o jOk@sDddlZddlZddlZddlZddlZddlmZddlmZm Z m Z m Z m Z m Z mZmZddlmZddlmZmZddlmZddlmZddlmZdd lmZdd lmZGd d d ZGd ddZ GdddZ!GdddZ"GdddZ#GdddZ$GdddZ%GdddZ&GdddZ'GdddZ(dS)N)List)Ticket EncryptedData krb5_pvno KrbCredInfo EncryptionKeyKRBCRED TicketFlagsEncKrbCredPart)dt_to_kerbtime)EncryptionType MESSAGE_TYPE)logger)core)hashlib)Kirbi) KerberosSPNc@sBeZdZddZeddZddZedefdd Zd d Z d S) HeadercCsd|_d|_d|_dSNtagtaglentagdataselfr/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/minikerberos/common/ccache.py__init__s zHeader.__init__cCst|}g}|t|kr>t}tj|dddd|_tj|dddd|_ ||j |_ | ||t|ks|S)z# returns a list of header tags bigF byteordersigned) ioBytesIOtelllenrint from_bytesreadrrrappend)datareaderheadershrrrparses  z Header.parsecCs:|jjdddd}|t|jjdddd7}||j7}|SNrrFr )rto_bytesr&rrtrrrr1*s zHeader.to_bytesr+cCs t|Sr)rr/r+rrrr(0s zHeader.from_bytescCs*d|j}|d|j7}|d|j7}|S)Nztag: %s z taglen: %s z tagdata: %s rr2rrr__str__4s zHeader.__str__N) __name__ __module__ __qualname__r staticmethodr/r1bytesr(r5rrrrrs  rc@sBeZdZddZedejfddZddZede fd d Z d S) DateTimecCd|_d|_dSr) time_offset usec_offsetrrrrr; zDateTime.__init__r,cCs:t}tj|dddd|_tj|dddd|_|SNrFr )r;r'r(r)r=r>)r,drrrr/?szDateTime.parsecCs,|jjdddd}||jjdddd7}|Sr@)r=r1r>r2rrrr1FszDateTime.to_bytesr+cCtt|Sr)r;r/r#r$r4rrrr(KzDateTime.from_bytesN r6r7r8rr9r#r$r/r1r:r(rrrrr;:sr;c@szeZdZddZddZddZddZd d Zed e fd d Z eddZ eddZ eddZ ddZddZdS) CredentialcCsLd|_d|_d|_d|_d|_d|_d|_g|_d|_g|_ d|_ d|_ dSr) clientserverkeytimeis_skeytktflags num_addressaddrs num_authdataauthdataticket second_ticketrrrrrRs zCredential.__init__cCst|jj}t|dd}t|dd}|dkr&|ddd}n|ddd}|d}|tjj krY|ddd d}|dddd }d |||| | fS|dddd }|ddd d}d |||| | fS) Nenc-partetypesname name-stringrrealmcipheriz$krb5tgs$%s$%s$%s$%s$%sz$krb5tgs$%s$*%s$%s$spn*$%s$%s) rloadrQto_asn1nativer'r&r AES256_CTS_HMAC_SHA1_96valuehex)rrestgs_encryption_typer3tgs_name_string tgs_realm tgs_checksumtgs_encrypted_data2rrrto_hash`s zCredential.to_hashcCtddd}i}t|d<tjj|d<|jj|d<|jd|d<t |j j |d <|j |d <t |jj }||fS zf Returns the native format of an AS_REP message and the sessionkey in EncryptionKey native format rWrTrYpvnomsg-typecrealmrcnamerQrSrrr KRB_AS_REPr_rGrX to_stringr\rr[rQr]rrIrenc_parttgt_repr3rrrto_tgtr  zCredential.to_tgtcCrhrirprsrrrto_tgsrwzCredential.to_tgscCsd|j|jt|jddf}i}t|j |d<|jj |d<|jd|d<t |j t|d<|jjdkrStj|jjtjj|d<|jjdkrftj|jjtjj|d <|jjdkrytj|jjtjj|d <|jjdkrtj|jjtjj|d <|jj |d <|jd|d <i}t|g|d<i}t|d<tjj|d<t|jg|d<t t!j"jt#|$d|d<t%t&|}||fS)Nz%s@%s_%srIprealmrpnameflagsauthtime starttimeendtime renew-tillsrealmrU