o
    Žõ±j!/  ã                   @   sŠ   d dl Z d dlZd dlZd dlZd dlZd dlZd dlmZ d dlmZ d dl	m
Z
 d dlmZ d dlmZ d dl	mZ G dd	„ d	ƒZdS )
é    N)Úlogger)Úpypykatz)ÚUniversalEncoder)ÚLogonSession)ÚMinidumpFile)ÚKatzSystemInfoc                   @   s<   e Zd Zdd„ Zdd„ Zdd„ Zdd„ Zd	d
„ Zdd„ ZdS )ÚLSACMDHelperc                 C   s   dg| _ dg| _d S )NÚlsa)Úlive_keywordsÚkeywords)Úself© r   ú’/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/lsadecryptor/cmdhelper.pyÚ__init__   s   zLSACMDHelper.__init__c                 C   sh  |j ddd�}|jdddd� |jdd	dd
d� |jdddd� |jdddd� |jddddd� |jdddgddd� |jddg d¢dddd� |j dd d�}|jd!g d"¢d#� |jd$d%d� |jd&d'td(d)� |jdddd� |jdd	dd
d� |jdddd� |jdddd� |jd*d+dd,d� |jd-d.dd/d� |jddddd� |jddg d¢dddd� d S )0Nr	   zGet all secrets from LSASS)Úhelpz--jsonÚ
store_truez Print credentials in JSON format)Úactionr   z-ez--halt-on-errorz*Stops parsing when a file cannot be parsedz-oz	--outfilez[Save results to file (you can specify --json for json file, or text format will be written)z-kz--kerberos-dirz%Save kerberos tickets to a directory.z-gz--grepz%Print credentials in greppable formatz--methodÚprocopenÚ	handledupzLSASS process access method)ÚchoicesÚdefaultr   z-pz
--packages)	ÚallÚmsvÚwdigestÚtspkgÚsspÚlivesspÚdpapiÚcloudapÚkerberosú+r   zLSASS package to parse)r   Únargsr   r   zGet secrets from memory dumpÚcmd)ÚminidumpÚrekallÚinfoÚzipdump)r   Ú
memoryfilezpath to the dump filez-tz--timestamp_overridez;enforces msv timestamp override (0=normal, 1=anti_mimikatz))Útyper   z-rz--recursivezRecursive parsingz-dz--directoryz Parse all dump files in a folder)Ú
add_parserÚadd_argumentÚint)r   ÚparserÚlive_parserÚ
live_groupÚgroupr   r   r   Úadd_args   s(   zLSACMDHelper.add_argsc                 C   sb   t | jƒdkr|j| jv r|  |¡ t | jƒdkr+|jdkr-|j| jv r/|  |¡ d S d S d S d S )Nr   Úlive)Úlenr   ÚcommandÚrunr
   ÚmoduleÚrun_live)r   Úargsr   r   r   Úexecute3   s
   
$ÿzLSACMDHelper.executec                 C   s  |j r(|jr(t|j dƒ�}tj||tddd� W d   ƒ n1 s!w   Y  �né|j rw|jrwt|j dddd��6}| d tj	¡d	 ¡ |D ] }|| j
D ]}|| j
|  ¡ D ]}| d |¡d	 ¡ qWqLqEW d   ƒ n1 spw   Y  �nš|j rêt|j ddd
��^}|D ]<}| d| ¡ || j
D ]}| dt|| j
| ƒ ¡ q“t|| jƒdkrÁ| d¡ || jD ]	}| t|ƒ¡ q·q…t|ƒdkrÙ| d¡ |D ]	}	| d|	 ¡ qÏW d   ƒ n1 sãw   Y  �n'|jrúttj|tddd�ƒ �n|j�rot|dƒ�r|jd u�rtd dgtj	 ¡ƒ ntd tj	¡ƒ |D �]L}|| j
D ](}|| j
|  ¡ D ]}t|dƒ�rF|jd u�rF|g| }td |¡ƒ �q3�q(|| jD ]Ê}| ¡ }
|
d dk�r›t|
d ƒdddddt| ¡ ƒt|
d ƒt|
d ƒ|
d g
}t|dƒ�r’|jd u�r’|g| }td |¡ƒ �qV|
d dk�rç|
 dd ¡d u�rå|
d d u�råt|
d ƒt|
d ƒt|
d ƒdddddt|
d ƒg	}t|dƒ�rÞ|jd u�rÞ|g| }td |¡ƒ �qV| ¡ }
t|
d ƒdddddt|
d ƒt|
d ƒt|
d ƒdg
}t|dƒ�r|jd u�r|g| }td |¡ƒ �qV|| jD ]E\}}t|ƒd	 d	 t |j¡¡ }t | ¡ ¡ ¡ }|d dddddddd|g
}t|dƒ�ra|jd u�ra|g| }td |¡d	 ƒ �q&�q n¢|D ]Š}td| ƒ t|| tƒ�r‰t|| ƒ �qq|| j
D ]}tt|| j
| ƒƒ �qŽt|| jƒdk�rºtd ƒ || jD ]	}tt|ƒƒ �q°t|| jƒdk�rútd!ƒ || jD ],\}}t|ƒd	 d	 t |j¡¡ }t  |¡ t | ¡ ¡ ¡ }td"|d |f ƒ �qÍ�qqt|ƒdk�rtd#ƒ |D ]}	t|	ƒ �q	|j!�r‚t"j# $|j!¡}t %d$| ¡ |D ]^}	t& '|	¡}d%|t" (d¡ )¡ f }||	 j* +t"j# ||¡¡ ||	 j
D ]}||	 j
| j,D ]}|j-D ]}| .|¡ �qX�qS�qI||	 jD ]}|j/d&k�r~|j-D ]}| .|¡ �qu�qj�q%d S d S )'NÚwé   T)ÚclsÚindentÚ	sort_keysÚ Úreplace)ÚnewlineÚerrorsú:z
)rA   zFILE: ======== %s =======
Ú
r   z
== Orphaned credentials ==
z!
== Failed to parse these files:
z%s
Ú	directoryÚfilenameÚcredtyper   Údpapi_key_sha1Úkey_guidÚPRTr   ÚpasswordÚ
domainnameÚusernameÚ	masterkeyÚsha1_masterkeyÚ_exception_please_reportzFILE: ======== %s =======z== Orphaned credentials ==z== Errors ==z%s %sz
==== Parsing errors:zWriting kerberos tickets to %sz%s_%s.ccacher   )0ÚoutfileÚjsonÚopenÚdumpr   ÚgrepÚwriteÚjoinr   Úgrep_headerÚlogon_sessionsÚto_grep_rowsÚstrr2   Úorphaned_credsÚprintÚdumpsÚhasattrrD   Úto_dictÚget_masterkey_hexÚgetrA   Ú	tracebackÚ	format_tbÚ__traceback__Úbase64Ú	b64encodeÚencodeÚdecodeÚ
isinstancer   ÚdebugÚkerberos_dirÚosÚpathÚabspathr%   ÚntpathÚbasenameÚurandomÚhexÚkerberos_ccacheÚto_fileÚkerberos_credsÚticketsÚto_kirbirF   )r   ÚresultsÚfiles_with_errorr7   ÚfÚresultÚluidÚrowÚcredrE   ÚtÚxÚpkgÚerrÚerr_strÚdirÚbase_filenameÚccache_filenameÚkcredÚticketr   r   r   Úprocess_results:   sî   ÿ€ÿÿÿþ€
€
€ñ€

