a k#d[@sbdZddlZddlZddlZddlZddlmZddlmZm Z ddl m Z ddl m Z mZmZmZddlmZddlmZmZdd lmZdd lmZmZmZmZmZmZmZm Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z*m+Z+m,Z,m-Z-m.Z.m/Z/dd l0m1Z1dd l2m3Z3dd l4m5Z5m6Z6ddl7m8Z8ddlm9Z9m:Z:m;Z;mZ>ddl7m?Z?e j@rjddlAmBZBmCZCndZBZCGddde ebz._NTLMPayloadField.__init__..cSs"g|]}|jdur|j|jfqSN)defaultr9r:r8r8r= fs z._NTLMPayloadField.__init__..)r6r4r5r7superr3__init__)selfr9r6r4r7 __class__r8r=rDYs  z_NTLMPayloadField.__init__cCsl|r|s gSg}|D]R\}}||jvr(qt|j|tsXt|tsXt|j||||}|||fq|Sr@)r5 isinstancerr%getattrappend)rEpktxfuncresults field_namevaluer8r8r= _on_payloadjs  z_NTLMPayloadField._on_payloadcCs|||dS)Ni2hrQrErKrLr8r8r=rR{sz_NTLMPayloadField.i2hcCs|||dS)Nh2irSrTr8r8r=rUsz_NTLMPayloadField.h2icCst|||dS)Ni2repr)reprrQrTr8r8r=rVsz_NTLMPayloadField.i2reprc Cszt}|D]b\}}||jvrq |j|}||d}|durJ||j8}nt|}|||d||dq |t|S)N BufferOffsetr?)r&r5 getfieldvalr6lenrJaddfieldbytes) rErKsvalbufrOrPr<r6r8r8r=r\s    z_NTLMPayloadField.addfieldc Cs2|jdurd|}}n$||}||d|d|}}|rB|sJ|gfSg}d}|jD]}||jd|j} z||jd} Wntyt|| } Yn0| dkrqXt| | |}|| | | rX|| |j| ||| | | dfqX|r|||d7}|j ddd|d d |DfS) Nr?rrXLenrYcSs|dSNrr8rLr8r8r=r?z,_NTLMPayloadField.getfield..)keycSsg|]}|ddqS)rYNr8r;rLr8r8r=rBr?z._NTLMPayloadField.getfield..) r7r4rZr9r6AttributeErrorr[maxrJgetfieldsort) rErKr^retZremainZlen_pktrN max_offsetr<r6lengthr8r8r=ris6      z_NTLMPayloadField.getfield)N)__name__ __module__ __qualname____doc__ __slots__ZislistrDrQrRrUrVr\ri __classcell__r8r8rFr=r3Ssr3cs,eZdZdZfddZfddZZS)_NTLMPayloadPacketPayloadc spztt|WStyjz*tfddtt||jDWYStydtYn0Yn0dS)Nc3s"|]}|dkr|dVqdS)rrYNr8rfattrr8r= s z1_NTLMPayloadPacket.__getattr__..)rCrt __getattr__rgnext_NTLM_PAYLOAD_FIELD_NAME StopIteration)rErwrFrvr=rys    z_NTLMPayloadPacket.__getattr__c sztt||WStytt||j}||jjvrNtz2|t fddt tt||jDWnt yYn0| |gtt||j|Yn0dS)Nc3s"|]\}}|dkr|VqdSrNr8r;irLrvr8r=rxs z1_NTLMPayloadPacket.setfieldval..) rCrt setfieldvalrgryr{ get_fieldr5poprz enumerater|rJ)rErwr_rurFrvr=rs.     z_NTLMPayloadPacket.setfieldval)rnrorpr{ryrrsr8r8rFr=rts rtcCs|jdD]\}}|dj|||}||}||ddurl|d|td|||dd}||ddur|d|dtd|||dd}||ddur|d|dtd |||d d}||7}q |S) z:Util function to build the offset and populate the lengthsruraN.)rrr)r9rAr8r8r= _NTLMStrField<src @s>eZdZeddeddeddeddeddddigZd S) _NTLM_VersionProductMajorVersionrProductMinorVersionZ ProductBuildZres_verZNTLMRevisionCurrentZv15N)rnrorprrrrrr8r8r8r=rHs rc@s~eZdZdZdZdZeedddee dde d de d de d de d de d de e dee dde ddgg ZddZdS)rzNTLM NegotiaterY(rr DomainNameLenNDomainNameMaxLenDomainNameBufferOffsetZWorkstationNameLenZWorkstationNameMaxLenZWorkstationNameBufferOffsetru DomainNamer?WorkstationNamecCst|||jddd|S)N)rrrOFFSETrErKZpayr8r8r= post_buildms  zNTLM_NEGOTIATE.post_build)rnrorpr9 messageTyperrr_negotiateFlagsrrrr3rrrr8r8r8r=rTs( rc@s@eZdZeddeddeddddeddd dgZd d Zd S) Single_Host_DataSizerZZ4Z CustomDatar?rrZ MachineID cCstjSr@rZ padding_layerrEpayloadr8r8r=default_payload_classsz&Single_Host_Data.default_payload_classN)rnrorprr#rrr8r8r8r=rws   rc@seZdZdZedddddddd d d d d dd edddddeeddddddddfeddgddddd dfe de e d!dfe dd"d#dd$d%dfge dd"d&dd$gZ d'd(ZdS))AV_PAIRz NTLM AV PairAvIdrZMsvAvEOLZMsvAvNbComputerNameZMsvAvNbDomainNameZMsvAvDnsComputerNameZMsvAvDnsDomainNameZMsvAvDnsTreeName MsvAvFlagsZMsvAvTimestampZMsvAvSingleHostZMsvAvTargetNameZMsvAvChannelBindings) rrYrrrr rAvLenNValuer)Z length_offmtrYZ constrainedz MIC integrityzSPN from untrusted source)rYrrcCs |jdkS)Nrrrr8r8r=rdr?zAV_PAIR.iArYrYrrrcA.ServerNameGenr?srs)joiniterrrrrHMAC_MD5)rE ResponseKeyNTrZResponserversionZHiResponserversionrZ ServerNametempr8rr=computeNTProofStrs    z!NTLMv2_RESPONSE.computeNTProofStrN)rnrorpr#rrrr8r8r8r=rs rc!@sTeZdZdZdZdZdZeeddedde dded ded de d ded ded de ddeddedde ddeddedde ddeddedde dde ddde e e edddddd ed!eeed"eed#d fged"eeeed$eed%d fged$eeed&ded'ded(ded)dggZd*d+ZdS),NTLM_AUTHENTICATEzNTLM AuthenticaterXrYZLmChallengeResponseLenNZLmChallengeResponseMaxLenZLmChallengeResponseBufferOffsetNtChallengeResponseLenNtChallengeResponseMaxLenZNtChallengeResponseBufferOffsetrrr UserNameLenZUserNameMaxLenZUserNameBufferOffsetZWorkstationLenZWorkstationMaxLenZWorkstationBufferOffsetZEncryptedRandomSessionKeyLenZEncryptedRandomSessionKeyMaxLen%EncryptedRandomSessionKeyBufferOffsetrrrMICr?rrcCs|jddduS)Nrr?)r4getrr8r8r=rd=r?zNTLM_AUTHENTICATE.ruLmChallengeResponsecCs |jdkSNr NTLM_VERSIONrr8r8r=rdDr?NtChallengeResponsecCs |jdkSrrrr8r8r=rdJr?rUserName WorkstationEncryptedRandomSessionKeyc Cs"t|||jddddddd|S)Nr$,4)rrrrrrrrr8r8r=rUs zNTLM_AUTHENTICATE.post_build)rnrorpr9rrrrrrrrrrr#r3rrrrrrrr"rrr8r8r8r=rsv  9rc@seZdZdZdS)rrN)rnrorprr8r8r8r=rasrcCs:t|tsJddlm}m}||dtt|dS)zCCreate an HTTP NTLM negotiate packet from an NTLM_NEGOTIATE messager)HTTP HTTPRequestsNTLM ) Authorization)rHrZscapy.layers.httprrr r])Zntlm_negotiaterrr8r8r=HTTP_ntlm_negotiatees rcs>eZdZfddZddZddZd dd Zd d ZZS) _NTLM_Automatonc snt|_i|_dD]\}}t|||||q|jp:|j|_tt |j ffddfddd|dS)N)) DROP_MIC_v1F) DROP_MIC_v2FcsSr@r8kwargssockr8r=rdyr?z*_NTLM_Automaton.