o
    Žõ±j&  ã                   @   sn   d dl Z d dlZd dlT d dlmZmZmZmZmZ d dl	T d dl
T d dlmZ d dlmZ G dd„ dƒZdS )é    N)Ú*)ÚRC4ÚDESÚAESÚexpand_DES_keyÚMODE_CBC)Úlogger)Úhexdumpc                   @   st   e Zd Zddd„Zeddd„ƒZdd„ Zd	d
„ Zdd„ Zdd„ Z	dd„ Z
dd„ Zdd„ Zdd„ Zdd„ Zdd„ ZdS )ÚSECURITYNc                 C   s:   || _ || _|| _d| _d| _d | _d | _g | _g | _d S )Né (  T)	ÚhiveÚsystem_hiveÚbootkeyÚdcc_iteration_countÚlsa_secret_key_vista_typeÚlsa_keyÚNKLM_keyÚ
dcc_hashesÚcached_secrets)ÚselfÚsecurity_hiver   r   © r   ú—/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/registry/security/asecurity.pyÚ__init__   s   
zSECURITY.__init__éè  c                 C   s*   t  | ¡}t|ƒD ]}| |¡ q	| ¡ S ©N)ÚhashlibÚsha256ÚrangeÚupdateÚdigest)ÚkeyÚvalueÚroundsÚctxÚ_r   r   r   Úsha256_multi(   s   
zSECURITY.sha256_multic                    s:  t  d¡ | jdu rdt |¡‰t | jˆjd d… ¡}d}t	|ƒ}d‰ ‡ ‡fdd„t
dtˆjdd … ƒˆ ƒD ƒD ]}t|ƒˆ k rJ|d	ˆ t|ƒ  7 }|| |¡7 }q8t |¡‰ˆjd
d … d d… | _n,t | j¡}t
dƒD ]}| |dd… ¡ qnt| ¡ ƒ}| |dd… ¡‰ˆdd… | _t  d| j ¡  ¡ | jS )Nz [SECURITY] Decrypting LSA key...Té    ó    é   c                    ó&   g | ]}ˆj d d… ||ˆ  … ‘qS ©r'   N©Údata©Ú.0Úi©ÚnÚrecordr   r   Ú
<listcomp>7   ó   & z,SECURITY.decrypt_lsa_key.<locals>.<listcomp>r   ó    é4   r   é<   éL   é   z[SECURITY] LSA key value: %s)r   Údebugr   Ú
LSA_SECRETÚ
from_bytesr
   r&   r   r-   r   r   ÚlenÚdecryptÚLSA_SECRET_BLOBÚsecretr   r   Úmd5r   r   r    Úhex)r   r-   r!   Ú
secret_decÚcipherÚblockr$   r0   r   r1   r   Údecrypt_lsa_key/   s*   


.
zSECURITY.decrypt_lsa_keyc                 Ã   sl   �t  d¡ | j dd¡I d H }|d u r/| j dd¡I d H }|s't  d¡ d S d| _t  d¡ |  |d ¡S )Nz[SECURITY] Fetching LSA key...zPolicy\PolEKList\defaultFz%Policy\PolSecretEncryptionKey\defaultz[SECURITY] LSA key not found!z,[SECURITY] LSA secrets default to VISTA typeé   )r   r;   r   Ú	get_valuer   rG   )r   r"   r   r   r   Úget_lsa_keyK   s   €


