o
    j<                     @   sr   d dl Z d dlZd dlZd dlmZ d dlmZ d dlmZmZm	Z	 G dd dZ
G dd dZG d	d
 d
ZdS )    N)logger)hexdump)KatzSystemArchitectureWindowsBuildWindowsMinBuildc                   @   s,   e Zd Zdd Zdd Zdd Zdd Zd	S )
RDPCredentialc                 C   s4   d| _ d | _d| _d| _d| _d | _d| _d| _d S )Nrdp     )credtype
domainnameusernamepasswordpassword_rawisencrypted
servername
serverfqdnself r   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/rdp/packages/creds/decryptor.py__init__      
zRDPCredential.__init__c                 C   s:   i }| j |d< | j|d< | j|d< | j|d< | j|d< |S )Nr   r   r   r   r   )r   cachedirPRTkey_guid	dpapi_keyr   tr   r   r   to_dict   s   




zRDPCredential.to_dictc                 C   s   t |  S N)jsondumpsr   r   r   r   r   to_json   s   zRDPCredential.to_jsonc                 C   s   d}|d| j  7 }|d| j 7 }|d| j 7 }z|d| j  7 }W n   |d| j 7 }Y |dt| j 7 }|d| j 7 }|d| j 7 }|S )	Nz	== RDP Credential ==
z		domainname %s
z		username %s
z		password '%s'
z		password_raw %s
z		isencrypted: %s
z		servername: '%s'
z		serverfqdn: '%s'
)	r   r   r   r   hexstrr   r   r   r   r   r   r   __str__!   s   zRDPCredential.__str__N)__name__
__module____qualname__r   r   r#   r&   r   r   r   r   r   
   s
    
	r   c                   @   s2   e Zd ZdddZdd ZdddZdd	d
ZdS )RDPCredentialDecryptorMstscFc                 C   s(   || _ || _|| _|| _g | _|| _d S r    )processreadersysinfodecryptor_templatecredentials
find_first)r   r+   r,   r.   r-   r0   r   r   r   r   2   s   
z$RDPCredentialDecryptorMstsc.__init__c                 C   s&   | d}|dkrd}|d |d  S )N     r   r
      )find)r   chunckmarkerr   r   r   find_string:   s   
z'RDPCredentialDecryptorMstsc.find_string (  c                 C   s  | j  }| }| }|D ]}|| jj|}|D ]}| j | | j| j }|j	t
dkr|jdkr|jdk r|jdkr|jdk r|jjr	 zo| j |jj t }	t|jD ]H}
| j| j }|jr|jdkr|jdk r	 | j  }z| j |j | j d}| |}|d}|dkr|d | }|d}g d	}||v rd
}|jdkr|jrdnd}|jdkr| j |j | j d}| |}|d}nE|jdkr%|jr%|jr%| j |j | j |j}|jd@ r#| jd u r|}n| j|j|jd}t|dkr"|dd  }n|}|d u r,d}|dkr5||	_nU|dkr>||	_ nL|dkrG||	_!nC|dkrP||	_"n:|dkry|jd@ ry||	_#| jd u rkd
|	_$d|	_%n|	j#d&d|	_$d|	_%n|dkr||	_#|d|	_$d|	_%W n t'y } zt()d*| W Y d }~nd }~ww | j | qd|	j!r| j+,|	 | j-rW   d S W q t'y } zt()d*| W Y d }~qd }~ww qqd S )Nl   +7 
   i  r      i       zutf-8)

ServerName
ServerFqdnServerNameUsedForAuthenticationUserSpecifiedServerNameUserNameDomainPasswordSmartCardReaderNameRDmiUsernamePasswordContainsSCardPinr	      TRUEFALSE   	utf-16-le   i   r
   r;   r<   r?   r@   rA   T Fz	Error: {}).r,   
get_readerget_handler
get_memorysearchr.   	signaturemoveproperties_structunkh0intunkd1cbPropertiespPropertiesvaluer   rangeproperty_struct
szPropertydwTypetellreadr6   r3   decodepvDataunkp2dwFlagsr+   dpapi_memory_unprotectlenr   r   r   r   r   r   r   rstrip	Exceptionr   debugformatr/   appendr0   )r   	chunksizer,   handlermemory_segmentsmsxaddr
propertiescredipropertycurrent_addrr4   stringr5   r[   szPropertiesrX   er   r   r   find_entries@   s   



 














z(RDPCredentialDecryptorMstsc.find_entriesc                 C   s&   |  | t| jstd d S d S )NzNo RDP credentials found!)rx   rd   r/   r   rg   )r   rj   r   r   r   start   s   

z!RDPCredentialDecryptorMstsc.startN)Fr7   )r'   r(   r)   r   r6   rx   ry   r   r   r   r   r*   1   s
    

~r*   c                   @   s(   e Zd ZdddZdd Zdd	d
ZdS )$RDPCredentialDecryptorLogonpasswordsFr   c                 C   s4   || _ || _|| _|| _g | _|| _|| _|| _d S r    )r+   r,   r-   r.   r/   r0   lower_boundupper_bound)r   r+   r,   r.   r-   r0   r}   r~   r   r   r   r      r   z-RDPCredentialDecryptorLogonpasswords.__init__c           
   
   C   s  t |jjd@ t dkrd}nt |jjd@ sd}nd}z|r|jdkr|jdkr|jdkr|jdkr|jdkr|jd |j d}|jd |j d}|j	d |j }| j
jtjjkr| jd u r|td	 |j	d d
t|jd
   }d}d}n%| j|j|jd}|dd}d}n|d}|dd d }d}t }||_||_||_||_||_| j| W d S td W d S  ty }	 ztd|	  W Y d }	~	d S d }	~	ww )Nl     ~ i   Tl      Fi   r   rI   z)Credentials found but they are encrypted!   r	   rK   r1   r:   zThis RDPCred entry is garbage!z"RDP entry parsing error! Reason %s) r$   unk1rX   cbDomain
cbUsername
cbPasswordr@   r_   r?   rA   r-   buildnumberr   WIN_10r+   r   rg   mathceilrc   Password_addrre   splitr   r   r   r   r   r   r/   ri   rf   )
r   rdpcred_entrybIsCandidate	domainamer   r   r   r   rq   rw   r   r   r   	add_entry   sD   6


z.RDPCredentialDecryptorLogonpasswords.add_entryr7   c                 C   s  | j  }| }| }| jdkrt|| _t|D ]h\}}|| jkr|| jk rg }| jj	D ]
}||
||7 }q/|D ]F}	|	| jj7 }	| j |	 z	| j| j }
W n tyn } ztdt|  W Y d }~q<d }~ww | |
 t| jdkr| jr  d S q<qd S )Nr|   z+Reading error! (this can be normal here) %sr   )r,   rL   rM   rN   r~   rd   	enumerater}   r.   
signaturesrO   offsetrQ   cred_structrf   r   rg   r%   r   r/   r0   )r   rj   r,   rk   rl   idxrm   rn   rP   ro   rq   rw   r   r   r   ry      s2   



z*RDPCredentialDecryptorLogonpasswords.startN)Fr   r|   rz   )r'   r(   r)   r   r   ry   r   r   r   r   r{      s    

+r{   )r!   hashlibr   pypykatzr   pypykatz.commons.commonr   r   r   r   r   r*   r{   r   r   r   r   <module>   s    ' 