from __future__ import division

from __future__ import print_function

import sys

import os

import cmd

import argparse

import time

import logging

import ntpath

from base64 import b64encode

from impacket.examples import logger

from impacket.examples.utils import parse_target

from impacket import version

from impacket.smbconnection import SMBConnection, SMB_DIALECT, SMB2_DIALECT_002, SMB2_DIALECT_21

from impacket.dcerpc.v5.dcomrt import DCOMConnection, COMVERSION

from impacket.dcerpc.v5.dcom import wmi

from impacket.dcerpc.v5.dtypes import NULL

from impacket.krb5.keytab import Keytab

from six import PY2

OUTPUT_FILENAME = '__' + str(time.time())

CODEC = sys.stdout.encoding

class WMIEXEC:

dcom.disconnect()

class RemoteShell(cmd.Cmd):

self.__outputBuffer = ''

class AuthFileSyntaxError(Exception):

self.path, self.lineno, self.reason)

def load_smbclient_auth_file(path):

return (domain, username, password)

if __name__ == '__main__':

print(version.BANNER)

parser = argparse.ArgumentParser(add_help=True, description="Executes a semi-interactive shell using Windows "

"Management Instrumentation.")

parser.add_argument('target', action='store', help='[[domain/]username[:password]@]<targetName or address>')

parser.add_argument('-share', action='store', default='ADMIN$', help='share where the output will be grabbed from '

'(default ADMIN$)')

parser.add_argument('-nooutput', action='store_true', default=False, help='whether or not to print the output '

'(no SMB connection created)')

parser.add_argument('-ts', action='store_true', help='Adds timestamp to every logging output')

parser.add_argument('-silentcommand', action='store_true', default=False,

help='does not execute cmd.exe to run given command (no output)')

parser.add_argument('-debug', action='store_true', help='Turn DEBUG output ON')

parser.add_argument('-codec', action='store', help='Sets encoding used (codec) from the target\'s output (default '

'"%s"). If errors are detected, run chcp.com at the target, '

'map the result with '

'https://docs.python.org/3/library/codecs.html#standard-encodings and then execute wmiexec.py '

'again with -codec and the corresponding codec ' % CODEC)

parser.add_argument('-shell-type', action='store', default='cmd', choices=['cmd', 'powershell'],

help='choose a command processor for the semi-interactive shell')

parser.add_argument('-com-version', action='store', metavar="MAJOR_VERSION:MINOR_VERSION",

help='DCOM version, format is MAJOR_VERSION:MINOR_VERSION e.g. 5.7')

parser.add_argument('command', nargs='*', default=' ', help='command to execute at the target. If empty it will '

'launch a semi-interactive shell')

group = parser.add_argument_group('authentication')

group.add_argument('-hashes', action="store", metavar="LMHASH:NTHASH", help='NTLM hashes, format is LMHASH:NTHASH')

group.add_argument('-no-pass', action="store_true", help='don\'t ask for password (useful for -k)')

group.add_argument('-k', action="store_true",

help='Use Kerberos authentication. Grabs credentials from ccache file '

'(KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use the '

'ones specified in the command line')

group.add_argument('-aesKey', action="store", metavar="hex key", help='AES key to use for Kerberos Authentication '

'(128 or 256 bits)')

group.add_argument('-dc-ip', action='store', metavar="ip address", help='IP Address of the domain controller. If '

'ommited it use the domain part (FQDN) specified in the target parameter')

group.add_argument('-target-ip', action='store', metavar="ip address",

help='IP Address of the target machine. If omitted it will use whatever was specified as target. '

'This is useful when target is the NetBIOS name and you cannot resolve it')

group.add_argument('-A', action="store", metavar="authfile", help="smbclient/mount.cifs-style authentication file. "

"See smbclient man page's -A option.")

group.add_argument('-keytab', action="store", help='Read keys for SPN from keytab file')

if len(sys.argv) == 1:

parser.print_help()

sys.exit(1)

options = parser.parse_args()

# Init the example's logger theme

logger.init(options.ts)

if options.codec is not None:

CODEC = options.codec

else:

if CODEC is None:

CODEC = 'utf-8'

if ' '.join(options.command) == ' ' and options.nooutput is True:

logging.error("-nooutput switch and interactive shell not supported")

sys.exit(1)

if options.silentcommand and options.command == ' ':

logging.error("-silentcommand switch and interactive shell not supported")

sys.exit(1)

if options.debug is True:

logging.getLogger().setLevel(logging.DEBUG)

# Print the Library's installation path

logging.debug(version.getInstallationPath())

else:

logging.getLogger().setLevel(logging.INFO)

if options.com_version is not None:

try:

major_version, minor_version = options.com_version.split('.')

COMVERSION.set_default_version(int(major_version), int(minor_version))

except Exception:

logging.error("Wrong COMVERSION format, use dot separated integers e.g. \"5.7\"")

sys.exit(1)

domain, username, password, address = parse_target(options.target)

try:

if options.A is not None:

(domain, username, password) = load_smbclient_auth_file(options.A)

logging.debug('loaded smbclient auth file: domain=%s, username=%s, password=%s' % (

repr(domain), repr(username), repr(password)))

if options.target_ip is None:

options.target_ip = address

if domain is None:

domain = ''

if options.keytab is not None:

Keytab.loadKeysFromKeytab(options.keytab, username, domain, options)

options.k = True

if password == '' and username != '' and options.hashes is None and options.no_pass is False and options.aesKey is None:

from getpass import getpass

password = getpass("Password:")

if options.aesKey is not None:

options.k = True

executer = WMIEXEC(' '.join(options.command), username, password, domain, options.hashes, options.aesKey,

options.share, options.nooutput, options.k, options.dc_ip, options.target_ip, options.shell_type)

executer.run(address, options.silentcommand)

except KeyboardInterrupt as e:

logging.error(str(e))

except Exception as e:

if logging.getLogger().level == logging.DEBUG:

import traceback

traceback.print_exc()

logging.error(str(e))

sys.exit(1)

sys.exit(0)