Your IP : 216.73.216.79
| Current Path : /usr/local/bin/ |
|
|
| Current File : //usr/local/bin/exchanger.py |
#!/usr/bin/python3
# Impacket - Collection of Python classes for working with network protocols.
#
# Copyright Fortra, LLC and its affiliated companies
#
# All rights reserved.
#
# This software is provided under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Description:
# A tool for connecting to MS Exchange via RPC over HTTP v2
#
# Notes about -rpc-hostname:
# Our RPC over HTTP v2 implementation tries to extract the
# target's NetBIOS name via NTLMSSP and use it as RPC Server name.
# If it fails, you have to manually get the target RPC Server name
# from the Autodiscover service and set it in the -rpc-hostname parameter.
#
# Author:
# Arseniy Sharoglazov <mohemiv@gmail.com> / Positive Technologies (https://www.ptsecurity.com/)
#
# References:
# - https://swarm.ptsecurity.com/attacking-ms-exchange-web-interfaces/
#
from __future__ import print_function
import base64
import codecs
import logging
import argparse
import binascii
import sys
from six import PY3
from impacket import uuid, version
from impacket.http import AUTH_BASIC
from impacket.examples import logger
from impacket.examples.utils import parse_target
from impacket.structure import parse_bitmask
from impacket.dcerpc.v5 import transport, nspi
from impacket.mapi_constants import PR_CONTAINER_FLAGS_VALUES, MAPI_PROPERTIES
from impacket.dcerpc.v5.nspi import CP_TELETEX, ExchBinaryObject, \
get_guid_from_dn, get_dn_from_guid
from impacket.dcerpc.v5.rpch import RPC_PROXY_REMOTE_NAME_NEEDED_ERR, \
RPC_PROXY_HTTP_IN_DATA_401_ERR, RPC_PROXY_CONN_A1_0X6BA_ERR, \
RPC_PROXY_CONN_A1_404_ERR, RPC_PROXY_RPC_OUT_DATA_404_ERR, \
RPC_PROXY_CONN_A1_401_ERR
PY37ORHIGHER = sys.version_info >= (3, 7)
PR_CONTAINER_FLAGS = 0x36000003
PR_ENTRYID = 0x0fff0102
PR_DEPTH = 0x30050003
PR_EMS_AB_IS_MASTER = 0xfffb000B
PR_EMS_AB_CONTAINERID = 0xfffd0003
PR_EMS_AB_PARENT_ENTRYID = 0xfffc0102
PR_DISPLAY_NAME = 0x3001001F
PR_EMS_AB_OBJECT_GUID = 0x8c6d0102
PR_INSTANCE_KEY = 0x0ff60102
DELIMITER = "======================="
class Exchanger:
def __init__(self):
self._username = ''
self._password = ''
self._domain = ''
self._lmhash = ''
self._nthash = ''
self._extended_output = False
self._output_type = 'hex'
self._stringbinding = None
self._rpctransport = None
self.__outputFileName = None
self.__outputFd = None
def conenct_mapi(self):
raise NotImplementedError('Virtual method. Not implemented in subclass!')
def connect_rpc(self):
raise NotImplementedError('Virtual method. Not implemented in subclass!')
def load_autodiscover(self):
# This should be implemented only as optional,
# and the implementation should support processing emails
# which do not belong to the used for the authentication account
raise NotImplementedError('Not Implemented!')
