mirror of
https://github.com/fortra/impacket
synced 2026-06-08 14:15:13 +00:00
Raz Kissos
20002f79e5
* Add documentation in the comments for clearer use of NT_CREATE_ANDX flags.
Then sort out some mismatching flags.
* Change default shareAccessMode in the retr file methods to allow read, write and delete.
I found it out when capturing network traffic and seeing I can manage to read files with open handles.
This fixes SHARE_ACCESS_DENIED errors when trying to read files with handles on them.
This is the logical thing to do when we open files for reading.
We do not want to block other processes from interacting with the file.
This may raise problems when reading files that are being written into / being deleted.
I still think this is the right move since we usually want to read the files no matter what.
* Add ability to read files with open handles - this is related to my previous commits.
* Add ability to read files that have open handles to them.
This is related to my older commits on the subject.
* Update smbconnection.py
Add method parameters to `getFile` to easily communicate with the underlying SMB API.
* Fix `shareAccessMode` when opening files for writing.
We obviously do not want to allow others to write to the file while we are writing to it.
* Extend `SMBConnection`'s method parameters for `getFile` and `putFile` methods.
* Add comments for `DesiredAccess`, `ShareAccess` and `CreateDisposition` values in SMBv2.
* Update smb3structs.py
* Fix missing values.
* [SMB] Define CIFS SMB Date and SMB Time according to `2.2.1.4 Time`.
This is done to assist future development of SetInfo operations on files and directories.
```
Date Conversion Example - Year Component:
-----------------------------------------
2009 - 1980 = 29
| (convert to binary)
V
0001 1101
| (position data correctly by shifting)
V
0001 1101
<< 9
---------------------
= 0 0011 1010 0000 0000
| (trim to correct size with bitwise AND of correct mask)
V
0 0011 1010 0000 0000
& 1111 1110 0000 0000
---------------------
= 0011 1010 0000 0000
```
* [SMB] Added CIFS DateTime objects helper methods to convert values to classes.
* [SMB] Feature: added support for set_file_info method using trans2.
By doing so I also fixed a bad structure definition in the SMBSetFileBasicInfo structure.
Now we can modify file information remotely ;)
* [SMBServer] Moved FileTime Conversion methods to the base SMB library.
Also converted the SMB DATETIME methods to use my SMB_DATE and SMB_TIME implementations.
* [SMBConnection] Added type hinting for (almost) all methods.
Also implemented setInfo method to use for setting file information.
* [TEST_SMB] Add tests for new setInfo method.
* [TEST_SMB] This is causing errors so I will wait for now.
* [SMBConnection] add support for default info class type in queryInfo method.
* [SMBConnection] Fix queryInfo to allow retrieval of more
fileInformationClasses other than the default one.
* [attrib] Added attrib example to showcase file attribute modifications using SMB.
for now only implemented query.
* [smbserver] fix missing pack operation in getSMBTime method.
* [attrib] Finished set action, thus finishing the attrib example script.
* [attrib] Final touches, adding output to set action as well.
* [attrib] Add option to set connection timeout.
* [smbclient] Add reconnect command.
* [smb] Fix accidental SMB_TIME creation with removing `+ 1980` to hours.
* [examples] Implement filetime.py
An example script that allows querying and modifying file timestamps using SMB.
* After merge, fix some syntax issues.
* Actually show subparser's descriptions now.
* [SMB] Removed type annotations. Improved comments. Cleaned imports.
* [SMB] Removed type annotations, improved comments.
* [SMB] Comment changes.
* [examples] Add handling of empty action, even though argparse should catch it.
* refactor: Fix PR requests.
