内网渗透瑞士军刀-impacket工具解析（二）

PrincipalName::= SEQUENCE {           name-type       [0] Int32,           name-string     [1] SEQUENCE OF KerberosString   }

Record ::= SEQUENCE {      id        INTEGER,    room  [0] INTEGER OPTIONAL,    house [1] INTEGER DEFAULT 0    }

from pyasn1.type.univ import *from pyasn1.type.tag import *from pyasn1.type.namedtype import *class Record(Sequence):    componentType = NamedTypes(        NamedType('id', Integer()),        OptionalNamedType(            'room', Integer().subtype(                implicitTag=Tag(tagClassContext, tagFormatSimple, 0)            )        ),        DefaultedNamedType(            'house', Integer(0).subtype(                implicitTag=Tag(tagClassContext, tagFormatSimple, 1)            )        )    )

record = Record()record['id'] = 123record['room'] = 321print(record)-----------------------------------Record: id=123 room=321

from pyasn1.codec.der import encoderencodedRecord = encoder.encode(record)print(encodedRecord.hex())----------------------------------------300702017b80020141

class Int32(univ.Integer):    subtypeSpec = univ.Integer.subtypeSpec + constraint.ValueRangeConstraint(        -2147483648, 2147483647)class UInt32(univ.Integer):    pass#    subtypeSpec = univ.Integer.subtypeSpec + constraint.ValueRangeConstraint(#        0, 4294967295)class Microseconds(univ.Integer):    subtypeSpec = univ.Integer.subtypeSpec + constraint.ValueRangeConstraint(        0, 999999)class KerberosString(char.GeneralString):    # TODO marc: I'm not sure how to express this constraint in the API.    # For now, we will be liberal in what we accept.    # subtypeSpec = constraint.PermittedAlphabetConstraint(char.IA5String())    pass

class PrincipalName(univ.Sequence):    componentType = namedtype.NamedTypes(        _sequence_component("name-type", 0, Int32()),        _sequence_component("name-string", 1,                            univ.SequenceOf(componentType=KerberosString()))                            )class HostAddress(univ.Sequence):    componentType = namedtype.NamedTypes(        _sequence_component("addr-type", 0, Int32()),        _sequence_component("address", 1, univ.OctetString())        )class AuthorizationData(univ.SequenceOf):    componentType = univ.Sequence(componentType=namedtype.NamedTypes(        _sequence_component('ad-type', 0, Int32()),        _sequence_component('ad-data', 1, univ.OctetString())        ))class PA_DATA(univ.Sequence):    componentType = namedtype.NamedTypes(        _sequence_component('padata-type', 1, Int32()),        _sequence_component('padata-value', 2, univ.OctetString())        )

KDC-REQ        ::= SEQUENCE {    pvno         [0] INTEGER (5),    msg-type     [1] INTEGER (10 -- AS --),    padata       [2] SEQUENCE OF PA-DATA OPTIONAL,    req-body     [3] KDC-REQ-BODY}

KDC-REQ-BODY   ::= SEQUENCE {    kdc-options             [0] KDCOptions,    cname                   [1] PrincipalName OPTIONAL,    realm                   [2] Realm,    sname                   [3] PrincipalName OPTIONAL,    from                    [4] KerberosTime OPTIONAL,    till                    [5] KerberosTime,    rtime                   [6] KerberosTime OPTIONAL,    nonce                   [7] UInt32,    etype                   [8] SEQUENCE OF Int32 -- EncryptionType    addresses               [9] HostAddresses OPTIONAL,    enc-authorization-data  [10] EncryptedData OPTIONAL,    additional-tickets      [11] SEQUENCE OF Ticket OPTIONAL}

KDC-REP        ::= SEQUENCE {    pvno         [0] INTEGER (5),    msg-type     [1] INTEGER (11 -- AS -- | 13 -- TGS --),    padata       [2] SEQUENCE OF PA-DATA OPTIONAL,    crealm       [3] Realm,    cname        [4] PrincipalName,    ticket       [5] Ticket,    enc-part     [6] EncryptedData}

def sendReceive(data, host, kdcHost):    if kdcHost is None:        targetHost = host    else:        targetHost = kdcHost    messageLen = struct.pack('!i', len(data))    LOG.debug('Trying to connect to KDC at %s' % targetHost)    try:        af, socktype, proto, canonname, sa = socket.getaddrinfo(targetHost, 88, 0, socket.SOCK_STREAM)[0]        s = socket.socket(af, socktype, proto)        s.connect(sa)    except socket.error as e:        raise socket.error("Connection error (%s:%s)" % (targetHost, 88), e)    s.sendall(messageLen + data)    recvDataLen = struct.unpack('!i', s.recv(4))[0]    r = s.recv(recvDataLen)    while len(r) < recvDataLen:        r += s.recv(recvDataLen-len(r))    try:        krbError = KerberosError(packet = decoder.decode(r, asn1Spec = KRB_ERROR())[0])    except:        return r    if krbError.getErrorCode() != constants.ErrorCodes.KDC_ERR_PREAUTH_REQUIRED.value:        try:            for i in decoder.decode(r):                if type(i) == Sequence:                    for k in vars(i)["_componentValues"]:                        if type(k) == GeneralizedTime:                            server_time = datetime.datetime.strptime(k.asOctets().decode("utf-8"), "%Y%m%d%H%M%SZ")                            LOG.debug("Server time (UTC): %s" % server_time)        except:            # Couldn't get server time for some reason            pass        raise krbError    return r

def getKerberosTGT(clientName, password, domain, lmhash, nthash, aesKey='', kdcHost=None, requestPAC=True):    # Convert to binary form, just in case we're receiving strings    if isinstance(lmhash, str):        try:            lmhash = unhexlify(lmhash)        except TypeError:            pass    if isinstance(nthash, str):        try:            nthash = unhexlify(nthash)        except TypeError:            pass    if isinstance(aesKey, str):        try:            aesKey = unhexlify(aesKey)        except TypeError:            pass    asReq = AS_REQ()    ...

def getKerberosTGS(serverName, domain, kdcHost, tgt, cipher, sessionKey):    # Decode the TGT    try:        decodedTGT = decoder.decode(tgt, asn1Spec = AS_REP())[0]    except:        decodedTGT = decoder.decode(tgt, asn1Spec = TGS_REP())[0]    domain = domain.upper()    # Extract the ticket from the TGT    ticket = Ticket()    ticket.from_asn1(decodedTGT['ticket'])    apReq = AP_REQ()    apReq['pvno'] = 5    apReq['msg-type'] = int(constants.ApplicationTagNumbers.AP_REQ.value)