def set_credentials(self, username='', password='', domain='', hashes=None):
self._username = username
self._password = password
self._domain = domain
self._lmhash = ''
self._nthash = ''
if hashes is not None:
self._lmhash, self._nthash = hashes.split(':')
def set_extended_output(self, output_mode):
self._extended_output = output_mode
def set_output_type(self, output_type):
self._output_type = output_type
def set_output_file(self, filename):
self.__outputFileName = filename
self.__outputFd = open(self.__outputFileName, 'w+')
def print(self, text):
if self.__outputFd != None:
if PY3:
self.__outputFd.write(text + '\n')
else:
self.__outputFd.write((text + '\n').encode('utf-8'))
print(text)
def _encode_binary(self, bytestr):
if PY3 and self._output_type == "hex":
return "0x%s" % str(binascii.hexlify(bytestr), 'ascii')
elif self._output_type == "hex":
return "0x%s" % binascii.hexlify(bytestr)
elif PY3:
return str(base64.b64encode(bytestr), 'ascii')
else:
return base64.b64encode(bytestr)
def __del__(self):
if self.__outputFd != None:
self.__outputFd.close()
self.__outputFd = None
class NSPIAttacks(Exchanger):
PROPS_GUID = [PR_EMS_AB_OBJECT_GUID]
PROPS_MINUMAL = [
0x3a00001F, # mailNickname
0x39fe001F, # mail
0x80270102, # objectSID
0x30070040, # whenCreated
0x30080040, # whenChanged
0x8c6d0102, # objectGUID
]
PROPS_EXTENDED = PROPS_MINUMAL + [
# Names
0x3a0f001f, # cn
0x8202001f, # name
0x0fff0102, # PR_ENTRYID
0x3001001f, # PR_DISPLAY_NAME
0x3a20001f, # PR_TRANSMITABLE_DISPLAY_NAME
0x39ff001f, # displayNamePrintable
0x800f101f, # proxyAddresses
0x8171001f, # lDAPDisplayName
0x8102101f, # ou
0x804b001F, # adminDisplayName
# Text Properties
0x806f101f, # description
0x3004001f, # info
0x8069001f, # c
0x3a26001f, # co
0x3a2a001f, # postalCode
0x3a28001f, # st
0x3a29001f, # streetAddress
0x3a09001f, # homePhone
0x3a1c001f, # mobile
0x3a1b101f, # otherTelephone
0x3a16001f, # company
0x3a18001f, # department
0x3a17001f, # title
0x3a11001f, # sn
0x3a0a001f, # initials
0x3a06001f, # givenName
# Attributes of Types
0x0ffe0003, # PR_OBJECT_TYPE
0x39000003, # PR_DISPLAY_TYPE
0x80bd0003, # instanceType
# Exchange Extension Attributes
0x802d001F, # extensionAttribute1
0x802e001F, # extensionAttribute2
0x802f001F, # extensionAttribute3
0x8030001F, # extensionAttribute4
0x8031001F, # extensionAttribute5
0x8032001F, # extensionAttribute6
0x8033001F, # extensionAttribute7
0x8034001F, # extensionAttribute8
0x8035001F, # extensionAttribute9
0x8036001F, # extensionAttribute10
0x8c57001F, # extensionAttribute11
0x8c58001F, # extensionAttribute12
0x8c59001F, # extensionAttribute13
0x8c60001F, # extensionAttribute14
0x8c61001F, # extensionAttribute15
# 0x8c9e0102, # thumbnailPhoto, large
# Configuration
0x81b6101e, # protocolSettings
0x8c9f001e, # msExchUserCulture
0x8c730102, # msExchMailboxGuid
0x8c96101e, # msExchResourceAddressLists, exists only for Exchange Organization object
0x8c750102, # msExchMasterAccountSid
0x8cb5000b, # msExchEnableModeration
0x8cb30003, # msExchGroupJoinRestriction
0x8ce20003, # msExchGroupMemberCount
# Useful when lookuping DNTs
0x813b101e, # subRefs
0x8170101e, # networkAddress
0x8011001e, # targetAddress
0x8175101e, # url
# Useful for distinguishing accounts
0x8c6a1102, # userCertificate
# Assigned MId
0x0ff60102, # PR_INSTANCE_KEY
]
# MS-OXNSPI
# 2.1 Transport
# For the network protocol sequence RPC over HTTPS,
# this protocol MUST use the well-known endpoint 6004.
DEFAULT_STRING_BINDING = 'ncacn_http:%s[6004,RpcProxy=%s:443]'
def __init__(self):
Exchanger.__init__(self)
self.__handler = None
self.htable = {}
self.anyExistingContainerID = -1
self.props = list()
self.stat = nspi.STAT()
self.stat['CodePage'] = nspi.CP_TELETEX
def connect_rpc(self, remoteName, rpcHostname=''):
self._stringbinding = self.DEFAULT_STRING_BINDING % (rpcHostname, remoteName)
logging.debug('StringBinding %s' % self._stringbinding)
self._rpctransport = transport.DCERPCTransportFactory(self._stringbinding)
self._rpctransport.set_credentials(self._username, self._password, self._domain,
self._lmhash, self._nthash)
self.__dce = self._rpctransport.get_dce_rpc()
