o
    j                     @   s  d dl Z d dlZd dlZd dlZd dlZd dlZd dlmZ d dlm	Z	 d dl
mZ d dlmZmZ d dlmZ d dlmZ d dlmZmZ d d	lmZ d d
lmZ d dlmZmZ d dlmZmZm Z  d dl!m"Z" d dl#m$Z$ d dl%m&Z&m'Z'm(Z(m)Z) d dl*m+Z+ eZ,G dd deZ-G dd deZ.G dd deZ/G dd deZ0G dd deZ1G dd deZ2i dddd d!d"d#d$d%d&d'd(d)d*d+d,d-d.d/d0d1d2d3d4d5d6d7d8d9d:d;d<d=d>i d?d@dAdBdCdDdEdFdGdHdIdJdKdLdMdNdOdPdQdRdSdTdUdVdWdXdYdZd[d\d]d^d_d`i dadbdcdddedfdgdhdidjdkdldmdndodpdqdrdsdtdudvdwdxdydzd{d|d}d~ddddi ddddddddddddddddddddddddddddddddddi ddddddddddddddddddddddddddddddddēddƓddddddddddddҜZ3ddԄ Z4ddք Z5dd؄ Z6ddڄ Z7dd܄ Z8e9dkre8  dS dS )    N)Sequence)MD4)Enum)	unhexlifyhexlify)decoder)version)FILETIMEPRPC_SID)TypeSerialization1)logger)	constantspac)TGS_REPEncTicketPartAD_IF_RELEVANT)CCache)ChecksumTypes)Key_enctype_tableInvalidChecksumgenerate_kerberos_keys)LDAP_SIDc                   @      e Zd ZdZdZdS )
User_Flags       N)__name__
__module____qualname__LOGON_EXTRA_SIDSLOGON_RESOURCE_GROUPS r"   r"   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/../../../bin/describeTicket.pyr   .       r   c                   @   s   e Zd ZdZdZdZdS )SE_GROUP_Attributes         N)r   r   r   SE_GROUP_MANDATORYSE_GROUP_ENABLED_BY_DEFAULTSE_GROUP_ENABLEDr"   r"   r"   r#   r%   3   s    r%   c                   @   sd   e Zd ZdZdZdZdZdZdZdZ	dZ
d	Zd
ZdZdZdZdZdZdZdZdZdZdZdZdZdS )USER_ACCOUNT_Codesr&   r'   r(         r   @         r   i             i @  i                      N)r   r   r   USER_ACCOUNT_DISABLEDUSER_HOME_DIRECTORY_REQUIREDUSER_PASSWORD_NOT_REQUIREDUSER_TEMP_DUPLICATE_ACCOUNTUSER_NORMAL_ACCOUNTUSER_MNS_LOGON_ACCOUNTUSER_INTERDOMAIN_TRUST_ACCOUNTUSER_WORKSTATION_TRUST_ACCOUNTUSER_SERVER_TRUST_ACCOUNTUSER_DONT_EXPIRE_PASSWORDUSER_ACCOUNT_AUTO_LOCKED$USER_ENCRYPTED_TEXT_PASSWORD_ALLOWEDUSER_SMARTCARD_REQUIREDUSER_TRUSTED_FOR_DELEGATIONUSER_NOT_DELEGATEDUSER_USE_DES_KEY_ONLYUSER_DONT_REQUIRE_PREAUTHUSER_PASSWORD_EXPIRED+USER_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATIONUSER_NO_AUTH_DATA_REQUIREDUSER_PARTIAL_SECRETS_ACCOUNTUSER_USE_AES_KEYSr"   r"   r"   r#   r,   9   s.    r,   c                   @   sl   e Zd ZdZdZdZdZdZdZdZ	dZ
d	Zd
ZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdS )UF_FLAG_Codesr&   r'   r-   r.   r   r/   r0   r1   r   r2   r3   r4   r5   r6   r7   r8   r9   r:   i  @ i   i   i   i   i   N)r   r   r   	UF_SCRIPTUF_ACCOUNTDISABLEUF_HOMEDIR_REQUIRED
