def connect(self):
rpctransport = transport.DCERPCTransportFactory(self.stringBinding)
rpctransport.set_connect_timeout(30000)
if len(self.hashes) > 0:
lmhash, nthash = self.hashes.split(':')
else:
lmhash = ''
nthash = ''
#if hasattr(rpctransport, 'set_credentials'):
# This method exists only for selected protocol sequences.
# rpctransport.set_credentials(self.username,self.password, self.domain, lmhash, nthash)
dce = rpctransport.get_dce_rpc()
#dce.set_auth_level(RPC_C_AUTHN_LEVEL_PKT_INTEGRITY)
dce.connect()
dce.bind(mimilib.MSRPC_UUID_MIMIKATZ, transfer_syntax=self.ts)
dh = mimilib.MimiDiffeH()
blob = mimilib.PUBLICKEYBLOB()
blob['y'] = dh.genPublicKey()[::-1]
request = mimilib.MimiBind()
request['clientPublicKey']['sessionType'] = mimilib.CALG_RC4
request['clientPublicKey']['cbPublicKey'] = 144
request['clientPublicKey']['pbPublicKey'] = str(blob)
resp = dce.request(request)
blob = mimilib.PUBLICKEYBLOB(''.join(
resp['serverPublicKey']['pbPublicKey']))
key = dh.getSharedSecret(''.join(blob['y'])[::-1])
pHandle = resp['phMimi']
return dce, rpctransport, pHandle, key[-16:]
def test_MimiBind(self):
dce, rpc_transport = self.connect()
dh, public_key = self.get_dh_public_key()
request = mimilib.MimiBind()
request['clientPublicKey'] = public_key
# Send request and get response
resp = dce.request(request)
self.assertEqual(resp["ErrorCode"], 0)
self.assertEqual(resp["serverPublicKey"]["sessionType"], mimilib.CALG_RC4)
# Get shared secret and obtain handle
blob = mimilib.PUBLICKEYBLOB(b''.join(resp['serverPublicKey']['pbPublicKey']))
key = dh.getSharedSecret(blob['y'][::-1])
pHandle = resp['phMimi']
self.assertIsInstance(pHandle, bytes)
self.assertIsInstance(key, bytes)
dce.disconnect()
rpc_transport.disconnect()
def test_MimiBind(self):
dce, rpctransport, pHandle, key = self.connect()
dh = mimilib.MimiDiffeH()
print 'Our Public'
print '=' * 80
hexdump(dh.genPublicKey())
blob = mimilib.PUBLICKEYBLOB()
blob['y'] = dh.genPublicKey()[::-1]
request = mimilib.MimiBind()
request['clientPublicKey']['sessionType'] = mimilib.CALG_RC4
request['clientPublicKey']['cbPublicKey'] = 144
request['clientPublicKey']['pbPublicKey'] = str(blob)
resp = dce.request(request)
blob = mimilib.PUBLICKEYBLOB(''.join(
resp['serverPublicKey']['pbPublicKey']))
print '=' * 80
print 'Server Public'
hexdump(''.join(blob['y']))
print '=' * 80
print 'Shared'
hexdump(dh.getSharedSecret(''.join(blob['y'])[::-1]))
resp.dump()