o
    Žõ±jžD  ã                   @   s  d dl mZmZmZ d dlmZmZmZ d dlm	Z	 G dd„ de	ƒZ
G dd„ dƒZG dd	„ d	ƒZG d
d„ dƒZG dd„ dƒZG dd„ dƒZG dd„ dƒZG dd„ deƒZG dd„ dƒZG dd„ de
ƒZG dd„ de
ƒZG dd„ de
ƒZG dd„ de
ƒZG dd„ de
ƒZG d d!„ d!e
ƒZG d"d#„ d#e
ƒZG d$d%„ d%e
ƒZG d&d'„ d'e
ƒZG d(d)„ d)e
ƒZG d*d+„ d+e
ƒZG d,d-„ d-e
ƒZG d.d/„ d/e
ƒZG d0d1„ d1e
ƒZ G d2d3„ d3e
ƒZ!G d4d5„ d5e
ƒZ"d6eƒ eƒ eƒ eƒ eƒ eƒ eƒ eƒ eƒ d7œ	eƒ eƒ eƒ eƒ e ƒ e!ƒ e"ƒ d8œd9œiZ#d:S );é    )ÚULONGÚPVOIDÚPOINTER)ÚKatzSystemArchitectureÚWindowsMinBuildÚWindowsBuild)ÚPackageTemplatec                       s4   e Zd Z‡ fdd„Zedd„ ƒZedd„ ƒZ‡  ZS )ÚLsaTemplate_NT6c                    s.   t ƒ  d¡ d | _d | _d | _t| _d| _d S )NzLSA DecryptorÚ6)ÚsuperÚ__init__Úkey_patternÚkey_handle_structÚ
key_structÚKIWI_HARD_KEYÚhard_key_structÚnt_major©Úself©Ú	__class__© úš/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/alsadecryptor/lsa_template_nt6.pyr      s   
zLsaTemplate_NT6.__init__c                 c   sÆ   � | j tjkr1| jtjjkrtdƒ‚| jtjjkrtdƒ‚t	d d D ]}t	d d | V  q#d S | j tj
kr_| jtjjkrBtdƒ‚| jtjjkrMtdƒ‚t	d d D ]}t	d d | V  qSd S d S )NzNT 5 is not yet supported!Únt6Úx86Úx64)Úarchitecturer   ÚX86Úbuildnumberr   ÚWIN_XPÚvalueÚ	ExceptionÚWIN_2K3Ú	templatesÚX64)ÚsysinfoÚkeyr   r   r   Úget_template_brute   s$   €ÿùz"LsaTemplate_NT6.get_template_brutec                 C   sf  t ƒ }| jtjkrÑ| jtjjkrtdƒ‚| jtj	jkr(d|_
td d d }�nttjj| j  kr7tjjk rCn n
td d d }�nYtjj| j  krRtjjk r^n n
td d d }�n>tjj| j  krmtjjk ryn n
td d d }�n#tjj| j  krˆtjjk r”n n
td d d	 }�ntjj| j  kr£tjjkr®n n	td d d }nîtjj| j  kr½tjjk rÈn n	td d d
 }nÔtd d d }nË| jtjk�r’| jtjjkrãtdƒ‚| jtj	jkrîtdƒ‚| jtjjk rþtd d d }nž| jtjjk �rtd d d }n�| jtjjk �r@| jtjjk �r7| jdk �r.td d d }nntd d d }netd d d	 }n\| jtjjk �rQtd d d }nKtjj| j  k�rbtjjk �rmn n	td d d
 }n/tjj| j  k�r~tjjk �r‰n n	td d d }ntd d d }n
td| j| jf ƒ‚| d|j¡ | d|j¡ | d|j¡ |S )NzMaybe implemented laterÚ5Únt5r   Ú1r   Ú2Ú3Ú4r
   Ú7r   i   `Ú8Ú9zEMissing LSA decrpytor template for Architecture: %s , Build number %sr   r   r   )r	   r   r   r   r   r   r   r    r!   r"   r   r#   Ú	WIN_VISTAÚWIN_7ÚWIN_8ÚWIN_BLUEÚWIN_10r   ÚWIN_10_1507ÚWIN_10_1909r$   Úmsv_dll_timestampÚWIN_10_1809ÚWIN_11ÚWIN_11_24H2Úlog_templater   r   r   )r%   Útemplater   r   r   Úget_template+   s^   """"""&&zLsaTemplate_NT6.get_template)Ú__name__Ú
__module__Ú__qualname__r   Ústaticmethodr'   r>   Ú__classcell__r   r   r   r   r	      s    	
r	   c                   @   ó   e Zd Zdd„ ZdS )ÚLSADecyptorKeyPatternc                 C   ó"   d | _ d | _d | _d | _d | _d S ©N)Ú	signatureÚoffset_to_IV_ptrÚ	IV_lengthÚoffset_to_AES_key_ptrÚoffset_to_DES_key_ptrr   r   r   r   r   z   ó
   