UF_LOCKOUTUF_PASSWD_NOTREQDUF_PASSWD_CANT_CHANGE"UF_ENCRYPTED_TEXT_PASSWORD_ALLOWEDUF_TEMP_DUPLICATE_ACCOUNTUF_NORMAL_ACCOUNTUF_INTERDOMAIN_TRUST_ACCOUNTUF_WORKSTATION_TRUST_ACCOUNTUF_SERVER_TRUST_ACCOUNTUF_DONT_EXPIRE_PASSWDUF_MNS_LOGON_ACCOUNTUF_SMARTCARD_REQUIREDUF_TRUSTED_FOR_DELEGATIONUF_NOT_DELEGATEDUF_USE_DES_KEY_ONLYUF_DONT_REQUIRE_PREAUTHUF_PASSWORD_EXPIRED)UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATIONUF_NO_AUTH_DATA_REQUIREDUF_PARTIAL_SECRETS_ACCOUNTUF_USE_AES_KEYSr"   r"   r"   r#   rQ   R   s2    rQ   c                   @   r   )Upn_Dns_Flagsr&   r'   N)r   r   r   U_UsernameOnlyS_SidSamSuppliedr"   r"   r"   r#   rj   m   r$   rj   c                   @   r   )Attributes_Flagsr&   r'   N)r   r   r   PAC_WAS_REQUESTEDPAC_WAS_GIVEN_IMPLICITLYr"   r"   r"   r#   rm   r   r$   rm   498z'Enterprise Read-Only Domain Controllers512zDomain Admins513zDomain Users514zDomain Guests515zDomain Computers516zDomain Controllers517zCert Publishers518zSchema Admins519zEnterprise Admins520zGroup Policy Creator Owners521zRead-Only Domain Controllers522zCloneable Controllers525zProtected Users526z
Key Admins527zEnterprise Key Admins553zRAS and IAS Servers571z'Allowed RODC Password Replication Group572z&Denied RODC Password Replication GroupzS-1-1-0EveryonezS-1-2-0LocalzS-1-2-1zConsole LogonzS-1-3-0zCreator OwnerzS-1-3-1zCreator GroupzS-1-3-2zOwner ServerzS-1-3-3zGroup ServerzS-1-3-4zOwner RightszS-1-5-1DialupzS-1-5-2NetworkzS-1-5-3BatchzS-1-5-4InteractivezS-1-5-6ServicezS-1-5-7zAnonymous LogonzS-1-5-8ProxyzS-1-5-9zEnterprise Domain ControllerszS-1-5-10SelfzS-1-5-11zAuthenticated UserszS-1-5-12zRestricted CodezS-1-5-13zTerminal Server UserzS-1-5-14zRemote Interactive LogonzS-1-5-15zThis OrganizationzS-1-5-17IUSRzS-1-5-18zSystem (or LocalSystem)zS-1-5-19zNT Authority (LocalService)zS-1-5-20zNetwork ServicezS-1-5-32-544AdministratorszS-1-5-32-545UserszS-1-5-32-546GuestszS-1-5-32-547zPower UserszS-1-5-32-548zAccount OperatorszS-1-5-32-549zServer OperatorszS-1-5-32-550zPrint OperatorszS-1-5-32-551zBackup OperatorszS-1-5-32-552ReplicatorszS-1-5-32-554zBuiltin\Pre-WindowszS-1-5-32-555zBuiltin\Remote Desktop UserszS-1-5-32-556z'Builtin\Network Configuration OperatorszS-1-5-32-557z&Builtin\Incoming Forest Trust BuilderszS-1-5-32-558z!Builtin\Performance Monitor UserszS-1-5-32-559zBuiltin\Performance Log UserszS-1-5-32-560z*Builtin\Windows Authorization Access GroupzS-1-5-32-561z'Builtin\Terminal Server License ServerszS-1-5-32-562zBuiltin\Distributed COM UserszS-1-5-32-568zBuiltin\IIS_IUSRSzS-1-5-32-569zBuiltin\Cryptographic OperatorszS-1-5-32-573zBuiltin\Event Log ReaderszS-1-5-32-574z'Builtin\Certificate Service DCOM AccesszS-1-5-32-575z!Builtin\RDS Remote Access ServerszS-1-5-32-576zBuiltin\RDS Endpoint ServerszS-1-5-32-577zBuiltin\RDS Management ServerszS-1-5-32-578zBuiltin\Hyper-V AdministratorszS-1-5-32-579z+Builtin\Access Control Assistance OperatorszS-1-5-32-580zBuiltin\Remote Management UserszS-1-5-64-10zNTLM AuthenticationzS-1-5-64-14zSChannel AuthenticationzS-1-5-64-21zDigest AuthenticationzS-1-5-80z
