
    h1k                        d Z ddlZddlZddlZddlZddlmZmZ ddlm	Z	m
Z
 ddlmZmZmZmZ ddlmZmZmZmZ ddlmZmZmZmZ ddlmZmZmZ dd	lmZm Z m!Z!m"Z"m#Z#m$Z$m%Z% ej&        rdd
l'm(Z(m)Z) ddl*m+Z+m,Z,m-Z- ddl.m/Z/ ndxZ(xZ)xZ+xZ,xZ-Z/ddl0m1Z1 i ddddddddddddddddddd d!d"d#d$d%d&d'd(d)d*d+d,d-d.d/d0d1d2d3d4d5d6d7d8d9	Z2 e
d:dd;e2          j3        Z2ed<             Z4ed=             Z5ed>             Z6d? Z7ed@             Z8dA Z9dB Z:edNdC            Z;edNdD            Z<edE             Z=edF             Z>edG             Z? G dH dIe          Z@ G dJ dKejA                  ZB G dL dMe          ZCdS )Oz
[MS-NRPC] Netlogon Remote Protocol

https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-nrpc/ff8f970f-3e37-40f7-bd4b-af7336e4792f
    N)confcrypto_validator)	FlagValue
FlagsField)find_dcerpc_interfaceDCE_C_AUTHN_LEVELNL_AUTH_MESSAGENL_AUTH_SIGNATURE)GSS_C_FLAGSGSS_S_COMPLETEGSS_S_CONTINUE_NEEDEDGSS_S_FAILURE)RC4RC4KRC4InitSSP)DCERPC_ClientDCERPC_TransportSTATUS_ERREF)NetrServerAuthenticate3_Request NetrServerAuthenticate3_ResponseNetrServerReqChallenge_RequestNetrServerReqChallenge_ResponseNETLOGON_SECURE_CHANNEL_TYPEPNETLOGON_AUTHENTICATORPNETLOGON_CREDENTIAL)hasheshmac)Cipher
algorithmsmodes)DES)Optional   A   BDCContinuousUpdate   r      D   BDCChangelog    RestartingDCSync@   NoValidationLevel2   DatabaseRedo   RefusalPasswordChangei   	SendToSami   zGeneric-passthroughi   ConcurrentRPCi   AvoidRepliAccountDBi    AvoidRepliAuthorityDBi @  
StrongKeysi   TransitiveTrusti   QServerPasswordSet2GetDomainInfoCrossForestTrust	NoNT4EmulzRODC-passthroughAESKerberos	SecureRPCZ)	i   i   i   i   i    i   i    i   @         ic                     | }t          j        |t          j                              }|                    |           |                    |           |                                d d         S )Nr+   r   HMACr   SHA256updatefinalize)HashNtClientChallengeServerChallengeM4SShs        ^/mounts/lovelace/software/anaconda3/lib/python3.11/site-packages/scapy/layers/msrpce/msnrpc.pyComputeSessionKeyAESrR   ~   sY    D	$((AHH_HH_::<<    c                    | }t          j        t          j                              }|                    d           |                    |           |                    |           t	          j        |t          j                              }|                    |                                           |                                S N       r   HashMD5rJ   r   rH   rK   )rL   rM   rN   rO   digestrP   s         rQ   ComputeSessionKeyStrongKeyr[      s    D[&&F
MM%&&&
MM/"""
MM/"""	$
%%AHHV__::<<rS   c                     t          t          j        |          t          j        d                    }|                                }|                    |           S )Ns                   mode)r   r    r@   r!   CFB8	encryptorrJ   )InputSkcipherr`   s       rQ   ComputeNetlogonCredentialAESrd      sM    JN2&&UZ-E-EFFFF  ""IE"""rS   c                    t          d          }| d         dz	  |d<   | d         dz  dz  | d         dz	  z  |d<   | d         dz  dz  | d         dz	  z  |d<   | d         dz  d	z  | d         d	z	  z  |d<   | d         d
z  dz  | d	         dz	  z  |d	<   | d	         dz  dz  | d         dz	  z  |d<   | d         dz  dz  | d         dz	  z  |d<   | d         dz  |d<   t          d          D ]}||         dz  dz  ||<   |S )Ns           r   r$      r&            r(         ?      r)      )	bytearrayrange)KeyInKeyOutis      rQ   	InitLMKeyrt      s6   {##FaD F1I(T/a'E!HM:F1I(T/a'E!HM:F1I(T/a'E!HM:F1I(T/a'E!HM:F1I(T/a'E!HM:F1I(T/a'E!HM:F1Ia4F1I1XX , ,AY!^t+q		MrS   c                    t          |dd                   }t          |dd                   }t          t          |          t          j                                                                                  |           }t          t          |          t          j                                                                                  |          S )Nr   ri      )rt   r   r"   r!   ECBr`   rJ   )ra   rb   k3k4output1s        rQ   ComputeNetlogonCredentialDESr{      s    	2ac7		B	2ad8		BSWWeikk**4466==eDDG#b''59;;''1133::7CCCrS   c           
          t          j        d|t          j        d| d d                   d         z   dz            | dd          z   S )Nz<Ir(   r       )structpackunpack)credrs   s     rQ   _credentialAdditionr      sQ    tT"1"X..q11Z?	
 	
