o
    j&                     @   sn   d dl Z d dlZd dlT d dlmZmZmZmZmZ d dl	T d dl
T d dlmZ d dlmZ G dd dZdS )    N)*)RC4DESAESexpand_DES_keyMODE_CBC)logger)hexdumpc                   @   st   e Zd ZdddZedddZdd Zd	d
 Zdd Zdd Z	dd Z
dd Zdd Zdd Zdd Zdd ZdS )SECURITYNc                 C   s:   || _ || _|| _d| _d| _d | _d | _g | _g | _d S )N (  T)	hivesystem_hivebootkeydcc_iteration_countlsa_secret_key_vista_typelsa_keyNKLM_key
dcc_hashescached_secrets)selfsecurity_hiver   r    r   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/registry/security/asecurity.py__init__   s   
zSECURITY.__init__  c                 C   s*   t | }t|D ]}|| q	| S N)hashlibsha256rangeupdatedigest)keyvalueroundsctx_r   r   r   sha256_multi(   s   
zSECURITY.sha256_multic                    s:  t d | jdu rdt|t| jjd d }d}t	|}d  fddt
dtjdd   D D ]}t| k rJ|d	 t|  7 }|||7 }q8t|jd
d  d d | _n,t| j}t
dD ]}||dd  qnt| }||dd dd | _t d| j   | jS )Nz [SECURITY] Decrypting LSA key...T           c                    &   g | ]}j d d ||   qS r'   Ndata.0inrecordr   r   
<listcomp>7      & z,SECURITY.decrypt_lsa_key.<locals>.<listcomp>r       4   r   <   L      z[SECURITY] LSA key value: %s)r   debugr   
LSA_SECRET
from_bytesr
   r&   r   r-   r   r   lendecryptLSA_SECRET_BLOBsecretr   r   md5r   r   r    hex)r   r-   r!   
secret_deccipherblockr$   r0   r   r1   r   decrypt_lsa_key/   s*   


.
zSECURITY.decrypt_lsa_keyc                    sl   t d | jddI d H }|d u r/| jddI d H }|s't d d S d| _t d | |d S )Nz[SECURITY] Fetching LSA key...zPolicy\PolEKList\defaultFz%Policy\PolSecretEncryptionKey\defaultz[SECURITY] LSA key not found!z,[SECURITY] LSA secrets default to VISTA type   )r   r;   r   	get_valuer   rG   )r   r"   r   r   r   get_lsa_keyK   s   


zSECURITY.get_lsa_keyc                 C   s   d}t j|d d ddd}|t|| d  }|}tdt|dD ]5}|d d }t|d d }t|}	||	|7 }|dd  }|dd  }t|dk rW|t|d  }q"t|}
|
jS )	Nr(      littleF)signedr         )	intr=   r>   r   r   r   r?   LSA_SECRET_XPrA   )r   r!   r"   dec_blobenc_sizet_keyr%   enc_blobdes_keyr$   rA   r   r   r   decrypt_secretZ   s    
zSECURITY.decrypt_secretc                    s&  t d | jd u r|  I d H  | jdI d H }|d u r(t d td| jdu r|d| _	t
|d t| jjd d }t|}d	  fd
dtdtjdd   D D ]}t| k rp|dd	t|  7 }|  j	||7  _	q^n
| | j|d | _	t d| j	   | j	S )Nz [SECURITY] Fetching NK$LM key...z$Policy\Secrets\NL$KM\CurrVal\defaultz+[SECURITY] Could not find NL$KM in registryz#Could not find NL$KM in registry :(Tr(   rH   r'   r)   c                    r*   r+   r,   r.   r1   r   r   r4   |   r5   z)SECURITY.get_NKLM_key.<locals>.<listcomp>r   r6   z[SECURITY] NL$KM key: %s)r   r;   r   rJ   r   rI   error	Exceptionr   r   r<   r=   r
   r&   r-   r   r   r>   r?   rW   rC   )r   r"   r!   rE   rF   r   r1   r   get_NKLM_keyl   s,   



