o
    àý°j­¼  ã                   @   sx  d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlmZ d dlm	Z	m
Z
 d dlmZ d dlmZ d dlmZ d dlmZ d dlmZmZmZmZ d d	lmZ d d
lmZ d dlmZ d dlmZ d dlm Z  d dl!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z*m+Z+m,Z,m-Z-m.Z.m/Z/m0Z0m1Z1m2Z2m3Z3m4Z4m5Z5 d dl6m7Z7m8Z8 ddd„Z9G dd„ dƒZ:G dd„ dƒZ;G dd„ dƒZ<dS )é    N)Údatetime)ÚunpackÚpack)Úb)Úntlm)ÚgetUnixTime)ÚLOG)Ú	transportÚrrpÚscmrÚwkst)ÚtransformKey)ÚERROR_NO_MORE_ITEMS)Úhexdump)Ú	constants)Ústring_to_key)ÚCryptoCommonÚ_print_helperÚDOMAIN_ACCOUNT_FÚSAM_KEY_DATAÚSAM_KEY_DATA_AESÚARC4ÚDESÚAESÚUSER_ACCOUNT_VÚSAM_HASHÚSAM_HASH_AESÚLSA_SECRET_XPÚHMACÚMD4ÚMD5Ú
LSA_SECRETÚLSA_SECRET_BLOBÚ	NL_RECORDÚDPAPI_SYSTEMÚ
NTDSHashes)Ú	unhexlifyÚhexlifyúw+c                 C   s"   |d ur	|| |ƒS t j| |dd�S )Núutf-8)Úencoding)ÚcodecsÚopen)ÚfileNameÚmodeÚopenFileFunc© r0   ú�/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/impacket/examples/regsecrets.pyÚopenFile   s   
r2   c                   @   s¦   e Zd Zd'dd„Zdd„ Zdd„ Zdd	„ Zd
d„ Zdd„ Zdd„ Z	dd„ Z
dd„ Zdd„ Zdd„ Zdd„ Zdd„ Zd(dd„Zd(dd „Zd(d!ed"efd#d$„Zd%d&„ ZdS ))ÚRemoteOperationsNc                 C   s€   || _ | j d ur| j  d¡ d| _d| _d | _d | _d | _d | _|| _|| _	d| _
d| _d| _d| _d| _d | _d | _d| _d S )Ni,  ÚRemoteRegistryzncacn_np:445[\pipe\winreg]ó    Fzncacn_np:445[\pipe\svcctl])Ú _RemoteOperations__smbConnectionÚ
setTimeoutÚ_RemoteOperations__serviceNameÚ&_RemoteOperations__stringBindingWinRegÚ_RemoteOperations__rrpÚ_RemoteOperations__regHandleÚ_RemoteOperations__samrÚ_RemoteOperations__drsrÚ_RemoteOperations__doKerberosÚ_RemoteOperations__kdcHostÚ_RemoteOperations__bootKeyÚ_RemoteOperations__disabledÚ_RemoteOperations__shouldStopÚ_RemoteOperations__startedÚ&_RemoteOperations__stringBindingSvcCtlÚ_RemoteOperations__scmrÚ!_RemoteOperations__tmpServiceNameÚ!_RemoteOperations__serviceDeleted)ÚselfÚsmbConnectionÚ
doKerberosÚkdcHostr0   r0   r1   Ú__init__!   s&   

zRemoteOperations.__init__c                 C   ó>   t  | j¡}| | j¡ | ¡ | _| j ¡  | j t	j
¡ d S ©N)r	   ÚDCERPCTransportFactoryrD   Úset_smb_connectionr6   Úget_dce_rpcrE   ÚconnectÚbindr   ÚMSRPC_UUID_SCMR©rH   Úrpcr0   r0   r1   Ú__connectSvcCtl;   ó
   

z RemoteOperations.__connectSvcCtlc                 C   rM   rN   )r	   rO   r9   rP   r6   rQ   r:   rR   rS   r
   ÚMSRPC_UUID_RRPrU   r0   r0   r1   Ú__connectWinRegB   rX   z RemoteOperations.__connectWinRegc                 C   s´   | j  ¡ dkr-|  ¡ \}}| j  ¡ }| ¡  | ¡ › d�¡r+d | d¡dd… ¡}ndS | j  ¡ }| j  ¡ }t	 
d|› d|› �¡ d| ¡  d	¡| ¡  d	¡| ¡  d	¡f }|S )
zm
        Returns Kerberos salt for the current connection if
        we have the correct information
        Ú Ú.é   Nr5   z,[Secretsdump][getMachineKerberosSalt] Host: z / Domain FQDN: s   %shost%s.%sr)   )r6   ÚgetServerNameÚgetMachineNameAndDomainÚgetRemoteNameÚlowerÚ
startswithÚjoinÚsplitÚgetServerDNSDomainNamer   ÚdebugÚupperÚencode)rH   ÚhostÚ_Ú
remoteNameÚdomainÚsaltr0   r0   r1   ÚgetMachineKerberosSaltI   s   


