o
    jD                     @   s   d dl Z d dlZd dlZd dlmZmZmZmZmZm	Z	 d dl
mZ d dlmZ d dlmZmZ d dlmZ G dd dZG d	d
 d
ZG dd dZG dd deZdS )    N)WindowsBuildWindowsMinBuildKatzSystemArchitectureAGenericReaderUniversalEncoderhexdump)filetime_to_dt)%MSV1_0_PRIMARY_CREDENTIAL_STRANGE_DEC)KIWI_CREDMAN_LIST_STARTERKIWI_CREDMAN_SET_LIST_ENTRY)PackageDecryptorc                   @   ,   e Zd Zdd Zdd Zdd Zdd Zd	S )
MsvCredentialc                 C   s4   d| _ d | _d | _d | _d | _d | _d | _d | _d S )Nmsv)credtypeusername
domainnameNThashLMHashSHAHashDPAPIisoProtself r   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/alsadecryptor/packages/msv/decryptor.py__init__   s   
zMsvCredential.__init__c                 C   D   i }| j |d< | j|d< | j|d< | j|d< | j|d< | j|d< |S )Nr   r   r   r   r   r   )r   r   r   r   r   r   r   tr   r   r   to_dict   s   





zMsvCredential.to_dictc                 C      t j|  tdS N)clsjsondumpsr    r   r   r   r   r   to_json&      zMsvCredential.to_jsonc                 C   s   d}|d| j r
| j nd 7 }|d| jr| jnd 7 }|d| jr$| j nd 7 }|d| jr2| j nd 7 }|d| jr@| j nd 7 }|d| jrN| j nd 7 }|S )	Nz	== MSV ==
z		Username: %s
NAz		Domain: %s
z			LM: %s
z			NT: %s
z		SHA1: %s
z		DPAPI: %s
)r   r   r   hexr   r   r   r   r   r   r   __str__)   s   zMsvCredential.__str__N__name__
__module____qualname__r   r    r'   r+   r   r   r   r   r      s
    r   c                   @   r   )
CredmanCredentialc                 C   s(   d| _ d | _d | _d | _d| _d | _d S )Ncredman    )r   luidr   passwordpassword_rawr   r   r   r   r   r   4   s   
zCredmanCredential.__init__c                 C   r   )Nr   r   r   r4   r5   r3   )r   r   r   r4   r5   r3   r   r   r   r   r    <   s   





zCredmanCredential.to_dictc                 C   s   t |  S N)r%   r&   r    r   r   r   r   r'   F   s   zCredmanCredential.to_jsonc                 C   sX   d| j  }|d| j  7 }|d| j 7 }|d| j 7 }|d| j 7 }|d| j  7 }|S )Nz	== CREDMAN [%x]==
z
		luid %s
z		username %s
z		domain %s
z		password %s
z		password (hex)%s
)r3   r   r   r4   r5   r*   r   r   r   r   r+   I   s   
zCredmanCredential.__str__Nr,   r   r   r   r   r0   3   s
    
r0   c                   @   sP   e Zd Zg dZdd Zedd Zdd Zdd	 Zd
d Z	dd Z
dd ZdS )LogonSession)
packagenamedomainuserNTLMSHA1	masterkeysha1_masterkeykey_guid	plaintextc                 C   sj   d | _ d | _d | _d | _d | _d | _d | _d | _g | _g | _	g | _
g | _g | _g | _g | _g | _g | _d S r6   )authentication_id
session_idr   r   logon_server
logon_timesidr3   	msv_credswdigest_creds	ssp_credslivessp_credsdpapi_credskerberos_credscredman_credstspkg_credscloudap_credsr   r   r   r   r   V   s"   
zLogonSession.__init__c              
      s   zKt  }| j|_| j|_| j|I dH |_| j|I dH |_	| j
|I dH |_| jdkr8t| j |_| j|I dH }t||_| j|_|W S  tyj } zddl}|  t  W Y d}~dS d}~ww )zA
		Converts KIWI_MSV1_0_LIST type objects into a unified class
		Nr   )r7   LocallyUniqueIdentifierrB   SessionrC   UserNameread_stringr   Domainer   LogonServerrD   	LogonTimer   	isoformatrE   pSidreadstrrF   r3   	Exception	traceback	print_excinput)entryreaderlsctser\   r   r   r   parsej   s(   

zLogonSession.parsec                 C   s  i }| j |d< | j|d< | j|d< | j|d< | j|d< | j|d< | j|d< | j|d< g |d	< g |d
< g |d< g |d< g |d< g |d< g |d< g |d< g |d< | jD ]}|d	 	|
  qQ| jD ]}|d
 	|
  q`| jD ]}|d 	|
  qo| jD ]}|d 	|
  q~| jD ]}|d 	|
  q| jD ]}|d 	|
  q| jD ]}|d 	|
  q| jD ]}|d 	|
  q| jD ]}|d 	|
  q|S )NrB   rC   r   r   rD   rE   rF   r3   rG   rH   rI   rJ   rK   rL   rM   rN   rO   )rB   rC   r   r   rD   rE   rF   r3   rG   appendr    rH   rI   rJ   rK   rL   rM   rN   rO   r   r   credr   r   r   r       sJ   
















