o
    Žõ±j  ã                   @   sš   d dl Z d dlmZ d dlmZ d dlmZ d dlmZ d dlm	Z	 d dl
mZ d dlmZ G d	d
„ d
ƒZddd„Zdd„ Zdd„ ZedkrKeƒ  dS dS )é    N)Útqdm)ÚESENT_DB)ÚAFile)ÚNTDS)ÚSYSTEM)ÚAIOWinRegHive)Úloggerc                   @   s&   e Zd Zd	dd„Zdd„ Zdd„ ZdS )
ÚNTDSParserConsoleTc                 C   s   || _ || _|| _|| _d S ©N)ÚbootkeyÚntdsfileÚignore_errorsÚwith_history)Úselfr   r   r   r   © r   úŒ/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/aesedb/examples/ntdsparse.pyÚ__init__   s   
zNTDSParserConsole.__init__c                 Ã   s„   �t  d¡ | j}t| jtƒrt| jƒ}t|ƒ}| ¡ I d H \}}|d ur'|‚d}| d¡I d H \}}|d ur9|‚t  d| ¡ |S )NzFetching total row count...é   Ú	datatablezTotal row count done! %s)	r   Údebugr   Ú
isinstanceÚstrr   r   ÚparseÚ
get_rowcnt)r   ÚfileÚdbÚ_ÚerrÚtotalr   r   r   Úget_total_rows   s   €

z NTDSParserConsole.get_total_rowsc              
   C  s>  �z…d}t | jtƒr t| jƒdkr z
t | j¡}d}W n   Y |du rA| j}t | jtƒr2t| jƒ}t|ƒ}t|ƒ}| 	¡ I d H }| j
}t | j
tƒrOt| j
ƒ}t|ƒ}| ¡ I d H \}}	|	d urb|	‚t||ƒ}
t d¡ |
j| j| jd�2 z3 d H W \}}	||	fV  qu6 W d S  tyž } zd |fV  W Y d }~d S d }~ww )NFé    TzDumping secrets)r   r   )r   r   r   ÚlenÚbytesÚfromhexr   r   r   Úget_bootkeyr   r   r   r   r   r   Údump_secretsr   r   Ú	Exception)r   Úhexkeyr   ÚregfileÚreghiveÚsyshiver   r   r   r   ÚntdsÚsecretÚer   r   r   Úget_secrets$   s@   €



"ÿ€ÿzNTDSParserConsole.get_secretsN)TT)Ú__name__Ú
__module__Ú__qualname__r   r   r.   r   r   r   r   r	   
   s    
r	   c              
   Ã   sš   �z5|d ur d}| D ]}z|t |ƒ7 }W q
   Y q
| |¡ n| D ]}ztt |ƒƒ W q"   Y q"g } W dS  tyL } z
d |fW  Y d }~S d }~ww )NÚ )TN)r   ÚwriteÚprintr&   )ÚbufferÚoutfile_handleÚresr,   r-   r   r   r   Úflush_bufferG   s*   €€ÿr8   c               
   Ã   s  �dd l } dd l}zà| jdd�}|jddddd� |jdd	d
dd� |jdddd� |jdd
dd� |jdd
dd� |jddd� |jddd� | ¡ }t|j|j|j|j	 d�}g }d}| 
¡ I d H }|jdu r~td|d|d dd�}td d!|d" d#d$�}	d }
|jd ur�t|jd%d!d&�}
| ¡ 2 zB3 d H W \}}|d urŸ|‚|jdu r¨| ¡  |d u r­q‘|jdu r¶|	 ¡  | |¡ t|ƒ|krÓt||
ƒI d H \}}g }|d urÓ|‚q‘6 t||
ƒI d H \}}g }|d urç|‚W d S  t�y } z| ¡  W Y d }~d S d }~ww )'Nr   zNTDS.dit parser)Údescriptionz-vz	--verboseÚcount)ÚactionÚdefaultz-pz
--progressÚ
store_truezShow progress bar)r;   Úhelpz-oz
--out-filezOutput file path.)r>   z--strictzStrict parsing. Fails on errorsz--no-historyzDo not parse historyr   z'Bootkey OR path to the SYSTEM hive filer   zNTDS.dit file path)r   r   iè  TzJET table parsing ÚrecordséÈ   )Údescr   ÚunitÚminitersÚpositionzUser secrets foundr2   é
   r   )rA   rB   rC   rD   Úw)Únewline)ÚargparseÚ	tracebackÚArgumentParserÚadd_argumentÚ
parse_argsr	   r   r   ÚstrictÚ
no_historyr   Úprogressr   Úout_fileÚopenr.   ÚupdateÚappendr!   r8   r&   Ú	print_exc)rH   rI   ÚparserÚargsÚntdsconr5   Úbuffer_sizer   ÚpbarÚpbar_secr6   r,   r   r   r-   r   r   r   Úamain^   sl   €ü




€íÿ€ÿr[   c                   C   s   t  tƒ ¡ d S r
   )ÚasyncioÚrunr[   r   r   r   r   ÚmainŸ   s   r^   Ú__main__r
   )r\   r   Úaesedb.eesentdbr   Úaesedb.utils.afiler   Úaesedb.security.ntdsr   Úaesedb.utils.systemhiver   Úaiowinreg.ahiver   Úaesedbr   r	   r8   r[   r^   r/   r   r   r   r   Ú<module>   s    
=A
ÿ