,z'RemoteOperations.getMachineKerberosSaltc                 C   s˜   | j  ¡ dkrBt d¡}| | j ¡ | ¡ }| ¡  | tj	¡ t 
|d¡}| ¡  |d d d d d… |d d d d d… fS | j  ¡ | j  ¡ fS )	Nr[   zncacn_np:445[\pipe\wkssvc]éd   Ú	WkstaInfoÚWkstaInfo100Úwki100_computernameéÿÿÿÿÚwki100_langroup)r6   r^   r	   rO   rP   rQ   rR   rS   r   ÚMSRPC_UUID_WKSTÚhNetrWkstaGetInfoÚ
disconnectÚgetServerDomain)rH   rV   ÚdceÚrespr0   r0   r1   r_   ]   s   
 ÿÿz(RemoteOperations.getMachineNameAndDomainc                 C   s–   zDt  | j| jd¡}|d }t  | j|d¡\}}|d d… }t  | j|d¡\}}|d d… }t  | j|¡ t|ƒdkrBd||f W S |W S    Y d S )Nz5SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinlogonÚ	phkResultÚDefaultUserNamers   ÚDefaultDomainNamer   z%s\%s)r
   ÚhBaseRegOpenKeyr:   r;   ÚhBaseRegQueryValueÚhBaseRegCloseKeyÚlen)rH   ÚansÚ	keyHandleÚdataTypeÚ	dataValueÚusernamerl   r0   r0   r1   ÚgetDefaultLoginAccountn   s   z'RemoteOperations.getDefaultLoginAccountc              
   C   s¦   z3t  | j| j|¡}|d }t  | j|¡}|d d d d… }t  | j|¡ | d¡r1|dd … }|W S  tyR } z| d¡du rGt	 
|¡ W Y d }~d S d }~ww )	NÚlpServiceHandleÚlpServiceConfigÚlpServiceStartNamers   z.\é   Ú_historyF)r   ÚhROpenServiceWrE   Ú"_RemoteOperations__scManagerHandleÚhRQueryServiceConfigWÚhRCloseServiceHandlerb   Ú	ExceptionÚendswithr   Úerror)rH   ÚserviceNamer‚   ÚserviceHandlerz   ÚaccountÚer0   r0   r1   ÚgetServiceAccount~   s   

€üz"RemoteOperations.getServiceAccountc                 C   s:  t  | j¡}|d | _t  | j| j| j¡}|d | _t  | j| j¡}|d d t jkr:t	 
d| j ¡ d| _d| _n |d d t jkrRt	 d| j ¡ d| _d| _ntd	|d
  ƒ‚| jdu r›t  | j| j¡}|d d dkr„t	 
d| j ¡ d| _t j| j| jdd� t	 
d| j ¡ t  | j| j¡ t d¡ d S d S )NÚ
lpScHandlerˆ   ÚlpServiceStatusÚdwCurrentStatezService %s is in stopped stateTFzService %s is already runningz%Unknown service state 0x%x - AbortingÚCurrentStater‰   ÚdwStartTypeé   z#Service %s is disabled, enabling ité   ©r�   zStarting service %sr]   )r   ÚhROpenSCManagerWrE   rŽ   r�   r8   Ú _RemoteOperations__serviceHandleÚhRQueryServiceStatusÚSERVICE_STOPPEDr   ÚinforB   rC   ÚSERVICE_RUNNINGrf   r‘   r�   rA   ÚhRChangeServiceConfigWÚhRStartServiceWÚtimeÚsleep©rH   r‚   r0   r0   r1   Ú__checkServiceStatus�   s0   


øz%RemoteOperations.__checkServiceStatusc                 C   s   |   ¡  |  ¡  |  ¡  d S rN   )Ú _RemoteOperations__connectSvcCtlÚ%_RemoteOperations__checkServiceStatusÚ _RemoteOperations__connectWinReg)rH   r0   r0   r1   ÚenableRegistry®   s   zRemoteOperations.enableRegistryc              
   C   sŽ  | j du rt d| j ¡ t | j| jtj¡ | j	du r.t d| j ¡ tj
| j| jdd� | jdu rÃ| jd urÅzwt d| j ¡  ¡}t|dƒrX|j| j ¡ Ž  | | j| j¡ | ¡ | _| j ¡  | j tj¡ t | j¡}|d	 | _t | j| j| j¡}|d
 }t | j|¡ t | j|tj¡ t | j|¡ t | j| j¡ t | j| j¡ |  ¡  W d S  t!yÂ } zW Y d }~d S d }~ww d S d S )NTzStopping service %sz+Restoring the disabled state for service %srž   r    Fzncacn_np:%s[\pipe\svcctl]Úset_credentialsr™   rˆ   )"rB   r   r¥   r8   r   ÚhRControlServicerE   r¢   ÚSERVICE_CONTROL_STOPrA   r§   rG   rF   r	   rO   r6   ÚgetRemoteHostÚhasattrr±   ÚgetCredentialsÚset_kerberosr>   r?   rQ   rR   rS   rT   r¡   rŽ   r�   ÚhRDeleteServicer�   rw   r‘   )rH   rV   r‚   rz   Úservicer—   r0   r0   r1   Ú	__restore³   s<   





€ûèzRemoteOperations.__restorec              
   C   sº   | j d urt | j| j ¡ |  ¡  | jd ur| j ¡  | jd ur%| j ¡  | jd ur/| j ¡  | jd ur[z| j ¡  W d S  t	yZ } zt
|ƒ d¡dkrNn‚ W Y d }~d S d }~ww d S )NÚSTATUS_INVALID_PARAMETERr   )r;   r
   r€   r:   Ú_RemoteOperations__restorerw   r=   r<   rE   r‘   ÚstrÚfind)rH   r—   r0   r0   r1   ÚfinishÚ   s(   