ticket-inforlrmticketsrkrS)'rGrrrHrsha1rQr\ hexdigestrrIrXrIntegerBitStringrLcastr rJr}datetime fromtimestamptimezoneutcr~r renew_tillrrr KRB_CREDr_rr[rr NULLr dumprr)rfilename krbcredinfo enc_krbcredkrbcredkirbirrrto_kirbis22      zCredential.to_kirbircCs8|jj}t}t|ddj}|dd}t|d|d|_t|ddd krY|ddd  |d  krYt d |d}|ddd |d<t||d |_ n t|d|d |_ t ||_t|d |_d|_t|dtjj|_d|_d|_tt|dd|_t|_|S)NrSrYrrr{rzrUrVrrz-SNAME contains the realm as well, trimming itrIr|r)kirbiobjr]rFr r[CCACHEPrincipal from_asn1rGr&upperrdebugrHTimesrJKeyblockrIrKr rrrrLrMrOCCACHEOctetStringrrrQemptyrR)rrc enc_credinfo ticket_infor3rrr from_kirbis( 4   zCredential.from_kirbicCst}t|d|d|_t|d|d|_t|d|_d|_t|d t j j |_ d|_d|_t|dd |_t|_|S) Nr{rzrUrrIrr|rSrY)rFrrrGrHrrIrKr rrrr]rLrMrOrrQrrR)rQr+rrrrrs zCredential.from_asn1cCst}t||_t||_t||_t||_t j | dddd|_ t j | dddd|_ t j | dddd|_t|jD] }|jt|qDt j | dddd|_t|jD] }|jt|qat||_t||_|SNrWrFr rAlittle)rFrr/rGrHrrIrrJr'r(r)rKrLrMrangerNr*AddressrOrPAuthdatarrQrR)r,r_rrrr/s       zCredential.parsecCsgdS)N)rGrHr~rrrrrrrsummary_headerszCredential.summary_headercCsd|jjdd|jjfd|jjdd|jjf|jjdkr,tj|jjnd|jj dkr=tj|jj nd|jj dkrOtj|jj gSdgS)Nz%s@%s/ separatorrzN/A) rGrrrXrHrJr~rr isoformatrrrrrrsummarys""zCredential.summarycCs|j}||j7}||j7}||j7}||jjdddd7}||jjdddd7}||jjdddd7}|jD]}||7}q>||j jdddd7}|j D]}||7}qU||j 7}||j 7}|Sr) rGr1rHrIrJrKrLrMrNrOrPrQrR)rr3addradrrrr1s   zCredential.to_bytesN)r6r7r8rrgrvrxrr9rrrr/rrr1rrrrrFQs     rFc@s<eZdZddZeddZddZeddZd d Zd S) rcCd|_d|_d|_d|_dSr)keytyperTkeylenkeyvaluerrrrr zKeyblock.__init__cCs2t}|d|_d|_t|d|_|d|_|S)Nrrr)rrrTr&rr)r+krrrrs   zKeyblock.from_asn1cCsi}|j|d<|j|d<|S)Nrr)rrr2rrrr\(s  zKeyblock.to_asn1cCs`t}tj|dddd|_tj|dddd|_tj|dddd|_||j|_|SNrrTr F)rr'r(r)rrTrr)r,rrrrr//s zKeyblock.parsecCsL|jjdddd}||jjdddd7}||jjdddd7}||j7}|Sr)rr1rTrrr2rrrr18s  zKeyblock.to_bytesN) r6r7r8rr9rr\r/r1rrrrrs    rc@sbeZdZddZeddZeejejj fddZ eddZ d d Z ed e fd d ZdS)rcCrr)r}r~rrrrrrrArzTimes.__init__cCst}d|vr|drt|dnd|_d|vr"|dr"t|dnd|_d|vr3|dr3t|dnd|_d|vrG|drGt|d|_|Sd|_|S)Nr}rr~rr)rr r}r~rr)enc_as_rep_partr3rrrrGs&   zTimes.from_asn1cCsJt}t||_t||_t|tjdd|_t|tjdd|_|S)NrW)daysr)rr r}r~r timedeltarr)startr3rrr dummy_timeTs   zTimes.dummy_timecCsjt}tj|dddd|_tj|dddd|_tj|dddd|_tj|dddd|_|Sr@)rr'r(r)r}r~rr)r,r3rrrr/]s z Times.parsecCsX|jjdddd}||jjdddd7}||jjdddd7}||jjdddd7}|Sr@)r}r1r~rrr2rrrr1fs zTimes.to_bytesr+cCrCr)rr/r#r$r4rrrr(mrDzTimes.from_bytesN)r6r7r8rr9rrnowrrrr/r1r:r(rrrrr@s   rc@s6eZdZddZeddZddZdefdd Zd S) rcCr<r)addrtypeaddrdatarrrrrrr?zAddress.