1
#!/usr/bin/env python
2
# Impacket - Collection of Python classes for working with network protocols.
3
#
4
# SECUREAUTH LABS. Copyright (C) 2022 SecureAuth Corporation. All rights reserved.
5
#
6
# This software is provided under a slightly modified version
7
# of the Apache Software License. See the accompanying LICENSE file
8
# for more information.
9
#
10
# Description:
11
#    This script is an alternative to smbpasswd tool and intended to be used
12
#    for changing passwords remotely over SMB (MSRPC-SAMR). It can perform the
13
#    password change when the current password is expired, and supports NTLM
14
#    hashes as a new password value instead of a plaintext value. As for the
15
#    latter approach the new password is flagged as expired after the change
16
#    due to how SamrChangePasswordUser function works.
17
#
18
#   Examples:
19
#      smbpasswd.py j.doe@192.168.1.11
20
#      smbpasswd.py contoso.local/j.doe@DC1 -hashes :fc525c9683e8fe067095ba2ddc971889
21
#      smbpasswd.py contoso.local/j.doe:'Passw0rd!'@DC1 -newpass 'N3wPassw0rd!'
22
#      smbpasswd.py contoso.local/j.doe:'Passw0rd!'@DC1 -newhashes :126502da14a98b58f2c319b81b3a49cb
23
#      smbpasswd.py contoso.local/j.doe:'Passw0rd!'@DC1 -newpass 'N3wPassw0rd!' -altuser administrator -altpass 'Adm1nPassw0rd!'
24
#      smbpasswd.py contoso.local/j.doe:'Passw0rd!'@DC1 -newhashes :126502da14a98b58f2c319b81b3a49cb -altuser CONTOSO/administrator -altpass 'Adm1nPassw0rd!' -admin
25
#      smbpasswd.py SRV01/administrator:'Passw0rd!'@10.10.13.37 -newhashes :126502da14a98b58f2c319b81b3a49cb -altuser CONTOSO/SrvAdm -althash 6fe945ead39a7a6a2091001d98a913ab
26
#
27
# Author:
28
#    @snovvcrash
29
#    @bransh
30
#    @alefburzmali
31
#
32
# References:
33
#    https://snovvcrash.github.io/2020/10/31/pretending-to-be-smbpasswd-with-impacket.html
34
#    https://www.n00py.io/2021/09/resetting-expired-passwords-remotely/
35
#    https://github.com/samba-team/samba/blob/master/source3/utils/smbpasswd.c
36
#    https://github.com/SecureAuthCorp/impacket/pull/381
37
#    https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-samr/acb3204a-da8b-478e-9139-1ea589edb880
38
#    https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-samr/9699d8ca-e1a4-433c-a8c3-d7bebeb01476
39
#    https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-samr/538222f7-1b89-4811-949a-0eac62e38dce
40
#
41

42
import sys
43
import logging
44
from getpass import getpass
45
from argparse import ArgumentParser
46

47
from impacket import version
48
from impacket.examples import logger
49
from impacket.examples.utils import parse_target
50
from impacket.dcerpc.v5 import transport, samr
51

52

53
class SMBPasswd:
54

55
  def __init__(self, address, domain='', username='', oldPassword='', newPassword='', oldPwdHashLM='', oldPwdHashNT='', newPwdHashLM='', newPwdHashNT=''):
56
    self.address = address
57
    self.domain = domain
58
    self.username = username
59
    self.oldPassword = oldPassword
60
    self.newPassword = newPassword
61
    self.oldPwdHashLM = oldPwdHashLM
62
    self.oldPwdHashNT = oldPwdHashNT
63
    self.newPwdHashLM = newPwdHashLM
64
    self.newPwdHashNT = newPwdHashNT
65
    self.dce = None
66

67
  def connect(self, domain='', username='', password='', nthash='', anonymous=False):
68
    rpctransport = transport.SMBTransport(self.address, filename=r'\samr')
69
    if anonymous:
70
      rpctransport.set_credentials(username='', password='', domain='', lmhash='', nthash='', aesKey='')
71
    elif username != '':
72
      lmhash = ''
73
      rpctransport.set_credentials(username, password, domain, lmhash, nthash, aesKey='')
74
    else:
75
      rpctransport.set_credentials(self.username, self.oldPassword, self.domain, self.oldPwdHashLM, self.oldPwdHashNT, aesKey='')
76

77
    self.dce = rpctransport.get_dce_rpc()
78
    self.dce.connect()
79
    self.dce.bind(samr.MSRPC_UUID_SAMR)
80

