Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
share.create(ImpersonationLevel.Impersonation,
DirectoryAccessMask.FILE_READ_ATTRIBUTES |
DirectoryAccessMask.SYNCHRONIZE |
DirectoryAccessMask.FILE_LIST_DIRECTORY,
FileAttributes.FILE_ATTRIBUTE_DIRECTORY,
ShareAccess.FILE_SHARE_READ |
ShareAccess.FILE_SHARE_WRITE |
ShareAccess.FILE_SHARE_DELETE,
CreateDisposition.FILE_OPEN,
CreateOptions.FILE_DIRECTORY_FILE)
try:
paexec_files = share.query_directory("PAExec-*.exe",
FileInformationClass.
FILE_NAMES_INFORMATION)
except SMBResponseException as exc:
if exc.status != NtStatus.STATUS_NO_SUCH_FILE:
raise exc
paexec_files = []
return client, paexec_services, paexec_files
request = self.connection.send(read_msg,
sid=self.sid,
tid=self.tid)
self.sent_first = True
try:
log.debug("Reading SMB Read response for Output Named "
"Pipe: %s" % self.name)
pipe_out = read_resp_func(request)
log.debug("Received SMB Read response for Output Named "
"Pipe: %s" % self.name)
self.handle_output(pipe_out)
except SMBResponseException as exc:
# if the error was the pipe was broken exit the loop
# otherwise the error is serious so throw it
close_errors = [
NtStatus.STATUS_PIPE_BROKEN,
NtStatus.STATUS_PIPE_CLOSING,
NtStatus.STATUS_PIPE_EMPTY,
NtStatus.STATUS_PIPE_DISCONNECTED
]
if exc.status in close_errors:
log.debug("%s received for Output Named Pipe: %s, "
"ending thread"
% (str(exc.header['status']), self.name))
break
else:
raise exc
finally:
log.debug("Closing Output Named Pipe: %s" % self.name)
self.pipe.close(get_attributes=False)
log.debug("Output Named Pipe %s thread finished" % self.name)
# send any input if there was any
try:
if stdin and isinstance(stdin, bytes):
log.info("Sending stdin bytes over stdin pipe: %s"
% self._stdin_pipe_name)
stdin_pipe.write(stdin)
elif stdin:
log.info("Sending stdin generator bytes over stdin pipe: "
"%s" % self._stdin_pipe_name)
for stdin_data in stdin():
stdin_pipe.write(stdin_data)
except SMBResponseException as exc:
# if it fails with a STATUS_PIPE_BROKEN exception, continue as
# the actual error will be in the response (process failed)
if exc.status != NtStatus.STATUS_PIPE_BROKEN:
raise exc
log.warning("Failed to send data through stdin: %s" % str(exc))
# read the final response from the process
log.info("Reading result of PAExec process")
exe_result_raw = main_pipe.read(0, 1024)
log.info("Results read of PAExec process")
if not interactive and not asynchronous:
log.info("Closing PAExec std* pipes")
stdout_pipe.close()
stderr_pipe.close()
stdin_pipe.close()
log.info("Gettings stdout and stderr from pipe buffer queue")
stdout_out = stdout_pipe.get_output()
stderr_bytes = stderr_pipe.get_output()
sent_first = False
while True:
# keep on trying to get the pipe output until we receive a
# STATUS_PIPE_BROKEN
pending_id = None
try:
data = pipe.read(0, 255)
if not sent_first:
queue.put(None) # tells parent thread to read from main pipe
sent_first = True
queue.put(data)
except SMBResponseException as exc:
if not sent_first:
queue.put(None)
sent_first = True
if exc.status == NtStatus.STATUS_PENDING:
# need to poll the receive queue for the final message
pending_id = exc.message_id
elif exc.status == NtStatus.STATUS_PIPE_BROKEN:
break
else:
raise exc
if pending_id:
try:
a = pipe.connection.receive(pending_id)
except SMBResponseException as exc:
if exc.status == NtStatus.STATUS_PIPE_BROKEN:
break
else:
raise exc
req_data += b"\x00\x00\x00\x00"
res = self._invoke("REnumServicesStatusW", opnum, req_data)
# now send another request with the total buffer size sent
buffer_size = struct.unpack("
self.sent_first = True
try:
log.debug("Reading SMB Read response for Output Named "
"Pipe: %s" % self.name)
pipe_out = read_resp_func(request)
log.debug("Received SMB Read response for Output Named "
"Pipe: %s" % self.name)
self.handle_output(pipe_out)
except SMBResponseException as exc:
# if the error was the pipe was broken exit the loop
# otherwise the error is serious so throw it
close_errors = [
NtStatus.STATUS_PIPE_BROKEN,
NtStatus.STATUS_PIPE_CLOSING,
NtStatus.STATUS_PIPE_EMPTY,
NtStatus.STATUS_PIPE_DISCONNECTED
]
if exc.status in close_errors:
log.debug("%s received for Output Named Pipe: %s, "
"ending thread"
% (str(exc.header['status']), self.name))
break
else:
raise exc
finally:
log.debug("Closing Output Named Pipe: %s" % self.name)
self.pipe.close(get_attributes=False)
log.debug("Output Named Pipe %s thread finished" % self.name)
FileInformationClass.FILE_NAMES_INFORMATION,
send=False),
share.close(False, send=False)
]
query_reqs = self.connection.send_compound([x[0] for x in query_msgs],
self.session.session_id,
smb_tree.tree_connect_id,
related=True)
# receive response for open and close
query_msgs[0][1](query_reqs[0])
query_msgs[2][1](query_reqs[2])
try:
# receive the response for query_directory
files = query_msgs[1][1](query_reqs[1])
except SMBResponseException as exc:
if exc.status != NtStatus.STATUS_NO_SUCH_FILE:
raise exc
files = []
for file in files:
file_name = file['file_name'].get_value().decode('utf-16-le')
self._delete_file(smb_tree, file_name)
# STATUS_PIPE_BROKEN
pending_id = None
try:
data = pipe.read(0, 255)
if not sent_first:
queue.put(None) # tells parent thread to read from main pipe
sent_first = True
queue.put(data)
except SMBResponseException as exc:
if not sent_first:
queue.put(None)
sent_first = True
if exc.status == NtStatus.STATUS_PENDING:
# need to poll the receive queue for the final message
pending_id = exc.message_id
elif exc.status == NtStatus.STATUS_PIPE_BROKEN:
break
else:
raise exc
if pending_id:
try:
a = pipe.connection.receive(pending_id)
except SMBResponseException as exc:
if exc.status == NtStatus.STATUS_PIPE_BROKEN:
break
else:
raise exc
read_resp = SMB2ReadResponse()
read_resp.unpack(a['data'].get_value())
queue.put(read_resp['buffer'].get_value())