o
    Žõ±j]  ã                   @   sr   d dl mZ d dlmZmZmZmZmZ d dlm	Z	 d dl
mZ d dlmZmZmZmZmZmZ G dd„ dƒZdS )	é    )Úhashlib)ÚRC4ÚAESÚMODE_CBCÚexpand_DES_keyÚDES)Úlogger)Ú	SAMSecret)ÚSAM_HASHÚDOMAIN_ACCOUNT_FÚSAM_KEY_DATAÚSAM_KEY_DATA_AESÚUSER_ACCOUNT_VÚSAM_HASH_AESc                   @   sP   e Zd Zdd„ Zedd„ ƒZdd„ Zdd„ Zd	d
„ Zdd„ Z	dd„ Z
dd„ ZdS )ÚSAMc                 C   s"   || _ || _d | _d | _g | _d S )N)ÚhiveÚbootkeyÚhashed_bootkeyÚmachine_sidÚsecrets)ÚselfÚsam_hiver   © r   ú�/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/registry/sam/asam.pyÚ__init__   s
   
zSAM.__init__c                 C   sŠ   t | dƒjdddd�}|d |d |d |d	 |d |d |d g}|d	 |d |d |d |d	 |d |d g}tt|ƒƒtt|ƒƒfS )
Né   é   ÚlittleF©Úsignedr   é   é   é   )ÚintÚto_bytesr   Úbytes)ÚridÚkeyÚkey1Úkey2r   r   r   Ú
rid_to_key    s   ..zSAM.rid_to_keyc                    sø   t  |¡\}}t|ƒ}t|ƒ}tˆ tƒr6t | jd d… t|dƒj	dddd� | ¡ 
¡ }t|ƒ ˆ j¡}	n2d}	t| jd d… tˆ jd�}
d‰‡ ‡fdd	„td
tˆ jƒˆƒD ƒD ]	}|	|
 |¡7 }	qX|	d d… }	| |	d d… ¡| |	dd … ¡ }|S )Nr   r   r   Fr   ó    ©ÚIVc                    s   g | ]}ˆ j ||ˆ … ‘qS r   )Údata©Ú.0Úi©ÚhashobjÚnr   r   Ú
<listcomp>4   s    z$SAM.decrypt_hash.<locals>.<listcomp>r   é   )r   r*   r   Ú
isinstancer
   r   Úmd5r   r#   r$   Údigestr   ÚencryptÚhashr   r   ÚsaltÚrangeÚlenr.   Údecrypt)r   r&   r3   Úconstantr(   r)   Údes1Údes2Úrc4keyr'   ÚcipherÚblockÚdec_hashr   r2   r   Údecrypt_hash'   s   
2&$zSAM.decrypt_hashc                 ƒ   sf  �t  d¡ d}d}| j d¡I d H }|d }t  dd| ¡ t |¡‰ tˆ jt	ƒrrt
 ˆ jj| | j | ¡ ¡ }t|ƒ ˆ jjˆ jj ¡| _t
 | jd d… | | jd d…  | ¡ ¡ }|| jdd … krqt  d¡ tdƒ‚n4tˆ jtƒr¦d	| _t| jtˆ jjd
�}d‰‡ ‡fdd„tdtˆ jjƒˆƒD ƒD ]}|  j| |¡7  _q™t  d| j ¡  ¡ | jS )NzSAM parsing hashed bootkeys/   !@#$%^&*()qwertyUIOPAzxcvbnmQQQQQQQQQQQQ)(*@&% s)   0123456789012345678901234567890123456789 zSAM\Domains\Account\Fr    z[SAM] F key value: %sr   z,[SAM] HBootkey checksum verification failed!r+   r,   c                    s    g | ]}ˆ j j||ˆ … ‘qS r   )Úkey_0r.   r/   ©Údomain_propertiesr4   r   r   r5   U   s     z%SAM.get_HBoot_key.<locals>.<listcomp>r   z[SAM] HBootkey: %s)r   Údebugr   Ú	get_valueÚlogr   Ú
from_bytesr7   rH   r   r   r8   r<   r   r9   r   r:   r'   Úchecksumr   ÚerrorÚ	Exceptionr   r   r   r=   r>   r.   r?   Úhex)r   ÚQWERTYÚDIGITSÚFÚrc4_keyrO   rD   rE   r   rI   r   Úget_HBoot_key<   s0   €

