o
    Žõ±jÐ>  ã                   @   s  d dl mZmZmZ d dlmZmZmZ d dlm	Z	 d dl
mZ G dd„ de	ƒZG dd„ dƒZG d	d
„ d
ƒZG dd„ dƒZG dd„ dƒZG dd„ dƒZG dd„ dƒZG dd„ deƒZG dd„ dƒZG dd„ deƒZG dd„ deƒZG dd„ deƒZG dd„ deƒZG dd „ d eƒZG d!d"„ d"eƒZG d#d$„ d$eƒZG d%d&„ d&eƒZG d'd(„ d(eƒZG d)d*„ d*eƒZG d+d,„ d,eƒZG d-d.„ d.eƒZ G d/d0„ d0eƒZ!G d1d2„ d2eƒZ"G d3d4„ d4eƒZ#G d5d6„ d6eƒZ$d7eƒ eƒ eƒ eƒ eƒ eƒ eƒ eƒ eƒ d8œ	eƒ eƒ e ƒ e!ƒ e"ƒ e#ƒ e$ƒ d9œd:œiZ%d;S )<é    )ÚULONGÚPVOIDÚPOINTER)ÚKatzSystemArchitectureÚWindowsMinBuildÚWindowsBuild)ÚPackageTemplate)Úloggerc                       s4   e Zd Z‡ fdd„Zedd„ ƒZedd„ ƒZ‡  ZS )ÚLsaTemplate_NT6c                    s.   t ƒ  d¡ d | _d | _d | _t| _d| _d S )NzLSA DecryptorÚ6)ÚsuperÚ__init__Úkey_patternÚkey_handle_structÚ
key_structÚKIWI_HARD_KEYÚhard_key_structÚnt_major©Úself©Ú	__class__© ú™/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/lsadecryptor/lsa_template_nt6.pyr      s   
zLsaTemplate_NT6.__init__c                 c   s  � | j tjkr>| jtjjkrtdƒ‚| jtjjkrtdƒ‚dd„ t	d d D ƒ}|j
dd� |D ]}t	d d | V  q0d S | j tjkr€| jtjjkrOtdƒ‚| jtjjkrZtdƒ‚dd„ t	d d	 D ƒ}|j
dd� |D ]}t d
| ¡ t	d d	 | V  qmd S d S )NzNT 5 is not yet supported!c                 S   ó   g | ]}|‘qS r   r   ©Ú.0Úxr   r   r   Ú
<listcomp>   ó    z6LsaTemplate_NT6.get_template_brute.<locals>.<listcomp>Únt6Úx86T)Úreversec                 S   r   r   r   r   r   r   r   r   *   r   Úx64zBF: using x64 - %s)Úarchitecturer   ÚX86Úbuildnumberr   ÚWIN_XPÚvalueÚ	ExceptionÚWIN_2K3Ú	templatesÚsortÚX64r	   Údebug)ÚsysinfoÚkeysÚkeyr   r   r   Úget_template_brute   s.   €ÿöz"LsaTemplate_NT6.get_template_brutec                 C   sÖ  t ƒ }t d| j ¡ | jtjkrÛ| jtjj	krt
dƒ‚| jtjj	kr0d|_td d d }�n¤tjj	| j  kr?tjj	k rKn n
td d d }�n‰tjj	| j  krZtjj	k rfn n
td d d }�nntjj	| j  krutjj	k r�n n
td d d	 }�nStjj	| j  kr�tjj	k rœn n
td d d
 }�n8tjj	| j  kr«tjj	kr·n n
td d d }�ntjj	| j  krÆtjj	k rÒn n
td d d }�ntd d d }nù| jtjk�rÊ| jtjj	krít
dƒ‚| jtjj	krøt
dƒ‚| jtjj	k �rt d¡ td d d }nÆ| jtjj	k �r$t d¡ td d d }n°| jtjj	k �rd| jtjj	k �rV| jdk �rHt d¡ td d d	 }nŒt d¡ td d d }n~t d¡ td d d
 }np| jtjj	k �rzt d¡ td d d }nZtjj	| j  k�r‹tjj	k �r›n nt d¡ td d d }n9tjj	| j  k�r¬tjj	k �r¼n nt d¡ td d d }nt d¡ td d d }n
t
d| j| jf ƒ‚| d|j¡ | d|j¡ | d|j¡ |S )NzBuildnumber: %szMaybe implemented laterÚ5Únt5r!   Ú1r    Ú2Ú3Ú4r   Ú7zusing x64 - 1r#   zusing x64 - 2i   `zusing x64 - 3zusing x64 - 7zusing x64 - 4zusing x64 - 5zusing x64 - 6zusing x64 - 8Ú8zusing x64 - 9Ú9zEMissing LSA decrpytor template for Architecture: %s , Build number %sr   r   r   )r