þ€þýzRemoteOperations.finishc                 C   sÚ   d}|   ¡  dD ]2}t d| ¡ t | j| jd| ¡}|d }t | j|¡}|t|d d d… ƒ }t 	| j|¡ qg d¢}t
|ƒ}tt|ƒƒD ]}|  j||| || d	 … 7  _qIt d
t| jƒ d¡ ¡ | jS )Nr5   )ÚJDÚSkew1ÚGBGÚDatazRetrieving class info for %sz'SYSTEM\CurrentControlSet\Control\Lsa\%sr{   Ú
lpClassOutrs   )é   é   rž   r‹   é   é	   é   rŸ   r   é   r]   é   é   é
   é   é   r]   zTarget system bootKey: 0x%sr)   )ÚopenHKLMHandler   rf   r
   r~   r:   r;   ÚhBaseRegQueryInfoKeyr   r€   r&   Úranger�   r@   r¥   r'   Údecode)rH   ÚbootKeyÚkeyr‚   rƒ   Ú
transformsÚir0   r0   r1   Ú
getBootKeyí   s   $zRemoteOperations.getBootKeyc                 C   s(   | j d u rt | j¡}|d | _ d S d S )NÚphKey)r;   r
   ÚhOpenLocalMachiner:   r«   r0   r0   r1   rÐ     s   
þzRemoteOperations.openHKLMHandler   c                 C   sœ   t  dt ¡ › d|› d|› �¡ |  ¡  ztj| j| j|tj	tj
B d d�}W n   td|› d�ƒ‚|d }t | j|d |¡}t | j|¡ t |¡ |S )Nú[z] Retrieving ú\©Ú	dwOptionsÚ
samDesiredúCan't open ú subKeyr{   )r   rf   r   ÚnowrÐ   r
   r~   r:   r;   ÚREG_OPTION_BACKUP_RESTOREÚREG_OPTION_OPEN_LINKr‘   r   r€   r©   rª   )rH   ÚsubKeyÚvalueÚthrottler‚   rƒ   r0   r0   r1   ÚretrieveSubKey  s    
ÿ
zRemoteOperations.retrieveSubKeyc                 C   sÔ   t  dt ¡ › d|› �¡ |  ¡  ztj| j| j|tj	tj
B d d�}W n   td|› d�ƒ‚|d }d}g }	 zt | j||¡}|d	7 }| |d
 d d… ¡ W n	 tyZ   Y nw q8t | j|¡ t |¡ |S )NrÛ   z] Enumerating keys rÝ   rà   rá   r{   r   Tr]   Ú	lpNameOutrs   )r   rf   r   râ   rÐ   r
   r~   r:   r;   rã   rä   r‘   ÚhBaseRegEnumKeyÚappendr€   r©   rª   )rH   rå   rç   r‚   rƒ   r×   ÚvaluesrÕ   r0   r0   r1   Ú
enumSubKey  s.   
ÿÿû
zRemoteOperations.enumSubKeyrå   Úreturnc              
   C   s$  t  dt ¡ › d|› �¡ |  ¡  ztj| j| j|tj	tj
B d d�}W n   td|› d�ƒ‚|d }d}tƒ }	 z1t | j||¡}|d	 d d
… }t|ƒdkrRd}|d }	d |d ¡}
|  |	|
¡||< |d7 }W n tjy‰ } z| ¡ tkrW Y d }~nW Y d }~nd }~ww q9t |¡ |S )NrÛ   z] Enumerating values rÝ   rà   rá   r{   r   TÚlpValueNameOutrs   z	(Default)ÚlpTyper5   ÚlpDatar]   )r   rf   r   râ   rÐ   r
   r~   r:   r;   rã   rä   r‘   ÚdictÚhBaseRegEnumValuer�   rc   Ú _RemoteOperations__parse_lp_dataÚDCERPCSessionErrorÚget_error_coder   r©   rª   )rH   rå   rç   r‚   rƒ   r×   rì   Úans2Úlp_value_nameÚlp_typeÚlp_datar—   r0   r0   r1   Ú
enumValues,  s<   
ÿÿ€ÿö
zRemoteOperations.enumValuesc              
   C   s  zc|t jks|t jkrt|ƒtu rW d S | d¡d d… W S |t jkr&|W S |t jkr3td|ƒd W S |t j	kr@td|ƒd W S |t j
krH|W S |t jkrW| d¡d d… W S td| ƒ t|ƒ W d S  tyƒ } zt dt|ƒ ¡ td	ƒ W Y d }~d S d }~ww )
Núutf-16lers   ú<Lr   z<QéþÿÿÿzUnknown Type 0x%x!z+Exception thrown when printing reg value %szInvalid data)r
   ÚREG_SZÚREG_EXPAND_SZÚtypeÚintrÓ   Ú
REG_BINARYÚ	REG_DWORDr   Ú	REG_QWORDÚREG_NONEÚREG_MULTI_SZÚprintr   r‘   Úloggingrf   r½   )rH   Ú	valueTypeÚ	valueDatar—   r0   r0   r1   Ú__parse_lp_dataG  s.   




€ýz RemoteOperations.__parse_lp_datarN   )r   )Ú__name__Ú
__module__Ú__qualname__rL   r­   r¯   rn   r_   r‡   r˜   r®   r°   r¼   r¿   rØ   rÐ   rè   rí   r½   rò   rû   rô   r0   r0   r0   r1   r3       s$    
'