# MS-OXNSPI
# 3.1.4 Message Processing Events and Sequencing Rules
#
# This protocol MUST indicate to the RPC runtime that it
# is to perform a strict Network Data Representation (NDR) data
# consistency check at target level 6.0, as specified in [MS-RPCE].
self.__dce.set_credentials(self._username, self._password, self._domain,
self._lmhash, self._nthash)
if options.basic:
self._rpctransport.set_auth_type(AUTH_BASIC)
self.__dce.set_auth_level(6)
self.__dce.connect()
self.__dce.bind(nspi.MSRPC_UUID_NSPI)
resp = nspi.hNspiBind(self.__dce, self.stat)
self.__handler = resp['contextHandle']
def update_stat(self, table_MId):
stat = nspi.STAT()
stat['CodePage'] = CP_TELETEX
stat['ContainerID'] = NSPIAttacks._int_to_dword(table_MId)
resp = nspi.hNspiUpdateStat(self.__dce, self.__handler, stat)
self.stat = resp['pStat']
def load_htable(self):
resp = nspi.hNspiGetSpecialTable(self.__dce, self.__handler)
resp_simpl = nspi.simplifyPropertyRowSet(resp['ppRows'])
self._parse_and_set_htable(resp_simpl)
def load_htable_stat(self):
for MId in self.htable:
self.update_stat(MId)
self.htable[MId]['count'] = self.stat['TotalRecs']
self.htable[MId]['start_mid'] = self.stat['CurrentRec']
def load_htable_containerid(self):
if self.anyExistingContainerID != -1:
return
if self.htable == {}:
self.load_htable()
for MId in self.htable:
self.update_stat(MId)
if self.stat['CurrentRec'] > 0:
self.anyExistingContainerID = NSPIAttacks._int_to_dword(MId)
return
def _parse_and_set_htable(self, htable):
self.htable = {}
for ab in htable:
MId = ab[PR_EMS_AB_CONTAINERID]
self.htable[MId] = {}
self.htable[MId]['flags'] = ab[PR_CONTAINER_FLAGS]
if MId == 0:
self.htable[0]['name'] = "Default Global Address List"
else:
self.htable[MId]['name'] = ab[PR_DISPLAY_NAME]
self.htable[MId]['guid'] = get_guid_from_dn(ab[PR_ENTRYID])
if PR_EMS_AB_PARENT_ENTRYID in ab:
self.htable[MId]['parent_guid'] = get_guid_from_dn(ab[PR_EMS_AB_PARENT_ENTRYID])
if PR_DEPTH in ab:
self.htable[MId]['depth'] = ab[PR_DEPTH]
else:
self.htable[MId]['depth'] = 0
if PR_EMS_AB_IS_MASTER in ab:
self.htable[MId]['is_master'] = ab[PR_EMS_AB_IS_MASTER]
else:
self.htable[MId]['is_master'] = 0
@staticmethod
def _int_to_dword(number):
if number > 0:
return number
else:
return (number + (1 << 32)) % (1 << 32)
def print_htable(self, parent_guid=None):
MIds_print = []
for MId in self.htable:
if parent_guid == None and 'parent_guid' not in self.htable[MId]:
MIds_print.append(MId)
elif parent_guid != None and 'parent_guid' in self.htable[MId] and self.htable[MId]['parent_guid'] == parent_guid:
MIds_print.append(MId)
for MId in MIds_print:
ab = self.htable[MId]
ab['printed'] = True
indent = ' ' * ab['depth']
# Table name
print("%s%s" % (indent, ab['name']))
# Count
if 'count' in ab:
print("%sTotalRecs: %d" % (indent, ab['count']))
# Table params
if MId != 0:
guid = uuid.bin_to_string(ab['guid']).lower()
print("%sGuid: %s" % (indent, guid))
else:
print("%sGuid: None" % indent)
if ab['is_master'] != 0:
print("%sPR_EMS_AB_IS_MASTER attribute is set!" % indent)
if self._extended_output:
dword = NSPIAttacks._int_to_dword(MId)
print("%sAssigned MId: 0x%.08X (%d)" % (indent, dword, MId))
if 'start_mid' in ab:
dword = NSPIAttacks._int_to_dword(ab['start_mid'])
if dword == 2:
print("%sAssigned first record MId: 0x00000002 (MID_END_OF_TABLE)" % indent)
else:
print("%sAssigned first record MId: 0x%.08X (%d)" % (indent, dword, ab['start_mid']))
flags = parse_bitmask(PR_CONTAINER_FLAGS_VALUES, ab['flags'])
print("%sFlags: %s" % (indent, flags))
print()
if MId != 0:
self.print_htable(parent_guid=ab['guid'])
if parent_guid == None:
for MId in self.htable:
if self.htable[MId]['printed'] == False:
print("Found parentless object!")
