o
    Žõ±jÚ  ã                   @   s”   d dl mZ d dlmZ d dlmZ G dd„ dƒZG dd„ deƒZG dd	„ d	eƒZ	G d
d„ deƒZ
G dd„ deƒZG dd„ deƒZG dd„ dƒZdS )é    )Úmd4)ÚDPAPI_SYSTEM)Úhexdumpc                   @   s4   e Zd Zddd„Zeddd„ƒZdd„ Zd	d
„ ZdS )Ú	LSASecretFc                 C   s   || _ || _|| _d S ©N)Ú
raw_secretÚkey_nameÚhistory©Úselfr   r   r	   © r   ú•/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/registry/security/acommon.pyÚ__init__   s   
zLSASecret.__init__Nc                 Ã   sð   �|   ¡ }t|ƒdkrd S | d¡rd S | d¡r)t||||ƒ}| ¡ I d H  |S | d¡r:t|||ƒ}| ¡  |S | d¡rKt|||ƒ}| ¡  |S | d¡r\t|||ƒ}| ¡  |S | d¡rpt||||j	d�}| ¡  |S t
|||ƒ}|S )	Nr   s     Ú_SC_ÚDEFAULTPASSWORDÚASPNET_WP_PASSWORDr   z$MACHINE.ACC)Úusername)ÚupperÚlenÚ
startswithÚLSASecretServiceÚprocess_secretÚLSASecretDefaultPasswordÚLSASecretASPNETÚLSASecretDPAPIÚLSASecretMachineAccountÚmachinenamer   )r   r   r	   Úsystem_hiveÚknÚlssr   r   r   Úprocess   s8   €


í
ñ
õ	
ùþzLSASecret.processc                 C   s"   d| j  d| j  d t| jƒ S )Nz=== LSASecret %s ===
z
History: %sz
Secret: 
)r   r	   r   r   ©r   r   r   r   Ú__str__9   ó   "zLSASecret.__str__c                 C   s.   i }d|d< | j |d< | j|d< | j|d< |S )Nr   Útyper   r	   r   )r   r	   r   ©r   Útr   r   r   Úto_dict<   s   


zLSASecret.to_dict)F)FN)Ú__name__Ú
__module__Ú__qualname__r   Ústaticmethodr    r"   r'   r   r   r   r   r      s    
 r   c                   @   ó.   e Zd Zd
dd„Zdd„ Zdd„ Zdd	„ ZdS )r   Nc                 C   s,   t  | |||¡ || _d | _d | _d | _d S r   )r   r   r   Úservicer   Úsecret)r   r   r   r	   r   r   r   r   r   E   ó
   
zLSASecretService.__init__c                 Ã   sl   �z	| j  d¡| _W n   | j  ¡ | _Y d S | j| _d| _| jd ur4| j | jdd … ¡I d H | _d S d S )Nú	utf-16-leÚUNKNOWNé   )	r   Údecoder.   Úhexr   r-   r   r   Úget_service_userr!   r   r   r   r   L   s   €
"ÿzLSASecretService.process_secretc                 C   s"   d| j | j| jf d t| jƒ S )NzM=== LSA Service User Secret ===
History: %s
Service name: %s 
Username: %sz
)r	   r-   r   r   r.   r!   r   r   r   r"   Y   r#   zLSASecretService.__str__c                 C   óB   i }d|d< | j |d< | j|d< | j|d< | j|d< | j|d< |S )Nr   r$   r   r	   r   r.   r-   )r   r	   r   r.   r-   r%   r   r   r   r'   \   ó   




zLSASecretService.to_dictr   ©r(   r)   r*   r   r   r"   r'   r   r   r   r   r   D   s
    
r   c                   @   ó,   e Zd Zdd„ Zdd„ Zdd„ Zdd„ Zd	S )
r   c                 C   s&   t  | |||¡ d | _d | _d | _d S r   )r   r   r   Údomainr.   r
   r   r   r   r   h   s   
z!LSASecretDefaultPassword.__init__c                 C   s:   z| j  d¡| _| j dd¡| _W n   Y d S d| _d S )Nr0   ú Ú r1   )r   r3   r.   Úreplacer   r!   r   r   r   r   n   s   
z'LSASecretDefaultPassword.process_secretc                 C   ó   d| j | j| jf S )NzE=== LSA Default Password ===
History: %s
Username: %s
Password: %s©r	   r   r.   r!   r   r   r   r"   y   ó   z LSASecretDefaultPassword.__str__c                 C   r6   )Nr   r$   r   r	   r   r:   r.   )r   r	   r   r:   r.   r%   r   r   r   r'   |   r7   z LSASecretDefaultPassword.to_dictNr8   r   r   r   r   r   g   s
    r   c                   @   r9   )
r   c                 C   s    t  | |||¡ d| _d | _d S )NÚASPNET)r   r   r   r.   r
   r   r   r   r   ‡   ó   
zLSASecretASPNET.__init__c                 C   s"   z
| j  d¡| _W d S    Y d S )Nr0   )r   r3   r.   r!   r   r   r   r   Œ   s   zLSASecretASPNET.process_secretc                 C   r>   )NzD=== LSA ASPNET Password ===
History: %s
Username: %s
Password: %sr?   r!   r   r   r   r"   ’   r@   zLSASecretASPNET.__str__c                 C   ó8   i }d|d< | j |d< | j|d< | j|d< | j|d< |S )Nr   r$   r   r	   r   r.   )r   r	   r   r.   r%   r   r   r   r'   •   ó   