r3   c                   @   s|   e Zd Zdd„ dddfdefdd„Zd	d
„ Zdd„ Zddd„Zdd„ Zdd„ Z	dd„ Z
dd„ Zdd„ Zdd„ Zddd„ZdS )Ú	SAMHashesc                 C   s   t | ƒS rN   ©r   )Úsecretr0   r0   r1   Ú<lambda>a  ó    zSAMHashes.<lambda>NFr   Ú	remoteOpsc                 C   s<   || _ d| _|| _tƒ | _i | _|| _|| _g | _|| _	d S )Nr5   )
Ú_SAMHashes__remoteOpsÚ_SAMHashes__hashedBootKeyÚ_SAMHashes__bootKeyr   Ú_SAMHashes__cryptoCommonÚ_SAMHashes__itemsFoundÚ_SAMHashes__perSecretCallbackÚ_SAMHashes__historyÚ_SAMHashes__historyItemsÚ_SAMHashes__throttle)rH   rÔ   ÚperSecretCallbackr  Úhistoryrç   r0   r0   r1   rL   a  s   
zSAMHashes.__init__c                 C   ó   t  d¡}| |¡ | ¡ S ©NÚmd5©ÚhashlibÚnewÚupdateÚdigest©rH   Údatar#  r0   r0   r1   r    l  ó   

zSAMHashes.MD5c           	      C   s(  t  d¡ d}d}| jjdd| jd�d }t|ƒ}|d d	d… d
krlt|d ƒ}|  |d | | j | ¡}t	 
|¡}| |d |d  ¡| _|  | jd d… | | jd d…  | ¡}|| jdd … krjtdƒ‚d S |d d	d… dkr’t|d ƒ}| j | j|d d |d … |d ¡| _d S d S )Nz"Calculating HashedBootKey from SAMs/   !@#$%^&*()qwertyUIOPAzxcvbnmQQQQQQQQQQQQ)(*@&% s)   0123456789012345678901234567890123456789 zSAM\SAM\Domains\AccountÚF©rç   r]   ÚKey0r   ó   ÚSaltÚKeyÚCheckSumé   zJhashedBootKey CheckSum failed, Syskey startup password probably in use! :(ó   rÃ   ÚDataLen)r   rf   r  rè   r  r   r   r    r  r   r&  Úencryptr  r‘   r   r  Ú
decryptAES)	rH   ÚQWERTYÚDIGITSr,  Ú
domainDataÚ
samKeyDataÚrc4KeyÚrc4ÚcheckSumr0   r0   r1   ÚgetHBootKeyq  s(   

*ÿ

ÿüzSAMHashes.getHBootKeyc                 C   sÂ   | j  |¡\}}t |tj¡}t |tj¡}|du r8|  | jd d… td|ƒ | ¡}	t |	¡}
|
 	|d ¡}n| j  
| jd d… |d |d ¡d d… }| |d d… ¡| |dd … ¡ }|S )NFr3  rý   ÚHashr0  rÅ   )r  Ú	deriveKeyr   r&  ÚMODE_ECBr    r  r   r   r6  r7  Údecrypt)rH   ÚridÚcryptedHashÚconstantÚnewStyleÚKey1ÚKey2ÚCrypt1ÚCrypt2r<  r=  rÕ   ÚdecryptedHashr0   r0   r1   Ú__decryptHashŽ  s   "
*$zSAMHashes.__decryptHashc                 C   sP   | j  |¡\}}t |tj¡}t |tj¡}| |d d… ¡| |dd… ¡ S )NrÅ   r3  )r  rA  r   r&  rB  rC  )rH   Úrid_intÚblock16Úkey1Úkey2Úcrypt1Úcrypt2r0   r0   r1   Ú__unwrap_history_block¡  s   $z SAMHashes.__unwrap_history_blockc                 C   s°   g }| j d d… }|D ]J\}}|rt|ƒd dkrq|r"t|ƒdkr#qtj|tj|d�}| |¡}tdt|ƒdƒD ]}	||	|	d … }
t|
ƒdk rK n
| |  ||
¡¡ q9q|S )Nr3  r   )Úiv)	r  r�   r   r&  ÚMODE_CBCrC  rÒ   rë   Ú _SAMHashes__unwrap_history_block)rH   rN  ÚentriesÚoutrÕ   rm   ÚencÚcipherÚplainÚoffÚblockr0   r0   r1   Ú__decrypt_history_entries_aes§  s    
€z'SAMHashes.__decrypt_history_entries_aesc           	      C   sê   g }t |ƒ}|dkrdnd}|d |krs|||d … }tj||d |d … ddd�}|dks4|d	kr9|d
7 }q|d }|| |ksI|d dkrN|d
7 }q|||| … }| ||f¡ || }|d
 rm|d
|d
  7 }|d |ks|S )Ni   é   r   é   r3  ÚlittleF©Úsignedi    rž   )r�   r  Ú
from_bytesrë   )	rH   ÚvdatarX  ÚlengthÚoffsetrm   Údata_lenÚdata_offrZ  r0   r0   r1   Ú__scan_v_for_aes_entries¸  s(    òz"SAMHashes.__scan_v_for_aes_entriesc           
   	   C   sÐ   |dks|dkr
g S || }|t |ƒkrg S |||… }t |ƒdk r$g S zt|ƒ}W n ty>   tjd||dd� g  Y S w |d }|sGg S t |ƒt |ƒd  }	|	dkrWg S |d |	… }|  ||d |fg¡S )	Nr   é   z;Failed to parse SAM_HASH_AES history block at 0x%x (len=%d)T©Úexc_infor@  r3  r0  )r�   r   r‘   r   rf   Ú'_SAMHashes__decrypt_history_entries_aes)
rH   rN  r*  rh  rg  ÚendÚblobÚrecordrZ  Úenc_lenr0   r0   r1   Ú__decode_aes_history_blockÍ  s,   þz$SAMHashes.__decode_aes_history_blockc                 C   s\  d}d}g g dœ}|d }|d }t j|dd… dd	d
�}	t j|dd… dd	d
�}
t j|dd… dd	d
�}t j|dd… dd	d
�}|sKt d|¡ |S |  |||	|
¡}|  ||||¡}|sp|
rp||	|	|
 … }|  ||  |¡¡}|s…|r…|||| … }|  ||  |¡¡}||d< ||d< |d s¬|d s¬|
dkr¬|dkr¬|  |¡}|r¬|  ||¡|d< |S )Ns   LMPASSWORDHISTORY s   NTPASSWORDHISTORY )ÚlmÚntÚ	Unknown15rÃ   r   rž   rb  Frc  rÅ   rË   r3  ra  z<Skipping old-style history for RID %d; RC4/DES path disabledru  rv  )r  re  r   rf   Ú$_SAMHashes__decode_aes_history_blockro  Ú"_SAMHashes__scan_v_for_aes_entries)rH   rN  Ú	new_styleÚuser_accountÚlm_constÚnt_constÚresultÚmetar*  Ú	lm_offsetÚ	lm_lengthÚ	nt_offsetÚ	nt_lengthÚ
lm_entriesÚ
nt_entriesrq  Úfallback_entriesr0   r0   r1   Ú__extract_local_historyé  s6   
 