zLSADecyptorKeyPattern.__init__N©r?   r@   rA   r   r   r   r   r   rE   y   ó    rE   c                   @   s    e Zd Zdd„ Zedd„ ƒZdS )r   c                 C   s   d | _ d | _d S rG   )ÚcbSecretÚdatar   r   r   r   r   ‚   s   
zKIWI_HARD_KEY.__init__c                 Ã   s2   �t ƒ }t | ¡I d H |_|  |j¡I d H |_|S rG   )ÚKIWI_BCRYPT_KEYr   Ú	loadvaluerP   ÚreadrQ   ©ÚreaderÚresr   r   r   Úload†   s
   €zKIWI_HARD_KEY.loadN)r?   r@   rA   r   rB   rX   r   r   r   r   r   �   s    r   c                   @   ó(   e Zd Zdd„ Zedd„ ƒZdd„ ZdS )rR   c                 C   s.   d | _ d | _d | _d | _d | _d | _d | _d S rG   )ÚsizeÚtagÚtypeÚunk0Úunk1Úunk2Úhardkeyr   r   r   r   r   Ž   s   
zKIWI_BCRYPT_KEY.__init__c                 Ã   sŠ   �t ƒ }t | ¡I d H |_|  d¡I d H |_t | ¡I d H |_t | ¡I d H |_t | ¡I d H |_t | ¡I d H |_	t
 | ¡I d H |_|S ©Né   )rR   r   rS   rZ   rT   r[   r\   r]   r^   r_   r   rX   r`   rU   r   r   r   rX   —   s   €zKIWI_BCRYPT_KEY.loadc                 C   ó
   | j dkS ©Ns   KSSM©r[   r   r   r   r   Úverify£   ó   
zKIWI_BCRYPT_KEY.verifyN©r?   r@   rA   r   rB   rX   rf   r   r   r   r   rR   �   s
    	
rR   c                   @   rY   )ÚKIWI_BCRYPT_KEY8c                 C   s:   d | _ d | _d | _d | _d | _d | _d | _d | _d | _d S rG   )	rZ   r[   r\   r]   r^   r_   Úunk3Úunk4r`   r   r   r   r   r   §   s   
zKIWI_BCRYPT_KEY8.__init__c                 Ã   s¼   �t ƒ }t | ¡I d H |_|  d¡I d H |_t | ¡I d H |_t | ¡I d H |_t | ¡I d H |_t | ¡I d H |_	t | ¡I d H |_
|  ¡ I d H  t | ¡I d H |_t | ¡I d H |_|S ra   )ri   r   rS   rZ   rT   r[   r\   r]   r^   r_   rj   Úalignr   rX   rk   r   r`   rU   r   r   r   rX   ³   s   €zKIWI_BCRYPT_KEY8.loadc                 C   rc   rd   re   r   r   r   r   rf   Â   rg   zKIWI_BCRYPT_KEY8.verifyNrh   r   r   r   r   ri   ¦   s
    
ri   c                   @   rY   )ÚKIWI_BCRYPT_KEY81c                 C   sX   d | _ d | _d | _d | _d | _d | _d | _d | _d | _d | _	d | _
d | _d | _d | _d S rG   )rZ   r[   r\   r]   r^   r_   rj   rk   Úunk5Úunk6Úunk7Úunk8Úunk9r`   r   r   r   r   r   Æ   s   
zKIWI_BCRYPT_KEY81.__init__c                 Ã   s  �t ƒ }t | ¡I d H |_|  d¡I d H |_t | ¡I d H |_t | ¡I d H |_t | ¡I d H |_t | ¡I d H |_	t | ¡I d H |_
t | ¡I d H |_|  ¡ I d H  t | ¡I d H |_t | ¡I d H |_t | ¡I d H |_t | ¡I d H |_t | ¡I d H |_t | ¡I d H |_|S ra   )rm   r   rS   rZ   rT   r[   r\   r]   r^   r_   rj   rk   rl   r   rX   rn   ro   rp   rq   rr   r   r`   rU   r   r   r   rX   ×   s$   €zKIWI_BCRYPT_KEY81.loadc                 C   rc   rd   re   r   r   r   r   rf   ë   rg   zKIWI_BCRYPT_KEY81.verifyNrh   r   r   r   r   rm   Å   s
    
