Yasso/cmd/winrm.go

package cmd

import (
	"Yasso/config"
	"fmt"
	"github.com/masterzen/winrm"
	"github.com/spf13/cobra"
	"io"
	"net"
	"os"
)

var WinRMCmd = &cobra.Command{
	Use: "winrm",
	Short: "winrm burst and extend tools (support proxy)",
	Run: func(cmd *cobra.Command, args []string) {
		if Hosts == "" && ConnHost == "" {
			_ = cmd.Help()
		}else{
			WinBurpByUser()
		}
	},
}

func init(){
	WinRMCmd.Flags().StringVar(&ConnHost,"hostname","","Open an interactive SSH at that address(brute param need false)")
	WinRMCmd.Flags().StringVar(&LoginUser,"user","","Login ssh username")
	WinRMCmd.Flags().StringVar(&LoginPass,"pass","","Login ssh password")
	WinRMCmd.Flags().BoolVar(&WinRMbool,"shell",false,"Get a cmd shell with WinRM")
	WinRMCmd.Flags().StringVarP(&SQLCommand,"cmd","c","","Execute system command")
}

func WinBurpByUser(){
	if BrutePort == 0 {
		BrutePort = 5985
	}
	var ips []string
	var err error
	if Hosts != "" {
		ips,err = ResolveIPS(Hosts)
		if err != nil {
			Println(fmt.Sprintf("resolve hosts address failed %v",err))
			return
		}
		if BruteFlag == true {
			users,pass := ReadTextToDic("rdp",UserDic,PassDic) // winrm 和 rdp认证相同
			Println(Clearln+"[*] Brute Module [winrm]")
			Println(fmt.Sprintf(Clearln + "[*] Have [user:%v] [pass:%v] [request:%v]",len(users),len(pass),len(users) * len(pass) * len(ips)))
			SwitchBurp("winrm",users,pass,ips,BrutePort,Runtime,TimeDuration,"")
		}else{
			Println(Clearln + "[*] May be you want to brute? try to add --crack")
		}
	}
	if Hosts == "" && ConnHost != "" && LoginUser != "" && LoginPass != ""{
		auth, b, err := WinRMAuth(config.HostIn{Host: ConnHost, Port: BrutePort, TimeOut: TimeDuration}, LoginUser, LoginPass)
		if err != nil {
			Println(fmt.Sprintf("[!] WinRM Auth Failed %v",err))
			return
		}
		if SQLCommand != "" && b == true{
			WinRMShell(auth,SQLCommand,false)
		}
		if WinRMbool == true && b== true {
			WinRMShell(auth,"",true)
		}
	}
}

func WinRMAuth(info config.HostIn,user,pass string)(*winrm.Client,bool,error){
	var err error
	params := winrm.DefaultParameters
	// 设置代理认证
	params.Dial = func(network, addr string) (net.Conn, error) {
		return GetConn(fmt.Sprintf("%s:%v",info.Host,info.Port),info.TimeOut)
	}
	// 设置输入
	endpoint := winrm.NewEndpoint("other-host",5985, false, false, nil, nil, nil, 0)
	client, err := winrm.NewClientWithParameters(endpoint, user, pass, params)
	stdout := os.Stdout
	res,err := client.Run("echo ISOK > nul", stdout, os.Stderr)
	if err != nil {
		return nil,false,err
	}
	if res == 0 && err == nil {
		return client,true,nil
	}
	return nil,false,err
}

func WinRMShell(client *winrm.Client,Command string,shell bool){
	if shell == true {
		shell, err := client.CreateShell()
		if err != nil {
			Println(fmt.Sprintf("[!] create shell failed %v",err))
			return
		}
		var cmd *winrm.Command
		cmd, err = shell.Execute("cmd.exe")
		if err != nil {
			Println(fmt.Sprintf("[!] create shell failed %v",err))
			return
		}

		go io.Copy(cmd.Stdin, os.Stdin)
		go io.Copy(os.Stdout, cmd.Stdout)
		go io.Copy(os.Stderr, cmd.Stderr)
		cmd.Wait()
		shell.Close()
	}else{
		_, err := client.Run(Command, os.Stdout, os.Stderr)
		if err != nil {
			Println(fmt.Sprintf("[!] Execute Command failed %v",err))
			return
		}
	}
}