__init__..csSr@r8r r r8r=rdzr?)Zrecvsockll) r token_pipevaluessetattrrrrZDROP_MICrCrrD)rEr r reZdfltrFr r=rDqs    z_NTLM_Automaton.__init__c Cs|sdSddlm}m}m}d}d}d}t|tr>|dddfSt|tttt frZ|}d}nt||rj|j }t||rz|j }t |dr|j r|j j}t |dr|j}z |j}Wnty|j}Yn0t||r|j}t|trt|j}t|tjrt|j}|js|jrt|trd|_d|_d|_d|_|jrtd d |j D} td d t!| j"D} | j"#| d t$d dd||||fS)NNNNNr) GSSAPI_BLOBSPNEGO_negToken SPNEGO_TokenFT mechListMIC negResultscss"|]}|ddkr|dVqdS)rrrYNr8)r;vr8r8r=rxs z-_NTLM_Automaton._get_token..css |]\}}|jdkr|VqdS)rNr)r;rkr8r8r=rxs rYrrr)%Zscapy.layers.gssapirrrrHr]rrrrZinnerContextTokentokenhasattrrrPrZ mechTokenrgZ responseTokenrrr_r raw_layerloadrrrrrrrzrurrinsertr) rErrrrrrrawTokenntlmZChallengeResponserr8r8r= _get_token~sf              z_NTLM_Automaton._get_tokencCs|j|dSr@)rsend)rEr r8r8r=received_ntlm_tokensz#_NTLM_Automaton.received_ntlm_tokenNcCs |dur|j||S|j|Sr@)rr)rErwrAr8r8r=rsz_NTLM_Automaton.getcCs|j|dSr@)Z listen_sockclosestoprr8r8r=ends z_NTLM_Automaton.end)N) rnrorprDr!r#rr&rsr8r8rFr=rps  ? rcsZeZdZdZdZejZdZiZ fddZ ddZ dd Z d d Z d d ZddZZS) NTLM_ClientzO A class to overload to create a client automaton when using NTLM. Fcs"t|_tt|j|i|dSr@)r client_piperCr'rDrErr rFr8r=rDszNTLM_Client.__init__cCs ||_dSr@)srv_atmt)rEr+r8r8r=bindszNTLM_Client.bindcCs||jj|<dSr@)r+rrErwrPr8r8r=set_srvszNTLM_Client.set_srvcCs |jjSr@)r+rrecvrr8r8r= get_tokenszNTLM_Client.get_tokencCs |j|Sr@)r+r"rErKr8r8r=echoszNTLM_Client.echocCs|j}|j|Sr@)r)r/r$rEr r8r8r= wait_servers  zNTLM_Client.wait_server)rnrorprqportrrrssl kwargs_clsrDr,r.r0r2r4rsr8r8rFr=r's r'csheZdZdZdZejZfddZddZ ddd Z d d Z fd d Z ddZ ddZddZZS) NTLM_Servera A class to overload to create a server automaton when using NTLM. :param NTLM_VALUES: a dict whose keys are - "NetbiosDomainName" - "NetbiosComputerName" - "DnsDomainName" - "DnsComputerName" - "DnsTreeName" - "Flags" - "Timestamp" :param IDENTITIES: a dict {"username": NTOWFv2("password", "username", "domain")} (this is the KeyResponseNT). Setting this value enables signature computation and