zLogonSession.to_dictc                 C   r!   r"   r$   r   r   r   r   r'      r(   zLogonSession.to_jsonc                 C   s  d}|d| j | j f 7 }|d| j 7 }|d| j 7 }|d| j 7 }|d| j 7 }|d| j 7 }|d| j 7 }|d	| j 7 }t| j	d
krR| j	D ]
}|dt
| 7 }qGt| jd
kre| jD ]}|t
|7 }q\t| jd
krx| jD ]}|t
|7 }qot| jd
kr| jD ]}|t
|7 }qt| jd
kr| jD ]}|t
|7 }qt| jd
kr| jD ]}|t
|7 }qt| jd
kr| jD ]}|t
|7 }qt| jd
kr| jD ]}|t
|7 }qt| jd
kr| jD ]}|t
|7 }qt| jd
kr| jD ]}|t
|7 }q|S )Nz== LogonSession ==
zauthentication_id %s (%x)
zsession_id %s
zusername %s
zdomainname %s
zlogon_server %s
zlogon_time %s
zsid %s
zluid %s
r   z%s)rB   rC   r   r   rD   rE   rF   r3   lenrG   rZ   rH   rI   rJ   rL   rM   rN   rK   rO   rf   r   r   r   r+      sP   









zLogonSession.__str__c                 c   s   | j D ]Z}| }| jd| j| jdd| j| jd|d r"|d  ndg
V  | jd| j| jdd| j| jd|d r>|d  ndg
V  | jd| j| jdd| j| jd|d rZ|d  ndg
V  q| jD ]}| }| j|d	 | j| j|d	 d| j| jd
|d g
V  qb| j	D ]}| }| j|d	 | j| j|d	 d| j| jd
|d g
V  q| j
D ]}| }| j|d	 | j| j|d	 d| j| jd
|d g
V  q| jD ]6}| }| j|d	 | j| j|d	 d| j| jd|d g
V  | j|d	 | j| j|d	 d| j| jd|d g
V  q| jD ]}| }| j|d	 | j| j|d	 d| j| jd
|d g
V  q| jD ]}| }| j|d	 | j| j|d	 d| j| jd
|d g
V  q%| jD ]}| }| j|d	 | j| j|d	 d| j| jd
|d g
V  qH| jD ]U}| }| j|d	 | j| j|d	 d| j| jdt| g
V  | j|d	 | j| j|d	 d| j| jdt|d g
V  | j|d	 | j| j|d	 d| j| jdt|d g
V  qkd S )Nr    r;   r   r<   r   sha1r   r   rA   r4   r>   r?   dpapi_key_sha1PRT)rG   r    r3   rC   rF   r   r   r*   rH   rI   rJ   rK   rL   rM   rN   rO   rZ   get_masterkey_hex)r   rg   r   r   r   r   to_row   sD   
88:
2
2
2
02
4
4
4
448zLogonSession.to_rowc                 c   sN   | j D ]3}| }d| j| j|d r|d  nd|d r$|d  nd|d r/|d  ndddddg
V  q| j| j| j| j| j	fD ].}|D ])}| }|d d urqt
|d t
|d t
|d	 ddddddt
|d g
V  qHqD| jD ]\}| }|d d us|d
 d urd}|d
 d urd|d
  }t
|d t
|d t
|d	 dddddd|g
V  |d d urt
|d t
|d t
|d	 ddddddt
|d g
V  qv| jD ]#}| }t
|d dddddt
|d t
|d t
|d dg
V  q| jD ]'}| }t
|d dddddt
| t
|d t
|d t
|d g
V  qd S )Nr   r   ri   r   r   r4   r   r   r   pinz[PIN]%sr>   r?   r@   rk   rl   )rG   r    r   r   r*   rH   rI   rJ   rM   rN   rZ   rL   rK   rO   rm   )r   rg   r   packagero   r   r   r   to_grep_rows   sL   
:
2:
<
DzLogonSession.to_grep_rowsN)r-   r.   r/   grep_headerr   staticmethodrd   r    r'   r+   rn   rq   r   r   r   r   r7   S   s    
'*#r7   c                       sT   e Zd Z fddZdd Zdd Zdd Zd	d
 Zdd Zdd Z	dd Z
  ZS )MsvDecryptorc                    s@   t  d||| || _|| _g | _i | _i | _d | _d | _d S )NMsv)	superr   decryptor_templatecredman_decryptor_templateentriesentries_seenlogon_sessionslogon_session_countcurrent_logonsession)r   r`   rw   lsa_decryptorcredman_templatesysinfo	__class__r   r   r   %  s   
zMsvDecryptor.__init__c                    sH  |  d| jjI d H }d| _| jjtjkr^| jjt	j
jks6tj
j| jj  kr.tjjk r^n n.| jjdkr^| j|| jj I d H }| j|I d H  | jdI d H }tj|ddd| _d}| jjdkr|| jj }| j|I d H  | jdI d H }tj|d	dd}| j|| jj I d H }||7 }| j|I d H }||fS )
Nz
lsasrv.dll   i   `bigF)	byteordersignedr      little)find_signaturerw   	signaturer|   r   architecturer   X64buildnumberr   WIN_8valuer   WIN_BLUEmsv_dll_timestampr`   get_ptr_with_offsetoffset2moverY   int
from_bytesfirst_entry_offset_correctionfirst_entry_offsetget_ptr)r   positionptr_entry_locr   additional_offset	offsetpos	ptr_entryr   r   r   find_first_entry0  s&   @zMsvDecryptor.find_first_entryc                    sv   t || jI d H | _|jjdkr| |I d H  |jjdkr,| |j| j	I d H  n| 
d | j| j| jj< d S )Nr   z!No credentials in this structure!)r7   rd   r`   r}   CredentialManagerr   parse_credman_credentialsCredentials_list_ptr	walk_listadd_credentialslogr{   r3   )r   r_   r   r   r   	add_entryI  s   
zMsvDecryptor.add_entryc                    s   |  |j| jI d H  d S r6   )r   PrimaryCredentials_ptradd_primary_credentials)r   primary_credentials_list_entryr   r   r   r   U  s
   zMsvDecryptor.add_credentialsc                    s   |  |jjdI d H  |jj| jtdI d H }|  |jjdI d H  |jj| jtdI d H }|jj|jj	krH| j
|j| j| jjdI d H  d S d S )Nr   )override_finaltyper
   )override_ptr)log_ptrr   r   rY   r`   r   list1r
   startlocationr   add_credman_credentialrx   
list_entry)r   logon_sessioncredman_set_list_entrylist_starterr   r   r   r   [  s   "z&MsvDecryptor.parse_credman_credentialsc                    s   t  }|j| jI d H |_|j| jI d H |_|jrV|jdkrV|j	| j|jI d H }|j
ddu rM| j|dd\|_|_|jd urL|j |_n	| |\|_|_| jj|_| jj| d S )Nr   $Tbytes_expected)r0   r:   rS   r`   r   server2r   cbEncPasswordencPasswordread_rawendswithdecrypt_passwordr4   r5   r*   r}   r3   rM   re   )r   credman_credential_entrycenc_datar   r   r   r   c  s   

