o
    Žõ±jOO  ã                   @   s¾   d dl Z d dlZd dlZd dlZd dlmZmZmZmZm	Z	m
Z
 d dlmZ d dlmZ d dlmZ d dlmZmZ d dlmZ G dd	„ d	ƒZG d
d„ dƒZG dd„ dƒZG dd„ deƒZdS )é    N)ÚWindowsBuildÚWindowsMinBuildÚKatzSystemArchitectureÚGenericReaderÚUniversalEncoderÚhexdump)Úfiletime_to_dt)ÚPVOID)Ú%MSV1_0_PRIMARY_CREDENTIAL_STRANGE_DEC)ÚKIWI_CREDMAN_LIST_STARTERÚKIWI_CREDMAN_SET_LIST_ENTRY)ÚPackageDecryptorc                   @   ó,   e Zd Zdd„ Zdd„ Zdd„ Zdd„ Zd	S )
ÚMsvCredentialc                 C   s4   d| _ d | _d | _d | _d | _d | _d | _d | _d S )NÚmsv)ÚcredtypeÚusernameÚ
domainnameÚNThashÚLMHashÚSHAHashÚDPAPIÚisoProt©Úself© r   úŸ/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/lsadecryptor/packages/msv/decryptor.pyÚ__init__   s   
zMsvCredential.__init__c                 C   óD   i }| j |d< | j|d< | j|d< | j|d< | j|d< | j|d< |S )Nr   r   r   r   r   r   )r   r   r   r   r   r   ©r   Útr   r   r   Úto_dict   ó   





zMsvCredential.to_dictc                 C   ó   t j|  ¡ tdS ©N)Úcls©ÚjsonÚdumpsr!   r   r   r   r   r   Úto_json'   ó   zMsvCredential.to_jsonc                 C   s  d}|d| j r
| j nd 7 }|d| jr| jnd 7 }| jrU|d7 }|dt| jƒ 7 }|d| jr4t| jƒnd 7 }|d| jrBt| jƒnd 7 }|d	| jrP| j ¡ nd 7 }n*|d
| j	r_| j	 ¡ nd 7 }|d| j
rm| j
 ¡ nd 7 }|d| jr{| j ¡ nd 7 }|d| jr‰| j ¡ nd 7 }|S )Nz	== MSV ==
z		Username: %s
ÚNAz		Domain: %s
z			[LSA Isolated Data]
z			Is NT Present: %s
z			Context Handle: %s
z			Proxy Info: %s
z			Encrypted blob: %s
z			LM: %s
z			NT: %s
z		SHA1: %s
z		DPAPI: %s
)r   r   r   ÚboolÚisNtOwfPasswordÚcontextHandleÚhexÚ	proxyInfoÚencryptedBlobr   r   r   r   r   r   r   r   Ú__str__*   s   zMsvCredential.__str__N©Ú__name__Ú
__module__Ú__qualname__r   r!   r)   r2   r   r   r   r   r      s
    
r   c                   @   r   )
ÚCredmanCredentialc                 C   s(   d| _ d | _d | _d | _d| _d | _d S )NÚcredmanó    )r   Úluidr   ÚpasswordÚpassword_rawr   r   r   r   r   r   <   s   
zCredmanCredential.__init__c                 C   r   )Nr   r   r   r;   r<   r:   )r   r   r   r;   r<   r:   r   r   r   r   r!   D   r"   zCredmanCredential.to_dictc                 C   s   t  |  ¡ ¡S ©N)r'   r(   r!   r   r   r   r   r)   N   s   zCredmanCredential.to_jsonc                 C   sX   d| j  }|d| j  7 }|d| j 7 }|d| j 7 }|d| j 7 }|d| j ¡  7 }|S )Nz	== CREDMAN [%x]==
z
