o
    Žõ±j#  ã                   @   sf   d dl mZ d dlmZmZ d dlmZ d dlmZm	Z	 d dl
mZ G dd„ dƒZG dd	„ d	eƒZd
S )é    )ÚList)ÚKerberosTicketÚKerberosTicketType)ÚPackageDecryptor)ÚPLIST_ENTRYÚPRTL_AVL_TABLE)ÚWindowsMinBuildc                   @   s$   e Zd Zdd„ Zdd„ Zdd„ ZdS )ÚKerberosCredentialc                 C   sL   d| _ d | _d | _d| _d | _d | _g | _d | _d | _d | _	d | _
d | _d S )NÚkerberosó    )ÚcredtypeÚusernameÚpasswordÚpassword_rawÚ
domainnameÚluidÚticketsÚpinÚpin_rawÚcardinfoÚ
aes_key128Ú
aes_key256)Úself© r   ú¤/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/lsadecryptor/packages/kerberos/decryptor.pyÚ__init__   s   
zKerberosCredential.__init__c                 C   s  d}|d| j  7 }|d| j 7 }| jd ur%|d| j 7 }|d| j ¡  7 }| jd ur:|d| j 7 }|d| j ¡  7 }| jd urg|d7 }|d	| jd
  7 }|d| jd  7 }|d| jd  7 }|d| jd  7 }| jrs|d| j ¡  7 }| j	r|d| j	 ¡  7 }|S )Nz	== Kerberos ==
z		Username: %s
z		Domain: %s
z		Password: %s
z		password (hex)%s
z
		PIN: %s
z		PIN (hex): %s
z		CARDINFO: 
z			CardName: %s
ÚCardNamez			ReaderName: %s
Ú
ReaderNamez			ContainerName: %s
ÚContainerNamez			CSPName: %s
ÚCSPNamez		AES128 Key: %s
z		AES256 Key: %s
)
r   r   r   r   Úhexr   r   r   r   r   )r   Útr   r   r   Ú__str__   s(   


zKerberosCredential.__str__c                 C   sª   i }| j |d< | j|d< | j|d< | j|d< | j|d< | j|d< | j|d< | j|d< | j|d	< g |d
< | j	D ]}| 
¡ |d
< q6| jrI| j ¡ |d< | jrS| j ¡ |d< |S )Nr   r   r   r   r   r   r   r   r   r   Úaes128Úaes256)r   r   r   r   r   r   r   r   r   r   Úto_dictr   r    r   )r   r!   Úticketr   r   r   r%   8   s$   









zKerberosCredential.to_dictN)Ú__name__Ú
__module__Ú__qualname__r   r"   r%   r   r   r   r   r	      s    r	   c                       sF   e Zd Zd‡ fdd„	Zdd„ Zdd„ Zdd	„ Zd
d„ Zdd„ Z‡  Z	S )ÚKerberosDecryptorTc                    s4   t ƒ  d|||¡ || _|| _g | _d | _d | _d S )NÚKerberos)Úsuperr   Údecryptor_templateÚwith_ticketsÚcredentialsÚcurrent_ticket_typeÚcurrent_cred)r   Úreaderr-   Úlsa_decryptorÚsysinfor.   ©Ú	__class__r   r   r   N   s   
zKerberosDecryptor.__init__c                 C   sž   |   d| jj ¡  ¡ |  d| jj¡}|   dt|ƒ ¡ |   dt|| jj ƒ ¡ | j || jj ¡}|   dt|ƒ ¡ | j |¡}|   dt|ƒ ¡ ||fS )Nz#Scanning for Kerberos signature! %szkerberos.dllzSignature @ %szSignature (corrected) @ %szFirst entry ptr @ %szFirst entry -> %s)	Úlogr-   Ú	signaturer    Úfind_signatureÚfirst_entry_offsetr2   Úget_ptr_with_offsetÚget_ptr)r   ÚpositionÚptr_entry_locÚ	ptr_entryr   r   r   Úfind_first_entryW   s   z"KerberosDecryptor.find_first_entryc              
   C   sJ   zt  || j| jj| j¡}| jj |¡ W d S  t	y$ } z|‚d }~ww )N)
r   Úparser2   r-   r4   r0   r1   r   ÚappendÚ	Exception)r   Úkerberos_ticketÚktÚer   r   r   Úhandle_ticketb   s   €ÿzKerberosDecryptor.handle_ticketc           	      C   s.  z|   ¡ \}}W n ty" } z|  d| ¡ W Y d }~d S d }~ww | jjtjjk r?| j 	|¡ t
| jƒ}|  || j¡ d S g }| j 	|¡ t| jƒ | j¡}|  |jj|¡ |D ]:}|  || jjj¡ | j 	|¡ | j | j¡}z|  |¡ W qZ ty” } z|  d| ¡ W Y d }~ d S d }~ww d S )Nz"Failed to find structs! Reason: %sú%Failed to process session! Reason: %s)r@   rC   r7   r4   Úbuildnumberr   Ú	WIN_VISTAÚvaluer2   Úmover   Ú	walk_listÚprocess_session_elistr   ÚreadÚwalk_avlÚBalancedRootÚ
RightChildÚlog_ptrr-   Úkerberos_session_structr'   Úprocess_session)	r   Úentry_ptr_valueÚentry_ptr_locrF   Ú	entry_ptrÚresult_ptr_listÚ
start_nodeÚptrÚkerberos_logon_sessionr   r   r   Ústarti   s6   €þ
€þúzKerberosDecryptor.startc              
   C   sv   | j  |j¡ | j  ¡  | j  ¡  | j | j ¡}z|  |¡ W d S  ty: } z|  d| ¡ W Y d }~d S d }~ww )NrH   )	r2   rL   ÚlocationÚ	read_uintr-   rT   rU   rC   r7   )r   Úelistr\   rF   r   r   r   rN   „   s   

