o j@s~ddlZddlmZddlmZddlmZddlTddlTddl Tddl TGdddZ e dkr=e ZeeedSdS) N) AIOWinRegHive)logger)UniversalEncoder)*c@seZdZdZddZddZddZdd d Zd d Zd dZ ddZ e dddZ e dddZ e dddZe ddZdS)OffineRegistryz This class represents an offline registry You will need to set at least the SYSTEM hive (to get bootkey) In case you have the SAM and/or SECURITY hives, it will parse them for the stored credentials/secrets as well. cCs4d|_d|_d|_d|_d|_d|_d|_d|_dSN)sam_hive security_hive system_hive software_hivesystemsamsecuritysoftwareselfr/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/registry/offline_parser.py__init__s zOffineRegistry.__init__cCst|j|_|j}|j|jrt|j||_|j|jr0t |j||j|_ |j |j r?t |j ||_ |j |dSr)SYSTEMr r get_bootkey get_secretsrSAMr r SECURITYrr SOFTWARErget_default_logoncleanup)rbootkeyrrrr#s       zOffineRegistry.get_secretscCs0|j|j|jfD] }z|WqYqdSr)r r rclose)rhiverrrr6s  zOffineRegistry.cleanupFcCsjt|ddd$}|dkr|t|n||WddSWddS1s.wYdS)Na)newlineF)openwritestrto_json)r file_path json_formatfrrrto_file=s"zOffineRegistry.to_filecCstj|tdddS)NT)clsindent sort_keys)jsondumpsto_dictrrrrrr&DszOffineRegistry.to_jsoncCsRi}|j|d<|jr|j|d<|jr|j|d<|jr'|j|d<|S)Nrrrr)r r1r rrrtrrrr1GszOffineRegistry.to_dictcCsJt|j}|jr|t|j7}|jr|t|j7}|jr#|t|j7}|Sr)r%r r rrr2rrr__str__Ss zOffineRegistry.__str__NcCsRt|}d}d}d}|rt|}|rt|}|r t|}tj||||dS)N)sam_buff security_buff software_buff)ioBytesIOr from_buffer) system_datasam_data security_data software_data system_buffr5r6r7rrr from_bytes]s    zOffineRegistry.from_bytescCstj||||ddS)NT)sam_path security_path software_pathnotfile)r from_files)r?r5r6r7rrrr:mszOffineRegistry.from_bufferc Cst}z|dkr |}nt|d}t||_Wnty-}z tdt||d}~ww|r[z|dkr8|}nt|d}t||_WntyZ}z tdt||d}~wwt d|rz|dkrj|} nt|d} t| |_ Wnty}z tdt||d}~wwt d|rz|dkr|} nt|d} t| |_ Wnty}z tdt||d}~wwt d| z| WnYz| WnYz| WnYz| W|SY|S) NTrbz&Failed to open SYSTEM hive! Reason: %sz#Failed to open SAM hive! Reason: %sz5SAM hive path not supplied! Parsing SAM will not workz(Failed to open SECURITY hive! Reason: %sz?SECURITY hive path not supplied! Parsing SECURITY will not workz?SOFTWARE hive path not supplied! Parsing SOFTWARE will not work)rr#rr Exceptionrerrorr%rwarningr r rr) system_pathrArBrCrDposys_hiveersec_hivesof_hiverrrrEqs           zOffineRegistry.from_filesc Cstdzddlm}ddlm}ddl}ddl}ddl}ddl }Wnt y9}z t dt |d}~ww| ||d}| ||d}| ||d} d|fd|fd | fg} td z |} | |Wnt y}z t d t ||d}~wwtd i} | D]I\} }td | z|j|j| dd}||||Wnt y}zt d| t |fWYd}~qd}~wwtd| || | <qd} d| vrzt|d| vr|ndd | vr| nd} Wn t y}zddl}|WYd}~n d}~wwt dtd| D]4\} }z||Wn t yU}zt d| |t |fWYd}~q*d}~wwtd| q*| S)Nz$Obtaining registry from local systemr)ProcessManipulator) SE_BACKUPzBCould not import necessary packages! Are you on Windows? Error: %sr+rrrz Obtaining SE_BACKUP privilege...zMFailed to obtain SE_BACKUP privilege! Registry dump will not work! Reason: %szObtaining SE_BACKUP OK!z Dumping %s...i)accesszDumping %s FAILED!! Reason: %szDumping %s OK!z&Failed to dump SYSTEM hive, exiting...zCleaning up temp fileszpFailed to clean up temp file for %s! Sensitive files might have been left on the filesystem! Path: %s Reason: %szCleanup for %s OK!)rdebug*pypykatz.commons.winapi.processmanipulatorrP!pypykatz.commons.winapi.constantsrQwinregtempfileosntpathrGrHr%join gettempdirurandomhex set_privilegeOpenKeyHKEY_LOCAL_MACHINESaveKeyCloserrE traceback print_excremove)rPrQrVrWrXrYrMsam_name system_name security_name locationsrK dumped_namesreg_namelocationkeyrcrrrfrom_live_systems~         "  *   &zOffineRegistry.from_live_system)F)NNN)NNNF)__name__ __module__ __qualname____doc__rrrr*r&r1r4 staticmethodr@r:rErnrrrrrs"      Nr__main__)r/aiowinreg.hiverpypykatz.registryrpypykatz.commons.commonrpypykatz.registry.sam.sam#pypykatz.registry.security.securitypypykatz.registry.system.system#pypykatz.registry.software.softwarerrornrKprintr%rrrrs   t