o
    j#                     @   s   d dl mZ d dl mZ d dlmZmZmZmZmZ d dl	Z	d dl
mZmZmZmZ d dlmZmZ d dlmZ G dd	 d	ZdS )
    )hashlib)hmac)RC4AESMODE_CBCDESexpand_DES_keyN)
LSA_SECRETLSA_SECRET_BLOBLSA_SECRET_XP	NL_RECORD)LSADCCSecret	LSASecret)loggerc                   @   sl   e Zd ZdddZedddZdd Zd	d
 Zdd Zdd Z	dd Z
dd Zdd Zdd Zdd ZdS )SECURITYNc                 C   s:   || _ || _|| _d| _d| _d | _d | _g | _g | _d S )N (  T)	hivesystem_hivebootkeydcc_iteration_countlsa_secret_key_vista_typelsa_keyNKLM_key
dcc_hashescached_secrets)selfsecurity_hiver   r    r   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/registry/security/security.py__init__   s   
zSECURITY.__init__  c                 C   s*   t | }t|D ]}|| q	| S N)r   sha256rangeupdatedigest)keyvalueroundsctx_r   r   r   sha256_multi&   s   
zSECURITY.sha256_multic                    s:  t d | jdu rdt|t| jjd d }d}t	|}d  fddt
dtjdd   D D ]}t| k rJ|d	 t|  7 }|||7 }q8t|jd
d  d d | _n,t| j}t
dD ]}||dd  qnt| }||dd dd | _t d| j   | jS )Nz [SECURITY] Decrypting LSA key...T           c                    &   g | ]}j d d ||   qS r,   Ndata.0inrecordr   r   
<listcomp>5      & z,SECURITY.decrypt_lsa_key.<locals>.<listcomp>r       4   r    <   L      z[SECURITY] LSA key value: %s)r   debugr   r	   
from_bytesr   r+   r   r2   r   r#   lendecryptr
   secretr   r   md5r$   r   r%   hex)r   r2   r&   
secret_deccipherblockr)   r5   r   r6   r   decrypt_lsa_key-   s*   


.
zSECURITY.decrypt_lsa_keyc                 C   s^   t d | jdd}|d u r(| jdd}|s t d d S d| _t d | |d S )Nz[SECURITY] Fetching LSA key...zPolicy\PolEKList\defaultFz%Policy\PolSecretEncryptionKey\defaultz[SECURITY] LSA key not found!z,[SECURITY] LSA secrets default to VISTA type   )r   r@   r   	get_valuer   rJ   )r   r'   r   r   r   get_lsa_keyI   s   


zSECURITY.get_lsa_keyc                 C   s   d}t j|d d ddd}|t|| d  }|}tdt|dD ]5}|d d }t|d d }t|}	||	|7 }|dd  }|dd  }t|dk rW|t|d  }q"t|}
|
jS )	Nr-      littleF)signedr         )	intrA   rB   r#   r   r   rC   r   rD   )r   r&   r'   dec_blobenc_sizet_keyr*   enc_blobdes_keyr)   rD   r   r   r   decrypt_secretX   s    
zSECURITY.decrypt_secretc                    s  t d | jd u r|   | jd}|d u r!t d td| jdu rud| _	t
|d t| jjd d }t|}d	  fd
dtdtjdd   D D ]}t| k ri|dd	t|  7 }|  j	||7  _	qWn
| | j|d | _	t d| j	   | j	S )Nz [SECURITY] Fetching NK$LM key...z$Policy\Secrets\NL$KM\CurrVal\defaultz+[SECURITY] Could not find NL$KM in registryz#Could not find NL$KM in registry :(Tr-   rK   r,   r.   c                    r/   r0   r1   r3   r6   r   r   r9   z   r:   z)SECURITY.get_NKLM_key.<locals>.<listcomp>r   r;   z[SECURITY] NL$KM key: %s)r   r@   r   rM   r   rL   error	Exceptionr   r   r	   rA   r   r+   r2   r   r#   rB   rC   rY   rF   )r   r'   r&   rH   rI   r   r6   r   get_NKLM_keyj   s*   



