o
    Žõ±jD  ã                   @   sª   d dl Z d dlZd dlZd dlmZmZmZmZmZm	Z	 d dl
mZ d dlmZ d dlmZmZ d dlmZ G dd„ dƒZG d	d
„ d
ƒZG dd„ dƒZG dd„ deƒZdS )é    N)ÚWindowsBuildÚWindowsMinBuildÚKatzSystemArchitectureÚAGenericReaderÚUniversalEncoderÚhexdump)Úfiletime_to_dt)Ú%MSV1_0_PRIMARY_CREDENTIAL_STRANGE_DEC)ÚKIWI_CREDMAN_LIST_STARTERÚKIWI_CREDMAN_SET_LIST_ENTRY)ÚPackageDecryptorc                   @   ó,   e Zd Zdd„ Zdd„ Zdd„ Zdd„ Zd	S )
ÚMsvCredentialc                 C   s4   d| _ d | _d | _d | _d | _d | _d | _d | _d S )NÚmsv)ÚcredtypeÚusernameÚ
domainnameÚNThashÚLMHashÚSHAHashÚDPAPIÚisoProt©Úself© r   ú /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/alsadecryptor/packages/msv/decryptor.pyÚ__init__   s   
zMsvCredential.__init__c                 C   óD   i }| j |d< | j|d< | j|d< | j|d< | j|d< | j|d< |S )Nr   r   r   r   r   r   )r   r   r   r   r   r   ©r   Útr   r   r   Úto_dict   s   





zMsvCredential.to_dictc                 C   ó   t j|  ¡ td�S ©N)Úcls©ÚjsonÚdumpsr    r   r   r   r   r   Úto_json&   ó   zMsvCredential.to_jsonc                 C   s¨   d}|d| j r
| j nd 7 }|d| jr| jnd 7 }|d| jr$| j ¡ nd 7 }|d| jr2| j ¡ nd 7 }|d| jr@| j ¡ nd 7 }|d| jrN| j ¡ nd 7 }|S )	Nz	== MSV ==
z		Username: %s
ÚNAz		Domain: %s
z			LM: %s
z			NT: %s
z		SHA1: %s
z		DPAPI: %s
)r   r   r   Úhexr   r   r   r   r   r   r   Ú__str__)   s   zMsvCredential.__str__N©Ú__name__Ú
__module__Ú__qualname__r   r    r'   r+   r   r   r   r   r      s
    r   c                   @   r   )
ÚCredmanCredentialc                 C   s(   d| _ d | _d | _d | _d| _d | _d S )NÚcredmanó    )r   Úluidr   ÚpasswordÚpassword_rawr   r   r   r   r   r   4   s   
zCredmanCredential.__init__c                 C   r   )Nr   r   r   r4   r5   r3   )r   r   r   r4   r5   r3   r   r   r   r   r    <   s   





zCredmanCredential.to_dictc                 C   s   t  |  ¡ ¡S ©N)r%   r&   r    r   r   r   r   r'   F   s   zCredmanCredential.to_jsonc                 C   sX   d| j  }|d| j  7 }|d| j 7 }|d| j 7 }|d| j 7 }|d| j ¡  7 }|S )Nz	== CREDMAN [%x]==
z
		luid %s
z		username %s
z		domain %s
z		password %s
z		password (hex)%s
)r3   r   r   r4   r5   r*   r   r   r   r   r+   I   s   
zCredmanCredential.__str__Nr,   r   r   r   r   r0   3   s
    
r0   c                   @   sP   e Zd Zg d¢Zdd„ Zedd„ ƒZdd„ Zdd	„ Zd
d„ Z	dd„ Z
dd„ ZdS )ÚLogonSession)
ÚpackagenameÚdomainÚuserÚNTÚLMÚSHA1Ú	masterkeyÚsha1_masterkeyÚkey_guidÚ	plaintextc                 C   sj   d | _ d | _d | _d | _d | _d | _d | _d | _g | _g | _	g | _
g | _g | _g | _g | _g | _g | _d S r6   )Úauthentication_idÚ
session_idr   r   Úlogon_serverÚ