		luid %s
z		username %s
z		domain %s
z		password %s
z		password (hex)%s
)r:   r   r   r;   r<   r/   r   r   r   r   r2   Q   s   
zCredmanCredential.__str__Nr3   r   r   r   r   r7   ;   s
    
r7   c                   @   sP   e Zd Zg d¢Zdd„ Zedd„ ƒZdd„ Zdd	„ Zd
d„ Z	dd„ Z
dd„ ZdS )ÚLogonSession)
ÚpackagenameÚdomainÚuserÚNTÚLMÚSHA1Ú	masterkeyÚsha1_masterkeyÚkey_guidÚ	plaintextc                 C   sj   d | _ d | _d | _d | _d | _d | _d | _d | _g | _g | _	g | _
g | _g | _g | _g | _g | _g | _d S r=   )Úauthentication_idÚ
session_idr   r   Úlogon_serverÚ
logon_timeÚsidr:   Ú	msv_credsÚwdigest_credsÚ	ssp_credsÚlivessp_credsÚdpapi_credsÚkerberos_credsÚcredman_credsÚtspkg_credsÚcloudap_credsr   r   r   r   r   ^   s"   
zLogonSession.__init__c                 C   sx   t ƒ }| j|_| j|_| j |¡|_| j |¡|_	| j
 |¡|_| jdkr-t| jƒ ¡ |_t| j |¡ƒ|_| j|_|S )zA
		Converts KIWI_MSV1_0_LIST type objects into a unified class
		r   )r>   ÚLocallyUniqueIdentifierrI   ÚSessionrJ   ÚUserNameÚread_stringr   ÚDomainer   ÚLogonServerrK   Ú	LogonTimer   Ú	isoformatrL   ÚstrÚpSidÚreadrM   r:   )ÚentryÚreaderÚlscr   r   r   Úparser   s   
zLogonSession.parsec                 C   s®  i }| j |d< | j|d< | j|d< | j|d< | j|d< | j|d< | j|d< | j|d< g |d	< g |d
< g |d< g |d< g |d< g |d< g |d< g |d< g |d< | jD ]}|d	  	| 
¡ ¡ qQ| jD ]}|d
  	| 
¡ ¡ q`| jD ]}|d  	| 
¡ ¡ qo| jD ]}|d  	| 
¡ ¡ q~| jD ]}|d  	| 
¡ ¡ q| jD ]}|d  	| 
¡ ¡ qœ| jD ]}|d  	| 
¡ ¡ q«| jD ]}|d  	| 
¡ ¡ qº| jD ]}|d  	| 
¡ ¡ qÉ|S )NrI   rJ   r   r   rK   rL   rM   r:   rN   rO   rP   rQ   rR   rS   rT   rU   rV   )rI   rJ   r   r   rK   rL   rM   r:   rN   Úappendr!   rO   rP   rQ   rR   rS   rT   rU   rV   ©r   r    Úcredr   r   r   r!   „   sJ   
















zLogonSession.to_dictc                 C   r#   r$   r&   r   r   r   r   r)   «   r*   zLogonSession.to_jsonc                 C   sþ  d}|d| j | j f 7 }|d| j 7 }|d| j 7 }|d| j 7 }|d| j 7 }|d| j 7 }|d| j 7 }|d	| j 7 }t| j	ƒd
krR| j	D ]
}|dt
|ƒ 7 }qGt| jƒd
kre| jD ]}|t
|ƒ7 }q\t| jƒd
krx| jD ]}|t
|ƒ7 }qot| jƒd
kr‹| jD ]}|t
|ƒ7 }q‚t| jƒd
krž| jD ]}|t
|ƒ7 }q•t| jƒd
kr±| jD ]}|t
|ƒ7 }q¨t| jƒd
krÄ| jD ]}|t
|ƒ7 }q»t| jƒd
kr×| jD ]}|t
|ƒ7 }qÎt| jƒd
krê| jD ]}|t
|ƒ7 }qát| jƒd
krý| jD ]}|t
|ƒ7 }qô|S )Nz== LogonSession ==
zauthentication_id %s (%x)
zsession_id %s
zusername %s
zdomainname %s
zlogon_server %s