z!SAMHashes.__extract_local_historyc                 C   s(  d}d}t  d¡ |  ¡  g | _d}| jj|| jd�}z| d¡ W n   Y tt	 
dd¡ƒ d¡}tt	 dd¡ƒ d¡}|D �]Ñ}t| jjt ||¡d	| jd�d
 ƒ}t|dƒ}|d }	|	|d |d |d  …  d¡}
|d dkr|t d|
 ¡ q?d}|	|d d … dd… dkr»d}|d dkr¤t|	|d d … d |d … ƒ}|d dkrºt|	|d d … d |d … ƒ}n(d}|d dkrÓt|	|d d … d |d … ƒ}t|	|d d … d |d … ƒ}t  d| ¡ |d dkrù|  ||||¡}nd}|dk�r	|  ||||¡}nd}|dk�rt	 
dd¡}|dk�r!t	 dd¡}d|
|t|ƒ d¡t|ƒ d¡f }|| j|< |  |¡ | j�rz³|  |||¡}| d g ¡}| d!g ¡}|�r{|�r{|d" |d" k�r{| ¡  | ¡  |�r{|�r{|d" |d" k�sdt  d#|
|t|ƒt|ƒ¡ tt|ƒt|ƒƒ}t |ƒD ]]}|t|ƒk �r¢|| nd}|t|ƒk �r¯|| nd}|�r»t|ƒ d¡n|}|�rÇt|ƒ d¡n|}||k�rÕ||k�rÕ�q•|
› d$|› d%|› d%|› d%|› d&�
}| j !|¡ |  |¡ �q•W q? t"�y } zt jd'||dd(� W Y d }~q?d }~ww q?d S ))Ns   NTPASSWORD s   LMPASSWORD z0Dumping local SAM hashes (uid:rid:lmhash:nthash)zSAM\SAM\Domains\Account\Usersr-  ÚNamesr[   r)   ÚVr]   r3  rÃ   Ú
NameOffsetÚ
NameLengthrü   ÚNTHashLengthr   zTSAM hashes extraction for user %s failed. The account doesn't have hash information.r5   ÚNTHashOffsetr‹   rŸ   r/  FÚLMHashLengthra  ÚLMHashOffsetTrl  zNewStyle hashes is: %sz%s:%d:%s:%s:::ru  rv  rs   z,History lengths for %s (RID %d): lm=%d nt=%drŒ   ú:z:::z)SAM history parsing failed for RID %d: %srm  )#r   r¥   r?  r  r  rí   r  Úremover'   r   ÚLMOWFv1rÓ   ÚNTOWFv1r   rè   Úntpathrc   r  r	  r“   r   r   rf   Ú_SAMHashes__decryptHashr  r  r  Ú!_SAMHashes__extract_local_historyÚgetÚpopr�   ÚmaxrÒ   rë   r‘   )rH   Ú
NTPASSWORDÚ
LMPASSWORDÚusersKeyÚridsÚempty_lm_hexÚempty_nt_hexrD  ÚuserAccountr‰  ÚuserNameÚ	encNTHashrG  Ú	encLMHashÚlmHashÚntHashÚanswerr   Úlm_histÚnt_histÚcountÚidxÚlm_valÚnt_valÚlm_hexÚnt_hexÚhistory_lineÚexcr0   r0   r1   Údump  sš   

$
"  €  


$

þ
ÿ"÷
€ÿëÑzSAMHashes.dumpc                 C   st   t | jƒdkr8t| jƒ}|d }t||d�}|D ]}| | j| d ¡ q| jD ]	}| |d ¡ q(| ¡  |S d S )Nr   z.sam©r/   Ú
)r�   r  Úsortedr2   Úwriter  Úclose)rH   ÚbaseFileNamer/   Úitemsr-   ÚfdÚitemÚliner0   r0   r1   Úexportj  s   