 qrr(		rS   c                     t          j        d| dz            }t          j        d| dz	  dz  |rdndz            }||z   S )Nz>Lr}   r-   rD   r   )r~   r   )ClientSequenceNumberclientlowhighs       rQ   ComputeCopySeqNumberr      sU    
+d0:=
>
>C;
"
$
	2V7RzzQRS D :rS   c                    t          j        |t          j                              }|                    | d d                    |r|                    |           |                    |           |                                S )Nr)   rG   )nl_auth_sigmessage
SessionKey
ConfounderrP   s        rQ   ComputeNetlogonChecksumAESr      sm    	*fmoo..AHH[!_ 	HHW::<<rS   c                    t          j        t          j                              }|                    d           |                    | d d                    |r|                    |           |                    |           t	          j        |t          j                              }|                    |                                           |                                S )NrV   r)   rW   )r   r   r   r   rZ   rP   s         rQ   ComputeNetlogonChecksumMD5r      s    [&&F
MM%&&&
MM+bqb/""" "j!!!
MM'	*fjll++AHHV__::<<rS   c                 h    t          t          d t          |           D                                 S )Nc              3       K   | ]	}|d z  V  
dS    N .0xs     rQ   	<genexpr>z/ComputeNetlogonSealingKeyAES.<locals>.<genexpr>   s&      EE!AHEEEEEErS   )bytesro   )r   s    rQ   ComputeNetlogonSealingKeyAESr      s/    EEy/D/DEEEEEFFFrS   c                    t          t          d t          |           D                                 }t          j        |t	          j                              }|                    d           t          j        |                                t	          j                              }|                    |           |                                S )Nc              3       K   | ]	}|d z  V  
dS r   r   r   s     rQ   r   z/ComputeNetlogonSealingKeyRC4.<locals>.<genexpr>   s&      GGAa$hGGGGGGrS   rV   )r   ro   r   rH   r   rY   rJ   rK   )r   CopySeqNumberXorKeyrP   s       rQ   ComputeNetlogonSealingKeyRC4r      s    9GG:1F1FGGGGGHHF	&&*,,''AHH !!!	!**,,
--AHH]::<<rS   c                 :   t          j        | t          j                              }|                    d           t          j        |                                t          j                              }|                    |           |                                S rU   )r   rH   r   rY   rJ   rK   )r   ChecksumrP   s      rQ   #ComputeNetlogonSequenceNumberKeyMD5r      sk    	*fjll++AHH !!!	!**,,
--AHHX::<<rS   c                        e Zd ZdZ G d dej                  Z G d dej                  Zd fd	Zd Zd	 Z	ddZ
ddZd Zd Z	 ddee         fdZddZdefdZ xZS )NetlogonSSPD   c                       e Zd ZdZdZdZdS )NetlogonSSP.STATEr$   r&   rg   N)__name__
__module____qualname__INITCLI_SENT_NLSRV_SENT_NLr   rS   rQ   STATEr      s        rS   r   c                   (     e Zd Zg dZd fd	Z xZS )NetlogonSSP.CONTEXT)r   IsClientr@   NTc                     t           j        j        | _        || _        d| _        || _        t          t           j        |           	                    |           d S )Nr   )	req_flags)
r   r   r   stater   r   r@   superCONTEXT__init__)selfr   r   r@   	__class__s       rQ   r   zNetlogonSSP.CONTEXT.__init__  sP    $*/DJ$DM()D%DH+%t,,55	5JJJJJrS   NT)r   r   r   	__slots__r   __classcell__r   s   @rQ   r   r     sX        
 