zLSASecretASPNET.to_dictNr8   r   r   r   r   r   †   s
    r   c                   @   r,   )r   Nc                 C   s,   t  | |||¡ || _d | _d | _|| _d S r   )r   r   r   r.   Úkerberos_passwordr   )r   r   r   r	   r   r   r   r   r   Ÿ   r/   z LSASecretMachineAccount.__init__c                 C   s0   t | jƒ}| ¡ | _| j dd¡ dd¡| _d S )Nr0   r=   zutf-8)ÚMD4r   Údigestr.   r3   ÚencoderE   )r   Úctxr   r   r   r   ¦   s   

z&LSASecretMachineAccount.process_secretc                 C   r6   )Nr   r$   r   r	   r   r.   rE   )r   r	   r   r.   rE   r%   r   r   r   r'   ¯   r7   zLSASecretMachineAccount.to_dictc                 C   s(   d| j | j| j ¡ | j ¡ | j ¡ f S )Nzv=== LSA Machine account password ===
History: %s
Username: %s
NT: %s
Password(hex): %s
Kerberos password(hex): %s)r	   r   r.   r4   r   rE   r!   r   r   r   r"   ¹   s   (zLSASecretMachineAccount.__str__r   ©r(   r)   r*   r   r   r'   r"   r   r   r   r   r   ž   s
    
	
r   c                   @   r9   )
r   c                 C   s    t  | |||¡ d | _d | _d S r   )r   r   Úmachine_keyÚuser_keyr
   r   r   r   r   ¾   rB   zLSASecretDPAPI.__init__c                 C   s    t  | j¡}|j| _|j| _d S r   )r   Ú
from_bytesr   rK   rL   )r   Údsr   r   r   r   Ã   s   zLSASecretDPAPI.process_secretc                 C   rC   )Nr   r$   r   r	   rK   rL   )r   r	   rK   rL   r%   r   r   r   r'   È   rD   zLSASecretDPAPI.to_dictc                 C   s   d| j | j ¡ | j ¡ f S )NzO=== LSA DPAPI secret ===
History: %s
Machine key (hex): %s
User key(hex): %s)r	   rK   r4   rL   r!   r   r   r   r"   Ñ   s   zLSASecretDPAPI.__str__NrJ   r   r   r   r   r   ½   s
    	r   c                   @   s8   e Zd Zddd„Zdd„ Zddd„Zd	d
„ Zdd„ ZdS )ÚLSADCCSecreté (  Nc                 C   s(   || _ || _|| _|| _|| _|| _d S r   )Úversionr:   r   Ú	iterationÚ
hash_valueÚlast_write_ts)r   rQ   r:   r   rS   rR   rT   r   r   r   r   Õ   s   
zLSADCCSecret.__init__c                 C   sF   i }| j |d< | j|d< | j|d< | j|d< | j|d< |  ¡ |d< |S )NrQ   r:   r   rR   rS   Ú	lastwrite)rQ   r:   r   rR   rS   Úget_lastwriter%   r   r   r   r'   Ý   s   




zLSADCCSecret.to_dictc                 C   s   | j d u r|S | j  d¡S )Nz%Y-%m-%d %H:%M:%S)rT   Ústrftime)r   Údefaultr   r   r   rV   ç   s   
zLSADCCSecret.get_lastwritec                 C   s   |   ¡ S r   )Úto_lopthr!   r   r   r   r"   ì   s   zLSADCCSecret.__str__c                 C   sN   | j dkrd| j| j| j ¡ | jf S d| j| j|  d¡| j| j| j ¡ f S )Né   z%s/%s:%s:%sz%s/%s:*%s*$DCC2$%s#%s#%sr<   )rQ   r:   r   rS   r4   rV   rR   r!   r   r   r   rY   ï   s   
(zLSADCCSecret.to_lopth)rP   Nr   )r(   r)   r*   r   r'   rV   r"   rY   r   r   r   r   rO   Ô   s    


rO   N)Úunicrypto.hashlibr   rF   Ú pypykatz.dpapi.structures.systemr   Úpypykatz.commons.commonr   r   r   r   r   r   r   rO   r   r   r   r   Ú<module>   s   	2#