o
    Žõ±j¦¼  ã                   @   s  d dl Z d dlmZmZmZmZmZ d dlmZm	Z	m
Z
 d dlmZmZmZmZmZmZmZmZmZmZ d dlmZ d dlmZ G dd„ deƒZG d	d
„ d
eƒZG dd„ dƒZG dd„ deƒZG dd„ dƒZG dd„ deƒZG dd„ dƒZG dd„ deƒZ G dd„ dƒZ!G dd„ deƒZ"G dd„ dƒZ#G dd„ deƒZ$G dd „ d ƒZ%G d!d"„ d"eƒZ&G d#d$„ d$ƒZ'G d%d&„ d&eƒZ(G d'd(„ d(ƒZ)G d)d*„ d*eƒZ*G d+d,„ d,ƒZ+G d-d.„ d.eƒZ,G d/d0„ d0ƒZ-G d1d2„ d2ƒZ.G d3d4„ d4eƒZ/G d5d6„ d6ƒZ0G d7d8„ d8eƒZ1G d9d:„ d:ƒZ2G d;d<„ d<eƒZ3G d=d>„ d>ƒZ4G d?d@„ d@ƒZ5G dAdB„ dBƒZ6G dCdD„ dDeƒZ7G dEdF„ dFƒZ8G dGdH„ dHeƒZ9G dIdJ„ dJƒZ:G dKdL„ dLeƒZ;G dMdN„ dNƒZ<G dOdP„ dPeƒZ=G dQdR„ dRƒZ>G dSdT„ dTeƒZ?G dUdV„ dVƒZ@G dWdX„ dXeƒZAG dYdZ„ dZƒZBG d[d\„ d\eƒZCG d]d^„ d^ƒZDG d_d`„ d`eƒZEG dadb„ dbƒZFG dcdd„ ddeƒZGG dedf„ dfƒZHG dgdh„ dheƒZIG didj„ djƒZJG dkdl„ dleƒZKG dmdn„ dnƒZLG dodp„ dpeƒZMG dqdr„ drƒZNG dsdt„ dteƒZOG dudv„ dvƒZPG dwdx„ dxeƒZQG dydz„ dzƒZRG d{d|„ d|ƒZSG d}d~„ d~ƒZTG dd€„ d€ƒZUdS )�é    N)ÚULONG64ÚFILETIMEÚPCWSTRÚSIZE_TÚBOOL)ÚKatzSystemArchitectureÚWindowsMinBuildÚWindowsBuild)
ÚPOINTERÚPVOIDÚULONGÚ
LIST_ENTRYÚDWORDÚLSA_UNICODE_STRINGÚPKERB_EXTERNAL_NAMEÚKIWI_GENERIC_PRIMARY_CREDENTIALÚLUIDÚPLSAISO_DATA_BLOB)ÚPackageTemplate)Úhexdumpc                       s(   e Zd Z‡ fdd„Zedd„ ƒZ‡  ZS )ÚKerberosTemplatec                    s<   t ƒ  d|¡ d | _d | _d | _d | _d | _d | _d | _d S )NÚKerberos)	ÚsuperÚ__init__Ú	signatureÚfirst_entry_offsetÚkerberos_session_structÚkerberos_ticket_structÚkeys_list_structÚhash_password_structÚcsp_info_struct)ÚselfÚsysinfo©Ú	__class__© ú¤/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/lsadecryptor/packages/kerberos/templates.pyr      s   
zKerberosTemplate.__init__c                 C   s>  t | ƒ}| jtjk�r¢tjj| j  krtjjk r3n nd|_	d|_
t|_t|_t|_t|_t|_|S tjj| j  krBtjjk r[n nd|_	d|_
t|_t|_t|_t|_t|_|S tjj| j  krjtjjk rƒn nd|_	d|_
t|_t|_t|_t|_t|_|S tjj| j  kr’tjjk r«n nd|_	d|_
t|_t|_t|_t|_t|_|S tjj| j  krºtj jk rÓn nd|_	d|_
t|_t|_t|_t|_t!|_|S tj j| j  krâtj"jk rûn nd|_	d|_
t#|_t|_t|_t|_t$|_|S tj"j| j  k�rtj%jk �r%n nd|_	d|_
t#|_t&|_t|_t|_t$|_|S tj%j| j  k�r6tj'jk �rOn nd|_	d|_
t(|_t)|_t|_t*|_t$|_|S tj'j| j  k�r`tj+jk �ryn nd|_	d|_
t(|_t,|_t|_t*|_t$|_|S | jtj+jk�r˜d|_	d|_
t-|_t,|_t|_t*|_t$|_|S t.d| j| jf ƒ‚| jtj/k�rtjj| j  k�rºtjjk �rÓn nd|_	d|_
t|_t|_t|_t|_t|_|S tjj| j  k�rätjjk �rýn nd|_	d|_
t|_t|_t|_t|_t|_|S tjj| j  k�rtjjk �r'n nd|_	d	|_
t|_t|_t|_t|_t|_|S tjj| j  k�r8tjjk �rQn nd|_	d	|_
t|_t|_t|_t|_t|_|S tjj| j  k�rbtj0jk �r{n nd
|_	d|_
t|_t|_t|_t|_t!|_|S tj0j| j  k�rŒtj jk �r¥n nd|_	d|_
t|_t|_t|_t|_t!|_|S tj j| j  k�r¶tj"jk �rÏn nd|_	d|_
t1|_t|_t|_t|_t$|_|S tj"j| j  k�ràtj2jk �rùn nd|_	d|_
t3|_t)|_t|_t*|_t$|_|S tj2j| jk�rd|_	d|_
t3|_t)|_t|_t*|_t$|_|S t.d| j ƒ‚)Ns   H;þ„éüÿÿÿs   H‹H�é   zECould not identify template! Architecture: %s sysinfo.buildnumber: %ss   ‹}‹9Piøÿÿÿs   S‹PViõÿÿÿs   W‹8Phiòÿÿÿs   V‹0PWiñÿÿÿs   V‹0PSzUnknown architecture! %s)4r   Úarchitecturer   ÚX64r   ÚWIN_XPÚvalueÚbuildnumberÚWIN_2K3r   r   ÚKIWI_KERBEROS_LOGON_SESSION_51r   Ú KIWI_KERBEROS_INTERNAL_TICKET_51r   ÚKIWI_KERBEROS_KEYS_LIST_5r   ÚKERB_HASHPASSWORD_5r   ÚKIWI_KERBEROS_CSP_INFOS_5r    Ú	WIN_VISTAÚKIWI_KERBEROS_LOGON_SESSIONÚ KIWI_KERBEROS_INTERNAL_TICKET_52ÚWIN_7Ú KIWI_KERBEROS_INTERNAL_TICKET_60ÚKIWI_KERBEROS_KEYS_LIST_6ÚKERB_HASHPASSWORD_6ÚKIWI_KERBEROS_CSP_INFOS_60ÚWIN_8ÚKIWI_KERBEROS_INTERNAL_TICKET_6r	   ÚWIN_10_1507ÚKIWI_KERBEROS_CSP_INFOS_62ÚWIN_10_1511ÚKIWI_KERBEROS_LOGON_SESSION_10ÚKIWI_KERBEROS_CSP_INFOS_10ÚWIN_10_1607Ú KIWI_KERBEROS_INTERNAL_TICKET_10ÚWIN_11_2022Ú#KIWI_KERBEROS_LOGON_SESSION_10_1607Ú%KIWI_KERBEROS_INTERNAL_TICKET_10_1607ÚKERB_HASHPASSWORD_6_1607ÚWIN_11_24H2Ú KIWI_KERBEROS_INTERNAL_TICKET_11Ú KIWI_KERBEROS_LOGON_SESSION_24H2Ú	ExceptionÚX86ÚWIN_BLUEÚ"KIWI_KERBEROS_LOGON_SESSION_10_X86ÚWIN_10_1903Ú'KIWI_KERBEROS_LOGON_SESSION_10_1607_X86)r"   Útemplater%   r%   r&   Úget_template   sx  " 7 �"Ì - �"Õ $ �"Þ  �"ç  �"ð 	 �&ù&„u&�l–c &U&®K&·B&À9&É0&Ò'&Þ&èòýzKerberosTemplate.get_template)Ú__name__Ú
__module__Ú__qualname__r   ÚstaticmethodrS   Ú__classcell__r%   r%   r#   r&   r      s    
r   c                       ó   e Zd Z‡ fdd„Z‡  ZS )ÚPKERB_SMARTCARD_CSP_INFO_5c                    ó   t ƒ  |t¡ d S ©N)r   r   ÚKERB_SMARTCARD_CSP_INFO_5©r!   Úreaderr#   r%   r&   r   ß   ó   z#PKERB_SMARTCARD_CSP_INFO_5.__init__©rT   rU   rV   r   rX   r%   r%   r#   r&   rZ   Þ   ó    rZ   c                   @   ó$   e Zd Zdd„ Zdd„ Zdd„ ZdS )r]   c                 C   sr   |  ¡ }t|ƒj| _t|ƒj| _t|ƒj| _t|ƒj| _t|ƒj| _|  ¡ | }| 	|| d ¡}t
 |¡| _d S )Né   )Útellr   r,   ÚContextInformationr   ÚnCardNameOffsetÚnReaderNameOffsetÚnContainerNameOffsetÚnCSPNameOffsetÚreadÚioÚBytesIOÚbBuffer©r!   r_   ÚsizeÚposÚdiffÚdatar%   r%   r&   r   ä   s   z"KERB_SMARTCARD_CSP_INFO_5.__init__c                 C   óˆ   |  ¡ }| |d¡ d}d}d}|dk r5|dkrn| d¡}|dkr'|d7 }nd}||7 }|d7 }|dk s| |d¡ | d¡ dd	¡S ©
Nr   ó    éÿ   é   é   ó    z	utf-16-leú Ú ©re   Úseekrk   ÚdecodeÚreplace©r!   ÚbufferÚtposrq   rs   ÚiÚncÚcr%   r%   r&   Úread_wcharnullð   ó"   

÷
z(KERB_SMARTCARD_CSP_INFO_5.read_wcharnullc                 C   óX   i }|   | j| j¡|d< |   | j| j¡|d< |   | j| j¡|d< |   | j| j¡|d< |S ©NÚCardNameÚ
ReaderNameÚContainerNameÚCSPName©r‡   rn   rg   rh   ri   rj   ©r!   Útr%   r%   r&   Ú	get_infos  ó   z#KERB_SMARTCARD_CSP_INFO_5.get_infosN©rT   rU   rV   r   r‡   r’   r%   r%   r%   r&   r]   ã   s    r]   c                       rY   )ÚPKERB_SMARTCARD_CSP_INFOc                    r[   r\   )r   r   ÚKERB_SMARTCARD_CSP_INFOr^   r#   r%   r&   r     r`   z!PKERB_SMARTCARD_CSP_INFO.__init__ra   r%   r%   r#   r&   r•     rb   r•   c                   @   rc   )r–   c                 C   s²   |  ¡ }t|ƒj| _t|ƒj| _t|ƒj| _t|ƒj| _t|ƒj| _	t
|ƒjd | _t
|ƒjd | _t
|ƒjd | _t
|ƒjd | _|  ¡ | }| || d ¡}t |¡| _d S )Né   rd   )re   r   r,   ÚMessageTyper   rf   r   ÚSpaceHolderForWow64ÚflagsÚKeySpecr   rg   rh   ri   rj   rk   rl   rm   rn   ro   r%   r%   r&   r     s   z KERB_SMARTCARD_CSP_INFO.__init__c                 C   rt   ru   r}   r�   r%   r%   r&   r‡   "  rˆ   z&KERB_SMARTCARD_CSP_INFO.read_wcharnullc                 C   r‰   rŠ   r�   r�   r%   r%   r&   r’   5  r“   z!KERB_SMARTCARD_CSP_INFO.get_infosNr”   r%   r%   r%   r&   r–     s    r–   c                       rY   )ÚPKIWI_KERBEROS_CSP_INFOS_5c                    r[   r\   )r   r   r3   r^   r#   r%   r&   r   ?  r`   z#PKIWI_KERBEROS_CSP_INFOS_5.__init__ra   r%   r%   r#   r&   rœ   >  rb   rœ   c                   @   ó   e Zd Zdd„ ZdS )r3   c                 C   s^   t |ƒ| _t|ƒ| _t|ƒ| _t|ƒ| _t|ƒ| _t|ƒj| _	t|ƒj| _
t|| j
d�| _d S ©N)rp   )r   ÚPinCoder   Úunk0Úunk1ÚCertificateInfosÚunkDatar   r,   ÚFlagsÚCspDataLengthr]   ÚCspDatar^   r%   r%   r&   r   C  s   




