o
    j                     @   sJ   d dl Z d dlZd dlmZ d dlmZ G dd dZG dd deZdS )    N)PackageDecryptor)LSA_UNICODE_STRINGc                   @   s,   e Zd Zdd Zdd Zdd Zdd Zd	S )
WdigestCredentialc                 C   s(   d| _ d | _d | _d | _d| _d | _d S )Nwdigest    credtypeusername
domainnamepasswordpassword_rawluidself r   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/alsadecryptor/packages/wdigest/decryptor.py__init__   s   
zWdigestCredential.__init__c                 C   sD   i }| j |d< | j|d< | j|d< | j|d< | j|d< | j|d< |S )Nr   r	   r
   r   r   r   r   r   tr   r   r   to_dict   s   





zWdigestCredential.to_dictc                 C   s   t |  S )N)jsondumpsr   r   r   r   r   to_json   s   zWdigestCredential.to_jsonc                 C   sJ   d| j  }|d| j 7 }|d| j 7 }|d| j 7 }|d| j  7 }|S )Nz	== WDIGEST [%x]==
z		username %s
z		domainname %s
z		password %s
z		password (hex)%s
)r   r	   r
   r   r   hexr   r   r   r   __str__!   s   
zWdigestCredential.__str__N)__name__
__module____qualname__r   r   r   r   r   r   r   r   r      s
    	r   c                       s4   e Zd Z fddZdd Zdd Zdd Z  ZS )	WdigestDecryptorc                    s"   t  d||| || _g | _d S )NWdigest)superr   decryptor_templatecredentials)r   readerr!   lsa_decryptorsysinfo	__class__r   r   r   *   s   
zWdigestDecryptor.__init__c                    sL   |  d| jjI d H }| j|| jj I d H }| j|I d H }||fS )Nzwdigest.dll)find_signaturer!   	signaturer#   get_ptr_with_offsetfirst_entry_offsetget_ptr)r   positionptr_entry_loc	ptr_entryr   r   r   find_first_entry/   s
   z!WdigestDecryptor.find_first_entryc                    s&  t  }|j|_| j|jj| jj I dH  t	| jI dH }t	| jI dH }t	| jI dH }|
| jI dH |_|
| jI dH |_|| jI dH |_|jddu rp| j|jdd\|_|_|jduro|j |_n
| |j\|_|_|jdkr|jdkr|jdu rdS | j| dS )z
		Changed the wdigest parsing, the struct only contains the pointers in the linked list, the actual data is read by 
		adding an offset to the current entry's position
		N$T)bytes_expected )r   r   r#   move
this_entryvaluer!   primary_offsetr   loadread_stringr	   r
   read_maxdataencrypted_passwordendswithdecrypt_passwordr   r   r   r"   append)r   wdigest_entrywcUserName
DomainNamePasswordr   r   r   	add_entry5   s&   
zWdigestDecryptor.add_entryc              
      s   z|   I d H \}}W n ty& } z| d|  W Y d }~d S d }~ww | j|I d H  | jj| jI d H }| || j	I d H  d S )Nz*Failed to find Wdigest structs! Reason: %s)
r0   	Exceptionlogr#   r4   r!   
list_entryr8   	walk_listrD   )r   entry_ptr_valueentry_ptr_loce	entry_ptrr   r   r   startR   s   zWdigestDecryptor.start)r   r   r   r   r0   rD   rM   __classcell__r   r   r&   r   r   )   s
    r   )ior   &pypykatz.alsadecryptor.package_commonsr   $pypykatz.alsadecryptor.win_datatypesr   r   r   r   r   r   r   <module>   s   