内网渗透瑞士军刀-impacket工具解析（一）

class AV_PAIRS:    def __init__(self, data = None):        self.fields = {}        if data is not None:            self.fromString(data)
    def __setitem__(self,key,value):        self.fields[key] = (len(value),value)
    def __getitem__(self, key):        if key in self.fields:           return self.fields[key]        return None
    def __delitem__(self, key):        del self.fields[key]
    def __len__(self):        return len(self.getData())
    def __str__(self):        return len(self.getData())
    def fromString(self, data):        tInfo = data        fType = 0xff        while fType is not NTLMSSP_AV_EOL:            fType = struct.unpack('<H',tInfo[:struct.calcsize('<H')])[0]            tInfo = tInfo[struct.calcsize('<H'):]            length = struct.unpack('<H',tInfo[:struct.calcsize('<H')])[0]            tInfo = tInfo[struct.calcsize('<H'):]            content = tInfo[:length]            self.fields[fType]=(length,content)            tInfo = tInfo[length:]
    def dump(self):        for i in list(self.fields.keys()):            print("%s: {%r}" % (i,self[i]))
    def getData(self):        if NTLMSSP_AV_EOL in self.fields:            del self.fields[NTLMSSP_AV_EOL]        ans = b''        for i in list(self.fields.keys()):            ans+= struct.pack('<HH', i, self[i][0])            ans+= self[i][1]         # end with a NTLMSSP_AV_EOL        ans += struct.pack('<HH', NTLMSSP_AV_EOL, 0)
        return ans

class VERSION(Structure):    NTLMSSP_REVISION_W2K3 = 0x0F
    structure = (        ('ProductMajorVersion', '<B=0'),        ('ProductMinorVersion', '<B=0'),        ('ProductBuild', '<H=0'),        ('Reserved', '3s=""'),        ('NTLMRevisionCurrent', '<B=self.NTLMSSP_REVISION_W2K3'),    )

sublcasses can define commonHdr and/or structure.    each of them is an tuple of either two: (fieldName, format) or three: (fieldName, ':', class) fields.    [it can't be a dictionary, because order is important]        where format specifies how the data in the field will be converted to/from bytes (string)    class is the class to use when unpacking ':' fields.
    each field can only contain one value (or an array of values for *)       i.e. struct.pack('Hl',1,2) is valid, but format specifier 'Hl' is not (you must use 2 dfferent fields)
    format specifiers:      specifiers from module pack can be used with the same format       see struct.__doc__ (pack/unpack is finally called)        x       [padding byte]        c       [character]        b       [signed byte]        B       [unsigned byte]        h       [signed short]        H       [unsigned short]        l       [signed long]        L       [unsigned long]        i       [signed integer]        I       [unsigned integer]        q       [signed long long (quad)]        Q       [unsigned long long (quad)]        s       [string (array of chars), must be preceded with length in format specifier, padded with zeros]        p       [pascal string (includes byte count), must be preceded with length in format specifier, padded with zeros]        f       [float]        d       [double]        =       [native byte ordering, size and alignment]        @       [native byte ordering, standard size and alignment]        !       [network byte ordering]        <       [little endian]        >       [big endian]
      usual printf like specifiers can be used (if started with %)       [not recommended, there is no way to unpack this]
        %08x    will output an 8 bytes hex        %s      will output a string        %s\x00  will output a NUL terminated string        %d%d    will output 2 decimal digits (against the very same specification of Structure)        ...
      some additional format specifiers:        :       just copy the bytes from the field into the output string (input may be string, other structure, or anything responding to __str__()) (for unpacking, all what's left is returned)        z       same as :, but adds a NUL byte at the end (asciiz) (for unpacking the first NUL byte is used as terminator)  [asciiz string]        u       same as z, but adds two NUL bytes at the end (after padding to an even size with NULs). (same for unpacking) [unicode string]        w       DCE-RPC/NDR string (it's a macro for [  '<L=(len(field)+1)/2','"\x00\x00\x00\x00','<L=(len(field)+1)/2',':' ]        ?-field length of field named 'field', formatted as specified with ? ('?' may be '!H' for example). The input value overrides the real length        ?1*?2   array of elements. Each formatted as '?2', the number of elements in the array is stored as specified by '?1' (?1 is optional, or can also be a constant (number), for unpacking)        'xxxx   literal xxxx (field's value doesn't change the output. quotes must not be closed or escaped)        "xxxx   literal xxxx (field's value doesn't change the output. quotes must not be closed or escaped)        _       will not pack the field. Accepts a third argument, which is an unpack code. See _Test_UnpackCode for an example        ?=packcode  will evaluate packcode in the context of the structure, and pack the result as specified by ?. Unpacking is made plain        ?&fieldname "Address of field fieldname".                    For packing it will simply pack the id() of fieldname. Or use 0 if fieldname doesn't exists.                    For unpacking, it's used to know weather fieldname has to be unpacked or not, i.e. by adding a & field you turn another field (fieldname) in an optional field.

