mirror of
https://github.com/Pennyw0rth/NetExec
synced 2026-06-06 16:34:30 +00:00
byt3bl33d3r
ab4d0a4406
This reverts commit db056d1ab4.
Module chaining will be re-implemented once I find a less hacky way of
going about it.
This also closes issue #144 and PR #145
100 lines
3.4 KiB
Python
100 lines
3.4 KiB
Python
import ntpath, logging
|
|
|
|
from gevent import sleep
|
|
from cme.helpers import gen_random_string
|
|
from impacket.dcerpc.v5.dcomrt import DCOMConnection
|
|
from impacket.dcerpc.v5.dcom import wmi
|
|
from impacket.dcerpc.v5.dtypes import NULL
|
|
|
|
class WMIEXEC:
|
|
def __init__(self, target, username, password, domain, smbconnection, hashes=None, share=None):
|
|
self.__target = target
|
|
self.__username = username
|
|
self.__password = password
|
|
self.__domain = domain
|
|
self.__lmhash = ''
|
|
self.__nthash = ''
|
|
self.__share = share
|
|
self.__smbconnection = smbconnection
|
|
self.__output = None
|
|
self.__outputBuffer = ''
|
|
self.__shell = 'cmd.exe /Q /c '
|
|
self.__pwd = 'C:\\'
|
|
self.__aesKey = None
|
|
self.__doKerberos = False
|
|
self.__retOutput = True
|
|
|
|
if hashes is not None:
|
|
#This checks to see if we didn't provide the LM Hash
|
|
if hashes.find(':') != -1:
|
|
self.__lmhash, self.__nthash = hashes.split(':')
|
|
else:
|
|
self.__nthash = hashes
|
|
|
|
if self.__password is None:
|
|
self.__password = ''
|
|
|
|
self.__dcom = DCOMConnection(self.__target, self.__username, self.__password, self.__domain, self.__lmhash, self.__nthash, self.__aesKey, oxidResolver = True, doKerberos=self.__doKerberos)
|
|
iInterface = self.__dcom.CoCreateInstanceEx(wmi.CLSID_WbemLevel1Login,wmi.IID_IWbemLevel1Login)
|
|
iWbemLevel1Login = wmi.IWbemLevel1Login(iInterface)
|
|
iWbemServices= iWbemLevel1Login.NTLMLogin('//./root/cimv2', NULL, NULL)
|
|
iWbemLevel1Login.RemRelease()
|
|
|
|
self.__win32Process,_ = iWbemServices.GetObject('Win32_Process')
|
|
|
|
def execute(self, command, output=False):
|
|
self.__retOutput = output
|
|
if self.__retOutput:
|
|
self.__smbconnection.setTimeout(100000)
|
|
self.cd('\\')
|
|
|
|
self.execute_remote(command)
|
|
self.__dcom.disconnect()
|
|
return self.__outputBuffer
|
|
|
|
def cd(self, s):
|
|
self.execute_remote('cd ' + s)
|
|
if len(self.__outputBuffer.strip('\r\n')) > 0:
|
|
print self.__outputBuffer
|
|
self.__outputBuffer = ''
|
|
else:
|
|
self.__pwd = ntpath.normpath(ntpath.join(self.__pwd, s))
|
|
self.execute_remote('cd ')
|
|
self.__pwd = self.__outputBuffer.strip('\r\n')
|
|
self.__outputBuffer = ''
|
|
|
|
def execute_remote(self, data):
|
|
self.__output = '\\Windows\\Temp\\' + gen_random_string(6)
|
|
|
|
command = self.__shell + data
|
|
if self.__retOutput:
|
|
command += ' 1> ' + '\\\\127.0.0.1\\%s' % self.__share + self.__output + ' 2>&1'
|
|
|
|
logging.debug('Executing command: ' + command)
|
|
self.__win32Process.Create(command, self.__pwd, None)
|
|
self.get_output()
|
|
|
|
def get_output(self):
|
|
|
|
if self.__retOutput is False:
|
|
self.__outputBuffer = ''
|
|
return
|
|
|
|
def output_callback(data):
|
|
self.__outputBuffer += data
|
|
|
|
while True:
|
|
try:
|
|
self.__smbconnection.getFile(self.__share, self.__output, output_callback)
|
|
break
|
|
except Exception as e:
|
|
if str(e).find('STATUS_SHARING_VIOLATION') >=0:
|
|
# Output not finished, let's wait
|
|
sleep(2)
|
|
pass
|
|
else:
|
|
#print str(e)
|
|
pass
|
|
|
|
self.__smbconnection.deleteFile(self.__share, self.__output)
|