NT Servicez
S-1-5-80-0zAll Servicesz
S-1-5-83-0z#NT VIRTUAL MACHINE\Virtual Machinesz	S-1-5-113zLocal Accountz	S-1-5-114z0Local Account and member of Administrators groupz
S-1-5-1000zOther Organizationz
S-1-15-2-1zAll app packageszS-1-16-0zML UntrustedzS-1-16-4096zML LowzS-1-16-8192z	ML MediumzML Medium PluszML Highz	ML SystemzML Protected ProcesszML Secure Processz*Authentication authority asserted identityzService asserted identityzFresh public key identityzKey trust identityzKey property MFAzKey property attestation)zS-1-16-8448zS-1-16-12288zS-1-16-16384zS-1-16-20480zS-1-16-28672zS-1-18-1zS-1-18-2zS-1-18-3zS-1-18-4zS-1-18-5zS-1-18-6c                 C   s4  t | j}tdt|j  t|jD ]\}}td|  | }t	j
|d t dd }t|d j
d}tdd	|f  tdd
|d  dd 
df  tdd|d  dd 
df  |d  dd 
d}tdd|f  tdd|d  dd 
df  tddtj|d d df  tj|d d tj k rtddtj|d d df  ntddtj|d d df  tj|d d tj k rtddtj|d d df  ntddtj|d d df  g }tjD ]}	|d d|	j ? d@ dkr>|t|	jj q$tdd|d d|f  |d  d! d" }
t|
j}t|d# d$ j}tdd%|f  tdd&t|d# d' 
df  |d(d d)krtd* d }|d+kr|d,krtd-|  n=|d+krt||| j| j d.}n-| jr| j!d/rd0| j"d/# | j # f }n| j}t|||| j d.}nt$d1 |rtdd2|f  td3d4 |  d(t%d5d6 |d  d7 d8 D }td9d|f  td9d|d  d: f  td;d<t|
j|
f  |d  d! d= & sMtd> td?d@|d  d! d= f  tdA t'| j(| j)| j*| j+| j,| j| j }ztdB||
f  ||
 }tdCt|j
d  W n3 t-y   t|dkrt$dDt|
j|
ddEd6 |. D  nt$dFt|
j|
 Y qw z|d  d! dG }t/t0|
 }|1|dH|}W n t2y   t$dI | j,rtdJ tdK Y qw tdL t	j
|t3 dd }t4|d# d$ t5|d# d' }t	j
|dM d dN t6 dd }t78|d dN 9 }t:|| }td3dO |  |D ]e}t%|. d }tdP|  || D ]N}|| | }t;|t<rt;|t=st|dkrtdQ||d f  |dd  D ]}tdRdS|   qrqFtdT|  qFtdQ||f  qFq1qd S )UNz"Number of credentials in cache: %dzParsing credential[%d]:KDC_REP)asn1Specr   
sessionKeyutf-8z	%-30s: %szTicket Session Keyz	User Nameclient   @z
User Realmr&   serverzService NamezService Realmz
Start Timetime	starttime%d/%m/%Y %H:%M:%S %pendtimez%-30s: %s (expired)zEnd Time
renew_till	RenewTilltktflags   z%-30s: (0x%x) %sFlags, ticketenc-partetypekeykeytypeKeyTypezBase64(key)keyvalue/krbtgtz$Attempting to create Kerberoast hashrc4_hmacaes256_cts_hmac_sha1_96zKService ticket uses encryption key type %s, unable to extract hash and salt)
decodedTGSspnusernamedomain$z	host%s.%szJAES256 in use but no '-u/--user' passed, unable to generate crackable hashzKerberoast hashz%-30s:z5Decoding unencrypted data in credential[%d]['ticket']c                 S      g | ]}t |qS r"   str).0sname_componentr"   r"   r#   