class NTLMAuthNegotiate(Structure):
    structure = (        ('','"NTLMSSPx00'),        ('message_type','<L=1'),        ('flags','<L'),        ('domain_len','<H-domain_name'),        ('domain_max_len','<H-domain_name'),        ('domain_offset','<L=0'),        ('host_len','<H-host_name'),        ('host_maxlen','<H-host_name'),        ('host_offset','<L=0'),        ('os_version',':'),        ('host_name',':'),        ('domain_name',':'))                                                                                    def __init__(self):        Structure.__init__(self)        self['flags']= (               NTLMSSP_NEGOTIATE_128     |               NTLMSSP_NEGOTIATE_KEY_EXCH|               # NTLMSSP_LM_KEY      |               NTLMSSP_NEGOTIATE_NTLM    |               NTLMSSP_NEGOTIATE_UNICODE     |               # NTLMSSP_ALWAYS_SIGN |               NTLMSSP_NEGOTIATE_SIGN        |               NTLMSSP_NEGOTIATE_SEAL        |               # NTLMSSP_TARGET      |               0)        self['host_name']=''        self['domain_name']=''        self['os_version']= ''        self._workstation = ''
    def setWorkstation(self, workstation):        self._workstation = workstation
    def getWorkstation(self):        return self._workstation
    def __hasNegotiateVersion(self):        return (self['flags'] & NTLMSSP_NEGOTIATE_VERSION) == NTLMSSP_NEGOTIATE_VERSION
    def getData(self):        if len(self.fields['host_name']) > 0:            self['flags'] |= NTLMSSP_NEGOTIATE_OEM_WORKSTATION_SUPPLIED        if len(self.fields['domain_name']) > 0:            self['flags'] |= NTLMSSP_NEGOTIATE_OEM_DOMAIN_SUPPLIED        version_len = len(self.fields['os_version'])        if version_len > 0:            self['flags'] |= NTLMSSP_NEGOTIATE_VERSION        elif self.__hasNegotiateVersion():            raise Exception('Must provide the os_version field if the NTLMSSP_NEGOTIATE_VERSION flag is set')        if (self['flags'] & NTLMSSP_NEGOTIATE_OEM_WORKSTATION_SUPPLIED) == NTLMSSP_NEGOTIATE_OEM_WORKSTATION_SUPPLIED:            self['host_offset']=32 + version_len        if (self['flags'] & NTLMSSP_NEGOTIATE_OEM_DOMAIN_SUPPLIED) == NTLMSSP_NEGOTIATE_OEM_DOMAIN_SUPPLIED:            self['domain_offset']=32+len(self['host_name']) + version_len        return Structure.getData(self)
    def fromString(self,data):        Structure.fromString(self,data)
        domain_offset = self['domain_offset']        domain_end    = self['domain_len'] + domain_offset        self['domain_name'] = data[ domain_offset : domain_end ]
        host_offset = self['host_offset']        host_end    = self['host_len'] + host_offset        self['host_name'] = data[ host_offset : host_end ]
        if len(data) >= 36 and self.__hasNegotiateVersion():            self['os_version'] = VERSION(data[32:])        else:            self['os_version'] = ''

from impacket.ntlm import NTLMAuthNegotiate
if __name__ == '__main__':    nego_data = bytes.fromhex('4e544c4d5353500001000000978208e2000000000000000000000000000000000a00614a0000000f')    nego = NTLMAuthNegotiate()    nego.fromString(nego_data)    nego.dump()

NTLMAuthNegotiate: {'NTLMSSPx00'}message_type: {1}flags: {3792208535}domain_len: {0}domain_max_len: {0}domain_offset: {0}host_len: {0}host_maxlen: {0}host_offset: {0}
os_version:{    ProductMajorVersion: {10}    ProductMinorVersion: {0}    ProductBuild: {19041}    Reserved: {b'x00x00x00'}    NTLMRevisionCurrent: {15}}host_name: {b''}domain_name: {b''}

class NTLMAuthChallenge(Structure):
    structure = (        ('','"NTLMSSPx00'),        ('message_type','<L=2'),        ('domain_len','<H-domain_name'),        ('domain_max_len','<H-domain_name'),        ('domain_offset','<L=40'),        ('flags','<L=0'),        ('challenge','8s'),        ('reserved','8s=""'),        ('TargetInfoFields_len','<H-TargetInfoFields'),        ('TargetInfoFields_max_len','<H-TargetInfoFields'),        ('TargetInfoFields_offset','<L'),        ('VersionLen','_-Version','self.checkVersion(self["flags"])'),         ('Version',':'),        ('domain_name',':'),        ('TargetInfoFields',':'))
    @staticmethod    def checkVersion(flags):        if flags is not None:           if flags & NTLMSSP_NEGOTIATE_VERSION == 0:              return 0        return 8
    def getData(self):        if self['TargetInfoFields'] is not None and type(self['TargetInfoFields']) is not bytes:            raw_av_fields = self['TargetInfoFields'].getData()            self['TargetInfoFields'] = raw_av_fields        return Structure.getData(self)
    def fromString(self,data):        Structure.fromString(self,data)        self['domain_name'] = data[self['domain_offset']:][:self['domain_len']]        self['TargetInfoFields'] = data[self['TargetInfoFields_offset']:][:self['TargetInfoFields_len']]        return self

