o
    Žõ±jœ  ã                   @   sr   d dl mZ d dlmZmZmZmZmZ d dlm	Z	 d dl
mZ d dlmZmZmZmZmZmZ G dd„ dƒZdS )	é    )Úhashlib)ÚRC4ÚAESÚMODE_CBCÚexpand_DES_keyÚDES)Úlogger)Ú	SAMSecret)ÚSAM_HASHÚDOMAIN_ACCOUNT_FÚSAM_KEY_DATAÚSAM_KEY_DATA_AESÚUSER_ACCOUNT_VÚSAM_HASH_AESc                   @   sP   e Zd Zdd„ Zedd„ ƒZdd„ Zdd„ Zd	d
„ Zdd„ Z	dd„ Z
dd„ ZdS )ÚSAMc                 C   s"   || _ || _d | _d | _g | _d S )N)ÚhiveÚbootkeyÚhashed_bootkeyÚmachine_sidÚsecrets)ÚselfÚsam_hiver   © r   úŒ/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/registry/sam/sam.pyÚ__init__   s
   
zSAM.__init__c                 C   sŠ   t | dƒjdddd�}|d |d |d |d	 |d |d |d g}|d	 |d |d |d |d	 |d |d g}tt|ƒƒtt|ƒƒfS )
Né   é   ÚlittleF©Úsignedr   é   é   é   )ÚintÚto_bytesr   Úbytes)ÚridÚkeyÚkey1Úkey2r   r   r   Ú
rid_to_key   s   ..zSAM.rid_to_keyc                    sø   t  |¡\}}t|ƒ}t|ƒ}tˆ tƒr6t | jd d… t|dƒj	dddd� | ¡ 
¡ }t|ƒ ˆ j¡}	n2d}	t| jd d… tˆ jd�}
d‰‡ ‡fdd	„td
tˆ jƒˆƒD ƒD ]	}|	|
 |¡7 }	qX|	d d… }	| |	d d… ¡| |	dd … ¡ }|S )Nr   r   r   Fr   ó    ©ÚIVc                    s   g | ]}ˆ j ||ˆ … ‘qS r   )Údata©Ú.0Úi©ÚhashobjÚnr   r   Ú
<listcomp>3   s    z$SAM.decrypt_hash.<locals>.<listcomp>r   é   )r   r*   r   Ú
isinstancer
   r   Úmd5r   r#   r$   Údigestr   ÚencryptÚhashr   r   ÚsaltÚrangeÚlenr.   Údecrypt)r   r&   r3   Úconstantr(   r)   Údes1Údes2Úrc4keyr'   ÚcipherÚblockÚdec_hashr   r2   r   Údecrypt_hash&   s   
2&$zSAM.decrypt_hashc                    sZ  t  d¡ d}d}| j d¡d }t  dd| ¡ t |¡‰ tˆ jt	ƒrlt
 ˆ jj| | j | ¡ ¡ }t|ƒ ˆ jjˆ jj ¡| _t
 | jd d… | | jd d…  | ¡ ¡ }|| jdd … krkt  d¡ tdƒ‚n4tˆ jtƒr d	| _t| jtˆ jjd
�}d‰‡ ‡fdd„tdtˆ jjƒˆƒD ƒD ]}|  j| |¡7  _q“t  d| j ¡  ¡ | jS )NzSAM parsing hashed bootkeys/   !@#$%^&*()qwertyUIOPAzxcvbnmQQQQQQQQQQQQ)(*@&% s)   0123456789012345678901234567890123456789 zSAM\Domains\Account\Fr    z[SAM] F key value: %sr   z,[SAM] HBootkey checksum verification failed!r+   r,   c                    s    g | ]}ˆ j j||ˆ … ‘qS r   )Úkey_0r.   r/   ©Údomain_propertiesr4   r   r   r5   S   s     z%SAM.get_HBoot_key.<locals>.<listcomp>r   z[SAM] HBootkey: %s)r   Údebugr   Ú	get_valueÚlogr   Ú
from_bytesr7   rH   r   r   r8   r<   r   r9   r   r:   r'   Úchecksumr   ÚerrorÚ	Exceptionr   r   r   r=   r>   r.   r?   Úhex)r   ÚQWERTYÚDIGITSÚFÚrc4_keyrO   rD   rE   r   rI   r   Úget_HBoot_key;   s,   

 .
þ(zSAM.get_HBoot_keyc              
   C   s¸   z?| j  d¡d }|dd … }tj|d d… ddd�}tj|dd… ddd�}tj|dd	… ddd�}d
d|||f | _W | jS  ty[ } zdd l}| ¡  W Y d }~| jS d }~ww )NzSAM\Domains\Account\Vr    iôÿÿÿr   r   Fr   r6   é   z%s-%s-%s-%szS-1-5-21r   )r   rL   r#   rN   r   rQ   Ú	tracebackÚ	print_exc)r   Úuac_dataÚp1Úp2Úp3ÚerY   r   r   r   Úget_machine_sidY   s   ý€ýzSAM.get_machine_sidc                 C   sr  t  d¡ d}d}d}d}|  ¡  |  ¡  | j d¡D ]š}d }|dkr$qd| }t  d	| ¡ | j |¡d
 }t |¡}t	 
|¡}	t	 
|¡}
|jr^t|jtƒr^|jjdkr]|  ||j|¡}	n|jrut|jtƒru|jjdkru|  ||j|¡}	|jr�t|jtƒr�|jjdkrŒ|  ||j|¡}
n|jr¤t|jtƒr¤|jjdkr¤|  ||j|¡}
t|jt|dƒ|	|
ƒ}| j |¡ q| jS )NzSAM get_secrets invokeds   NTPASSWORD s   LMPASSWORD Ú 31d6cfe0d16ae931b73c59d7e0c089c0Ú aad3b435b51404eeaad3b435b51404eezSAM\Domains\Account\UsersÚNameszSAM\Domains\Account\Users\%s\Vz![SAM] Parsing secrets for RID: %sr    r+   r   )r   rK   rW   r`   r   Úenum_keyrL   r   rN   r%   ÚfromhexÚNT_hashr7   r   r.   rG   r
   r;   ÚLM_hashr	   Únamer#   r   Úappend)r   Ú
NTPASSWORDÚ
LMPASSWORDÚ	NTDEFAULTÚ	LMDEFAULTr&   ÚuacÚkey_pathr[   ÚnthashÚlmhashÚsecretr   r   r   Úget_secretsh   sD   



€€zSAM.get_secretsc                 C   s8   i }| j |d< g |d< | jD ]}|d  | ¡ ¡ q|S )NÚ	HBoot_keyÚlocal_users)r   r   ri   Úto_dict©r   Útrr   r   r   r   rv   “   s   

zSAM.to_dictc                 C   s6   d}|d| j  ¡  7 }| jD ]
}|d| ¡  7 }q|S )Nz0============== SAM hive secrets ==============
zHBoot Key: %s
z%s
)r   rR   r   Úto_lopthrw   r   r   r   Ú__str__›   s
   
zSAM.__str__N)Ú__name__Ú
__module__Ú__qualname__r   Ústaticmethodr*   rG   rW   r`   rs   rv   rz   r   r   r   r   r      s    
+r   N)Ú	unicryptor   Úunicrypto.symmetricr   r   r   r   r   Úpypykatz.registryr   Úpypykatz.registry.sam.commonr	   Ú pypykatz.registry.sam.structuresr
   r   r   r   r   r   r   r   r   r   r   Ú<module>   s    