   r	   r.   r&   r$   r   r%   r   r'   r(   r)   r*   r   r+   Ú	WIN_VISTAÚWIN_7ÚWIN_8ÚWIN_BLUEÚWIN_10r   ÚWIN_10_1507ÚWIN_10_1909r-   Úmsv_dll_timestampÚWIN_10_1809ÚWIN_11ÚWIN_11_24H2Úlog_templater   r   r   )r/   Útemplater   r   r   Úget_template1   sr   """"""





&
&

zLsaTemplate_NT6.get_template)Ú__name__Ú
__module__Ú__qualname__r   Ústaticmethodr2   rI   Ú__classcell__r   r   r   r   r
      s    	
r
   c                   @   ó   e Zd Zdd„ ZdS )ÚLSADecyptorKeyPatternc                 C   s"   d | _ d | _d | _d | _d | _d S ©N)Ú	signatureÚoffset_to_IV_ptrÚ	IV_lengthÚoffset_to_AES_key_ptrÚoffset_to_DES_key_ptrr   r   r   r   r   Š   s
   
zLSADecyptorKeyPattern.__init__N©rJ   rK   rL   r   r   r   r   r   rP   ‰   ó    rP   c                   @   rO   )r   c                 C   s   t |ƒj| _| | j¡| _d S rQ   )r   r(   ÚcbSecretÚreadÚdata©r   Úreaderr   r   r   r   ’   s   zKIWI_HARD_KEY.__init__NrW   r   r   r   r   r   ‘   rX   r   c                   @   ó   e Zd Zdd„ Zdd„ ZdS )ÚKIWI_BCRYPT_KEYc                 C   sV   t |ƒj| _| d¡| _t |ƒj| _t |ƒj| _t |ƒj| _t |ƒj| _t	|ƒ| _
d S ©Né   )r   r(   ÚsizerZ   ÚtagÚtypeÚunk0Úunk1Úunk2r   Úhardkeyr\   r   r   r   r   —   s   zKIWI_BCRYPT_KEY.__init__c                 C   ó
   | j dkS ©Ns   KSSM©rc   r   r   r   r   Úverify    ó   
zKIWI_BCRYPT_KEY.verifyN©rJ   rK   rL   r   rl   r   r   r   r   r_   –   s    	r_   c                   @   r^   )ÚKIWI_BCRYPT_KEY8c                 C   sv   t |ƒj| _| d¡| _t |ƒj| _t |ƒj| _t |ƒj| _t |ƒj| _t |ƒj| _	| 
¡  t|ƒj| _t|ƒ| _d S r`   )r   r(   rb   rZ   rc   rd   re   rf   rg   Úunk3Úalignr   Úunk4r   rh   r\   r   r   r   r   ¤   s   zKIWI_BCRYPT_KEY8.__init__c                 C   ri   rj   rk   r   r   r   r   rl   °   rm   zKIWI_BCRYPT_KEY8.verifyNrn   r   r   r   r   ro   £   s    ro   c                   @   r^   )ÚKIWI_BCRYPT_KEY81c                 C   s²   t |ƒj| _| d¡| _t |ƒj| _t |ƒj| _t |ƒj| _t |ƒj| _t |ƒj| _	t |ƒj| _
| ¡  t|ƒj| _t |ƒj| _t |ƒj| _t |ƒj| _t |ƒj| _t|ƒ| _d S r`   )r   r(   rb   rZ   rc   rd   re   rf   rg   rp   rr   rq   r   Úunk5Úunk6Úunk7Úunk8Úunk9r   rh   r\   r   r   r   r   ´   s   zKIWI_BCRYPT_KEY81.__init__c                 C   ri   rj   rk   r   r   r   r   rl   Å   rm   zKIWI_BCRYPT_KEY81.verifyNrn   r   r   r   r   rs   ³   s    rs   c                   @   r^   )ÚKIWI_BCRYPT_KEY81_NEWc                 C   s¾   t |ƒj| _| d¡| _t |ƒj| _t |ƒj| _t |ƒj| _t |ƒj| _t |ƒj| _	t |ƒj| _
