o
    j                     @   s   d dl mZ d dlmZ d dlmZ G dd dZG dd deZG dd	 d	eZ	G d
d deZ
G dd deZG dd deZG dd dZdS )    )md4)DPAPI_SYSTEM)hexdumpc                   @   s4   e Zd ZdddZedddZdd Zd	d
 ZdS )	LSASecretFc                 C   s   || _ || _|| _d S N)
raw_secretkey_namehistoryselfr   r   r	    r   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/registry/security/acommon.py__init__   s   
zLSASecret.__init__Nc                    s   |   }t|dkrd S |drd S |dr)t||||}| I d H  |S |dr:t|||}|  |S |drKt|||}|  |S |dr\t|||}|  |S |drpt||||j	d}|  |S t
|||}|S )	Nr   s     _SC_DEFAULTPASSWORDASPNET_WP_PASSWORDr   z$MACHINE.ACC)username)upperlen
startswithLSASecretServiceprocess_secretLSASecretDefaultPasswordLSASecretASPNETLSASecretDPAPILSASecretMachineAccountmachinenamer   )r   r   r	   system_hiveknlssr   r   r   process   s8   




	
zLSASecret.processc                 C   s"   d| j  d| j  d t| j S )Nz=== LSASecret %s ===
z
History: %sz
Secret: 
)r   r	   r   r   r   r   r   r   __str__9      "zLSASecret.__str__c                 C   s.   i }d|d< | j |d< | j|d< | j|d< |S )Nr   typer   r	   r   )r   r	   r   r   tr   r   r   to_dict<   s   


zLSASecret.to_dict)F)FN)__name__
__module____qualname__r   staticmethodr    r"   r'   r   r   r   r   r      s    
 r   c                   @   .   e Zd Zd
ddZdd Zdd Zdd	 ZdS )r   Nc                 C   s,   t | ||| || _d | _d | _d | _d S r   )r   r   r   servicer   secret)r   r   r   r	   r   r   r   r   r   E   
   
zLSASecretService.__init__c                    sl   z	| j d| _W n   | j  | _Y d S | j| _d| _| jd ur4| j| jdd  I d H | _d S d S )N	utf-16-leUNKNOWN   )	r   decoder.   hexr   r-   r   r   get_service_userr!   r   r   r   r   L   s   
"zLSASecretService.process_secretc                 C   s"   d| j | j| jf d t| j S )NzM=== LSA Service User Secret ===
History: %s
Service name: %s 
Username: %sz
)r	   r-   r   r   r.   r!   r   r   r   r"   Y   r#   zLSASecretService.__str__c                 C   B   i }d|d< | j |d< | j|d< | j|d< | j|d< | j|d< |S )Nr   r$   r   r	   r   r.   r-   )r   r	   r   r.   r-   r%   r   r   r   r'   \      




zLSASecretService.to_dictr   r(   r)   r*   r   r   r"   r'   r   r   r   r   r   D   s
    
r   c                   @   ,   e Zd Zdd Zdd Zdd Zdd Zd	S )
r   c                 C   s&   t | ||| d | _d | _d | _d S r   )r   r   r   domainr.   r
   r   r   r   r   h   s   
z!LSASecretDefaultPassword.__init__c                 C   s:   z| j d| _| jdd| _W n   Y d S d| _d S )Nr0     r1   )r   r3   r.   replacer   r!   r   r   r   r   n   s   
z'LSASecretDefaultPassword.process_secretc                 C      d| j | j| jf S )NzE=== LSA Default Password ===
History: %s
Username: %s
Password: %sr	   r   r.   r!   r   r   r   r"   y      z LSASecretDefaultPassword.__str__c                 C   r6   )Nr   r$   r   r	   r   r:   r.   )r   r	   r   r:   r.   r%   r   r   r   r'   |   r7   z LSASecretDefaultPassword.to_dictNr8   r   r   r   r   r   g   s
    r   c                   @   r9   )
r   c                 C   s    t | ||| d| _d | _d S )NASPNET)r   r   r   r.   r
   r   r   r   r         
zLSASecretASPNET.__init__c                 C   s"   z
| j d| _W d S    Y d S )Nr0   )r   r3   r.   r!   r   r   r   r      s   zLSASecretASPNET.process_secretc                 C   r>   )NzD=== LSA ASPNET Password ===
History: %s
Username: %s
Password: %sr?   r!   r   r   r   r"      r@   zLSASecretASPNET.__str__c                 C   8   i }d|d< | j |d< | j|d< | j|d< | j|d< |S )Nr   r$   r   r	   r   r.   )r   r	   r   r.   r%   r   r   r   r'         