344 lines
18 KiB
Python
344 lines
18 KiB
Python
#!/usr/bin/env python
|
|
# Impacket - Collection of Python classes for working with network protocols.
|
|
#
|
|
# Copyright Fortra, LLC and its affiliated companies
|
|
#
|
|
# All rights reserved.
|
|
#
|
|
# This software is provided under a slightly modified version
|
|
# of the Apache Software License. See the accompanying LICENSE file
|
|
# for more information.
|
|
#
|
|
# Description:
|
|
# This script allows the user to query and modify file / directory attributes - utilizing pure SMB.
|
|
#
|
|
# Author:
|
|
# Raz Kissos (@covertivy)
|
|
#
|
|
|
|
from __future__ import division
|
|
from __future__ import print_function
|
|
from __future__ import annotations
|
|
import sys
|
|
import argparse
|
|
import logging
|
|
import ntpath
|
|
from dataclasses import dataclass
|
|
|
|
from impacket.examples import logger
|
|
from impacket.examples.utils import parse_target
|
|
from impacket import version
|
|
from impacket import smbconnection
|
|
from impacket.nmb import SMB_SESSION_PORT
|
|
from impacket.smb import (
|
|
SMB_DIALECT,
|
|
FILE_READ_ATTRIBUTES,
|
|
FILE_WRITE_ATTRIBUTES,
|
|
FILE_SHARE_READ,
|
|
FILE_SHARE_WRITE,
|
|
FILE_SHARE_DELETE,
|
|
SMB_QUERY_FILE_BASIC_INFO,
|
|
SMB_SET_FILE_BASIC_INFO,
|
|
SMBQueryFileBasicInfo,
|
|
SMBSetFileBasicInfo,
|
|
)
|
|
from impacket.smb3structs import (
|
|
SMB2_FILE_BASIC_INFO,
|
|
FILE_BASIC_INFORMATION,
|
|
)
|
|
|
|
|
|
ATTRIB_QUERY_ACTION = 'query'
|
|
ATTRIB_SET_ACTION = 'set'
|
|
VALID_ATTRIB_ACTIONS = (ATTRIB_QUERY_ACTION, ATTRIB_SET_ACTION)
|
|
|
|
# All Knwon File Attributes according to [MS-FSCC] 2.6 File Attributes.
|
|
FILE_ATTRIBUTE_READONLY = 0x00000001
|
|
FILE_ATTRIBUTE_HIDDEN = 0x00000002
|
|
FILE_ATTRIBUTE_SYSTEM = 0x00000004
|
|
FILE_ATTRIBUTE_VOLUME = 0x00000008
|
|
FILE_ATTRIBUTE_DIRECTORY = 0x00000010
|
|
FILE_ATTRIBUTE_ARCHIVE = 0x00000020
|
|
FILE_ATTRIBUTE_NORMAL = 0x00000080
|
|
FILE_ATTRIBUTE_TEMPORARY = 0x00000100
|
|
FILE_ATTRIBUTE_SPARSE_FILE = 0x00000200
|
|
FILE_ATTRIBUTE_REPARSE_POINT = 0x00000400
|
|
FILE_ATTRIBUTE_COMPRESSED = 0x00000800
|
|
FILE_ATTRIBUTE_OFFLINE = 0x00001000
|
|
FILE_ATTRIBUTE_NOT_CONTENT_INDEXED = 0x00002000
|
|
FILE_ATTRIBUTE_ENCRYPTED = 0x00004000
|
|
FILE_ATTRIBUTE_NO_SCRUB_DATA = 0x00020000
|
|
FILE_ATTRIBUTE_RECALL_ON_OPEN = 0x00040000
|
|
FILE_ATTRIBUTE_PINNED = 0x00080000
|
|
FILE_ATTRIBUTE_UNPINNED = 0x00100000
|
|
FILE_ATTRIBUTE_RECALL_ON_DATA_ACCESS = 0x00400000
|
|
|
|
|
|
@dataclass
|
|
class FileAttributes:
|
|
readonly: bool = False
|
|
hidden: bool = False
|
|
system: bool = False
|
|
volume: bool = False
|
|
directory: bool = False
|
|
archive: bool = False
|
|
normal: bool = False
|
|