print("Name: %s" % self.htable[MId]['name'])
print("Guid: %s" % uuid.bin_to_string(self.htable[MId]['guid']).lower())
print("Parent guid: %s" % uuid.bin_to_string(self.htable[MId]['parent_guid']).lower())
dword = NSPIAttacks._int_to_dword(MId) if MId < 0 else MId
print("Assigned MId: 0x%.08X (%d)" % (dword, MId))
flags = parse_bitmask(PR_CONTAINER_FLAGS_VALUES, self.htable[MId]['flags'])
print("Flags: %s" % flags)
if self.htable[MId]['is_master'] != 0:
print("%sPR_EMS_AB_IS_MASTER attribute is set!" % indent)
print()
def disconnect(self):
nspi.hNspiUnbind(self.__dce, self.__handler)
self.__dce.disconnect()
def print_row(self, row_simpl, delimiter=None):
empty = True
for aulPropTag in row_simpl:
PropertyId = aulPropTag >> 16
PropertyType = aulPropTag & 0xFFFF
# Error, e.g. MAPI_E_NOT_FOUND
if PropertyType == 0x000A:
continue
# PtypEmbeddedTable
if PropertyType == 0x000D:
continue
empty = False
if PropertyId in MAPI_PROPERTIES:
property_name = MAPI_PROPERTIES[PropertyId][1]
if property_name is None:
property_name = MAPI_PROPERTIES[PropertyId][5]
if property_name is None:
property_name = MAPI_PROPERTIES[PropertyId][6]
else:
property_name = "0x%.8x" % aulPropTag
if self._extended_output:
property_name = "%s, 0x%.8x" % (property_name, aulPropTag)
if isinstance(row_simpl[aulPropTag], ExchBinaryObject):
self.print("%s: %s" % (property_name, self._encode_binary(row_simpl[aulPropTag])))
else:
self.print("%s: %s" % (property_name, row_simpl[aulPropTag]))
if empty == False and delimiter != None:
self.print(delimiter)
def load_props(self):
if len(self.props) > 0:
return
resp = nspi.hNspiQueryColumns(self.__dce, self.__handler)
for prop in resp['ppColumns']['aulPropTag']:
PropertyTag = prop['Data']
PropertyType = PropertyTag & 0xFFFF
if PropertyType == 0x000D:
# Skipping PtypEmbeddedTable to reduce traffic
continue
self.props.append(PropertyTag)
def req_print_table_rows(self, table_MId=None, attrs=[], count=50, eTable=None, onlyCheck=False):
printOnlyGUIDs = False
useAsExplicitTable = False
if self.anyExistingContainerID == -1:
self.load_htable_containerid()
if table_MId == None and eTable == None:
raise Exception("Wrong arguments!")
elif table_MId != None and eTable != None:
raise Exception("Wrong arguments!")
elif table_MId != None:
# Let's call NspiUpdateStat
# It's important when the given MId is taken from the hierarchy table,
# especially in Multi-Tenant environments
self.update_stat(table_MId)
# Table end reached
if self.stat['CurrentRec'] == nspi.MID_END_OF_TABLE:
# Returning False to support onlyCheck
return False
else:
# eTable != None
useAsExplicitTable = True
if attrs == self.PROPS_GUID:
# GUIDS
firstReqProps = self.PROPS_GUID
printOnlyGUIDs = True
elif attrs == self.PROPS_MINUMAL:
# MINIMAL
firstReqProps = self.PROPS_MINUMAL
elif attrs == []:
# FULL
# Requesting a list of all the properties that the server knows
if self.props == []:
self.load_props()
attrs = self.props
# To avoid MAPI_E_NOT_ENOUGH_RESOURCES error we request MIds,
# and then use them as an Explicit Table
firstReqProps = [PR_INSTANCE_KEY]
useAsExplicitTable = True
else:
# EXTENDED and custom
#
# To avoid MAPI_E_NOT_ENOUGH_RESOURCES error we request MIds,
# and then use them as an Explicit Table
firstReqProps = [PR_INSTANCE_KEY]
useAsExplicitTable = True
if onlyCheck:
attrs = self.PROPS_GUID
firstReqProps = self.PROPS_GUID
useAsExplicitTable = True
while True:
if eTable == None:
resp = nspi.hNspiQueryRows(self.__dce, self.__handler,
pStat=self.stat, Count=count, pPropTags=firstReqProps)
self.stat = resp['pStat']
try:
# Addressing to PropertyRowSet_r must be inside try / except,
# as if the server returned a wrong result, it can be in
# multiple of forms, and we cannot easily determine it
# before parsing
resp_rows = nspi.simplifyPropertyRowSet(resp['ppRows'])
except Exception as e:
resp.dumpRaw()
logging.error(str(e))
raise Exception("NspiQueryRows returned wrong result")
if onlyCheck:
if len(resp_rows) == 0:
return False
for row in resp_rows:
# PropertyId = 0x8C6D (objectGUID)
# PropertyType = 0x000A (error)
if 0x8C6D000A not in row:
return True
return False
if useAsExplicitTable:
if eTable == None:
eTableInt = []
for row in resp_rows:
eTableInt.append(row[PR_INSTANCE_KEY])
else:
eTableInt = eTable
resp = nspi.hNspiQueryRows(self.__dce, self.__handler,
ContainerID=self.anyExistingContainerID, Count=count, pPropTags=attrs, lpETable=eTableInt)
try:
# Addressing to PropertyRowSet_r must be inside try / except,
# as if the server returned a wrong result, it can be in
# multiple of forms, and we cannot easily determine it
# before parsing
resp_rows = nspi.simplifyPropertyRowSet(resp['ppRows'])
except Exception as e:
resp.dumpRaw()
logging.error(str(e))
raise Exception("NspiQueryRows returned wrong result while processing explicit table")
if onlyCheck:
if len(resp_rows) == 0:
return False
for row in resp_rows:
# PropertyId = 0x8C6D (objectGUID)
# PropertyType = 0x000A (error)
if 0x8C6D000A not in row:
return True
return False
if printOnlyGUIDs:
for row in resp_rows:
if PR_EMS_AB_OBJECT_GUID in row:
objectGuid = row[PR_EMS_AB_OBJECT_GUID]
self.print(objectGuid)
else:
# Empty row (wrong MId)
pass
else:
for row in resp_rows:
self.print_row(row, DELIMITER)
# When the caller specified eTable it's always one NspiQueryRows call
if eTable != None:
break
# Table end reached
# It also MUST be checked after NspiUpdateStat
if self.stat['CurrentRec'] == nspi.MID_END_OF_TABLE:
break
# This should not happen
if len(resp_rows) == 0:
break
def req_print_guid(self, guid=None, attrs=[], count=50, guidFile=None):
if guid == None and guidFile == None:
raise Exception("Wrong arguments!")
