1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
|
#!/usr/bin/env python
# Impacket - Collection of Python classes for working with network protocols.
#
# Copyright Fortra, LLC and its affiliated companies
#
# All rights reserved.
#
# This software is provided under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Description:
# This script can be used in order to query & modify file timestamps - utilizing pure SMB.
# This is a PoC using my implementation of the `set_info` method in the `smb.py` file.
# The script mimics the syntax & logic to both the linux `touch` and `stat` binaries.
#
# Author:
# Raz Kissos (@covertivy)
#
from __future__ import division
from __future__ import print_function
from __future__ import annotations
import sys
import argparse
import logging
import ntpath
from typing import Tuple
from collections import namedtuple
from dataclasses import dataclass
from impacket.examples import logger
from impacket.examples.utils import parse_target
from impacket import version
from impacket import smbconnection
from impacket.nmb import SMB_SESSION_PORT
from impacket.smb import (
SMB_DIALECT,
FILE_READ_ATTRIBUTES,
FILE_WRITE_ATTRIBUTES,
FILE_SHARE_READ,
FILE_SHARE_WRITE,
FILE_SHARE_DELETE,
SMB_QUERY_FILE_BASIC_INFO,
SMB_SET_FILE_BASIC_INFO,
SMBQueryFileBasicInfo,
SMBSetFileBasicInfo,
)
from impacket.smb3structs import (
SMB2_FILE_BASIC_INFO,
FILE_BASIC_INFORMATION,
)
import argparse
import datetime
from impacket import smbconnection
from impacket.smb import SMB_DIALECT, FILE_READ_DATA, FILE_WRITE_DATA, FILE_WRITE_ATTRIBUTES, SMB_SET_FILE_BASIC_INFO, POSIXtoFT, FTtoPOSIX, SMBSetFileBasicInfo
from impacket.smb3 import FILE_BASIC_INFORMATION
from impacket.smb3structs import SMB2_DIALECT_311, SMB2_FILE_BASIC_INFO
FILETIME_READ_ACTION = 'stat'
FILETIME_WRITE_ACTION = 'touch'
VALID_FILETIME_ACTIONS = (FILETIME_READ_ACTION, FILETIME_WRITE_ACTION)
@dataclass
class FileTimes:
creation_time: int = None
last_access_time: int = None
last_write_time: int = None
change_time: int = None
def pretty_repr(self):
return """
CreationTime: {creation_time}
LastAccessTime: {last_access_time}
LastWriteTime: {last_write_time}
ChangeTime: {change_time}
""".format(
creation_time="N/A" if self.creation_time is None else datetime.datetime.fromtimestamp(FTtoPOSIX(self.creation_time)).isoformat(),
last_access_time="N/A" if self.last_access_time is None else datetime.datetime.fromtimestamp(FTtoPOSIX(self.last_access_time)).isoformat(),
last_write_time="N/A" if self.last_write_time is None else datetime.datetime.fromtimestamp(FTtoPOSIX(self.last_write_time)).isoformat(),
change_time="N/A" if self.change_time is None else datetime.datetime.fromtimestamp(FTtoPOSIX(self.change_time)).isoformat(),
)
def filetime_query(connection: smbconnection.SMBConnection, tid: int, fid: int) -> FileTimes:
if connection.getDialect() == SMB_DIALECT:
basicinfo = SMBQueryFileBasicInfo(connection.queryInfo(tid, fid, SMB_QUERY_FILE_BASIC_INFO))
else:
basicinfo = FILE_BASIC_INFORMATION(connection.queryInfo(tid, fid, SMB2_FILE_BASIC_INFO))
filetimes = FileTimes(
creation_time=basicinfo['CreationTime'],
last_access_time=basicinfo['LastAccessTime'],
last_write_time=basicinfo['LastWriteTime'],
change_time=basicinfo['ChangeTime'],
)
logging.debug(f"Got file / directory {filetimes = }")
return filetimes
def filetime_set(connection: smbconnection.SMBConnection, tid: int, fid: int, filetimes: FileTimes) -> None:
if connection.getDialect() == SMB_DIALECT:
info_data = SMBSetFileBasicInfo()
info_data['ExtFileAttributes'] = 0
fileInfoClass = SMB_SET_FILE_BASIC_INFO
else:
info_data = FILE_BASIC_INFORMATION()
info_data['FileAttributes'] = 0
fileInfoClass = SMB2_FILE_BASIC_INFO
info_data['CreationTime'] = filetimes.creation_time if filetimes.creation_time is not None else 0
info_data['LastAccessTime'] = filetimes.last_access_time if filetimes.last_access_time is not None else 0
info_data['LastWriteTime'] = filetimes.last_write_time if filetimes.last_write_time is not None else 0
info_data['ChangeTime'] = filetimes.change_time if filetimes.change_time is not None else 0
logging.debug(f"Setting file / directory filetimes = {filetimes}")
connection.setInfo(tid, fid, fileInfoClass, info_data)
def main():
# Init the example's logger theme
logger.init()
print(version.BANNER)
parser = argparse.ArgumentParser(add_help = True, description = "File / Directory Timestamp Querying & Modification Utility implementation.")
