o
    Žõ±j®2  ã                   @   sN  d dl Z d dlmZ d dlmZmZmZmZmZm	Z	 d dl
mZ d dlmZmZmZmZ d dlmZmZmZ d dlmZmZmZmZ d dlmZ d d	lmZmZ d d
lm Z  d dl!m"Z" d dl#m$Z$ d dl%Z%d dl&m'Z' ed ded ded ded ded ded ded ded ded ded ded ded diZ(G dd„ dƒZ)dS )é    N)ÚOrderedDict)ÚRC4ÚAESÚDESÚMODE_CBCÚMODE_ECBÚ	deriveKey)Úmd5)ÚNAME_TO_INTERNALÚACCOUNT_TYPESÚKERBEROS_TYPEÚINTERNAL_TO_NAME)ÚPEKLIST_ENCÚPEK_KEYÚPEKLIST_PLAIN)ÚCRYPTED_HASHÚCRYPTED_HASHW16ÚCRYPTED_HISTORYÚCRYPTED_BLOB)ÚUSER_PROPERTIES)ÚKERB_STORED_CREDENTIAL_NEWÚKERB_KEY_DATA_NEW)ÚSAMR_RPC_SID)ÚUserSecrets)Úlogger)ÚunpackÚ	objectSidé   ÚdBCSPwdÚnameÚsAMAccountTypeÚ
unicodePwdÚsAMAccountNameÚuserPrincipalNameÚntPwdHistoryÚlmPwdHistoryÚ
pwdLastSetÚuserAccountControlÚsupplementalCredentialsc                   @   sp   e Zd Zdd„ Zdd„ Zdd„ Zdd„ Zd	d
„ Zedd„ ƒZ	dd„ Z
ddefdd„Zdefdd„Zddd„ZdS )ÚNTDSc                 C   s,   || _ || _g | _d | _tƒ | _tƒ | _d S ©N)ÚdbÚbootkeyÚ
_NTDS__PEKÚ_NTDS__cryptoCommonr   Ú_NTDS__kerberosKeysÚ_NTDS__clearTextPwds)Úselfr+   r,   © r2   ú‡/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/aesedb/security/ntds.pyÚ__init__$   s   zNTDS.__init__c              
   Ã   sf   �zt  d¡ | j d¡I d H \}}|d ur|‚|d fW S  ty2 } z
d |fW  Y d }~S d }~ww )NzOpening datatable...Ú	datatable)r   Údebugr+   Ú
open_tableÚ	Exception)r1   ÚcursorÚerrÚer2   r2   r3   Úopen_db_table-   s   €

€ÿzNTDS.open_db_tablec              
   Ã   s4  ��z t  d¡ |  ¡ I d H \}}|d ur|‚td }d }	 | j ||di¡I d H \}}|d ur2|‚|d u r:tdƒ‚||v rE|| d u rEq||v rQt || ¡}nq|d u rZtdƒ‚|j	d d… dkr®t
| jƒ}tdƒD ]}| |j¡ ql| ¡ }t|ƒ}	t |	 |j¡¡}
tƒ j}tt|
jƒ| ƒD ]}|| }t |
j||| … ¡}| j |j¡ q“nM|j	d d… d	krût| jt|jd
�}| |j¡}t |¡}
d\}}	 |
j||d … }t|ƒdk ràntd|ƒ\}}||krìn| j |¡ |d7 }|d7 }qÐt  d¡ W dS  t�y } z
d |fW  Y d }~S d }~ww )NzFetching PEK...ÚpekListTr   zPEK not found!é   s      iè  s      ©ÚIV)r   r   é   z<L16szPEK found and decrypted!©TN)r   r6   r<   r
   r+   Úget_next_rowr8   r   Ú
from_bytesÚHeaderr	   r,   ÚrangeÚupdateÚKeyMaterialÚdigestr   r   ÚencryptÚEncryptedPekr   Ú_lenÚlenÚDecryptedPekr-   ÚappendÚKeyr   r   Údecryptr   )r1   Ú	db_cursorr:   Ú
pklistnameÚpeklist_encÚrecordÚctxÚ_ÚtmpKeyÚrc4ÚpeklistÚPEKLenÚir9   ÚpekÚdec_pekÚposÚ	cur_indexÚ	pek_entryÚindexr;   r2   r2   r3   Úget_pek7   sn   €
ó
ü