 
		K 	K 	K 	K 	K 	K 	K 	K 	K 	KrS   r   Tc                     || _         || _        || _        || _         t	          t
          |           j        di | d S )Nr   )r   r@   computername
domainnamer   r   r   )r   r   r   r   r@   kwargsr   s         rQ   r   zNetlogonSSP.__init__  sI    $($)k4  )33F33333rS   c                    d                     d |D                       }d}|rt          j        d          }|j        rt	          d|rdnd          }nt	          d	|rd
nd          }t          |j        |j                  }|xj        dz  c_        |j        r2t          t          |          || j
        |          dd         |_        n1t          t          |          || j
        |          dd         |_        |r#|j        rt          | j
                  }nt          | j
        |          }|j        r|dz  }	t          t!          j        |          t#          j        |	                                                    }
|
                    |          |_        |D ](}|j        r|
                    |j                  |_        )nYt1          |          }t3          ||          |_        t1          |          }|D ]#}|j        rt3          ||j                  |_        $|j        ru| j
        }|j        dz  }	t          t!          j        |          t#          j        |	                    }|                                }
|
                    |          |_        n/t7          | j
        |j                  }t9          ||          |_        ||fS )zd
        Internal function used by GSS_WrapEx and GSS_GetMICEx

        [MS-NRPC] 3.3.4.2.1
        rS   c              3   2   K   | ]}|j         	|j        V  d S Nsigndatar   s     rQ   r   z&NetlogonSSP._secure.<locals>.<genexpr>!  +      99Q!&9!&999999rS   Nr)         i  )SignatureAlgorithmSealAlgorithmw   z   r$   r&   r]   )joinosurandomr@   r
   r   r   r   r   r   r   r   r   r   r   r   r    r!   r_   r`   rJ   r   conf_req_flagr   r   r   SequenceNumberr   r   )r   ContextmsgsSealToSignr   	signaturer   EncryptionKeyIVr`   msghandlerc   s                 rQ   _securezNetlogonSSP._secure  s    99$99999
 	'AJ; 	)#)(,8ff&  II *#)(,8ff&  I .('*:
 
 	$$)$$; 	!;i  &$/:" "qb"I "<i  &$/:" "qb"I
  !	9{  <T_ M M <O^! ! { 9#a'"N=11
2  )++  (1'7'7
'C'C	$ > >C( >#,#3#3CH#=#=> !//'*6:'>'>	$ !// 9 9C( 9#&vsx#8#8; 
	K OM#a'BJN=99
2OOOF((**I'0'7'7'G'GI$$?!3 M (,M>'J'JI$ 
 	
rS   c                    t          |t                    sJ |j        r|j        dk    s|j        s|j        dk    rt	          d          |j        ru| j        }|j        dz  }t          t          j        |          t          j
        |                    }|                                }|                    |j                  }	n/t          | j        |j                  }t          ||j                  }	t!          |j        |j                   }
|	|
k    rt	          d          |xj        dz  c_        d}|r)|j        rt'          | j                  }nt)          | j        |	          }|j        r|	dz  }t          t          j        |          t          j
        |                                                    }|                    |j                  }|D ](}|j        r|                    |j                  |_        )n_t)          | j        |	          }t          ||j                  }t1          |          }|D ]#}|j        rt3          ||j                  |_        $d	                    d
 |D                       }|j        r-t7          t9          |          || j        |          dd         }n,t;          t9          |          || j        |          dd         }|j        |k    rt	          d          |S )zi
        Internal function used by GSS_UnwrapEx and GSS_VerifyMICEx