elif guid != None and guidFile != None:
raise Exception("Wrong arguments!")
if attrs == []:
# Requesting a list of all the properties that the server knows
if self.props == []:
self.load_props()
attrs = self.props
if guid:
printedLines = self._req_print_guid([guid], attrs)
if printedLines == 0:
raise Exception("Object with specified GUID not found!")
return
fd = open(guidFile, 'r')
line = fd.readline()
while True:
guidList = []
# EOF
if line == '':
break
# Reading N lines from the file
for i in range(count):
line = fd.readline()
guid = line.strip()
if guid == '' or line[0] == '#':
continue
guidList.append(guid)
# Multiple empty lines or EOF
if len(guidList) == 0:
continue
# Processing
self._req_print_guid(guidList, attrs, DELIMITER)
fd.close()
def _req_print_guid(self, guidList, attrs, delimiter=None):
legacyDNList = []
for guid in guidList:
legacyDNList.append(get_dn_from_guid(guid, minimize=True))
resp = nspi.hNspiResolveNamesW(self.__dce, self.__handler, pPropTags=attrs, paStr=legacyDNList)
try:
# Addressing to PropertyRowSet_r must be inside try / except,
# as if the server returned a wrong result, it can be in
# multiple of forms, and we cannot easily determine it
# before parsing
if resp['ppRows']['cRows'] <= 0:
return 0
# Addressing to PropertyRowSet_r must be inside try / except,
# as if the server returned a wrong result, it can be in
# multiple of forms, and we cannot easily determine it
# before parsing
resp_rows = nspi.simplifyPropertyRowSet(resp['ppRows'])
except Exception as e:
resp.dumpRaw()
logging.error(str(e))
raise Exception("NspiResolveNamesW returned wrong result")
for row in resp_rows:
self.print_row(row, delimiter)
return resp['ppRows']['cRows']
def req_print_dnt(self, start_dnt, stop_dnt, attrs=[], count=50, checkIfEmpty=False):
if count <= 0 or start_dnt < 0 or stop_dnt < 0 or stop_dnt > 0xFFFFFFFF or start_dnt > 0xFFFFFFFF:
raise Exception("Wrong arguments!")
