o
    jR                     @   s   d dl mZmZ d dlZd dlZd dlZd dlmZ d dlm	Z	 d dl
mZ d dlmZ d dlmZ d dlmZ G d	d
 d
ZdS )    )UniversalEncoderhexdumpN)
DPAPI_BLOB)CredentialFile)MasterKeyFile)
VAULT_VPOL)	RegFinder)PVKFilec                   @   s4   e Zd Zdd Zdd Zdd Zdd Zd	d
 ZdS )DPAPICMDHelperc                 C   s   dg| _ dg| _d S )Ndpapi)live_keywordskeywords)self r   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/dpapi/cmdhelper.py__init__   s   zDPAPICMDHelper.__init__c           &      C   s  t jdd}|jdd}d|_d|_|jddd}|jd	g d
ddd |jdddd |jddd}|jddd |jddd}|jddd |jddd |jddd}|jddd |jddd}	|	jdd d |jd!d"d}
|
jd!d#d |jd$d%d}|jd$d&d |jd'd%d}|jd'd(d |jd)d*d}|jd+d,d}|jd-d.d}|jd/td0d1 |jd2d3d4d5 |jd6d7d |jddd8d |jd9d:|gd; t jdd}|jd<d}d|_d<|_|jd=d>d}|jd?d@d |jd=dAd |jddBdCd |jdDdEd}|jd?d@d |jdFdGd |jddBdCd |jdHdId}|jd?d@d |jdJdKd |jddBdCd |jdLdMd}|jdNdOd |jdPdQd |jdRdSd |jddBdCd |jd9dTd}| }d|_dU|_|jdVdW|gd; |jdXdYd}|jdZd[d |jddBd\d |jd]d^d}|jd_d`d |jdadbd}|jdcddd |jdVded |jddBd\d |jdfdgd}|jdcddd |jdhded |jddBd\d |jdidjd}|jdkdld |jddmd |jddnd}|jddod |jdpdqdrds |jddtd}|jdkdld |jddud |jd!dvd}|jdkdld |jd!dwd |jddxd} | jdkdld | jddyd |jd+dzd}!|!jdkdld |!jd{d|d |!jd}d~d |!jddd |!jdddd |jd)dd}"|"jdkdld |"jddd |jddd}#|#jdg ddd |#jddd |jddd}$|$jdkdld |$jddd |jddd}%|%jddd |%jddd |%jddd |%jddd d S )NF)add_helpzSLIVE DPAPI commands work under the current user context. Except: keys, wifi, chrome)helpTlivedpapicommandkeyszq[ADMIN ONLY]  Dump all local DPAPI related keys. Aggressively. Recommended: use file output. !This takes a while!z--method)lsassregistryallr   zWhere to look for the keys)choicesdefaultr   z-oz	--outfilezOutput file base namevpolz.Decrypting VPOL file with current user contextvpolfilezVPOL file to decryptvcredzDecrypt VCREDz*VPOL file to use to decrypt the VCRED file	vcredfilezVCRED file to decryptcredzDecrypt CRED filecredfilezCRED file to decryptblobzDecrypt raw dpapi blob hexzblob string in hex formatsecurestringzDecrypt securestring hexzsecurestring in hex formatblobfile zDecrypt raw dpapi blob in filesecurestringfilezDecrypt securestring from filewifiz*[ADMIN ONLY] Decrypt stored WIFI passwordschromezk[ADMIN ONLY] !TAKES SUPER-LONG! Decrypt all chrome passwords for all users (admin) or for the current user.tcapzQ[ADMIN ONLY] Obtains users stored DPAPI creds via SeTrustedCredmanAccessPrivilege	targetpidz&PID of the process of the target user.)typer   z--sourcezwinlogon.exez2A process that has SeTrustedCredmanAccessPrivilege)r   r   z
--tempfilez%PID of the process of the target userzOutput file namer   zfDPAPI (live) related commands. This will use winAPI to decrypt secrets using the current user context.)r   parentsprekey_commandpasswordzGenerate prekeys from passwordsidzSID of the userzPassword of the userz
