o
    j#                     @   sf   d dl mZ d dlmZmZ d dlmZ d dlmZm	Z	 d dl
mZ G dd dZG dd	 d	eZd
S )    )List)KerberosTicketKerberosTicketType)PackageDecryptor)PLIST_ENTRYPRTL_AVL_TABLE)WindowsMinBuildc                   @   s$   e Zd Zdd Zdd Zdd ZdS )KerberosCredentialc                 C   sL   d| _ d | _d | _d| _d | _d | _g | _d | _d | _d | _	d | _
d | _d S )Nkerberos    )credtypeusernamepasswordpassword_raw
domainnameluidticketspinpin_rawcardinfo
aes_key128
aes_key256)self r   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/lsadecryptor/packages/kerberos/decryptor.py__init__   s   
zKerberosCredential.__init__c                 C   s  d}|d| j  7 }|d| j 7 }| jd ur%|d| j 7 }|d| j  7 }| jd ur:|d| j 7 }|d| j  7 }| jd urg|d7 }|d	| jd
  7 }|d| jd  7 }|d| jd  7 }|d| jd  7 }| jrs|d| j  7 }| j	r|d| j	  7 }|S )Nz	== Kerberos ==
z		Username: %s
z		Domain: %s
z		Password: %s
z		password (hex)%s
z
		PIN: %s
z		PIN (hex): %s
z		CARDINFO: 
z			CardName: %s
CardNamez			ReaderName: %s

ReaderNamez			ContainerName: %s
ContainerNamez			CSPName: %s
CSPNamez		AES128 Key: %s
z		AES256 Key: %s
)
r   r   r   r   hexr   r   r   r   r   )r   tr   r   r   __str__   s(   


zKerberosCredential.__str__c                 C   s   i }| j |d< | j|d< | j|d< | j|d< | j|d< | j|d< | j|d< | j|d< | j|d	< g |d
< | j	D ]}|
 |d
< q6| jrI| j |d< | jrS| j |d< |S )Nr   r   r   r   r   r   r   r   r   r   aes128aes256)r   r   r   r   r   r   r   r   r   r   to_dictr   r    r   )r   r!   ticketr   r   r   r%   8   s$   









zKerberosCredential.to_dictN)__name__
__module____qualname__r   r"   r%   r   r   r   r   r	      s    r	   c                       sF   e Zd Zd fdd	Zdd Zdd Zdd	 Zd
d Zdd Z  Z	S )KerberosDecryptorTc                    s4   t  d||| || _|| _g | _d | _d | _d S )NKerberos)superr   decryptor_templatewith_ticketscredentialscurrent_ticket_typecurrent_cred)r   readerr-   lsa_decryptorsysinfor.   	__class__r   r   r   N   s   
zKerberosDecryptor.__init__c                 C   s   |  d| jj   | d| jj}|  dt|  |  dt|| jj   | j|| jj }|  dt|  | j|}|  dt|  ||fS )Nz#Scanning for Kerberos signature! %szkerberos.dllzSignature @ %szSignature (corrected) @ %szFirst entry ptr @ %szFirst entry -> %s)	logr-   	signaturer    find_signaturefirst_entry_offsetr2   get_ptr_with_offsetget_ptr)r   positionptr_entry_loc	ptr_entryr   r   r   find_first_entryW   s   z"KerberosDecryptor.find_first_entryc              
   C   sJ   zt || j| jj| j}| jj| W d S  t	y$ } z|d }~ww )N)
r   parser2   r-   r4   r0   r1   r   append	Exception)r   kerberos_ticketkter   r   r   handle_ticketb   s   zKerberosDecryptor.handle_ticketc           	      C   s.  z|   \}}W n ty" } z| d|  W Y d }~d S d }~ww | jjtjjk r?| j	| t
| j}| || j d S g }| j	| t| j| j}| |jj| |D ]:}| || jjj | j	| | j| j}z| | W qZ ty } z| d|  W Y d }~ d S d }~ww d S )Nz"Failed to find structs! Reason: %s%Failed to process session! Reason: %s)r@   rC   r7   r4   buildnumberr   	WIN_VISTAvaluer2   mover   	walk_listprocess_session_elistr   readwalk_avlBalancedRoot
RightChildlog_ptrr-   kerberos_session_structr'   process_session)	r   entry_ptr_valueentry_ptr_locrF   	entry_ptrresult_ptr_list
start_nodeptrkerberos_logon_sessionr   r   r   starti   s6   
zKerberosDecryptor.startc              
   C   sv   | j |j | j   | j   | j| j }z| | W d S  ty: } z| d|  W Y d }~d S d }~ww )NrH   )	r2   rL   location	read_uintr-   rT   rU   rC   r7   )r   elistr\   rF   r   r   r   rN      s   

z'KerberosDecryptor.process_session_elistc           	      C   s>  t  | _|j| j_|jj| j| j_|jj	| j| j_
|jjdkr|jj| j| jjd}|| j| jj |jD ]M}|jjdkr|jjdkre|jj| j|jj}|rd| j|dd\}}|rd|| j_q:|jjdkr|jj| j|jj}|r| j|dd\}}|r|| j_q:|jjjdkr| jjddu r| j|jj| jdd\| j_| j_| jjd ur| jj | j_n| |jj| j\| j_| j_|j jdkr|j j| j| jj!d}|j"| j}| |\| j_#| j_$|j%dkr|j&' | j_(| j)du r|j*j+jdkr1|j*j+j|j*j+j,kr1|j*j+j|j*j+j,d kr1t-j.| _/| j0|j*j+| j1| jj2d	 |j3j+jdkrb|j3j+j|j3j+j,krb|j3j+j|j3j+j,d krbt-j4| _/| j0|j3j+| j1| jj2d	 |j5j+jdkr|j5j+j|j5j+j,kr|j5j+j|j5j+j,d krt-j6| _/| j0|j5j+| j1| jj2d	 d | _/| j7| j d S )
Nr   )override_finaltype   T)bytes_expected    $   )override_ptr)8r	   r1   LocallyUniqueIdentifierr   r/   UserNameread_stringr2   r   Domainer   pKeyListrK   rO   r-   keys_list_structhash_password_struct
KeyEntriesgenericSize	Checksumpread_rawdecrypt_passwordr   r   PasswordLengthendswithread_maxdatar   r   r    SmartcardInfoscsp_info_structPinCoder   r   CspDataLengthCspData	get_infosr   r.   	Tickets_1Flinkr^   r   TGSr0   rM   rG   kerberos_ticket_struct	Tickets_2CLIENT	Tickets_3TGTrB   )	r   r\   key_listkeykeydatadec_key_csp_infopin_encr   r   r   rU      sv   


z!KerberosDecryptor.process_session)T)
r'   r(   r)   r   r@   rG   r]   rN   rU   __classcell__r   r   r5   r   r*   M   s    	r*   N)typingr   pypykatz.commons.kerberosticketr   r   %pypykatz.lsadecryptor.package_commonsr   pypykatz.commons.win_datatypesr   r   pypykatz.commons.commonr   r	   r*   r   r   r   r   <module>   s   A