z"KIWI_KERBEROS_CSP_INFOS_5.__init__N©rT   rU   rV   r   r%   r%   r%   r&   r3   B  ó    r3   c                       rY   )ÚPKIWI_KERBEROS_CSP_INFOS_60c                    r[   r\   )r   r   r;   r^   r#   r%   r&   r   N  r`   z$PKIWI_KERBEROS_CSP_INFOS_60.__init__ra   r%   r%   r#   r&   r©   M  rb   r©   c                   @   r�   )r;   c                 C   sr   t |ƒ| _t|ƒj| _t|ƒj| _t|ƒj| _t|ƒj| _t|ƒj| _	t|ƒj| _
t|ƒj| _t|| jd�| _d S rž   )r   rŸ   r   r,   r    r¡   r¢   r£   r   r¤   ÚunkFlagsr¥   r–   r¦   r^   r%   r%   r&   r   S  s   
z#KIWI_KERBEROS_CSP_INFOS_60.__init__Nr§   r%   r%   r%   r&   r;   R  r¨   r;   c                       rY   )ÚPKIWI_KERBEROS_CSP_INFOS_62c                    r[   r\   )r   r   r?   r^   r#   r%   r&   r   _  r`   z$PKIWI_KERBEROS_CSP_INFOS_62.__init__ra   r%   r%   r#   r&   r«   ^  rb   r«   c                   @   r�   )r?   c                 C   s~   t |ƒ| _t|ƒj| _t|ƒj| _t|ƒj| _t|ƒj| _t|ƒj| _t	|ƒj| _
t	|ƒj| _t	|ƒj| _t|| jd�| _d S rž   )r   rŸ   r   r,   r    r¡   r¢   Úunk2r£   r   r¤   rª   r¥   r–   r¦   r^   r%   r%   r&   r   d  s   
z#KIWI_KERBEROS_CSP_INFOS_62.__init__Nr§   r%   r%   r%   r&   r?   c  r¨   r?   c                       rY   )ÚPKIWI_KERBEROS_CSP_INFOS_10c                    r[   r\   )r   r   rB   r^   r#   r%   r&   r   q  r`   z$PKIWI_KERBEROS_CSP_INFOS_10.__init__ra   r%   r%   r#   r&   r­   p  rb   r­   c                   @   r�   )rB   c                 C   sŠ   t |ƒ| _t|ƒj| _t|ƒj| _t|ƒj| _t|ƒj| _t|ƒj| _t	|ƒj| _
t	|ƒj| _t|ƒj| _t	|ƒj| _t|| jd�| _d S rž   )r   rŸ   r   r,   r    r¡   r¢   r¬   r£   r   r¤   rª   Úunk3r¥   r–   r¦   r^   r%   r%   r&   r   u  s   
z#KIWI_KERBEROS_CSP_INFOS_10.__init__Nr§   r%   r%   r%   r&   rB   t  r¨   rB   c                       rY   )ÚPKIWI_KERBEROS_LOGON_SESSION_51c                    r[   r\   )r   r   r/   r^   r#   r%   r&   r   ƒ  r`   z(PKIWI_KERBEROS_LOGON_SESSION_51.__init__ra   r%   r%   r#   r&   r¯   ‚  rb   r¯   c                   @   r�   )r/   c                 C   s~  t |ƒj| _t|ƒ| _t|ƒ| _t|ƒj| _t |ƒj| _t |ƒj| _	t|ƒj| _
t|ƒj| _t|ƒj| _t|ƒj| _| d¡ t|ƒj| _t|ƒj| _t |ƒj| _t |ƒj| _t|ƒj| _t|ƒj| _t|ƒj| _t|ƒ| _t |ƒj| _t |ƒj| _t |ƒj| _t |ƒj| _t|ƒj| _t|ƒj| _t|ƒj| _ t|ƒj| _!t|ƒ| _"t|ƒj| _#t|ƒ| _$t|ƒ| _%t|ƒ| _&t|ƒ| _'d S ©Né   )(r   r,   Ú
UsageCountr   r    r¡   r   r¬   r®   Úunk4Úunk5Úunk6Úunk7r   ÚLocallyUniqueIdentifierÚalignr   Úunk8Úunk9Úunk10Úunk11Úunk12Úunk13Úunk14r   ÚcredentialsÚunk15Úunk16Úunk17Úunk18Úunk19Úunk20Úunk21Úunk22ÚpKeyListÚunk24Ú	Tickets_1Ú	Tickets_2Ú	Tickets_3ÚSmartcardInfosr^   r%   r%   r&   r   ‡  sB   







z'KIWI_KERBEROS_LOGON_SESSION_51.__init__Nr§   r%   r%   r%   r&   r/   †  r¨   r/   c                       rY   )ÚPKIWI_KERBEROS_LOGON_SESSIONc                    r[   r\   )r   r   r5   r^   r#   r%   r&   r   ­  r`   z%PKIWI_KERBEROS_LOGON_SESSION.__init__ra   r%   r%   r#   r&   rÏ   ¬  rb   rÏ   c                   @   r�   )r5   c                 C   s¨  t |ƒj| _| ¡  t|ƒ| _t|ƒj| _t |ƒj| _t |ƒj| _	t|ƒj| _
t|ƒj| _t|ƒj| _t|ƒj| _| d¡ t|ƒj| _t|ƒj| _t |ƒj| _t |ƒj| _t|ƒj| _t|ƒj| _t|ƒj| _t|ƒ| _t |ƒj| _t |ƒj| _t |ƒj| _t |ƒj| _t|ƒj| _t|ƒj| _t|ƒj| _t|ƒj| _ t|ƒ| _!t|ƒj| _"| ¡  t|ƒ| _#t|ƒj| _$t|ƒ| _%t|ƒj| _&t|ƒ| _'t|ƒj| _(t|ƒ| _)d S r°   )*r   r,   r²   r¸   r   r    r   r¡   r¬   r®   r³   r´   rµ   r   r·   r   r¶   r¹   rº   r»   r¼   r½   r¾   r   rÀ   r¿   rÁ   rÂ   rÃ   rÄ   rÅ   rÆ   rÇ   rÉ   Úunk23rË   rÊ   rÌ   Úunk25rÍ   Úunk26rÎ   r^   r%   r%   r&   r   ±  sJ   