zlogon_time %s
zsid %s
zluid %s
r   z%s)rI   rJ   r   r   rK   rL   rM   r:   ÚlenrN   r_   rO   rP   rQ   rS   rT   rU   rR   rV   rg   r   r   r   r2   ®   sP   









zLogonSession.__str__c                 c   s†   | j D ]Z}| ¡ }| jd| j| jdd| j| jd|d r"|d  ¡ ndg
V  | jd| j| jdd| j| jd|d r>|d  ¡ ndg
V  | jd| j| jdd| j| jd|d rZ|d  ¡ ndg
V  q| jD ]}| ¡ }| j|d	 | j| j|d	 d| j| jd
|d g
V  qb| j	D ]}| ¡ }| j|d	 | j| j|d	 d| j| jd
|d g
V  q„| j
D ]}| ¡ }| j|d	 | j| j|d	 d| j| jd
|d g
V  q¦| jD ]6}| ¡ }| j|d	 | j| j|d	 d| j| jd|d g
V  | j|d	 | j| j|d	 d| j| jd|d g
V  qÈ| jD ]}| ¡ }| j|d	 | j| j|d	 d| j| jd
|d g
V  q| jD ]}| ¡ }| j|d	 | j| j|d	 d| j| jd
|d g
V  q%| jD ]}| ¡ }| j|d	 | j| j|d	 d| j| jd
|d g
V  qH| jD ]U}| ¡ }| j|d	 | j| j|d	 d| j| jdt| ¡ ƒg
V  | j|d	 | j| j|d	 d| j| jdt|d ƒg
V  | j|d	 | j| j|d	 d| j| jdt|d ƒg
V  qkd S )Nr   Ú rB   r   rC   r   Úsha1r   r   rH   r;   rE   rF   Údpapi_key_sha1ÚPRT)rN   r!   r:   rJ   rM   r   r   r/   rO   rP   rQ   rR   rS   rT   rU   rV   r_   Úget_masterkey_hex)r   rh   r    r   r   r   Úto_rowØ   sD   €
88:
2
2
2
02
4
4
4
448üzLogonSession.to_rowc                 c   sN   | j D ]3}| ¡ }d| j| j|d r|d  ¡ nd|d r$|d  ¡ nd|d r/|d  ¡ ndddddg
V  q| j| j| j| j| j	fD ].}|D ])}| ¡ }|d d urqt
|d ƒt
|d ƒt
|d	 ƒddddddt
|d ƒg
V  qHqD| jD ]\}| ¡ }|d d usˆ|d
 d urÒd}|d
 d ur¯d|d
  }t
|d ƒt
|d ƒt
|d	 ƒdddddd|g
V  |d d urÒt
|d ƒt
|d ƒt
|d	 ƒddddddt
|d ƒg
V  qv| jD ]#}| ¡ }t
|d ƒdddddt
|d ƒt
|d ƒt
|d ƒdg
V  qÖ| jD ]'}| ¡ }t
|d ƒdddddt
| ¡ ƒt
|d ƒt
|d ƒt
|d ƒg
V  qýd S )Nr   r   rj   r   r   r;   r   r   r   Úpinz[PIN]%srE   rF   rG   rl   rm   )rN   r!   r   r   r/   rO   rP   rQ   rT   rU   r_   rS   rR   rV   rn   )r   rh   r    Úpackagerp   r   r   r   Úto_grep_rowsú   sL   €
ö:€ý
2:€
<
DþzLogonSession.to_grep_rowsN)r4   r5   r6   Úgrep_headerr   Ústaticmethodre   r!   r)   r2   ro   rr   r   r   r   r   r>   [   s    
'*"r>   c                       s\   e Zd Z‡ fdd„Zdd„ Zdd„ Zdd„ Zd	d
„ Zdd„ Zdd„ Z	dd„ Z
dd„ Z‡  ZS )ÚMsvDecryptorc                    s@   t ƒ  d|||¡ || _|| _g | _i | _i | _d | _d | _d S )NÚMsv)	Úsuperr   Údecryptor_templateÚcredman_decryptor_templateÚentriesÚentries_seenÚlogon_sessionsÚlogon_session_countÚcurrent_logonsession)r   rc   rx   Úlsa_decryptorÚcredman_templateÚsysinfo©Ú	__class__r   r   r   '  s   
