o
    j2                     @   sN  d dl Z d dlmZ d dlmZmZmZmZmZm	Z	 d dl
mZ d dlmZmZmZmZ d dlmZmZmZ d dlmZmZmZmZ d dlmZ d d	lmZmZ d d
lm Z  d dl!m"Z" d dl#m$Z$ d dl%Z%d dl&m'Z' ed ded ded ded ded ded ded ded ded ded ded ded diZ(G dd dZ)dS )    N)OrderedDict)RC4AESDESMODE_CBCMODE_ECB	deriveKey)md5)NAME_TO_INTERNALACCOUNT_TYPESKERBEROS_TYPEINTERNAL_TO_NAME)PEKLIST_ENCPEK_KEYPEKLIST_PLAIN)CRYPTED_HASHCRYPTED_HASHW16CRYPTED_HISTORYCRYPTED_BLOB)USER_PROPERTIES)KERB_STORED_CREDENTIAL_NEWKERB_KEY_DATA_NEW)SAMR_RPC_SID)UserSecrets)logger)unpack	objectSid   dBCSPwdnamesAMAccountType
unicodePwdsAMAccountNameuserPrincipalNamentPwdHistorylmPwdHistory
pwdLastSetuserAccountControlsupplementalCredentialsc                   @   sp   e Zd Zdd Zdd Zdd Zdd Zd	d
 Zedd Z	dd Z
ddefddZdefddZdddZdS )NTDSc                 C   s,   || _ || _g | _d | _t | _t | _d S N)dbbootkey
_NTDS__PEK_NTDS__cryptoCommonr   _NTDS__kerberosKeys_NTDS__clearTextPwds)selfr+   r,    r2   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/aesedb/security/ntds.py__init__$   s   zNTDS.__init__c              
      sf   zt d | jdI d H \}}|d ur||d fW S  ty2 } z
d |fW  Y d }~S d }~ww )NzOpening datatable...	datatable)r   debugr+   
open_table	Exception)r1   cursorerrer2   r2   r3   open_db_table-   s   

zNTDS.open_db_tablec              
      s4  z t d |  I d H \}}|d ur|td }d }	 | j||diI d H \}}|d ur2||d u r:td||v rE|| d u rEq||v rQt|| }nq|d u rZtd|j	d d dkrt
| j}tdD ]}||j ql| }t|}	t|	|j}
t j}tt|
j| D ]}|| }t|
j|||  }| j|j qnM|j	d d d	krt| jt|jd
}||j}t|}
d\}}	 |
j||d  }t|dk rntd|\}}||krn| j| |d7 }|d7 }qt d W dS  ty } z
d |fW  Y d }~S d }~ww )NzFetching PEK...pekListTr   zPEK not found!   s      i  s      IV)r   r      z<L16szPEK found and decrypted!TN)r   r6   r<   r
   r+   get_next_rowr8   r   
from_bytesHeaderr	   r,   rangeupdateKeyMaterialdigestr   r   encryptEncryptedPekr   _lenlenDecryptedPekr-   appendKeyr   r   decryptr   )r1   	db_cursorr:   
pklistnamepeklist_encrecordctx_tmpKeyrc4peklistPEKLenir9   pekdec_pekpos	cur_index	pek_entryindexr;   r2   r2   r3   get_pek7   sn   





zNTDS.get_pekc                 C   sL   t t|\}}t|t}t|t}||d d ||dd   }|S )N   )r   intr   r   rQ   )r1   cryptedHashridKey1Key2Crypt1Crypt2decryptedHashr2   r2   r3   __removeDESLayer   s
   