z$KIWI_KERBEROS_LOGON_SESSION.__init__Nr§   r%   r%   r%   r&   r5   °  r¨   r5   c                       rY   )Ú$PKIWI_KERBEROS_10_PRIMARY_CREDENTIALc                    r[   r\   )r   r   Ú#KIWI_KERBEROS_10_PRIMARY_CREDENTIALr^   r#   r%   r&   r   Ú  r`   z-PKIWI_KERBEROS_10_PRIMARY_CREDENTIAL.__init__ra   r%   r%   r#   r&   rÓ   Ù  rb   rÓ   c                   @   r�   )rÔ   c                 C   s.   t |ƒ| _t |ƒ| _t|ƒj| _t |ƒ| _d S r\   )r   ÚUserNameÚDomainer   r,   r    ÚPasswordr^   r%   r%   r&   r   ß  s   

z,KIWI_KERBEROS_10_PRIMARY_CREDENTIAL.__init__Nr§   r%   r%   r%   r&   rÔ   Þ  r¨   rÔ   c                       rY   )ÚPKIWI_KERBEROS_LOGON_SESSION_10c                    r[   r\   )r   r   rA   r^   r#   r%   r&   r   æ  r`   z(PKIWI_KERBEROS_LOGON_SESSION_10.__init__ra   r%   r%   r#   r&   rØ   å  rb   rØ   c                   @   r�   )rO   c                 C   sî  t |ƒj| _| ¡  t|ƒ| _t|ƒj| _t |ƒj| _| ¡  t	|ƒj| _
t|ƒj| _t|ƒj| _t|ƒj| _t|ƒj| _| ¡  t	|ƒj| _t|ƒj| _t |ƒj| _| ¡  t	|ƒj| _t|ƒj| _t|ƒj| _t|ƒj| _| d¡ t|ƒ| _t |ƒj| _t |ƒj| _t |ƒj| _t |ƒj| _| d¡ t|ƒj| _t|ƒj| _t|ƒj| _t|ƒj| _ t|ƒj| _!t|ƒj| _"t|ƒj| _#t|ƒ| _$t|ƒj| _%| ¡  t|ƒ| _&t	|ƒj| _'t|ƒ| _(t	|ƒj| _)t|ƒ| _*t	|ƒj| _+t|ƒ| _,d S r°   ©-r   r,   r²   r¸   r   r    r   r¡   Úunk1br   r¬   r³   r´   rµ   r   r·   r¶   r¹   Úunk8brº   r¼   r½   r¾   rÔ   rÀ   r¿   rÁ   rÂ   rÃ   rÅ   rÆ   rÇ   rÈ   rÐ   rÊ   rÑ   rÉ   rÒ   rË   Úunk27rÌ   Úunk28rÍ   Úunk29rÎ   r^   r%   r%   r&   r   ê  sX   







z+KIWI_KERBEROS_LOGON_SESSION_10_X86.__init__Nr§   r%   r%   r%   r&   rO   é  r¨   rO   c                   @   r�   )rA   c                 C   sÊ  t |ƒj| _| ¡  t|ƒ| _t|ƒj| _t |ƒj| _| ¡  t	|ƒj| _
t|ƒj| _t|ƒj| _t|ƒj| _t|ƒj| _t	|ƒj| _t|ƒj| _t |ƒj| _| ¡  t	|ƒj| _t|ƒj| _t|ƒj| _t|ƒj| _t|ƒ| _t |ƒj| _t |ƒj| _t |ƒj| _t |ƒj| _t|ƒj| _t|ƒj| _t|ƒj| _t|ƒj| _ t|ƒj| _!t|ƒj| _"t|ƒj| _#t|ƒ| _$t|ƒj| _%t|ƒ| _&t	|ƒj| _'t|ƒ| _(t	|ƒj| _)t|ƒ| _*t	|ƒj| _+t|ƒ| _,d S r\   rÙ   r^   r%   r%   r&   r   !  sP   





z'KIWI_KERBEROS_LOGON_SESSION_10.__init__Nr§   r%   r%   r%   r&   rA      r¨   rA   c                       rY   )Ú-PKIWI_KERBEROS_10_PRIMARY_CREDENTIAL_1607_ISOc                    r[   r\   )r   r   Ú,KIWI_KERBEROS_10_PRIMARY_CREDENTIAL_1607_ISOr^   r#   r%   r&   r   M  r`   z6PKIWI_KERBEROS_10_PRIMARY_CREDENTIAL_1607_ISO.__init__ra   r%   r%   r#   r&   rß   L  rb   rß   c                   @   r�   )rà   c                 C   s"   t |ƒj| _| ¡  t|ƒ| _d S r\   )r   r,   Ú
StructSizer¸   r   ÚisoBlobr^   r%   r%   r&   r   R  s   z5KIWI_KERBEROS_10_PRIMARY_CREDENTIAL_1607_ISO.__init__Nr§   r%   r%   r%   r&   rà   Q  r¨   rà   c                       rY   )Ú)PKIWI_KERBEROS_10_PRIMARY_CREDENTIAL_1607c                    r[   r\   )r   r   Ú(KIWI_KERBEROS_10_PRIMARY_CREDENTIAL_1607r^   r#   r%   r&   r   X  r`   z2PKIWI_KERBEROS_10_PRIMARY_CREDENTIAL_1607.__init__ra   r%   r%   r#   r&   rã   W  rb   rã   c                   @   r�   )rä   c                 C   sL   t |ƒ| _t |ƒ| _t|ƒj| _t|ƒj| _| ¡  t |ƒ| _	t
|ƒ| _d S r\   )r   rÕ   rÖ   r   r,   ÚunkFunctionr   Útyper¸   r×   rà   ÚIsoPasswordr^   r%   r%   r&   r   \  s   