if stop_dnt >= start_dnt:
step = count
rstep = 1
else:
step = -count
rstep = -1
stop_dnt += rstep
dnt1 = start_dnt
dnt2 = start_dnt + step
while True:
if step > 0 and dnt2 > stop_dnt:
dnt2 = stop_dnt
elif step < 0 and dnt2 < stop_dnt:
dnt2 = stop_dnt
self.print("# MIds %d-%d:" % (dnt1, dnt2 - rstep))
if checkIfEmpty:
# Speed up the process by reducing the length of request/response
exists = self.req_print_table_rows(attrs=attrs, eTable=range(dnt1, dnt2, rstep), onlyCheck=True)
if exists:
self.req_print_table_rows(attrs=attrs, eTable=range(dnt1, dnt2, rstep))
else:
self.req_print_table_rows(attrs=attrs, eTable=range(dnt1, dnt2, rstep))
if dnt2 == stop_dnt:
break
dnt1 += step
dnt2 += step
class ExchangerHelper:
def __init__(self, domain, username, password, remoteName):
self.__domain = domain
self.__username = username
self.__password = password
self.__remoteName = remoteName
self.exch = None
def run(self, options):
module = options.module.lower()
submodule = options.submodule.lower()
if module == 'nspi':
# Checking options before connecting to the server
self.nspi_check(submodule, options)
self.nspi_run(submodule, options)
else:
raise Exception("%s module not found" % module)
def nspi_run(self, submodule, options):
self.exch = NSPIAttacks()
self.exch.set_credentials(self.__username, self.__password, self.__domain, options.hashes)
self.exch.set_extended_output(options.debug)
if submodule in ['dump-tables', 'guid-known', 'dnt-lookup'] and options.output_file != None:
self.exch.set_output_file(options.output_file)
self.exch.connect_rpc(self.__remoteName, options.rpc_hostname)
if submodule == 'list-tables':
self.nspi_list_tables(options)
elif submodule == 'dump-tables':
self.nspi_dump_tables(options)
elif submodule == 'guid-known':
self.nspi_guid_known(options)
elif submodule == 'dnt-lookup':
self.nspi_dnt_lookup(options)
self.exch.disconnect()
def nspi_check(self, submodule, options):
if submodule == 'dump-tables' and options.name == None and options.guid == None:
dump_tables.print_help()
sys.exit(1)
if submodule == 'dump-tables' and options.name != None and options.guid != None:
logging.error("Specify only one of -name or -guid")
sys.exit(1)
if submodule == 'guid-known' and options.guid == None and options.guid_file == None:
guid_known.print_help()
sys.exit(1)
if submodule == 'guid-known' and options.guid != None and options.guid_file != None:
logging.error("Specify only one of -guid or -guid-file")
sys.exit(1)
def nspi_list_tables(self, options):
self.exch.load_htable()
if options.count:
self.exch.load_htable_stat()
self.exch.print_htable()
def nspi_dump_tables(self, options):
self.exch.set_output_type(options.output_type)
if options.lookup_type == None or options.lookup_type == 'MINIMAL':
propTags = NSPIAttacks.PROPS_MINUMAL
elif options.lookup_type == 'EXTENDED':
propTags = NSPIAttacks.PROPS_EXTENDED
elif options.lookup_type == 'GUIDS':
propTags = NSPIAttacks.PROPS_GUID
else:
# FULL
propTags = []
if options.name != None and options.name.lower() in ['gal', 'default global address list', 'global address list']:
logging.info("Lookuping Global Address List")
table_MId = 0
else:
# 2.2.8
# The client obtains Minimal Entry IDs for STAT ContainerID
# from the server's address book hierarchy table
#
# We cannot convert the GUID to a MId via NspiDNToMId or similar operations because it
# may not work in Multi-Tenant environments
self.exch.load_htable()
if options.guid != None:
logging.info("Search for an address book with objectGUID = %s" % options.guid)
guid = uuid.string_to_bin(options.guid)
name = None
else:
guid = None
name = options.name
table_MId = 0
for MId in self.exch.htable:
if MId == 0:
# GAL
continue
if guid is not None:
# -guid
if self.exch.htable[MId]['guid'] == guid:
logging.debug("MId %d is assigned for %s object" % (MId, options.guid))
logging.info("Lookuping %s" % self.exch.htable[MId]['name'])
table_MId = MId
break
else:
# -name
if self.exch.htable[MId]['name'] == name:
guid = uuid.bin_to_string(self.exch.htable[MId]['guid'])
logging.debug("MId %d is assigned for %s object" % (MId, guid))
logging.info("Lookuping address book with objectGUID = %s" % guid)
table_MId = MId
break
if table_MId == 0:
logging.error("Specified address book not found!")
sys.exit(1)
self.exch.req_print_table_rows(table_MId, propTags, options.rows_per_request)
def nspi_guid_known(self, options):
self.exch.set_output_type(options.output_type)
if options.lookup_type == None or options.lookup_type == 'MINIMAL':
propTags = NSPIAttacks.PROPS_MINUMAL
elif options.lookup_type == 'EXTENDED':
propTags = NSPIAttacks.PROPS_EXTENDED
else:
# FULL
propTags = []
if options.guid != None:
self.exch.req_print_guid(options.guid, propTags)
else:
self.exch.req_print_guid(attrs=propTags, count=options.rows_per_request, guidFile=options.guid_file)
def nspi_dnt_lookup(self, options):
if options.lookup_type == None or options.lookup_type == 'EXTENDED':
propTags = NSPIAttacks.PROPS_EXTENDED
elif options.lookup_type == 'GUIDS':
propTags = NSPIAttacks.PROPS_GUID
else:
# FULL
propTags = []
self.exch.req_print_dnt(options.start_dnt, options.stop_dnt, attrs=propTags,
count=options.rows_per_request, checkIfEmpty=True)