zSECURITY.get_lsa_keyc                 C   sÀ   d}t j|d d… ddd�}|t|ƒ| d … }|}tdt|ƒdƒD ]5}|d d… }t|d d… ƒ}t|ƒ}	||	 |¡7 }|dd … }|dd … }t|ƒdk rW|t|ƒd … }q"t |¡}
|
jS )	Nr(   é   ÚlittleF)Úsignedr   é   é   )	Úintr=   r>   r   r   r   r?   ÚLSA_SECRET_XPrA   )r   r!   r"   Údec_blobÚenc_sizeÚt_keyr%   Úenc_blobÚdes_keyr$   rA   r   r   r   Údecrypt_secretZ   s    €
zSECURITY.decrypt_secretc                 ƒ   s&  �t  d¡ | jd u r|  ¡ I d H  | j d¡I d H }|d u r(t  d¡ tdƒ‚| jdu r|d| _	t
 |d ¡‰t | jˆjd d… ¡}t|ƒ}d	‰ ‡ ‡fd
d„tdtˆjdd … ƒˆ ƒD ƒD ]}t|ƒˆ k rp|dd	t|ƒ  7 }|  j	| |¡7  _	q^n
|  | j|d ¡| _	t  d| j	 ¡  ¡ | j	S )Nz [SECURITY] Fetching NK$LM key...z$Policy\Secrets\NL$KM\CurrVal\defaultz+[SECURITY] Could not find NL$KM in registryz#Could not find NL$KM in registry :(Tr(   rH   r'   r)   c                    r*   r+   r,   r.   r1   r   r   r4   |   r5   z)SECURITY.get_NKLM_key.<locals>.<listcomp>r   r6   z[SECURITY] NL$KM key: %s)r   r;   r   rJ   r   rI   ÚerrorÚ	Exceptionr   r   r<   r=   r
   r&   r-   r   r   r>   r?   rW   rC   )r   r"   r!   rE   rF   r   r1   r   Úget_NKLM_keyl   s,   €



.ýzSECURITY.get_NKLM_keyc                 C   s   |d@ dkr||d@  S |S )Né   r   r   )r   r-   r   r   r   Ú__pad‡   s   zSECURITY.__padc              	   ƒ   s®  �t  d¡ | j dd¡I d H }|d u rt  d¡ d S | j |¡I d H }|g kr/t  d¡ d S d|v r8| d¡ d|v rbt  d¡ | d¡ | j d¡I d H ‰ˆd	 ‰ˆd
kr]ˆd@ | _nˆd | _| jd u rn|  	¡ I d H  | j
d u rz|  ¡ I d H  |D ]×}t  d| ¡ | j d| ¡  ¡I d H }|d	 }t |¡‰ˆjdk�rSˆjd	@ d	krÿ| jdu rêd}t| j
dd… tˆjd�}d‰ ‡ ‡fdd„tdtˆjƒˆ ƒD ƒD ]}t|ƒdk rá|ddt|ƒ  7 }|| |¡7 }qÏnt | j
ˆj¡ ¡ }t|ƒ}| ˆj¡}nt  d| ¡ q||d d… }	t |dd … ¡}
|
 ˆj¡ d¡}|
  |  !ˆj¡|  !ˆj"¡ ¡ |
 ˆj#¡ d¡}| jdu �r?dnd	}t$||||	| jˆj%d�}| j& '|¡ q|| j&S )Nz[SECURITY] dump_dcc invokedÚCacheFz[SECURITY] No DCC secrets foundó
   NL$Controls   NL$IterationCountz&[SECURITY] DCC Setting iteration countzCache\NL$IterationCountrH   r   l    |ÿ i   z![SECURITY] DCC Checking value: %szCache\%ss                   Tr(   r)   r'   )ÚIVc                    s   g | ]}ˆj ||ˆ  … ‘qS r   )ÚEncryptedDatar.   r1   r   r   r4   ¹   s    z%SECURITY.dump_dcc.<locals>.<listcomp>r   r6   z0[SECURITY] DCC Skipping value %s, unknown formetéH   z	utf-16-leé   )Ú	iterationÚlast_write_ts)(r   r;   r   Úfind_keyÚlist_valuesÚremoverI   r   r   rJ   r   rZ   ÚdecodeÚ	NL_RECORDr=   r_   ÚFlagsr   r   r   r   r>   r`   r?   ÚhmacÚnewr    r   ÚioÚBytesIOÚreadÚ
UserLengthÚseekÚ_SECURITY__padÚDomainNameLengthÚDnsDomainNameLengthÚLSADCCSecretÚ	LastWriter   Úappend)r   Ú	cache_regÚvaluesr"   Úrecord_dataÚ	plaintextrE   rF   r!   Údcc_hashÚblobÚusernameÚdomainÚversionrA   r   r1   r   Údump_dcc�   sn   €










