o
    j̾                     @   s4  d dl Z d dlZd dlmZmZmZmZmZmZm	Z	m
Z
mZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZ d dlmZ eZeZe	ZeZ eZ!eZ"eZ#e#Z$ee$Z%eZ&e#Z'ee'Z(e(Z)e!Z*ee*Z+eZ eZ,ee,Z-e
Z.ee.Z/eeZ0eZ1eZ2e,Z3ee3Z4e1Z5e2Z6e5Z7d Z8dZ9G dd dZ:G dd de j;Z<G d	d
 d
e j;Z=G dd de j>Z?G dd de j>Z@G dd de j;ZAG dd de j;ZBG dd deZCeeCZDeCZEeDZFG dd deZGG dd deZHG dd deZIG dd deZJeeJZKeeHZLeHZMeLZNeHZOeLZPG dd deZQeeQZRG dd  d eZSeeSZTG d!d" d"eZUeeUZVG d#d$ d$eZWeeWZXG d%d& d&eZYeeYZZG d'd( d(eZ[G d)d* d*eZ\ee\Z]G d+d, d,eZ^ee^Z_G d-d. d.eZ`ee`ZaG d/d0 d0eZbebZcG d1d2 d2eZdG d3d4 d4eZeG d5d6 d6eZfG d7d8 d8eZgeeg Zhdrd9d:ZiG d;d< d<eZjdsd>d?ZkG d@dA dAeZlzedBjmZnW n eoy   eedCkrdDZnneed=krdEZnn Y nw dFdG ZpdtdIdJZqdtdKdLZrdMdN ZsdOdP ZtdQdR ZudSdT ZvdUdV ZwdWdX ZxdYdZ Zyd[d\ Zzd]d^ Z{dud_d`Z|dadb Z}de@j~e@jB e@jB e@jB d dfdcddZdvdfdgZdhdi Zedjkrd dklmZ d dllmZ e Zd dlZe  ewdmZe  exednZedodpZe ZW d   n	1 svw   Y  d ZeieedqZeyeee\ZZZeepe ee dS dS )w    N)pointerc_bytec_wcharc_char_p	addressofc_ubytec_int16
c_longlongcastbyref	Structurec_charc_buffer	string_atwindllc_void_pc_uint32POINTER	c_wchar_pWinErrorsizeofc_int32c_uint16create_string_buffer)hexdumpi@  c                   @   s(   e Zd Zdd Zdd Zedd ZdS )SIDc                 C   s   d | _ d | _d | _g | _d S N)RevisionSubAuthorityCountIdentifierAuthoritySubAuthorityself r#   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/kerberos/functiondefs/netsecapi.py__init__*   s   
zSID.__init__c                 C   sd   d}| j dk r|t| j 7 }n|d| j dd  dd 7 }| jD ]
}|dt| 7 }q%|S )	NzS-1-l        0x   big   0-)r   strto_byteshexupperrjustr    )r"   tir#   r#   r$   __str__0   s   
&
zSID.__str__c                 C   s   | d krd S t | d}t|}t }tj|dddd|_tj|dddd|_tj|dddd|_	t | d |jd }t|}t
|jD ]}|jtj|dddd qK|S )	N      littleF)signedr'   r(      )r   ioBytesIOr   int
from_bytesreadr   r   r   ranger    append)ptrdatabuffsid_r#   r#   r$   from_ptr:   s   


 zSID.from_ptrN)__name__
__module____qualname__r%   r3   staticmethodrE   r#   r#   r#   r$   r   )   s
    