parser.add_argument('target', action='store', help='[[domain/]username[:password]@]<targetName or address>')
parser.add_argument("share", type=str, help="The share in which the desired file / directory to query or modify resides.")
parser.add_argument("path", type=str, help="The path of the desired file / directory whose timestamps we wish to query or modify.")
parser.add_argument('-debug', action='store_true', help='Turn DEBUG output ON')
group = parser.add_argument_group('authentication')
group.add_argument('-hashes', action="store", metavar="LMHASH:NTHASH", help='NTLM hashes, format is LMHASH:NTHASH')
group.add_argument('-no-pass', action="store_true", help='Don\'t ask for password (useful for -k)')
group.add_argument('-k', action="store_true", help='Use Kerberos authentication. Grabs credentials from ccache file '
'(KRB5CCNAME) based on target parameters. If valid credentials '
'cannot be found, it will use the ones specified in the command '
'line')
group.add_argument('-aesKey', action="store", metavar = "hex key", help='AES key to use for Kerberos Authentication '
'(128 or 256 bits)')
group = parser.add_argument_group('connection')
group.add_argument('-p', '--port', default=SMB_SESSION_PORT, type=int, metavar="destination port", help='Destination port to connect to the SMB Server.')
group.add_argument('-dc-ip', action='store', metavar="ip address",
help='IP Address of the domain controller. If omitted it will use the domain part (FQDN) specified in '
'the target parameter')
group.add_argument('-target-ip', action='store', metavar="ip address",
help='IP Address of the target machine. If omitted it will use whatever was specified as target. '
'This is useful when target is the NetBIOS name and you cannot resolve it')
group.add_argument('-t', '--timeout', default=60, type=int, metavar="seconds", help='Set connection timeout (seconds).')
subcommands = parser.add_subparsers(dest="action")
query_parser = subcommands.add_parser(FILETIME_READ_ACTION, description="Show current file / directory timestamps.")
touch_parser = subcommands.add_parser(FILETIME_WRITE_ACTION, description="Modify file / directory timestamps.")
touch_parser.add_argument('-c', '--create', action='store_true', help='Change the "CreationTime" of the file / directory.')
touch_parser.add_argument('-a', '--access', action='store_true', help='Change the "LastAccessTime" of the file / directory.')
touch_parser.add_argument('-w', '--write', action='store_true', help='Change the "LastWriteTime" of the file / directory.')
touch_parser.add_argument('-m', '--modify', action='store_true', help='Change the "ChangeTime" of the file / directory.')
touch_parser.add_argument('-r', '--reference', default=None, metavar=('<share>', '<path>'), nargs=2, help='Specify a file / directory to reference and copy the timestamps of (format is <share> <path>).')
touch_parser.add_argument('-t', '--timestamp', default=None, metavar="STAMP", help='Specify a timestamp to set for the selected filetimes (format: YYYY-MM-DD_HH:MM:SS.mmmmmm).')
touch_parser.add_argument('-v', '--validate', action='store_true', help='Query the file after touching to verify the changes.')