&ý€zSECURITY.dump_dccc                 ƒ   s  �t  d¡ | jd u r|  ¡ I d H  |  ¡ I d H  | j d¡I d H }|d u r-t  d¡ d S d|v r6| d¡ |D ]Ï}dD ]Ê}d ||¡}t  d| ¡ z| j 	|d¡I d H }W n t
yp } zt  d	| ¡ W Y d }~q<d }~ww |rÿ|d
 dkrÿt  d
d||d
 f ¡ | jdu rÝt |d
 ¡‰t | jˆjd d… ¡}d}t|ƒ}	d‰ ‡ ‡fdd„tdtˆjdd … ƒˆ ƒD ƒD ]}
t|
ƒˆ k rÌ|
dˆ t|
ƒ  7 }
||	 |
¡7 }qºt |¡‰ˆj}n	|  | j|d
 ¡}t |||dk| j¡I d H }|d urþ| j |¡ q<t  d	| ¡ q<q8d S )Nz[SECURITY] get_secretszPolicy\Secretsz*[SECURITY] No cached secrets found in hiver^   )ÚCurrValÚOldValzPolicy\Secrets\{}\{}\defaultz [SECURITY] Parsing secrets in %sFz'[SECURITY] Could not open %s, skipping!rH   r   z[SECURITY] Key %s Value %sTr'   r(   r)   c                    r*   r+   r,   r.   r1   r   r   r4   ù   r5   z(SECURITY.get_secrets.<locals>.<listcomp>r6   rƒ   )r   r;   r   rJ   r�   r   Úenum_keyrg   ÚformatrI   rY   Úlogr   r<   r=   r
   r&   r-   r   r   r>   r?   r@   rA   rW   Ú	LSASecretÚprocessr   r   rw   )r   ÚkeysÚkey_nameÚvlÚkey_pathÚvÚer!   rD   rE   rF   rR   rA   r   r1   r   Úget_secretsÖ   sX   €



€þ
.
€àÿzSECURITY.get_secretsc                 C   s&   | j D ]}t|tƒr||_||_qd S r   )r   Ú
isinstanceÚLSASecretDefaultPasswordr~   r   )r   r~   r   rA   r   r   r   Úset_default_user
  s   

€ýzSECURITY.set_default_userc                 C   s–   i }| j |d< | jrdnd|d< | j|d< d |d< | jd ur#| j|d< g |d< | jD ]}|d  | ¡ ¡ q*g |d< | jD ]}|d  | ¡ ¡ q=|S )	Nr   ÚVISTAÚOLDÚsecrets_formatr   zNK$LMÚdccr   )r   r   r   r   r   rw   Úto_dictr   ©r   ÚtrA   r   r   r   r—     s   





zSECURITY.to_dictc                 C   s’   d}|d| j  7 }|| jrdd nd7 }|d| j ¡  7 }| jd ur+|d| j ¡  7 }| jD ]
}|d| ¡  7 }q.| jD ]
}|dt|ƒ 7 }q<|S )	Nz5============== SECURITY hive secrets ==============
zIteration count: %s
zSecrets structure format : %s
r“   r”   zLSA Key: %s
zNK$LM Key: %s
z%s
)	r   r   r   rC   r   r   Úto_lopthr   Ústrr˜   r   r   r   Ú__str__!  s   


zSECURITY.__str__r   )r   )Ú__name__Ú
__module__Ú__qualname__r   Ústaticmethodr&   rG   rJ   rW   rZ   rr   r�   r�   r’   r—   rœ   r   r   r   r   r
      s    
I4r
   )r   rk   Ú pypykatz.registry.sam.structuresÚunicrypto.symmetricr   r   r   r   r   Ú%pypykatz.registry.security.structuresÚ"pypykatz.registry.security.acommonÚpypykatz.registryr   Úpypykatz.commons.commonr	   r
   r   r   r   r   Ú<module>   s   	