÷zSAMHashes.export)FrN   )r  r  r  r3   rL   r    r?  r•  rW  ro  ry  rx  r–  r±  r¼  r0   r0   r0   r1   r  `  s    
%\r  c                   @   s¸   e Zd ZdZG dd„ dƒZdddd„ dfd	efd
d„Zdd„ Zd+dd„Zdd„ Z	dd„ Z
dd„ Zdd„ Zdd„ Zdd„ Zdd„ Zdd „ Zd!d"„ Zd#d$„ Zd%d&„ Zd,d'd(„Zd,d)d*„ZdS )-Ú
LSASecretsz(Unknown User)c                   @   s   e Zd ZdZdZdZdZdS )zLSASecrets.SECRET_TYPEr   r]   r‹   rŸ   N)r  r  r  ÚLSAÚ
LSA_HASHEDÚLSA_RAWÚLSA_KERBEROSr0   r0   r0   r1   ÚSECRET_TYPEx  s
    rÂ  NFc                 C   s   t |ƒS rN   r  )Ú
secretTyper  r0   r0   r1   r    r  zLSASecrets.<lambda>r   r  c                 C   sH   || _ d| _d| _d| _tƒ | _|| _g | _g | _|| _	|| _
|| _d S )Nr5   T)Ú_LSASecrets__bootKeyÚ_LSASecrets__LSAKeyÚ_LSASecrets__NKLMKeyÚ_LSASecrets__vistaStyler   Ú_LSASecrets__cryptoCommonÚ_LSASecrets__remoteOpsÚ_LSASecrets__cachedItemsÚ_LSASecrets__secretItemsÚ_LSASecrets__perSecretCallbackÚ_LSASecrets__historyÚ_LSASecrets__throttle)rH   rÔ   r  r   r  rç   r0   r0   r1   rL   ~  s   
zLSASecrets.__init__c                 C   r!  r"  r$  r)  r0   r0   r1   r    Œ  r+  zLSASecrets.MD5éè  c                 C   s2   t  ¡ }| |¡ t|ƒD ]}| |¡ q| ¡ S rN   )r%  Úsha256r'  rÒ   r(  )rH   rÕ   ræ   ÚroundsÚshar×   r0   r0   r1   Ú__sha256‘  s
   
zLSASecrets.__sha256c                 C   sÈ   d}t d|d d… ƒd }|t|ƒ| d … }|}tdt|ƒdƒD ]:}|d d… }|d d… }t|ƒ}	t |	tj¡}
||
 |¡7 }|dd … }|dd … }t|ƒdk r[|t|ƒd … }q!t|ƒ}|d S )Nr5   z<Irž   r   rÅ   rÏ   ÚSecret)	r   r�   rÒ   r   r   r&  rB  rC  r   )rH   rÕ   ræ   Ú	plainTextÚencryptedSecretSizeÚkey0r×   Ú
cipherTextÚ	tmpStrKeyÚtmpKeyrJ  r  r0   r0   r1   Ú__decryptSecret˜  s"   €zLSASecrets.__decryptSecretc                 C   s.   t  ||t¡}| ¡ }t |¡}| |¡}|S rN   )r   r&  r    r(  r   r6  )rH   rÕ   ræ   rU  Úhmac_md5Úrc4keyr=  r*  r0   r0   r1   rM  ¯  s
   

zLSASecrets.__decryptHashc                 C   sØ   | j du r6t|ƒ}|  | j|d d d… ¡}| j ||d dd … ¡}t|ƒ}|d dd … d d… | _d S t 	d¡}| 
| j¡ tdƒD ]}| 
|dd	… ¡ qE| ¡ }t 	|¡}| |d
d… ¡}|dd… | _d S )NTÚEncryptedDataé    rÔ  é4   r#  rÏ  é<   éL   rË   r3  )rÇ  r!   Ú_LSASecrets__sha256rÄ  rÈ  r7  r"   rÅ  r%  r&  r'  rÒ   r(  r   rC  )rH   ræ   rr  rÚ  rÕ  r#  r×   r=  r0   r0   r1   Ú__decryptLSA·  s   


zLSASecrets.__decryptLSAc                 C   sh   t  d¡ | jjdd| jd�}|d u r+t  d¡ | jjdd| jd�}d| _|d u r+d S |  |d ¡ d S )	NzDecrypting LSA KeyzSECURITY\Policy\PolEKListr[   r-  z2PolEKList not found, trying PolSecretEncryptionKeyz&SECURITY\Policy\PolSecretEncryptionKeyFr]   )r   rf   rÉ  rè   rÎ  rÇ  Ú_LSASecrets__decryptLSA)rH   ræ   r0   r0   r1   Ú__getLSASecretKeyÊ  s   

zLSASecrets.__getLSASecretKeyc                 C   s–   t  d¡ | jjdd| jd�}|d u rtdƒ‚| jdu r?t|d ƒ}|  | j	|d d d	… ¡}| j
 ||d d	d … ¡| _d S |  | j	|d ¡| _d S )
NzDecrypting NL$KMz%SECURITY\Policy\Secrets\NL$KM\CurrValr[   r-  zCouldn't get NL$KM valueTr]   rÞ  rß  )r   rf   rÉ  rè   rÎ  r‘   rÇ  r!   rã  rÅ  rÈ  r7  rÆ  Ú_LSASecrets__decryptSecret)rH   ræ   rr  rÚ  r0   r0   r1   Ú__getNLKMSecretÙ  s   