authenticates inbound users. :param DOMAIN_AUTH: a tuple ("", "machineName", b"machinePassword") to use for domain authentication, used to establish the netlogon session. (UNIMPLEMENTED) r(cszd|_t|_|dd|_d|_|dd|_|dd|_t|jpPt|j|_ d|_ d|_ t t |j|i|dS)NZ NTLM_VALUESr DOMAIN_AUTH IDENTITIES)cli_atmtdict cli_valuesr ntlm_values ntlm_stater9r:bool CHECK_LOGINSigningSessionKey ChallengerCr8rDr*rFr8r=rDszNTLM_Server.__init__cCs ||_dSr@)r;)rEr;r8r8r=r,szNTLM_Server.bindFc sB|r$jrjjSjdSddlm}jdkrJd_d\}}}tt d|dddd d dd d t dd dt dddt dddt dddt dddt dddt ddgfgd}jrֈjj\}}}}njd}j r8dD] }|j vrt ||j |qdd|j DfdddD|_ |_||||fSjdkr>d_d}jrtjjSj\}} } }t|vrtd jr2|jr|j} nd} jrjrddd|fS| jvr|jj| jj} | |jjkrddd|fSt d|ddj_jdd|fSddd|fSdS)!Nrr)randintrY)NNFrlrlEr)rrZSRVrZDOMAINrzSRV.DOMAIN.localrz DOMAIN.localrrgr)rrrrrru)rrrrrcSsi|]}|j|jqSr8rrfr8r8r=r>Hr?z)NTLM_Server.get_token..c s<g|]4\}}|jvs|vrt|j||dqS)r)r>rrr~ZavpairsrEr8r=rBIs z)NTLM_Server.get_token..))rZNetbiosDomainName)rYZNetbiosComputerName)rZ DnsDomainName)rZDnsComputerName)rZ DnsTreeName)rFlags)r Timestampr}FzUnexpected state :()r;rr/clearrandomrDr?rrrrr>rrrCr ValueErrorrArrrBr9r:rrrr) rEZnegoexrDrrrtokreZauth_tok_usernamerr8rFr=r0s                     zNTLM_Server.get_tokencCs:|jr|j}nd}|jr6||jvr6t|j||jjSdSr@)rrr:NTLMv2_ComputeSessionBaseKeyrr)rEr rNr8r8r=get_SessionBaseKey}szNTLM_Server.get_SessionBaseKeycs^|d}t|trJ|jrJ||}|rJ|}|jjr@t||j}n|}||_t t | |dSrb) rHrrArPrrRC4KrrBrCr8r#)rEZ ntlm_tupler ZSessionBaseKeyZKeyExchangeKeyExportedSessionKeyrFr8r=r#s zNTLM_Server.received_ntlm_tokencCs"|jr||jj|<n ||j|<dSr@)r;rr=r-r8r8r=set_cliszNTLM_Server.set_clicCs|jr|j|SdSr@)r;r"r1r8r8r=r2szNTLM_Server.echocKs |jsJd|jj|dS)Nz&Cannot start NTLM client: not provided)r;r)r"r3r8r8r= start_clientszNTLM_Server.start_client)F)rnrorprqr5rrrrDr,r0rPr#rSr2rTrsr8r8rFr=r8s  j r8Frc Cs,t|tsJdt|ts$Jd|s0Jdttjtj} | t| pNtj |j f| dg} |pni}|pvi}|rd|d<|d<|rd|d<|d<|rd|d <d|d <|d ur||d <|d <|j |iD]\} }| |vr||| <qސzzt}|s| \}}t||j}||fd | i|}t}|||j fd }|jrttj}d|_tj|_||}t||j}n t||j}td t|t| f||fd | i|}||f||ff}| !