        [MS-NRPC] 3.3.4.2.2
        r   r   zInvalid SignatureAlgorithm !r&   r]   z!ERROR: SequenceNumber don't matchr$   NrS   c              3   2   K   | ]}|j         	|j        V  d S r   r   r   s     rQ   r   z(NetlogonSSP._unsecure.<locals>.<genexpr>  r   rS   r)   zERROR: Checksum don't match)
isinstancer
   r@   r   
ValueErrorr   r   r   r    r!   r_   	decryptorrJ   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   )r   r   r   r   r   r   r   rc   r   r   r   r   r   r   r   r   s                   rQ   	_unsecurezNetlogonSSP._unsecurez  s9    )%677777 K 	=I8FBB C ) < F F;<<< ; 
	K OM#a'BJN=99
2OOOF((**I&--i.FGGNN?!3 M "-1IJJN,(g.>*>
 
 ]**@AAA$$)$$ 
 	9{  <T_ M M <O^! ! { 9#a'"N=11
2  )++  '--i.BCC
 > >C( >#,#3#3CH#=#=>
 !=O^! ! "-1EFF
 // 9 9C( 9#&vsx#8#8 99$99999 ; 	1i  &$/: qbHH 2i  &$/: qbH )):;;;rS   r   c                 0    |                      ||d          S r   r   r   r   r   qop_reqs       rQ   
GSS_WrapExzNetlogonSSP.GSS_WrapEx  s    ||GT4000rS   c                 <    |                      ||d          d         S )NFr$   r   r   s       rQ   GSS_GetMICExzNetlogonSSP.GSS_GetMICEx  s    ||GT511!44rS   c                 2    |                      |||d          S r   r   r   r   r   r   s       rQ   GSS_UnwrapExzNetlogonSSP.GSS_UnwrapEx  s    ~~gtY===rS   c                 6    |                      |||d           d S )NFr   r   s       rQ   GSS_VerifyMICExzNetlogonSSP.GSS_VerifyMICEx  s     wi77777rS   Nr   c                     ||                      d|| j                  }|j        | j        j        k    r6| j        j        |_        |t          dd| j        | j                  t          fS |d t          fS )NTr   r@   r   rg   )MessageTypeFlagsNetbiosDomainNameNetbiosComputerName)r   r@   r   r   r   r   r	   r   r   r   r   )r   r   valr   s       rQ   GSS_Init_sec_contextz NetlogonSSP.GSS_Init_sec_context  s     ?ll49$(lKKG=DJO++ J2GM !&*o(,(9	   &	 	 D.00rS   c                     ||                      dd| j                  }|j        | j        j        k    r*| j        j        |_        |t          dd          t          fS |d t          fS )NFr   r   r$   )r   r   )	r   r@   r   r   r   r   r	   r   r   )r   r   r   s      rQ   GSS_Accept_sec_contextz"NetlogonSSP.GSS_Accept_sec_context  sv    ?ll5A48lDDG=DJO++ J2GM !     D-//rS   r   c                 V    |j         t          j        z  r|j        rdS dS |j        rdS dS )z
        Returns the Maximum Signature length.