r   c                   @   s   e Zd ZdZdZdZdZdZdZdZ	dZ
d	Zd
ZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZ dZ!d Z"d!S )"KERB_PROTOCOL_MESSAGE_TYPEr   r5         r8      r'      r4   	   
      r)                                                            N)#rF   rG   rH   KerbDebugRequestMessageKerbQueryTicketCacheMessage KerbChangeMachinePasswordMessageKerbVerifyPacMessageKerbRetrieveTicketMessageKerbUpdateAddressesMessageKerbPurgeTicketCacheMessageKerbChangePasswordMessage KerbRetrieveEncodedTicketMessageKerbDecryptDataMessageKerbAddBindingCacheEntryMessageKerbSetPasswordMessageKerbSetPasswordExMessageKerbVerifyCredentialsMessageKerbQueryTicketCacheExMessageKerbPurgeTicketCacheExMessage&KerbRefreshSmartcardCredentialsMessageKerbAddExtraCredentialsMessage'KerbQuerySupplementalCredentialsMessageKerbTransferCredentialsMessageKerbQueryTicketCacheEx2MessageKerbSubmitTicketMessage KerbAddExtraCredentialsExMessageKerbQueryKdcProxyCacheMessageKerbPurgeKdcProxyCacheMessageKerbQueryTicketCacheEx3Message$KerbCleanupMachinePkinitCredsMessage!KerbAddBindingCacheEntryExMessageKerbQueryBindingCacheMessageKerbPurgeBindingCacheMessage&KerbQueryDomainExtendedPoliciesMessageKerbQueryS4U2ProxyCacheMessager#   r#   r#   r$   rJ   K   sB    rJ   c                   @   s8  e Zd ZdZdZdZdZdZdZdZ	dZ
d	Zd
ZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZ dZ!d Z"d!Z#d"Z$d#Z%d$Z&d%Z'd&Z(d'Z)d(Z*d)Z+d*Z,d+Z-d,Z.d-Z/d.Z0d/Z1d0Z2d1Z3d2Z4d3Z5d4Z6d5Z7d6Z8d7Z9d8Z:d9Z;d:Z<d;Z=d<Z>d=Z?d>Z@d?ZAd@ZBdAZCdBZDdCZEdDZFdEZGdFZHdGZIdHZJdIZKdJZLdKZMdLS )MSEC_Er   i	 l      l     l     l     l     l     l     l     l     l   	  l   
  l     l     l     l     l     l     l     l     l     l     l      l   !  l   "  l   $  l   %  l   &  l   '  l   (  l   )  l   0  l   1  l   2  l   3  l   4  l   5  l   6  l   7  l   8  l   9  l   :  l   ;  l   <  l   =  l   >  l   ?  l   @  l   A  l   B  l   C  l   E  l   F  l   G  l   H  l   I  l   P  l   Q  l   R  l   S  l   T  l   U  l   V  l   W  l   X  l   Y  l   Z  l   [  l   ]  l   ^  l   _  i!	 i	 i	 N)NrF   rG   rH   OKCONTINUE_NEEDEDINSUFFICIENT_MEMORYINVALID_HANDLEUNSUPPORTED_FUNCTIONTARGET_UNKNOWNINTERNAL_ERRORSECPKG_NOT_FOUND	NOT_OWNERCANNOT_INSTALLINVALID_TOKENCANNOT_PACKQOP_NOT_SUPPORTEDNO_IMPERSONATIONLOGON_DENIEDUNKNOWN_CREDENTIALSNO_CREDENTIALSMESSAGE_ALTEREDOUT_OF_SEQUENCENO_AUTHENTICATING_AUTHORITY	BAD_PKGIDCONTEXT_EXPIREDINCOMPLETE_MESSAGEINCOMPLETE_CREDENTIALSBUFFER_TOO_SMALLWRONG_PRINCIPAL	TIME_SKEWUNTRUSTED_ROOTILLEGAL_MESSAGECERT_UNKNOWNCERT_EXPIREDENCRYPT_FAILUREDECRYPT_FAILUREALGORITHM_MISMATCHSECURITY_QOS_FAILEDUNFINISHED_CONTEXT_DELETEDNO_TGT_REPLYNO_IP_ADDRESSESWRONG_CREDENTIAL_HANDLECRYPTO_SYSTEM_INVALIDMAX_REFERRALS_EXCEEDEDMUST_BE_KDCSTRONG_CRYPTO_NOT_SUPPORTEDTOO_MANY_PRINCIPALS