__init__cC.t}tj|dddd|_t||_|Sr0)rr'r(r)rrr/rr,arrrr/v z Address.parsecC$|jjdddd}||j7}|Sr0)rr1rr2rrrr1}zAddress.to_bytesr+cCrCr)rr/r#r$r4rrrr(zAddress.from_bytesN) r6r7r8rr9r/r1r:r(rrrrrqs  rc@s>eZdZddZedejfddZddZde fd d Z d S) rcCr<r)authtyperPrrrrrr?zAuthdata.__init__r,cCrr0)rr'r(r)rrr/rPrrrrr/rzAuthdata.parsecCrr0)rr1rPr2rrrr1rzAuthdata.to_bytesr+cCrCr)rr/r#r$r4rrrr(rzAuthdata.from_bytesNrErrrrrs rc@sbeZdZddZeddZeddZddd Zd d Zd d Z eddZ ddZ ddZ dS)rcCsd|_d|_d|_g|_dSr) name_typenum_componentsrX componentsrrrrrrzCCACHEPrincipal.__init__cCsNt}|d|_t|d|_t||_|dD] }|jt |q|S)N name-typerV) rrr&rr from_stringrXrr*r) principalrXpcomprrrrs   zCCACHEPrincipal.from_asn1cCsBt}d|_d|_td|_tdD] }|jtdq|S)NrWz kerbi.corpkerbi) rrrrrrXrrr*)rrrrrrs  zCCACHEPrincipal.empty-cCs|dd|jDS)NcSg|]}|qSrrr.0rrrr z-CCACHEPrincipal.to_string..)joinr)rrrrrrrszCCACHEPrincipal.to_stringcCs&|jdd|jDd}||jfS)NcSrrrrnamerrrrrz+CCACHEPrincipal.to_asn1..)rrV)rrrXrrr2rrrr\szCCACHEPrincipal.to_asn1cCs$ddd|jDd|jS)NrcSrrrrrrrrrz*CCACHEPrincipal.to_spn..@)rrrXrrrrrrto_spns$zCCACHEPrincipal.to_spncCsht}tj|dddd|_tj|dddd|_t||_t |jD] }|j t|q&|Sr@) rr'r(r)rrrr/rXrrr*)r,rrrrrr/s zCCACHEPrincipal.parsecCsV|jjdddd}|t|jjdddd7}||j7}|jD]}||7}q |Sr@)rr1r&rrX)rr3comrrrr1s  zCCACHEPrincipal.to_bytescCs,|jd}|ddd|jD7}|S)NrcSrrrrrrrrrz+CCACHEPrincipal.__str__..)rXrrrrr2rrrr5szCCACHEPrincipal.__str__N)r) r6r7r8rr9rrrrr\rr/r1r5rrrrrs     rc@sneZdZddZeddZddZddZed d Zed d Z ed dZ ddZ de de fddZdS)rcCr<r)lengthr+rrrrrr?zCCACHEOctetString.__init__cCst}d|_d|_|S)Nrrj)rrr+)orrrrszCCACHEOctetString.emptycCs|jSrr4rrrrr\szCCACHEOctetString.to_asn1cCs |jSr)r+decoderrrrrrs zCCACHEOctetString.to_stringcCs t}||_t|j|_|Sr)rencoder+r&rr+rrrrrs  zCCACHEOctetString.from_stringcCs2t}t||_t|tr||_|S||_|Sr)rr&r isinstancestrrr+rrrrrs   zCCACHEOctetString.from_asn1cCs0t}tj|dddd|_||j|_|Sr@)rr'r(r)rr+)r,rrrrr/szCCACHEOctetString.parsecCsHt|jtr|j|_t|j|_t|jjdddd}||j7}|Sr@)rr+rrr&rr1r2rrrr1s    zCCACHEOctetString.to_bytes_CCACHEOctetString__oreturncCst|tr ||kSdSNF)rrr1)rrrrr__eq__ s zCCACHEOctetString.__eq__N)r6r7r8rr9rr\rrrrr/r1objectboolrrrrrrs    rc@s<eZdZdZd@ddZddZddZdAd d Zd@d d ZdAde fddZ ddZ ddZ d@de defddZdBdefddZddZddZed ejfd!d"Zd#d$Zd%d&Zed'e fd(d)Zed*efd+d,Zed-d.Zd/efd0d1Zed2d3Zd4d5Zed6d7Z ed8d9Z!d:d;Z"dd?Z$dS)CCCACHEz As the header is rarely used -mostly static- you'd need to init this object with empty = True to get an object without header already present FcCs0d|_g|_d|_g|_|dkr|dSdSr)file_format_versionr-primary_principal credentials_CCACHE__setup)rrrrrrs zCCACHE.__init__cCs8d|_t}d|_d|_d|_|j|t|_ dS)NirWrys) rrrrrr-r*rrr)rheaderrrr__setups zCCACHE.