# Process command-line arguments.
if __name__ == '__main__':
# Explicitly changing the stdout encoding format
if sys.stdout.encoding is None:
# Output is redirected to a file
sys.stdout = codecs.getwriter('utf8')(sys.stdout)
print(version.BANNER)
class SmartFormatter(argparse.HelpFormatter):
def _split_lines(self, text, width):
if text.startswith('R|'):
return text[2:].splitlines()
else:
return argparse.HelpFormatter._split_lines(self, text, width)
def localized_arg(bytestring):
unicode_string = bytestring.decode(sys.getfilesystemencoding())
return unicode_string
parser = argparse.ArgumentParser(add_help=True, description="A tool to abuse Exchange services")
parser.add_argument('target', action='store', help='[[domain/]username[:password]@]<targetName or address>')
parser.add_argument('-debug', action='store_true', help='Turn DEBUG and EXTENDED output ON')
parser.add_argument('-ts', action='store_true', help='Adds timestamp to every logging output')
#parser.add_argument('-transport', choices=['RPC', 'MAPI'], nargs='?', default='RPC', help='Protocol to use')
parser.add_argument('-rpc-hostname', action='store', help='A name of the server in GUID (preferred) '
'or NetBIOS name format (see description in the beggining of this file)')
group = parser.add_argument_group('authentication')
group.add_argument('-hashes', action="store", metavar = "LMHASH:NTHASH", help='NTLM hashes, format is LMHASH:NTHASH')
if PY37ORHIGHER:
subparsers = parser.add_subparsers(help='A module name', dest='module', required=True)
else:
subparsers = parser.add_subparsers(help='A module name', dest='module')
# NSPI module
nspi_parser = subparsers.add_parser('nspi', help='Attack NSPI interface')
# Attacks for NSPI protocol
if PY37ORHIGHER:
nspi_attacks = nspi_parser.add_subparsers(help='A submodule name', dest='submodule', required=True)
else:
nspi_attacks = nspi_parser.add_subparsers(help='A submodule name', dest='submodule')
list_tables = nspi_attacks.add_parser('list-tables', help='List Address Books')
list_tables.add_argument('-count', action='store_true', help='Request total number of records in each table')
parser.add_argument('-basic', action='store_true', help='Authenticate with Basic Auth instead of NTLM')
dump_tables = nspi_attacks.add_parser('dump-tables', formatter_class=SmartFormatter, help='Dump Address Books')
dump_tables.add_argument('-lookup-type', choices=['MINIMAL', 'EXTENDED', 'FULL', 'GUIDS'], nargs='?', default='MINIMAL',
help='R|Lookup type:\n'
' MINIMAL - Request limited set of fields (default)\n'
' EXTENDED - Request extended set of fields\n'
' FULL - Request all fields for each row\n'
' GUIDS - Request only GUIDs')
dump_tables.add_argument('-rows-per-request', action='store', type=int, metavar="50", default=50,
help='Limit the number of rows per request')
if PY3:
dump_tables.add_argument('-name', action='store', help='Dump table with the specified name (inc. GAL)')
else:
dump_tables.add_argument('-name', action='store', help='Dump table with the specified name (inc. GAL)',
type=localized_arg)
dump_tables.add_argument('-guid', action='store', help='Dump table with the specified GUID')
dump_tables.add_argument('-output-type', choices=['hex', 'base64'], nargs='?', default='hex',
help='Output format for binary objects')
dump_tables.add_argument('-output-file', action='store', help='Output filename')
guid_known = nspi_attacks.add_parser('guid-known', formatter_class=SmartFormatter,
help='Retrieve Active Directory objects by GUID / GUIDs')
guid_known.add_argument('-guid', action='store', help='Dump object with the specified GUID')
guid_known.add_argument('-guid-file', action='store', help='Dump objects using GUIDs from file')
guid_known.add_argument('-lookup-type', choices=['MINIMAL', 'EXTENDED', 'FULL'], nargs='?', default='MINIMAL',
help='R|Lookup type:\n'
' MINIMAL - Request limited set of fields (default)\n'
' EXTENDED - Request extended set of fields\n'
' FULL - Request all fields for each row')
guid_known.add_argument('-rows-per-request', action='store', type=int, metavar="50", default=50,
help='Limit the number of rows per request')
guid_known.add_argument('-output-type', choices=['hex', 'base64'], nargs='?', default='hex',
help='Output format for binary objects')
guid_known.add_argument('-output-file', action='store', help='Output filename')
dnt_lookup = nspi_attacks.add_parser('dnt-lookup', formatter_class=SmartFormatter, help='Lookup Distinguished Name Tags')