NO_PA_DATAPKINIT_NAME_MISMATCHSMARTCARD_LOGON_REQUIREDSHUTDOWN_IN_PROGRESSKDC_INVALID_REQUESTKDC_UNABLE_TO_REFERKDC_UNKNOWN_ETYPEUNSUPPORTED_PREAUTHDELEGATION_REQUIREDBAD_BINDINGSMULTIPLE_ACCOUNTSNO_KERB_KEYCERT_WRONG_USAGEDOWNGRADE_DETECTEDSMARTCARD_CERT_REVOKEDISSUING_CA_UNTRUSTEDREVOCATION_OFFLINE_CPKINIT_CLIENT_FAILURESMARTCARD_CERT_EXPIREDNO_S4U_PROT_SUPPORTCROSSREALM_DELEGATION_FAILUREREVOCATION_OFFLINE_KDCISSUING_CA_UNTRUSTED_KDCKDC_CERT_EXPIREDKDC_CERT_REVOKEDINVALID_PARAMETERDELEGATION_POLICYPOLICY_NLTM_ONLYRENEGOTIATECOMPLETE_AND_CONTINUECOMPLETE_NEEDEDr#   r#   r#   r$   r   n   s    r   c                   @   s    e Zd ZdZdZdZdZdZdS )SECPKG_CREDrU   rL   r5   rK       N)rF   rG   rH   AUTOLOGON_RESTRICTEDBOTHINBOUNDOUTBOUNDPROCESS_POLICY_ONLYr#   r#   r#   r$   r      s    r   c                   @   sh   e Zd ZdZdZdZdZdZdZdZ	dZ
d	Zd
ZdZdZdZdZdZdZdZdZdZdZdZdZdZdS )ISC_REQr5   rK   r8   r4   rU   r   @         i   i   i   i   i    i @  i   i   i   i   i   i   i    i   N)rF   rG   rH   DELEGATEMUTUAL_AUTHREPLAY_DETECTSEQUENCE_DETECTCONFIDENTIALITYUSE_SESSION_KEYPROMPT_FOR_CREDSUSE_SUPPLIED_CREDSALLOCATE_MEMORYUSE_DCE_STYLEDATAGRAM
CONNECTION
CALL_LEVELFRAGMENT_SUPPLIEDEXTENDED_ERRORSTREAM	INTEGRITYIDENTIFYNULL_SESSIONMANUAL_CRED_VALIDATION	RESERVED1FRAGMENT_TO_FITHTTPr#   r#   r#   r$   r      s0    r   c                   @   s<   e Zd ZdZdZdZdZdZdZdZ	dZ
d	Zd
ZdZdZdS )SECPKG_ATTRrO   l       l       l       l       l       l       rP   l       r   |   r_   N)rF   rG   rH   SESSION_KEYC_ACCESS_TOKENC_FULL_ACCESS_TOKENCERT_TRUST_STATUSCREDSCREDS_2NEGOTIATION_PACKAGEPACKAGE_INFOSERVER_AUTH_FLAGSSIZESSUBJECT_SECURITY_ATTRIBUTESENDPOINT_BINDINGSr#   r#   r#   r$   r      s    r   c                   @   sl   e Zd ZdZdZdZdZdZdZdZ	dZ
d	Zd
ZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdS )SECBUFFER_TYPErV   l      ` rS   rT   r5   r]   r   rM   rQ   r)   r8   rL   r[   r\   rY   rX   rN   r'   rR   rU   rK   rZ   rW   rO   N)rF   rG   rH   SECBUFFER_ALERTSECBUFFER_ATTRMASKSECBUFFER_CHANNEL_BINDINGSSECBUFFER_CHANGE_PASS_RESPONSESECBUFFER_DATASECBUFFER_DTLS_MTUSECBUFFER_EMPTYSECBUFFER_EXTRASECBUFFER_MECHLISTSECBUFFER_MECHLIST_SIGNATURESECBUFFER_MISSINGSECBUFFER_PKG_PARAMSSECBUFFER_PRESHARED_KEY SECBUFFER_PRESHARED_KEY_IDENTITY$SECBUFFER_SRTP_MASTER_KEY_IDENTIFIER"SECBUFFER_SRTP_PROTECTION_PROFILESSECBUFFER_STREAM_HEADERSECBUFFER_STREAM_TRAILERSECBUFFER_TARGETSECBUFFER_TARGET_HOSTSECBUFFER_TOKENSECBUFFER_TOKEN_BINDINGSECBUFFER_APPLICATION_PROTOCOLSSECBUFFER_PADDINGr#   r#   r#   r$   r     s2    r  c                   @   s   e Zd ZdefdefgZdS )FILETIMEdwLowDateTimedwHighDateTimeN)rF   rG   rH   DWORD_fields_r#   r#   r#   r$   r        r  c                   @   s(   e Zd ZdefdefgZedd ZdS )SecPkgContext_SessionKeySessionKeyLength
SessionKeyc                 C   s   t | j| jdS N)size)r   r"  r!  r!   r#   r#   r$   Buffer     zSecPkgContext_SessionKey.BufferN)rF   rG   rH   ULONGLPBYTEr  propertyr%  r#   r#   r#   r$   r     s    r   c                       s4   e Zd ZdeefdeefgZ fddZ  ZS )	SecHandledwLowerdwUpperc                    s"   t t| tt tt  d S r   )superr*  r%   r   r'  r!   	__class__r#   r$   r%   %  s   "zSecHandle.__init__)rF   rG   rH   r   r'  r  r%   __classcell__r#   r#   r.  r$   r*    s
    