zMsvDecryptor.__init__c                 C   sÄ  |   d| jj¡}|  dt|ƒ ¡ d| _| jjtj	krv| jj
tjjks;tjj| jj
  kr3tjjk rvn nA| jjdkrv|  dt|| jj ƒ ¡ | j || jj ¡}|  dt|ƒ ¡ | j |¡ tj| j d¡ddd	| _|  d
| j ¡ |  dt|| jj ƒ ¡ d}| jjdkrº|  d¡ || jj }|  dt|ƒ ¡ | j |¡ tj| j d¡ddd	}|  dt|ƒ ¡ | j || jj ¡| }|  dt|ƒ ¡ | j |¡}|  dt|ƒ ¡ ||fS )Nz
lsasrv.dllzSignature position @ %sé   i   `zLogon session count PTR @ %szLogon session count PTR -> %sÚbigF)Ú	byteorderÚsignedzLogon session count: %szLogon session PTR @ %sr   z%This template uses offset correction!z"Fetching additional offset from %sé   ÚlittlezAdditional offset value: %szLogon session PTR -> %szLogon session @ %s)Úfind_signaturerx   Ú	signatureÚlogr/   r}   r   Úarchitecturer   ÚX64Úbuildnumberr   ÚWIN_8Úvaluer   ÚWIN_BLUEÚmsv_dll_timestampÚoffset2rc   Úget_ptr_with_offsetÚmoveÚintÚ
from_bytesra   Úfirst_entry_offsetÚfirst_entry_offset_correctionÚget_ptr)r   ÚpositionÚptr_entry_locÚadditional_offsetÚ	offsetposÚ	ptr_entryr   r   r   Úfind_first_entry2  s2   @
zMsvDecryptor.find_first_entryc                 C   sr   t  || j¡| _|jjdkr|  |¡ |jjdkr*|  |jjd¡ |  	|j| j
¡ n|  d¡ | j| j| jj< d S )Nr   ÚKIWI_MSV1_0_CREDENTIALS_LISTz!No credentials in this structure!)r>   re   rc   r~   ÚCredentialManagerr‘   Úparse_credman_credentialsÚCredentials_list_ptrÚlog_ptrÚ	walk_listÚadd_credentialsrŒ   r|   r:   )r   rb   r   r   r   Ú	add_entryV  s   

zMsvDecryptor.add_entryc                 C   s$   | j  |jj¡ |  |j| j¡ d S r=   )rc   r–   ÚPrimaryCredentials_ptrr‘   r§   Úadd_primary_credentials)r   Úprimary_credentials_list_entryr   r   r   r¨   d  s
   þzMsvDecryptor.add_credentialsc                 C   s„   |   |jjd¡ |jj| jtd}|   |jjd¡ |jj| jtd}|   |jjd¡ |jj|jj	kr@| j
|j| j| jjd d S d S )Nr   )Úoverride_finaltyper   ÚKIWI_CREDMAN_LIST_ENTRY)Úoverride_ptr)r¦   r£   r‘   ra   rc   r   Úlist1r   ÚstartÚlocationr§   Úadd_credman_credentialry   Ú
list_entry)r   Úlogon_sessionÚcredman_set_list_entryÚlist_starterr   r   r   r¤   m  s   ÿz&MsvDecryptor.parse_credman_credentialsc                 C   s´   t ƒ }|j | j¡|_|j | j¡|_|jrL|jdkrL|j 	| j|j¡}|j 
d¡du rC| j|dd\|_|_|jd urB|j ¡ |_n	|  |¡\|_|_| jj|_| jj |¡ d S )Nr   ú$T©Úbytes_expected)r7   rA   rZ   rc   r   Úserver2r   ÚcbEncPasswordÚencPasswordÚread_rawÚendswithÚdecrypt_passwordr;   r<   r/   r~   r:   rT   rf   )r   Úcredman_credential_entryÚcÚenc_datar   r   r   r³   v  s   
