o
    j2                     @   s  d dl Z d dlmZ d dlmZ d dlmZ d dlmZ d dl	m
Z
 d dlmZ d dlmZ d dl	m
Z
 d dlmZ d d	lmZmZmZmZmZmZmZmZmZ d d
lmZ d dlmZmZ d dlmZmZ d dl m!Z!m"Z" d dl#m$Z$ d dl%m&Z& d dl'm(Z(m)Z)m*Z*m+Z+m,Z,m-Z-m.Z.m/Z/m0Z0m1Z1m2Z2m3Z3m4Z4m5Z5m6Z6m7Z7m8Z8m9Z9m:Z:m;Z;m<Z<m=Z=m>Z> d dl?m@Z@mAZA d dlBmCZCmDZDmEZEmFZF G dd dZGdddZHdS )    N)get_logon_info)LDAPConnectionFactory)InitialContextToken)TGSTicket2hashcat)KerberosTarget)
asreproast)KerberosCredential)	AP_REQKRB_CREDEncKrbCredPartKRBCREDAuthenticatorKrbCredInfoEncryptedDataTGS_REQAP_REP)print_table)CCACHE
Credential)ChecksumFlagsAuthenticatorChecksum)Key_enctype_table)logger)ProcessManipulator)LsaConnectUntrustedLsaLookupAuthenticationPackageKERB_PURGE_TKT_CACHE_REQUESTLsaCallAuthenticationPackageLsaDeregisterLogonProcessLsaRegisterLogonProcessLsaEnumerateLogonSessionsLsaGetLogonSessionDataLsaFreeReturnBufferretrieve_tkt_helperKERB_RETRIEVE_TKT_RESPONSEget_lsa_errorget_ticket_cache_info_helperextract_ticketsubmit_tkt_helperAcquireCredentialsHandleInitializeSecurityContextSECPKG_CREDISC_REQSEC_ESecPkgContext_SessionKeyQueryContextAttributesSECPKG_ATTR)OpenProcessToken#GetTokenInformation_tokenstatistics)GetCurrentProcessIdOpenProcessCloseHandleMAXIMUM_ALLOWEDc                   @   s   e Zd Zd'ddZdd Zdd Zd(d
dZdd Zdd Zdd Z	dd Z
dd Zdd Zdd Zdd Zdd Zd)dd Zd*d!d"Zd)d#d$Zd%d& ZdS )+KerberosLiver   TOTALLY_NOT_PYPYKATZc                 C   sB   g | _ || _|  | _d | _|| _d | _d | _|   | 	  d S N)
available_luidscurrent_luidget_current_luidoriginal_luidkerberos_package_idhelper_name_KerberosLive__lsa_handle%_KerberosLive__lsa_handle_is_elevatedget_kerberos_package_id
list_luids)self
start_luidr@    rG   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/kerberos/kerberoslive.py__init__%   s   
zKerberosLive.__init__c                 C   s*   | j d u rt }t|d| _ t| | j S )Nkerberos)r?   r   r   r   )rE   
lsa_handlerG   rG   rH   rC   1   s
   
z$KerberosLive.get_kerberos_package_idc              
   C   sh   | j du r| jS t }z|  W n ty# } ztd| d }~ww t| j| _|  d| _ | jS )NTz<Failed to obtain SYSTEM privileges! Are you admin? Error: %s)rB   rA   r   	getsystem	Exceptionr    r@   
dropsystem)rE   pmerG   rG   rH   __open_elevated9   s   
zKerberosLive.__open_elevatedFc                 C   sV   |du r| j du r| jS |  S |dks| j| jkr$t | _d| _ | jS |   | jS )NTr   F)rB   rA   _KerberosLive__open_elevatedr>   r<   r   )rE   luidreq_elevatedrG   rG   rH   open_lsa_handleH   s   
zKerberosLive.open_lsa_handlec                 C   s6   | j ddd || jvr||  vrtd|| _d S )Nr   TrT   zThis luid is not known!)rU   r;   rD   rM   r<   )rE   new_luidrG   rG   rH   switch_luidW   s
   