r*  c                   @   sF   e Zd ZdZdefdefdefgZde ej	fddZ
edd	 Zd
S )	SecBufferzStores a memory buffer: size, type-flag, and POINTER. 
	The type can be empty (0) or token (2).
	InitializeSecurityContext will write to the buffer that is flagged "token"
	and update the size, or else fail 0x80090321=SEC_E_BUFFER_TOO_SMALL.cbBuffer
BufferTypepvBuffer    c                 C   s4   t |t|d}t| t||jtt|t d S r#  )	r   lenr   r%   r   valuer
   r   PVOID)r"   tokenbuffer_typebufr#   r#   r$   r%   2  s   $zSecBuffer.__init__c                 C   s   t | jt| j| jdfS r#  )r  r3  r   r4  r2  r!   r#   r#   r$   r%  6  s   zSecBuffer.BufferN)rF   rG   rH   __doc__r'  r8  r  maxtoken_sizer  r  r%   r)  r%  r#   r#   r#   r$   r1  (  s    r1  c                   @   sH   e Zd ZdZdefdefdeefgZdddZdd	 Z	e
d
d ZdS )SecBufferDesczsDescriptor stores SECBUFFER_VERSION=0, number of buffers (e.g. one),
	and POINTER to an array of SecBuffer structs.	ulVersioncBufferspBuffersNc                 C   sF   |d urt | dt|tt| |  d S t | ddtt  d S )Nr   r5   )r   r%   r6  r1  r   )r"   
secbuffersr#   r#   r$   r%   >  s   $zSecBufferDesc.__init__c                 C   s
   | j | S r   )rA  )r"   indexr#   r#   r$   __getitem__D     
zSecBufferDesc.__getitem__c                 C   s*   g }t | jD ]}|| j| j q|S r   )r>   r@  r?   rA  r%  )r"   rA   r2   r#   r#   r$   BuffersG  s   zSecBufferDesc.Buffersr   )rF   rG   rH   r<  r'  r   r1  r  r%   rD  r)  rF  r#   r#   r#   r$   r>  :  s    
r>  c                   @   s<   e Zd ZdefdefgZdd Zedd Zedd Z	d	S )
LUIDLowPartHighPartc                 C   s
   t | S r   )rG  luid_to_intr!   r#   r#   r$   to_int\  rE  zLUID.to_intc                 C   s   | j d> | j S )Nr   )rI  rH  )luidr#   r#   r$   rJ  _  r&  zLUID.luid_to_intc                 C   s   t  }| d? |_| d@ |_|S )Nr       )rG  rI  rH  )r2   rL  r#   r#   r$   from_intc  s   

