o
    Žõ±j¯  ã                   @   s”   d dl mZ d dlmZ d dlmZ G dd„ dƒZG dd„ deƒZG dd	„ d	eƒZ	G d
d„ deƒZ
G dd„ deƒZG dd„ deƒZG dd„ dƒZdS )é    )Úmd4)ÚDPAPI_SYSTEM)Úhexdumpc                   @   s4   e Zd Zddd„Zeddd„ƒZdd„ Zd	d
„ ZdS )Ú	LSASecretFc                 C   s   || _ || _|| _d S ©N)Ú
raw_secretÚkey_nameÚhistory©Úselfr   r   r	   © r   ú”/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/registry/security/common.pyÚ__init__   s   
zLSASecret.__init__Nc                 C   sè   |   ¡ }t|ƒdkrd S | d¡rd S | d¡r%t||||ƒ}| ¡  |S | d¡r6t|||ƒ}| ¡  |S | d¡rGt|||ƒ}| ¡  |S | d¡rXt|||ƒ}| ¡  |S | d¡rlt||||j	d�}| ¡  |S t
|||ƒ}|S )	Nr   s     Ú_SC_ÚDEFAULTPASSWORDÚASPNET_WP_PASSWORDr   z$MACHINE.ACC)Úusername)ÚupperÚlenÚ
startswithÚLSASecretServiceÚprocess_secretÚLSASecretDefaultPasswordÚLSASecretASPNETÚLSASecretDPAPIÚLSASecretMachineAccountÚmachinenamer   )r   r   r	   Úsystem_hiveÚknÚlssr   r   r   Úprocess   s6   


í
ñ
õ	
ùþzLSASecret.processc                 C   s"   d| j  d| j  d t| jƒ S )Nz=== LSASecret %s ===
z
History: %sz
Secret: 
)r   r	   r   r   ©r   r   r   r   Ú__str__9   ó   "zLSASecret.__str__c                 C   s.   i }d|d< | j |d< | j|d< | j|d< |S )Nr   Útyper   r	   r   )r   r	   r   ©r   Útr   r   r   Úto_dict<   s   


zLSASecret.to_dict)F)FN)Ú__name__Ú
__module__Ú__qualname__r   Ústaticmethodr    r"   r'   r   r   r   r   r      s    
 r   c                   @   ó.   e Zd Zd
dd„Zdd„ Zdd„ Zdd	„ ZdS )r   Nc                 C   s,   t  | |||¡ || _d | _d | _d | _d S r   )r   r   r   Úservicer   Úsecret)r   r   r   r	   r   r   r   r   r   E   ó
   
zLSASecretService.__init__c                 C   sv   z	| j  d¡| _W n   | j  ¡ | _Y d S | j| _d| _| jd ur9t| jdd … ƒ | j 	| jdd … ¡| _d S d S )Nú	utf-16-leÚUNKNOWNé   )
r   Údecoder.   Úhexr   r-   r   r   ÚprintÚget_service_userr!   r   r   r   r   L   s   
þzLSASecretService.process_secretc                 C   s"   d| j | j| jf d t| jƒ S )NzM=== LSA Service User Secret ===
History: %s
Service name: %s 
Username: %sz
)r	   r-   r   r   r.   r!   r   r   r   r"   Z   r#   zLSASecretService.__str__c                 C   óB   i }d|d< | j |d< | j|d< | j|d< | j|d< | j|d< |S )Nr   r$   r   r	   r   r.   r-   )r   r	   r   r.   r-   r%   r   r   r   r'   ]   ó   




zLSASecretService.to_dictr   ©r(   r)   r*   r   r   r"   r'   r   r   r   r   r   D   s
    
r   c                   @   ó,   e Zd Zdd„ Zdd„ Zdd„ Zdd„ Zd	S )
r   c                 C   ó    t  | |||¡ d | _d | _d S r   ©r   r   r   r.   r
   r   r   r   r   h   ó   
z!LSASecretDefaultPassword.__init__c                 C   s:   z| j  d¡| _| j dd¡| _W n   Y d S d| _d S )Nr0   ú Ú r1   )r   r3   r.   Úreplacer   r!   r   r   r   r   m   s   
z'LSASecretDefaultPassword.process_secretc                 C   ó   d| j | j| jf S )NzE=== LSA Default Password ===
History: %s
Username: %s
Password: %s©r	   r   r.   r!   r   r   r   r"   x   ó   z LSASecretDefaultPassword.__str__c                 C   ó8   i }d|d< | j |d< | j|d< | j|d< | j|d< |S )Nr   r$   r   r	   r   r.   ©r   r	   r   r.   r%   r   r   r   r'   {   ó   



