o
    àý°jÈr  ã                   @   sø  d dl Z d dlZd dlZd dlZd dlmZmZ d dlmZ d dl	m
Z
mZ d dlmZ d dlmZ d dlmZmZ d dlmZmZmZmZmZmZmZmZmZmZmZmZm Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z( d d	l)m*Z*m+Z+m,Z, d d
l-m.Z.m/Z/m0Z0m1Z1m2Z2m3Z3m4Z4 d dl5m6Z6 d dl7m8Z8m9Z9m:Z: d dl;m<Z< d dl=m>Z>m?Z?m@Z@mAZAmBZBmCZC d dl-mDZD d dlEmFZFmGZG d dlHmIZI ze J¡ ZKW n eLyÏ   eZKY nw d$dd„ZMd%dd„ZNd&dd„ZOdd„ ZP		d'dd„ZQG d d!„ d!eRƒZSG d"d#„ d#e<ƒZTdS )(é    N)ÚdecoderÚencoder)ÚPyAsn1Error)ÚnoValueÚSequence)ÚGeneralizedTime)Úb)Ú	unhexlifyÚhexlify)ÚAS_REQÚAP_REQÚTGS_REQÚKERB_PA_PAC_REQUESTÚ	KRB_ERRORÚPA_ENC_TS_ENCÚAS_REPÚTGS_REPÚEncryptedDataÚAuthenticatorÚEncASRepPartÚEncTGSRepPartÚseq_setÚseq_set_iterÚKERB_ERROR_DATAÚMETHOD_DATAÚETYPE_INFO2Ú
ETYPE_INFOÚAP_REPÚEncAPRepPartÚKERB_SUPERSEDED_BY_USER)ÚKerberosTimeÚ	PrincipalÚTicket)ÚCheckSumFieldÚGSS_C_DCE_STYLEÚGSS_C_MUTUAL_FLAGÚGSS_C_REPLAY_FLAGÚGSS_C_SEQUENCE_FLAGÚGSS_C_CONF_FLAGÚGSS_C_INTEG_FLAG)Ú	constants)ÚKeyÚ_enctype_tableÚInvalidChecksum)ÚSessionError)ÚSPNEGO_NegTokenInitÚ	TypesMechÚSPNEGO_NegTokenRespÚASN1_OIDÚ
asn1encodeÚASN1_AID)ÚKRB5_AP_REQ)Ú	nt_errorsÚLOG)ÚCCacheéX   c              
   C   s´  |d u r|}n|}t  dt| ƒ¡}t d||f ¡ zt ||dtj¡d \}}}}	}
t |||¡}| |
¡ W n tj	yO } z
t 	d||f |¡‚d }~ww | 
||  ¡ t  d| d¡¡d }| |¡}t|ƒ|k r~|| |t|ƒ ¡7 }t|ƒ|k smzttj|tƒ d�d d�}W n   | Y S | ¡ tjjjkrØz3t |¡D ]*}t|ƒtkrÎt|ƒd D ]}t|ƒtkrÍtj | ¡  d	¡d
¡}t d| ¡ q²q¤W |‚   Y |‚|S )Nz!iz!Trying to connect to KDC at %s:%sr   zConnection error (%s:%s)é   ©Úasn1Spec©ÚpacketÚ_componentValuesúutf-8z%Y%m%d%H%M%SZzServer time (UTC): %s)ÚstructÚpackÚlenr7   ÚdebugÚsocketÚgetaddrinfoÚSOCK_STREAMÚconnectÚerrorÚsendallÚunpackÚrecvÚKerberosErrorr   Údecoder   ÚgetErrorCoder*   Ú
ErrorCodesÚKDC_ERR_PREAUTH_REQUIREDÚvalueÚtyper   Úvarsr   ÚdatetimeÚstrptimeÚasOctets)ÚdataÚhostÚkdcHostÚportÚ
targetHostÚ
messageLenÚafÚsocktypeÚprotoÚ	canonnameÚsaÚsÚeÚrecvDataLenÚrÚkrbErrorÚiÚkÚserver_time© rk   ú‹/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/impacket/krb5/kerberosv5.pyÚsendReceive5   sL    €ÿ
ÿ€û	ýrm   Ú TFc
           .      C   s‚	  t |tƒrzt|ƒ}W n	 ty   Y nw t |tƒr*zt|ƒ}W n	 ty)   Y nw t |tƒr?zt|ƒ}W n	 ty>   Y nw |d ur]t |tƒs]zt|tjjjd�}W n	 ty\   Y nw t	ƒ }