zLUID.from_intN)
rF   rG   rH   r  LONGr  rK  rI   rJ  rN  r#   r#   r#   r$   rG  V  s    
rG  c                   @   s.   e Zd ZdefdefdeefgZdd ZdS )
LSA_STRINGLengthMaximumLengthr%  c                 C   s   t | j| j S r   )r   r%  rR  decoder!   r#   r#   r$   	to_stringr  s   zLSA_STRING.to_stringN)rF   rG   rH   USHORTr   r   r  rT  r#   r#   r#   r$   rP  l  s    
rP  c                   @   s:   e Zd ZdefdefdeefgZedd Zdd Z	dS )	LSA_UNICODE_STRINGrQ  rR  r%  c                 C   s<   |  d} t }t| t| |_t| d |_t| |_|S )N	utf-16-ler5   )encoderV  r   r6  r%  rR  rQ  )slusr#   r#   r$   from_string~  s   

zLSA_UNICODE_STRING.from_stringc                 C   s   t | j| jdddS )NrW    )r   r%  rR  rS  replacer!   r#   r#   r$   rT    s   zLSA_UNICODE_STRING.to_stringN)
rF   rG   rH   rU  r   r   r  rI   r[  rT  r#   r#   r#   r$   rV  w  s    

rV  c                   @   s*   e Zd ZdefdefdefgZdd ZdS )LSA_LAST_INTER_LOGON_INFOLastSuccessfulLogonLastFailedLogon*FailedAttemptCountSinceLastSuccessfulLogonc                 C   s   | j | j| jdS )Nr`  ra  rb  rc  r!   r#   r#   r$   to_dict  s   z!LSA_LAST_INTER_LOGON_INFO.to_dictN)rF   rG   rH   LARGE_INTEGERr'  r  rd  r#   r#   r#   r$   r_    s    r_  c                   @   s   e Zd Zdefdefdefdefdefdefdefdefd	efd
efdefdefdefdefdefdefdefdefdefdefdefdefdefgZ	dd Z
dS )SECURITY_LOGON_SESSION_DATASizeLogonIdUserNameLogonDomainAuthenticationPackage	LogonTypeSessionSid	LogonTimeLogonServerDnsDomainNameUpn	UserFlagsLastLogonInfoLogonScriptProfilePathHomeDirectoryHomeDirectoryDrive
LogoffTimeKickOffTimePasswordLastSetPasswordCanChangePasswordMustChangec                 C   s   i d| j  d| j d| j d| j d| jd| jdtt	
| jd| jd	| j d
| j d| j d| jd| j d| j d| j d| j d| j | j| j| j| j| jdS )Nrh  ri  rj  rk  rl  rm  rn  ro  rp  rq  rr  rs  rt  ru  rv  rw  rx  )ry  rz  r{  r|  r}  )rh  rK  ri  rT  rj  rk  rl  rm  r,   r   rE   rn  ro  rp  rq  rr  rs  rt  rd  ru  rv  rw  rx  ry  rz  r{  r|  r}  r!   r#   r#   r$   rd    sR   




	







z#SECURITY_LOGON_SESSION_DATA.to_dictN)rF   rG   rH   r'  rG  rV  r8  re  r_  r  rd  r#   r#   r#   r$   rf    s4    rf  c                       s:   e Zd ZdefdefdefdefgZd	 fdd	Z  ZS )
KERB_PURGE_TKT_CACHE_REQUESTMessageTyperh  
ServerName	RealmNamer   Nc                    .   t |tr
t|}tt| tjj	| d S r   )

isinstancer;   rG  rN  r-  r~  r%   rJ   rk   r7  )r"   logonid
servernamerealnamer.  r#   r$   r%        

z%KERB_PURGE_TKT_CACHE_REQUEST.__init__)r   NN)	rF   rG   rH   r  rG  rP  r  r%   r0  r#   r#   r.  r$   r~    s    r~  c                   @   sB   e Zd ZdefdefdefdefdefdefdefgZdd	 Zd
S )KERB_TICKET_CACHE_INFOr  r  	StartTimeEndTime	RenewTimeEncryptionTypeTicketFlagsc                 C   s*   | j  | j | j| j| j| j| jdS )N)r  r  r  r  r  r  r  )r  rT  r  r  r  r  r  r  r!   r#   r#   r$   rd    s   zKERB_TICKET_CACHE_INFO.to_dictN)	rF   rG   rH   rV  re  rO  r'  r  rd  r#   r#   r#   r$   r    s    
r  c                   @   s*   e Zd ZdefdefdefgZdd ZdS )KERB_CRYPTO_KEYKeyTyperQ  Valuec                 C   s   | j t| j| jdS )N)r  Key)r  r   r  rQ  r!   r#   r#   r$   rd    s   zKERB_CRYPTO_KEY.to_dictN)rF   rG   rH   rO  r'  r8  r  rd  r#   r#   r#   r$   r    s    r  c                   @   "   e Zd ZdefdefdefgZdS )KERB_EXTERNAL_NAMENameType	NameCountNamesN)rF   rG   rH   SHORTrU  rV  r  r#   r#   r#   r$   r    
    r  c                   @   sx   e Zd Zdefdefdefdefdefdefdefdefd	efd
efdefdefdefdefdefdefgZdd Z	dS )KERB_EXTERNAL_TICKETServiceName
TargetName
ClientName
DomainNameTargetDomainNameAltTargetDomainNamer"  r  FlagsKeyExpirationTimer  r  
RenewUntilTimeSkewEncodedTicketSizeEncodedTicketc                 C   s   | j  t| j| jdS )N)r  Ticket)r"  rd  r   r  r  r!   r#   r#   r$   get_data"  s   zKERB_EXTERNAL_TICKET.get_dataN)
rF   rG   rH   r8  rV  r  r'  re  r  r  r#   r#   r#   r$   r    s&    r  c                       s.   e Zd ZdefdefgZd fdd	Z  ZS )KERB_QUERY_TKT_CACHE_REQUESTr  rh  r   c                    r  r   )
r  r;   rG  rN  r-  r  r%   rJ   rf   r7  )r"   r  r.  r#   r$   r%   0  r  z%KERB_QUERY_TKT_CACHE_REQUEST.__init__r   )rF   rG   rH   r  rG  r  r%   r0  r#   r#   r.  r$   r  *  s
    r  c                   @   s   e Zd ZdefdefgZdS )"KERB_QUERY_TKT_CACHE_RESPONSE_SIZEr  CountOfTicketsN)rF   rG   rH   r  r'  r  r#   r#   r#   r$   r  6  r  r  c                   @   r  )KERB_QUERY_TKT_CACHE_RESPONSEr  r  TicketsN)rF   rG   rH   r  r'  r  r  r#   r#   r#   r$   r  ;  r  r  c                   @   s4   e Zd ZdefdefdefdefdefdefgZdS )KERB_SUBMIT_TKT_REQUESTr  rh  r  r  KerbCredSizeKerbCredOffsetN)rF   rG   rH   r  rG  r'  r  r  r#   r#   r#   r$   r  B  s    r  c                    sz   t d }t|trt|}G  fdddt}| }tjj|_	||_
d|_t |_t |_tt    |_||_|S )Nr8   c                       sL   e Zd ZdZdefdefdefdefdefdefdefd	ee	  fgZ
d
S )z2submit_tkt_helper.<locals>.KERB_SUBMIT_TKT_REQUESTr8   r  rh  r  rQ  r  r  r  
TicketDataN)rF   rG   rH   _pack_r  rG  r'  r8  r   r6  r  r#   ticket_datar#   r$   r  S  s    r  r   )KERB_SUBMIT_TKT_REQUEST_OFFSETr  r;   rG  rN  r   rJ   rz   r7  r  rh  r  r  r  r6  r  r   r  r  )r  r  offsetr  reqr#   r  r$   submit_tkt_helperN  s   