zLSASecretASPNET.to_dictNr8   r   r   r   r   r      s
    r   c                   @   r,   )r   Nc                 C   s,   t | ||| || _d | _d | _|| _d S r   )r   r   r   r.   kerberos_passwordr   )r   r   r   r	   r   r   r   r   r      r/   z LSASecretMachineAccount.__init__c                 C   s0   t | j}| | _| jdddd| _d S )Nr0   r=   zutf-8)MD4r   digestr.   r3   encoderE   )r   ctxr   r   r   r      s   

z&LSASecretMachineAccount.process_secretc                 C   r6   )Nr   r$   r   r	   r   r.   rE   )r   r	   r   r.   rE   r%   r   r   r   r'      r7   zLSASecretMachineAccount.to_dictc                 C   s(   d| j | j| j | j | j f S )Nzv=== LSA Machine account password ===
History: %s
Username: %s
NT: %s
Password(hex): %s
Kerberos password(hex): %s)r	   r   r.   r4   r   rE   r!   r   r   r   r"      s   (zLSASecretMachineAccount.__str__r   r(   r)   r*   r   r   r'   r"   r   r   r   r   r      s
    
	
r   c                   @   r9   )
r   c                 C   s    t | ||| d | _d | _d S r   )r   r   machine_keyuser_keyr
   r   r   r   r      rB   zLSASecretDPAPI.__init__c                 C   s    t | j}|j| _|j| _d S r   )r   
from_bytesr   rK   rL   )r   dsr   r   r   r      s   zLSASecretDPAPI.process_secretc                 C   rC   )Nr   r$   r   r	   rK   rL   )r   r	   rK   rL   r%   r   r   r   r'      rD   zLSASecretDPAPI.to_dictc                 C   s   d| j | j | j f S )NzO=== LSA DPAPI secret ===
History: %s
Machine key (hex): %s
User key(hex): %s)r	   rK   r4   rL   r!   r   r   r   r"      s   zLSASecretDPAPI.__str__NrJ   r   r   r   r   r      s
    	r   c                   @   s8   e Zd ZdddZdd ZdddZd	d
 Zdd ZdS )LSADCCSecret (  Nc                 C   s(   || _ || _|| _|| _|| _|| _d S r   )versionr:   r   	iteration
hash_valuelast_write_ts)r   rQ   r:   r   rS   rR   rT   r   r   r   r      s   
zLSADCCSecret.__init__c                 C   sF   i }| j |d< | j|d< | j|d< | j|d< | j|d< |  |d< |S )NrQ   r:   r   rR   rS   	lastwrite)rQ   r:   r   rR   rS   get_lastwriter%   r   r   r   r'      s   




zLSADCCSecret.to_dictc                 C   s   | j d u r|S | j dS )Nz%Y-%m-%d %H:%M:%S)rT   strftime)r   defaultr   r   r   rV      s   
zLSADCCSecret.get_lastwritec                 C   s   |   S r   )to_lopthr!   r   r   r   r"      s   zLSADCCSecret.__str__c                 C   sN   | j dkrd| j| j| j | jf S d| j| j| d| j| j| j f S )N   z%s/%s:%s:%sz%s/%s:*%s*$DCC2$%s#%s#%sr<   )rQ   r:   r   rS   r4   rV   rR   r!   r   r   r   rY      s   
(zLSADCCSecret.to_lopth)rP   Nr   )r(   r)   r*   r   r'   rV   r"   rY   r   r   r   r   rO      s    


rO   N)unicrypto.hashlibr   rF    pypykatz.dpapi.structures.systemr   pypykatz.commons.commonr   r   r   r   r   r   r   rO   r   r   r   r   <module>   s   	2#