zKerberosLive.switch_luidc                 C   sP   |dkr| j }| | i }g ||< t| j| j|ddD ]	}|| | q|S )Nr   Fthrow)r>   rU   r'   rA   r?   append)rE   rS   ticket_infosticket_inforG   rG   rH   get_ticketinfoq   s   
zKerberosLive.get_ticketinfoc                 C   sd   | j ddd i }|  D ]"}||vrg ||< t| j| j|ddD ]}|g kr.|| | q!q|S )Nr   TrV   FrY   )rU   rD   r'   rA   r?   r[   )rE   r\   rS   r]   rG   rG   rH   get_all_ticketinfo|   s   zKerberosLive.get_all_ticketinfoc                 C   s   |  | t| j| j||S r:   )rU   r(   rA   r?   )rE   rS   targetrG   rG   rH   export_ticketdata_target   s   
z%KerberosLive.export_ticketdata_targetc                 C   s`   |dkr| j }i }||vrg ||< |  }|| D ]}t| j| j||d }|| | q|S )Nr   
ServerName)r>   r_   r(   rA   r?   r[   )rE   rS   ticket_datar\   ticketresrG   rG   rH   export_ticketdata   s   zKerberosLive.export_ticketdatac                 C   sj   | j ddd |  }i }|D ]#}||vrg ||< || D ]}t| j| j||d }|| | qq|S )Nr   TrV   rb   )rU   r_   r(   rA   r?   r[   )rE   r\   rc   rS   rd   re   rG   rG   rH   export_all_ticketdata   s   z"KerberosLive.export_all_ticketdatac                 C   s2   t  }ttd|}t|}t|}t| |d S )NFAuthenticationId)r4   r5   r7   r2   r3   r6   )rE   current_pidprocess_handletoken_handlestatsrG   rG   rH   r=      s   zKerberosLive.get_current_luidc                 C   s   t  | _| jS r:   )r!   r;   )rE   rG   rG   rH   rD      s   zKerberosLive.list_luidsc                 C   s~   | j D ]9}zt|}td|dd|d |d t|d f  W q ty< } ztd||f  W Y d }~qd }~ww d S )NzUSER "%s\%s" SPN "%s" LUID %sLogonDomain.UserNameUpnLogonIdz)Failed to get info for LUID %s Reason: %s)r;   r"   printgethexrM   r   debug)rE   rS   session_inforP   rG   rG   rH   list_sessions   s   
0zKerberosLive.list_sessionsNc                 C   s   g }|d u r| j ddd ||  7 }n
|| |  | |D ]*}t|}t| j| j|\}}}|dkr@t|dkr<q t|t|dkrJt	| q d S )Nr   TrV      )
rU   rD   r[   r   r   rA   r?   lenr&   r#   )rE   rS   luidsluid_currentmessagemessage_ret
status_retfree_ptrrG   rG   rH   purge   s"   

zKerberosLive.purgec                 C   sX   |  | t||d}t| j| j|\}}}|dkrt|t|dkr*t| d S d S )N)logonidr   )rU   r)   r   rA   r?   r&   ry   r#   )rE   rc   rS   r|   ret_msg
ret_statusr   rG   rG   rH   submit_ticket   s   
zKerberosLive.submit_ticketc                 C   s  |d u rt  }|d d u rtdd|d  }td d|tj}t||d |tjtjB tj	B d\}}}}}|t
jks>|t
jkr| d|}t|d d |d d }	t|d d	 }
t|
jd
 j}t|d d  }||	d|d d }t|j}|d d dkrtdt|d d }tj|jvrtdt|jj}||	d|d d }i }d|d< ||d< t|}i }|d |d< |d |d< |d |d< ||d< t|}| S d S )NlogonserverzFFailed to get logonserver and no target was specified! This wont work.zcifs/%srJ   tokenctxflagsr   r   KeyTyperx   innerContextTokenauthenticatoretype   ciphercksum	cksumtypei  zChecksum not good :(checksumzdelegation flag not set!   zenc-partpvnozmsg-typetickets)r   rM   r*   r,   OUTBOUNDr+   r-   DELEGATEMUTUAL_AUTHALLOCATE_MEMORYr.   OKCONTINUE_NEEDEDra   r   r   loadr	   nativer   decryptr   r   
from_bytesr   GSS_C_DELEG_FLAGr   r
   delegation_datar   dump)rE   r`   logonr   re   dataoutputflagsexpiry
raw_ticketkeyr   rd   r   dec_authenticatorr   checksum_data	cred_origtetentcredrG   rG   rH   get_tgt   sP   	zKerberosLive.get_tgtc           
      C   s   t d d|tj}t||d |tjtjB d\}}}}}|tjks$|tj	krCt
 }t|tj| |j}t|d d jd }	t|	|fS d S )NrJ   r   r   rx   r   )r*   r,   r   r+   r-   r   
CONNECTIONr.   r   r   r/   r0   r1   SESSION_KEYBufferr   r   r   r	   )
rE   r`   r   re   r   r   r   
sec_structkey_datard   rG   rG   rH   	get_apreq  s   
zKerberosLive.get_apreq)r   r9   )Fr:   )r   )__name__
__module____qualname__rI   rC   rR   rU   rX   r^   r_   ra   rf   rg   r=   rD   rw   r   r   r   r   rG   rG   rG   rH   r8   $   s$    