| ¡  t|ƒj| _t |ƒj| _t |ƒj| _t |ƒj| _t |ƒj| _t |ƒj| _t|ƒ| _d S r`   )r   r(   rb   rZ   rc   rd   re   rf   rg   rp   rr   rq   r   rt   ru   rv   rw   rx   Úunk10r   rh   r\   r   r   r   r   É   s    zKIWI_BCRYPT_KEY81_NEW.__init__c                 C   ri   rj   rk   r   r   r   r   rl   Û   rm   zKIWI_BCRYPT_KEY81_NEW.verifyNrn   r   r   r   r   ry   È   s    ry   c                       s   e Zd Z‡ fdd„Z‡  ZS )ÚPKIWI_BCRYPT_KEYc                    s   t ƒ  |t¡ d S rQ   )r   r   r_   r\   r   r   r   r   à   s   zPKIWI_BCRYPT_KEY.__init__)rJ   rK   rL   r   rN   r   r   r   r   r{   ß   s    r{   c                   @   r^   )ÚKIWI_BCRYPT_HANDLE_KEYc                 C   s>   t |ƒj| _| d¡| _t|ƒj| _t|ƒ| _t|ƒj| _	d S r`   )
r   r(   rb   rZ   rc   r   Ú
hAlgorithmr{   Úptr_keyre   r\   r   r   r   r   ä   s
   
zKIWI_BCRYPT_HANDLE_KEY.__init__c                 C   ri   )Ns   RUUUrk   r   r   r   r   rl   ë   rm   zKIWI_BCRYPT_HANDLE_KEY.verifyNrn   r   r   r   r   r|   ã   s    r|   c                   @   rO   )Ú	LSA_x64_1c                 C   óJ   t  | ¡ tƒ | _d| j_d| j_d| j_d| j_d| j_t	| _
t| _d S )Nó   ƒd$0 D‹L$HH‹é   é?   é»ÿÿÿé   ©r
   r   rP   r   rR   rT   rS   rV   rU   r_   r   r|   r   r   r   r   r   r   ï   ó   

zLSA_x64_1.__init__NrW   r   r   r   r   r   î   rX   r   c                   @   rO   )Ú	LSA_x64_2c                 C   r€   )Nr�   r‚   é;   iÃÿÿÿr…   r†   r   r   r   r   r   ü   r‡   zLSA_x64_2.__init__NrW   r   r   r   r   rˆ   û   rX   rˆ   c                   @   rO   )Ú	LSA_x64_3c                 C   r€   ©Nó   ƒd$0 D‹MØH‹r‚   é>   iºÿÿÿé   ©r
   r   rP   r   rR   rT   rS   rV   rU   ro   r   r|   r   r   r   r   r   r   
  r‡   zLSA_x64_3.__init__NrW   r   r   r   r   rŠ   	  rX   rŠ   c                   @   rO   )Ú	LSA_x64_4c                 C   r€   r‹   ©r
   r   rP   r   rR   rT   rS   rV   rU   rs   r   r|   r   r   r   r   r   r     r‡   zLSA_x64_4.__init__NrW   r   r   r   r   r�     rX   r�   c                   @   rO   )Ú	LSA_x64_5c                 C   óJ   t  | ¡ tƒ | _d| j_d| j_d| j_d| j_d| j_t	| _