rm   c                   @   rY   )ÚKIWI_BCRYPT_KEY81_NEWc                 C   s^   d | _ d | _d | _d | _d | _d | _d | _d | _d | _d | _	d | _
d | _d | _d | _d | _d S rG   )rZ   r[   r\   r]   r^   r_   rj   rk   rn   ro   rp   rq   rr   Úunk10r`   r   r   r   r   r   ð   s   
zKIWI_BCRYPT_KEY81_NEW.__init__c                 Ã   s(  �t ƒ }t | ¡I d H |_|  d¡I d H |_t | ¡I d H |_t | ¡I d H |_t | ¡I d H |_t | ¡I d H |_	t | ¡I d H |_
t | ¡I d H |_|  ¡ I d H  t | ¡I d H |_t | ¡I d H |_t | ¡I d H |_t | ¡I d H |_t | ¡I d H |_t | ¡I d H |_t | ¡I d H |_|S ra   )rs   r   rS   rZ   rT   r[   r\   r]   r^   r_   rj   rk   rl   r   rX   rn   ro   rp   rq   rr   rt   r   r`   rU   r   r   r   rX     s&   €zKIWI_BCRYPT_KEY81_NEW.loadc                 C   rc   rd   re   r   r   r   r   rf     rg   zKIWI_BCRYPT_KEY81_NEW.verifyNrh   r   r   r   r   rs   ï   s
    
rs   c                       s(   e Zd Z‡ fdd„Zedd„ ƒZ‡  ZS )ÚPKIWI_BCRYPT_KEYc                    s   t ƒ  ¡  d S rG   )r   r   r   r   r   r   r     s   zPKIWI_BCRYPT_KEY.__init__c                 Ã   s,   �t ƒ }|  ¡ |_|  ¡ I d H |_t|_|S rG   )r   ÚtellÚlocationÚ	read_uintr    rR   Ú	finaltype)rV   Úpr   r   r   rX     s   €
zPKIWI_BCRYPT_KEY.load)r?   r@   rA   r   rB   rX   rC   r   r   r   r   ru     s    ru   c                   @   rY   )ÚKIWI_BCRYPT_HANDLE_KEYc                 C   rF   rG   )rZ   r[   Ú
hAlgorithmÚptr_keyr]   r   r   r   r   r   '  rM   zKIWI_BCRYPT_HANDLE_KEY.__init__c                 Ã   sf   �t ƒ }t | ¡I d H |_|  d¡I d H |_t | ¡I d H |_t	 | ¡I d H |_
t | ¡I d H |_|S ra   )r{   r   rS   rZ   rT   r[   r   rX   r|   ru   r}   r]   rU   r   r   r   rX   .  s   €zKIWI_BCRYPT_HANDLE_KEY.loadc                 C   rc   )Ns   RUUUre   r   r   r   r   rf   8  rg   zKIWI_BCRYPT_HANDLE_KEY.verifyNrh   r   r   r   r   r{   &  s
    
	r{   c                   @   rD   )Ú	LSA_x64_1c                 C   óJ   t  | ¡ tƒ | _d| j_d| j_d| j_d| j_d| j_t	| _
t| _d S )Nó   ƒd$0 D‹L$HH‹é   é?   é»ÿÿÿé   ©r	   r   rE   r   rH   rJ   rI   rL   rK   rR   r   r{   r   r   r   r   r   r   <  ó   