||||||"|"qWnt#y0tdYn0W| D]j\}}|D],}z|j$ddWnt%ylYn0qD|D](}z |&Wnt%yYn0qvq8| &nz| D]j\}}|D],}z|j$ddWnt%yYn0q|D](}z |&Wnt%yYn0qq| &0d S)a NTLM Relay This class aims at implementing a simple pass-the-hash attack across various protocols. Usage example: ntlm_relay(port=445, remoteIP="192.168.122.65", remotePort=445, iface="eth0") :param port: the port to open the relay on :param remoteIP: the address IP of the server to connect to for auth :param remotePort: the proto to connect to the server into #Specify a correct NTLM server classz#Specify a correct NTLM client classz!Specify a valid remote IP addressrTrrFZEXTENDED_SECURITYN ALLOW_SMB2debugz%s connected -> %sExiting.wait)' issubclassr8r'socketAF_INET SOCK_STREAMr,rrifacer5listenr7ritems threadingEventis_setacceptr(rconnectr6 SSLContextPROTOCOL_TLS_CLIENTcheck_hostname CERT_NONE verify_mode wrap_socketr'printrW getsocknamerJrunbgKeyboardInterrupt forcestop Exceptionr$) serverClsZremoteIPZremoteClientClsrrZDROP_EXTENDED_SECURITYrV server_kwargsZ client_kwargsr_rWssocksniffersrrevt clientsocketaddressr r+_sockZ remote_sockcontextr;Zsock_tupZatmtssocksatmtr8r8r= ntlm_relays                  r~c Cst|tsJdttjtj}|t|p0tj|j f| dt tj d|jg}|pfi}zzpt}|s|\}}t||j} || fd|i|} || | ft tj dt|| qtWntyt dYn0W|D]P\} } z| jddWnty(Yn0z | WqtyJYq0q|nb|D]R\} } z| jddWntyYn0z | WntyYn0q\|0d S) z/ Starts a standalone NTLM server class rUrzServer %s started. Waiting...rWz-> %s connected rXFrYN)r[r8r\r]r^r,rrr_r5r`rmZ color_themegreenrnrbrcrdrer(rrJZgoldrWrorprqrrr$) rsrtr_rWrurvrwrxryr r+r}r8r8r= ntlm_servers\         rc@s8eZdZejZeeeeddeddddddZ dS)NEGOEX_EXCHANGE_NTLM_ITEMoidrEr1)Z explicit_tagN) rnrorprBER ASN1_codecrrr ASN1_rootr8r8r8r=rCsrc@s.eZdZdZejZeeedge ddZ dS)NEGOEX_EXCHANGE_NTLMz[ GSSAPI NegoEX Exchange metadata blob This was reversed and may be meaningless ra)Z implicit_tagN) rnrorprqrrrrr rrr8r8r8r=rQsrcCs"t|t}|||Sr@)r2HMACr1MD5updatefinalize)redatahr8r8r=res rcCs t|Sr@)r0digestrcr8r8r=MD4ksrcCs2ddlm}m}||}||dd}|}|S)z Alleged RC4rCipher algorithmsNmode)&cryptography.hazmat.primitives.ciphersrrARC4 encryptor)rerr algorithmcipherrr8r8r=RC4Initos   rcCs ||S)zThe RC4 Encryption Algorithm)r)handlerr8r8r=RC4xsrcCs@ddlm}m}||}||dd}|}|||S)zXIndicates the encryption of data item D with the key K using the RC4 algorithm. rrNr)rrrrrrr)rerrrrrrr8r8r=rQ}s   rQc@s,eZdZeddeddddeddgZd S) NTLMSSP_MESSAGE_SIGNATUREVersionrYChecksumr?rrSeqNumrN)rnrorprrrr8r8r8r=rs rcCs"tt|d||dS)zComputes the ResponseKeyNTzutf-16le)rrencodeupper)ZPasswdZUserZUserDomr8r8r=NTOWFv2srcCs t||Sr@)r)rrr8r8r=rOsrOcCs:t|td||dd}|r,t||}td||dS)Nzs    d     `/$  # (&%J Z!B j 2