<listcomp>      z parse_ccache.<locals>.<listcomp>snamename-stringz  %-28s: %srealmz  %-28s: %s (etype %d)zEncryption typekvnozNo kvno in ticket, skippingz  %-28s: %dzKey version number (kvno)zHandling Kerberos keysz&Ticket is encrypted with %s (etype %d)zUsing corresponding key: %szCould not find the correct encryption key! Ticket is encrypted with %s (etype %d), but only keytype(s) %s were calculated/suppliedc                 S   r   r"   r   )r   enctyper"   r"   r#   r   3  r   zrCould not find the correct encryption key! Ticket is encrypted with %s (etype %d), but no keys/creds were suppliedcipherr'   zUCiphertext integrity failed. Most likely the account password or AES key is incorrectzMake sure the salt/username/domain are set and with the proper values. In case of a computer account, append a "$" to the name.zRemember: the encrypted-part of the ticket is secured with one of the target service's Kerberos keys. The target service is the one who owns the 'Service Name' SPN printed abovezTicket successfully decryptedzauthorization-datazad-dataz-Decoding credential[%d]['ticket']['enc-part']z  %-28sz    %-26s: %sz                                 z%sz
    %-26s:)>r   loadFiler   logginginfolencredentials	enumeratetoTGSr   decoder   r   contentsprettyPrintsplitdatetimefromtimestampstrftimenowr   TicketFlagsvalueappendnamejoinEncryptionTypesbase64	b64encodedebugkerberoast_from_ccacheuserr   endswithrstriplowererrorlist	isNoValuer   rc4aespasswordhex_passsaltKeyErrorkeysr   intdecryptr   r   r   bytesr   r   PACTYPEasOctets	parse_pac
isinstancer   r   )argsccachecred_numbercreds	rawTicketdecodedTicketr   r   flagskr   	etype_enckeyTypekerberoast_hashr   ekeysr   
cipherText	newCipher	plainTextencTicketPartadIfRelevantpacType
parsed_pacelement_typeelement_type_name	attributer   subvaluer"   r"   r#   parse_ccache   s   ***(*( *(
&

 
$

"





 
r  c           >      C   sF
  dd }dd }g }| d }t | d D ]}t|}| d |d d d  d |d	  }|d
 tjkrVt|}	|t|	d d  }
t }||
 ||
t|	 d   i }||d |d< ||d |d< ||d |d< ||d |d< ||d |d< ||d |d< ||d |d< ||d |d< |d |d< |d |d< |d |d< |d |d < |d! |d"< |d# |d$< |d% |d&< |d' |d(< |d) |d*< |d+ |d,< |d- |d.< |d/ |d0< d1d2 ||d3 D }d4
||d5< g }d6}|D ]}t|}|r|d7| d8|  q|d97 }q|d6kr.|d:| d;|d9kr)d<nd=  ||d>< |d? }g }tD ]}||j@ rH||j q:d@|d4
|f |dA< t|dB dC|dD< |dE |dF< |dG |dH< |dI dJkrz|dI |dK< n|dI  |dK< |dL }g }tD ]}||j@ r||j qd@|d4
|f |dM< |dN |dO< g }|dP D ]T}|dQ  }|dR }g }tD ]}||j@ r||j qt|d=}|st|dSdkrt|dSdT d=}|rdU| }|dV||d4
|f  q||dW< |dX dJkr|dX |dY< n|dX  |dY< |dZ |d[< d4
d\d2 ||d] D |d^< t|d_ dC|d_< |d` |d`< |da |da< |db|i n|d
 tjkrt }|| i }z
||dc |dd< W n+   z|t|d de |dd< W n ty } zt| W Y d }~nd }~ww Y |df dg|dh< |di|i ng|d
 tjkrWt|}|dj }|dk } || | |  dg}!|dl }"|dm }#||#|#|"  dg}$|dn }%g }&tD ]}'|%|'j@ r|&|'j qi }d7|% d8d4
|& |dn< |!|do< |$|dp< tj j|&v rNt!|}|dq }(|dr })||)|)|(  dg}*|ds }+|dt },t"||,|,|+  }-|*|du< |- |dv< |dw|i n|d