zLSA_x64_1.__init__NrN   r   r   r   r   r~   ;  rO   r~   c                   @   rD   )Ú	LSA_x64_2c                 C   r   )Nr€   r�   é;   iÃÿÿÿr„   r…   r   r   r   r   r   I  r†   zLSA_x64_2.__init__NrN   r   r   r   r   r‡   H  rO   r‡   c                   @   rD   )Ú	LSA_x64_3c                 C   r   ©Nó   ƒd$0 D‹MØH‹r�   é>   iºÿÿÿé   ©r	   r   rE   r   rH   rJ   rI   rL   rK   ri   r   r{   r   r   r   r   r   r   W  r†   zLSA_x64_3.__init__NrN   r   r   r   r   r‰   V  rO   r‰   c                   @   rD   )Ú	LSA_x64_4c                 C   r   rŠ   ©r	   r   rE   r   rH   rJ   rI   rL   rK   rm   r   r{   r   r   r   r   r   r   d  r†   zLSA_x64_4.__init__NrN   r   r   r   r   r�   c  rO   r�   c                   @   rD   )Ú	LSA_x64_5c                 C   óJ   t  | ¡ tƒ | _d| j_d| j_d| j_d| j_d| j_t	| _
t| _d S )Nó   ƒd$0 H�EàD‹MØH�r�   é=   i·ÿÿÿr�   r   r   r   r   r   q  r†   zLSA_x64_5.__init__NrN   r   r   r   r   r‘   p  rO   r‘   c                   @   rD   )Ú	LSA_x64_6c                 C   r’   )Nr“   r�   éC   é§ÿÿÿr�   r   r   r   r   r   ~  r†   zLSA_x64_6.__init__NrN   r   r   r   r   r•   }  rO   r•   c                   @   rD   )Ú	LSA_x64_7c                 C   r   )Nr‹   r�   é:   iÂÿÿÿr�   rŽ   r   r   r   r   r   ‹  r†   zLSA_x64_7.__init__NrN   r   r   r   r   r˜   Š  rO   r˜   c                   @   rD   )Ú	LSA_x64_8c                 C   r’   )Nr“   r�   r™   r—   r�   r   r   r   r   r   ˜  r†   zLSA_x64_8.__init__NrN   r   r   r   r   rš   —  rO   rš   c                   @   rD   )Ú	LSA_x64_9c                 C   r’   )Nr“   r�   éG   r—   r�   r   r   r   r   r   ¥  r†   zLSA_x64_9.__init__NrN   r   r   r   r   r›   ¤  rO   r›   c                   @   rD   )Ú	LSA_x86_1c                 C   r   ©Nó   jjhr�   é   i´ÿÿÿiëÿÿÿr…   r   r   r   r   r   ²  r†   zLSA_x86_1.__init__NrN   r   r   r   r   r�   ±  rO   r�   c                   @   rD   )Ú	LSA_x86_2c                 C   r   rž   r…   r   r   r   r   r   ¿  r†   zLSA_x86_2.__init__NrN   r   r   r   r   r¡   ¾  rO   r¡   c                   @   rD   )Ú	LSA_x86_3c                 C   r   ©NrŸ   r�   r    rƒ   iîÿÿÿrŽ   r   r   r   r   r   Ì  r†   zLSA_x86_3.__init__NrN   r   r   r   r   r¢   Ë  rO   r¢   c                   @   rD   )Ú	LSA_x86_4c                 C   r   r£   r�   r   r   r   r   r   Ù  r†   zLSA_x86_4.__init__NrN   r   r   r   r   r¤   Ø  rO   r¤   c                   @   rD   )Ú	LSA_x86_5c                 C   r   ©NrŸ   r�   r    i±ÿÿÿiêÿÿÿr�   r   r   r   r   r   æ  r†   zLSA_x86_5.__init__NrN   r   r   r   r   r¥   å  rO   r¥   c                   @   rD   )Ú	LSA_x86_6c                 C   r   r¦   r�   r   r   r   r   r   ó  ó   

zLSA_x86_6.__init__NrN   r   r   r   r   r§   ò  rO   r§   c                   @   rD   )Ú	LSA_x86_7c                 C   r   r¦   )r	   r   rE   r   rH   rJ   rI   rL   rK   rs   r   r{   r   r   r   r   r   r     r¨   zLSA_x86_7.__init__NrN   r   r   r   r   r©      rO   r©   r   )	r*   r+   r,   r-   r(   r
   r.   r/   r0   )r*   r+   r,   r-   r(   r
   r.   )r   r   N)$Ú$pypykatz.alsadecryptor.win_datatypesr   r   r   Úpypykatz.commons.commonr   r   r   Ú&pypykatz.alsadecryptor.package_commonsr   r	   rE   r   rR   ri   rm   rs   ru   r{   r~   r‡   r‰   r�   r‘   r•   r˜   rš   r›   r�   r¡   r¢   r¤   r¥   r§   r©   r#   r   r   r   r   Ú<module>   sb   m*+÷ùôÿ