ø

€ÿzNTDS.get_pekc                 C   sL   t t|ƒƒ\}}t|tƒ}t|tƒ}| |d d… ¡| |dd … ¡ }|S )Né   )r   Úintr   r   rQ   )r1   ÚcryptedHashÚridÚKey1ÚKey2ÚCrypt1ÚCrypt2ÚdecryptedHashr2   r2   r3   Ú__removeDESLayerƒ   s
   

$zNTDS.__removeDESLayerc                 C   sD   |j d }t| j| ƒ}| |j¡ | ¡ }t|ƒ}| |j¡}|S )Nr>   )	rE   r	   r-   rG   rH   rI   r   rJ   ÚEncryptedHash)r1   rf   Úpek_ixdrV   rX   rY   Ú	plainTextr2   r2   r3   Ú__removeRC4LayerŠ   s   
zNTDS.__removeRC4Layerc                 C   s2   | d8 } | d } | dk rdS t j  | ¡}| d¡S )Nl     }*{Gíi€–˜ r   Úneverz%Y-%m-%d %H-%M)ÚdatetimeÚfromtimestampÚstrftime)ÚtÚdtr2   r2   r3   Ú__fileTimeToDateTime”   s   
zNTDS.__fileTimeToDateTimec                 C   sb   g }i }|D ]}|| }|t v r||t | < | |¡ q|D ]}||= q|D ]}|| ||< q&|S r*   )r   rO   )r1   rU   Únames_to_deleteÚnames_to_addr   Úvaluer2   r2   r3   Úresolve_record_namesž   s   
€zNTDS.resolve_record_namesTÚsecretc              
   C   sÈ  �zËzt  |td  ¡}t|ƒ d¡d }W n ty4 } ztdƒ td|td   ¡  ƒ |‚d }~ww ||_|td  d urƒt	 |td  ¡}|j
d d… dkrvt |td  ¡}|j
d }	t| j|	 t|jd	�}
|
 |jd d
… ¡}n|  |¡}|  ||¡|_nt d¡|_|td  d urÔt	 |td  ¡}|j
d d… dkrÇt |td  ¡}|j
d }	t| j|	 t|jd	�}
|
 |jd d
… ¡}n|  |¡}|  ||¡|_nt d¡|_|td  d urø|td   d¡d |_d|td   |_n	d|td   |_|td  d u�r|td  |_|td  d u�r$|  |td  ¡|_|du �r,W dS |td  d u�rft |td  ¡}|  |¡}tdt|ƒd
 ƒD ]}|  ||d
 |d d
 … |¡}|j  !|¡ �qL|td  d u�rÊt |td  ¡}|j
d d… dk�r¢t |td  ¡}|j
d }	t| j|	 t|jd	�}
|
 |j¡}n|  |¡}tdt|ƒd
 ƒD ]}|  ||d
 |d d
 … |¡}|j" !|¡ �q°W dS  t�yã } z
d |fW  Y d }~S d }~ww )Nr   ú-éÿÿÿÿzSID parsing failed!zData inpuit: %sr   r>   ó      r?   é   Ú aad3b435b51404eeaad3b435b51404eer!   Ú 31d6cfe0d16ae931b73c59d7e0c089c0r#   ú@z%sr"   r'   r&   F©NNr%   r   r   r$   rB   )#r   rD   r
   ÚstrÚsplitr8   ÚprintÚhexÚ
object_sidr   rE   r   r   r-   r   rH   rQ   rn   Ú_NTDS__removeRC4LayerÚ_NTDS__removeDESLayerÚlm_hashÚbytesÚfromhexÚnt_hashÚdomainÚusernameÚuser_account_controlÚ_NTDS__fileTimeToDateTimeÚpwd_last_setr   rF   rM   Ú
lm_historyrO   Ú
nt_history)r1   r}   rU   rR   Úwith_historyÚsidrg   r;   ÚencryptedLMHashÚpekIndexrV   Údec_hash_tempÚencryptedNTHashÚencryptedLMHistoryÚtmpLMHistoryr\   ÚLMHashÚencryptedNTHistoryÚNTHashr2   r2   r3   Ú__decrypt_hash¬   s~   €ý