dnt_lookup.add_argument('-lookup-type', choices=['EXTENDED', 'FULL', 'GUIDS'], nargs='?', default='EXTENDED',
help='R|Lookup type:\n'
' EXTENDED - Request extended set of fields (default)\n'
' FULL - Request all fields for each row\n'
' GUIDS - Request only GUIDs')
dnt_lookup.add_argument('-rows-per-request', action='store', type=int, metavar="350", default=350,
help='Limit the number of rows per request')
dnt_lookup.add_argument('-start-dnt', action='store', type=int, metavar="500000", default=500000,
help='A DNT to start from')
dnt_lookup.add_argument('-stop-dnt', action='store', type=int, metavar="0", default=0,
help='A DNT to lookup to')
dnt_lookup.add_argument('-output-type', choices=['hex', 'base64'], nargs='?', default='hex',
help='Output format for binary objects')
dnt_lookup.add_argument('-output-file', action='store', help='Output filename')
if len(sys.argv) == 1:
parser.print_help()
sys.exit(1)
options = parser.parse_args()
# Init the example's logger theme
logger.init(options.ts, options.debug)
domain, username, password, remoteName = parse_target(options.target)
if domain is None:
domain = ''
if password == '' and username != '' and options.hashes is None:
from getpass import getpass
password = getpass("Password:")
if options.rpc_hostname == '':
# Preventing false feedback that empty hostname means something for Exchange
# For autodetect -rpc-hostname should be skipped
logging.error("-rpc-hostname cannot be empty")
sys.exit(1)
if options.rpc_hostname is None:
# Autodetect
options.rpc_hostname = ''
try:
exchHelper = ExchangerHelper(domain, username, password, remoteName)
exchHelper.run(options)
except KeyboardInterrupt:
logging.error("KeyboardInterrupt")
except Exception as e:
#raise
# This may contain UTF-8
error_text = 'Protocol failed: %s' % e
logging.critical(error_text)
if 'NspiQueryRows returned wrong result' in error_text and \
options.submodule.lower() == 'dnt-lookup':
logging.critical("Most likely ntdsai.dll in lsass.exe has crashed "
"on a Domain Controller while processing a DNT which "
"does not support to be requested via MS-NSPI. "
"The DC is probably rebooting. "
"This can happend in Multi-Tenant Environment. "
"You can try to request different DNT range")
if 'Connection reset by peer' in error_text and \
exchHelper.exch._rpctransport.rts_ping_received == True and \
options.submodule.lower() == 'dnt-lookup':
logging.critical("Most likely ntdsai.dll in lsass.exe has crashed "
"on a Domain Controller while processing a DNT which "
"does not support to be requested via MS-NSPI. "
"The DC is probably rebooting. "
"This can happend in Multi-Tenant Environment. "
"You can try to request different DNT range")
# This usually happens when the target is RDG
# Probably may happen for Exchange 2003 / 2007 / 2010
if RPC_PROXY_CONN_A1_0X6BA_ERR in error_text:
logging.critical("This usually means the target has no ACL to connect to "
"this endpoint using RPC Proxy")
logging.critical("Is the server a MS Exchange?")
if options.rpc_hostname == '':
logging.critical("Try to specify -rpc-hostname (see description in the "
"beggining of this file)")
else:
logging.critical("Try to specify different -rpc-hostname, or enumerate "
"endpoints via rpcmap.py / rpcdump.py")
# It's Exchange or Exchange behind TMG, but the RPC Server name is wrong
if RPC_PROXY_RPC_OUT_DATA_404_ERR in error_text or \
RPC_PROXY_CONN_A1_404_ERR in error_text:
if options.rpc_hostname == '':
logging.critical("Cannot determine the right RPC Server name. Specify -rpc-hostname "
"(see description in the beggining of this file)")
else:
logging.critical("The specified RPC Server is incorrect. "
"Try to specify different -rpc-hostname")
if RPC_PROXY_REMOTE_NAME_NEEDED_ERR in error_text:
logging.critical("Specify -rpc-hostname (see description in the beggining of this file)")
# Wrong credentials
if RPC_PROXY_HTTP_IN_DATA_401_ERR in error_text or RPC_PROXY_CONN_A1_401_ERR in error_text:
logging.critical("Wrong credentials!")
# Show a reminder if Basic
if RPC_PROXY_HTTP_IN_DATA_401_ERR in error_text or RPC_PROXY_CONN_A1_401_ERR in error_text:
if exchHelper.exch._rpctransport.get_auth_type() == AUTH_BASIC and domain == '':
logging.critical("The server requested Basic authentication which "
"may require you to specify the domain. "
"Your domain is empty!")
if RPC_PROXY_CONN_A1_401_ERR in error_text or \
RPC_PROXY_CONN_A1_404_ERR in error_text:
logging.info("A proxy in front of the target server detected (may be WAF / SIEM)")