t| _d S )Nó   ƒd$0 H�EàD‹MØH�r‚   é=   i·ÿÿÿr‘   r   r   r   r   r   $  r‡   zLSA_x64_5.__init__NrW   r   r   r   r   r’   #  rX   r’   c                   @   rO   )Ú	LSA_x64_6c                 C   r“   )Nr”   r‚   éC   é§ÿÿÿr‘   r   r   r   r   r   1  r‡   zLSA_x64_6.__init__NrW   r   r   r   r   r–   0  rX   r–   c                   @   rO   )Ú	LSA_x64_7c                 C   r€   )NrŒ   r‚   é:   iÂÿÿÿrŽ   r�   r   r   r   r   r   >  r‡   zLSA_x64_7.__init__NrW   r   r   r   r   r™   =  rX   r™   c                   @   rO   )Ú	LSA_x64_8c                 C   r“   )Nr”   r‚   rš   r˜   r‘   r   r   r   r   r   K  r‡   zLSA_x64_8.__init__NrW   r   r   r   r   r›   J  rX   r›   c                   @   s   e Zd ZdZdd„ ZdS )Ú	LSA_x64_9z0Same as LSA_x64_8 but with a different IV offsetc                 C   r“   )Nr”   r‚   éG   r˜   r‘   r   r   r   r   r   Y  r‡   zLSA_x64_9.__init__N)rJ   rK   rL   Ú__doc__r   r   r   r   r   rœ   W  s    rœ   c                   @   rO   )Ú	LSA_x86_1c                 C   r€   ©Nó   jjhr‚   é   i´ÿÿÿiëÿÿÿr†   r   r   r   r   r   f  r‡   zLSA_x86_1.__init__NrW   r   r   r   r   rŸ   e  rX   rŸ   c                   @   rO   )Ú	LSA_x86_2c                 C   r€   r    r†   r   r   r   r   r   s  r‡   zLSA_x86_2.__init__NrW   r   r   r   r   r£   r  rX   r£   c                   @   rO   )Ú	LSA_x86_3c                 C   r€   ©Nr¡   r‚   r¢   r„   iîÿÿÿr�   r   r   r   r   r   €  r‡   zLSA_x86_3.__init__NrW   r   r   r   r   r¤     rX   r¤   c                   @   rO   )Ú	LSA_x86_4c                 C   r€   r¥   r‘   r   r   r   r   r   �  r‡   zLSA_x86_4.__init__NrW   r   r   r   r   r¦   Œ  rX   r¦   c                   @   rO   )Ú	LSA_x86_5c                 C   r€   ©Nr¡   r‚   r¢   i±ÿÿÿiêÿÿÿr‘   r   r   r   r   r   š  r‡   zLSA_x86_5.__init__NrW   r   r   r   r   r§   ™  rX   r§   c                   @   rO   )Ú	LSA_x86_6c                 C   r€   r¨   r‘   r   r   r   r   r   §  ó   

zLSA_x86_6.__init__NrW   r   r   r   r   r©   ¦  rX   r©   c                   @   rO   )Ú	LSA_x86_7c                 C   r€   r¨   )r
   r   rP   r   rR   rT   rS   rV   rU   ry   r   r|   r   r   r   r   r   r   µ  rª   zLSA_x86_7.__init__NrW   r   r   r   r   r«   ´  rX   r«   r    )	r5   r6   r7   r8   r3   r   r9   r:   r;   )r5   r6   r7   r8   r3   r   r9   )r#   r!   N)&Úminidump.win_datatypesr   r   r   Úpypykatz.commons.commonr   r   r   Ú%pypykatz.lsadecryptor.package_commonsr   Úpypykatzr	   r
   rP   r   r_   ro   rs   ry   r{   r|   r   rˆ   rŠ   r�   r’   r–   r™   r›   rœ   rŸ   r£   r¤   r¦   r§   r©   r«   r+   r   r   r   r   Ú<module>   sd   |÷ùôÿ