r  c                       sL   e Zd ZdefdefdefdefdefdefdefgZ	d fd
d	Z
  ZS )KERB_RETRIEVE_TKT_REQUESTr  rh  r  r  CacheOptionsr  CredentialsHandler   r4   c              	      s>   t |tr
t|}tt| tjj	|t
||||d  d S r   )r  r;   rG  rN  r-  r  r%   rJ   rm   r7  rV  r[  )r"   
targetnameticketflagscacheoptionsencryptiontyper  r.  r#   r$   r%     s   


z"KERB_RETRIEVE_TKT_REQUEST.__init__)r   r4   r   r   )rF   rG   rH   r  rG  rV  r'  rO  r8  r  r%   r0  r#   r#   r.  r$   r  |  s    
r  r4   c                    s   t |tr
t|}| dd }t| G  fdddt}| }tjj	|_
||_||_||_||_tt| | |_t|t| }	|	  }
|
|
tt  }t }t| d|_ |_t|tt|_||_|S )NrW  s     c                       sJ   e Zd Zdefdefdefdefdefdefdefdefd	e	  fg	Z
d
S )z6retrieve_tkt_helper.<locals>.KERB_RETRIEVE_TKT_REQUESTr  rh  r  r  r  r  r  UNKTargetNameDataN)rF   rG   rH   r  rG  rV  r'  rO  r8  r   r  r#   targetname_len_allocr#   r$   r    s    
r  )r  r;   rG  rN  rX  r6  r   rJ   rm   r7  r  rh  r  r  r  r   r  r   r   r   rV  rQ  rR  r
   r   r   r%  r  )r  r  r  r  r  temp_offsettargetname_encr  r  
struct_endtargetname_starttargetname_start_padded
lsa_targetr#   r  r$   retrieve_tkt_helper  s*   
	

r  c                   @   s   e Zd ZdefgZdS )KERB_RETRIEVE_TKT_RESPONSEr  N)rF   rG   rH   r  r  r#   r#   r#   r$   r    s    r  r8   rM  l    c                 C   s   t t| S r   )r   LsaNtStatusToWinError)
ret_statusr#   r#   r$   get_lsa_error  s   r  r#   c                 C   s   | st  | S )z
	Error checking for most Win32 API calls.

	The function is assumed to return an integer, which is C{0} on error.
	In that case the C{WindowsError} exception is raised.
	)r   resultfunc	argumentsr#   r#   r$   RaiseIfZero  s   r  c                 C   s   | t kr
tt| | S )z
	Error checking for Win32 Registry API calls.