ý<
 6
€8

úæ"
€

ÿÿ
€ýôzLSACMDHelper.process_resultsc              
   C   s
  g }i }|j dkrƒd}zG|jd urd|jvr|j d¡ |jdkr)tj|jd�}n|jdkr=tj|jd�}|d u r=tdƒ‚||d< |j	d	krQt
|jƒd
krQtdƒ‚W n' tyy } z| |¡ |j	d	krf|‚tdƒ t ¡  	 W Y d }~nd }~ww |  |||¡ d S d S )Nr	   r1   r   Úkticketsr   ©Úpackagesr   z&HANDLEDUP failed to bring any results!Tr   úError in modules!z4Exception while dumping LSA credentials from memory.)r5   rk   rŒ   ÚappendÚmethodr   Úgo_liveÚgo_handledupÚ	ExceptionÚhalt_on_errorr2   rA   r\   rb   Ú	print_excr‰   )r   r7   ry   rx   rE   ÚmimiÚer   r   r   r6   ±   s8   


€

€ù	ézLSACMDHelper.run_livec                 C   sÔ  g }i }|j dkr*|jd urd|jvr|j d¡ tj|j|j|jd�}||d< �n·|j dkrs|jrQt	j
 |j¡}d}|jdkrIt	j
 |d|¡}nt	j
 ||¡}n|j}tj||jd	�D ]}t |¡}	t |	¡}
td
||
f ƒ q\�nn|j dk�rw|j�rt	j
 |j¡}dD ]‹}|jdkr–t	j
 |d|¡}nt	j
 ||¡}t d| ¡ tj||jd	�D ]d}t d| ¡ z3|jd urÆd|jvrÆ|j d¡ tj||jd�}|||< |jdkrçt|jƒdkrçt|jƒ tdƒ‚W q¬ t�y } z| |¡ t d| ¡ |jdk�r|‚	 W Y d }~q¬d }~ww q†nÎt d|j ¡ z4|jd u�r.d|jv�r.|j d¡ tj|j|jd�}|||j< |jdk�rNt|jƒdk�rNtdƒ‚W n‘ t�yv } zt d|j ¡ |jdk�rh|‚t ¡  W Y d }~nod }~ww |j dk�rát d|j ¡ z4|jd u�r˜d|jv�r˜|j d¡ tj|j|jd�}|||j< |jdk�r¸t|jƒdk�r¸tdƒ‚W n' t�yà } zt d|j ¡ |jdk�rÒ|‚t ¡  W Y d }~nd }~ww |  |||¡ d S )Nr$   r   rŠ   r‹   r%   ú*.dmpTz**)Ú	recursivez[%s] %sr#   )r—   z*.DMPzParsing folder %szParsing file %sr   r�   zError parsing file %s zError while parsing file %sr&   ) r"   rk   rŒ   rŽ   r   Úparse_memory_dump_rekallr'   Útimestamp_overriderD   rl   rm   rn   r˜   rV   Úglobr   Úparser   Úfrom_minidumpr\   r   r%   Úparse_minidump_filer“   r2   rA   r’   Ú	exceptionrb   r”   Úparse_zipdump_filer‰   )r   r7   ry   rx   r•   Údir_fullpathÚfile_patternÚglobdatarE   r#   Úsysinfor–   r   r   r   r4   Í   s¦   




ý

€
€úöù
€€û
€€ûzLSACMDHelper.runN)	Ú__name__Ú
__module__Ú__qualname__r   r0   r8   r‰   r6   r4   r   r   r   r   r      s    wr   )rl   rQ   r›   ro   rb   re   r   r   Úpypykatz.pypykatzÚpypykatz.commons.commonr   Ú,pypykatz.lsadecryptor.packages.msv.decryptorr   Úminidump.minidumpfiler   r   r   r   r   r   r   Ú<module>   s   