o
    j                     @   s   d dl mZ d dlmZ d dlmZ G dd dZG dd deZG dd	 d	eZ	G d
d deZ
G dd deZG dd deZG dd dZdS )    )md4)DPAPI_SYSTEM)hexdumpc                   @   s4   e Zd ZdddZedddZdd Zd	d
 ZdS )	LSASecretFc                 C   s   || _ || _|| _d S N)
raw_secretkey_namehistoryselfr   r   r	    r   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/registry/security/common.py__init__   s   
zLSASecret.__init__Nc                 C   s   |   }t|dkrd S |drd S |dr%t||||}|  |S |dr6t|||}|  |S |drGt|||}|  |S |drXt|||}|  |S |drlt||||j	d}|  |S t
|||}|S )	Nr   s     _SC_DEFAULTPASSWORDASPNET_WP_PASSWORDr   z$MACHINE.ACC)username)upperlen
startswithLSASecretServiceprocess_secretLSASecretDefaultPasswordLSASecretASPNETLSASecretDPAPILSASecretMachineAccountmachinenamer   )r   r   r	   system_hiveknlssr   r   r   process   s6   




	
zLSASecret.processc                 C   s"   d| j  d| j  d t| j S )Nz=== LSASecret %s ===
z
History: %sz
Secret: 
)r   r	   r   r   r   r   r   r   __str__9      "zLSASecret.__str__c                 C   s.   i }d|d< | j |d< | j|d< | j|d< |S )Nr   typer   r	   r   )r   r	   r   r   tr   r   r   to_dict<   s   


zLSASecret.to_dict)F)FN)__name__
__module____qualname__r   staticmethodr    r"   r'   r   r   r   r   r      s    
 r   c                   @   .   e Zd Zd
ddZdd Zdd Zdd	 ZdS )r   Nc                 C   s,   t | ||| || _d | _d | _d | _d S r   )r   r   r   servicer   secret)r   r   r   r	   r   r   r   r   r   E   
   
zLSASecretService.__init__c                 C   sv   z	| j d| _W n   | j  | _Y d S | j| _d| _| jd ur9t| jdd   | j	| jdd  | _d S d S )N	utf-16-leUNKNOWN   )
r   decoder.   hexr   r-   r   r   printget_service_userr!   r   r   r   r   L   s   
zLSASecretService.process_secretc                 C   s"   d| j | j| jf d t| j S )NzM=== LSA Service User Secret ===
History: %s
Service name: %s 
Username: %sz
)r	   r-   r   r   r.   r!   r   r   r   r"   Z   r#   zLSASecretService.__str__c                 C   B   i }d|d< | j |d< | j|d< | j|d< | j|d< | j|d< |S )Nr   r$   r   r	   r   r.   r-   )r   r	   r   r.   r-   r%   r   r   r   r'   ]      




zLSASecretService.to_dictr   r(   r)   r*   r   r   r"   r'   r   r   r   r   r   D   s
    
r   c                   @   ,   e Zd Zdd Zdd Zdd Zdd Zd	S )
r   c                 C       t | ||| d | _d | _d S r   r   r   r   r.   r
   r   r   r   r   h      
z!LSASecretDefaultPassword.__init__c                 C   s:   z| j d| _| jdd| _W n   Y d S d| _d S )Nr0     r1   )r   r3   r.   replacer   r!   r   r   r   r   m   s   
z'LSASecretDefaultPassword.process_secretc                 C      d| j | j| jf S )NzE=== LSA Default Password ===
History: %s
Username: %s
Password: %sr	   r   r.   r!   r   r   r   r"   x      z LSASecretDefaultPassword.__str__c                 C   8   i }d|d< | j |d< | j|d< | j|d< | j|d< |S )Nr   r$   r   r	   r   r.   r   r	   r   r.   r%   r   r   r   r'   {      



