o
    Žõ±j±  ã                   @   sz   d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlmZ d dl	m
Z
 d dlmZ d dlmZ G dd„ dƒZdS )é    N)Úlogger)Ú	apypykatz)ÚUniversalEncoder)ÚLogonSessionc                   @   s<   e Zd Zdd„ Zdd„ Zdd„ Zdd„ Zd	d
„ Zdd„ ZdS )ÚLSACMDHelperc                 C   s   dg| _ dg| _d S )NÚlsa)Úlive_keywordsÚkeywords)Úself© r   ú“/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/alsadecryptor/cmdhelper.pyÚ__init__   s   zLSACMDHelper.__init__c                 C   sÖ   |j ddd�}|jdddgd� |jdd	d� |jd
dtdd� |jdddd� |jddddd� |jdddd� |jdddd� |jddddd� |jdddd d� |jd!d"dd#d� |jd$d%g d&¢d'd(d)d*� d S )+Nr   zGet secrets from memory dump)ÚhelpÚcmdÚminidumpÚrekall)ÚchoicesÚ
memoryfilezpath to the dump filez-tz--timestamp_overridez;enforces msv timestamp override (0=normal, 1=anti_mimikatz))Útyper   z--jsonÚ
store_truez Print credentials in JSON format)Úactionr   z-ez--halt-on-errorz*Stops parsing when a file cannot be parsedz-oz	--outfilez[Save results to file (you can specify --json for json file, or text format will be written)z-kz--kerberos-dirz%Save kerberos tickets to a directory.z-rz--recursivezRecursive parsingz-dz--directoryz Parse all dump files in a folderz-gz--grepz%Print credentials in greppable formatz-pz
--packages)ÚallÚmsvÚwdigestÚtspkgÚsspÚlivesspÚdpapiÚcloudapú+r   zLSASS package to parse)r   ÚnargsÚdefaultr   )Ú
add_parserÚadd_argumentÚint)r
   ÚparserÚlive_parserÚgroupr   r   r   Úadd_args   s   zLSACMDHelper.add_argsc                 C   sh   t | jƒdkr|j| jv rt |  |¡¡ t | jƒdkr.|jdkr0|j| jv r2|  |¡ d S d S d S d S )Nr   Úlive)Úlenr	   ÚcommandÚasyncioÚrunr   ÚmoduleÚrun_live©r
   Úargsr   r   r   Úexecute*   s
   $ÿzLSACMDHelper.executec                 C   s  |j r(|jr(t|j dƒ�}tj||tddd� W d   ƒ n1 s!w   Y  �np|j rv|jrvt|j ddd��6}| d tj	¡d ¡ |D ] }|| j
D ]}|| j
|  ¡ D ]}| d |¡d ¡ qVqKqDW d   ƒ n1 sow   Y  �n"|j rçt|j dƒ�^}|D ]<}| d	| ¡ || j
D ]}| d
t|| j
| ƒ ¡ q�t|| jƒdkr¾| d¡ || jD ]	}| t|ƒ¡ q´q‚t|ƒdkrÖ| d¡ |D ]	}	| d|	 ¡ qÌW d   ƒ n1 sàw   Y  �n±|jr÷ttj|tddd�ƒ �n¡|j�rû|j�rtd dgtj	 ¡ƒ ntd tj	¡ƒ |D ]ä}|| j
D ] }|| j
|  ¡ D ]}|j�r2|g| }td |¡ƒ �q'�q|| jD ]r}| ¡ }
|
d dk�rƒ|
d d u�r�t|
d ƒt|
d ƒt|
d ƒdddddt|
d ƒg	}|j�rz|g| }td |¡ƒ �qB| ¡ }
t|
d ƒdddddt|
d ƒt|
d ƒt|
d ƒdg
}|j�r¬|g| }td |¡ƒ �qB|| jD ]=\}}t|ƒd d t |j¡¡ }t | ¡ ¡ ¡ }|d dddddddd|g
}|j�rí|g| }td |¡d ƒ �qº�qn�|D ]…}td| ƒ t|| tƒ�rt|| ƒ �qý|| j
D ]}tt|| j
| ƒƒ �qt|| jƒdk�rFtdƒ || jD ]	}tt|ƒƒ �q<t|| jƒdk�r�tdƒ || jD ]'\}}t|ƒd d t |j¡¡ }t | ¡ ¡ ¡ }td|d |f ƒ �qY�qýt|ƒdk�r˜tdƒ |D ]}	t|	ƒ �q�|j�r	tj |j¡}t  !d| ¡ |D ]^}	t" #|	¡}d|t $d¡ %¡ f }||	 j& 'tj ||¡¡ ||	 j
D ]}||	 j
| j(D ]}|j)D ]}| *|¡ �qß�qÚ�qÐ||	 jD ]}|j+d k�r|j)D ]}| *|¡ �qü�qñ�q¬d S d S )!NÚwé   T)ÚclsÚindentÚ	sort_keysÚ )Únewlineú:z
zFILE: ======== %s =======
Ú
r   z
== Orphaned credentials ==
z!
== Failed to parse these files:
z%s
ÚfilenameÚcredtyper   ÚpasswordÚ
domainnameÚusernameÚ	masterkeyÚsha1_masterkeyÚkey_guidÚ_exception_please_reportzFILE: ======== %s =======z== Orphaned credentials ==z== Errors ==z%s %sz
==== Parsing errors:zWriting kerberos tickets to %sz%s_%s.ccacheÚkerberos),ÚoutfileÚjsonÚopenÚdumpr   ÚgrepÚwriteÚjoinr   Úgrep_headerÚlogon_sessionsÚto_grep_rowsÚstrr*   Úorphaned_credsÚprintÚdumpsÚ	directoryÚto_dictÚerrorsÚ	tracebackÚ	format_tbÚ__traceback__Úbase64Ú	b64encodeÚencodeÚdecodeÚ
isinstanceÚkerberos_dirÚosÚpathÚabspathr   ÚinfoÚntpathÚbasenameÚurandomÚhexÚkerberos_ccacheÚto_fileÚkerberos_credsÚticketsÚto_kirbir=   )r
   ÚresultsÚfiles_with_errorr1   ÚfÚresultÚluidÚrowÚcredr<   ÚtÚxÚpkgÚerrÚerr_strÚdirÚbase_filenameÚccache_filenameÚkcredÚticketr   r   r   Úprocess_results1   sâ   ÿ€ÿÿÿþ€
€
€ñ€
ý6
€8

