o
    Žõ±j„"  ã                   @   sÎ   d dl Z d dlmZ d dlmZ d dlmZmZmZ d dl	m
Z
mZ d dlmZmZmZmZmZmZmZmZmZ d dlmZmZmZ d dlZd dlZd dlZG dd	„ d	ejƒZG d
d„ dƒZG dd„ dƒZ dS )é    N)Úcore)Úfiletime_to_dt)ÚWindowsBuildÚGenericReaderÚhexdump)ÚLSAISO_DATA_BLOBÚENC_LSAISO_DATA_BLOB)	ÚEncryptionKeyÚPrincipalNameÚTicketFlagsÚKrbCredInfoÚ	krb5_pvnoÚEncryptedDataÚKRBCREDÚTicketÚEncKrbCredPart)Ú	NAME_TYPEÚMESSAGE_TYPEÚEncryptionTypec                   @   s$   e Zd Ze ¡ Ze ¡ Ze ¡ ZdS )ÚKerberosTicketTypeN)Ú__name__Ú
__module__Ú__qualname__ÚenumÚautoÚTGTÚTGSÚCLIENT© r   r   ú’/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/commons/kerberosticket.pyr      s    r   c                   @   s    e Zd Zdd„ Zedd„ ƒZdS )ÚKerberosSessionKeyc                 C   s   d | _ d | _d S ©N)ÚkeydataÚ
sessionkey©Úselfr   r   r   Ú__init__   s   
zKerberosSessionKey.__init__c                 C   s–   t ƒ }| j|_|jtjjk s| jtj	k r|j|_
|S t|j|jd�}| jtj	tdƒ d d kr;t|ƒ}| d¡|_n
t|ƒ}| d¡|_|j|_
|S )N)Úprocessor_architectureÚKerberosKeyé   é    éÿÿÿÿ)r    ÚDatar"   Úbuildnumberr   ÚWIN_10_1507ÚvalueÚLengthr   Úsizer#   r   ÚarchitectureÚlenÚreadr   )Ú
key_structÚsysinfoÚkskÚreaderÚblobr   r   r   Úparse    s   ÷zKerberosSessionKey.parseN)r   r   r   r&   Ústaticmethodr:   r   r   r   r   r       s    r    c                   @   sX   e Zd Zdd„ Zdd„ Zdd„ Zeddd	„ƒZedd
d„ƒZdd„ Z	dd„ Z
dd„ ZdS )ÚKerberosTicketc                 C   sˆ   d | _ d | _d | _d | _d | _d | _d | _d | _d | _d | _	d | _
d | _d | _d | _d | _d | _d | _d | _d | _d | _i | _d | _d S r!   )ÚtypeÚServiceNameÚServiceName_typeÚ
DomainNameÚETargetNameÚETargetName_typeÚTargetDomainNameÚEClientNameÚEClientName_typeÚAltTargetDomainNameÚDescriptionÚ	StartTimeÚEndTimeÚ
RenewUntilÚKeyTypeÚKeyr   ÚTicketEncTypeÚ
TicketKvnor   Ú
kirbi_dataÚsession_keyr$   r   r   r   r&   4   s,   
zKerberosTicket.__init__c                 C   s€   i }| j |d< | j|d< | j|d< | j|d< | j|d< | j|d< | j|d< | j|d< | j|d	< | j	|d
< | j
|d< | j|d< |S )Nr=   r>   r@   rA   rC   rD   rF   rH   rI   rJ   rK   rL   )r=   r>   r@   rA   rC   rD   rF   rH   rI   rJ   rK   rL   ©r%   Útr   r   r   Úto_dictS   s   











zKerberosTicket.to_dictc                 C   s4  i }t | j| jdœƒ|d< | j|d< t| j| jdœƒ|d< t | j	¡ 
t	¡|d< | j|d< | j|d< | j|d	< | j|d
< t| j| jdœƒ|d< i }t|ƒg|d< i }t|d< | j|d< ttjj| jdœƒ|d< t| j| j| jdœƒ|d< i }t|d< tjj|d< t|ƒg|d< ttjjt|ƒ ¡ dœƒ|d< t |ƒS )N)ÚkeytypeÚkeyvalueÚkeyÚprealm)z	name-typezname-stringÚpnameÚflagsÚ	starttimeÚendtimez
renew-tillÚsrealmÚsnamezticket-infoztkt-vnoÚrealm)ÚetypeÚkvnoÚcipherzenc-partÚpvnozmsg-typeÚtickets)r_   ra   )!r	   rK   rL   rF   r
   rE   rD   r   ÚIntegerBitStringr   ÚcastrH   rI   rJ   r@   r?   r>   r   r   r   ÚSRV_INSTr/   r   rM   rN   r   r   ÚKRB_CREDr   ÚNULLr   Údumpr   )r%   ÚkrbcredinfoÚenc_krbcredÚticketÚkrbcredr   r   r   Úto_asn1f   s.   