z1KIWI_KERBEROS_10_PRIMARY_CREDENTIAL_1607.__init__Nr§   r%   r%   r%   r&   rä   [  r¨   rä   c                       rY   )Ú$PKIWI_KERBEROS_LOGON_SESSION_10_1607c                    r[   r\   )r   r   rF   r^   r#   r%   r&   r   f  r`   z-PKIWI_KERBEROS_LOGON_SESSION_10_1607.__init__ra   r%   r%   r#   r&   rè   e  rb   rè   c                   @   r�   )rF   c                 C   sÐ  t |ƒj| _| ¡  t|ƒ| _t|ƒj| _t |ƒj| _| ¡  t	|ƒj| _
t|ƒj| _t|ƒj| _t|ƒj| _t|ƒj| _t	|ƒj| _t|ƒj| _t |ƒj| _| ¡  t	|ƒj| _t|ƒj| _t|ƒj| _t|ƒj| _| d¡ t|ƒ| _t |ƒj| _t |ƒj| _t |ƒj| _t |ƒj| _t|ƒj| _t|ƒj| _t|ƒj| _t|ƒj| _ t|ƒj| _!t|ƒj| _"| ¡  t|ƒ| _#t|ƒj| _$t|ƒ| _%t	|ƒj| _&t|ƒ| _'t	|ƒj| _(t|ƒ| _)t	|ƒj| _*t|ƒ| _+d S r°   ),r   r,   r²   r¸   r   r    r   r¡   rÚ   r   r¬   r³   r´   rµ   r   r·   r¶   r¹   rÛ   rº   r¼   r½   r¾   rä   rÀ   r¿   rÁ   rÂ   rÃ   rÄ   rÅ   rÆ   rÇ   rÈ   rÐ   rÉ   rÒ   rË   rÜ   rÌ   rÝ   rÍ   rÞ   rÎ   r^   r%   r%   r&   r   k  sR   






z,KIWI_KERBEROS_LOGON_SESSION_10_1607.__init__Nr§   r%   r%   r%   r&   rF   j  r¨   rF   c                   @   r�   )rK   c                 C   s¸  t |ƒj| _| ¡  t|ƒ| _t |ƒj| _| ¡  t|ƒj| _t	|ƒj| _
t	|ƒj| _t	|ƒj| _t|ƒj| _t|ƒj| _t	|ƒj| _t |ƒj| _| ¡  t|ƒj| _t	|ƒj| _t	|ƒj| _| d¡ t|ƒ| _t |ƒj| _t |ƒj| _t |ƒj| _t |ƒj| _t	|ƒj| _t	|ƒj| _t	|ƒj| _t	|ƒj| _t	|ƒj| _t	|ƒj| _ | ¡  t	|ƒ| _!t	|ƒj| _"t|ƒ| _#t|ƒj| _$t|ƒ| _%t|ƒj| _&t|ƒ| _'t|ƒj| _(t	|ƒ| _)d S r°   )*r   r,   r²   r¸   r   r    r¡   r   r¬   r   r³   r´   rµ   r   r·   r¶   r¹   rÛ   rº   r¼   r½   rä   rÀ   r¿   rÁ   rÂ   rÃ   rÄ   rÅ   rÆ   rÇ   rÈ   rÐ   rÉ   rÒ   rË   rÜ   rÌ   rÝ   rÍ   rÞ   rÎ   r^   r%   r%   r&   r   §  sN   






z)KIWI_KERBEROS_LOGON_SESSION_24H2.__init__Nr§   r%   r%   r%   r&   rK   ¦  r¨   rK   c                   @   r�   )rQ   c                 C   sÒ  t |ƒj| _| ¡  t|ƒ| _t|ƒj| _t |ƒj| _| ¡  t	|ƒj| _
t|ƒj| _t|ƒj| _t|ƒj| _t|ƒj| _t	|ƒj| _t|ƒj| _t |ƒj| _| ¡  t	|ƒj| _t|ƒj| _t|ƒj| _t|ƒj| _t |ƒj| _t|ƒ| _t |ƒj| _t |ƒj| _t |ƒj| _t |ƒj| _t|ƒj| _t|ƒj| _t|ƒj| _ t|ƒj| _!t|ƒj| _"t|ƒj| _#| ¡  t|ƒ| _$t|ƒj| _%t|ƒ| _&t	|ƒj| _'t|ƒ| _(t	|ƒj| _)t|ƒ| _*t	|ƒj| _+t|ƒ| _,d S r\   )-r   r,   r²   r¸   r   r    r   r¡   rÚ   r   r¬   r³   r´   rµ   r   r·   r¶   r¹   rÛ   rº   r¼   r½   r¾   ÚunkAlignrä   rÀ   r¿   rÁ   rÂ   rÃ   rÄ   rÅ   rÆ   rÇ   rÈ   rÐ   rÉ   rÒ   rË   rÜ   rÌ   rÝ   rÍ   rÞ   rÎ   r^   r%   r%   r&   r   Ó  sR   





z0KIWI_KERBEROS_LOGON_SESSION_10_1607_X86.__init__Nr§   r%   r%   r%   r&   rQ   Ò  r¨   rQ   c                       rY   )Ú!PKIWI_KERBEROS_INTERNAL_TICKET_51c                    r[   r\   )r   r   r0   r^   r#   r%   r&   r     r`   z*PKIWI_KERBEROS_INTERNAL_TICKET_51.__init__ra   r%   r%   r#   r&   rê     rb   rê   c                   @   r�   )r0   c                 C   s†  t |ƒ| _t |ƒ| _t|ƒj| _t|ƒj| _t|ƒ| _t|ƒ| _	t
|ƒ| _t
|ƒ| _t
|ƒ| _t
|ƒ| _t|ƒ| _tj| d¡ddd�| _t|ƒj| _t|ƒj| _t|ƒ| _t|ƒj| _t|ƒj| _t|ƒj| _t|ƒj| _t|ƒj| _t|ƒj| _t|ƒj| _ t|ƒj| _!t|ƒj| _"t|ƒj| _#t|ƒj| _$t%|ƒj| _&t|ƒj| _'t|ƒj| _(t|ƒj| _)t|ƒj| _*t|ƒj| _+t|ƒ| _,d S ©Nrd   ÚbigF©Ú	byteorderÚsigned)-rê   ÚFlinkÚBlinkr   r,   r    r¡   r   ÚServiceNameÚ
TargetNamer   Ú
DomainNameÚTargetDomainNameÚDescriptionÚAltTargetDomainNameÚ
ClientNameÚintÚ
from_bytesrk   ÚTicketFlagsr   r¬   ÚKeyTypeÚKIWI_KERBEROS_BUFFERÚKeyr®   r³   r´   rµ   r¶   r¹   r   Ú	StartTimeÚEndTimeÚ
RenewUntilrº   r»   r   Údomainr¼   ÚstrangeNamesr½   ÚTicketEncTypeÚ
TicketKvnoÚTicketr^   r%   r%   r&   r     sB   