temporary: bool = False
|
|
sparse_file: bool = False
|
|
reparse_point: bool = False
|
|
compressed: bool = False
|
|
offline: bool = False
|
|
not_content_indexed: bool = False
|
|
encrypted: bool = False
|
|
no_scrub_data: bool = False
|
|
recall_on_open: bool = False
|
|
pinned: bool = False
|
|
unpinned: bool = False
|
|
recall_on_data_access: bool = False
|
|
|
|
def pack(self) -> int:
|
|
return \
|
|
(FILE_ATTRIBUTE_READONLY if self.readonly else 0) | \
|
|
(FILE_ATTRIBUTE_HIDDEN if self.hidden else 0) | \
|
|
(FILE_ATTRIBUTE_SYSTEM if self.system else 0) | \
|
|
(FILE_ATTRIBUTE_VOLUME if self.volume else 0) | \
|
|
(FILE_ATTRIBUTE_DIRECTORY if self.directory else 0) | \
|
|
(FILE_ATTRIBUTE_ARCHIVE if self.archive else 0) | \
|
|
(FILE_ATTRIBUTE_NORMAL if self.normal else 0) | \
|
|
(FILE_ATTRIBUTE_TEMPORARY if self.temporary else 0) | \
|
|
(FILE_ATTRIBUTE_SPARSE_FILE if self.sparse_file else 0) | \
|
|
(FILE_ATTRIBUTE_REPARSE_POINT if self.reparse_point else 0) | \
|
|
(FILE_ATTRIBUTE_COMPRESSED if self.compressed else 0) | \
|
|
(FILE_ATTRIBUTE_OFFLINE if self.offline else 0) | \
|
|
(FILE_ATTRIBUTE_NOT_CONTENT_INDEXED if self.not_content_indexed else 0) | \
|
|
(FILE_ATTRIBUTE_ENCRYPTED if self.encrypted else 0) | \
|
|
(FILE_ATTRIBUTE_NO_SCRUB_DATA if self.no_scrub_data else 0) | \
|
|
(FILE_ATTRIBUTE_RECALL_ON_OPEN if self.recall_on_open else 0) | \
|
|
(FILE_ATTRIBUTE_PINNED if self.pinned else 0) | \
|
|
(FILE_ATTRIBUTE_UNPINNED if self.unpinned else 0) | \
|
|
(FILE_ATTRIBUTE_RECALL_ON_DATA_ACCESS if self.recall_on_data_access else 0)
|
|
|
|
@classmethod
|
|
def unpack(cls, data: int) -> FileAttributes:
|
|
return cls(
|
|
readonly = bool(data & FILE_ATTRIBUTE_READONLY),
|
|
hidden = bool(data & FILE_ATTRIBUTE_HIDDEN),
|
|
system = bool(data & FILE_ATTRIBUTE_SYSTEM),
|
|
volume = bool(data & FILE_ATTRIBUTE_VOLUME),
|
|
directory = bool(data & FILE_ATTRIBUTE_DIRECTORY),
|
|
archive = bool(data & FILE_ATTRIBUTE_ARCHIVE),
|
|
normal = bool(data & FILE_ATTRIBUTE_NORMAL),
|
|
temporary = bool(data & FILE_ATTRIBUTE_TEMPORARY),
|
|
sparse_file = bool(data & FILE_ATTRIBUTE_SPARSE_FILE),
|
|
reparse_point = bool(data & FILE_ATTRIBUTE_REPARSE_POINT),
|
|
compressed = bool(data & FILE_ATTRIBUTE_COMPRESSED),
|
|
offline = bool(data & FILE_ATTRIBUTE_OFFLINE),
|
|
not_content_indexed = bool(data & FILE_ATTRIBUTE_NOT_CONTENT_INDEXED),
|
|
encrypted = bool(data & FILE_ATTRIBUTE_ENCRYPTED),
|
|
no_scrub_data = bool(data & FILE_ATTRIBUTE_NO_SCRUB_DATA),
|
|
recall_on_open = bool(data & FILE_ATTRIBUTE_RECALL_ON_OPEN),
|
|
pinned = bool(data & FILE_ATTRIBUTE_PINNED),
|
|
unpinned = bool(data & FILE_ATTRIBUTE_UNPINNED),
|
|
recall_on_data_access = bool(data & FILE_ATTRIBUTE_RECALL_ON_DATA_ACCESS),
