o
    j)                     @   sZ   d dl Z d dlmZ d dlmZ d dlmZ d dlmZ d dl	m
Z
mZ G dd dZdS )	    N)logger)MinidumpFile)KatzSystemInfo)RDPCredsTemplate)$RDPCredentialDecryptorLogonpasswordsRDPCredentialDecryptorMstscc                   @   sB   e Zd ZdddZedddZedd
dZdd Zdd ZdS )RDPCredParserFr   c                 C   s4   || _ || _|| _g | _|| _|| _|| _|| _d S N)processreadersysinfocredentials
rdp_module
find_firstlower_boundupper_bound)selfr   r   r   r   r   r   r    r   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/rdp/parser.py__init__
   s   
zRDPCredParser.__init__Nc                 C   s  t  dkr
tdddlm}m} ddlm} ddlm	}m
}m}m}	m}
 ddlm} ddlm} dd	lm} ||B |B |	B |
B }|  g }| d urm|| |d
}|  ||jd}t|}|t|| || n| }|dkr|du r| D ]&\}}} |dkr|| |d
}||jd}t|}|t|| || q||dkr|du r| D ]M} z2|| |d
}| D ]%}|j ddkr||jd}t|}|t|| ||  nqW n ty } zW Y d }~nd }~ww t |r nq|du ra| D ]Z} z@|| |d
}| D ]2}|j ddks+|j ddkrD||jd}t|}|t|| ||  nqW q ty` } zt!| W Y d }~qd }~ww |D ]}|"  qc|S )NWindowsz&Live parsing will only work on Windowsr   )OpenProcessPROCESS_ALL_ACCESS)LiveMachine)PROCESS_VM_READPROCESS_VM_WRITEPROCESS_VM_OPERATIONPROCESS_QUERY_INFORMATIONPROCESS_CREATE_THREAD)enable_debug_privilege)
LiveReader)Process)pidaccess)process_handlelogonpasswordsFTermServicemstsczmstscax.dllr	   Tzrdpcorets.dll)#platformsystem	Exception8pypykatz.commons.readers.local.common.live_reader_ctypesr   r   pypykatz.commons.winapi.machiner   !pypykatz.commons.winapi.constantsr   r   r   r   r   0pypykatz.commons.readers.local.common.privilegesr    *pypykatz.commons.readers.local.live_readerr!   &pypykatz.commons.readers.local.processr"   list_modulesphandler   from_live_readerappendr   get_buffered_readerlist_serviceslist_all_pidsnamelowerfindlenprintstart)r#   all_rdplive_rdp_moduler   r   r   r   r   r   r   r   r    r!   r"   req_access_rightstargetsr   r   r   machineservice_namedisplay_namemoduleetargetr   r   r   go_live   s   



,
zRDPCredParser.go_live (  c              
   C   s   zt | }| j|d}t|}W n ty' } ztd |d }~ww zt	d |||}|
  W |gS  tyJ } ztd |d }~ww )N)segment_chunk_sizezMinidump parsing error!zCredentials parsing error!)r   parse
get_readerr6   r   from_minidumpr+   r   	exceptionr   r>   info)filenamer   	chunksizeminidumpr   r   rG   mimir   r   r   parse_minidump_fileY   s$   



z!RDPCredParser.parse_minidump_filec              	   C   s   | j dkrt| j}t| j| j|| j| j| j| j	d}nt
 }t| j| j|| j| jd}|  |jD ]}| j| q5d S )Nr&   )r   r   r   )r   )r   r   get_logonpasswords_templater   r   r   r   r   r   r   get_mstsc_templater   r>   r   r5   )r   decryptor_template	decryptorcredr   r   r   rdpcredsj   s   
$
zRDPCredParser.rdpcredsc                 C   s   |    d S r
   )r[   )r   r   r   r   r>   w   s   zRDPCredParser.start)Fr   r	   )NFN)rJ   )	__name__
__module____qualname__r   staticmethodrI   rU   r[   r>   r   r   r   r   r   	   s    

Dr   )r)   pypykatzr   minidump.minidumpfiler   pypykatz.commons.commonr   %pypykatz.rdp.packages.creds.templatesr   %pypykatz.rdp.packages.creds.decryptorr   r   r   r   r   r   r   <module>   s   