logon_timeÚsidr3   Ú	msv_credsÚwdigest_credsÚ	ssp_credsÚlivessp_credsÚdpapi_credsÚkerberos_credsÚcredman_credsÚtspkg_credsÚcloudap_credsr   r   r   r   r   V   s"   
zLogonSession.__init__c              
   Ã   sÖ   �zKt ƒ }| j|_| j|_| j |¡I dH |_| j |¡I dH |_	| j
 |¡I dH |_| jdkr8t| jƒ ¡ |_| j |¡I dH }t|ƒ|_| j|_|W S  tyj } zddl}| ¡  tƒ  W Y d}~dS d}~ww )zA
		Converts KIWI_MSV1_0_LIST type objects into a unified class
		Nr   )r7   ÚLocallyUniqueIdentifierrB   ÚSessionrC   ÚUserNameÚread_stringr   ÚDomainer   ÚLogonServerrD   Ú	LogonTimer   Ú	isoformatrE   ÚpSidÚreadÚstrrF   r3   Ú	ExceptionÚ	tracebackÚ	print_excÚinput)ÚentryÚreaderÚlscÚtsÚer\   r   r   r   Úparsej   s(   €

€ýzLogonSession.parsec                 C   s®  i }| j |d< | j|d< | j|d< | j|d< | j|d< | j|d< | j|d< | j|d< g |d	< g |d
< g |d< g |d< g |d< g |d< g |d< g |d< g |d< | jD ]}|d	  	| 
¡ ¡ qQ| jD ]}|d
  	| 
¡ ¡ q`| jD ]}|d  	| 
¡ ¡ qo| jD ]}|d  	| 
¡ ¡ q~| jD ]}|d  	| 
¡ ¡ q�| jD ]}|d  	| 
¡ ¡ qœ| jD ]}|d  	| 
¡ ¡ q«| jD ]}|d  	| 
¡ ¡ qº| jD ]}|d  	| 
¡ ¡ qÉ|S )NrB   rC   r   r   rD   rE   rF   r3   rG   rH   rI   rJ   rK   rL   rM   rN   rO   )rB   rC   r   r   rD   rE   rF   r3   rG   Úappendr    rH   rI   rJ   rK   rL   rM   rN   rO   ©r   r   Úcredr   r   r   r    �   sJ   
















zLogonSession.to_dictc                 C   r!   r"   r$   r   r   r   r   r'   ¨   r(   zLogonSession.to_jsonc                 C   sþ  d}|d| j | j f 7 }|d| j 7 }|d| j 7 }|d| j 7 }|d| j 7 }|d| j 7 }|d| j 7 }|d	| j 7 }t| j	ƒd
krR| j	D ]
}|dt
|ƒ 7 }qGt| jƒd
kre| jD ]}|t
|ƒ7 }q\t| jƒd
krx| jD ]}|t
|ƒ7 }qot| jƒd
kr‹| jD ]}|t
|ƒ7 }q‚t| jƒd
krž| jD ]}|t
|ƒ7 }q•t| jƒd
kr±| jD ]}|t
|ƒ7 }q¨t| jƒd
krÄ| jD ]}|t
|ƒ7 }q»t| jƒd
kr×| jD ]}|t
|ƒ7 }qÎt| jƒd
krê| jD ]}|t
|ƒ7 }qát| jƒd
krý| jD ]}|t
|ƒ7 }qô|S )Nz== LogonSession ==
zauthentication_id %s (%x)
zsession_id %s
zusername %s
zdomainname %s
zlogon_server %s
zlogon_time %s
zsid %s
zluid %s
r   z%s)rB   rC   r   r   rD   rE   rF   r3   ÚlenrG   rZ   rH   rI   rJ   rL   rM   rN   rK   rO   rf   r   r   r   r+   «   sP   









zLogonSession.__str__c                 c   s†  � | j D ]Z}| ¡ }| jd| j| jdd| j| jd|d r"|d  ¡ ndg
V  | jd| j| jdd| j| jd|d r>|d  ¡ ndg
V  | jd| j| jdd| j| jd|d rZ|d  ¡ ndg
V  q| jD ]}| ¡ }| j|d	 | j| j|d	 d| j| jd
|d g
V  qb| j	D ]}| ¡ }| j|d	 | j| j|d	 d| j| jd
|d g
V  q„| j
D ]}| ¡ }| j|d	 | j| j|d	 d| j| jd
|d g
V  q¦| jD ]6}| ¡ }| j|d	 | j| j|d	 d| j| jd|d g
V  | j|d	 | j| j|d	 d| j| jd|d g
V  qÈ| jD ]}| ¡ }| j|d	 | j| j|d	 d| j| jd
|d g
V  �q| jD ]}| ¡ }| j|d	 | j| j|d	 d| j| jd
|d g
V  �q%| jD ]}| ¡ }| j|d	 | j| j|d	 d| j| jd
|d g
V  �qH| jD ]U}| ¡ }| j|d	 | j| j|d	 d| j| jdt| ¡ ƒg
V  | j|d	 | j| j|d	 d| j| jdt|d ƒg
