t d||jj|jj | fdSt d| d ||jj|jj | fdS)NrrrrATrzD[!] The created key is volatile and will not remain after a reboot. r ErrorCodezSuccessfully set subkey %sz%Error 0x%08x while creating subkey %sREG_zError parsing value type %szz ra0rz.Successfully set key %s\%s type %s value %sz8Error 0x%08x while setting key %s\%s type %s value %s)rrtrjoinrrrr KEY_SET_VALUEKEY_CREATE_SUB_KEYrhBaseRegCreateKeygetattrvt startswithrLrivdreplacelenrfrgREG_DWORD_LITTLE_ENDIANrjREG_QWORD_LITTLE_ENDIANrrebinasciia2b_hexljusthBaseRegSetValue)r rrrrr subKeyCreaterdwOptionans3dwTyper valueDatavalueDataToPrint bin_value_lenr$r$r%rsl             zRegHandler.addc Csx|||\}}|jjdur|jjs|jjs|}d|ddd}tj|||t tj Btj Bd}z t |||}Wn7t jy\}z|jdkrWtd|WYd}~dSd}~wtys}z tdWYd}~dSd}~ww|ddkrtd |dStd |d|fdS|jjrtj|||t tj Btj Bd}t||d |jj}|ddkrtd ||jjfdStd |d||jjfdS|jjr tj|||t tj Btj Bd}t||d d}|ddkrtd|dfdStd|d||jjfdS|jjrtj|||tjtjBd}d} g} zt||d | }|ddd} | | | d7} Wn!tjy]}z|tkrSWYd}~n WYd}~nd}~wwq tj|||tjtjBd} | D]J}z't|| d |} | ddkrtd||fn td| d||fWqoty}ztdt|||fWYd}~qod}~wwdSdS)NrrrrlzMCannot delete key %s. Possibly it contains subkeys or insufficient privilegesz+Unhandled exception while hBaseRegDeleteKeyrrzSuccessfully deleted subkey %sz%Error 0x%08x while deleting subkey %srzSuccessfully deleted key %s\%sz%Error 0x%08x while deleting key %s\%sraz Successfully deleted value %s\%sDefaultz'Error 0x%08x while deleting value %s\%sTlpValueNameOutrAz'Error 0x%08x in deletion of value %s\%sz-Unhandled error %s in deletion of value %s\%s)rrtrvarrrrrrrrhBaseRegDeleteKeyr DCERPCException error_coderrLrHrhBaseRegDeleteValuerrhBaseRegEnumValueappendDCERPCSessionErrorget_error_coder r)r rrrr subKeyDeleterrrr allSubKeys lp_value_nameans4ans5r$r$r%rRs                           zRegHandler.deletecCsz|dd}d|ddd}Wn ty"td|w|dkr/t|}n*|dkr;t|}n|dkrGt|}n|dkrSt|}ntd ||d }||fS) NrrrAzError parsing keyName %sHKLMHKCUHKUHKCRzInvalid root key %s phKey) rrrLrvrhOpenLocalMachinehOpenCurrentUser hOpenUsershOpenClassesRoot)r rrrootKeyrrRrr$r$r%__strip_root_keys"           zRegHandler.__strip_root_keyc Csd} zAt|||}|ddd}t|dkrd}|d}d|d}td |d |j|d d d d ||||d 7}Wn tjyd}z| t krZWYd}~dSWYd}~nd}~wwq)NrTrrz (Default)lpTypelpDatarr )endrA) rrrrrrr_RegHandler__parse_lp_datarrr ) r r2 keyHandlerrrrlp_typelp_datarr$r$r%__print_key_valuess& &    zRegHandler.__print_key_valuesc CsRd} z>t|||}|d7}tj|||dtjtjBd}||dddd}t||||d||||ddWnftjya}z| t krWWYd}~dSWYd}~nKd}~wt j y}z:t |d dkrtd |dddWYd}~qt |d dkrtd |dddWYd}~dSd}~wwq) NrTrArrrrr access_deniedz%Cannot access subkey %s, bypassing itrpc_x_bad_stub_dataz6Fault call, cannot retrieve value for %s, bypassing it)rrrrrrrrrrr r rrfindrHr) r r2rr indexsubkeyrR newKeyNamerr$r$r%__print_all_subkeys_and_entriess8    z*RegHandler.__print_all_subkeys_and_entriesc Csz|tjks |tjkr(t|turtdWdStd|dddWdS|tjkr9tdt|dWdS|tj krLtdt d|d WdS|tj kr_tdt d |d WdS|tj krzt |d krutdt|dntd WWdSWWdStd YWdS|tjkrtd|ddd WdStd|t|WdSty}ztdt|tdWYd}~dSd}~ww)NNULLz%szutf-16lerrarz0x%xz           zRegHandler.__parse_lp_dataN)r]r^r_r&r.rrrrrrrrr staticmethodr r$r$r$r%r`s $  Oir`__main__utf8Tz%Windows Register manipulation script.)add_help descriptiontargetstorez6[[domain/]username[:password]@])ruhelpz-debug store_truezTurn DEBUG output ONz-tsz&Adds timestamp to every logging outputactionsru)r$destrzqReturns a list of the next tier of subkeys and entries that are located under a specified subkey in the registry.)r$z-keyNamezSpecifies the full path of the subkey. The keyName must include a valid root key. Valid root keys for the local computer are: HKLM, HKU, HKCU, HKCR.)rurequiredr$z-v VALUENAMEFzoSpecifies the registry value name that is to be queried. If omitted, all value names for keyName are returned. )rumetavarr(r$z-vez1Queries for the default value or empty value name)rudefaultr(r$z-sz;Specifies to query all subkeys and value names recursively.)rur+r$rz*Adds a new subkey or entry to the registryz[Specifies the registry value name that is to be set. Set to "" to write the (Default) valuez-vt VALUETYPEzSpecifies the registry type name that is to be set. Default is REG_SZ. Valid types are: REG_NONE, REG_SZ, REG_EXPAND_SZ, REG_BINARY, REG_DWORD, REG_DWORD_BIG_ENDIAN, REG_LINK, REG_MULTI_SZ, REG_QWORDrc)rur*r(r$r+z-vdr VALUEDATAzSpecifies the registry value data that is to be set. In case of adding a REG_MULTI_SZ value, set this option once for each line you want to add.z --persistentzjSpecify that the created key is intended to be persistent through reboot. Default is volatile key creationrz-Deletes a subkey or entries from the registryz8Specifies the registry value name that is to be deleted.z-vaz!Delete all values under this key.z/Delete the value of empty value name (Default).rz[Saves a copy of specified subkeys, entries, and values of the registry in a specified file.z-orz\\192.168.0.2\sharezCOutput UNC path the target system must export the registry saves to)r'rur*r(r$backupzW(special command) Backs up HKLM\SAM, HKLM\SYSTEM and HKLM\SECURITY to a specified file.authenticationz-hashesz LMHASH:NTHASHz$NTLM hashes, format is LMHASH:NTHASH)rur*r$z-no-passz&don't ask for password (useful for -k)z-kzUse Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use the ones specified in the command linez-aesKeyzhex keyzs         Y                8