| 
¡ }|d u rttd| tjjjd�}n	t|tjjjd�}tƒ }||d< t |¡}d|
d< ttjj	jƒ|
d< t|
d< t|
d d< ttjjjƒ|
d d d	< ||
d d d
< t|
dƒ}tƒ }| tjjj¡ | tjjj¡ | tjjj¡ t |¡|d< t|d|jƒ t|d| jƒ |dkròtdƒ‚||d< tj tjj ¡tj!dd� }t" #|¡|d< t" #|¡|d< t$ %d¡|d< |d u �r d}|dk�rL|dk�rCt&|ƒdk�r:ttj'j(jƒf}nttj'j)jƒf}nttj'j(jƒf}nttj'j*jƒf}t+|d|ƒ t |
¡}zt,|||ƒ}W nM t-�y´ } z@| .¡ tj/j0jk�r©|d tj'j)jtj'j(jfv �r¨|dk�r¨ttj'j*jƒf}t+|d|ƒ t |
¡}t,|||ƒ}n‚ ‚ W Y d }~nd }~ww d}zt1j2|t3ƒ d�d }W n   t1j2|t4ƒ d�d }d}Y t5ƒ }d}|du �rë|d }|||d < |}nt1j2|d t6ƒ d�d }|D ]Ÿ}|d	 tjj7jk�rJt1j2|d
 t8ƒ d�d }|D ]4}z|d d u �s&|d  9¡ du �r)d}n|d  :¡ }W n t;�y<   d}Y nw | d ¡||d < �q�qù|d	 tjj<jk�r—t1j2|d
 t=ƒ d�d }|D ]4}z|d d u �su|d  9¡ du �rxd}n|d  :¡ }W n t;�y‹   d}Y nw | d ¡||d < �qb�qù|d }t>| } t |t?ƒ�r³|dk�r³t@| jA|ƒ}!n|dk�r¿t@| jA|ƒ}!n	|  B||| d ¡}!|du �r%||  v �rÜdu �rÝtd!ƒ‚ tCƒ }"tj tjj ¡}t" #|¡|"d"< |jD|"d#< t |"¡}#|  E|!d|#d ¡}$tFƒ }%| jA|%d< |$|%d$< t |%¡}&t	ƒ }
d|
d< ttjj	jƒ|
d< t|
d< t|
d d< ttjjGjƒ|
d d d	< |&|
d d d
< t|
d d< ttjjjƒ|
d d d	< ||
d d d
< t|
dƒ}tƒ }| tjjj¡ | tjjj¡ | tjjj¡ t |¡|d< t|d|jƒ t|d| jƒ ||d< tj tjj ¡tj!dd� }t" #|¡|d< t" #|¡|d< t$ %d¡|d< t+|dt| jAƒfƒ zt,t |
¡||ƒ}W nM t�y } z@t|ƒ Hd%¡dk�r|dk�r|dk�r|dk�sô|d u �rdd&lImJ}'mK}( |'|ƒ}|(|ƒ}tL| |||||||ƒW  Y d }~S ‚ d }~ww t1j2|t4ƒ d�d }|d' d$ })|du �rXtM Nd(|d' d | |tO|d' d$  P¡ d d)… ƒtO|d' d$  P¡ d)d … ƒf ¡ z	|  Q|!d*|)¡}*W n; tR�yœ } z.|du �r—d+t|ƒ }+|	�r�tM NtS|+|| |!|)ƒ¡ |d |!d fW  Y d }~S tS|+|| |!|)ƒ‚‚ d }~ww t1j2|*tTƒ d�d },t>|,d, d-  } t@| jA|,d, d.  P¡ ƒ}-|| |!|-fS )/N©rS   z	krbtgt/%szinclude-pacé   Úpvnoúmsg-typeÚpadatar   úpadata-typeúpadata-valueúreq-bodyúkdc-optionsÚsnameÚcnamern   z$Empty Domain not allowed in KerberosÚrealmé   ©ÚdaysÚtillÚrtimeé   Únonceó    é    ÚetypeTr;   Fúe-dataÚsaltr@   zNo Encryption Data Available!ÚpatimestampÚpausecÚcipherÚKDC_ERR_ETYPE_NOSUPP©Úcompute_lmhashÚcompute_nthashúenc-partz$krb5asrep$%d$%s@%s:%s$%sé   é   z!failed to decrypt session key: %sÚkeyÚkeytypeÚkeyvalue)UÚ
isinstanceÚstrr	   Ú	TypeErrorr!   r*   ÚPrincipalNameTypeÚNT_PRINCIPALrR   r   Úupperr   r   ÚencodeÚintÚApplicationTagNumbersr   ÚPreAuthenticationDataTypesÚPA_PAC_REQUESTr   ÚlistÚappendÚ
