o
    j                     @   sV   d dl Z d dlZd dlmZ d dlmZ d dlmZ G dd dZG dd deZ	dS )	    N)PackageDecryptor)LSA_UNICODE_STRING)hexdumpc                   @   s,   e Zd Zdd Zdd Zdd Zdd Zd	S )
WdigestCredentialc                 C   s(   d| _ d | _d | _d | _d| _d | _d S )Nwdigest    credtypeusername
domainnamepasswordpassword_rawluidself r   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/lsadecryptor/packages/wdigest/decryptor.py__init__   s   
zWdigestCredential.__init__c                 C   sD   i }| j |d< | j|d< | j|d< | j|d< | j|d< | j|d< |S )Nr	   r
   r   r   r   r   r   r   tr   r   r   to_dict   s   





zWdigestCredential.to_dictc                 C   s   t |  S )N)jsondumpsr   r   r   r   r   to_json   s   zWdigestCredential.to_jsonc                 C   sJ   d| j  }|d| j 7 }|d| j 7 }|d| j 7 }|d| j  7 }|S )Nz	== WDIGEST [%x]==
z		username %s
z		domainname %s
z		password %s
z		password (hex)%s
)r   r
   r   r   r   hexr   r   r   r   __str__"   s   
zWdigestCredential.__str__N)__name__
__module____qualname__r   r   r   r   r   r   r   r   r      s
    	r   c                       s4   e Zd Z fddZdd Zdd Zdd Z  ZS )	WdigestDecryptorc                    s"   t  d||| || _g | _d S )NWdigest)superr   decryptor_templatecredentials)r   readerr"   lsa_decryptorsysinfo	__class__r   r   r   +   s   
zWdigestDecryptor.__init__c                 C   s   |  d| jj   | d| jj}|  dt|  |  dt|| jj   | j|| jj }|  dt|  | j|}|  dt|  ||fS )Nz Scanning for Wdigest structs! %szwdigest.dllzSignature @ %szSignature (corrected) @ %szFirst entry ptr @ %szFirst entry -> %s)	logr"   	signaturer   find_signaturefirst_entry_offsetr$   get_ptr_with_offsetget_ptr)r   positionptr_entry_loc	ptr_entryr   r   r   find_first_entry0   s   z!WdigestDecryptor.find_first_entryc                 C   s   t  }|j|_| j|jj| jj  t| j}t| j}t| j}|	| j|_
|	| j|_|| j|_|j
ddu rW| j|jdd\|_|_|jdurV|j |_n
| |j\|_|_|j
dkrr|jdkrr|jdu rrdS | j| dS )z
		Changed the wdigest parsing, the struct only contains the pointers in the linked list, the actual data is read by 
		adding an offset to the current entry's position
		$T)bytes_expectedN )r   r   r$   move
this_entryvaluer"   primary_offsetr   read_stringr
   r   read_maxdataencrypted_passwordendswithdecrypt_passwordr   r   r   r#   append)r   wdigest_entrywcUserName
DomainNamePasswordr   r   r   	add_entry;   s$   



zWdigestDecryptor.add_entryc              
   C   sr   z|   \}}W n ty" } z| d|  W Y d }~d S d }~ww | j| | j| j}| || j d S )Nz*Failed to find Wdigest structs! Reason: %s)	r2   	Exceptionr)   r$   r6   r"   
list_entry	walk_listrE   )r   entry_ptr_valueentry_ptr_loce	entry_ptrr   r   r   startY   s   zWdigestDecryptor.start)r   r   r   r   r2   rE   rM   __classcell__r   r   r'   r   r   *   s
    r   )
ior   %pypykatz.lsadecryptor.package_commonsr   pypykatz.commons.win_datatypesr   pypykatz.commons.commonr   r   r   r   r   r   r   <module>   s   