__setupcCs<d}|d|j7}|jD]}|d|7}q |d|j7}|S)Nz == CCACHE == zfile_format_version : %s z%s zprimary_principal : %s )rr-r)rr3rrrrr5's  zCCACHE.__str__TcCt}t|d|d|_|dkr|j|_t|d|d|_t||_t|d|_ d|_ t |d t jj|_d|_d|_tt|d |_t|_|j|d S) a Creates credential object from the TGT and adds to the ccache file The TGT is basically the native representation of the asn1 encoded AS_REP data that the AD sends upon a succsessful TGT request. This function doesn't do decryption of the encrypted part of the as_rep object, it is expected that the decrypted XXX is supplied in enc_as_rep_part override_pp: bool to determine if client principal should be used as the primary principal for the ccache file rornTrUrrIrr|rQNrFrrrGrrHrrJrrIrKr rrrr]rLrMrOrrrrQrrRrr*)ras_repr override_pprrrradd_tgt/   zCCACHE.add_tgtcCr) a Creates credential object from the TGS and adds to the ccache file The TGS is the native representation of the asn1 encoded TGS_REP data when the user requests a tgs to a specific service principal with a valid TGT This function doesn't do decryption of the encrypted part of the tgs_rep object, it is expected that the decrypted XXX is supplied in enc_as_rep_part override_pp: bool to determine if client principal should be used as the primary principal for the ccache file rornTrUrrIrr|rQNr)rtgs_repenc_tgs_rep_partrrrrradd_tgsIrzCCACHE.add_tgsrcCs*t|}|dkr |j|_|j|dS)NT)rFrrGrrr*)rrrrrrr add_kirbids zCCACHE.add_kirbicCsBg}|jD]}|jjddddkr||dq|S)z Returns a list of AS_REP tickets in kirbi format (Kirbi). To determine which ticket are AP_REP we check for the server principal to be the kerberos service rrkrbtgtrr)rrHrrlowerfindr*rrtgtscredrrrget_all_tgt_kirbisjs  zCCACHE.get_all_tgt_kirbiscCs>g}|jD]}|jjddddkr||q|S)z Returns a list of AS_REP tickets in native format (dict). To determine which ticket are AP_REP we check for the server principal to be the kerberos service rrrr)rrHrrrrr*rvrrrr get_all_tgtvs  zCCACHE.get_all_tgtspnstrictcCs|}|D]/\}}d|dddd|dd}|t|kr5td|||dfSq|durCddtd |fS|d d |d d dfS) NrrQrUrVrrXzFound TGS for SPN %sTzNo TGS found for SPN %srrW) get_all_tgsrrrrr Exception)rrrtgsstgs keystruct ticket_forrrrget_tgss &zCCACHE.get_tgsNc Cszdd|D}t|dkrddtdfS|durh|dur0td|dd|dddfS|durh|D]\}}|dd t|d krUtd |||dfSq6td |dd|dddfS|D]3\}}t|d t|}d|dd d |d}||krtd |||dfSqj|durtd|dd|dddfSddtd|fS)NcSsg|]}|qSrr)rxrrrrsz"CCACHE.get_tgt..rzNo TGT found in CCACHE fileFz0Missing username, returning first availabla TGT!rWrorVrzFound TGT for user %sz>Missing domain, user not found, returning first availabla TGT!rrrnz;domain+user combo not found, returning