 tj#krt$|}.i }t%|.dx j|dy< t|.dz dC|dz< |d{|i n|d
 tj&krt$|}.i }t%|.dx j|dy< t|.dz dC|dz< |d||i ni|d
 tj'krt(|}/i }0d}|/j)d~ |/j)d~ f |0d~< |/j)d }1d|1t*+|/j)d jf |0d< |j,sd|0d< td |d|0i n"|d|0i t-|1 }2t.|1t/|j,}3|20|3d|/j)d }4t|4}	|4t|	d d  }
t1|
}5i }6|5d |6d< |d|6i |5d D ]M}7i }8|7d |8d< |7d |8d< |d|8i t2dJ
|7d }9i }:|9d~ |:d< |9dn |:d< t|9d dC|:d< t|9d dC|:d< |d|:i q9n|d
 tj3krt4|};i }|;d |d< |;j)d j)d |d< |;d dC|d< |d|i n`|d
 tj5krt6|}<|<dn }%g }&t7D ]}'|%|'j@ r|&|'j qdnd7|% d8d4
|& i}|d|i n&|d
 tj8krt9|}=dv|=dv  i}|d|i n	t:d|d
   |t|d  }q|S )Nc                 S   s~   | d }| d }d}|dkr=|dkr=|}|dK }||O }t j|d d d	kr=t  d
ddd	d	d	t j|d d d}|S )NdwLowDateTimedwHighDateTimezInfinity (absolute time)l    ir   
   )microsecondsr   iA  r&   r   )r   	timedeltatotal_secondsr   )datar  r  
v_FILETIME	temp_timer"   r"   r#   PACparseFILETIMEd  s   *z#parse_pac.<locals>.PACparseFILETIMEc                 S   s8   g }| D ]}i }|d |d< |d |d< | | q|S )N
RelativeId
Attributes)r   )r
  groupsgroupgroupMembershipr"   r"   r#   PACparseGroupIdst  s   z#parse_pac.<locals>.PACparseGroupIdsBufferscBuffersOffsetr-   cbBufferSizeulTyper(   	LogonTimez
Logon Time
LogoffTimezLogoff TimeKickOffTimezKickoff TimePasswordLastSetzPassword Last SetPasswordCanChangezPassword Can ChangePasswordMustChangezPassword Must ChangeLastSuccessfulILogonLastFailedILogonFailedILogonCountEffectiveNamezAccount NameFullNamez	Full NameLogonScriptzLogon ScriptProfilePathzProfile PathHomeDirectoryzHome DirHomeDirectoryDrivez	Dir Drive
LogonCountzLogon CountBadPasswordCountzBad Password CountUserIdzUser RIDPrimaryGroupIdz	Group RID
GroupCountzGroup Countc                 S      g | ]}t |d  qS r  r   r   gidr"   r"   r#   r         zparse_pac.<locals>.<listcomp>GroupIdsr   Groupsr   (z) r&   +z Unknown custom groups zGroups (decoded)	UserFlagsz(%s) %sz
User FlagsUserSessionKeyr   zUser Session KeyLogonServerzLogon ServerLogonDomainNamezLogon Domain NameLogonDomainId    zLogon Domain SIDUserAccountControlzUser Account ControlSidCountzExtra SID Count	ExtraSidsSidr  - z	%s%s (%s)z
Extra SIDsResourceGroupDomainSidzResource Group Domain SIDResourceGroupCountzResource Group Countc                 S   r-  r.  r   r/  r"   r"   r#   r     r1  ResourceGroupIdszResource Group IdsLMKeySubAuthStatus	Reserved3	LoginInfoClientIdz	Client Idr   Namez	utf-16-lezClient Name
ClientName	UpnLength	UpnOffsetDnsDomainNameLengthDnsDomainNameOffsetr   UPNzDNS Domain NameSamNameLengthSamNameOffset	SidLength	SidOffsetSamAccountNameUserSidUpnDnsSignatureTypezSignature Type	SignatureServerChecksumKDCChecksumz	(0x%x) %dVersionEncryptionTypez	(0x%x) %szEncryption Typez%<Cannot decrypt, --asrep-key missing>z5No ASREP key supplied, cannot decrypt PAC CredentialszCredential Infor.   SerializedDataCredentialCountz  Credential Countz  Credential DataCredentialsPackageNamez      Package NameCredentialSizez      Credential Sizez      SecPkg Credentialsz        Versionz        Flags