 zLSASecrets.__getNLKMSecretc                 C   s   |d@ dkr||d@  S |S )NrŸ   r   r0   )rH   r*  r0   r0   r1   Ú__padå  s   zLSASecrets.__padc              	   C   s4  t  d¡ | jjd| jd�}|d u rd S z|d= W n   Y d}| dd ¡r;| d¡}|d= |dkr7|d@ }n|d }|  ¡  |  ¡  t  d	t	| j
ƒ ¡ › �¡ t  d
t	| jƒ ¡ › �¡ | ¡ D ]¶\}}t  d|› �¡ t|ƒ}|d dk�r|d d@ dkr¥| jdu r—| j | jdd… |d |d ¡}n|  | j|d |d ¡}	 nqa|d d… }|dd … }|d |d …  d¡}||  |d ¡|  |d ¡ d … }|d |  |d ¡…  d¡}	t t|d ƒ¡}
| jdu rûd|	|||t	|ƒ d¡|
f }nd|	|t	|ƒ d¡||
f }| j |¡ |  tjj|¡ qad S )Nz>Dumping cached domain logon information (domain/username:hash)zSECURITY\Cacher-  ú
NL$Controli (  zNL$IterationCountl    |ÿ i   zLsaSecretKey: 0xzNKLM Secret: 0xúLooking into ÚIVs                   ÚFlagsr]   Tr3  rß  rÞ  éH   Ú
UserLengthrü   ÚDomainNameLengthÚDnsDomainNameLengthÚ	LastWritez%s/%s:$DCC2$%s#%s#%s: (%s)r)   z%s/%s:%s:%s: (%s))r   r¥   rÉ  rû   rÎ  r—  Ú_LSASecrets__getLSASecretKeyÚ_LSASecrets__getNLKMSecretrf   r'   rÅ  rÓ   rÆ  r¸  r#   rÇ  rÈ  r7  Ú_LSASecrets__decryptHashÚ_LSASecrets__padr   Úutcfromtimestampr   rÊ  rë   rÌ  r½  rÂ  r¿  )rH   rì   ÚiterationCountrr  rÕ   ræ   rÕ  ÚencHashr¡  Ú
domainLongÚ	timestampr¦  r0   r0   r1   ÚdumpCachedHashesë  sT   




$$
 €ãzLSASecrets.dumpCachedHashesc              
   C   s(  t |ƒdkrt d| ¡ d S | d¡rt d| ¡ d S | ¡ }t d| ¡ d}| d¡rgz| d¡}W n   Y �nt| jd	ƒr\| j 	|d
d … ¡}|d u rW| j
d }n
d| }n| j
d }||7 }�nï| d¡rŸz| d¡}W n   Y �nÜt| jdƒr”| j ¡ }|d u r�| j
d }n
d| }n| j
d }||7 }�n·| d¡r¸z| d¡}W n   Y �n¤d| }�nž| d¡r×t|ƒ}d t|d ƒ d¡t|d ƒ d¡¡}�n| d¡�rRt ¡ }| |¡ t| jdƒ�r| j ¡ \}	}
d|
|	f }d|
|	tt dd¡ƒ d¡t| ¡ ƒ d¡f }nd}dtt dd¡ƒ d¡t| ¡ ƒ d¡f }|  ||¡�s7t d¡ d|t|ƒ d¡f }| j |¡ |  tjj|¡ �nt d|¡d u�rât d|¡  d¡}z| d¡}t! "|¡}W n t#�yƒ } zW Y d }~n×d }~ww g }|d  dk�rÊt |d! ƒdk�rÅ| d"|d   ¡ |d! D ]}| d#|d$  ¡ | d%|d&  ¡ �q£d' $|¡}d(||f }n‘d)| }nŒt %d*t&|d  ƒ ¡ t %d+¡ t!j'|d
d,�}ntt d-|¡d u�rt d-|¡  d¡}z
| d¡ (d.¡}W n   Y nRd/||f }nKt d0|¡d u�r1t d0|¡  d1¡}z| d¡}W n   Y n,d2||f }n%t d3|¡d u�rVt d3|¡  d1¡}z| d¡}W n   Y nd4||f }|dk�rm|}| j |¡ |  tjj|¡ d S d5|t|ƒ d¡f }| j |¡ | j)| jj)k�rŠt*|ƒ |  tjj+|¡ d S )6Nr   zDiscarding secret %s, NULL Datas     zDiscarding secret %s, all zerosz%s r[   Ú_SC_rü   r˜   rž   r�  z%s:ÚDEFAULTPASSWORDr‡   ÚASPNET_WP_PASSWORDz
ASPNET: %sr$   z*dpapi_machinekey:0x{0}
dpapi_userkey:0x{1}Ú
MachineKeyzlatin-1ÚUserKeyz$MACHINE.ACCr_   z%s\%s$z%s\%s$:%s:%s:::r)   z$MACHINE.ACC: %s:%sz]Could not calculate machine account Kerberos keys, only printing plain password (hex encoded)z%s:plain_password_hex:%szG^L\$_SQSA_(S-[0-9]-[0-9]-([0-9])+-([0-9])+-([0-9])+-([0-9])+-([0-9])+)$r]   ÚversionÚ	questionsz - Version : %dz | Question: %sÚquestionz | |--> Answer: %sr¦  r³  z#Security questions for user %s: 
%sz%Empty security questions for user %s.zfUnknown SQSA version (%s), please open an issue with the following data so we can add a parser for it.zSDon't forget to remove sensitive content before sending the data in a Github issue.)ÚindentzE^SCM:{([0-9A-F]{8}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{12})}ú zPassword of service %s: %sz%^L\$([0-9A-Z]{3})-PRV-([0-9A-F]{32})$r‹   zOpenGPG private key %s: 
%sz%^L\$([0-9A-Z]{3})-PUB-([0-9A-F]{32})$zOpenGPG public key %s: 
%sz%s:%s),r�   r   rf   rb   rg   r¥   rÓ   rµ   rÉ  r˜   ÚUNKNOWN_USERr‡   r$   Úformatr'   r   r&  r'  r_   r   r’  r(  Ú!_LSASecrets__printMachineKerberosrË  rë   rÌ  r½  rÂ  r¾  ÚreÚmatchÚsearchÚgroupÚjsonÚloadsr‘   rc   Úwarningr½   ÚdumpsÚrstripr  r   rÀ  )rH   ÚnameÚ
secretItemÚ	upperNamer  Ú
strDecodedr–   ÚdpapiÚmd4Úmachinerl   Ú	printnameÚextrasecretÚsidr—   ÚoutputÚqkÚpasswordÚkeyidÚb64keyÚprintableSecretr0   r0   r1   Ú__printSecret)  sä   