|
|
)
|
|
|
|
@staticmethod
|
|
def repr_attribs(data: int) -> str:
|
|
return FileAttributes.unpack(data).__repr__()
|
|
|
|
def __repr__(self) -> str:
|
|
return \
|
|
('R' if self.readonly else '-') + \
|
|
('H' if self.hidden else '-') + \
|
|
('S' if self.system else '-') + \
|
|
('V' if self.volume else '-') + \
|
|
('D' if self.directory else '-') + \
|
|
('A' if self.archive else '-') + \
|
|
('N' if self.normal else '-') + \
|
|
('T' if self.temporary else '-') + \
|
|
('C' if self.compressed else '-') + \
|
|
('O' if self.offline else '-') + \
|
|
('E' if self.encrypted else '-') + \
|
|
('P' if self.pinned else '-') + \
|
|
('U' if self.unpinned else '-')
|
|
|
|
|
|
def attrib_query(connection: smbconnection.SMBConnection, tid: int, fid: int) -> FileAttributes:
|
|
if connection.getDialect() == SMB_DIALECT:
|
|
basicinfo = SMBQueryFileBasicInfo(connection.queryInfo(tid, fid, SMB_QUERY_FILE_BASIC_INFO))
|
|
attributes = basicinfo['ExtFileAttributes']
|
|
else:
|
|
basicinfo = FILE_BASIC_INFORMATION(connection.queryInfo(tid, fid, SMB2_FILE_BASIC_INFO))
|
|
attributes = basicinfo['FileAttributes']
|
|
|
|
logging.debug(f"Got file / directory {attributes = }")
|
|
return FileAttributes.unpack(attributes)
|
|
|
|
def attrib_set(connection: smbconnection.SMBConnection, tid: int, fid: int, attribs: FileAttributes) -> None:
|
|
if connection.getDialect() == SMB_DIALECT:
|
|
info_data = SMBSetFileBasicInfo()
|
|
info_data['CreationTime'] = 0
|
|
info_data['LastAccessTime'] = 0
|
|
info_data['LastWriteTime'] = 0
|
|
info_data['ChangeTime'] = 0
|
|
info_data['ExtFileAttributes'] = attribs.pack()
|
|
fileInfoClass = SMB_SET_FILE_BASIC_INFO
|
|
else:
|
|
info_data = FILE_BASIC_INFORMATION()
|
|
info_data['CreationTime'] = 0
|
|
info_data['LastAccessTime'] = 0
|
|
info_data['LastWriteTime'] = 0
|
|
info_data['ChangeTime'] = 0
|
|
info_data['FileAttributes'] = attribs.pack()
|
|
fileInfoClass = SMB2_FILE_BASIC_INFO
|
|
|
|
logging.debug(f"Setting file / directory attributes = {attribs.pack()}")
|
|
|
|
connection.setInfo(tid, fid, fileInfoClass, info_data)
|
|
|
|
|
|
def main():
|
|
# Init the example's logger theme
|
|
logger.init()
|
|
print(version.BANNER)
|
|
parser = argparse.ArgumentParser(add_help = True, description = "File Attribute Modification Utility implementation.")
|
|
|
|
parser.add_argument('target', action='store', help='[[domain/]username[:password]@]<targetName or address>')
|
|
parser.add_argument("share", type=str, help="The share in which the desired file to query or modify resides.")
|
|
parser.add_argument("path", type=str, help="The path of the desired file whose attributes we wish to query or modify.")