	The function is assumed to return a Win32 error code. If the code is not
	C{ERROR_SUCCESS} then a C{WindowsError} exception is raised.
	)ERROR_SUCCESSr   r  r  r#   r#   r$   LsaRaiseIfNotErrorSuccess  s   r  c                 C   s6   t jj}tg|_t|_|| }|dkrtd|  |S )Ni=  zERROR_MR_MID_NOT_FOUND for %s)r   Advapi32r  NTSTATUSargtypesr'  restype	Exception)errcode_LsaConnectUntrustedresr#   r#   r$   r    s   r  c                 C   (   t jj}tg|_t|_t|_||  d S r   )	r   Secur32LsaFreeReturnBufferr8  r  r  r  r  errcheck)pbuffer_LsaFreeReturnBufferr#   r#   r$   r    s
   r  c                  C   s4   t jj} tg| _t| _t| _t	t
}| t| |S r   )r   r  LsaConnectUntrustedPHANDLEr  r  r  r  r  HANDLEINVALID_HANDLE_VALUEr   )r  
lsa_handler#   r#   r$   r    s   r  c                 C   r  r   )	r   r  LsaDeregisterLogonProcessr  r  r  r  r  r  )r  _LsaDeregisterLogonProcessr#   r#   r$   r    s   r  c                 C   s   t jj}tttg|_t|_t	|_
t| tr|  } t }t| |_t| |_t| d |_tt}td}|t|t|t| |S Nr5   r   )r   r  LsaRegisterLogonProcessPLSA_STRINGr  PLSA_OPERATIONAL_MODEr  r  r  r  r  r  r,   rX  rP  r   r%  r6  rQ  rR  r  r  LSA_OPERATIONAL_MODEr   )logon_process_name_LsaRegisterLogonProcesspnamer  dummyr#   r#   r$   r  #  s   


r  c                 C   s|   t jj}tttg|_t|_t	|_
t|tr| }t }t||_t||_t|d |_td}|| t|t| |jS r  )r   r  LsaLookupAuthenticationPackager  r  PULONGr  r  r  r  r  r  r,   rX  rP  r   r%  r6  rQ  rR  r'  r   r7  )r  package_name_LsaLookupAuthenticationPackager  
package_idr#   r#   r$   r  :  s   


r  c           
   	   C   s   t jj}tttttttg|_t	|_
t|_t|ts"t|}t|}ntt|}t }td}tt}|| |t||t|t|t| d}d }	|jdkrVt||j}|}	||j|	fS )Nr       )r   r  LsaCallAuthenticationPackager  r'  r8  r  	PNTSTATUSr  r  r  r  r  r  r   bytesr6  r   r  r  r   r7  r   )
r  r  message_LsaCallAuthenticationPackagemessage_lenreturn_msg_preturn_msg_lenreturn_status
return_msgfree_ptrr#   r#   r$   r  O  s$   

$
r  c                     s   t jj} ttg| _t| _t| _	t
d t }| t t| G  fdddt}t|}g }t||}|jjD ]	}||  q8t| |S )Nr   c                       s   e Zd Zde j fgZdS )z+LsaEnumerateLogonSessions.<locals>.LUIDListLogonIdsN)rF   rG   rH   rG  r7  r  r#   LogonSessionCountr#   r$   LUIDListw  s    r	  )r   r  LsaEnumerateLogonSessionsr  r8  r  r  r  r  r  r'  r   r   r   r   r
   contentsr  r?   rK  r  )_LsaEnumerateLogonSessions
start_luidr	  	PLUIDList	res_luidspluidsrL  r#   r  r$   r
  l  s   

r
  c                 C   sj   t jj}ttg|_t|_t|_	t
| trt| } t }|t| t| t|t}|j }t| |S r   )r   r  LsaGetLogonSessionDataPLUIDr8  r  r  r  r  r  r  r;   rG  rN  r   r   r
   PSECURITY_LOGON_SESSION_DATAr  rd  r  )rL  _LsaGetLogonSessionDatappsessiondatapsessiondatasessiondatar#   r#   r$   r    s   