V  | j|d	 | j| j|d	 d| j| jdt|d ƒg
V  �qkd S )Nr   Ú r;   r   r<   r   Úsha1r   r   rA   r4   r>   r?   Údpapi_key_sha1ÚPRT)rG   r    r3   rC   rF   r   r   r*   rH   rI   rJ   rK   rL   rM   rN   rO   rZ   Úget_masterkey_hex)r   rg   r   r   r   r   Úto_rowÕ   sD   €
88:
2
2
2
02
4
4
4
448üzLogonSession.to_rowc                 c   sN  � | j D ]3}| ¡ }d| j| j|d r|d  ¡ nd|d r$|d  ¡ nd|d r/|d  ¡ ndddddg
V  q| j| j| j| j| j	fD ].}|D ])}| ¡ }|d d urqt
|d ƒt
|d ƒt
|d	 ƒddddddt
|d ƒg
V  qHqD| jD ]\}| ¡ }|d d usˆ|d
 d urÒd}|d
 d ur¯d|d
  }t
|d ƒt
|d ƒt
|d	 ƒdddddd|g
V  |d d urÒt
|d ƒt
|d ƒt
|d	 ƒddddddt
|d ƒg
V  qv| jD ]#}| ¡ }t
|d ƒdddddt
|d ƒt
|d ƒt
|d ƒdg
V  qÖ| jD ]'}| ¡ }t
|d ƒdddddt
| ¡ ƒt
|d ƒt
|d ƒt
|d ƒg
V  qýd S )Nr   r   ri   r   r   r4   r   r   r   Úpinz[PIN]%sr>   r?   r@   rk   rl   )rG   r    r   r   r*   rH   rI   rJ   rM   rN   rZ   rL   rK   rO   rm   )r   rg   r   Úpackagero   r   r   r   Úto_grep_rowsø   sL   €
ö:€ý
2:€
<
DþzLogonSession.to_grep_rowsN)r-   r.   r/   Úgrep_headerr   Ústaticmethodrd   r    r'   r+   rn   rq   r   r   r   r   r7   S   s    
'*#r7   c                       sT   e Zd Z‡ fdd„Zdd„ Zdd„ Zdd„ Zd	d
„ Zdd„ Zdd„ Z	dd„ Z
‡  ZS )ÚMsvDecryptorc                    s@   t ƒ  d|||¡ || _|| _g | _i | _i | _d | _d | _d S )NÚMsv)	Úsuperr   Údecryptor_templateÚcredman_decryptor_templateÚentriesÚentries_seenÚlogon_sessionsÚlogon_session_countÚcurrent_logonsession)r   r`   rw   Úlsa_decryptorÚcredman_templateÚsysinfo©Ú	__class__r   r   r   %  s   
zMsvDecryptor.__init__c                 Ã   sH  �|   d| jj¡I d H }d| _| jjtjkr^| jjt	j
jks6tj
j| jj  kr.tjjk r^n n.| jjdkr^| j || jj ¡I d H }| j |¡I d H  | j d¡I d H }tj|ddd�| _d}| jjdkr†|| jj }| j |¡I d H  | j d¡I d H }tj|d	dd�}| j || jj ¡I d H }||7 }| j |¡I d H }||fS )
Nz
lsasrv.dllé   i   `ÚbigF)Ú	byteorderÚsignedr   é   Úlittle)Úfind_signaturerw   Ú	signaturer|   r€   Úarchitecturer   ÚX64Úbuildnumberr   ÚWIN_8Úvaluer   ÚWIN_BLUEÚmsv_dll_timestampr`   Úget_ptr_with_offsetÚoffset2ÚmoverY   ÚintÚ
from_bytesÚfirst_entry_offset_correctionÚfirst_entry_offsetÚget_ptr)r   ÚpositionÚptr_entry_locr   Úadditional_offsetÚ	offsetposÚ	ptr_entryr   r   r   Úfind_first_entry0  s&   €@zMsvDecryptor.find_first_entryc                 Ã   sv   �t  || j¡I d H | _|jjdkr|  |¡I d H  |jjdkr,|  |j| j	¡I d H  n|  
d¡ | j| j| jj< d S )Nr   z!No credentials in this structure!)r7   rd   r`   r}   ÚCredentialManagerr�   Úparse_credman_credentialsÚCredentials_list_ptrÚ	walk_listÚadd_credentialsÚlogr{   r3   )r   r_   r   r   r   Ú	add_entryI  s   €
zMsvDecryptor.add_entryc                 Ã   s   �|   |j| j¡I d H  d S r6   )r£   ÚPrimaryCredentials_ptrÚadd_primary_credentials)r   Úprimary_credentials_list_entryr   r   r   r¤   U  s