if __name__ == '__main__':    challenge_data = bytes.fromhex('4e544c4d53535000020000000400040038000000158289e267bf6a81e0c5dcd300000000000000006a006a003c0000000a0063450000000f4a004400020004004a004400010008004400430030003100040010006a0064002e006c006f00630061006c0003001a0044004300300031002e006a0064002e006c006f00630061006c00050010006a0064002e006c006f00630061006c00070008004e3a1907b2dbd90100000000')    challenge = NTLMAuthChallenge()    challenge.fromString(nego_data)    challenge.dump()

NTLMAuthChallenge: {'NTLMSSPx00'}message_type: {2}domain_len: {4}domain_max_len: {4}domain_offset: {56}flags: {3800662549}challenge: {b'gxbfjx81xe0xc5xdcxd3'}reserved: {b'x00x00x00x00x00x00x00x00'}TargetInfoFields_len: {106}TargetInfoFields_max_len: {106}TargetInfoFields_offset: {60}VersionLen: {8}Version: {b'nx00cEx00x00x00x0f'}domain_name: {b'Jx00Dx00'}TargetInfoFields: {b'x02x00x04x00Jx00Dx00x01x00x08x00Dx00Cx000x001x00x04x00x10x00jx00dx00.x00lx00ox00cx00ax00lx00x03x00x1ax00Dx00Cx000x001x00.x00jx00dx00.x00lx00ox00cx00ax00lx00x05x00x10x00jx00dx00.x00lx00ox00cx00ax00lx00x07x00x08x00N:x19x07xb2xdbxd9x01x00x00x00x00'}

class NTLMAuthChallengeResponse(Structure):
    structure = (        ('','"NTLMSSPx00'),        ('message_type','<L=3'),        ('lanman_len','<H-lanman'),        ('lanman_max_len','<H-lanman'),        ('lanman_offset','<L'),        ('ntlm_len','<H-ntlm'),        ('ntlm_max_len','<H-ntlm'),        ('ntlm_offset','<L'),        ('domain_len','<H-domain_name'),        ('domain_max_len','<H-domain_name'),        ('domain_offset','<L'),        ('user_len','<H-user_name'),        ('user_max_len','<H-user_name'),        ('user_offset','<L'),        ('host_len','<H-host_name'),        ('host_max_len','<H-host_name'),        ('host_offset','<L'),        ('session_key_len','<H-session_key'),        ('session_key_max_len','<H-session_key'),        ('session_key_offset','<L'),        ('flags','<L'),        ('VersionLen','_-Version','self.checkVersion(self["flags"])'),         ('Version',':=""'),        ('MICLen','_-MIC','self.checkMIC(self["flags"])'),        ('MIC',':=""'),        ('domain_name',':'),        ('user_name',':'),        ('host_name',':'),        ('lanman',':'),        ('ntlm',':'),        ('session_key',':'))        ...

def getNTLMSSPType1(workstation='', domain='', signingRequired = False, use_ntlmv2 = USE_NTLMv2):    # Let's do some encoding checks before moving on. Kind of dirty, but found effective when dealing with    # international characters.    import sys    encoding = sys.getfilesystemencoding()    if encoding is not None:        try:            workstation.encode('utf-16le')        except:            workstation = workstation.decode(encoding)        try:            domain.encode('utf-16le')        except:            domain = domain.decode(encoding)
    # Let's prepare a Type 1 NTLMSSP Message    auth = NTLMAuthNegotiate()    # auth['os_version'] = bytes.fromhex('0a00614a0000000f')    auth['flags']=0    if signingRequired:       auth['flags'] = NTLMSSP_NEGOTIATE_KEY_EXCH | NTLMSSP_NEGOTIATE_SIGN | NTLMSSP_NEGOTIATE_ALWAYS_SIGN |                        NTLMSSP_NEGOTIATE_SEAL    if use_ntlmv2:       auth['flags'] |= NTLMSSP_NEGOTIATE_TARGET_INFO    auth['flags'] |= NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY | NTLMSSP_NEGOTIATE_UNICODE |                      NTLMSSP_REQUEST_TARGET |  NTLMSSP_NEGOTIATE_128 | NTLMSSP_NEGOTIATE_56
    # We're not adding workstation / domain fields this time. Normally Windows clients don't add such information but,    # we will save the workstation name to be used later.    auth.setWorkstation(workstation)
    return auth