|
|
|
|
parser.add_argument('-debug', action='store_true', help='Turn DEBUG output ON')
|
|
|
|
group = parser.add_argument_group('authentication')
|
|
group.add_argument('-hashes', action="store", metavar="LMHASH:NTHASH", help='NTLM hashes, format is LMHASH:NTHASH')
|
|
group.add_argument('-no-pass', action="store_true", help='Don\'t ask for password (useful for -k)')
|
|
group.add_argument('-k', action="store_true", help='Use Kerberos authentication. Grabs credentials from ccache file '
|
|
'(KRB5CCNAME) based on target parameters. If valid credentials '
|
|
'cannot be found, it will use the ones specified in the command '
|
|
'line')
|
|
group.add_argument('-aesKey', action="store", metavar = "hex key", help='AES key to use for Kerberos Authentication '
|
|
'(128 or 256 bits)')
|
|
|
|
group = parser.add_argument_group('connection')
|
|
group.add_argument('-p', '--port', default=SMB_SESSION_PORT, type=int, metavar="destination port", help='Destination port to connect to the SMB Server.')
|
|
group.add_argument('-dc-ip', action='store', metavar="ip address",
|
|
help='IP Address of the domain controller. If omitted it will use the domain part (FQDN) specified in '
|
|
'the target parameter')
|
|
group.add_argument('-target-ip', action='store', metavar="ip address",
|
|
help='IP Address of the target machine. If omitted it will use whatever was specified as target. '
|
|
'This is useful when target is the NetBIOS name and you cannot resolve it')
|
|
group.add_argument('-t', '--timeout', default=60, type=int, metavar="seconds", help='Set connection timeout (seconds).')
|
|
|
|
subcommands = parser.add_subparsers(dest="action")
|
|
|
|
query_parser = subcommands.add_parser(ATTRIB_QUERY_ACTION, help="Query current file / directory attributes.")
|
|
|
|
set_parser = subcommands.add_parser(ATTRIB_SET_ACTION, help="Modify file / directory attributes.")
|
|
set_parser.add_argument('-r', '--readonly', dest='readonly', action='store_true', help="A file or directory that is read-only. For a file, applications can read the file but cannot write to it or delete it. For a directory, applications cannot delete it, but applications can create and delete files from that directory.")
|
|
set_parser.add_argument('-H', '--hidden', dest='hidden', action='store_true', help="A file or directory that is hidden. Files and directories marked with this attribute do not appear in an ordinary directory listing.")
|
|
set_parser.add_argument('-s', '--system', dest='system', action='store_true', help="A file or directory that the operating system uses a part of or uses exclusively.")
|
|
set_parser.add_argument('-a', '--archive', dest='archive', action='store_true', help="A file or directory that requires to be archived. Applications use this attribute to mark files for backup or removal.")
|
|
set_parser.add_argument('-n', '--normal', dest='normal', action='store_true', help="A file that does not have other attributes set. This flag is used to clear all other flags by specifying it with no other flags set.")
|
|
set_parser.add_argument('-t', '--temporary', dest='temporary', action='store_true', help="A file that is being used for temporary storage. The operating system can choose to store this file's data in memory rather than on mass storage, writing the data to mass storage only if data remains in the file when the file is closed.")
|
|
set_parser.add_argument('-c', '--compressed', dest='compressed', action='store_true', help="A file or directory that is compressed. For a file, all of the data in the file is compressed. For a directory, compression is the default for newly created files and subdirectories.")
|
|
set_parser.add_argument('-o', '--offline', dest='offline', action='store_true', help="The data in this file is not available immediately. This attribute indicates that the file data is physically moved to offline storage. This attribute is used by Remote Storage, which is hierarchical storage management software.")
|
|
set_parser.add_argument('-e', '--encrypted', dest='encrypted', action='store_true', help="A file or directory that is encrypted. For a file, all data streams in the file are encrypted. For a directory, encryption is the default for newly created files and subdirectories.")