        This will be used in auth_len in DceRpc5, and is necessary for
        PFC_SUPPORT_HEADER_SIGN to work properly.
        8   r-   0      )flagsr   GSS_C_CONF_FLAGr@   )r   r   s     rQ   MaximumSignatureLengthz"NetlogonSSP.MaximumSignatureLength  s>     =;66 		{ rr{ rrrS   )T)r   )NNr   )r   r   r   	auth_typer   r   r   r   r   r   r   r   r   r   r#   r   r   r   r  r   r   s   @rQ   r   r      sj       I    	   
K K K K K#+ K K K4 4 4 4 4 4^
 ^
 ^
@S S Sj1 1 1 15 5 5 5> > >8 8 8 EI1 1,4[,A1 1 1 1*0 0 0 0$g        rS   r   c                       e Zd ZdZdZdS )NETLOGON_SECURE_CHANNEL_METHODr$   r&   N)r   r   r   NetrServerAuthenticate3NetrServerAuthenticateKerberosr   rS   rQ   r  r    s        %&"""rS   r  c                        e Zd ZdZej        ddf fd	Z fdZ fdZd Z	d Z
ej        ej        fded	ed
efdZ xZS )NetlogonClienta  
    A subclass of DCERPC_Client that supports establishing a Netlogon secure channel
    using the Netlogon SSP, and handling Netlogon authenticators.

    This class therefore only supports the 'logon' rpc.

    :param auth_level: one of DCE_C_AUTHN_LEVEL

    :param verb: verbosity control.
    :param supportAES: advertise AES support in the Netlogon session.

    Example::

        >>> cli = NetlogonClient()
        >>> cli.connect_and_bind("192.168.0.100")
        >>> cli.establishSecureChannel(
        ...     domainname="DOMAIN", computername="WIN10",
        ...     HashNT=bytes.fromhex("aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"),
        ... )
    Tc                     t          d          | _        d| _        d | _        d | _        || _         t          t          |           j        t          j
        f|| j        |d| d S )NlogonF)
auth_levelndr64verb)r   	interfacer  r   ClientStoredCredential
supportAESr   r	  r   r   NCACN_IP_TCP)r   r  r  r  r   r   s        rQ   r   zNetlogonClient.__init__4  s     /w77
&*#$,nd##,)	
!*		
 	

 	
 	
 	
 	
 	
rS   c                 d    t          t          |                               || j                   dS )z\
        This calls DCERPC_Client's connect_and_bind to bind the 'logon' interface.
        N)r   r	  connect_and_bindr  )r   remoteIPr   s     rQ   r  zNetlogonClient.connect_and_bindH  s-     	nd##44Xt~NNNNNrS   c                 ^    t          t          |                               | j                  S r   )r   r	  alter_contextr  )r   r   s    rQ   r  zNetlogonClient.alter_contextN  s#    ^T**88HHHrS   c                 &   t          t          j                              }t          | j        |          | _        t	          t          | j        rt          | j        | j                  nt          | j        | j                            |          S )z1
        Create a NETLOGON_AUTHENTICATOR
        r   )
Credential	Timestamp)
inttimer   r  r   r   r  rd   r   r{   )r   tss     rQ   create_authenticatorz#NetlogonClient.create_authenticatorQ  s    
 &9''
 '
# '+ 	03  
 63    
 
 
 	
rS   c                     t          | j        d          | _        | j        rt          | j        | j                  }nt          | j        | j                  }||j        j        k    rt          d          dS )zk
        Validate a NETLOGON_AUTHENTICATOR

        :param auth: the NETLOGON_AUTHENTICATOR object
        r$   z(Server netlogon authenticator is wrong !N)	r   r  r  rd   r   r{   r  r   r   )r   authtempcreds      rQ   validate_authenticatorz%NetlogonClient.validate_authenticatork  s     ':''
 '
# ? 	3+T_ HH 4+T_ H t+++GHHH ,+rS   r   r   rL   c                 Z   t          j        d          }|                     t          d|t	          |          | j        | j                            }t          |vs|j        dk    rbt          t          j                            dt          j        |j        d          z                       |                                 t           t#          dt$          	          }| j        r|d
z  }|t(          j        k    r~|j        j        }	| j        r't1          |||	          }
t3          ||
          | _        n&t7          |||	          }
t9          ||
          | _        |                     t;          d|dz   ||t	          | j                  t=          |          | j        | j                            }t>          |vs|j        dk    rd}t>          |v rSt#          |j         t$          	          }||k    r2t          t          j                            d||z  z                       t          t          j                            dt          j        |j        d          z                       |j        t          vr|                                 t           | j        rR|j!        j        t3          |	|
          k    r3t          t          j                            d                     t           nQ|j!        j        t9          |	|
          k    r3t          t          j                            d                     t           |
| _"        tG          | j"        | j        ||          x| _$        | j%        j&        _$        n|t(          j'        k    r|dz  }tP          | )                                 dS )a  
        Function to establish the Netlogon Secure Channel.