--out-filezbKey candidates will be stored in this file. Easier to handle this way in the masterkeyfil command.ntzGenerate prekeys from NT hashnthashzNT hash of the usersha1zGenerate prekeys from SHA1 hashsha1hashzSHA1 hash of the userr   z&Generate prekeys from registry secretssystemzSYSTEM hivesamzSAM hivesecurityzSECURITY hivez DPAPI (offline) related commandsdapi_moduleprekeyzPrekey generationminidumpz.Dump masterkeys and prekeys from minidump fileminidumpfilezpath to minidump filezWMaster and Backup keys will be stored in this file. Easier to handle in other commands.preferredkeyzGet preferred masterkey GUIDpreferredkeyfilez path to preferred masterkey file	masterkeyzDecrypt masterkey filemasterkeyfilezpath to masterkey filezAPath to prekey file, which has multiple decryption key candidatesmasterkeypvkz$Decrypt masterkey file with PVK filepvkfile
credentialzDecrypt credential filemkfz.Keyfile generated by the masterkey -o command.zpath to credential filezDecrypt vcred filezpath to vcred filez	--vpolkey+zeKey obtained by decrypting the corresponding VPOL file, in hex format. Remember to try both VPOL keys)nargsr   zDecrypt vpol filezpath to vpol filezDecrypt securestringzOpath to securestring file (hex data expected!), or the securestring in hex formzDecrypt blobz?path to blob file (hex data expected!), or the blob in hex formzDecrypt Google Chrome secrets
localstatezLocal State filez--logindatazLogin Data filez	--cookieszCookies filez--json
store_truezPrint in JSON format)actionr   z Decrypt Windows WIFI config filewifixmlzWIFI config XML filedescribez$Print information on given structuredatatype)r!   r<   pvkr   r@   zType of structure)r   r   datazfilepath or hex-encoded data	cloudapkdz(Decrypt KeyValue structure from CloudAPKkeyvaluez!KeyValue string obtained from PRTwinhellopinzGet winhello hashmkdz_Directory path for all machine masterkeys. Usually: C:\System32\Microsoft\Protect\S-1-5-18\UserregdirzgDirectory path for all registry hives. Usually: C:\System32\config\. SAM, SYSTEM, SECURITY hives neededngcdirzkDirectory path of NGC folder. Usually: C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Ngc\
cryptokeysz|Directory path of cryptokeys folder. Usually: C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Crypto\Keys\)argparseArgumentParseradd_subparsersrequireddest
add_parseradd_argumentint)&r   parserlive_parserlive_subcommand_parserlive_dpapi_subparserslive_keys_parserlive_vpol_parserlive_vcred_parserlive_cred_parserlive_blob_parserlive_securestring_parserlive_blobfile_parserlive_securestringfile_parserlive_wifi_parserlive_chrome_parserlive_tcap_parserprekey_subcommand_parserdpapi_prekey_subparsersprekey_passwd	