€
z#MsvDecryptor.add_credman_credentialc                 C   s   | j  ¡ }| j j  d¡}|d u r| j  |¡ dS z|  dd¡}|  dt d|d ¡¡}|  dt d|¡¡}W n   d}Y ||_| j  |¡ |S )Nú
msv1_0.dllr   s   àzRE}*ìL²sŸAYÃ’z<Qrˆ   )rc   ÚtellÚget_module_by_namer–   rŠ   ÚstructÚpackr0   )r   Úmsv1_0_moduleÚold_posrœ   r   r   r   Úget_proxy_infoˆ  s   
zMsvDecryptor.get_proxy_infoc              
   C   sR  |j  | j¡}|sd S |  dt|ƒ ¡ |  d¡ | j|dd\}}|  d| jjjt|ƒf ¡ t	|| j
jƒ}t|ƒtjkrK|dd… dkrKt|ƒ}n| j |¡}tƒ }|jr|z	|j |¡|_W n ty{ } z|  d	t|ƒ ¡ W Y d }~nd }~ww |jr¤z	|j |¡|_W n ty£ } z|  d
t|ƒ ¡ W Y d }~nd }~ww t|dƒr²|jdkr²|j|_t|dƒr¿t|jd ƒ|_|jdu r
t|dƒr
|jré| j ¡ }	| j |jd ¡ t | jƒj!|_"| j |	¡ |j#|_#|j$|_$| jj %d¡}
t|
dƒr|
j&|_&n|  '|
¡|_&n|j(|_)|j*r|j*dkr|j*|_+|j,|_-| j.j/ 0|¡ d S )NzEncrypted credential data 
%szDecrypting credential structureTr¹   z%s: 
%srˆ   é   s   ÌÌÌÌz#Failed to get username, reason : %sz%Failed to get domainname, reason : %sÚDPAPIProtecteds                   ÚisIsor   r1   é   rÄ   r0   )1Úencrypted_credentialsÚ	read_datarc   rŒ   r   rÀ   rx   Údecrypted_credential_structr4   r   r   r   ri   r
   Úsizer   rY   rZ   r   Ú	Exceptionr_   ÚLogonDomainNamer   ÚhasattrrÍ   r   r,   rÎ   r   ÚpNtlmCredIsoInProcrÅ   r–   r	   r‘   r.   r1   r-   rÆ   r0   rË   ÚNtOwfPasswordr   ÚLmOwfPasswordr   ÚShaOwPasswordr   r~   rN   rf   )r   Úprimary_credentials_entryÚencrypted_credential_dataÚdec_dataÚraw_decÚstruct_readerÚcreds_structrh   ÚerÊ   rÉ   r   r   r   r«     s^   

€ÿ€ÿ


z$MsvDecryptor.add_primary_credentialsc                 C   s~   |   ¡ \}}t| jƒD ]1}| j |¡ t|d ƒD ]}| j ¡  q|  |d¡ | j | j¡}|j	|j
kr5q|  || j¡ qd S )Né   ÚPKIWI_MSV1_0_LIST)r¡   Úranger}   rc   r–   Úread_intr¦   rx   r´   r²   r‘   r§   r©   )r   Úentry_ptr_valueÚentry_ptr_locÚiÚxÚ	entry_ptrr   r   r   r±   Ü  s   ñzMsvDecryptor.start)r4   r5   r6   r   r¡   r©   r¨   r¤   r³   rË   r«   r±   Ú__classcell__r   r   r‚   r   ru   &  s    $		?ru   )Úior'   Úbase64rÇ   Úpypykatz.commons.commonr   r   r   r   r   r   Úpypykatz.commons.filetimer   Úpypykatz.commons.win_datatypesr	   Ú,pypykatz.lsadecryptor.packages.msv.templatesr
   Ú0pypykatz.lsadecryptor.packages.credman.templatesr   r   Ú%pypykatz.lsadecryptor.package_commonsr   r   r7   r>   ru   r   r   r   r   Ú<module>   s    *  L