first availabla TGT!zNo TGT found for user %s) rr&rrrrrrr) rusernamedomainrrtgtr our_userr rrrget_tgts4      zCCACHE.get_tgtcCs>g}|jD]}|jjddddkr||q|S)Nrrrr)rrHrrrrr*rx)rr rrrrrs  zCCACHE.get_all_tgscCs"g}|jD] }||q|S)z Returns a list of hashes in hashcat-firendly format for tickets with encryption type 23 (which is RC4) all_hashes: overrides the encryption type filtering and returns hash for all tickets )rr*rg)rhashesrrrr get_hashess zCCACHE.get_hashesr,cCstd}tj|dddd|_tj|dddd}t|||_t||_ | }| dd| }| |d| |krot |}t |jjdkrc|jjddkrc|jjd ksi|j|| |ksD|S) NTrrFr rrkrb5_ccache_conf_dataz X-CACHECONF:)rr'r(r)rrr/r-rrr%seekrFr&rHrrrrXrr*)r,rhdr_sizeposeofrrrrr/s      $  z CCACHE.parsecCsx|jjdddd}d}|jD]}||7}q|t|jdddd7}||7}||j7}|jD]}||7}q1|S)NrrFr rj)rr1r-r&rr)rr3t_hdrrrrrrr1s  zCCACHE.to_bytesccs"|jD] }|j}|VqdSr)rrHr)rrtargetrrr list_targetss   zCCACHE.list_targets kirbidatacCs2t|tdur t|}n|}t}|||Sr)rrr(rr)rrccrrrrs   zCCACHE.from_kirbikirbi_filenamecCsttj|}d}t|d }|}Wdn1swYzt|}W|St|}t|}Y|S)Nrb) ospathabspathopenr)rrrfrom_b64)r kf_absrfccacherrrrfrom_kirbifiles      zCCACHE.from_kirbifilecCsDt}tjtj|d}t|D] }t|}||q|S)zk Iterates trough all .kirbi files in a given directory and converts all of them into one CCACHE object z*.kirbi) rr"r#rr$globr from_filer)directory_pathrdir_pathrrrrr from_kirbidirs   zCCACHE.from_kirbidirr-cCsPtj|}|jD]}|\}}d|dd}tj||}||q dS)a Converts all credential object in the CCACHE object to the kirbi file format used by mimikatz. The kirbi file format supports one credential per file, so prepare for a lot of files being generated. directory_path: str the directory to write the kirbi files to z%s.kirbiz..!N)r"r#r$rrreplacerto_file)rr-r'rrrfilepathrrr to_kirbidir!s    zCCACHE.to_kirbidircCs8t|d }t|WdS1swYdS)z8 Parses the ccache file and returns a CCACHE object r!N)r%rr/)rr(rrrr,/s $zCCACHE.from_filecCs>t|d}||WddS1swYdS)z8 Writes the contents of the CCACHE object to a file wbN)r%writer1)rrr(rrrr27s "zCCACHE.to_filecCrCr)rr/r#r$r4rrrr(>rDzCCACHE.from_bytescCrCr)rr(r:fromhex)hexdatarrrfrom_hexBrDzCCACHE.from_hexcCs |Sr)r1r`rrrrto_hexFs z CCACHE.to_hexcCst|dS)Nascii)base64 b64encoder1rrrrrto_b64Isz CCACHE.to_b64cCrCr)rr(r< b64decode)b64datarrrr&LrDzCCACHE.from_b64)F)Tr)%r6r7r8__doc__rrr5rrrrrrrrr rrrr9r#r$r/r1rrrr*r/r4r,r2r(r9r:r>r&rrrrrsH      (       r))r"r#rr+r<typingr"minikerberos.protocol.asn1_structsrrrrrrr r minikerberos.common.utilsr minikerberos.protocol.constantsr r minikerberosr asn1cryptor unicryptorminikerberos.common.kirbirminikerberos.common.spnrrr;rFrrrrrrrrrrrs2 (      %G)1?8