z#MsvDecryptor.add_credman_credentialc           	   
      s  |j | jI d H }|sd S | dt|  | d | j|dd\}}| d| jjjt|f  t	|| j
j}t|tjkrS|dd dkrSt|I d H }n
| jj|I d H }t }|jrz|j|I d H |_W n ty } z| d	t|  W Y d }~nd }~ww |jrz|j|I d H |_W n ty } z| d
t|  W Y d }~nd }~ww t|dr|jdkr|j|_t|drt|j|_|j|_|j r|j dkr|j |_!|j"|_#| j$j%&| d S )NzEncrypted credential data 
%szDecrypting credential structureTr   z%s: 
%sr      s   z#Failed to get username, reason : %sz%Failed to get domainname, reason : %sDPAPIProtecteds                   isIso)'encrypted_credentials	read_datar`   r   r   r   rw   decrypted_credential_structr-   r   r   r   rh   r	   sizeloadr   rR   rS   r   r[   rZ   LogonDomainNamer   hasattrr   r   boolr   r   NtOwfPasswordr   LmOwfPasswordr   ShaOwPasswordr   r}   rG   re   )	r   primary_credentials_entryencrypted_credential_datadec_dataraw_decstruct_readercreds_structrg   rc   r   r   r   r   w  sH   

z$MsvDecryptor.add_primary_credentialsc                    s   |   I d H \}}t| jD ]8}| j|I d H  t|d D ]
}| j I d H  q | jj| jI d H }|j	|j
kr=q| || jI d H  qd S )N   )r   ranger|   r`   r   read_intrw   r   r   r   r   r   r   )r   entry_ptr_valueentry_ptr_loci_	entry_ptrr   r   r   r     s   zMsvDecryptor.start)r-   r.   r/   r   r   r   r   r   r   r   r   __classcell__r   r   r   r   rt   $  s    ;rt   )ior%   base64pypykatz.commons.commonr   r   r   r   r   r   pypykatz.commons.filetimer   -pypykatz.alsadecryptor.packages.msv.templatesr	   1pypykatz.alsadecryptor.packages.credman.templatesr
   r   &pypykatz.alsadecryptor.package_commonsr   r   r0   r7   rt   r   r   r   r   <module>   s    $  R