if len(sys.argv)==1:
parser.print_help()
sys.exit(1)
options = parser.parse_args()
if options.debug is True:
logging.getLogger().setLevel(logging.DEBUG)
# Print the Library's installation path
logging.debug(version.getInstallationPath())
else:
logging.getLogger().setLevel(logging.INFO)
if options.action not in VALID_FILETIME_ACTIONS:
logging.error("Invalid action '{action}'".format(action=options.action))
domain, username, password, address = parse_target(options.target)
if options.target_ip is None:
options.target_ip = address
if domain is None:
domain = ''
if password == '' and username != '' and options.hashes is None and options.no_pass is False and options.aesKey is None:
from getpass import getpass
password = getpass("Password:")
if options.aesKey is not None:
options.k = True
if options.hashes is not None:
lmhash, nthash = options.hashes.split(':')
else:
lmhash = ''
nthash = ''
share = options.share
path = ntpath.normpath(options.path)
if options.action == FILETIME_WRITE_ACTION:
if all((options.reference, options.timestamp)) or all((not options.reference, not options.timestamp)):
logging.error("Error! Must select one touch method! Either by reference or by timestamp!")
sys.exit(1)
if options.reference:
if len(options.reference) != 2:
logging.error("Error! Reference must be in the following format: <share> <path>!")
sys.exit(1)
else:
ref_share = options.reference[0]
ref_path = options.reference[1]
elif options.timestamp:
try:
touch_timestamp = datetime.datetime.fromisoformat(options.timestamp)
except Exception as exc:
logging.error("Error parsing timestamp, make sure it is valid ISO format!")
logging.debug(str(exc))
sys.exit(1)
try:
connection = smbconnection.SMBConnection(address, options.target_ip, sess_port=int(options.port), timeout=int(options.timeout))
if options.k is True:
connection.kerberosLogin(username, password, domain, lmhash, nthash, options.aesKey, options.dc_ip)
else:
connection.login(username, password, domain, lmhash, nthash)
if options.action == FILETIME_WRITE_ACTION:
if options.reference:
try:
ref_tid = connection.connectTree(ref_share)
ref_fid = connection.openFile(
ref_tid,
ref_path,
shareMode=FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, # Allow other processes to interact with the file / directory.
creationOption=0, # Open both a file or a directory without limitation.
desiredAccess=FILE_READ_ATTRIBUTES # Request only the permissions we need.
)
logging.debug(f"Querying Reference FileTimes from '{ref_path}' on share '{ref_share}'!")
new_filetimes = filetime_query(connection, ref_tid, ref_fid)
finally:
connection.closeFile(ref_tid, ref_fid)
connection.disconnectTree(ref_tid)
elif options.timestamp:
logging.debug(f"Got TimeStamp: '{options.timestamp}'!")
new_filetimes = FileTimes(
POSIXtoFT(touch_timestamp.timestamp()),
POSIXtoFT(touch_timestamp.timestamp()),
POSIXtoFT(touch_timestamp.timestamp()),
POSIXtoFT(touch_timestamp.timestamp()),
)
# Keep only desired filetime changes.
if not options.create:
new_filetimes.creation_time = None
if not options.access:
new_filetimes.last_access_time = None
if not options.write:
new_filetimes.last_write_time = None
if not options.modify:
new_filetimes.change_time = None
try:
tid = connection.connectTree(share)
if options.action == FILETIME_READ_ACTION:
desiredAccess = FILE_READ_ATTRIBUTES
elif options.action == FILETIME_WRITE_ACTION:
desiredAccess = FILE_WRITE_ATTRIBUTES
if options.validate:
desiredAccess |= FILE_READ_ATTRIBUTES
fid = connection.openFile(
tid,
path,
shareMode=FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, # Allow other processes to interact with the file / directory.
creationOption=0, # Open both a file or a directory without limitation.
desiredAccess=desiredAccess # Request only the permissions we need.
)
if options.action == FILETIME_READ_ACTION:
logging.info(f"Queried FileTimes for '{path}' on share '{share}'!")
print(filetime_query(connection, tid, fid).pretty_repr())
elif options.action == FILETIME_WRITE_ACTION:
logging.info(f"Changing FileTimes for '{path}' on share '{share}'!")
print(new_filetimes.pretty_repr())
filetime_set(connection, tid, fid, new_filetimes)
if options.validate:
logging.info(f"Validating Updated FileTimes for '{path}' on share '{share}'!")
print(filetime_query(connection, tid, fid).pretty_repr())
finally:
connection.closeFile(tid, fid)
connection.disconnectTree(tid)
connection.close()
except Exception as e:
if logging.getLogger().level == logging.DEBUG:
import traceback
traceback.print_exc()
logging.error(str(e))
if __name__ == "__main__":
main()
|
