o jO@sbddlmZmZddlmZddlmZddlmZGdddZ GdddZ Gd d d Z d S) )ABCabstractmethod)logger)hexdump) RTL_AVL_TABLEc@s&eZdZddZddZd ddZdS) LoggercCs||_||_||_t|_dSN) package_name module_namesysinfor)selfr r r r /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/lsadecryptor/package_commons.py__init__ s zLogger.__init__cCs |jSr)rgetEffectiveLevel)r r r r get_levels zLogger.get_levelcCs^d}|dD]%}|dkr|j|d|j|j|fd}q|j|d|j|j|fqdS)NT z [%s] [%s] %sFz[%s] [%s] %s)splitrlogr r )r msgloglevelfirstliner r rrsz Logger.logN)r)__name__ __module__ __qualname__rrrr r r rr src@s:eZdZd ddZd ddZd ddZeed d ZdS) PackageTemplateNcCstd|||_||_||_dS)Ntemplate)rrr r )r r r r r rr s zPackageTemplate.__init__cCs|j|d|dSNz%srrr rrr r rr%zPackageTemplate.logcCs|jd||jf|dS)zW" Generic logging function to show which template was selected for which structure zSelecting template for %s: %sN)rrr)r struct_var_namestruct_template_objrr r r log_template(szPackageTemplate.log_templatecCsdSrr )r r r r get_template/szPackageTemplate.get_templaterr) rrrrrr& staticmethodrr'r r r rrs   rc@sNeZdZddZdddZdddZdd d ZdddZddZdddZ dS)PackageDecryptorcCs*td|||_||_||_||_||_dS)N decryptor)rrr lsa_decryptorr reader)r r r,r r-r r rr6s  zPackageDecryptor.__init__rcCs|jd||dSr r!r"r r rr=r#zPackageDecryptor.logNcCsT|d|dur |jj}|jj||dd}t|dkr&td||f|dS)zN Searches for a sequence of bytes in the module identified by module_name z"Searching for key struct signatureNT) find_firstrz2Signature was not found in module %s Signature: %s)rdecryptor_template signaturer-find_in_modulelen Exceptionhex)r r r0flr r rfind_signature@s  zPackageDecryptor.find_signaturec Cs|j}|dks |dkrdS|s/|dkrd}|dkrd}|dkr#d }|d kr)d }|d kr/d }|j}z%|j||j|}|j||d|t|t||dfWdSt yw}z|d|t|fWYd}~dSd}~ww)z Reads datasize bytes from the memory region pointed by the pointer. ptr = the pointer to be read name = display name for the memory structure, usually the data structure's name the pointer is pointing at rrN Priz %s: %s %s)startz"%s: Logging failed for position %s) rrr-tellmovepeekrr4rr3)r ptrnamedatasizelevelposdataer r rlog_ptrLs0     &$zPackageDecryptor.log_ptrFTc Csd}|jj||d}|rVt|dkrV|dkrTz|d}Wn)z|d}Wnz|d}Wn|}YYY||fSY||fS|dkrP|d }||fS|}||fS) a Common decryption method for LSA encrypted passwords. Result be string or hex encoded bytes (for machine accounts). Also supports bad data, as orphaned credentials may contain actual password OR garbage enc_password: bytes The encrypted password bytes bytes_expected: bool :indication that the result of decryption is bytes, no need for encoding trim_zeroes: bool: if a text is expected then this variable tells wether we should trim the trailing zeroes after decryption N) segment_sizerFz utf-16-lezutf-8asciiT)r,decryptr2decoder4rstrip)r enc_passwordbytes_expected trim_zeroesrL dec_passwordtempr r rdecrypt_passwordks.    z!PackageDecryptor.decrypt_passwordcCs|j|jtd}|dur|ddS|jjdkr@||jj|jjjdkr/| |jj||jj jdkrB| |jj |dSdSdS)z Walks the AVL tree, extracts all OrderedPointer values and returns them in a list node_ptr: POINTER : the Parent->RightChild pointer in the AVL tree result_ptr_list: list: the list to store the results in )override_finaltypeNzAVL walker found empty treer) readr-rrOrderedPointervalueappend BalancedRoot LeftChildwalk_avl RightChild)r node_ptrresult_ptr_listnoder r rr_s  zPackageDecryptor.walk_avlc Csvi}d||j<|}||j|sd|jjn|j z|r%||j|}n||j}WntyF}z|d|WYd}~dSd}~ww|sKdS|||d8}|d|s]|j jjn|j|j jf|d|sp|j jjn|j|j j|vf|d|s|j jjn|j|f|j jd kr|j j|vr|d krd||j j<||j j|sd |j jjn|j|j }ndSq) a1 Iterating over a linked list. Linked lists in packages are circural, so the end of the list is tested is the Flink is pointing to an address already seen. entry_ptr = pointer type object the will yiled the first entry when called read() callback = function that will be called when a new entry is found. callback method will be invoked with one parameter, the entry itself max_walk = limit the amount of entries to be iterating override_ptr = if this parameter is set the pointer will be resolved as if it would be pointing to this structure rzList entry -%s-Tz&Exception while reading list entry: %sNz%s next ptr: %xz %s seen: %sz%s max_walk: %drzNext list entry -%s-) locationrJr[ finaltyperrYr-r3rFlink)r entry_ptrcallbackmax_walk override_ptr entries_seenentryrIr r r walk_lists8   &*"  $zPackageDecryptor.walk_listr(r)FTrK)rdN) rrrrrr6rJrWr_rnr r r rr*5s   !r*N) abcrrpypykatzrpypykatz.commons.commonrpypykatz.commons.win_datatypesrrrr*r r r rs