z LSASecretDefaultPassword.to_dictNr9   r   r   r   r   r   g   s
    r   c                   @   r:   )
r   c                 C   s    t | ||| d| _d | _d S )NASPNETr<   r
   r   r   r   r      r=   zLSASecretASPNET.__init__c                 C   s"   z
| j d| _W d S    Y d S )Nr0   )r   r3   r.   r!   r   r   r   r      s   zLSASecretASPNET.process_secretc                 C   rA   )NzD=== LSA ASPNET Password ===
History: %s
Username: %s
Password: %srB   r!   r   r   r   r"      rC   zLSASecretASPNET.__str__c                 C   rD   )Nr   r$   r   r	   r   r.   rE   r%   r   r   r   r'      rF   zLSASecretASPNET.to_dictNr9   r   r   r   r   r      s
    r   c                   @   r,   )r   Nc                 C   s,   t | ||| || _d | _d | _|| _d S r   )r   r   r   r.   kerberos_passwordr   )r   r   r   r	   r   r   r   r   r      r/   z LSASecretMachineAccount.__init__c                 C   s0   t | j}| | _| jdddd| _d S )Nr0   r@   zutf-8)MD4r   digestr.   r3   encoderH   )r   ctxr   r   r   r      s   

z&LSASecretMachineAccount.process_secretc                 C   r7   )Nr   r$   r   r	   r   r.   rH   )r   r	   r   r.   rH   r%   r   r   r   r'      r8   zLSASecretMachineAccount.to_dictc                 C   s(   d| j | j| j | j | j f S )Nzv=== LSA Machine account password ===
History: %s
Username: %s
NT: %s
Password(hex): %s
Kerberos password(hex): %s)r	   r   r.   r4   r   rH   r!   r   r   r   r"      s   (zLSASecretMachineAccount.__str__r   r(   r)   r*   r   r   r'   r"   r   r   r   r   r      s
    
	
r   c                   @   r:   )
r   c                 C   r;   r   )r   r   machine_keyuser_keyr
   r   r   r   r      r=   zLSASecretDPAPI.__init__c                 C   s    t | j}|j| _|j| _d S r   )r   
from_bytesr   rN   rO   )r   dsr   r   r   r      s   zLSASecretDPAPI.process_secretc                 C   rD   )Nr   r$   r   r	   rN   rO   )r   r	   rN   rO   r%   r   r   r   r'      rF   zLSASecretDPAPI.to_dictc                 C   s   d| j | j | j f S )NzO=== LSA DPAPI secret ===
History: %s
Machine key (hex): %s
User key(hex): %s)r	   rN   r4   rO   r!   r   r   r   r"      s   zLSASecretDPAPI.__str__NrM   r   r   r   r   r      s
    	r   c                   @   s8   e Zd ZdddZdd ZdddZd	d
 Zdd ZdS )LSADCCSecret (  Nc                 C   s(   || _ || _|| _|| _|| _|| _d S r   )versiondomainr   	iteration
hash_valuelast_write_ts)r   rT   rU   r   rW   rV   rX   r   r   r   r      s   
zLSADCCSecret.__init__c                 C   sF   i }| j |d< | j|d< | j|d< | j|d< | j|d< |  |d< |S )NrT   rU   r   rV   rW   	lastwrite)rT   rU   r   rV   rW   get_lastwriter%   r   r   r   r'      s   




zLSADCCSecret.to_dictc                 C   s   | j d u r|S | j dS )Nz%Y-%m-%d %H:%M:%S)rX   strftime)r   defaultr   r   r   rZ      s   
zLSADCCSecret.get_lastwritec                 C   s   |   S r   )to_lopthr!   r   r   r   r"      s   zLSADCCSecret.__str__c                 C   sN   | j dkrd| j| j| j | jf S d| j| j| d| j| j| j f S )N   z%s/%s:%s:%sz%s/%s:*%s*$DCC2$%s#%s#%sr?   )rT   rU   r   rW   r4   rZ   rV   r!   r   r   r   r]      s   
(zLSADCCSecret.to_lopth)rS   Nr   )r(   r)   r*   r   r'   rZ   r"   r]   r   r   r   r   rR      s    


rR   N)unicrypto.hashlibr   rI    pypykatz.dpapi.structures.systemr   pypykatz.commons.commonr   r   r   r   r   r   r   rR   r   r   r   r   <module>   s   	2#