 

 €ÿzNTDS.__decrypt_hashc              
   C   s  zëd }d}|t d  d urMt|t d  ƒdkrMt |t d  ¡}|jd d… dkrF|jd }t| j| t|jd�}| 	|j
dd … ¡}d}n|  |¡}d}|du rV|d fW S zt |¡}W n tyk }	 z|	‚d }	~	ww |jD ]w}
|
jd	krÁt |
j ¡ ¡}t |¡}|j}t|jƒD ]4}t |¡}||jd … }||jd … d |j… }|jtv r²t|j |f}nt|jƒ|f}|j  |¡ q‹qo|
jd
kræz|j!  |
j d¡¡ W qo t"yå   |j!  |
j d¡¡ Y qow qo|d fW S  t�y }	 z
d |	fW  Y d }	~	S d }	~	ww )NFr(   é   r>   r€   r?   TrB   zPrimary:Kerberos-Newer-KeyszPrimary:CLEARTEXTzutf-16lezutf-8)#r
   rM   r   rD   rE   r   r-   r   rH   rQ   rn   r‹   r   r8   ÚUserPropertiesÚPropertyNamerŽ   r�   ÚPropertyValueÚdecoder   ÚBufferrF   ÚCredentialCountr   rL   Ú	KeyOffsetÚ	KeyLengthÚKeyTyper   r‰   Úkerberos_keysrO   Úcleartext_pwdsÚUnicodeDecodeError)r1   r}   rU   rp   ÚhaveInfoÚ
cipherTextr›   rV   ÚuserPropertiesr;   ÚuserpropÚpropertyValueBufferÚkerbStoredCredentialNewÚdataÚ
credentialÚ
keyDataNewÚkeyValueÚanswerr2   r2   r3   Ú__decryptSupplementalInfoÿ   s^   


€ÿ




õ
þû
	€ÿzNTDS.__decryptSupplementalInfoFc              
   C  sX  �z’|   ¡ I d H \}}|d ur|‚| j d¡I d H \}}|d ur"|‚	 t d¡I d H  | j |t¡I d H \}}|d ur=|‚|d u rDW d S t|ƒdkr�|td  t	v r�td |v r�d }t
ƒ }	|  |	|||¡\}}|d urr|du rq|‚q"td |v rŠ|  |	|¡\}}|d urŠ|du rŠ|‚|	d fV  q"dV  q# ty« }
 zd |
fV  W Y d }
~
d S d }
~
ww )	Nr5   Tr   r    r   Fr(   r…   )rc   r+   r7   ÚasyncioÚsleeprC   ÚNTDS_SUPPORTED_SECRET_TYPESrM   r
   r   r   Ú_NTDS__decrypt_hashÚ_NTDS__decryptSupplementalInfor8   )r1   Ú	only_ntlmr˜   Úignore_errorsrW   r:   rR   rU   ÚdecryptedSupplementalInfor}   r;   r2   r2   r3   Údump_secrets=  sH   €(
ä€ÿzNTDS.dump_secretsN)T)FTT)Ú__name__Ú
__module__Ú__qualname__r4   r<   rc   rŒ   r‹   Ústaticmethodr”   r|   r   rÀ   rÁ   rÅ   r2   r2   r2   r3   r)   #   s    	
L

	S>r)   )*r½   Úcollectionsr   Úunicrypto.symmetricr   r   r   r   r   r   Úunicrypto.hashlibr	   Úaesedb.security.constantsr
   r   r   r   Úaesedb.security.structures.pekr   r   r   Ú"aesedb.security.structures.cryptedr   r   r   r   Ú$aesedb.security.structures.userpropsr   Ú%aesedb.security.structures.kerbsecretr   r   Úaesedb.security.structures.sidr   Ú!aesedb.security.common.usersecretr   Úaesedbr   rs   Ústructr   r¿   r)   r2   r2   r2   r3   Ú<module>   s8    ô