z)KIWI_KERBEROS_INTERNAL_TICKET_51.__init__Nr§   r%   r%   r%   r&   r0   
  r¨   r0   c                       rY   )Ú!PKIWI_KERBEROS_INTERNAL_TICKET_52c                    r[   r\   )r   r   r6   r^   r#   r%   r&   r   /  r`   z*PKIWI_KERBEROS_INTERNAL_TICKET_52.__init__ra   r%   r%   r#   r&   r  .  rb   r  c                   @   r�   )r6   c                 C   ón  t |ƒ| _t |ƒ| _t|ƒj| _t|ƒj| _t|ƒ| _t|ƒ| _	t
|ƒ| _t
|ƒ| _t
|ƒ| _t
|ƒ| _t|ƒ| _t|ƒj| _tj| d¡ddd�| _t|ƒj| _t|ƒj| _t|ƒ| _t|ƒj| _t|ƒj| _t|ƒj| _t|ƒj| _t|ƒj| _t|ƒj| _ t|ƒj| _!t|ƒj| _"t#|ƒj| _$t|ƒj| _%t|ƒj| _&t|ƒj| _'t|ƒj| _(t|ƒj| _)t|ƒ| _*d S rë   )+r  rð   rñ   r   r,   r    r¡   r   rò   ró   r   rô   rõ   rö   r÷   rø   Úname0rù   rú   rk   rû   r   r¬   rü   rý   rþ   r®   r³   r´   r   rÿ   r   r  rµ   r¶   r   r  r¹   r  rº   r  r  r  r^   r%   r%   r&   r   4  s>   









z)KIWI_KERBEROS_INTERNAL_TICKET_52.__init__Nr§   r%   r%   r%   r&   r6   3  r¨   r6   c                       rY   )Ú!PKIWI_KERBEROS_INTERNAL_TICKET_60c                    r[   r\   )r   r   r8   r^   r#   r%   r&   r   V  r`   z*PKIWI_KERBEROS_INTERNAL_TICKET_60.__init__ra   r%   r%   r#   r&   r
  U  rb   r
  c                   @   r�   )r8   c                 C   r  rë   )+r
  rð   rñ   r   r,   r    r¡   r   rò   ró   r   rô   rõ   rö   r÷   rø   r	  rù   rú   rk   rû   r   r¬   rü   rý   rþ   r®   r³   r´   r   rÿ   r   r  rµ   r¶   r   r  r¹   r  rº   r  r  r  r^   r%   r%   r&   r   [  s>   









z)KIWI_KERBEROS_INTERNAL_TICKET_60.__init__Nr§   r%   r%   r%   r&   r8   Z  r¨   r8   c                       rY   )Ú PKIWI_KERBEROS_INTERNAL_TICKET_6c                    r[   r\   )r   r   r=   r^   r#   r%   r&   r     r`   z)PKIWI_KERBEROS_INTERNAL_TICKET_6.__init__ra   r%   r%   r#   r&   r  ~  rb   r  c                   @   r�   )r=   c                 C   s�  t |ƒ| _t |ƒ| _t|ƒj| _t|ƒj| _t|ƒ| _t|ƒ| _	t
|ƒ| _t
|ƒ| _t
|ƒ| _t
|ƒ| _t
|ƒ| _t|ƒ| _t|ƒj| _tj| d¡ddd�| _t|ƒj| _t|ƒj| _| ¡  t|ƒ| _t|ƒj| _t|ƒj| _t|ƒj| _t|ƒj| _ t|ƒj| _!t|ƒj| _"t|ƒj| _#t|ƒj| _$t%|ƒj| _&t|ƒj| _'| ¡  t|ƒj| _(t|ƒj| _)t|ƒj| _*t|ƒj| _+| ¡  t|ƒ| _,d S rë   )-r  rð   rñ   r   r,   r    r¡   r   rò   ró   r   rô   rõ   rö   r÷   Ú	KDCServerrø   r	  rù   rú   rk   rû   r   r¬   rü   r¸   rý   rþ   r®   r³   r´   r   rÿ   r   r  rµ   r¶   r   r  r¹   r  rº   r  r  r  r^   r%   r%   r&   r   ƒ  sF   










z(KIWI_KERBEROS_INTERNAL_TICKET_6.__init__Nr§   r%   r%   r%   r&   r=   ‚  r¨   r=   c                       rY   )Ú!PKIWI_KERBEROS_INTERNAL_TICKET_10c                    r[   r\   )r   r   rD   r^   r#   r%   r&   r   ­  r`   z*PKIWI_KERBEROS_INTERNAL_TICKET_10.__init__ra   r%   r%   r#   r&   r  ¬  rb   r  c                   @   r�   )rD   c                 C   sœ  t |ƒ| _t |ƒ| _t|ƒj| _t|ƒj| _t|ƒ| _t|ƒ| _	t
|ƒ| _t
|ƒ| _t
|ƒ| _t
|ƒ| _t
| _t
| _t|ƒ| _t|ƒj| _tj| d¡ddd�| _t|ƒj| _t|ƒj| _| ¡  t|ƒ| _t|ƒj| _t|ƒj| _t|ƒj| _| d¡ t |ƒj| _!t |ƒj| _"t |ƒj| _#t|ƒj| _$t|ƒj| _%t&|ƒj| _'t|ƒj| _(| ¡  t|ƒj| _)t|ƒj| _*t|ƒj| _+t|ƒj| _,| ¡  t|ƒ| _-d S )Nrd   rì   Frí   r±   ).r  rð   rñ   r   r,   r    r¡   r   rò   ró   r   rô   rõ   rö   r÷   r  Ú
unk10586_drø   r	  rù   rú   rk   rû   r   r¬   rü   r¸   rý   rþ   r®   r³   r´   r   rÿ   r   r  rµ   r¶   r   r  r¹   r  rº   r  r  r  r^   r%   r%   r&   r   ±  sJ   