prekey_ntprekey_sha1prekey_registrydpapi_groupdpapi_subparsersdpapi_minidump_groupdpapi_preferredkey_groupdpapi_masterkey_groupdpapi_masterkeypvk_groupdpapi_credential_groupdpapi_vcred_groupdpapi_vpol_groupdpapi_securestring_groupdpapi_blob_groupdpapi_chrome_groupdpapi_wifi_groupdpapi_describe_groupdpapi_cloudapkd_groupdpapi_winhellopin_groupr   r   r   add_args   s   zDPAPICMDHelper.add_argsc                 C   sb   t | jdkr|j| jv r| | t | jdkr+|jdkr-|j| jv r/| | d S d S d S d S )Nr   live)lenr   commandrunr   modulerun_live)r   argsr   r   r   execute   s
   
$zDPAPICMDHelper.executec                 C   s  ddl m} | }|jdkr|jdkr5|jd u rtd|jd u r*|jd u r*td||j|j|j n`|jdkr\|j	d u rCtd|j
}|j
d u rSdd l}| }|j|j	|d	 n9|jd
kry|jd u sk|j	d u rotd|j|j	|jd n|jdkr|jd u s|j	d u rtd|j|j	|jd ||j d S |jdkr|jd u rtd||j ||j |jd ur||jd  d S |  d S |jdkr||j d S |jdkr|jd u rtd||j ||j t|jdkr
t|jdkr
td d S ||j d S |jdkr>||j|j t|jdkr6t|jdkr6td d S ||j d S |jdkrZ| |j! |"|j#}td|$   d S |jdkrt| |j! |%|j&}t|'  d S |jdkr| |j! |(|j)\}}	td|$   td|	$   d S |jdkr|j*d u st|j*dkrtdd d! |j*D |_+|,|j-}
|
D ]+}t.t|
| D ]}|
| | d urtd"|j/|f  tt0|
| |  q͐qd S |jd#kr>| |j! zt12|j3 W n ty$ } ztd$|  |4|j3}W Y d }~nd }~ww |5|j3}td%|$   td&|6d'  d S |jd(kr| |j! zt12|j7 W n tyq } ztd$|  |4|j7}W Y d }~nd }~ww |5|j7}td%|$   td&|6d'  d S |jd)kr&| |j! i }i |d*< |j8|d* d+< |j9d ur|j9|d* d,< |j:d ur|j:|d* d-< |j;|d.d/}
|
d0 D ])\}}}}|j<rtt<j=t>d1||||6 d2t?d3 qtd4||||f  q|
d, D ],\}}}}}|j<rtt<j=t>d5|||||6 d6t?d3 qtd7|||||f  qd S |jd8krK| |j! |@|jA}|B|}td9|d: |d; f  d S |jd<krtCD|jE}||d= |d> |d?  |F|jG |H|jI|jJ}t|dkrtd@ d S |D ]}t| qd S |jdAkrdBdC }z||jK}W n   tdD|jLM dEkrtNO|}
n?|jLM dFkrtPO|}
n1|jLM dGkrtQO|}
n#|jLM dHkrtRO|}
n|jLM dIkrtSO|}
ntdJ|jL ttT|
 d S d S )KNr   DPAPIr7   r   z3SYSTEM hive must be specified for registry parsing!zUEither SAM or SECURITY hive must be supplied for registry parsing! Best to have both.r-   z8SID must be specified for generating prekey in this mode)r-   r/   zDNT hash and SID must be specified for generating prekey in this mode)nt_hashr1   zFSHA1 hash and SID must be specified for generating prekey in this mode)	sha1_hashr8   z5minidump file must be specified for mindiump parsing!_prekeysr:   r<   z4Etieher KEY or path to prekey file must be supplied!z$Failed to decrypt the masterkeyfile!r>   rL   zClear key: %sr@   r   VPOL key1: %sVPOL key2: %sr   zVPOL key bust be specified!c                 S   s   g | ]}t |qS r   )bytesfromhex).0xr   r   r   
<listcomp>  s    z&DPAPICMDHelper.run.<locals>.<listcomp>AttributeID: %s Key %sr"   z	Error! %sHEX: %sSTR: %s	utf-16-ler!   r'   pypykatzrD   cookies	logindataF)throwloginslogin)r*   fileurluserr-   )cls"file: %s user: %s pass: %s url: %scookie)r*   r   domainnamepathvalue1file: %s host_key: %s name: %s path: %s value: %sr&   %s : %sr   keyrN   SYSTEMSECURITYSAMzNo results!rH   c                 S   sX   d }zt | d}| }W d    W |S 1 sw   Y  W |S    t| }Y |S )Nrb)openreadr   r   )r   rK   fr   r   r   read_file_or_hex]  s   