   €þzMsvDecryptor.add_credentialsc                 Ã   s”   �|   |jjd¡I d H  |jj| jtd�I d H }|   |jjd¡I d H  |jj| jtd�I d H }|jj|jj	krH| j
|j| j| jjd�I d H  d S d S )Nr   )Úoverride_finaltyper
   )Úoverride_ptr)Úlog_ptrr    r�   rY   r`   r   Úlist1r
   ÚstartÚlocationr£   Úadd_credman_credentialrx   Ú
list_entry)r   Úlogon_sessionÚcredman_set_list_entryÚlist_starterr   r   r   r¡   [  s   €"ÿz&MsvDecryptor.parse_credman_credentialsc                 Ã   sÈ   �t ƒ }|j | j¡I d H |_|j | j¡I d H |_|jrV|jdkrV|j 	| j|j¡I d H }|j 
d¡du rM| j|dd�\|_|_|jd urL|j ¡ |_n	|  |¡\|_|_| jj|_| jj |¡ d S )Nr   ú$T©Úbytes_expected)r0   r:   rS   r`   r   Úserver2r   ÚcbEncPasswordÚencPasswordÚread_rawÚendswithÚdecrypt_passwordr4   r5   r*   r}   r3   rM   re   )r   Úcredman_credential_entryÚcÚenc_datar   r   r   r°   c  s   €
€
z#MsvDecryptor.add_credman_credentialc           	   
   Ã   sØ  �|j  | j¡I d H }|sd S |  dt|ƒ ¡ |  d¡ | j|dd�\}}|  d| jjjt|ƒf ¡ t	|| j
jƒ}t|ƒtjkrS|dd… dkrSt |¡I d H }n
| jj |¡I d H }tƒ }|jr‹z|j |¡I d H |_W n tyŠ } z|  d	t|ƒ ¡ W Y d }~nd }~ww |jr¶z|j |¡I d H |_W n tyµ } z|  d
t|ƒ ¡ W Y d }~nd }~ww t|dƒrÄ|jdkrÄ|j|_t|dƒrÏt|jƒ|_|j|_|j rß|j dkrß|j |_!|j"|_#| j$j% &|¡ d S )NzEncrypted credential data 
%szDecrypting credential structureTr¶   z%s: 
%sr‡   é   s   ÌÌÌÌz#Failed to get username, reason : %sz%Failed to get domainname, reason : %sÚDPAPIProtecteds                   ÚisIso)'Úencrypted_credentialsÚ	read_datar`   r¥   r   r½   rw   Údecrypted_credential_structr-   r   r€   r‹   rh   r	   ÚsizeÚloadr   rR   rS   r   r[   rZ   ÚLogonDomainNamer   ÚhasattrrÂ   r   ÚboolrÃ   r   ÚNtOwfPasswordr   ÚLmOwfPasswordr   ÚShaOwPasswordr   r}   rG   re   )	r   Úprimary_credentials_entryÚencrypted_credential_dataÚdec_dataÚraw_decÚstruct_readerÚcreds_structrg   rc   r   r   r   r¨   w  sH   €
€ÿ€ÿ
z$MsvDecryptor.add_primary_credentialsc                 Ã   s”   �|   ¡ I d H \}}t| jƒD ]8}| j |¡I d H  t|d ƒD ]
}| j ¡ I d H  q | jj | j¡I d H }|j	|j
kr=q|  || j¡I d H  qd S )Né   )rŸ   Úranger|   r`   r”   Úread_intrw   r±   rÈ   r¯   r�   r£   r¦   )r   Úentry_ptr_valueÚentry_ptr_locÚiÚ_Ú	entry_ptrr   r   r   r®   ²  s   €òzMsvDecryptor.start)r-   r.   r/   r   rŸ   r¦   r¤   r¡   r°   r¨   r®   Ú__classcell__r   r   r�   r   rt   $  s    ;rt   )Úior%   Úbase64Úpypykatz.commons.commonr   r   r   r   r   r   Úpypykatz.commons.filetimer   Ú-pypykatz.alsadecryptor.packages.msv.templatesr	   Ú1pypykatz.alsadecryptor.packages.credman.templatesr
   r   Ú&pypykatz.alsadecryptor.package_commonsr   r   r0   r7   rt   r   r   r   r   Ú<module>   s    $  R