ÿ
ÿÿ

€ÿ



zLSASecrets.__printSecretc           	   	   C   sâ   t | jdƒro| j ¡ }|dkrdS ttjjjƒttjjjƒttjj	jƒg}| 
dd¡ dd¡}|D ];}z	t|||d ƒ}W n tyK   tjddd	� ‚ w tj| }d
||t|jƒ 
d¡f }| j |¡ |  tjj|¡ q1dS dS )Nrn   r5   Fz	utf-16-leÚreplacer)   r‘   Trm  z%s:%s:%s)rµ   rÉ  rn   r  r   ÚEncryptionTypesÚaes256_cts_hmac_sha1_96ræ   Úaes128_cts_hmac_sha1_96Údes_cbc_md5rÓ   rh   r   r‘   r   rf   r%   ÚKERBEROS_TYPEr'   ÚcontentsrË  rë   rÌ  r½  rÂ  rÁ  )	rH   Ú	rawsecretÚmachinenamerm   Ú
allciphersÚetyperÕ   Útypenamer  r0   r0   r1   Ú__printMachineKerberosË  s,   
ý
þ
z!LSASecrets.__printMachineKerberosc                 C   s¼  t  d¡ | jjd| jd�}|d u rd S z| d¡ W n   Y z| d¡ W n   Y | jdkr5|  ¡  |D ]¤}t  d|› �¡ dg}| j	rL| 
d	¡ |D ]Œ}z| jjd
|› d|› �d| jd�}W n( tyŠ } zt ¡ jtjkrzdd l}| ¡  tt|ƒƒ W Y d }~qNd }~ww |d urÚ|d dkrÚ| jdu rÃt|d ƒ}|  | j|d d d… ¡}	| j |	|d dd … ¡}
t|
ƒ}|d }n	|  | j|d ¡}|d	krÔ|d7 }|  ||¡ qNq7d S )NzDumping LSA SecretszSECURITY\Policy\Secretsr-  zNL$KMrê  r5   rë  ÚCurrValÚOldValúSECURITY\Policy\Secrets\rÜ   r[   r   r]   TrÞ  rß  rÔ  rŒ   )r   r¥   rÉ  rí   rÎ  r‘  rÅ  ró  rf   rÍ  rë   rè   r‘   r	  Ú	getLoggerÚlevelÚDEBUGÚ	tracebackÚ	print_excr  r½   rÇ  r!   rã  rÈ  r7  r"   rç  Ú_LSASecrets__printSecret)rH   ÚkeysrÕ   ÚvalueTypeListr
  ræ   r—   r7  rr  rÚ  rÕ  r  r0   r0   r1   ÚdumpSecretsë  sX   


$€û

€éùzLSASecrets.dumpSecretsc                 C   sV  t  d|› �¡ | jdkr|  ¡  dg}| jr| d¡ |D ]Š}z| jjd|› d|› �d| jd�}W n( t	yZ } zt
 ¡ jt
jkrJd	d l}| ¡  tt|ƒƒ W Y d }~qd }~ww |d ur¨|d
 d	kr¨| jdu r“t|d
 ƒ}|  | j|d d d… ¡}| j ||d dd … ¡}	t|	ƒ}|d }
n	|  | j|d
 ¡}
|dkr¤|d7 }|
  S qd S )NzDumping LSA secret: r5   r1  r2  r3  rÜ   r[   r-  r   r]   TrÞ  rß  rÔ  rŒ   )r   r¥   rÅ  ró  rÍ  rë   rÉ  rè   rÎ  r‘   r	  r4  r5  r6  r7  r8  r  r½   rÇ  r!   rã  rÈ  r7  r"   rç  )rH   rÕ   r;  r
  ræ   r—   r7  rr  rÚ  rÕ  r  r0   r0   r1   Ú	getSecret"  s<   

$€û

€ézLSASecrets.getSecretc                 C   óL   t | jƒdkr$|d }t||d�}| jD ]	}| |d ¡ q| ¡  |S d S )Nr   z.secretsr²  r³  )r�   rË  r2   rµ  r¶  ©rH   r·  r/   r-   r¹  rº  r0   r0   r1   ÚexportSecretsF  ó   
úzLSASecrets.exportSecretsc                 C   r>  )Nr   z.cachedr²  r³  )r�   rÊ  r2   rµ  r¶  r?  r0   r0   r1   ÚexportCachedO  rA  zLSASecrets.exportCached)rÏ  rN   )r  r  r  r  rÂ  r3   rL   r    rã  rç  rõ  rå  ró  rô  rö  rü  r9  r	  r<  r=  r@  rB  r0   r0   r0   r1   r½  v  s,    ÿ
> # 7
$	r½  )r(   N)=r%  r”  r	  r©   r
  r  r+   r   Ústructr   r   Úsixr   Úimpacketr   Úimpacket.eser   r   Úimpacket.dcerpc.v5r	   r
   r   r   Úimpacket.cryptor   Úimpacket.system_errorsr   Úimpacket.structurer   Úimpacket.krb5r   Úimpacket.krb5.cryptor   Úimpacket.examples.secretsdumpr   r   r   r   r   r   r   r   r   r   r   r   r   r   r    r!   r"   r#   r$   r%   Úbinasciir&   r'   r2   r3   r  r½  r0   r0   r0   r1   Ú<module>   s:    X
  B  