o
    j9M                     @   sz  d dl mZ d dl mZ d dlZd dlZd dlZd dlZd dlZd dlZd dl	Z	d dl
mZ d dlmZ d dlmZ d dlmZ d dlmZmZmZmZ d d	lmZmZ d d
lmZ d dlmZ d dlmZ de e  Z!ej"j#Z$G dd dZ%G dd dej&Z'G dd de(Z)dd Z*e+dkre,ej- ej.dddZ/e/j0dddd e/j0dddd d! e/j0d"d#d$d%d! e/j0d&d#d'd e/j0d(d#d$d)d! e/j0d*d#d+d e/j0d,dd-e$ d e/j0d.dd/d/d0gd1d2 e/j0d3dd4d5d6 e/j0d7d8d9d:d; e/1d<Z2e2j0d=dd>d?d6 e2j0d@d#dAd e2j0dBd#dCd e2j0dDddEdFd6 e2j0dGddHdId6 e2j0dJddHdKd6 e2j0dLddMdNd6 e2j0dOddPd e3ej4dQkrUe/5  e6dQ e/7 Z8e9e8j:e8j; e8j<durke8j<Z$ne$du rrdRZ$d9=e8j>d9kre8j?du re@dS e6dQ e8jAre8j>d9kre@dT e6dQ e8jBdurze8jBCdU\ZDZEeFeGeDeGeE W n e(y   e@dV e6dQ Y nw ee8jH\ZIZJZKZLze8jMdure*e8jM\ZIZJZKe;dWeNeIeNeJeNeKf  e8jOdu reLe8_OeIdu rdXZIe8jPdureQe8jPeJeIe8 de8_ReKdXkr>eJdXkr>e8jSdu r>e8jTd$u r>e8jUdu r>d dYlVmVZV eVdZZKe8jUdurGde8_Re%d9=e8j>eJeKeIe8jSe8jUe8jWe8j?e8jRe8jXe8jOe8jYZZeZ[eLe8jA W nI e\y Z] ze@e e] W Y dZ][]n4dZ][]w e(y Z] z#e^ j_ej`krd dlaZaeab  e@e e] e6dQ W Y dZ][]ndZ][]ww e6d  dS dS )[    )division)print_functionN)	b64encode)logger)parse_target)version)SMBConnectionSMB_DIALECTSMB2_DIALECT_002SMB2_DIALECT_21)DCOMConnection
COMVERSION)wmi)NULL)Keytab__c                   @   s$   e Zd Z		dddZd	ddZdS )
WMIEXEC NFc                 C   sv   || _ || _|| _|| _d| _d| _|| _|| _|| _|	| _	|
| _
|| _|| _d | _|d ur9|d\| _| _d S d S )Nr   :)_WMIEXEC__command_WMIEXEC__username_WMIEXEC__password_WMIEXEC__domain_WMIEXEC__lmhash_WMIEXEC__nthash_WMIEXEC__aesKey_WMIEXEC__share_WMIEXEC__noOutput_WMIEXEC__doKerberos_WMIEXEC__kdcHost_WMIEXEC__remoteHost_WMIEXEC__shell_typeshellsplit)selfcommandusernamepassworddomainhashesaesKeysharenoOutput
doKerberoskdcHost
remoteHost
shell_type r1   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/../../../bin/wmiexec.py__init__4   s"   zWMIEXEC.__init__c                 C   s  | j du r^|du r^t|| j}| jdu r#|| j| j| j| j| j	 n|j
| j| j| j| j| j	| j| jd | }|tkrDtd n|tkrNtd n|tkrXtd ntd nd }t|| j| j| j| j| j	| jd| j| j| jd}z>|tjtj}t|}|d	tt}|  |d
\}	}
t| j|	|| j|| _ | j!dkr| j "| j! n| j #  W nA t$t%fy } z3t& j'tj(krdd l)}|*  t+t,| |d ur|-  |.  t/j01  t/2d W Y d }~nd }~ww |d ur|-  |.  d S )NF)r.   zSMBv1 dialect usedzSMBv2.0 dialect usedzSMBv2.1 dialect usedzSMBv3.0 dialect usedT)oxidResolverr-   r.   r/   z//./root/cimv2Win32_Process r      )3r   r   r    r   loginr   r   r   r   r   kerberosLoginr   r   
getDialectr	   logginginfor
   r   r   CoCreateInstanceExr   CLSID_WbemLevel1LoginIID_IWbemLevel1LoginIWbemLevel1Login	NTLMLoginr   
RemRelease	GetObjectRemoteShellr   r!   r"   r   onecmdcmdloop	ExceptionKeyboardInterrupt	getLoggerlevelDEBUG	traceback	print_excerrorstrlogoff
disconnectsysstdoutflushexit)r$   addrsilentCommandsmbConnectiondialectdcom
iInterfaceiWbemLevel1LoginiWbemServiceswin32Process_erL   r1   r1   r2   runG   sZ   