LmPasswordz        LmPasword
NtPasswordz        NtPaswordz        NTLM CredentialsS4U2proxyTargetTransitedListSizeDataS4UTransitedServicesDelegationInfozAttributes InfozRequestor Infoz:Unsupported PAC structure: %s. Please raise an issue or PR);ranger   PAC_INFO_BUFFERPAC_LOGON_INFOr   r   KERB_VALIDATION_INFO
fromStringfromStringReferentsgetDatar   MsBuiltInGroupsgetr   r   r   r   r   r   formatCanonicalr,   r%   r   PAC_CLIENT_INFO_TYPEPAC_CLIENT_INFOr	   	Exceptionr   r   PAC_UPN_DNS_INFOUPN_DNS_INFOrj   rl   UPN_DNS_INFO_FULLr   PAC_SERVER_CHECKSUMPAC_SIGNATURE_DATAr   PAC_PRIVSVR_CHECKSUMPAC_CREDENTIALS_INFOPAC_CREDENTIAL_INFOfieldsr   r   	asrep_keyr   r   r   r   PAC_CREDENTIAL_DATANTLM_SUPPLEMENTAL_CREDENTIALPAC_DELEGATION_INFOS4U_DELEGATION_INFOPAC_ATTRIBUTES_INFOPAC_ATTRIBUTE_INFOrm   PAC_REQUESTOR_INFOPAC_REQUESTORr   )>r   r   r  r  parsed_tuPACbuffbufferN
infoBufferr
  type1newdatakerbdataparsed_dataall_groups_idr  unknown_countr0  
group_namer8  User_Flags_FlagsflagUAC	UAC_Flags	extraSidsextraSidsid
attributesattributes_flags
clientInfoeupnrO  rP  UpnNamerQ  rR  DnsNamer   
attr_flagsflag_librT  rU  SamNamerV  rW  rA  signatureDatacredential_infoparsed_credential_infocredinfo_enctyper   r   plain_credential_datacredential_dataparsed_credential_data
credentialparsed_secpkg_supplemental_credntlm_supplemental_credparsed_ntlm_supplemental_creddelegationInfoattributeInforequestorInfor"   r"   r#   r   c  s  

$



$
 











r   c              
   C   s  z@|s| d d j  }n| }|sd}|d}| d d d tjjjkr\dtjjj|||dd	t| d d d
 d d 	 
 t| d d d
 dd  	 
 f }|W S | d d d tjjjkrdtjjj|||dd	t| d d d
 dd  	 
 t| d d d
 d d 	 j
f }|W S | d d d tjjjkrdtjjj|||dd	t| d d d
 dd  	 
 t| d d d
 d d 	 
 f }|W S | d d d tjjjkrdtjjj|||dd	t| d d d
 d d 	 
 t| d d d
 dd  	 
 f }|W S td| d d d d | d d d d | d d d f  |W S  tyO } z d }~ww )Nr   r   USERr   r   r   z$krb5tgs$%d$*%s$%s$%s*$%s$%s:~r   r.   z$krb5tgs$%d$%s$%s$*%s*$%s$%siz,Skipping %s/%s due to incompatible e-type %dr   r   r   r&   )_valueupperr   r   r   r   r   replacer   r   r   aes128_cts_hmac_sha1_96r   des_cbc_md5r   r   ry  )r   r   r   r   entryr  r"   r"   r#   r   x  sX   
""" """"$r   c                  C   s|  t jddd} | jdddd | jdd	d
d | jdd	dd |  }d|_d|_|jdddddd |jddddddd |jdddddd |jdddd d!d |jd"d#dd$d%d |jd&dd'd(d |jd)dd*d+d |  }d,|_d-|_|jd.dd*d/d ttjd0kr| 	  t