81
  def hSamrUnicodeChangePasswordUser2(self):
82
    try:
83
      resp = samr.hSamrUnicodeChangePasswordUser2(self.dce, '\x00', self.username, self.oldPassword, self.newPassword, self.oldPwdHashLM, self.oldPwdHashNT)
84
    except Exception as e:
85
      if 'STATUS_PASSWORD_RESTRICTION' in str(e):
86
        logging.critical('Some password update rule has been violated. For example, the password may not meet length criteria.')
87
      else:
88
        raise e
89
    else:
90
      if resp['ErrorCode'] == 0:
91
        logging.info('Password was changed successfully.')
92
      else:
93
        logging.error('Non-zero return code, something weird happened.')
94
        resp.dump()
95

96
  def hSamrChangePasswordUser(self):
97
    try:
98
      serverHandle = samr.hSamrConnect(self.dce, self.address + '\x00')['ServerHandle']
99
      domainSID = samr.hSamrLookupDomainInSamServer(self.dce, serverHandle, self.domain)['DomainId']
100
      domainHandle = samr.hSamrOpenDomain(self.dce, serverHandle, domainId=domainSID)['DomainHandle']
101
      userRID = samr.hSamrLookupNamesInDomain(self.dce, domainHandle, (self.username,))['RelativeIds']['Element'][0]
102
      userHandle = samr.hSamrOpenUser(self.dce, domainHandle, userId=userRID)['UserHandle']
103
    except Exception as e:
104
      if 'STATUS_NO_SUCH_DOMAIN' in str(e):
105
        logging.critical('Wrong realm. Try to set the domain name for the target user account explicitly in format DOMAIN/username.')
106
        return
107
      else:
108
        raise e
109

110
    try:
111
      resp = samr.hSamrChangePasswordUser(self.dce, userHandle, self.oldPassword, newPassword='', oldPwdHashNT=self.oldPwdHashNT,
112
                                                newPwdHashLM=self.newPwdHashLM, newPwdHashNT=self.newPwdHashNT)
113
    except Exception as e:
114
      if 'STATUS_PASSWORD_RESTRICTION' in str(e):
115
        logging.critical('Some password update rule has been violated. For example, the password history policy may prohibit the use of recent passwords.')
116
      else:
117
        raise e
118
    else:
119
      if resp['ErrorCode'] == 0:
120
        logging.info('NTLM hashes were changed successfully.')
121
      else:
122
        logging.error('Non-zero return code, something weird happened.')
123
        resp.dump()
124

125
  def hSamrSetInformationUser(self):
126
    try:
127
      serverHandle = samr.hSamrConnect(self.dce, self.address + '\x00')['ServerHandle']
128
      domainSID = samr.hSamrLookupDomainInSamServer(self.dce, serverHandle, self.domain)['DomainId']
129
      domainHandle = samr.hSamrOpenDomain(self.dce, serverHandle, domainId=domainSID)['DomainHandle']
130
      userRID = samr.hSamrLookupNamesInDomain(self.dce, domainHandle, (self.username,))['RelativeIds']['Element'][0]
131
      userHandle = samr.hSamrOpenUser(self.dce, domainHandle, userId=userRID)['UserHandle']
132
    except Exception as e:
133
      if 'STATUS_NO_SUCH_DOMAIN' in str(e):
134
        logging.critical('Wrong realm. Try to set the domain name for the target user account explicitly in format DOMAIN/username.')
135
        return
136
      else:
137
        raise e
138
    try:
139
      resp = samr.hSamrSetNTInternal1(self.dce, userHandle, self.newPassword, self.newPwdHashNT)
140
    except Exception as e:
141
      raise e
142
    else:
143
      if resp['ErrorCode'] == 0:
144
        logging.info('Credentials were injected into SAM successfully.')
145
      else:
146
        logging.error('Non-zero return code, something weird happened.')
147
        resp.dump()
148

149

150
def init_logger(options):
151
  logger.init(options.ts)
152
  if options.debug is True:
153
    logging.getLogger().setLevel(logging.DEBUG)
154
    logging.debug(version.getInstallationPath())
155
  else:
156
    logging.getLogger().setLevel(logging.INFO)
157

158

159
def parse_args():
160
  parser = ArgumentParser(description='Change password over SMB.')
161

162
  parser.add_argument('target', action='store', help='[[domain/]username[:password]@]<targetName or address>')
163
  parser.add_argument('-ts', action='store_true', help='adds timestamp to every logging output')
164
  parser.add_argument('-debug', action='store_true', help='turn DEBUG output ON')
165

166
  group = parser.add_mutually_exclusive_group()
167
  group.add_argument('-newpass', action='store', default=None, help='new SMB password')
168
  group.add_argument('-newhashes', action='store', default=None, metavar='LMHASH:NTHASH', help='new NTLM hashes, format is LMHASH:NTHASH '
169
                                                                           '(the user will be asked to change their password at next logon)')
170