	


4r8   c                     s  zt  }|d }d|d  }t|}| }| I d H \}}|d ur(||jjdddd}g }g }	g }
g }g }d}d}| 2 z3 d H W \}}|d urT|t	 }|j
|_||_|	| qF6 | 2 z3 d H W \}}|d urw|t	 }|j
|_||_|| qi6 d	d
 |	D }|	d j}tt|||dgd2 z 3 d H W \}}}|d ur|
||f q|d7 }|t| q6 | d ur| d|d tj df  }t|ddd}|D ]}|d7 }||d  qW d    n1 sw   Y  n||7 }g }|D ]y}d|j|jf }|d d dkrqz<td d|tj}t||d |tjtjB d\}}}}}|tjksA|tj krNt!"|d d j#d }nt$d|j% W n t$yu } zt&| |
||f W Y d }~qd }~ww |t'| q| d ur| d|d tj df  }t|ddd}|D ]}|d7 }||d  qW d    n	1 sw   Y  n||7 }||
d fW S  t$y } zd d |fW  Y d }~S d }~ww )Ndomainzldap+sspi-ntlm://%sr   zDC= ,rn   r   c                 S   s   g | ]}|j qS rG   )username).0xrG   rG   rH   
<listcomp>D  s    zlive_roast.<locals>.<listcomp>   )override_etyperx   zasreproast_%s_%s.txtz%Y%m%d_%H%M%Sw)newlinez
z%s@%s   krbtgtrJ   r   r   zError %szspnroast_%s_%s.txt)(r   r   from_url
get_clientconnect	_ldapinfodistinguishedNamereplaceget_all_knoreq_usersr   sAMAccountNamer   r   r[   get_all_service_usersr   r   strdatetimeutcnowstrftimeopenwriter*   r,   r   r+   r-   r   r   r.   r   r   r   r   r   rM   valuerr   r   ) outfiler   r   url
msldap_urlclient_err	spn_usersasrep_userserrorsresultsfinal_resultsspn_cnt	asrep_cntuserr   asrepusernamesasrepdomainr   hfilenamefthashspn_namer   re   r   r   r   rd   rP   rG   rG   rH   
live_roast   s   
	
( 

 r   r:   )Ir   winacl.functions.highlevelr   msldap.commons.factoryr   *pypykatz.kerberos.functiondefs.asn1structsr   minikerberos.common.utilsr   minikerberos.common.targetr   minikerberos.securityr   minikerberos.common.credsr   "minikerberos.protocol.asn1_structsr	   r
   r   r   r   r   r   r   r   r   minikerberos.common.ccacher   r    minikerberos.protocol.structuresr   r    minikerberos.protocol.encryptionr   r   pypykatzr   *pypykatz.commons.winapi.processmanipulatorr   (pypykatz.kerberos.functiondefs.netsecapir   r   r   r   r   r    r!   r"   r#   r$   r%   r&   r'   r(   r)   r*   r+   r,   r-   r.   r/   r0   r1   'pypykatz.kerberos.functiondefs.advapi32r2   r3   'pypykatz.kerberos.functiondefs.kernel32r4   r5   r6   r7   r8   r   rG   rG   rG   rH   <module>   s.   ,d }