o
    j!                     @   sr   d dl mZ d dlmZmZ d dlmZ d dlmZm	Z	 d dl
mZ d dl
mZ G dd dZG d	d
 d
eZdS )    )List)KerberosTicketKerberosTicketType)PackageDecryptor)PLIST_ENTRYPRTL_AVL_TABLE)WindowsMinBuild)hexdumpc                   @   s$   e Zd Zdd Zdd Zdd ZdS )KerberosCredentialc                 C   sL   d| _ d | _d | _d| _d | _d | _g | _d | _d | _d | _	d | _
d | _d S )Nkerberos    )credtypeusernamepasswordpassword_raw
domainnameluidticketspinpin_rawcardinfo
aes_key128
aes_key256)self r   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/alsadecryptor/packages/kerberos/decryptor.py__init__   s   
zKerberosCredential.__init__c                 C   s   d}|d| j  7 }|d| j 7 }| jd ur%|d| j 7 }|d| j  7 }| jd ur1|d| j 7 }| jd ur^|d7 }|d| jd	  7 }|d
| jd  7 }|d| jd  7 }|d| jd  7 }| jrj|d| j  7 }| jrv|d| j  7 }|S )Nz	== Kerberos ==
z		Username: %s
z		Domain: %s
z		Password: %s
z		password (hex)%s
z
		PIN: %s
z		CARDINFO: 
z			CardName: %s
CardNamez			ReaderName: %s

ReaderNamez			ContainerName: %s
ContainerNamez			CSPName: %s
CSPNamez		AES128 Key: %s
z		AES256 Key: %s
)	r   r   r   r   hexr   r   r   r   )r   tr   r   r   __str__   s&   


zKerberosCredential.__str__c                 C   s   i }| j |d< | j|d< | j|d< | j|d< | j|d< | j|d< | j|d< | j|d< | j|d	< g |d
< | j	D ]}|
 |d
< q6| jrI| j |d< | jrS| j |d< |S )Nr   r   r   r   r   r   r   r   r   r   aes128aes256)r   r   r   r   r   r   r   r   r   r   to_dictr   r!   r   )r   r"   ticketr   r   r   r&   7   s$   









zKerberosCredential.to_dictN)__name__
__module____qualname__r   r#   r&   r   r   r   r   r
      s    r
   c                       sF   e Zd Zd fdd	Zdd Zdd Zdd	 Zd
d Zdd Z  Z	S )KerberosDecryptorTc                    s4   t  d||| || _|| _g | _d | _d | _d S )NKerberos)superr   decryptor_templatewith_ticketscredentialscurrent_ticket_typecurrent_cred)r   readerr.   lsa_decryptorsysinfor/   	__class__r   r   r   M   s   
zKerberosDecryptor.__init__c                    sL   |  d| jjI d H }| j|| jj I d H }| j|I d H }||fS )Nzkerberos.dll)find_signaturer.   	signaturer3   get_ptr_with_offsetfirst_entry_offsetget_ptr)r   positionptr_entry_loc	ptr_entryr   r   r   find_first_entryV   s
   z"KerberosDecryptor.find_first_entryc              
      sR   zt || j| jj| jI d H }| jj| W d S  t	y( } z|d }~ww N)
r   aparser3   r.   r5   r1   r2   r   append	Exception)r   kerberos_ticketkter   r   r   handle_ticket\   s   zKerberosDecryptor.handle_ticketc           
   
      s  z|   I d H \}}W n ty& } z| d|  W Y d }~d S d }~ww | jjtjjk r1d S g }| j	|I d H  t| jI d H }|| jI d H }| |jj|I d H  |D ]*}| || jjjI d H  | j	|I d H  | jj| jI d H }	| |	I d H  q[d S )Nz"Failed to find structs! Reason: %s)r@   rD   logr5   buildnumberr   	WIN_VISTAvaluer3   mover   load	walk_listprocess_session_elistr   readwalk_avlBalancedRoot
RightChildlog_ptrr.   kerberos_session_structr(   process_session)
r   entry_ptr_valueentry_ptr_locrG   	entry_ptrresult_ptr_list	avl_table
start_nodeptrkerberos_logon_sessionr   r   r   startc   s*   zKerberosDecryptor.startc                    s   d S rA   )r3   rM   location	read_uintr.   rV   rN   rW   )r   elistr_   r   r   r   rP   }   s   z'KerberosDecryptor.process_session_elistc                    s  t  | _|j| j_|jj| jI d H | j_|jj	| jI d H | j_
|jjdkr|jj| j| jjdI d H }|| j| jjI d H  |jD ]S}|jjdkr|jjdkru|jj| j|jjI d H }|rt| j|dd\}}|rt|| j_qG|jjdkr|jj| j|jjI d H }|r| j|dd\}}|r|| j_qG|jjjdkr|jj| jI d H }| jjddu r| j|dd\| j_| j_| jjd ur| jj | j_n| |\| j_| j_|j jdkr|j j| j| jj!dI d H }|j"| jI d H }	| |	\| j_#}
|j$dkr|j%& | j_'| j(du r|j)j*jdkrL|j)j*j|j)j*j+krL|j)j*j|j)j*j+d krLt,j-| _.| j/|j)j*| j0| jj1d	I d H  |j2j*jdkr|j2j*j|j2j*j+kr|j2j*j|j2j*j+d krt,j3| _.| j/|j2j*| j0| jj1d	I d H  |j4j*jdkr|j4j*j|j4j*j+kr|j4j*j|j4j*j+d krt,j5| _.| j/|j4j*| j0| jj1d	I d H  d | _.| j6| j d S )
Nr   )override_finaltype   T)bytes_expected    $   )override_ptr)7r
   r2   LocallyUniqueIdentifierr   r0   UserNameread_stringr3   r   Domainer   pKeyListrL   rQ   r.   keys_list_structhash_password_struct
KeyEntriesgenericSize	Checksumpread_rawdecrypt_passwordr   r   PasswordLengthread_maxdataendswithr   r   r!   SmartcardInfoscsp_info_structPinCoder   CspDataLengthCspData	get_infosr   r/   	Tickets_1Flinkra   r   TGSr1   rO   rH   kerberos_ticket_struct	Tickets_2CLIENT	Tickets_3TGTrC   )r   r_   key_listkeykeydatadec_key_pwdatacsp_infopin_encraw_decr   r   r   rW      sp   

   z!KerberosDecryptor.process_session)T)
r(   r)   r*   r   r@   rH   r`   rP   rW   __classcell__r   r   r6   r   r+   L   s    		r+   N)typingr   pypykatz.commons.kerberosticketr   r   &pypykatz.alsadecryptor.package_commonsr   $pypykatz.alsadecryptor.win_datatypesr   r   pypykatz.commons.commonr   r	   r
   r+   r   r   r   r   <module>   s   ?