d0 |  }|js|jr|js| d1 n|js|jr| d2 |jrd3|jvr| d4 |S )5NTzKTicket describer. Parses ticket, decrypts the enc-part, and parses the PAC.)add_helpdescriptionr   storezPath to ticket.ccache)actionhelpz-debug
store_truezTurn DEBUG output ONz-tsz&Adds timestamp to every logging outputz(Ticket decryption credentials (optional)a  Tickets carry a set of information encrypted by one of the target service account's Kerberos keys.(example: if the ticket is for user:"john" for service:"cifs/service.domain.local", you need to supply credentials or keys of the service account who owns SPN "cifs/service.domain.local")z-pz
--passwordPASSWORDz)Cleartext password of the service account)r  metavarr  z-hpz--hex-passwordr   HEXPASSWORDz#Hex password of the service account)destr  r  r  z-uz--userr  zName of the service accountz-dz--domainDOMAINzFQDN Domainz-sz--saltSALTzqSalt for keys calculation (DOMAIN.LOCALSomeuser for users, DOMAIN.LOCALhostsomemachine.domain.local for machines)z--rc4RC4zRC4 KEY (i.e. NT hash)z--aesHEXKEYzAES128 or AES256 keyz#PAC Credentials decryption materiala  [MS-PAC] section 2.6 (PAC Credentials) describes an element that is used to send credentials for alternate security protocols to the client during initial logon.This PAC credentials is typically used when PKINIT is conducted for pre-authentication. This structure contains LM and NT hashes.The information is encrypted using the AS reply key. Attack primitive known as UnPAC-the-Hash. (https://www.thehacker.recipes/ad/movement/kerberos/unpac-the-hash)z--asrep-keyz+AS reply key for PAC Credentials decryptionr&   z]without -s/--salt, and with -u/--user, argument -d/--domain is required to calculate the saltz]without -s/--salt, and with -d/--domain, argument -u/--user is required to calculate the salt.z-Domain supplied in -d/--domain should be FQDN)argparseArgumentParseradd_argumentadd_argument_grouptitler  r   sysargv
print_helpexit
parse_argsr   r   r   r   )parserticket_decryptionr  r   r"   r"   r#   r    s<   


r  c               
   C   s|   t tj t } t| j| j zt|  W d S  t	y= } zt
 jt
jkr+t  t
t| W Y d }~d S d }~ww )N)printr   BANNERr  r   inittsr   r  ry  r   	getLoggerlevelDEBUG	traceback	print_excr   r   )r   r  r"   r"   r#   main  s   
r  __main__):r   r  r  r  r   r   typingr   Cryptodome.Hashr   enumr   binasciir   r   pyasn1.codec.derr   impacketr   impacket.dcerpc.v5.dtypesr	   r
   impacket.dcerpc.v5.rpcrtr   impacket.examplesr   impacket.krb5r   r   impacket.krb5.asn1r   r   r   impacket.krb5.ccacher   impacket.krb5.constantsr   impacket.krb5.cryptor   r   r   r   impacket.ldap.ldaptypesr   PSIDr   r%   r,   rQ   rj   rm   rt  r  r   r   r  r  r   r"   r"   r"   r#   <module>   s  	
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVd   +-