zKerberosTicket.to_asn1Nc                 C   sn  t ƒ }||_| j |¡j|_| j |¡ |¡|_| j |¡|_| j |¡r7| j |¡ |¡|_	| j |¡j|_
| j |¡|_| j |¡ |¡|_| j |¡j|_| j |¡|_| j |¡|_t| jƒ|_t| jƒ|_| jdkr~tjdddddtjjd�|_nt| jƒ|_| j|_| j |¡|_t | j|¡|_| j|_| j|_| j|_| j  |¡|_ | !¡ }||j"| #¡ < |S ©Nr   i²  r)   )Útzinfo©$r<   r=   r>   r4   ÚNameTyper?   r@   Úread_stringÚ
TargetNamerA   rB   rC   Ú
ClientNamerD   rE   rF   rG   r   rH   rI   rJ   ÚdatetimeÚtimezoneÚutcrK   rL   r    r:   rP   r   rM   rN   r   rn   rO   Úgenerate_filename)Úkerberos_ticketr8   r6   r=   ÚktÚkirbir   r   r   r:   ƒ   s8   
zKerberosTicket.parsec                 Ã   sì  �t ƒ }||_| j |¡I d H }|j|_| j |¡I d H }| |¡I d H |_| j |¡I d H |_| j |¡I d H }|rZ| j |¡I d H }| |¡I d H |_	| j |¡I d H }|j|_
| j |¡I d H |_| j |¡I d H }| |¡I d H |_| j |¡I d H }|j|_| j |¡I d H |_| j |¡I d H |_t| jƒ|_t| jƒ|_| jdkr·tjdddddtjjd�|_nt| jƒ|_| j|_| j |¡I d H |_t | j|¡|_| j|_| j|_| j|_| j  |¡I d H |_ | !¡ }||j"| #¡ < |S ro   rq   )rz   r8   r6   r=   r{   ÚxÚyr|   r   r   r   Úaparse¨   sH   €
zKerberosTicket.aparsec              
   C   sR   dd  | jj| jd  | j¡d  | j¡t | j¡ 	¡ d d… g¡ }d| 
dd¡ S )Nz%sÚ_é   z%s.kirbiz..ú!)Újoinr=   Únamer@   rD   r>   ÚhashlibÚsha1r   Ú	hexdigestÚreplacerQ   r   r   r   ry   Ô   s   Bz KerberosTicket.generate_filenamec              	   C   sX   | j D ]&}ttj ||¡dƒ�}| | j |  ¡ ¡ W d   ƒ n1 s$w   Y  qd S )NÚwb)rO   ÚopenÚosÚpathrƒ   Úwriteri   )r%   ÚdirÚfilenameÚfr   r   r   Úto_kirbiØ   s   
ÿ€ÿzKerberosTicket.to_kirbic                 C   s  d}|d| j  7 }|d| j 7 }|d| j 7 }|d| j 7 }|d| j 7 }|d| j 7 }|d| j 7 }|d	| j 7 }|d
| j 	¡  7 }|d| j
 	¡  7 }|d| j 	¡  7 }|d| j 7 }|d| j ¡  7 }|d| j 7 }|d| j 7 }|d| j 7 }|d| j ¡  7 }|d| jj ¡  7 }|S )Nz== Kerberos Ticket ==
z	Type: %s
zServiceName: %s
zDomainName: %s
zETargetName: %s
zTargetDomainName: %s
zEClientName: %s
zAltTargetDomainName: %s
zDescription: %s
zStartTime: %s
zEndTime: %s
zRenewUntil: %s
zKeyType: %s
zKey: %s
zTicketFlags: %s
zTicketEncType: %s
zTicketKvno: %s
zTicket: %s
zSessionKey: %s
)r=   r>   r@   rA   rC   rD   rF   rG   rH   Ú	isoformatrI   rJ   rK   rL   Úhexr   rM   rN   r   rP   r#   rQ   r   r   r   Ú__str__Ý   s(   zKerberosTicket.__str__r!   )r   r   r   r&   rS   rn   r;   r:   r   ry   r‘   r”   r   r   r   r   r<   3   s    $+r<   )!rv   Ú
asn1cryptor   Úpypykatz.commons.filetimer   Úpypykatz.commons.commonr   r   r   Úpypykatz.commons.win_datatypesr   r   Ú"minikerberos.protocol.asn1_structsr	   r
   r   r   r   r   r   r   r   Úminikerberos.protocol.constantsr   r   r   r   r‹   r…   ÚEnumr   r    r<   r   r   r   r   Ú<module>   s   ,