o
    jN                     @   s^   d Z ddlmZ ddlmZ ddlT ddlZddlZddlZddl	m
Z
 G dd de
jZdS )	zTamas Jos <info@skelsec.com>    )pypykatz)RekallReader)*N)commonc                       s   e Zd ZdZ	 dZedddddeddd	d
eddd	d
edddddgZedddedddedddedddedddedddedddedddedd ded!d"dg
Z fd#d$Zd%d& Z	  Z
S )'Pypykatzz<Extract and decrypt passwords from the LSA Security Service.r   override_timestampintFz9The msv dll file timestamp detection fails in some cases.)nametyperequiredhelpout_filezThe file name to write.)r	   r   r   kerberos_dirjsonboolz(Write credentials to file in JSON format)r	   r   r
   r   LUID   )r	   widthType   Sess   SID   Module   InfoDomain   UserSType	   SecretP   c                    s   t t| j|i | d S )N)superr   __init__)selfargskwargs	__class__ /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/plugins/pypykatz_rekall.pyr%   3   s   zPypykatz.__init__c                 c   s&   | j j }t| j | jj}| jjrA| jjrA| j j	
d t| jjd}tj||tddd W d    n1 s;w   Y  nm| jjr| j j	
d t| jjd8}|d |jD ]'}|dt|j|   t|jd	kr|d
 |jD ]	}|t| qyq\W d    n1 sw   Y  n| j j	
d |jD ]}|j|  D ]}|V  qq| jjrtj| jj}| j j	
d|  td}d|td f }	|jtj||	 |jD ]}|j| jD ]}
|
j D ]}|!| qqq|jD ]}|j"dkr|j D ]}|!| qqd S )Nz&Dumping results to file in JSON formatw   T)clsindent	sort_keyszDumping results to filezFILE: ======== MEMORY =======

r   z
== Orphaned credentials ==
zDumping resultszWriting kerberos tickets to %srekall_memoryz%s_%s.ccachekerberos)#sessionpluginsccr   	go_rekallplugin_argsr   r   r   logginginfoopendumpUniversalEncoderwritelogon_sessionsstrlenorphaned_credsto_rowr   ospathabspathntpathbasenameurandomhexkerberos_ccacheto_filejoinkerberos_credsticketsto_kirbicredtype)r&   r7   mimifluidcredrow	directorybase_filenameccache_filenamekcredticketr+   r+   r,   collect6   s\   










zPypykatz.collect)__name__
__module____qualname____doc___Pypykatz__namedict_Pypykatz__argstable_headerr%   r]   __classcell__r+   r+   r)   r,   r      s<    









r   )
__author__pypykatz.pypykatzr   ,pypykatz.commons.readers.rekall.rekallreaderr   pypykatz.commons.commonr   rH   rE   rekall.plugins.windowsr   WindowsCommandPluginr   r+   r+   r+   r,   <module>   s   