úë€

ÿÿ
€ýôzLSACMDHelper.process_resultsc                 C   s   d S )Nr   r0   r   r   r   r/   ¢   s   zLSACMDHelper.run_livec           
      Ã   s’  �g }i }|j dkrÀ|jrtj |j¡}dD ]g}|jdkr&tj |d|¡}ntj ||¡}t 	d| ¡ t
j
||jd�D ]@}t 	d| ¡ ztj||jd�I d H }|||< W q< ty| }	 z| |¡ t d	| ¡ |jdkrq|	‚	 W Y d }	~	q<d }	~	ww qnAt 	d|j ¡ ztj|j|jd�I d H }|||j< W n% ty¿ }	 zt d
|j ¡ |jdkr±|	‚t ¡  W Y d }	~	nd }	~	ww |  |||¡ d S )Nr   )z*.dmpz*.DMPTz**zParsing folder %s)Ú	recursivezParsing file %s)ÚpackageszError parsing file %s zError while parsing file %s)r   rT   r`   ra   rb   r   r   rL   r   rc   Úglobr   Úparse_minidump_filer€   Ú	ExceptionÚappendÚ	exceptionÚhalt_on_errorrW   Ú	print_excr~   )
r
   r1   rn   rm   Údir_fullpathÚfile_patternÚglobdatar<   ÚmimiÚer   r   r   r-   ¥   sL   €



€úûù
€ûzLSACMDHelper.runN)	Ú__name__Ú
__module__Ú__qualname__r   r(   r2   r~   r/   r-   r   r   r   r   r      s    qr   )r`   rG   r�   rd   rW   r,   rZ   Úpypykatzr   Úpypykatz.apypykatzr   Úpypykatz.commons.commonr   Ú-pypykatz.alsadecryptor.packages.msv.decryptorr   r   r   r   r   r   Ú<module>   s   