o
    Žõ±j  ã                   @   s†   d dl Z e  ¡ dkredƒ‚d dlZd dlmZ d dlmZ d dlT d dl	T d dl
T d dlT d dlmZ d dlmZ G d	d
„ d
ƒZdS )é    NÚWindowsz'This will ONLY work on Windows systems!)ÚLiveRegistryHive)Úlogger)Ú*)ÚProcessManipulator)ÚUniversalEncoderc                   @   sV   e Zd ZdZdd„ Zdd„ Zdd„ Zdd	d
„Zdd„ Zdd„ Z	dd„ Z
edd„ ƒZdS )ÚLiveRegistryzµ
	This class represents the Registry hives that are currently on the live system.
	Use this in case you have at least Administrative privileges on a comp where pypykatz is running
	c                 C   s4   d | _ d | _d | _d | _d | _d | _d | _d | _d S ©N)Úsam_hiveÚsecurity_hiveÚsystem_hiveÚsoftware_hiveÚsystemÚsamÚsecurityÚsoftware©Úself© r   ú�/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/registry/live_parser.pyÚ__init__   s   
zLiveRegistry.__init__c              
   C   sò   t ƒ }z| ¡  W n ty } zt d¡ |‚d}~ww t| jƒ| _| j ¡ }| j	r7t
| j	|ƒ| _| j ¡  | jrFt| j|ƒ| _| j ¡  | jrszt| j|ƒ| _| j ¡  W n tyr } zt dt|ƒ ¡ W Y d}~nd}~ww |  ¡  dS )au  
		For obtaining all secrets from the registry on-the-fly, SYSTEM user MUST be used!
		In case this is not achievable, Administrator can be used to first dump the registry hives to disk, then parse them offline
		There is a 3rd way: As administrator you can obtain SE_TAKE_OWNERSHIP privileges, then you can open any hive with the WRITE_OWNER permission. 
			After doing that you'd need to change the SID of each target hive to include the administrator user with full access.
			This is so intrusive I'm not implementing that, if you mess that up your computer will turn to potato. Like literally... (also it's a lot of work)
		zBFailed to obtain SYSTEM prvis. On-the-fly parsing is not possible.Nz)Failed to parse SOFTWARE hive. Reason: %s)r   Úassign_token_thread_sidÚ	Exceptionr   ÚerrorÚSYSTEMr   r   Úget_bootkeyr
   ÚSAMr   Úget_secretsr   ÚSECURITYr   r   ÚSOFTWAREr   Úget_default_logonÚwarningÚstrÚcleanup)r   ÚpmÚeÚbootkeyr   r   r   r   '   s2   
€þ


€ÿzLiveRegistry.get_secretsc                 C   s0   | j | j| jfD ]}z| ¡  W q   Y qd S r	   )r   r   r
   Úclose)r   Úhiver   r   r   r#   J   s   üzLiveRegistry.cleanupFc                 C   sj   t |ddd��$}|dkr| t| ƒ¡ n| |  ¡ ¡ W d   ƒ d S W d   ƒ d S 1 s.w   Y  d S )NÚaÚ )ÚnewlineF)ÚopenÚwriter"   Úto_json)r   Ú	file_pathÚjson_formatÚfr   r   r   Úto_fileQ   s   ü"þzLiveRegistry.to_filec                 C   s   t j|  ¡ tddd�S )Né   T)ÚclsÚindentÚ	sort_keys)ÚjsonÚdumpsÚto_dictr   r   r   r   r   r.   X   s   zLiveRegistry.to_jsonc                 C   sR   i }| j  ¡ |d< | jr| j ¡ |d< | jr| j ¡ |d< | jr'| j ¡ |d< |S )Nr   r   r   r   )r   r9   r   r   r   ©r   Útr   r   r   r9   [   s   zLiveRegistry.to_dictc                 C   s6   t | jƒ}| jr|t | jƒ7 }| jr|t | jƒ7 }|S r	   )r"   r   r   r   r:   r   r   r   Ú__str__f   s   
zLiveRegistry.__str__c                  C   s:   t ƒ } tdƒ| _tdƒ| _tdƒ| _tdƒ| _|  ¡  | S )Nr   r   r   r   )r   r   r
   r   r   r   r   )Úlrr   r   r   Úgo_liven   s   



zLiveRegistry.go_liveN)F)Ú__name__Ú
__module__Ú__qualname__Ú__doc__r   r   r#   r2   r.   r9   r<   Ústaticmethodr>   r   r   r   r   r      s    #
r   )Úplatformr   r   r7   Ú-pypykatz.commons.readers.registry.live.readerr   Úpypykatz.registryr   Úpypykatz.registry.sam.samÚ#pypykatz.registry.security.securityÚpypykatz.registry.system.systemÚ#pypykatz.registry.software.softwareÚ*pypykatz.commons.winapi.processmanipulatorr   Úpypykatz.commons.commonr   r   r   r   r   r   Ú<module>   s   