KDCOptionsÚforwardableÚ	renewableÚ	proxiableÚencodeFlagsÚcomponents_to_asn1Ú	ExceptionrU   ÚnowÚtimezoneÚutcÚ	timedeltar    Úto_asn1ÚrandÚgetrandbitsrC   ÚEncryptionTypesÚaes256_cts_hmac_sha1_96Úaes128_cts_hmac_sha1_96Úrc4_hmacr   rm   rM   rO   rP   rŠ   r   rN   r   r   Údictr   ÚPA_ETYPE_INFO2r   ÚhasValueÚprettyPrintr   ÚPA_ETYPE_INFOr   r,   Úbytesr+   ÚenctypeÚstring_to_keyr   ÚmicrosecondÚencryptr   ÚPA_ENC_TIMESTAMPÚfindÚimpacket.ntlmrŒ   r�   ÚgetKerberosTGTr7   rD   r
   rW   Údecryptr-   ÚSessionKeyDecryptionErrorr   ).Ú
clientNameÚpasswordÚdomainÚlmhashÚnthashÚaesKeyrZ   Ú
requestPACÚ
serverNameÚkerberoast_no_preauthÚasReqÚ
pacRequestÚencodedPacRequestÚreqBodyÚoptsr¨   ÚsupportedCiphersÚmessagerf   rd   ÚpreAuthÚasRepÚencryptionTypesDatar†   ÚmethodsÚtgtÚmethodÚetypes2Úetype2Úetypesr„   r¹   r‰   r‘   Ú	timeStampÚencodedTimeStampÚencriptedTimeStampÚencryptedDataÚencodedEncryptedDatarŒ   r�   Ú
cipherTextÚ	plainTextÚ	error_msgÚencASRepPartÚ
sessionKeyrk   rk   rl   rÀ   a   sŠ  
ÿ
ÿ
ÿÿ





(
ü€ú
 €ÿ÷
 €ÿ€

ÿ




("€ù

.ÿ
€÷
rÀ   c                 C   sŽ  zt j|tƒ d�d }W n   t j|tƒ d�d }Y | ¡ }tƒ }| |d ¡ tƒ }	d|	d< tt	j
jjƒ|	d< tƒ }
t	 |
¡|	d< t|	d|jƒ tƒ }d|d< |d	  ¡ |d	< tƒ }| |d	d
¡ t|d
|jƒ tj tjj¡}|j|d< t |¡|d< t |¡}| |d|d ¡}t|	d< |j|	d d< ||	d d< t |	¡}tƒ }d|d< tt	j
jjƒ|d< t|d< t|d d< tt	j j!jƒ|d d d< ||d d d< t|dƒ}tƒ }
|
 "t	j#j$j¡ |
 "t	j#j%j¡ |
 "t	j#j&j¡ |
 "t	j#j'j¡ |dk�r|
 "t	j#j(j¡ t	 |
¡|d< t|d| jƒ ||d< tj tjj¡tj)dd� }t |¡|d< t* +d¡|d< t,|dtt	j-j.jƒtt	j-j/jƒtt	j-j0jƒt|jƒfƒ t |¡}t1|||ƒ}t j|tƒ d�d }|d d }| 2|d|¡}t j|t3ƒ d�d }t4|d  d! |d  d"  ¡ ƒ}t5|d  d!  }t j|tƒ d�d }tƒ }| |d dd¡ |j6d | j6d k�r¹||||fS |j6d }t7| |||||ƒS )#Nr;   r   Úticketrp   rq   rr   ú
ap-optionsúauthenticator-vnoÚcrealmry   ÚcusecÚctimeé   Úauthenticatorr„   r‰   rs   rt   ru   rv   Trw   rx   rz   r{   r|   r~   r€   r�   rŽ   é   r‘   r’   r“   )8r   rN   r   r   r™   r"   Ú	from_asn1r   r›   r*   rœ   rR   rŸ   r¥   r   r¬   r   rW   r!   r¦   rU   r¨   r©   rª   r»   r    r   rš   r¼   r   r¹   r   r�   Ú
PA_TGS_REQr    r¡   r¢   r£   Úrenewable_okÚcanonicalizeÚrenewr«   r­   r®   r   r¯   r²   Údes3_cbc_sha1_kdÚdes_cbc_md5rm   rÁ   r   r+   r,   Ú
componentsÚgetKerberosTGS)rÊ   rÅ   rZ   r×   r‰   rå   ró   Ú
decodedTGTræ   ÚapReqrