o
    jD                     @   s  d dl mZ d dl mZ d dlZd dlmZ d dlmZmZ d dlm	Z	m
Z
 d dlmZ d dlmZ d d	lmZmZmZmZ d d
lmZmZ d dlmZ d dlmZ d dlmZ d dlmZ d dlmZ d dl m!Z!m"Z" d dl#m$Z$ d dl%m&Z& d dl'm(Z( d Z)dZ*dZ+dZ,dZ-dZ.dZ/d Z0dZ1dZ2dZ3dZ4dZ5dZ6d Z7d Z8d Z9d!Z:d"Z;d#Z<d Z=d Z>d!Z?d"Z@d ZAd"ZBd#ZCd$ZDd%ZEd&ZFd'ZGd(ZHd)ZId*ZJd+ZKd,ZLd-ZMd.ZNd/ZOd0ZPd%ZQd&ZRd'ZSd(ZTd/ZUd!ZVd ZWd!ZXd ZYd!ZZd"Z[d#Z\d$Z]d Z^d!Z_d"Z`d#Zad#Zbd$Zcd%Zdd&Zed'Zfd(Zgd/Zhd0Zid)Zjd*Zkd+Zld Zmd!Znd"Zod#Zpd$Zqd%Zrd&Zsd Ztd1d2 ZuG d3d4 d4e&ZvG d5d6 d6e&ZwG d7d8 d8e&ZxG d9d: d:e&ZyG d;d< d<e&Zzewj{j|d=eddd>fewj}j|d=eddd>fewj~j|d?eejd'fewjj|d-eddd@fewjj|dAeejd-fiZG dBdC dCe!ZG dDdE dEe!ZG dFdG dGe!ZG dHdI dIe!ZG dJdK dKZG dLdM dMe!ZG dNdO dOe!ZG dPdQ dQe!ZG dRdS dSe!ZG dTdU dUe!ZG dVdW dWe!ZG dXdY dYe!ZG dZd[ d[e!ZG d\d] d]e!ZG d^d_ d_e!ZG d`da dae!ZG dbdc dce!ZG ddde dee!ZG dfdg dge!ZG dhdi die!ZG djdk dke!ZeeedlZG dmdn dne!ZG dodp dpe!ZdqZG drds dse!ZG dtdu due!ZG dvdw dwe!ZG dxdy dye!ZG dzd{ d{e!ZG d|d} d}e!ZG d~d de!ZG dd de!ZG dd de!Zdd Zdd Zdd ZdS )    )division)print_functionN)unpack)datetimetimezone)	unhexlifyhexlify)pack)pbkdf2_hmac)HMACSHA512SHA1MD4)AESDES3)unpad)RSA)bytes_to_long)PY3)getUnixTime)	Structurehexdump)bin_to_string)Enum)RPC_SIDi    i @  i `  i   i   i   i   i   i   i   i 
  i                           	                     
      c                    s   d  fdd| j D S )N|c                    s   g | ]\}}|j  @ r|qS  )value).0namememberflagsr-   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/impacket/dpapi.py
<listcomp>   s    zgetFlags.<locals>.<listcomp>)join__members__items)myenumr3   r-   r2   r4   getFlags   s   r:   c                   @   s(   e Zd ZdZdZdZdZdZdZdZ	dS )	FLAGSr   r   r"   r(   @      i    N)
__name__
__module____qualname__CRYPTPROTECT_UI_FORBIDDENCRYPTPROTECT_LOCAL_MACHINECRYPTPROTECT_CRED_SYNCCRYPTPROTECT_AUDITCRYPTPROTECT_VERIFY_PROTECTIONCRYPTPROTECT_CRED_REGENERATECRYPTPROTECT_SYSTEMr-   r-   r-   r4   r;      s    r;   c                   @   s(  e Zd ZeeB eB ZeeB eB ZeeB e	B Z
eeB eB ZeeB eB ZeeB eB ZeeB eB ZeeB eB ZeeB eB ZeeB eB ZeeB eB ZeeB e B Z!eeB e"B Z#eeB e$B Z%ee&B e'B Z(ee&B e)B Z*ee+B e,B Z-ee+B e.B Z/ee+B e0B Z1ee+B e2B Z3eeB e	B Z4eeB e5B Z6eeB e7B Z8eeB e9B Z:e;e<B e=B Z>e;e<B e?B Z@e;e<B eAB ZBe;e<B eCB ZDe;e<B eEB ZFe;e<B eGB ZHe;e<B eIB ZJeeB eKB ZLeeB eMB ZNeeB eOB ZPeeB eQB ZReeB eSB ZTeeB eUB ZVeeB eWB ZXeeB eYB ZZeeB e[B Z\eeB e]B Z^eeB e_B Z`ee+B eaB ZbeeB ecB ZdeeB eeB ZfdS )
ALGORITHMSN)gr>   r?   r@   ALG_CLASS_HASHALG_TYPE_ANYALG_SID_MD2CALG_MD2ALG_SID_MD4CALG_MD4ALG_SID_MD5CALG_MD5ALG_SID_SHACALG_SHAALG_SID_SHA1	CALG_SHA1ALG_CLASS_SIGNATUREALG_TYPE_RSAALG_SID_RSA_ANYCALG_RSA_SIGNALG_TYPE_DSSALG_SID_DSS_ANYCALG_DSS_SIGNALG_SID_ANYCALG_NO_SIGNALG_CLASS_KEY_EXCHANGECALG_RSA_KEYXALG_CLASS_DATA_ENCRYPTALG_TYPE_BLOCKALG_SID_DESCALG_DESALG_SID_3DES_112CALG_3DES_112ALG_SID_3DES	CALG_3DESALG_SID_DESX	CALG_DESXALG_SID_RC2CALG_RC2ALG_TYPE_STREAMALG_SID_RC4CALG_RC4ALG_SID_SEAL	CALG_SEALALG_TYPE_DHALG_SID_DH_SANDF
CALG_DH_SFALG_SID_DH_EPHEMCALG_DH_EPHEMALG_SID_AGREED_KEY_ANYCALG_AGREEDKEY_ANYALG_SID_KEACALG_KEA_KEYXCALG_HUGHES_MD5ALG_SID_SKIPJACKCALG_SKIPJACKALG_SID_TEKCALG_TEKALG_SID_SSL3SHAMD5CALG_SSL3_SHAMD5ALG_CLASS_MSG_ENCRYPTALG_TYPE_SECURECHANNELALG_SID_SSL3_MASTERCALG_SSL3_MASTERALG_SID_SCHANNEL_MASTER_HASHCALG_SCHANNEL_MASTER_HASHALG_SID_SCHANNEL_MAC_KEYCALG_SCHANNEL_MAC_KEYALG_SID_SCHANNEL_ENC_KEYCALG_SCHANNEL_ENC_KEYALG_SID_PCT1_MASTERCALG_PCT1_MASTERALG_SID_SSL2_MASTERCALG_SSL2_MASTERALG_SID_TLS1_MASTERCALG_TLS1_MASTERALG_SID_RC5CALG_RC5ALG_SID_HMAC	CALG_HMACALG_SID_TLS1PRFCALG_TLS1PRFALG_SID_HASH_REPLACE_OWFCALG_HASH_REPLACE_OWFALG_SID_AES_128CALG_AES_128ALG_SID_AES_192CALG_AES_192ALG_SID_AES_256CALG_AES_256ALG_SID_AESCALG_AESALG_SID_SHA_256CALG_SHA_256ALG_SID_SHA_384CALG_SHA_384ALG_SID_SHA_512CALG_SHA_512ALG_SID_ECDH	CALG_ECDHALG_SID_ECMQV
CALG_ECMQVALG_SID_ECDSA
CALG_ECDSAr-   r-   r-   r4   rH      s\    rH   c                   @   ,   e Zd ZdZdZdZdZdZdZdZ	dZ
d	S )
CREDENTIAL_FLAGSr   r   r   r"   r(       r<   r=   N)r>   r?   r@   CRED_FLAGS_PASSWORD_FOR_CERTCRED_FLAGS_PROMPT_NOWCRED_FLAGS_USERNAME_TARGETCRED_FLAGS_OWF_CRED_BLOBCRED_FLAGS_REQUIRE_CONFIRMATIONCRED_FLAGS_WILDCARD_MATCHCRED_FLAGS_VSM_PROTECTEDCRED_FLAGS_NGC_CERTr-   r-   r-   r4   r          r   c                   @   r   )
CREDENTIAL_TYPEr   r   r   r   r   r    r!   r"   N)r>   r?   r@   CRED_TYPE_GENERICCRED_TYPE_DOMAIN_PASSWORDCRED_TYPE_DOMAIN_CERTIFICATE!CRED_TYPE_DOMAIN_VISIBLE_PASSWORDCRED_TYPE_GENERIC_CERTIFICATECRED_TYPE_DOMAIN_EXTENDEDCRED_TYPE_MAXIMUMCRED_TYPE_MAXIMUM_EXr-   r-   r-   r4   r      r   r   c                   @   s   e Zd ZdZdZdZdZdS )CREDENTIAL_PERSISTr   r   r   r   N)r>   r?   r@   CRED_PERSIST_NONECRED_PERSIST_SESSIONCRED_PERSIST_LOCAL_MACHINECRED_PERSIST_ENTERPRISEr-   r-   r-   r4   r      s
    r      r<      r=   r   c                   @      e Zd ZdZdd ZdS )MasterKeyFile)Version<L=0)unk1r   )unk2r   )Guidz72s=b'')Unkownr   )Policyr   Flagsr   )MasterKeyLen<Q=0)BackupKeyLenr   )CredHistLenr   )DomainKeyLenr   c                 C   s   t d t d| d | d f  t d| d d  t d| d | d f  t d	| d
 | d
 f  t d| d | d f  t d| d | d f  t d| d | d f  t d| d | d f  t   d S )Nz[MASTERKEYFILE]Version     : %8x (%d)r   zGuid        : %sr   utf-16lezFlags       : %8x (%d)r   zPolicy      : %8x (%d)r   zMasterKeyLen: %.8x (%d)r   zBackupKeyLen: %.8x (%d)r   zCredHistLen : %.8x (%d)r   zDomainKeyLen: %.8x (%d)r   )printdecodeselfr-   r-   r4   dump   s   
zMasterKeyFile.dumpNr>   r?   r@   	structurer   r-   r-   r-   r4   r      s    r   c                   @   s2   e Zd ZdZdddZdd Zdd	 Zd
d ZdS )	MasterKey)r   )Saltz16s=b"")MasterKeyIterationCountr   HashAlgor   	CryptAlgor   data:Nr   c                 C   s   t | || d | _d S N)r   __init__decryptedKeyr   r   	alignmentr-   r-   r4   r     s   
zMasterKey.__init__c                 C   s   t d t d| d | d f  t dt| d   t d| d | d f  t d| d	 | d	 t| d	 jf  t d
| d | d t| d jf  t dt| d   t   d S )Nz[MASTERKEY]r   r   zSalt        : %sr   zRounds      : %8x (%d)r   zHashAlgo    : %.8x (%d) (%s)r   zCryptAlgo   : %.8x (%d) (%s)r   zdata        : %sr   )r   r   rH   r0   r   r-   r-   r4   r     s   $$
zMasterKey.dumpc                 C      d}d}t ||k rZ|td| }|d7 }t|||}	t|d D ]-}
t|||	}trCt|	tjt|tjA 	t |tj}	q"tdd t
|	|D }	q"||	7 }t ||k s
|d | S )N    r   !Lc                 S      g | ]
\}}t ||A qS r-   chrr/   abr-   r-   r4   r5   )      z'MasterKey.deriveKey.<locals>.<listcomp>lenr	   	bytearrayranger   int
from_bytessys	byteorderto_byteszipr   
passphrasesaltkeylencounthashFunctionkeyMaterialiUderivedractualr-   r-   r4   	deriveKey     ,zMasterKey.deriveKeyc                    sj  | d t jjkrt nt| d  d   fdd}| j|| d t| d  d t| d  d  | d	 |d
}|d t| d  d  }|t| d  d d  d t| d  d  }t| d  d j|t| d  d |d}|| d }|dd  }|d d }	|dd  d t| d  d  }
t||	 	 }t|| 	 }|d t| d  d  |
kr|| _
|S d S )Nr   r   c                       t | |  S r   r   newdigestps
hashModuler-   r4   <lambda>4      z#MasterKey.decrypt.<locals>.<lambda>r   r   r   r   r   r
  r  r   modeivr   ir(   )rH   r   r.   r   ALGORITHMS_DATAr  r  decryptr   r  r   )r   keyprfderivedBlobcryptKeyr"  cipher	cleartextr   hmacSalthmachmacKeyhmacCalculatedr-   r  r4   r$  .  s*   ,( zMasterKey.decryptNr   )r>   r?   r@   r   r   r   r  r$  r-   r-   r-   r4   r     s    
	
r   c                   @   r   )CredHist)r   )r   z16s=b''c                 C   s>   t d t d| d | d f  t dt| d   t   d S )Nz
[CREDHIST]Version       : %8x (%d)r   Guid          : %sr   )r   r   r   r-   r-   r4   r   R  s   
zCredHist.dumpNr   r-   r-   r-   r4   r0  M  s    r0  c                   @   s:   e Zd ZdZdddZdd Zdd	 Zd
d Zdd ZdS )CREDHIST_ENTRY)r   r   )Roundsr   SidLenr   _Sidz_-Sidzself["SidLen"]r   )
shaHashLenr   )	ntHashLenr   )r   16s=bSidr   )_dataz_-datazW(self["shaHashLen"]+self["ntHashLen"]) + (-(self["shaHashLen"]+self["ntHashLen"])) % 16r   )Version2r   r   r;  Nr   c                 C   s4   t | || td| d   | _d | _d | _d S )N      r=  )r   r   r   formatCanonicalsidpwdhashnthashr   r-   r-   r4   r   j  s   
zCREDHIST_ENTRY.__init__c                 C   r   )Nr   r   r   c                 S   r   r-   r   r   r-   r-   r4   r5   |  r   z,CREDHIST_ENTRY.deriveKey.<locals>.<listcomp>r   r  r-   r-   r4   r  p  r  zCREDHIST_ENTRY.deriveKeyc           	         sX  | d t jjkrt nt| d  d   fdd}| j|| d t| d  d t| d  d  | d	 |d
}|d t| d  d  }|t| d  d d  d t| d  d  }t| d  d j|t| d  d |d}|| d }d}|d | d  | _|| d | d |  | _	|| d | d  t
| d | d  | d krd | _d | _	d S d S )Nr   r   c                    r  r   r  r  r  r-   r4   r    r  z(CREDHIST_ENTRY.decrypt.<locals>.<lambda>r   r   r   r   r4  r  r   r   r   r(   r9      )rH   r   r.   r   r#  r  r  r$  rD  rE  r   )	r   r%  r&  r'  r(  r"  r)  r*  
ntHashSizer-   r  r4   r$    s    8,(0
zCREDHIST_ENTRY.decryptc                 C   s^  t d t d| d | d f  t d| d | d t| d jf  t d| d   t d| d	 | d	 t| d	 jf  t d
| d | d f  t d| d | d f  t dt| d    t d| j  t d| d | d f  t dt| d   | jd ur| jd urt dt| j   t dt| j   nt dt| d    t   d S )N[CREDHIST ENTRY]zVersion    : 0x%.8x (%d)r   zHashAlgo   : 0x%.8x (%d) (%s)r   zRounds     : %dr4  zCryptAlgo  : 0x%.8x (%d) (%s)r   zshaHashLen : 0x%.8x (%d)r9  zntHashLen  : 0x%.8x (%d)r:  zSalt       : %sr   zSID        : %szVersion2   : 0x%.8x (%d)r?  Guid       : %sr   pwdHash    : %sntHash     : %sData       : %sr   )	r   rH   r0   r   r   rC  r   rD  rE  r   r-   r-   r4   r     s    $$
zCREDHIST_ENTRY.dumpc                 C   s   t d t dt| d   | jd ur/| jd ur/t dt| j   t dt| j   nt dt| d    t   d S )NrH  rI  r   rJ  rK  rL  r   )r   r   rD  rE  r   r   r   r-   r-   r4   	summarize  s   
zCREDHIST_ENTRY.summarizer/  )	r>   r?   r@   r   r   r  r$  r   rM  r-   r-   r-   r4   r3  X  s    
r3  c                   @   s<   e Zd Zdd Zdd Zdd Zdd Zd	d
 Zdd ZdS )CREDHIST_FILEc                 C   s   i | _ g | _td|d d d | _td|dd d | _d}td|| d d  d }|d7 }|dkrst||| d  |  d}||d 7 }|| j t|d < | j| td|| d |  d }|d7 }|dks6d S d S )N<Lr   r   16sr   )r   r   )credhist_entriescredhist_entries_listr   versioncurrent_guidr3  r   append)r   rawr  next_lench_entryr-   r-   r4   r     s   zCREDHIST_FILE.__init__c                 C      | j | | d S r   )rR  r$  )r   entry_indexr%  r-   r-   r4   decrypt_entry_by_index     z$CREDHIST_FILE.decrypt_entry_by_indexc                 C   rY  r   )rQ  r$  )r   guidr%  r-   r-   r4   decrypt_entry_by_guid  r\  z#CREDHIST_FILE.decrypt_entry_by_guidc                 C   sj   |g}t | jD ]*\}}|D ]}|| |jd ur nq|jd u r+td|   d S t|j|j}qd S )NzError decrypting entry #%d)	enumeraterR  r$  rD  r   deriveKeysFromUserkeyrC  )r   r%  keysr  ekr-   r-   r4   r$    s   


zCREDHIST_FILE.decryptc                 C   `   t d t d| j| jf  t dt| j  t   t| jD ]\}}t d|  |  qd S Nz[CREDHIST FILE]zVersion        : 0x%.8x (%d)zCurrent Guid   : %sz[Entry #%d])r   rS  r   rT  r_  rR  r   r   r  rb  r-   r-   r4   r        
zCREDHIST_FILE.dumpc                 C   rd  re  )r   rS  r   rT  r_  rR  rM  rf  r-   r-   r4   rM    rg  zCREDHIST_FILE.summarizeN)	r>   r?   r@   r   r[  r^  r$  r   rM  r-   r-   r-   r4   rN    s    	rN  c                   @   r   )	DomainKey)r   )	SecretLenr   )AccessCheckLenr   r@  )_SecretDataz_-SecretDatazself["SecretLen"])
SecretDatar   )_AccessCheckz_-AccessCheckzself["AccessCheckLen"])AccessCheckr   c                 C   s   t d t d| d | d f  t dt| d   t d| d | d f  t d| d	 | d	 f  t d
t| d   t dt| d   t   d S )Nz[DOMAINKEY]r1  r   r2  r   zSecretLen     : %8x (%d)ri  zAccessCheckLen: %.8x (%d)rj  zSecretData    : %srl  zAccessCheck   : %srn  )r   r   r   r   r-   r-   r4   r     s   
zDomainKey.dumpNr   r-   r-   r-   r4   rh    s    
rh  c                   @   r   )DPAPI_SYSTEM)r   )
MachineKey20s=b"")UserKeyrq  c                 C   s^   t d t d| d | d f  t dt| d d  t dt| d d  t   d S )	Nz[DPAPI_SYSTEM]zVersion    : %8x (%d)r   zMachineKey : 0x%srp  latin-1zUserKey    : 0x%srr  )r   r   r   r   r-   r-   r4   r     s
   
zDPAPI_SYSTEM.dumpNr   r-   r-   r-   r4   ro    s    ro  c                   @      e Zd ZdZdS )CredentialFile)r   Sizer   Unknownr   )_Data_-Dataself["Size"]Datar   Nr>   r?   r@   r   r-   r-   r-   r4   ru        ru  c                   @   s*   e Zd ZdZdd Zdd Zd	ddZdS )

DPAPI_BLOB)r   )GuidCredentialr;  )MasterKeyVersionr   )GuidMasterKeyr;  r   DescriptionLenr   _Description_-Descriptionzself["DescriptionLen"]Descriptionr   r   )CryptAlgoLenr   )SaltLenr   )_Saltz_-Saltzself["SaltLen"])r   r   )
HMacKeyLenr   )_HMacKeyz	_-HMacKeyzself["HMacKeyLen"])HMacKeyr   r   )HashAlgoLenr   )HMacr   )_HMacz_-HMaczself["HMac"])r  r   )DataLenr   )rz  r{  zself["DataLen"]r}  )SignLenr   )_Signz_-Signzself["SignLen"])Signr   c                 C   sJ  t d t d| d | d f  t dt| d   t d| d | d f  t dt| d	   t d
| d tt| d f  t d| d d  t d| d | d t| d jf  t dt| d   t dt| d   t d| d | d t| d jf  t dt| d   t dt| d   t dt| d   t   d S )Nz[BLOB]zVersion          : %8x (%d)r   zGuid Credential  : %sr  zMasterKeyVersion : %8x (%d)r  zGuid MasterKey   : %sr  zFlags            : %8x (%s)r   zDescription      : %sr  r   z!CryptAlgo        : %.8x (%d) (%s)r   zSalt             : %sr   zHMacKey          : %sr  z!HashAlgo         : %.8x (%d) (%s)r   zHMac             : %sr  zData             : %sr~  zSign             : %sr  )r   r   r:   r;   r   rH   r0   r   r   r-   r-   r4   r   M  s   $$
zDPAPI_BLOB.dumpc                 C   s  dd }t |t| d  d kr tj|t| d  d d }n|}t |t| d  d k r|d	t| d  d  7 }td
d t|D d t| d  d  }tdd t|D d t| d  d  }t| d  d | t| d  d |  }||}|S )Nc                 S   s   ddl m}m} d}tt| D ]A}t|| |dd  dd}|d d dd dkr@||tt	|d d d d7 }q||tt	|d d d d7 }q|S )	Nr   )
indexbytesr   r   r   r"   0r!   1)
sixr  r   r   r   binrjustr
  r   r   )deskeyr  r   tempr  tr-   r-   r4   	fixparity`  s   $$z'DPAPI_BLOB.deriveKey.<locals>.fixparityr   r   r   )	digestmodr   r   rF  c                 S      g | ]}|d A qS 6   r-   r/   r  r-   r-   r4   r5   t      z(DPAPI_BLOB.deriveKey.<locals>.<listcomp>c                 S   r  \   r-   r  r-   r-   r4   r5   u  r  )r   r#  r   r  r  r   )r   
sessionKeyr  
derivedKeyipadopadr-   r-   r4   r  _  s    **zDPAPI_BLOB.deriveKeyNc                 C   s  t | }t|| d t| d  d }|d ur|| | }| |}t| d  d j|d t| d  d  t| d  d dt| d  d  d	}t|| d
 t| d  d j	}| j
dt| t| d  d  }|dt| d  d j	  }	tdd t|	D d t| d  d j	 }
tdd t|	D d t| d  d j	 }t| d  d |
}|| d  t| d  d |}||  |d ur|| || t|| d t| d  d }|d ur|| || | | d ks
| | d kr|S d S )Nr   r   r   r   r   r   rF  r   r   r~  r   r  r   c                 S   r  r  r-   r  r-   r-   r4   r5     r  z&DPAPI_BLOB.decrypt.<locals>.<listcomp>c                 S   r  r  r-   r  r-   r-   r4   r5     r  r  )r   r  r  r   r#  updater  r   r$  
block_sizerawDatar   r   )r   r%  entropykeyHashr  r  r)  r*  toSignkeyHash2r  r  r   hmacCalculated1hmacCalculated3r-   r-   r4   r$  |  s8   

& "",,



$zDPAPI_BLOB.decryptr   )r>   r?   r@   r   r   r  r$  r-   r-   r-   r4   r  %  s
    'r  c                   @   s.   e Zd ZdZdZdZdZdddZd	d
 ZdS )VAULT_ATTRIBUTE)Idr   Unknown1r   Unknown2r   )Unknown3r   ))Padz6s=b""))Unknown5r   )rv  )	IVPresentz<B=?&IVSizeIVSizer   )_IV_-IVz3self["IVSize"] if self["IVSize"] is not None else 0IVr   )rz  r{  zFself["Size"]-self["IVSize"]-5 if self["IVPresent"] else self["Size"]-1r}  Nr   c                 C   s   t |dkrA|dd  d d dkr|  j| j7  _td|d d d dkr/|  j| j7  _t |dd  d	krA|  j| j7  _t| || d S )
Nr   r(   r    s         rO  r   r   d   r#   )r   r   paddingr   id100extendedr   r   r   r-   r-   r4   r     s   zVAULT_ATTRIBUTE.__init__c                 C   sz   t d| d   t| jdkr;t d| d   | d dkr/t d| d	   t d
t| d   t dt| d   d S d S )Nz[ATTRIBUTE %d]r     zSize   : 0x%xrw  r  r   zIVSize : 0x%xr  zIV     : %sr  zData   : %sr~  )r   r   r  r   r   r-   r-   r4   r     s   zVAULT_ATTRIBUTE.dumpr/  )	r>   r?   r@   r   r  r  r  r   r   r-   r-   r-   r4   r    s    
	r  c                   @   r   )VAULT_ATTRIBUTE_MAP_ENTRY)r  )Offsetr   r  c                 C   s   t d| d | d f  d S )Nz[MAP ENTRY %d @ 0x%.8x]r  r  )r   r   r-   r-   r4   r     s   zVAULT_ATTRIBUTE_MAP_ENTRY.dumpNr   r-   r-   r-   r4   r    s    r  c                   @   "   e Zd ZdZdddZdd ZdS )	
VAULT_VCRD))
SchemaGuidr;  Unknown0r   LastWrittenr   r  r  )FriendlyNameLenr   )FriendlyNameLz_-FriendlyNamezself["FriendlyNameLen"])FriendlyNamer   )AttributesMapsSizer   )
AttributeLz_-AttributeMapszself["AttributesMapsSize"])AttributeMapsr   r}  Nr   c                 C   sV  t | || |d urt | _| d }t| d tt  D ]}t|}| j| |tt d  }qt | _tt| jD ]}|dkrY| j| j| d | j|d  d   q?| jt| j	| j| d   t | _
t| jD ]\}}t| j	|d d  d | j|  }| j
| qs| j	| jd d t| j
d   d  | d< d S d S )Nr  r  r   r  r   r~  )r   r   list
mapEntriesr   r   r  rU  attributesLenr  
attributesr_  r  getData)r   r   r   r  entry	attributer-   r-   r4   r     s(   ( $2zVAULT_VCRD.__init__c                 C   s   t d t dt| d   t dtjt| d tjd  t d| d d	  t   t| j	D ]\}}|
  | j| 
  q1t   t d
t| d   t   d S )Nz[VCRD]zSchemaGuid  : %sr  LastWritten : %sr  tzzFriendlyName: %sr  r   zRemaining   : %sr~  )r   r   r   fromtimestampr   r   utcr   r_  r  r   r  r   )r   r  r  r-   r-   r4   r     s    
zVAULT_VCRD.dumpr/  r>   r?   r@   r   r   r   r-   r-   r-   r4   r    s    
r  c                   @   s6   e Zd Zddddddddd	d
dddeffZdd ZdS )
VAULT_VPOLr   r@  r  r  r  )ry  z12s=b""rv  )Guid2r;  )Guid3r;  )KeySizer   )_Blob_-Blobzself["KeySize"]Blobr   c                 C   s   t d t d| d | d f  t dt| d   t d| d d  t d	| d
 | d
 f  t dt| d   t dt| d   t d| d | d f  | d   t   d S )Nz[VAULT_VPOL]zVersion      : %8x (%d)r   zGuid         : %sr   zDescription  : %sr  r   zSize         : 0x%.8x (%d)rw  zGuid2        : %sr  zGuid3        : %sr  zKeySize      : 0x%.8x (%d)r  r  )r   r   r   r   r   r-   r-   r4   r   (  s   
zVAULT_VPOL.dumpN)r>   r?   r@   r  r   r   r-   r-   r-   r4   r    s    r  c                   @   rt  )BCRYPT_KEY_DATA_BLOB_HEADER)dwMagicr   	dwVersionr   )	cbKeyDatar   )_bKeyz_-bKeyzself["cbKeyData"])bKeyr   Nr  r-   r-   r-   r4   r  5  r  r  c                   @   rt  )BCRYPT_KSSM_DATA_BLOB_HEADER))cbLengthr   )
dwKeyMagicr   )
dwUnknown2r   )
dwUnknown3r   )dwKeyBitLenr   )cbKeyLengthr   Nr  r-   r-   r-   r4   r  ?  r  r  c                   @   s.   e Zd ZddddddeffZdZdd
dZdS )BCRYPT_KEY_WRAPrv  r   r  )	_bKeyBlob
_-bKeyBlobr|  bKeyBlobr   )rv  r   r  )r  r  zself["Size"]-8)r  r   Nr   c                 C   sP   t |dkr|dd dks|dd dkr| j| _n| j| _t| || d S )Nr(   r   r      $   4)r   structureKDBMr   structureKSSMr   r   r   r-   r-   r4   r   _  s
    
zBCRYPT_KEY_WRAP.__init__r/  )r>   r?   r@   r  r  r  r   r-   r-   r-   r4   r  P  s    r  c                   @   s(   e Zd ZddefddeffZdd ZdS )VAULT_VPOL_KEYSKey1r   Key2c                 C   s   t d | d d dkr&t d t| d d  t d t| d d  d S t d	t| d d d
 d  t dt| d d d
 d  t   d S )Nz[VAULT_VPOL_KEYS]r
  rw  $   zKey1:r  zKey2:r  z
Key1: 0x%sr  rs  z
Key2: 0x%s)r   r   r   r   r   r-   r-   r4   r   l  s   ""
zVAULT_VPOL_KEYS.dumpN)r>   r?   r@   r  r   r   r-   r-   r-   r4   r	  g  s
    r	  c                   @       e Zd ZdZdd Zdd ZdS )VAULT_INTERNET_EXPLORER)r   Countr   rx  Id1r   )UsernameLenr   )	_Username
_-Usernamezself["UsernameLen"]Usernamer   Id2r   )ResourceLenr   )	_Resourcez
_-Resourcezself["ResourceLen"])Resourcer   Id3r   )PasswordLenr   )	_Passwordz
_-Passwordzself["PasswordLen"])Passwordr   c                 C   s   t | | d S r   )r   
fromString)r   r   r-   r-   r4   r"    s   z"VAULT_INTERNET_EXPLORER.fromStringc                 C   sR   t d t d| d d  t d| d d  t dt| d   t   d S )	Nz[Internet Explorer]zUsername        : %sr  r   zResource        : %sr  zPassword        : %sr!  )r   r   r   r   r-   r-   r4   r     s
   
zVAULT_INTERNET_EXPLORER.dumpNr>   r?   r@   r   r"  r   r-   r-   r-   r4   r  x  s    r  c                   @   r  )VAULT_WIN_BIO_KEY)r   r  rx  r  r5  r7  r<  r  NameLenr   _Namez_-Namezself["NameLen"]Namer   r  )	BioKeyLenr   )_BioKeyz_-BioKeyzself["BioKeyLen"])BioKeyr   c                 C   sB   t | | |d urtt| d dd d }|| d< d S d S )Nr-  r   r  )r   r"  r  r   r   )r   r   bioKeyr-   r-   r4   r"    s
   zVAULT_WIN_BIO_KEY.fromStringc                 C   sb   t d t dtd| d     t d| d d  t dt| d	 d
 d  t   d S )Nz[WINDOWS BIOMETRIC KEY]Sid          : %srA  r=  Friendly Name: %sr*  r   zBiometric Key: 0x%sr-  r  rs  )r   r   rB  r   r   r   r-   r-   r4   r     s
   
zVAULT_WIN_BIO_KEY.dumpNr#  r-   r-   r-   r4   r$    s    r$  c                   @   r   )NGC_LOCAL_ACCOOUNT)r   )UnlockKeySizer   r  )CipherTextSizer   )MustBeZeroTestr   )
_UnlockKeyz_-UnlockKeyzself["UnlockKeySize"])	UnlockKeyr   )r  r  zself["IVSize"]r  )_CipherTextz_-CipherTextzself["CipherTextSize"])
CipherTextr   c                 C   sH   t d t dt| d   t dt| d   t dt| d   d S )Nz[NGC LOCAL ACCOOUNT]zUnlockKey    : %sr6  zIV           : %sr  zCipherText   : %sr8  )r   r   r   r-   r-   r4   r     s   zNGC_LOCAL_ACCOOUNT.dumpNr   r-   r-   r-   r4   r1    s    r1  c                   @   s<   e Zd Zddddddddd	d
ddddddeffZdd ZdS )VAULT_NGC_ACCOOUNTr   r  rx  r  r5  r7  r<  r  r%  r'  r)  r  )BlobLenr   )r  r  zself["BlobLen"]r  r   c                 C   sP   t d t dtd| d     t d| d d  | d   t   d S )	Nz[NGC VAULT]r/  rA  r=  r0  r*  r   r  )r   r   rB  r   r   r   r-   r-   r4   r     s
   
zVAULT_NGC_ACCOOUNT.dumpN)r>   r?   r@   r1  r   r   r-   r-   r-   r4   r9    s$    r9  )z
WinBio Keyz)NGC Local Accoount Logon Vault CredentialzInternet Explorerc                   @   r   )CREDENTIAL_ATTRIBUTE)r   )KeyWordSizer   )_KeyWordz	_-KeyWordzself["KeyWordSize"])KeyWordr   )DataSizer   )rz  r{  zself["DataSize"]r}  c                 C   s.   t d| d d  t d t| d  d S )NzKeyWord : %sr>  r   z
Data    : r~  )r   r   r   r   r-   r-   r4   r     s   zCREDENTIAL_ATTRIBUTE.dumpNr   r-   r-   r-   r4   r;    s    r;  c                   @   r  )	CREDENTIAL_BLOB)r   rv  r  )Typer   )Flags2r   r  r  )Persistr   )	AttrCountr   )r  r   )
TargetSizer   )_Targetz_-Targetzself["TargetSize"])Targetr   )TargetAliasSizer   )_TargetAliastz_-TargetAliaszself["TargetAliasSize"])TargetAliasr   )DescriptionSizer   )r  r  zself["DescriptionSize"]r  )UnknownSizer   )_Unknownz	_-Unknownzself["UnknownSize"])ry  r   )UsernameSizer   )r  r  zself["UsernameSize"]r  )Unknown3Sizer   )	_Unknown3z
_-Unknown3zself["Unknown3Size"])r  r   )	Remainingr   Nr   c                 C   sj   t | || d| _|d ur1| d }t | _t| d D ]}t|}| j| |t|d  }qd S d S )Nr   rQ  rD  )r   r   r  r  r   r;  rU  r   )r   r   r   	remainingr  attrr-   r-   r4   r   *  s   zCREDENTIAL_BLOB.__init__c                 C   s<  t d t dtjt| d tjd  t d| d tt| d f  t d| d t| d j	f  t d	| d
 t
| d
 j	f  t d| d d  t d| d d  t d| d d  t d| d d  zt d| d d  W n ty   t d| d d  Y nw t   | jD ]}|  qd S )Nz[CREDENTIAL]r  r  r  zFlags       : 0x%.8x (%s)r   zPersist     : 0x%.8x (%s)rC  zType        : 0x%.8x (%s)rA  zTarget      : %srG  r   zDescription : %sr  zUnknown     : %sry  zUsername    : %sr  r  rs  )r   r   r  r   r   r  r:   r   r   r0   r   r   UnicodeDecodeErrorr  r   )r   r  r-   r-   r4   r   6  s$    

zCREDENTIAL_BLOB.dumpr/  r  r-   r-   r-   r4   r@    s    