zWMIEXEC.run)r   r   r   r   NNNFFNr   NF)__name__
__module____qualname__r3   ra   r1   r1   r1   r2   r   3   s
    
r   c                   @   s   e Zd Zd ddZdd Zdd Zdd	 Zd
d Zdd Zdd Z	dd Z
dd Zdd Zdd Zdd Zd!ddZdd ZdS )"rD   Fc                 C   s   t j|  || _dt | _td| _d| _|| _	d| _
|| _|| _|| _td| _d| _d| _| jd urA| jd | d nd	| _| jd	u rNd| _d S d S )
N\r   zcmd.exe /Q /c z@powershell.exe -NoP -NoL -sta -NonI -W Hidden -Exec Bypass -Enc zC:\Fzg[!] Launching semi-interactive shell - Careful what you execute
[!] Press help for extra shell commandsi T)cmdCmdr3   _RemoteShell__shareOUTPUT_FILENAME_RemoteShell__outputrO   _RemoteShell__outputBuffer_RemoteShell__shell_RemoteShell__shell_type_RemoteShell__pwsh_RemoteShell__win32Process_RemoteShell__transferClient_RemoteShell__silentCommand_RemoteShell__pwd_RemoteShell__noOutputintro
setTimeoutdo_cd)r$   r+   r^   rX   r0   rW   r1   r1   r2   r3   |   s(   





zRemoteShell.__init__c                 C   s   t | d S N)ossystemr$   sr1   r1   r2   do_shell   s   zRemoteShell.do_shellc                 C   s   t d d S )Na  
 lcd {path}                 - changes the current local directory to {path}
 exit                       - terminates the server process (and this session)
 lput {src_file, dst_path}   - uploads a local file to the dst_path (dst_path = default current directory)
 lget {file}                 - downloads pathname to the current local dir
 ! {cmd}                    - executes a local shell cmd
)printr$   liner1   r1   r2   do_help   s   zRemoteShell.do_helpc              
   C   s^   |dkrt t  d S zt| W d S  ty. } ztt| W Y d }~d S d }~ww Nr   )r~   ry   getcwdchdirrG   r;   rN   rO   )r$   r|   r`   r1   r1   r2   do_lcd   s   zRemoteShell.do_lcdc           	   
   C   s   z>dd l }||| j|}||\}}||}t|d}td||f  | j	
|d d d ||j |  W d S  tyj } z tt| tj|r_t| W Y d }~d S W Y d }~d S d }~ww )Nr   wbzDownloading %s\%s$)ntpathnormpathjoinrs   
splitdrivebasenameopenr;   r<   rq   getFilewritecloserG   rN   rO   ry   pathexistsremove)	r$   src_pathr   newPathdrivetailfilenamefhr`   r1   r1   r2   do_lget   s    