z)KIWI_KERBEROS_INTERNAL_TICKET_10.__init__Nr§   r%   r%   r%   r&   rD   °  r¨   rD   c                       rY   )Ú!PKIWI_KERBEROS_INTERNAL_TICKET_11c                    r[   r\   )r   r   rJ   r^   r#   r%   r&   r   Ú  r`   z*PKIWI_KERBEROS_INTERNAL_TICKET_11.__init__ra   r%   r%   r#   r&   r  Ù  rb   r  c                   @   r�   )rJ   c                 C   s¶  t |ƒ| _t |ƒ| _t|ƒj| _t|ƒj| _t|ƒ| _t|ƒ| _	t
|ƒ| _t
|ƒ| _t
|ƒ| _t
|ƒ| _t
|ƒ| _t
|ƒ| _t|ƒ| _t|ƒj| _tj| d¡ddd�| _t|ƒj| _t|ƒj| _t|ƒj| _t|ƒj| _t|ƒ| _t|ƒj| _t|ƒj| _t|ƒj| _ t|ƒj| _!t"|ƒj| _#t"|ƒj| _$t"|ƒj| _%t|ƒj| _&t|ƒj| _'t(|ƒj| _)t|ƒj| _*| +¡  t|ƒj| _,t|ƒj| _-t|ƒj| _.t|ƒj| _/| +¡  t|ƒ| _0d S rë   )1r  rð   rñ   r   r,   r    r¡   r   rò   ró   r   rô   rõ   rö   r÷   r  r  rø   r	  rù   rú   rk   rû   r   r¬   Ú
unk14393_0Úunk2xrü   rý   rþ   Ú
unk14393_1r®   r³   r´   r   rÿ   r   r  rµ   r¶   r   r  r¹   r¸   r  rº   r  r  r  r^   r%   r%   r&   r   ß  sL   











z)KIWI_KERBEROS_INTERNAL_TICKET_11.__init__Nr§   r%   r%   r%   r&   rJ   Þ  r¨   rJ   c                       rY   )Ú&PKIWI_KERBEROS_INTERNAL_TICKET_10_1607c                    r[   r\   )r   r   rG   r^   r#   r%   r&   r   
  r`   z/PKIWI_KERBEROS_INTERNAL_TICKET_10_1607.__init__ra   r%   r%   r#   r&   r  	  rb   r  c                   @   r�   )rG   c                 C   s²  t |ƒ| _t |ƒ| _t|ƒj| _t|ƒj| _t|ƒ| _t|ƒ| _	t
|ƒ| _t
|ƒ| _t
|ƒ| _t
|ƒ| _t
|ƒ| _t
|ƒ| _t|ƒ| _t|ƒj| _tj| d¡ddd�| _t|ƒj| _t|ƒj| _t|ƒj| _| ¡  t|ƒ| _t|ƒj| _t|ƒj| _t|ƒj| _ t|ƒj| _!t"|ƒj| _#t"|ƒj| _$t"|ƒj| _%t|ƒj| _&t|ƒj| _'t(|ƒj| _)t|ƒj| _*| ¡  t|ƒj| _+t|ƒj| _,t|ƒj| _-t|ƒj| _.| ¡  t|ƒ| _/d S rë   )0r  rð   rñ   r   r,   r    r¡   r   rò   ró   r   rô   rõ   rö   r÷   r  r  rø   r	  rù   rú   rk   rû   r   r¬   r  rü   r¸   rý   rþ   r  r®   r³   r´   r   rÿ   r   r  rµ   r¶   r   r  r¹   r  rº   r  r  r  r^   r%   r%   r&   r     sL   











z.KIWI_KERBEROS_INTERNAL_TICKET_10_1607.__init__Nr§   r%   r%   r%   r&   rG     r¨   rG   c                       rY   )ÚPKERB_HASHPASSWORD_GENERICc                    r[   r\   )r   r   ÚKERB_HASHPASSWORD_GENERICr^   r#   r%   r&   r   9  r`   z#PKERB_HASHPASSWORD_GENERIC.__init__ra   r%   r%   r#   r&   r  8  rb   r  c                   @   r�   )r  c                 C   s.   t |ƒj| _| ¡  t|ƒj| _t|ƒ| _d S r\   )r   r,   ÚTyper¸   r   ÚSizer   Ú	Checksumpr^   r%   r%   r&   r   =  s   z"KERB_HASHPASSWORD_GENERIC.__init__Nr§   r%   r%   r%   r&   r  <  r¨   r  c                       rY   )ÚPKERB_HASHPASSWORD_5c                    r[   r\   )r   r   r2   r^   r#   r%   r&   r   F  r`   zPKERB_HASHPASSWORD_5.__init__ra   r%   r%   r#   r&   r  E  rb   r  c                   @   r�   )r2   c                 C   s   t |ƒ| _t|ƒ| _d S r\   )r   Úsaltr  Úgenericr^   r%   r%   r&   r   J  s   
zKERB_HASHPASSWORD_5.__init__Nr§   r%   r%   r%   r&   r2   I  r¨   r2   c                       rY   )ÚPKERB_HASHPASSWORD_6c                    r[   r\   )r   r   r:   r^   r#   r%   r&   r   O  r`   zPKERB_HASHPASSWORD_6.__init__ra   r%   r%   r#   r&   r  N  rb   r  c                   @   r�   )r:   c                 C   s"   t |ƒ| _t|ƒ| _t|ƒ| _d S r\   )r   r  r   ÚstringToKeyr  r  r^   r%   r%   r&   r   S  s   

zKERB_HASHPASSWORD_6.__init__Nr§   r%   r%   r%   r&   r:   R  r¨   r:   c                       rY   )ÚPKERB_HASHPASSWORD_6_1607c                    r[   r\   )r   r   rH   r^   r#   r%   r&   r   \  r`   z"PKERB_HASHPASSWORD_6_1607.__init__ra   r%   r%   r#   r&   r  [  rb   r  c                   @   r�   )rH   c                 C   s0   t |ƒ| _t|ƒj| _t|ƒj| _t|ƒ| _d S r\   )r   r  r   r,   r  r    r  r  r^   r%   r%   r&   r   _  s   
z!KERB_HASHPASSWORD_6_1607.__init__Nr§   r%   r%   r%   r&   rH   ^  r¨   rH   c                       rY   )ÚPKIWI_KERBEROS_KEYS_LIST_5c                    r[   r\   )r   r   r1   r^   r#   r%   r&   r   f  r`   z#PKIWI_KERBEROS_KEYS_LIST_5.__init__ra   r%   r%   r#   r&   r  e  rb   r  c                   @   ó   e Zd Zdd„ Zdd„ ZdS )r1   c                 C   sD   t |ƒj| _t |ƒj| _t|ƒj| _t|ƒj| _| ¡ | _g | _	d S r\   )
r   r,   r    ÚcbItemr   r¡   r¬   re   ÚKeyEntries_startÚ
KeyEntriesr^   r%   r%   r&   r   j  s   