171
  group = parser.add_argument_group('authentication')
172
  group.add_argument('-hashes', action='store', default=None, metavar='LMHASH:NTHASH', help='NTLM hashes, format is LMHASH:NTHASH')
173

174
  group = parser.add_argument_group('RPC authentication')
175
  group.add_argument('-altuser', action='store', default=None, help='alternative username')
176
  group.add_argument('-altpass', action='store', default=None, help='alternative password')
177
  group.add_argument('-althash', action='store', default=None, help='alternative NT hash')
178

179
  group = parser.add_argument_group('set credentials method')
180
  group.add_argument('-admin', action='store_true', help='injects credentials into SAM (requires admin\'s priveleges on a machine, '
181
                   'but can bypass password history policy)')
182

183
  return parser.parse_args()
184

185

186
if __name__ == '__main__':
187
  print(version.BANNER)
188

189
  options = parse_args()
190
  init_logger(options)
191

192
  domain, username, oldPassword, address = parse_target(options.target)
193

194
  if domain is None:
195
    domain = 'Builtin'
196

197
  if options.hashes is not None:
198
    try:
199
      oldPwdHashLM, oldPwdHashNT = options.hashes.split(':')
200
    except ValueError:
201
      logging.critical('Wrong hashes string format. For more information run with --help option.')
202
      sys.exit(1)
203
  else:
204
    oldPwdHashLM = ''
205
    oldPwdHashNT = ''
206

207
  if oldPassword == '' and oldPwdHashNT == '' and not options.admin:
208
    oldPassword = getpass('Current SMB password: ')
209

210
  if options.newhashes is not None:
211
    try:
212
      newPwdHashLM, newPwdHashNT = options.newhashes.split(':')
213
    except ValueError:
214
      logging.critical('Wrong new hashes string format. For more information run with --help option.')
215
      sys.exit(1)
216
    newPassword = ''
217
  else:
218
    newPwdHashLM = ''
219
    newPwdHashNT = ''
220
    if options.newpass is None:
221
      newPassword = getpass('New SMB password: ')
222
      if newPassword != getpass('Retype new SMB password: '):
223
        logging.critical('Passwords do not match, try again.')
224
        sys.exit(1)
225
    else:
226
      newPassword = options.newpass
227

228
  smbpasswd = SMBPasswd(address, domain, username, oldPassword, newPassword, oldPwdHashLM, oldPwdHashNT, newPwdHashLM, newPwdHashNT)
229

230
  if options.altuser is not None:
231
    try:
232
      altDomain, altUsername = options.altuser.split('/')
233
    except ValueError:
234
      altDomain = domain
235
      altUsername = options.altuser
236

237
    if options.altpass is not None and options.althash is None:
238
      altPassword = options.altpass
239
      altNTHash = ''
240
    elif options.altpass is None and options.althash is not None:
241
      altPassword = ''
242
      altNTHash = options.althash
243
    elif options.altpass is None and options.althash is None:
244
      logging.critical('Please, provide either alternative password or NT hash for RPC authentication.')
245
      sys.exit(1)
246
    else:  # if options.altpass is not None and options.althash is not None
247
      logging.critical('Argument -altpass not allowed with argument -althash.')
248
      sys.exit(1)
249
  else:
250
    altUsername = ''
251

252
  try:
253
    if altUsername == '':
254
      smbpasswd.connect()
255
    else:
256
      logging.debug('Using {}\\{} credentials to connect to RPC.'.format(altDomain, altUsername))
257
      smbpasswd.connect(altDomain, altUsername, altPassword, altNTHash)
258
  except Exception as e:
259
    if any(msg in str(e) for msg in ['STATUS_PASSWORD_MUST_CHANGE', 'STATUS_PASSWORD_EXPIRED']):
260
      if newPassword:
261
        logging.warning('Password is expired, trying to bind with a null session.')
262
        smbpasswd.connect(anonymous=True)
263
      else:
264
        logging.critical('Cannot set new NTLM hashes when current password is expired. Provide a plaintext value for the new password.')
265
        sys.exit(1)
266
    elif 'STATUS_LOGON_FAILURE' in str(e):
267
      logging.critical('Authentication failure.')
268
      sys.exit(1)
269
    else:
270
      raise e
271

272
  if options.admin:
273
    # Inject credentials into SAM (requires admin's privileges)
274
    smbpasswd.hSamrSetInformationUser()
275
  else:
276
    if newPassword:
277
      # If using a plaintext value for the new password
278
      smbpasswd.hSamrUnicodeChangePasswordUser2()
279
    else:
280
      # If using NTLM hashes for the new password
281
      smbpasswd.hSamrChangePasswordUser()