zRemoteShell.do_lgetc              
   C   s  zf| d}t|dkr|d }|d }nt|dkr!|d }d}tj|}t|d}|dd}dd l}||| j	||}|
|\}	}
td||f  | j|	d d	 d
 |
|j |  W d S  ty } ztt| W Y d }~d S d }~ww )Nr6   r7   r   r   rb/rf   zUploading %s to %sr   r   )r#   lenry   r   r   r   replacer   r   rs   r   r;   r<   rq   putFilereadr   rG   criticalrO   )r$   r|   paramsr   dst_pathsrc_filer   r   pathnamer   r   r`   r1   r1   r2   do_lput   s,   


zRemoteShell.do_lputc                 C      dS )NTr1   r{   r1   r1   r2   do_exit      zRemoteShell.do_exitc                 C   s   t   | |S rx   )r~   r   r{   r1   r1   r2   do_EOF   s   
zRemoteShell.do_EOFc                 C   r   )NFr1   r$   r1   r1   r2   	emptyline   r   zRemoteShell.emptylinec                 C   s   |  d|  t| jddkrt| j d| _d S tt| j|| _|  d | jd| _| jd | _	| j
dkrEd| j	 d | _	d| _d S )	Ncd 
r   r   >
powershellzPS r6   )execute_remoter   rl   stripr~   r   r   r   rs   promptrn   r{   r1   r1   r2   rw      s   




zRemoteShell.do_cdc                 C   s   t |dkr?|d dkr?| | t | jddkr%t| j d| _d S || _| d | jd| _| jd | _d| _d S |dkrJ| | d S d S )	N   r7   r   r   r   r   r   r   )r   r   rl   r   r~   rs   r   	send_datar   r1   r1   r2   default   s   




zRemoteShell.defaultc              
      s    fdd} j du rd _d S 	 z j j j| W n? ty[ } z2t|ddkr4t	
d nt|ddkrQtd	  j    W  Y d }~S W Y d }~nd }~ww q j j j d S )
Nc              	      sR   z  j | t7  _ W d S  ty(   td   j | jtdd7  _ Y d S w )NzDecoding error detected, consider running chcp.com at the target,
map the result with https://docs.python.org/3/library/codecs.html#standard-encodings
and then execute wmiexec.py again with -codec and the corresponding codecr   )errors)rl   decodeCODECUnicodeDecodeErrorr;   rN   )datar   r1   r2   output_callback  s   
z/RemoteShell.get_output.<locals>.output_callbackTr   STATUS_SHARING_VIOLATIONr   r7   Brokenz(Connection broken, trying to recreate it)rt   rl   rq   r   ri   rk   rG   rO   findtimesleepr;   debug	reconnect
get_output
deleteFile)r$   r   r`   r1   r   r2   r      s(   
	


zRemoteShell.get_outputrg   c                 C   s   |dkrd| }| j t|d  }| j| }| jdu r,|dd| j  | j d 7 }| j	|| j
d }| jdu r@|   d S |  d S )Nr   z'$ProgressPreference="SilentlyContinue";zutf-16leFz 1> z\\127.0.0.1\%sz 2>&1)ro   r   encoder   rm   rt   ri   rk   rp   Creaters   r   printInformation)r$   r   r0   r%   responser1   r1   r2   r     s   


zRemoteShell.execute_remotec                 C   s"   |  || j t| j d| _d S r   )r   rn   r~   rl   )r$   r   r1   r1   r2   r   -  s   

zRemoteShell.send_dataNrb   )rg   )rc   rd   re   r3   r}   r   r   r   r   r   r   r   rw   r   r   r   r   r1   r1   r1   r2   rD   {   s    
		