$zNTDS.__removeDESLayerc                 C   sD   |j d }t| j| }||j | }t|}||j}|S )Nr>   )	rE   r	   r-   rG   rH   rI   r   rJ   EncryptedHash)r1   rf   pek_ixdrV   rX   rY   	plainTextr2   r2   r3   __removeRC4Layer   s   
zNTDS.__removeRC4Layerc                 C   s2   | d8 } | d } | dk rdS t j | }|dS )Nl     }*{Gi r   neverz%Y-%m-%d %H-%M)datetimefromtimestampstrftime)tdtr2   r2   r3   __fileTimeToDateTime   s   
zNTDS.__fileTimeToDateTimec                 C   sb   g }i }|D ]}|| }|t v r||t | < || q|D ]}||= q|D ]}|| ||< q&|S r*   )r   rO   )r1   rU   names_to_deletenames_to_addr   valuer2   r2   r3   resolve_record_names   s   
zNTDS.resolve_record_namesTsecretc              
   C   s  zzt |td  }t|dd }W n ty4 } ztd td|td     |d }~ww ||_|td  d urt	|td  }|j
d d dkrvt|td  }|j
d }	t| j|	 t|jd	}
|
|jd d
 }n| |}| |||_ntd|_|td  d urt	|td  }|j
d d dkrt|td  }|j
d }	t| j|	 t|jd	}
|
|jd d
 }n| |}| |||_ntd|_|td  d ur|td  dd |_d|td   |_n	d|td   |_|td  d ur|td  |_|td  d ur$| |td  |_|du r,W dS |td  d urft|td  }| |}tdt|d
 D ]}| ||d
 |d d
  |}|j !| qL|td  d urt|td  }|j
d d dkrt|td  }|j
d }	t| j|	 t|jd	}
|
|j}n| |}tdt|d
 D ]}| ||d
 |d d
  |}|j"!| qW dS  ty } z
d |fW  Y d }~S d }~ww )Nr   -zSID parsing failed!zData inpuit: %sr   r>         r?       aad3b435b51404eeaad3b435b51404eer!    31d6cfe0d16ae931b73c59d7e0c089c0r#   @z%sr"   r'   r&   FNNr%   r   r   r$   rB   )#r   rD   r
   strsplitr8   printhex
object_sidr   rE   r   r   r-   r   rH   rQ   rn   _NTDS__removeRC4Layer_NTDS__removeDESLayerlm_hashbytesfromhexnt_hashdomainusernameuser_account_control_NTDS__fileTimeToDateTimepwd_last_setr   rF   rM   
lm_historyrO   
nt_history)r1   r}   rU   rR   with_historysidrg   r;   encryptedLMHashpekIndexrV   dec_hash_tempencryptedNTHashencryptedLMHistorytmpLMHistoryr\   LMHashencryptedNTHistoryNTHashr2   r2   r3   __decrypt_hash   s~   





 

 zNTDS.__decrypt_hashc              
   C   s  zd }d}|t d  d urMt|t d  dkrMt|t d  }|jd d dkrF|jd }t| j| t|jd}|	|j
dd  }d}n| |}d}|du rV|d fW S zt|}W n tyk }	 z|	d }	~	ww |jD ]w}
|
jd	krt|
j }t|}|j}t|jD ]4}t|}||jd  }||jd  d |j }|jtv rt|j |f}nt|j|f}|j | qqo|
jd
krz|j! |
jd W qo t"y   |j! |
jd Y qow qo|d fW S  ty }	 z
d |	fW  Y d }	~	S d }	~	ww )NFr(      r>   r   r?   TrB   zPrimary:Kerberos-Newer-KeyszPrimary:CLEARTEXTzutf-16lezutf-8)#r
   rM   r   rD   rE   r   r-   r   rH   rQ   rn   r   r   r8   UserPropertiesPropertyNamer   r   PropertyValuedecoder   BufferrF   CredentialCountr   rL   	KeyOffset	KeyLengthKeyTyper   r   kerberos_keysrO   cleartext_pwdsUnicodeDecodeError)r1   r}   rU   rp   haveInfo
cipherTextr   rV   userPropertiesr;   userproppropertyValueBufferkerbStoredCredentialNewdata
credential
keyDataNewkeyValueanswerr2   r2   r3   __decryptSupplementalInfo   s^   









	zNTDS.__decryptSupplementalInfoFc              
   C  sX  z|   I d H \}}|d ur|| jdI d H \}}|d ur"|	 tdI d H  | j|tI d H \}}|d ur=||d u rDW d S t|dkr|td  t	v rtd |v rd }t
 }	| |	|||\}}|d urr|du rq|q"td |v r| |	|\}}|d ur|du r||	d fV  q"dV  q# ty }
 zd |
fV  W Y d }
~
d S d }
~
ww )	Nr5   Tr   r    r   Fr(   r   )rc   r+   r7   asynciosleeprC   NTDS_SUPPORTED_SECRET_TYPESrM   r
   r   r   _NTDS__decrypt_hash_NTDS__decryptSupplementalInfor8   )r1   	only_ntlmr   ignore_errorsrW   r:   rR   rU   decryptedSupplementalInfor}   r;   r2   r2   r3   dump_secrets=  sH   (
zNTDS.dump_secretsN)T)FTT)__name__
__module____qualname__r4   r<   rc   r   r   staticmethodr   r|   r   r   r   r   r2   r2   r2   r3   r)   #   s    	
L

	S>r)   )*r   collectionsr   unicrypto.symmetricr   r   r   r   r   r   unicrypto.hashlibr	   aesedb.security.constantsr
   r   r   r   aesedb.security.structures.pekr   r   r   "aesedb.security.structures.cryptedr   r   r   r   $aesedb.security.structures.userpropsr   %aesedb.security.structures.kerbsecretr   r   aesedb.security.structures.sidr   !aesedb.security.common.usersecretr   aesedbr   rs   structr   r   r)   r2   r2   r2   r3   <module>   s8    