z"KIWI_KERBEROS_KEYS_LIST_5.__init__c                 C   ó0   |  | j¡ t| jƒD ]
}| j ||ƒ¡ qd S r\   ©Úmover"  Úranger!  r#  Úappend©r!   r_   Úkeyentries_typeÚ_r%   r%   r&   rk   s  ó   ÿzKIWI_KERBEROS_KEYS_LIST_5.readN©rT   rU   rV   r   rk   r%   r%   r%   r&   r1   i  s    	r1   c                       rY   )ÚPKIWI_KERBEROS_KEYS_LIST_6c                    r[   r\   )r   r   r9   r^   r#   r%   r&   r   y  r`   z#PKIWI_KERBEROS_KEYS_LIST_6.__init__ra   r%   r%   r#   r&   r.  x  rb   r.  c                   @   r   )r9   c                 C   s\   t |ƒj| _t |ƒj| _t|ƒj| _t|ƒj| _t|ƒj| _t|ƒj| _| 	¡ | _
g | _d S r\   )r   r,   r    r!  r   r¡   r¬   r®   r³   re   r"  r#  r^   r%   r%   r&   r   |  s   

z"KIWI_KERBEROS_KEYS_LIST_6.__init__c                 C   r$  r\   r%  r)  r%   r%   r&   rk   ˆ  r,  zKIWI_KERBEROS_KEYS_LIST_6.readNr-  r%   r%   r%   r&   r9   {  s    r9   c                       rY   )ÚPKIWI_KERBEROS_ENUM_DATA_TICKETc                    r[   r\   )r   r   ÚKIWI_KERBEROS_ENUM_DATA_TICKETr^   r#   r%   r&   r   �  r`   z(PKIWI_KERBEROS_ENUM_DATA_TICKET.__init__ra   r%   r%   r#   r&   r/  Ž  rb   r/  c                   @   r�   )r0  c                 C   s   t |ƒj| _t |ƒj| _d S r\   )r   r,   ÚisTicketExportÚisFullTicketr^   r%   r%   r&   r   ’  s   z'KIWI_KERBEROS_ENUM_DATA_TICKET.__init__Nr§   r%   r%   r%   r&   r0  ‘  r¨   r0  c                   @   r   )rý   c                 C   s(   t |ƒj| _| ¡  t|ƒ| _d | _d S r\   )r   r,   ÚLengthr¸   r   ÚValueÚDatar^   r%   r%   r&   r   —  s   

zKIWI_KERBEROS_BUFFER.__init__c                 C   s   | j  || j¡| _| jS r\   )r4  Úread_rawr3  r5  r^   r%   r%   r&   rk   Ÿ  s   zKIWI_KERBEROS_BUFFER.readNr-  r%   r%   r%   r&   rý   –  s    rý   c                   @   r�   )ÚKerberosHashPasswordc                 C   s   d | _ d | _d | _d | _d S r\   )r  Ú
iterationsÚaes128Úaes256©r!   r%   r%   r&   r   ¤  s   
zKerberosHashPassword.__init__Nr§   r%   r%   r%   r&   r7  £  r¨   r7  c                   @   s,   e Zd Zdd„ Zdd„ Zdd„ Zdd„ Zd	S )
ÚKerberosCredentialc                 C   s.   d | _ d | _d | _d | _d | _d | _d | _d S r\   )ÚluidÚusernameÚ
domainnameÚpasswordÚpassword_rawÚ
aes_key128Ú
aes_key256r;  r%   r%   r&   r   «  s   
zKerberosCredential.__init__c                 C   sh   d}|d| j  7 }|d| j 7 }| jr|d| j 7 }| jr&|d| j ¡  7 }| jr2|d| j ¡  7 }|S )Nz		== Kerberos ==
z		Username: %s
z		Domain: %s
z		Password: %s
z		AES128 Key: %s
z		AES256 Key: %s
)r>  r?  r@  rB  ÚhexrC  r�   r%   r%   r&   Ú__str__´  s   zKerberosCredential.__str__c                 C   s`   i }d|d< | j |d< | j|d< | j|d< | j|d< | jr$| j ¡ |d< | jr.| j ¡ |d< |S )	NÚkerberosÚcredtyper>  r?  r@  rA  r9  r:  )r>  r?  r@  rA  rB  rD  rC  r�   r%   r%   r&   Úto_dictÀ  s   



zKerberosCredential.to_dictc                 C   sd   g }| j r| d| j| jddd| j  ¡ ddf ¡ | jr0| d| j| jdddd| j ¡ df ¡ |S )Nz kerberos	%s	%s	%s	%s	%s	%s	%s	%sr|   )rB  r(  r>  r?  rD  rC  )r!   Úlinesr%   r%   r&   Úto_grep_lineÍ  s0   ø
ø
zKerberosCredential.to_grep_lineN)rT   rU   rV   r   rE  rH  rJ  r%   r%   r%   r&   r<  ª  s
    	r<  )Vrl   Úminidump.win_datatypesr   r   r   r   r   Úpypykatz.commons.commonr   r   r	   Úpypykatz.commons.win_datatypesr
   r   r   r   r   r   r   r   r   r   Ú%pypykatz.lsadecryptor.package_commonsr   r   r   rZ   r]   r•   r–   rœ   r3   r©   r;   r«   r?   r­   rB   r¯   r/   rÏ   r5   rÓ   rÔ   rØ   rO   rA   rß   rà   rã   rä   rè   rF   rK   rQ   rê   r0   r  r6   r
  r8   r  r=   r  rD   r  rJ   r  rG   r  r  r  r2   r  r:   r  rH   r  r1   r.  r9   r/  r0  rý   r7  r<  r%   r%   r%   r&   Ú<module>   sˆ   0 P)-&)7,
<,3$"$*)+*		