o
    Žõ±j!/  ã                   @   sŠ   d dl Z d dlZd dlZd dlZd dlZd dlZd dlmZ d dlmZ d dl	m
Z
 d dlmZ d dlmZ d dl	mZ G dd	„ d	ƒZdS )
é    N)Úlogger)Úpypykatz)ÚUniversalEncoder)ÚLogonSession)ÚMinidumpFile)ÚKatzSystemInfoc                   @   s<   e Zd Zdd„ Zdd„ Zdd„ Zdd„ Zd	d
„ Zdd„ ZdS )ÚLSACMDHelperc                 C   s   dg| _ dg| _d S )NÚlsa)Úlive_keywordsÚkeywords)Úself© r   ú’/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/lsadecryptor/cmdhelper.pyÚ__init__   s   zLSACMDHelper.__init__c                 C   sh  |j ddd}|jdddd |jdd	dd
d |jdddd |jdddd |jddddd |jdddgddd |jddg d¢dddd |j dd d}|jd!g d"¢d# |jd$d%d |jd&d'td(d) |jdddd |jdd	dd
d |jdddd |jdddd |jd*d+dd,d |jd-d.dd/d |jddddd |jddg d¢dddd d S )0Nr	   zGet all secrets from LSASS)Úhelpz--jsonÚ
store_truez Print credentials in JSON format)Úactionr   z-ez--halt-on-errorz*Stops parsing when a file cannot be parsedz-oz	--outfilez[Save results to file (you can specify --json for json file, or text format will be written)z-kz--kerberos-dirz%Save kerberos tickets to a directory.z-gz--grepz%Print credentials in greppable formatz--methodÚprocopenÚ	handledupzLSASS process access method)ÚchoicesÚdefaultr   z-pz
--packages)	ÚallÚmsvÚwdigestÚtspkgÚsspÚlivesspÚdpapiÚcloudapÚkerberosú+r   zLSASS package to parse)r   Únargsr   r   zGet secrets from memory dumpÚcmd)ÚminidumpÚrekallÚinfoÚzipdump)r   Ú
memoryfilezpath to the dump filez-tz--timestamp_overridez;enforces msv timestamp override (0=normal, 1=anti_mimikatz))Útyper   z-rz--recursivezRecursive parsingz-dz--directoryz Parse all dump files in a folder)Ú
add_parserÚadd_argumentÚint)r   ÚparserÚlive_parserÚ
live_groupÚgroupr   r   r   Úadd_args   s(   zLSACMDHelper.add_argsc                 C   sb   t | jƒdkr|j| jv r|  |¡ t | jƒdkr+|jdkr-|j| jv r/|  |¡ d S d S d S d S )Nr   Úlive)Úlenr   ÚcommandÚrunr
   ÚmoduleÚrun_live)r   Úargsr   r   r   Úexecute3   s
   
$ÿzLSACMDHelper.executec                 C   s  |j r(|jr(t|j dƒ}tj||tddd W d   ƒ n1 s!w   Y  né|j rw|jrwt|j dddd6}| d tj	¡d	 ¡ |D ] }|| j
D ]}|| j
|  ¡ D ]}| d |¡d	 ¡ qWqLqEW d   ƒ n1 spw   Y  nš|j rêt|j ddd
^}|D ]<}| d| ¡ || j
D ]}| dt|| j
| ƒ ¡ q“t|| jƒdkrÁ| d¡ || jD ]	}| t|ƒ¡ q·q…t|ƒdkrÙ| d¡ |D ]	}	| d|	 ¡ qÏW d   ƒ n1 sãw   Y  n'|jrúttj|tdddƒ n|jrot|dƒr|jd urtd dgtj	 ¡ƒ ntd tj	¡ƒ |D ]L}|| j
D ](}|| j
|  ¡ D ]}t|dƒrF|jd urF|g| }td |¡ƒ q3q(|| jD ]Ê}| ¡ }
|
d dkr›t|
d ƒdddddt| ¡ ƒt|
d ƒt|
d ƒ|
d g
}t|dƒr’|jd ur’|g| }td |¡ƒ qV|
d dkrç|
 dd ¡d urå|
d d uråt|
d ƒt|
d ƒt|
d ƒdddddt|
d ƒg	}t|dƒrÞ|jd urÞ|g| }td |¡ƒ qV| ¡ }
t|
d ƒdddddt|
d ƒt|
d ƒt|
d ƒdg
}t|dƒr|jd ur|g| }td |¡ƒ qV|| jD ]E\}}t|ƒd	 d	 t |j¡¡ }t | ¡ ¡ ¡ }|d dddddddd|g
}t|dƒra|jd ura|g| }td |¡d	 ƒ q&q n¢|D ]Š}td| ƒ t|| tƒr‰t|| ƒ qq|| j
D ]}tt|| j
| ƒƒ qŽt|| jƒdkrºtd ƒ || jD ]	}tt|ƒƒ q°t|| jƒdkrútd!ƒ || jD ],\}}t|ƒd	 d	 t |j¡¡ }t  |¡ t | ¡ ¡ ¡ }td"|d |f ƒ qÍqqt|ƒdkrtd#ƒ |D ]}	t|	ƒ q	|j!r‚t"j# $|j!¡}t %d$| ¡ |D ]^}	t& '|	¡}d%|t" (d¡ )¡ f }||	 j* +t"j# ||¡¡ ||	 j
D ]}||	 j
| j,D ]}|j-D ]}| .|¡ qXqSqI||	 jD ]}|j/d&kr~|j-D ]}| .|¡ quqjq%d S d S )'NÚwé   T)ÚclsÚindentÚ	sort_keysÚ Úreplace)ÚnewlineÚerrorsú:z
)rA   zFILE: ======== %s =======
Ú
r   z
== Orphaned credentials ==
z!
== Failed to parse these files:
z%s
Ú	directoryÚfilenameÚcredtyper   Údpapi_key_sha1Úkey_guidÚPRTr   ÚpasswordÚ
domainnameÚusernameÚ	masterkeyÚsha1_masterkeyÚ_exception_please_reportzFILE: ======== %s =======z== Orphaned credentials ==z== Errors ==z%s %sz
==== Parsing errors:zWriting kerberos tickets to %sz%s_%s.ccacher   )0ÚoutfileÚjsonÚopenÚdumpr   ÚgrepÚwriteÚjoinr   Úgrep_headerÚlogon_sessionsÚto_grep_rowsÚstrr2   Úorphaned_credsÚprintÚdumpsÚhasattrrD   Úto_dictÚget_masterkey_hexÚgetrA   Ú	tracebackÚ	format_tbÚ__traceback__Úbase64Ú	b64encodeÚencodeÚdecodeÚ
isinstancer   ÚdebugÚkerberos_dirÚosÚpathÚabspathr%   ÚntpathÚbasenameÚurandomÚhexÚkerberos_ccacheÚto_fileÚkerberos_credsÚticketsÚto_kirbirF   )r   ÚresultsÚfiles_with_errorr7   ÚfÚresultÚluidÚrowÚcredrE   ÚtÚxÚpkgÚerrÚerr_strÚdirÚbase_filenameÚccache_filenameÚkcredÚticketr   r   r   Úprocess_results:   sî   ÿ€ÿÿÿþ€
€
€ñ€

