o
    j                  
   @   s  d dl mZ d dl mZ d dlZd dlZd dlZd dlmZ d dlm	Z	 d dl
mZ d dlmZ d dlmZ d d	lmZ d d
lmZ G dd dZedkrOee	j ejdddZejdddd ejdddd ejdddd edZejddddd ejddd d ejd!dd"d ejd#dd$d%d ejd&dd'd(d ejd)dd*d+d ejd,d-d.d/ dejjd0d1 eej d2kre!  ed3 ed4 ed5 e"d2 e# Z$e%e$j&e$j' ee$j(e$j)e$j*e$j+e$j,\Z-Z.Z/Z0Z0e$_,e-du re1d6 e"d2 e$j2du re1d7 e"d2 zee.e/e-e$Z3e34  W dS  e5yN Z6 ze7 j8ej9kr=d dl:Z:e:;  ee<e6 W Y dZ6[6dS dZ6[6ww dS )8    )division)print_functionN)	unhexlify)version)logger)parse_identity)getKerberosTGT)	constants)	Principalc                   @   s$   e Zd Zdd Zdd Zdd ZdS )GETTGTc                 C   sb   || _ || _|| _d| _d| _|j| _|| _|j| _	|j
| _|jd ur/|jd\| _| _d S d S )N :)_GETTGT__password_GETTGT__user_GETTGT__domain_GETTGT__lmhash_GETTGT__nthashaesKey_GETTGT__aesKey_GETTGT__optionsdc_ip_GETTGT__kdcHostservice_GETTGT__servicehashessplit)selftargetpassworddomainoptions r!   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/../../../bin/getTGT.py__init__&   s   
zGETTGT.__init__c                 C   sH   t d| jd   ddlm} | }|||| || jd  d S )NzSaving ticket in %sz.ccacher   )CCache)logginginfor   impacket.krb5.ccacher$   fromTGTsaveFile)r   ticket
sessionKeyr$   ccacher!   r!   r"   
saveTicket3   s
   zGETTGT.saveTicketc              
   C   sX   t | jtjjd}t|| j| jt| j	t| j
| j| j| jd\}}}}| || d S )N)type)
clientNamer   r   lmhashnthashr   kdcHost
serverName)r
   r   r    principalTypevaluer   r   r   r   r   r   r   r   r   r-   )r   userNametgtcipheroldSessionKeyr+   r!   r!   r"   run;   s   z
GETTGT.runN)__name__
__module____qualname__r#   r-   r:   r!   r!   r!   r"   r   %   s    r   __main__TzMGiven a password, hash or aesKey, it will request a TGT and save it as ccache)add_helpdescriptionidentitystorez[domain/]username[:password])actionhelpz-ts
store_truez&Adds timestamp to every logging outputz-debugzTurn DEBUG output ONauthenticationz-hasheszLMHASH:NTHASHz$NTLM hashes, format is LMHASH:NTHASH)rC   metavarrD   z-no-passz&don't ask for password (useful for -k)z-kzUse Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use the ones specified in the command linez-aesKeyzhex keyz<AES key to use for Kerberos Authentication (128 or 256 bits)z-dc-ipz
ip addresszoIP Address of the domain controller. If ommited it use the domain part (FQDN) specified in the target parameterz-serviceSPNz3Request a Service Ticket directly through an AS-REQz-principalType?c                 C   s"   |   tjjv rtj|    S d S )N)upperr	   PrincipalNameType__members__)r5   r!   r!   r"   <lambda>\   s   " rM   a  PrincipalType of the token, can be one of  NT_UNKNOWN, NT_PRINCIPAL, NT_SRV_INST, NT_SRV_HST, NT_SRV_XHST, NT_UID, NT_SMTP_NAME, NT_ENTERPRISE, NT_WELLKNOWN, NT_SRV_HST_DOMAIN, NT_MS_PRINCIPAL, NT_MS_PRINCIPAL_AND_ID, NT_ENT_PRINCIPAL_AND_ID; default is NT_PRINCIPAL, )nargsr.   rC   defaultrD      z
Examples: z,	./getTGT.py -hashes lm:nt contoso.com/user
ze	it will use the lm:nt hashes for authentication. If you don't specify them, a password will be askedzDomain should be specified!zInvalid principalType!)=
__future__r   r   argparser%   sysbinasciir   impacketr   impacket.examplesr   impacket.examples.utilsr   impacket.krb5.kerberosv5r   impacket.krb5r	   impacket.krb5.typesr
   r   r;   printBANNERArgumentParserparseradd_argumentadd_argument_groupgrouprK   NT_PRINCIPALlenargv
print_helpexit
parse_argsr    inittsdebugrA   r   no_passr   kr   usernamer   _criticalr4   executerr:   	Exceptione	getLoggerlevelDEBUG	traceback	print_excstrr!   r!   r!   r"   <module>   sj   
"


(