&r@  r   c                   @   rt  )P_BACKUP_KEY)r   r}  Nr  r-   r-   r-   r4   rU  K  r  rU  c                   @   rt  )PREFERRED_BACKUP_KEY)r   )	KeyLengthr   )CertificateLengthr   r}  Nr  r-   r-   r-   r4   rV  Q  r  rV  c                   @   rt  )PVK_FILE_HDR)r  r  )	dwKeySpecr   )dwEncryptTyper   )cbEncryptDatar   )cbPvkr   Nr  r-   r-   r-   r4   rY  Y  r  rY  c                   @   s   e Zd ZddddeffZdS )PUBLICKEYSTRUC)bType<B=0)bVersionr`  )reservedz<H=0aiKeyAlgN)r>   r?   r@   ALG_IDr   r-   r-   r-   r4   r^  c  s    r^  c                   @   rt  )	RSAPUBKEY))magicr   )bitlenr   )pubexpr   Nr  r-   r-   r-   r4   re  k  r  re  c                   @   s"   e Zd ZddefddefdfZdS )PUBLIC_KEY_BLOBpublickeystrucr   	rsapubkey_modulusz	_-modulus self["rsapubkey"]["bitlen"] // 8Nr>   r?   r@   r^  re  r   r-   r-   r-   r4   ri  r  s
    ri  c                   @   s<   e Zd Zddefddefdddddd	d
dddddddfZdS )PRIVATE_KEY_BLOBrj  r   rk  rl  )modulusr   )_prime1z_-prime1!self["rsapubkey"]["bitlen"] // 16)prime1r   )_prime2z_-prime2rs  )prime2r   )
_exponent1z_-exponent1rs  )	exponent1r   )
_exponent2z_-exponent2rs  )	exponent2r   )_coefficientz_-coefficientrs  )coefficientr   )_privateExponentz_-privateExponentrn  )privateExponentr   Nro  r-   r-   r-   r4   rp  y  s$    rp  c                   @   s    e Zd ZddefdefdfZdS )SIMPLE_KEY_BLOBrj  r   algid)encryptedkeyr   N)r>   r?   r@   r^  rd  r   r-   r-   r-   r4   r    s
    r  c                   @   rt  )DPAPI_DOMAIN_RSA_MASTER_KEY))cbMasterKeyr   )	cbSuppKeyr   )bufferr   Nr  r-   r-   r-   r4   r    r  r  c                 C   s   t | d ddd }t | d ddd }t | d ddd }t | d ddd }t | d ddd }t | d ddd }t | d	 ddd }trQt}|| d
 d }	t||	|||f}
|
S )zK
    parse private key into pkcs#1 format
    :param key:
    :return:
    rq  Nr  rt  rv  rx  rz  r|  r~  rk  rh  )r   r   r   r   	construct)r%  rq  rt  rv  exp1exp2r|  
privateExplongpubExpr  r-   r-   r4   privatekeyblob_to_pkcs1  s   r  c                 C   s   t t|d | d dt }t t|d | d dt }tdt|d | dd}td|| ddd d }t || d dt d d }|||gS )Nr    sha256'  r   r(   r   )r   r  r   encoder  r   r
   )rC  passwordkey1key2tmpKeytmpKey2key3r-   r-   r4   deriveKeysFromUser  s   ,,$$
r  c                 C   s   t |dkrt|| d dt }|gS t|| d dt }td|| dd}td|| ddd d }t|| d dt d d }||gS )Nr   r  r   r  r  r   r(   )r   r   r  r  r   r  r
   )rC  rD  r  r  r  r  r-   r-   r4   r`    s   $r`  )
__future__r   r   r  structr   r   r   binasciir   r   r	   hashlibr
   Cryptodome.Hashr   r   r   r   Cryptodome.Cipherr   r   Cryptodome.Util.Paddingr   Cryptodome.PublicKeyr   Cryptodome.Util.numberr   r  r   impacket.eser   impacket.structurer   r   impacket.uuidr   impacket.dcerpc.v5.enumr   impacket.dcerpc.v5.dtypesr   ALG_CLASS_ANYrU   r   r`   rI   r^   ALG_CLASS_ALLrJ   rY   rV   ra   rl   rq   r   r\   rW   ALG_SID_RSA_PKCSALG_SID_RSA_MSATWORKALG_SID_RSA_ENTRUSTALG_SID_RSA_PGPrZ   ALG_SID_DSS_PKCSALG_SID_DSS_DMSr   rb   rf   rh   ALG_SID_IDEAALG_SID_CASTALG_SID_SAFERSK64ALG_SID_SAFERSK128rd   ALG_SID_CYLINK_MEKr   r   r   r   r   r{   r}   CRYPT_MODE_CBCICRYPT_MODE_CFBPCRYPT_MODE_OFBPCRYPT_MODE_CBCOFMCRYPT_MODE_CBCOFMIrj   rm   ro   rr   rt   rv   rx   r   rK   rM   rO   rQ   rS   ALG_SID_MACALG_SID_RIPEMDALG_SID_RIPEMD160r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r:   r;   rH   r   r   r   rR   r.   r   rg   MODE_CBCr   r   r#  r   r   r0  r3  rN  rh  ro  ru  r  r  r  r  r  r  r  r  r	  r  r$  r1  r9  VAULT_KNOWN_SCHEMASr;  r@  rd  rU  rV  rY  r^  re  ri  rp  r  r  r  r  r`  r-   r-   r-   r4   <module>   s(  
/

	H^; -	8
!G