ý<
 6
€8

úæ"
€

ÿÿ
€ýôzLSACMDHelper.process_resultsc              
   C   s
  g }i }|j dkrƒd}zG|jd urd|jvr|j d¡ |jdkr)tj|jd}n|jdkr=tj|jd}|d u r=tdƒ‚||d< |j	d	krQt
|jƒd
krQtdƒ‚W n' tyy } z| |¡ |j	d	krf|‚tdƒ t ¡  	 W Y d }~nd }~ww |  |||¡ d S d S )Nr	   r1   r   Úkticketsr   ©Úpackagesr   z&HANDLEDUP failed to bring any results!Tr   úError in modules!z4Exception while dumping LSA credentials from memory.)r5   rk   rŒ   ÚappendÚmethodr   Úgo_liveÚgo_handledupÚ	ExceptionÚhalt_on_errorr2   rA   r\   rb   Ú	print_excr‰   )r   r7   ry   rx   rE   ÚmimiÚer   r   r   r6   ±   s8   


€

€ù	ézLSACMDHelper.run_livec                 C   sÔ  g }i }|j dkr*|jd urd|jvr|j d¡ tj|j|j|jd}||d< n·|j dkrs|jrQt	j
 |j¡}d}|jdkrIt	j
 |d|¡}nt	j
 ||¡}n|j}tj||jd	D ]}t |¡}	t |	¡}
td
||
f ƒ q\nn|j dkrw|jrt	j
 |j¡}dD ]‹}|jdkr–t	j
 |d|¡}nt	j
 ||¡}t d| ¡ tj||jd	D ]d}t d| ¡ z3|jd urÆd|jvrÆ|j d¡ tj||jd}|||< |jdkrçt|jƒdkrçt|jƒ tdƒ‚W q¬ ty } z| |¡ t d| ¡ |jdkr|‚	 W Y d }~q¬d }~ww q†nÎt d|j ¡ z4|jd ur.d|jvr.|j d¡ tj|j|jd}|||j< |jdkrNt|jƒdkrNtdƒ‚W n‘ tyv } zt d|j ¡ |jdkrh|‚t ¡  W Y d }~nod }~ww |j dkrát d|j ¡ z4|jd ur˜d|jvr˜|j d¡ tj|j|jd}|||j< |jdkr¸t|jƒdkr¸tdƒ‚W n' tyà } zt d|j ¡ |jdkrÒ|‚t ¡  W Y d }~nd }~ww |  |||¡ d S )Nr$   r   rŠ   r‹   r%   ú*.dmpTz**)Ú	recursivez[%s] %sr#   )r—   z*.DMPzParsing folder %szParsing file %sr   r   zError parsing file %s zError while parsing file %sr&   ) r"   rk   rŒ   rŽ   r   Úparse_memory_dump_rekallr'   Útimestamp_overriderD   rl   rm   rn   r˜   rV   Úglobr   Úparser   Úfrom_minidumpr\   r   r%   Úparse_minidump_filer“   r2   rA   r’   Ú	exceptionrb   r”   Úparse_zipdump_filer‰   )r   r7   ry   rx   r•   Údir_fullpathÚfile_patternÚglobdatarE   r#   Úsysinfor–   r   r   r   r4   Í   s¦   




ý

€
€úöù
€€û
€€ûzLSACMDHelper.runN)	Ú__name__Ú
__module__Ú__qualname__r   r0   r8   r‰   r6   r4   r   r   r   r   r      s    wr   )rl   rQ   r›   ro   rb   re   r   r   Úpypykatz.pypykatzÚpypykatz.commons.commonr   Ú,pypykatz.lsadecryptor.packages.msv.decryptorr   Úminidump.minidumpfiler   r   r   r   r   r   r   Ú<module>   s   