r  c                 C   s   dd }t jj}tttttttttg	|_	t
|_||_d }| r%t| d}t|d}	t }
t }|||	|||d d t|
t|	 |
S )Nc                 S   s(   t | t jkr	| S tdd| t | f )N!%s failed with error code %s (%s)AcquireCredentialsHandler   r   r  r  r#   r#   r$   errc  s   z&AcquireCredentialsHandle.<locals>.errcascii)r   r  AcquireCredentialsHandleA	PSEC_CHARr'  r  r8  PCredHandle
PTimeStampr  r  r  r  LPSTRrX  
CredHandle	TimeStampr   )client_namer  	tragetspn
cred_usagepluidauthdatar  _AcquireCredentialsHandlecnpncredstsr#   r#   r$   r    s    r  c                 C   sB   dd }t jj}tttg|_t|_||_	|t
| |jt
|}d S )Nc                 S   s,   t | t jkrt | S tdd| t | f )Nr  QueryContextAttributesr  r  r#   r#   r$   r    s   z$QueryContextAttributes.<locals>.errc)r   r  QueryContextAttributesWPCtxtHandler'  r8  r  r  r  r  r   r7  )ctxattr
sec_structr  _QueryContextAttributesr  r#   r#   r$   r.    s   r.  c                 C   s$  dd }t jj}tttttttttttt	g|_
t|_||_|r't|d}nd }t }	t }
t }|r;tt|g}|sbt }|t| d |t|d||rQt|nd dt|t|	t|
t|}n#|t| t||t|d||rut|nd dt|t|	t|
t|}|	j}|||t|
j|fS )Nc                 S   s>   t | t jt jt jt jt jfv rt | S tdd| t | f )Nr  InitializeSecurityContext)r   r   r   r   r   r   r  r  r#   r#   r$   r    s    z'InitializeSecurityContext.<locals>.errcr  r   )r   r  InitializeSecurityContextAr  r0  r  r'  PSecBufferDescr  r   r  r  r  r  r!  rX  r>  r#  r1  
CtxtHandler   r;   rF  r   r7  )r,  targetr1  flagsTargetDataRepr9  r  _InitializeSecurityContextptargetnewbufoutputflagsexpiryr  rA   r#   r#   r$   r5    s&   DFr5  Tc                    s   g }t |}t| ||\}}}|dkr|du rtt||S t|  jdkrIG  fdddt}	|	|}
|
jD ]	}|	|
  q;t| |S )Nr   Tc                       s(   e Zd Zdefdefde j fgZdS )zIget_ticket_cache_info_helper.<locals>.KERB_QUERY_TKT_CACHE_RESPONSE_ARRAYr  r  r  N)rF   rG   rH   r  r'  r  r  r  r#   response_preparser#   r$   #KERB_QUERY_TKT_CACHE_RESPONSE_ARRAY  s
    rC  )r  r  r   r  r  from_buffer_copyr  r   r  r?   rd  r  )r  r  rL  throwr  r  ret_msgr  free_prtrC  responseticketr#   rA  r$   get_ticket_cache_info_helper  s   



rJ  c           
      C   sb   t ||d}t| ||\}}}i }|dkrtt|t|dkr/t|}	|	j }t	| |S )Nr  r   )
r  r  r   r  r6  r  rD  r  r  r  )
r  r  rL  target_namer  rF  r  r  rI  respr#   r#   r$   extract_ticket
  s   

rN  __main__)RtlAdjustPrivilege)ProcessManipulatorHELLOOOkerberosztest_9.kirbirbrK  r  )r   r   r4   r   r   )Nr#   )NN)T)enumr9   ctypesr   r   r   r   r   r   r   r	   r
   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   pypykatz.commons.commonr   BYTEUCHARr  rU  rO  LPWSTRLPVOIDr8  PPVOIDr  r  r  LPHANDLEr  r  r'  r  re  PLARGE_INTEGERr(  r!  CHARr  r  PCHARSEC_CHARr  r  r=  r   EnumrJ   r   IntFlagr   r   r   r  r  	PFILETIMEr#  r   r   r*  r1  r>  r7  
PSecHandler"  r  r8  r0  rG  r  rP  r  rV  PLSA_UNICODE_STRINGr_  PLSA_LAST_INTER_LOGON_INFOrf  r  r~  r  PKERB_TICKET_CACHE_INFOr  PKERB_CRYPTO_KEYr  PKERB_EXTERNAL_NAMEr  PKERB_EXTERNAL_TICKETr  r  r  r  r  r  r  r  r  r7  r  	TypeErrorr  r  r  r  r  r  r  r  r  r  r
  r  r  r.  r   r   r   r   r5  rJ  rN  rF   0pypykatz.commons.readers.local.common.privilegesrP  *pypykatz.commons.winapi.processmanipulatorrQ  pmsys	getsystemr  
dropsystemr  openfr=   r  rL  r  rF  r  r  printr#   r#   r#   r$   <module>   s    h"#N		5


.
9

	
&
'


