o
    Žõ±j)  ã                   @   sZ   d dl Z d dlmZ d dlmZ d dlmZ d dlmZ d dl	m
Z
mZ G dd„ dƒZdS )	é    N)Úlogger)ÚMinidumpFile)ÚKatzSystemInfo)ÚRDPCredsTemplate)Ú$RDPCredentialDecryptorLogonpasswordsÚRDPCredentialDecryptorMstscc                   @   sB   e Zd Zddd„Zeddd„ƒZedd
d„ƒZdd„ Zdd„ ZdS )ÚRDPCredParserFr   éÿÿÿÿc                 C   s4   || _ || _|| _g | _|| _|| _|| _|| _d S ©N)ÚprocessÚreaderÚsysinfoÚcredentialsÚ
rdp_moduleÚ
find_firstÚlower_boundÚupper_bound)Úselfr   r   r   r   r   r   r   © r   ú†/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/rdp/parser.pyÚ__init__
   s   
zRDPCredParser.__init__Nc                 C   sÚ  t  ¡ dkr
tdƒ‚ddlm}m} ddlm} ddlm	}m
}m}m}	m}
 ddlm} ddlm} dd	lm} ||B |B |	B |
B }|ƒ  g }| d urm|| |d
�}| ¡  ||jd�}t |¡}| t|| ¡ ||ƒ¡ nô|ƒ }|dkr£|du r£| ¡ D ]&\}}} |dkr¢|| |d
�}||jd�}t |¡}| t|| ¡ ||ƒ¡ q||dkrý|du rý| ¡ D ]M} z2|| |d
�}| ¡ D ]%}|j ¡  d¡dkrá||jd�}t |¡}| t|| ¡ ||ƒ¡  nq¼W n tyõ } zW Y d }~nd }~ww t |ƒrü nq¯|du �ra| ¡ D ]Z} z@|| |d
�}| ¡ D ]2}|j ¡  d¡dk�s+|j ¡  d¡dk�rD||jd�}t |¡}| t|| ¡ ||ƒ¡  n�qW �q t�y` } zt!|ƒ W Y d }~�qd }~ww |D ]}| "¡  �qc|S )NÚWindowsz&Live parsing will only work on Windowsr   )ÚOpenProcessÚPROCESS_ALL_ACCESS)ÚLiveMachine)ÚPROCESS_VM_READÚPROCESS_VM_WRITEÚPROCESS_VM_OPERATIONÚPROCESS_QUERY_INFORMATIONÚPROCESS_CREATE_THREAD)Úenable_debug_privilege)Ú
LiveReader)ÚProcess)ÚpidÚaccess)Úprocess_handleÚlogonpasswordsFÚTermServiceÚmstsczmstscax.dllr	   Tzrdpcorets.dll)#ÚplatformÚsystemÚ	ExceptionÚ8pypykatz.commons.readers.local.common.live_reader_ctypesr   r   Úpypykatz.commons.winapi.machiner   Ú!pypykatz.commons.winapi.constantsr   r   r   r   r   Ú0pypykatz.commons.readers.local.common.privilegesr    Ú*pypykatz.commons.readers.local.live_readerr!   Ú&pypykatz.commons.readers.local.processr"   Úlist_modulesÚphandler   Úfrom_live_readerÚappendr   Úget_buffered_readerÚlist_servicesÚlist_all_pidsÚnameÚlowerÚfindÚlenÚprintÚstart)r#   Úall_rdpÚlive_rdp_moduler   r   r   r   r   r   r   r   r    r!   r"   Úreq_access_rightsÚtargetsr   r   r   ÚmachineÚservice_nameÚdisplay_nameÚmoduleÚeÚtargetr   r   r   Úgo_live   s€   

€
ü€€ýÿ
,
ü€€ýzRDPCredParser.go_liveé (  c              
   C   s–   zt  | ¡}| ¡ j|d�}t |¡}W n ty' } zt d¡ |‚d }~ww zt	d |||ƒ}| 
¡  W |gS  tyJ } zt d¡ |‚d }~ww )N)Úsegment_chunk_sizezMinidump parsing error!zCredentials parsing error!)r   ÚparseÚ
get_readerr6   r   Úfrom_minidumpr+   r   Ú	exceptionr   r>   Úinfo)Úfilenamer   Ú	chunksizeÚminidumpr   r   rG   Úmimir   r   r   Úparse_minidump_fileY   s$   

€þ
ý
€þz!RDPCredParser.parse_minidump_filec              	   C   s€   | j dkrt | j¡}t| j| j|| j| j| j| j	d�}nt 
¡ }t| j| j|| j| jd�}| ¡  |jD ]}| j |¡ q5d S )Nr&   )r   r   r   )r   )r   r   Úget_logonpasswords_templater   r   r   r   r   r   r   Úget_mstsc_templater   r>   r   r5   )r   Údecryptor_templateÚ	decryptorÚcredr   r   r   Úrdpcredsj   s   
$
ÿzRDPCredParser.rdpcredsc                 C   s   |   ¡  d S r
   )r[   )r   r   r   r   r>   w   s   zRDPCredParser.start)Fr   r	   )NFN)rJ   )	Ú__name__Ú
__module__Ú__qualname__r   ÚstaticmethodrI   rU   r[   r>   r   r   r   r   r   	   s    

Dr   )r)   Úpypykatzr   Úminidump.minidumpfiler   Úpypykatz.commons.commonr   Ú%pypykatz.rdp.packages.creds.templatesr   Ú%pypykatz.rdp.packages.creds.decryptorr   r   r   r   r   r   r   Ú<module>   s   