 .
þ(zSAM.get_HBoot_keyc              
   Ã   sÖ   �zM| j d ur| j W S | j d¡I d H }|d }|dd … }tj|d d… ddd�}tj|dd… ddd�}tj|dd	… ddd�}d
d|||f | _ W | j S  tyj } zdd l}| ¡  W Y d }~| j S d }~ww )NzSAM\Domains\Account\Vr    iôÿÿÿr   r   Fr   r6   é   z%s-%s-%s-%szS-1-5-21r   )r   r   rL   r#   rN   rQ   Ú	tracebackÚ	print_exc)r   Úuac_dataÚp1Úp2Úp3ÚerY   r   r   r   Úget_machine_sid[   s$   €
ý€ýzSAM.get_machine_sidc                 Ã   s”  �t  d¡ d}d}d}d}|  ¡ I d H  |  ¡ I d H  | j d¡I d H }|D ]Ÿ}d }|dkr0q'd| }t  d	| ¡ | j |¡I d H }	|	d
 }	t |	¡}t	 
|¡}
t	 
|¡}|jrot|jtƒro|jjdkrn|  ||j|¡}
n|jr†t|jtƒr†|jjdkr†|  ||j|¡}
|jržt|jtƒrž|jjdkr�|  ||j|¡}n|jrµt|jtƒrµ|jjdkrµ|  ||j|¡}t|jt|dƒ|
|ƒ}| j |¡ q'| jS )NzSAM get_secrets invokeds   NTPASSWORD s   LMPASSWORD Ú 31d6cfe0d16ae931b73c59d7e0c089c0Ú aad3b435b51404eeaad3b435b51404eezSAM\Domains\Account\UsersÚNameszSAM\Domains\Account\Users\%s\Vz![SAM] Parsing secrets for RID: %sr    r+   r   )r   rK   rW   r`   r   Úenum_keyrL   r   rN   r%   ÚfromhexÚNT_hashr7   r   r.   rG   r
   r;   ÚLM_hashr	   Únamer#   r   Úappend)r   Ú
NTPASSWORDÚ
LMPASSWORDÚ	NTDEFAULTÚ	LMDEFAULTÚnamesr&   ÚuacÚkey_pathr[   ÚnthashÚlmhashÚsecretr   r   r   Úget_secretsn   sJ   €



€€zSAM.get_secretsc                 C   s8   i }| j |d< g |d< | jD ]}|d  | ¡ ¡ q|S )NÚ	HBoot_keyÚlocal_users)r   r   ri   Úto_dict©r   Útrs   r   r   r   rw   ›   s   

zSAM.to_dictc                 C   s6   d}|d| j  ¡  7 }| jD ]
}|d| ¡  7 }q|S )Nz0============== SAM hive secrets ==============
zHBoot Key: %s
z%s
)r   rR   r   Úto_lopthrx   r   r   r   Ú__str__£   s
   
zSAM.__str__N)Ú__name__Ú
__module__Ú__qualname__r   Ústaticmethodr*   rG   rW   r`   rt   rw   r{   r   r   r   r   r      s    
-r   N)Ú	unicryptor   Úunicrypto.symmetricr   r   r   r   r   Úpypykatz.registryr   Úpypykatz.registry.sam.commonr	   Ú pypykatz.registry.sam.structuresr
   r   r   r   r   r   r   r   r   r   r   Ú<module>   s    