z,DPAPICMDHelper.run.<locals>.read_file_or_hexzCould not load data!BLOB	MASTERKEYVPOLPVK
CREDENTIALzUnknown data format %s)Upypykatz.dpapi.dpapir   r6   r,   r3   	Exceptionr4   r5   get_prekeys_form_registry_filesr.   r-   getpassget_prekeys_from_passwordr0   r2   dump_pre_keysout_filer9   get_masterkeys_from_lsass_dumpdump_masterkeysdump_preferred_masterkey_guidr;   r7   load_prekeysdecrypt_masterkey_filer=   r   
masterkeys
backupkeysprintdecrypt_masterkey_file_with_pvkr?   load_masterkeysrA   decrypt_cloudap_keyrM   hexdecrypt_credential_filer   to_textdecrypt_vpol_filer   vpolkey
vault_keysdecrypt_vcrd_filer   rangeidr   r   r   r"   decrypt_securestring_filedecrypt_securestring_hexdecoder!   rD   r   r   decrypt_all_chromejsondumpsdictr   parse_wifi_config_filerG   decrypt_wifi_config_file_innerr   from_dirrP   decrypt_masterkey_directoryrO   winhello_pin_hash_offlinerQ   rR   rK   rI   upperr   
from_bytesr   r   r	   r   str)r   r   r   r   pwr   plain	cred_blobkey1key2resattriedec_secdb_paths	file_pathr   r   r-   host_keyr   r   r   wificonfig_enc
wificonfighivesresultshr   rK   r   r   r   r      s6  












  (*
	zDPAPICMDHelper.runc                 C   s  t   dkrtd|jdkrfddlm} ||j|j|j	\}}}|d ur-t
| d S |jd urYt|jd}|D ]}|| d  q;W d    d S 1 sRw   Y  d S |D ]}t
|  q[d S ddlm} |d	d
}	|jdkrddlm}
 |
|j}	|jd ur|	|jd  |	|jd  d S |	  |	  d S |jdkr|	|j}t
|  d S |jdkr|	|j\}}t
d|   t
d|   d S |jdkr|	|j\}}|	|j}|D ])}tt|| D ]}|| | d urt
d|j|f  t
t|| |  qqd S |jdkr5|	 |j!}t
d|   t
d|"d  d S |jdkrX|j#d }|	$|}t
d|   t
d|"d  d S |jdkrn|	 |j%}t
d|   d S |jdkr|	$|j&}t
d|   d S |jdkr|	' }|d D ]\}}}}t
d||||f  q|d D ]\}}}}}t
d |||||f  qd S |jd!kr|	( D ]}t
d"|d# |d$ f  qd S d S )%Nwindowsz#Live commands only work on Windows!r(   r   )dpapi_trustedcredmanwz
r   T)
use_winapir   )prepare_dpapi_liver   _masterkeysr   r   r   r   r   r   r"   r   r   r   r%   r!   r#   r'   r   r   r   r   r&   r   r   r   ))platformr3   lowerr   r   pypykatz.dpapi.extrasr   r)   sourcetempfiler   outfiler   writer   r   r   r   methodr   r   r   r    r   r   r   r   r   r   r   r   r   r   r"   r   rK   r   r!   r#   decrypt_all_chrome_livedecrypt_wifi_live)r   r   r   rawdatacredserrr   r   r   r   r   r   r   r   r   r   r   r   rK   r   r   r   r-   r   r   r   r   r   r   r   r   r   x  s   










zDPAPICMDHelper.run_liveN)__name__
__module____qualname__r   r   r   r   r   r   r   r   r   r
      s      Lr
   )pypykatz.commons.commonr   r   rS   r   r   pypykatz.dpapi.structures.blobr   (pypykatz.dpapi.structures.credentialfiler   'pypykatz.dpapi.structures.masterkeyfiler   pypykatz.dpapi.structures.vaultr   pypykatz.dpapi.finders.registryr   winacl.dtyp.wcee.pvkfiler	   r
   r   r   r   r   <module>   s    