o
    j]                     @   sr   d dl mZ d dlmZmZmZmZmZ d dlm	Z	 d dl
mZ d dlmZmZmZmZmZmZ G dd dZdS )	    )hashlib)RC4AESMODE_CBCexpand_DES_keyDES)logger)	SAMSecret)SAM_HASHDOMAIN_ACCOUNT_FSAM_KEY_DATASAM_KEY_DATA_AESUSER_ACCOUNT_VSAM_HASH_AESc                   @   sP   e Zd Zdd Zedd Zdd Zdd Zd	d
 Zdd Z	dd Z
dd ZdS )SAMc                 C   s"   || _ || _d | _d | _g | _d S )N)hivebootkeyhashed_bootkeymachine_sidsecrets)selfsam_hiver    r   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/registry/sam/asam.py__init__   s
   
zSAM.__init__c                 C   s   t | djdddd}|d |d |d |d	 |d |d |d g}|d	 |d |d |d |d	 |d |d g}tt|tt|fS )
N      littleFsignedr            )intto_bytesr   bytes)ridkeykey1key2r   r   r   
rid_to_key    s   ..zSAM.rid_to_keyc                    s   t |\}}t|}t|}t tr6t| jd d t|dj	dddd | 
 }t| j}	n2d}	t| jd d t jd}
d fdd	td
t jD D ]	}|	|
|7 }	qX|	d d }	||	d d ||	dd   }|S )Nr   r   r   Fr       IVc                    s   g | ]} j ||  qS r   )data.0ihashobjnr   r   
<listcomp>4   s    z$SAM.decrypt_hash.<locals>.<listcomp>r      )r   r*   r   
isinstancer
   r   md5r   r#   r$   digestr   encrypthashr   r   saltrangelenr.   decrypt)r   r&   r3   constantr(   r)   des1des2rc4keyr'   cipherblockdec_hashr   r2   r   decrypt_hash'   s   
2&$zSAM.decrypt_hashc                    sf  t d d}d}| jdI d H }|d }t dd|  t| t jt	rrt
 jj| | j |  }t| jj jj | _t
| jd d | | jd d  |  }|| jdd  krqt d tdn4t jtrd	| _t| jt jjd
}d fddtdt jjD D ]}|  j||7  _qt d| j   | jS )NzSAM parsing hashed bootkeys/   !@#$%^&*()qwertyUIOPAzxcvbnmQQQQQQQQQQQQ)(*@&% s)   0123456789012345678901234567890123456789 zSAM\Domains\Account\Fr    z[SAM] F key value: %sr   z,[SAM] HBootkey checksum verification failed!r+   r,   c                    s    g | ]} j j||  qS r   )key_0r.   r/   domain_propertiesr4   r   r   r5   U   s     z%SAM.get_HBoot_key.<locals>.<listcomp>r   z[SAM] HBootkey: %s)r   debugr   	get_valuelogr   
from_bytesr7   rH   r   r   r8   r<   r   r9   r   r:   r'   checksumr   error	Exceptionr   r   r   r=   r>   r.   r?   hex)r   QWERTYDIGITSFrc4_keyrO   rD   rE   r   rI   r   get_HBoot_key<   s0   

 .
(zSAM.get_HBoot_keyc              
      s   zM| j d ur| j W S | jdI d H }|d }|dd  }tj|d d ddd}tj|dd ddd}tj|dd	 ddd}d
d|||f | _ W | j S  tyj } zdd l}|  W Y d }~| j S d }~ww )NzSAM\Domains\Account\Vr    ir   r   Fr   r6      z%s-%s-%s-%szS-1-5-21r   )r   r   rL   r#   rN   rQ   	traceback	print_exc)r   uac_datap1p2p3erY   r   r   r   get_machine_sid[   s$   
zSAM.get_machine_sidc                    s  t d d}d}d}d}|  I d H  |  I d H  | jdI d H }|D ]}d }|dkr0q'd| }t d	|  | j|I d H }	|	d
 }	t|	}t	
|}
t	
|}|jrot|jtro|jjdkrn| ||j|}
n|jrt|jtr|jjdkr| ||j|}
|jrt|jtr|jjdkr| ||j|}n|jrt|jtr|jjdkr| ||j|}t|jt|d|
|}| j| q'| jS )NzSAM get_secrets invokeds   NTPASSWORD s   LMPASSWORD  31d6cfe0d16ae931b73c59d7e0c089c0 aad3b435b51404eeaad3b435b51404eezSAM\Domains\Account\UsersNameszSAM\Domains\Account\Users\%s\Vz![SAM] Parsing secrets for RID: %sr    r+   r   )r   rK   rW   r`   r   enum_keyrL   r   rN   r%   fromhexNT_hashr7   r   r.   rG   r
   r;   LM_hashr	   namer#   r   append)r   
NTPASSWORD
LMPASSWORD	NTDEFAULT	LMDEFAULTnamesr&   uackey_pathr[   nthashlmhashsecretr   r   r   get_secretsn   sJ   



zSAM.get_secretsc                 C   s8   i }| j |d< g |d< | jD ]}|d |  q|S )N	HBoot_keylocal_users)r   r   ri   to_dictr   trs   r   r   r   rw      s   

zSAM.to_dictc                 C   s6   d}|d| j   7 }| jD ]
}|d|  7 }q|S )Nz0============== SAM hive secrets ==============
zHBoot Key: %s
z%s
)r   rR   r   to_lopthrx   r   r   r   __str__   s
   
zSAM.__str__N)__name__
__module____qualname__r   staticmethodr*   rG   rW   r`   rt   rw   r{   r   r   r   r   r      s    
-r   N)	unicryptor   unicrypto.symmetricr   r   r   r   r   pypykatz.registryr   pypykatz.registry.sam.commonr	    pypykatz.registry.sam.structuresr
   r   r   r   r   r   r   r   r   r   r   <module>   s    