rD   c                   @   s    e Zd ZdZdd Zdd ZdS )AuthFileSyntaxErrorz}raised by load_smbclient_auth_file if it encounters a syntax error
    while loading the smbclient-style authentication file.c                 C   s   || _ || _|| _d S rx   r   linenoreason)r$   r   r   r   r1   r1   r2   r3   7  s   
zAuthFileSyntaxError.__init__c                 C   s   d| j | j| jf S )Nz(Syntax error in auth file %s line %d: %sr   r   r1   r1   r2   __str__<  s   zAuthFileSyntaxError.__str__N)rc   rd   re   __doc__r3   r   r1   r1   r1   r2   r   3  s    r   c           	      C   s   d}d}d}d}t | D ]Q}|d7 }| }|ds|dkr q|dd}t|dkr2t| |d|d  |d  }}|d	krF|}q|d
krM|}q|dkrT|}qt| |dt| |||fS )zLoad credentials from an smbclient-style authentication file (used by
    smbclient, mount.cifs and others).  returns (domain, username, password)
    or raises AuthFileSyntaxError or any I/O exceptions.r   Nr7   #r   =r   zNo "=" present in liner&   r'   r(   zUnknown option %s)r   r   
startswithr#   r   r   repr)	r   r   r(   r&   r'   r   partskvr1   r1   r2   load_smbclient_auth_fileA  s*   
r   __main__TzKExecutes a semi-interactive shell using Windows Management Instrumentation.)add_helpdescriptiontargetstorez6[[domain/]username[:password]@]<targetName or address>)actionhelpz-sharezADMIN$z<share where the output will be grabbed from (default ADMIN$))r   r   r   z	-nooutput
store_trueFz>whether or not to print the output (no SMB connection created)z-tsz&Adds timestamp to every logging outputz-silentcommandz9does not execute cmd.exe to run given command (no output)z-debugzTurn DEBUG output ONz-codeca  Sets encoding used (codec) from the target's output (default "%s"). If errors are detected, run chcp.com at the target, map the result with https://docs.python.org/3/library/codecs.html#standard-encodings and then execute wmiexec.py again with -codec and the corresponding codec z-shell-typerg   r   z9choose a command processor for the semi-interactive shell)r   r   choicesr   z-com-versionzMAJOR_VERSION:MINOR_VERSIONz<DCOM version, format is MAJOR_VERSION:MINOR_VERSION e.g. 5.7)r   metavarr   r%   *r6   zRcommand to execute at the target. If empty it will launch a semi-interactive shell)nargsr   r   authenticationz-hasheszLMHASH:NTHASHz$NTLM hashes, format is LMHASH:NTHASHz-no-passz&don't ask for password (useful for -k)z-kzUse Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use the ones specified in the command linez-aesKeyzhex keyz<AES key to use for Kerberos Authentication (128 or 256 bits)z-dc-ipz
ip addresszoIP Address of the domain controller. If ommited it use the domain part (FQDN) specified in the target parameterz
-target-ipzIP Address of the target machine. If omitted it will use whatever was specified as target. This is useful when target is the NetBIOS name and you cannot resolve itz-AauthfilezSsmbclient/mount.cifs-style authentication file. See smbclient man page's -A option.z-keytabz"Read keys for SPN from keytab filer7   zutf-8z4-nooutput switch and interactive shell not supportedz9-silentcommand switch and interactive shell not supported.z>Wrong COMVERSION format, use dot separated integers e.g. "5.7"z?loaded smbclient auth file: domain=%s, username=%s, password=%sr   )getpassz	Password:)c
__future__r   r   rR   ry   rg   argparser   r;   r   base64r   impacket.examplesr   impacket.examples.utilsr   impacketr   impacket.smbconnectionr   r	   r
   r   impacket.dcerpc.v5.dcomrtr   r   impacket.dcerpc.v5.dcomr   impacket.dcerpc.v5.dtypesr   impacket.krb5.keytabr   rO   rj   rS   encodingr   r   rh   rD   rG   r   r   rc   r~   BANNERArgumentParserparseradd_argumentadd_argument_groupgroupr   argv
print_helprU   
parse_argsoptionsinittsr   codecr   r%   nooutputrN   silentcommandcom_versionr#   major_versionminor_versionset_default_versionintr   r(   r&   r'   addressAr   	target_ipkeytabloadKeysFromKeytabr   r)   no_passr*   r   r+   dc_ipr0   executerra   rH   r`   rI   rJ   rK   rL   rM   r1   r1   r1   r2   <module>   s   H 9
$













8