.zSECURITY.get_NKLM_keyc                 C   s   |d@ dkr||d@  S |S )N   r   r   )r   r-   r   r   r   __pad   s   zSECURITY.__padc              	      s  t d | jddI d H }|d u rt d d S | j|I d H }|g kr/t d d S d|v r8|d d|v rbt d |d | jdI d H d	 d
kr]d@ | _nd | _| jd u rn| 	 I d H  | j
d u rz|  I d H  |D ]}t d|  | jd|  I d H }|d	 }t|jdkrSjd	@ d	kr| jdu rd}t| j
dd tjd}d  fddtdtj D D ]}t|dk r|ddt|  7 }|||7 }qnt| j
j }t|}|j}nt d|  q||d d }	t|dd  }
|
jd}|
 | !j| !j"  |
j#d}| jdu r?dnd	}t$||||	| jj%d}| j&'| q|| j&S )Nz[SECURITY] dump_dcc invokedCacheFz[SECURITY] No DCC secrets found
   NL$Controls   NL$IterationCountz&[SECURITY] DCC Setting iteration countzCache\NL$IterationCountrH   r   l    | i   z![SECURITY] DCC Checking value: %szCache\%ss                   Tr(   r)   r'   )IVc                    s   g | ]}j ||   qS r   )EncryptedDatar.   r1   r   r   r4      s    z%SECURITY.dump_dcc.<locals>.<listcomp>r   r6   z0[SECURITY] DCC Skipping value %s, unknown formetH   z	utf-16-le   )	iterationlast_write_ts)(r   r;   r   find_keylist_valuesremoverI   r   r   rJ   r   rZ   decode	NL_RECORDr=   r_   Flagsr   r   r   r   r>   r`   r?   hmacnewr    r   ioBytesIOread
UserLengthseek_SECURITY__padDomainNameLengthDnsDomainNameLengthLSADCCSecret	LastWriter   append)r   	cache_regvaluesr"   record_data	plaintextrE   rF   r!   dcc_hashblobusernamedomainversionrA   r   r1   r   dump_dcc   sn   










&zSECURITY.dump_dccc                    s  t d | jd u r|  I d H  |  I d H  | jdI d H }|d u r-t d d S d|v r6|d |D ]}dD ]}d||}t d|  z| j	|dI d H }W n t
yp } zt d	|  W Y d }~q<d }~ww |r|d
 dkrt d
d||d
 f  | jdu rt|d
 t| jjd d }d}t|}	d  fddtdtjdd   D D ]}
t|
 k r|
d t|
  7 }
||	|
7 }qt|j}n	| | j|d
 }t|||dk| jI d H }|d ur| j| q<t d	|  q<q8d S )Nz[SECURITY] get_secretszPolicy\Secretsz*[SECURITY] No cached secrets found in hiver^   )CurrValOldValzPolicy\Secrets\{}\{}\defaultz [SECURITY] Parsing secrets in %sFz'[SECURITY] Could not open %s, skipping!rH   r   z[SECURITY] Key %s Value %sTr'   r(   r)   c                    r*   r+   r,   r.   r1   r   r   r4      r5   z(SECURITY.get_secrets.<locals>.<listcomp>r6   r   )r   r;   r   rJ   r   r   enum_keyrg   formatrI   rY   logr   r<   r=   r
   r&   r-   r   r   r>   r?   r@   rA   rW   	LSASecretprocessr   r   rw   )r   keyskey_namevlkey_pathver!   rD   rE   rF   rR   rA   r   r1   r   get_secrets   sX   




.
zSECURITY.get_secretsc                 C   s&   | j D ]}t|tr||_||_qd S r   )r   
isinstanceLSASecretDefaultPasswordr~   r   )r   r~   r   rA   r   r   r   set_default_user
  s   

zSECURITY.set_default_userc                 C   s   i }| j |d< | jrdnd|d< | j|d< d |d< | jd ur#| j|d< g |d< | jD ]}|d |  q*g |d< | jD ]}|d |  q=|S )	Nr   VISTAOLDsecrets_formatr   zNK$LMdccr   )r   r   r   r   r   rw   to_dictr   r   trA   r   r   r   r     s   





zSECURITY.to_dictc                 C   s   d}|d| j  7 }|| jrdd nd7 }|d| j  7 }| jd ur+|d| j  7 }| jD ]
}|d|  7 }q.| jD ]
}|dt| 7 }q<|S )	Nz5============== SECURITY hive secrets ==============
zIteration count: %s
zSecrets structure format : %s
r   r   zLSA Key: %s
zNK$LM Key: %s
z%s
)	r   r   r   rC   r   r   to_lopthr   strr   r   r   r   __str__!  s   


zSECURITY.__str__r   )r   )__name__
__module____qualname__r   staticmethodr&   rG   rJ   rW   rZ   rr   r   r   r   r   r   r   r   r   r   r
      s    
I4r
   )r   rk    pypykatz.registry.sam.structuresunicrypto.symmetricr   r   r   r   r   %pypykatz.registry.security.structures"pypykatz.registry.security.acommonpypykatz.registryr   pypykatz.commons.commonr	   r
   r   r   r   r   <module>   s   	