z LSASecretDefaultPassword.to_dictNr9   r   r   r   r   r   g   s
    r   c                   @   r:   )
r   c                 C   s    t  | |||¡ d| _d | _d S )NÚASPNETr<   r
   r   r   r   r   …   r=   zLSASecretASPNET.__init__c                 C   s"   z
| j  d¡| _W d S    Y d S )Nr0   )r   r3   r.   r!   r   r   r   r   Š   s   zLSASecretASPNET.process_secretc                 C   rA   )NzD=== LSA ASPNET Password ===
History: %s
Username: %s
Password: %srB   r!   r   r   r   r"   �   rC   zLSASecretASPNET.__str__c                 C   rD   )Nr   r$   r   r	   r   r.   rE   r%   r   r   r   r'   “   rF   zLSASecretASPNET.to_dictNr9   r   r   r   r   r   „   s
    r   c                   @   r,   )r   Nc                 C   s,   t  | |||¡ || _d | _d | _|| _d S r   )r   r   r   r.   Úkerberos_passwordr   )r   r   r   r	   r   r   r   r   r   �   r/   z LSASecretMachineAccount.__init__c                 C   s0   t | jƒ}| ¡ | _| j dd¡ dd¡| _d S )Nr0   r@   zutf-8)ÚMD4r   Údigestr.   r3   ÚencoderH   )r   Úctxr   r   r   r   ¤   s   

z&LSASecretMachineAccount.process_secretc                 C   r7   )Nr   r$   r   r	   r   r.   rH   )r   r	   r   r.   rH   r%   r   r   r   r'   ­   r8   zLSASecretMachineAccount.to_dictc                 C   s(   d| j | j| j ¡ | j ¡ | j ¡ f S )Nzv=== LSA Machine account password ===
History: %s
Username: %s
NT: %s
Password(hex): %s
Kerberos password(hex): %s)r	   r   r.   r4   r   rH   r!   r   r   r   r"   ·   s   (zLSASecretMachineAccount.__str__r   ©r(   r)   r*   r   r   r'   r"   r   r   r   r   r   œ   s
    
	
r   c                   @   r:   )
r   c                 C   r;   r   )r   r   Úmachine_keyÚuser_keyr
   r   r   r   r   ¼   r=   zLSASecretDPAPI.__init__c                 C   s    t  | j¡}|j| _|j| _d S r   )r   Ú
from_bytesr   rN   rO   )r   Údsr   r   r   r   Á   s   zLSASecretDPAPI.process_secretc                 C   rD   )Nr   r$   r   r	   rN   rO   )r   r	   rN   rO   r%   r   r   r   r'   Æ   rF   zLSASecretDPAPI.to_dictc                 C   s   d| j | j ¡ | j ¡ f S )NzO=== LSA DPAPI secret ===
History: %s
Machine key (hex): %s
User key(hex): %s)r	   rN   r4   rO   r!   r   r   r   r"   Ï   s   zLSASecretDPAPI.__str__NrM   r   r   r   r   r   »   s
    	r   c                   @   s8   e Zd Zddd„Zdd„ Zddd„Zd	d
„ Zdd„ ZdS )ÚLSADCCSecreté (  Nc                 C   s(   || _ || _|| _|| _|| _|| _d S r   )ÚversionÚdomainr   Ú	iterationÚ
hash_valueÚlast_write_ts)r   rT   rU   r   rW   rV   rX   r   r   r   r   Ó   s   
zLSADCCSecret.__init__c                 C   sF   i }| j |d< | j|d< | j|d< | j|d< | j|d< |  ¡ |d< |S )NrT   rU   r   rV   rW   Ú	lastwrite)rT   rU   r   rV   rW   Úget_lastwriter%   r   r   r   r'   Û   s   




zLSADCCSecret.to_dictc                 C   s   | j d u r|S | j  d¡S )Nz%Y-%m-%d %H:%M:%S)rX   Ústrftime)r   Údefaultr   r   r   rZ   å   s   
zLSADCCSecret.get_lastwritec                 C   s   |   ¡ S r   )Úto_lopthr!   r   r   r   r"   ê   s   zLSADCCSecret.__str__c                 C   sN   | j dkrd| j| j| j ¡ | jf S d| j| j|  d¡| j| j| j ¡ f S )Né   z%s/%s:%s:%sz%s/%s:*%s*$DCC2$%s#%s#%sr?   )rT   rU   r   rW   r4   rZ   rV   r!   r   r   r   r]   í   s   
(zLSADCCSecret.to_lopth)rS   Nr   )r(   r)   r*   r   r'   rZ   r"   r]   r   r   r   r   rR   Ò   s    


rR   N)Úunicrypto.hashlibr   rI   Ú pypykatz.dpapi.structures.systemr   Úpypykatz.commons.commonr   r   r   r   r   r   r   rR   r   r   r   r   Ú<module>   s   	2#