|
|
set_parser.add_argument('-p', '--pinned', dest='pinned', action='store_true', help="This attribute indicates user intent that the file or directory should be kept fully present locally even when not being actively accessed. This attribute is for use with hierarchical storage management software.")
|
|
set_parser.add_argument('-u', '--unpinned', dest='unpinned', action='store_true', help="This attribute indicates that the file or directory should not be kept fully present locally except when being actively accessed. This attribute is for use with hierarchical storage management software.")
|
|
|
|
if len(sys.argv)==1:
|
|
parser.print_help()
|
|
sys.exit(1)
|
|
|
|
options = parser.parse_args()
|
|
|
|
if options.debug is True:
|
|
logging.getLogger().setLevel(logging.DEBUG)
|
|
# Print the Library's installation path
|
|
logging.debug(version.getInstallationPath())
|
|
else:
|
|
logging.getLogger().setLevel(logging.INFO)
|
|
|
|
if options.action not in VALID_ATTRIB_ACTIONS:
|
|
logging.error("Invalid action '{action}'".format(action=options.action))
|
|
|
|
domain, username, password, address = parse_target(options.target)
|
|
|
|
if options.target_ip is None:
|
|
options.target_ip = address
|
|
|
|
if domain is None:
|
|
domain = ''
|
|
|
|
if password == '' and username != '' and options.hashes is None and options.no_pass is False and options.aesKey is None:
|
|
from getpass import getpass
|
|
password = getpass("Password:")
|
|
|
|
if options.aesKey is not None:
|
|
options.k = True
|
|
|
|
if options.hashes is not None:
|
|
lmhash, nthash = options.hashes.split(':')
|
|
else:
|
|
lmhash = ''
|
|
nthash = ''
|
|
|
|
share = options.share
|
|
path = ntpath.normpath(options.path)
|
|
|
|
try:
|
|
connection = smbconnection.SMBConnection(address, options.target_ip, sess_port=int(options.port), timeout=int(options.timeout))
|
|
if options.k is True:
|
|
connection.kerberosLogin(username, password, domain, lmhash, nthash, options.aesKey, options.dc_ip)
|
|
else:
|
|
connection.login(username, password, domain, lmhash, nthash)
|
|
|
|
tid = connection.connectTree(share)
|
|
|
|
if options.action == 'query':
|
|
desiredAccess = FILE_READ_ATTRIBUTES
|
|
elif options.action == 'set':
|
|
desiredAccess = FILE_WRITE_ATTRIBUTES
|
|
|
|
fid = connection.openFile(
|
|
tid,
|
|
path,
|
|
shareMode=FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, # Allow other processes to interact with the file / directory.
|
|
creationOption=0, # Open both a file or a directory without limitation.
|
|
desiredAccess=desiredAccess # Request only the permissions we need.
|
|
)
|
|
|
|
try:
|
|
if options.action == 'query':
|
|
print(attrib_query(connection, tid, fid), share, path)
|
|
elif options.action == 'set':
|
|
attribs = FileAttributes(
|
|
readonly = options.readonly,
|
|
hidden = options.hidden,
|
|
system = options.system,
|
|
archive = options.archive,
|
|
normal = options.normal,
|
|
temporary = options.temporary,
|
|
compressed = options.compressed,
|
|
offline = options.offline,
|
|
encrypted = options.encrypted,
|
|
pinned = options.pinned,
|
|
unpinned = options.unpinned,
|
|
)
|
|
attrib_set(connection, tid, fid, attribs)
|
|
print(attribs, share, path)
|
|
finally:
|
|
connection.closeFile(tid, fid)
|
|
connection.disconnectTree(tid)
|
|
connection.close()
|
|
|
|
except Exception as e:
|
|
if logging.getLogger().level == logging.DEBUG:
|
|
import traceback
|
|
traceback.print_exc()
|
|
logging.error(str(e))
|
|
|
|
|
|
if __name__ == "__main__":
|
|
main()
|