        This uses NetrServerAuthenticate3 to negotiate the session key, then creates a
        NetlogonSSP that uses that session key and alters the DCE/RPC session to use it.

        :param mode: one of NETLOGON_SECURE_CHANNEL_METHOD. This defines which method
                     to use to establish the secure channel.
        :param computername: the netbios computer account name that is used to establish
                             the secure channel. (e.g. WIN10)
        :param domainname: the netbios domain name to connect to (e.g. DOMAIN)
        :param HashNt: the HashNT of the computer account.
        r)   Nr  )PrimaryNameComputerNamerM   r  	ndrendianr   z! %sFailurei/`)namesr@   $)r%  AccountNameSecureChannelTyper&  ClientCredentialNegotiateFlagsr  r'  z! Unsupported server flags: %sz! Invalid ServerCredential.)r   r@   r   r   rA   )*r   r   sr1_reqr   r   r  r'  r   statusprintr   color_themefailr   getshowr   r   _negotiateFlagsr  r  r  rN   r   rR   rd   r  r[   r{   r   r  r   r.  ServerCredentialr   r   sspsocksessionr  NotImplementedErrorr  )r   r   r   rL   r^   secureChannelTypeclientChallnetr_server_req_chall_responser.  serverChallr   netr_server_auth3_responseNegotiatedFlagss                rQ   establishSecureChannelz%NetlogonClient.establishSecureChannel  s   . jmm)-* ) 4$! ! ! j.  
*
 
*
& ,3QQQ-499 %%"&'E'LiXXY    +//111"!
 
 
 ? 	$e#N1III 9HMK 1&+{SS
.J/ /++ 8K 
 /K/ /+ *./ $ ,s 2&7!-%9!8& & & $'~#6#6*"n  * *& 18RRR-499"&37QQQ&/2A-' ' 'O &88 ,11 @#2^#C!E    $))&*+E+LiXXY    .4LHH.33555   %.?D3KLLM M $*//0MNNOOO$$	M /?D3KLLM M $*//0MNNOOO$$(DO/:?O%)	0 0 0 DHty(,, 3RRRj(N%%rS   )r   r   r   __doc__r   NONEr   r  r  r  r#  r  r  r   WorkstationSecureChannelstrr   rB  r   r   s   @rQ   r	  r	    s        . %)	
 
 
 
 
 
(O O O O OI I I I I
 
 
4I I I4 ,C6OM MM M 	M M M M M M M MrS   r	  r   )DrC  enumr   r~   r  scapy.configr   r   scapy.fieldsr   r   scapy.layers.dcerpcr   r   r	   r
   scapy.layers.gssapir   r   r   r   scapy.layers.ntlmr   r   r   r   scapy.layers.msrpce.rpcclientr   r   r   scapy.layers.msrpce.raw.ms_nrpcr   r   r   r   r   r   r   crypto_validcryptography.hazmat.primitivesr   r   &cryptography.hazmat.primitives.ciphersr   r    r!   scapy.libs.rfc3961r"   typingr#   r6  r)  rR   r[   rd   rt   r{   r   r   r   r   r   r   r   r   Enumr  r	  r   rS   rQ   <module>rU     s!     				   / / / / / / / / . . . . . . . .                       6 5 5 5 5 5 5 5 5 5 5 5         
                   =;;;;;;;;PPPPPPPPPP&&&&&&&8<<F<T<F<Z<%#     77 %7 7 7 7 "7  $!7$ %7( ')7, -70 %174 578 %97< '=7@ A7D !E7H I7L %""m7 7 7p *RC99?       # # #   D D D         	 	 	 	 G G G      V V V V V# V V Vx' ' ' ' 'TY ' ' '
o o o o o] o o o o orS   