def getNTLMSSPType3(type1, type2, user, password, domain, lmhash = '', nthash = '', use_ntlmv2 = USE_NTLMv2):
    # Safety check in case somebody sent password = None.. That's not allowed. Setting it to '' and hope for the best.    if password is None:        password = ''
    # Let's do some encoding checks before moving on. Kind of dirty, but found effective when dealing with    # international characters.    import sys    encoding = sys.getfilesystemencoding()    if encoding is not None:        try:            user.encode('utf-16le')        except:            user = user.decode(encoding)        try:            password.encode('utf-16le')        except:            password = password.decode(encoding)        try:            domain.encode('utf-16le')        except:            domain = user.decode(encoding)
    ntlmChallenge = NTLMAuthChallenge(type2)
    # Let's start with the original flags sent in the type1 message    responseFlags = type1['flags']    # responseFlags = 3767042613    # Token received and parsed. Depending on the authentication     # method we will create a valid ChallengeResponse    ntlmChallengeResponse = NTLMAuthChallengeResponse(user, password, ntlmChallenge['challenge'])
    clientChallenge = b("".join([random.choice(string.digits+string.ascii_letters) for _ in range(8)]))
    serverName = ntlmChallenge['TargetInfoFields']        ntResponse, lmResponse, sessionBaseKey = computeResponse(ntlmChallenge['flags'], ntlmChallenge['challenge'],                                                         clientChallenge, serverName, domain, user, password,                                                         lmhash, nthash, use_ntlmv2)

def computeResponseNTLMv1(flags, serverChallenge, clientChallenge, serverName, domain, user, password, lmhash='',                          nthash='', use_ntlmv2=USE_NTLMv2):    if user == '' and password == '':        # Special case for anonymous authentication        lmResponse = ''        ntResponse = ''    else:        lmhash = LMOWFv1(password, lmhash, nthash)        nthash = NTOWFv1(password, lmhash, nthash)        if flags & NTLMSSP_NEGOTIATE_LM_KEY:           ntResponse = ''           lmResponse = get_ntlmv1_response(lmhash, serverChallenge)        elif flags & NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY:           md5 = hashlib.new('md5')           chall = (serverChallenge + clientChallenge)           md5.update(chall)           ntResponse = ntlmssp_DES_encrypt(nthash, md5.digest()[:8])           lmResponse = clientChallenge + b'x00'*16        else:           ntResponse = get_ntlmv1_response(nthash,serverChallenge)           lmResponse = get_ntlmv1_response(lmhash, serverChallenge)       sessionBaseKey = generateSessionKeyV1(password, lmhash, nthash)    return ntResponse, lmResponse, sessionBaseKey

def computeResponseNTLMv2(flags, serverChallenge, clientChallenge, serverName, domain, user, password, lmhash='',                          nthash='', use_ntlmv2=USE_NTLMv2):
    responseServerVersion = b'x01'    hiResponseServerVersion = b'x01'    responseKeyNT = NTOWFv2(user, password, domain, nthash)
    av_pairs = AV_PAIRS(serverName)    # In order to support SPN target name validation, we have to add this to the serverName av_pairs. Otherwise we will    # get access denied    # This is set at Local Security Policy -> Local Policies -> Security Options -> Server SPN target name validation    # level    if TEST_CASE is False:        av_pairs[NTLMSSP_AV_TARGET_NAME] = 'cifs/'.encode('utf-16le') + av_pairs[NTLMSSP_AV_HOSTNAME][1]        if av_pairs[NTLMSSP_AV_TIME] is not None:           aTime = av_pairs[NTLMSSP_AV_TIME][1]        else:           aTime = struct.pack('<q', (116444736000000000 + calendar.timegm(time.gmtime()) * 10000000) )           av_pairs[NTLMSSP_AV_TIME] = aTime        serverName = av_pairs.getData()    else:        aTime = b'x00'*8
    temp = responseServerVersion + hiResponseServerVersion + b'x00' * 6 + aTime + clientChallenge + b'x00' * 4 +            serverName + b'x00' * 4
    ntProofStr = hmac_md5(responseKeyNT, serverChallenge + temp)
    ntChallengeResponse = ntProofStr + temp    lmChallengeResponse = hmac_md5(responseKeyNT, serverChallenge + clientChallenge) + clientChallenge    sessionBaseKey = hmac_md5(responseKeyNT, ntProofStr)
    if user == '' and password == '':        # Special case for anonymous authentication        ntChallengeResponse = ''        lmChallengeResponse = ''
    return ntChallengeResponse, lmChallengeResponse, sessionBaseKey