.zSECURITY.get_NKLM_keyc                 C   s   |d@ dkr||d@  S |S )N   r   r   )r   r2   r   r   r   __pad   s   zSECURITY.__padc              	      sp  t d | jdd}|d u rt d d S | j|}|g kr(t d d S d|v r1|d d|v rVt d |d | jdd	 d
krQd@ | _nd | _|   | 	  |D ]}t d|  | jd|
  d	 }t|jdkr4jd	@ d	kr| jdu rd}t| jdd tjd}d  fddtdtj D D ]}t|dk r|ddt|  7 }|||7 }qntj| jjdd }t|}|j}nt d|  q`|d d }	t|dd  }
|
j
d}|
|  j|  j!  |
j"
d}| jdu r dnd	}t#||||	| jj$d}| j%&| q`| j%S ) Nz[SECURITY] dump_dcc invokedCacheFz[SECURITY] No DCC secrets found
   NL$Controls   NL$IterationCountz&[SECURITY] DCC Setting iteration countzCache\NL$IterationCountrK   r   l    | i   z![SECURITY] DCC Checking value: %szCache\%ss                   Tr-   r.   r,   )IVc                    s   g | ]}j ||   qS r   )EncryptedDatar3   r6   r   r   r9      s    z%SECURITY.dump_dcc.<locals>.<listcomp>r   r;   rE   )	digestmodz0[SECURITY] DCC Skipping value %s, unknown formetH   z	utf-16-le   )	iterationlast_write_ts)'r   r@   r   find_keylist_valuesremoverL   r   rM   r\   decoder   rA   ra   Flagsr   r   r   r   r#   rB   rb   rC   r   newr%   r   ioBytesIOread
UserLengthseek_SECURITY__padDomainNameLengthDnsDomainNameLengthr   	LastWriter   append)r   	cache_regvaluesr'   record_data	plaintextrH   rI   r&   dcc_hashblobusernamedomainversionrD   r   r6   r   dump_dcc   sd   








&zSECURITY.dump_dccc              	      s  t d |   |   | jd}|d u rt d d S d|v r'|d |D ]}dD ]}d||}t d|  | j|d}|r|d	 d
krt 	d	d||d	 f  | j
du rt|d	 t| jjd d }d}t|}d  fddtd
tjdd   D D ]}	t|	 k r|	d t|	  7 }	|||	7 }qt|j}
n	| | j|d	 }
t||
|dk| j}|d ur| j| q-t d|  q-q)d S )Nz[SECURITY] get_secretszPolicy\Secretsz*[SECURITY] No cached secrets found in hiver`   )CurrValOldValzPolicy\Secrets\{}\{}\defaultz [SECURITY] Parsing secrets in %sFrK   r   z[SECURITY] Key %s Value %sTr,   r-   r.   c                    r/   r0   r1   r3   r6   r   r   r9      r:   z(SECURITY.get_secrets.<locals>.<listcomp>r;   r   z'[SECURITY] Could not open %s, skipping!)r   r@   rM   r   r   enum_keyrj   formatrL   logr   r	   rA   r   r+   r   r2   r   r#   rB   rC   r
   rD   rY   r   processr   r   rw   )r   keyskey_namevlkey_pathvr&   rG   rH   rI   rT   rD   r   r6   r   get_secrets   sH   



.
zSECURITY.get_secretsc                 C   s   i }| j |d< | jrdnd|d< | j|d< d |d< | jd ur#| j|d< g |d< | jD ]}|d |  q*g |d< | jD ]}|d |  q=|S )	Nr   VISTAOLDsecrets_formatr   zNK$LMdccr   )r   r   r   r   r   rw   to_dictr   r   trD   r   r   r   r      s   





zSECURITY.to_dictc                 C   s   d}|d| j  7 }|| jrdd nd7 }|d| j  7 }| jd ur+|d| j  7 }| jD ]
}|d|  7 }q.| jD ]
}|dt| 7 }q<|S )	Nz5============== SECURITY hive secrets ==============
zIteration count: %s
zSecrets structure format : %s
r   r   zLSA Key: %s
zNK$LM Key: %s
z%s
)	r   r   r   rF   r   r   to_lopthr   strr   r   r   r   __str__  s   


zSECURITY.__str__r!   )r    )__name__
__module____qualname__r   staticmethodr+   rJ   rM   rY   r\   rs   r   r   r   r   r   r   r   r   r      s    
E-r   )	unicryptor   r   unicrypto.symmetricr   r   r   r   r   rn   %pypykatz.registry.security.structuresr	   r
   r   r   !pypykatz.registry.security.commonr   r   pypykatz.registryr   r   r   r   r   r   <module>   s   	