€þz'KerberosDecryptor.process_session_elistc           	      C   s>  t ƒ | _|j| j_|jj | j¡| j_|jj	 | j¡| j_
|jjdkrˆ|jj| j| jjd�}| | j| jj¡ |jD ]M}|jjdkr‡|jjdkre|jj | j|jj¡}|rd| j|dd�\}}|rd|| j_q:|jjdkr‡|jj | j|jj¡}|r‡| j|dd�\}}|r‡|| j_q:|jjjdkrË| jj d¡du rº| j|jj | j¡dd�\| j_| j_| jjd ur¹| jj ¡ | j_n|  |jj | j¡¡\| j_| j_|j jdkrú|j j| j| jj!d�}|j" | j¡}|  |¡\| j_#| j_$|j%dkrú|j& '¡ | j_(| j)du �r–|j*j+jdk�r1|j*j+j|j*j+j,k�r1|j*j+j|j*j+j,d k�r1t-j.| _/| j0|j*j+| j1| jj2d	� |j3j+jdk�rb|j3j+j|j3j+j,k�rb|j3j+j|j3j+j,d k�rbt-j4| _/| j0|j3j+| j1| jj2d	� |j5j+jdk�r“|j5j+j|j5j+j,k�r“|j5j+j|j5j+j,d k�r“t-j6| _/| j0|j5j+| j1| jj2d	� d | _/| j 7| j¡ d S )
Nr   )Úoverride_finaltypeé   T)Úbytes_expectedé    ú$é   )Úoverride_ptr)8r	   r1   ÚLocallyUniqueIdentifierr   r/   ÚUserNameÚread_stringr2   r   ÚDomainer   ÚpKeyListrK   rO   r-   Úkeys_list_structÚhash_password_structÚ
KeyEntriesÚgenericÚSizeÚ	ChecksumpÚread_rawÚdecrypt_passwordr   r   ÚPasswordÚLengthÚendswithÚread_maxdatar   r   r    ÚSmartcardInfosÚcsp_info_structÚPinCoder   r   ÚCspDataLengthÚCspDataÚ	get_infosr   r.   Ú	Tickets_1ÚFlinkr^   r   ÚTGSr0   rM   rG   Úkerberos_ticket_structÚ	Tickets_2ÚCLIENTÚ	Tickets_3ÚTGTrB   )	r   r\   Úkey_listÚkeyÚkeydataÚdec_keyÚ_Úcsp_infoÚpin_encr   r   r   rU   �   sv   

€€þ€ÿ
z!KerberosDecryptor.process_session)T)
r'   r(   r)   r   r@   rG   r]   rN   rU   Ú__classcell__r   r   r5   r   r*   M   s    	r*   N)Útypingr   Úpypykatz.commons.kerberosticketr   r   Ú%pypykatz.lsadecryptor.package_commonsr   Úpypykatz.commons.win_datatypesr   r   Úpypykatz.commons.commonr   r	   r*   r   r   r   r   Ú<module>   s   A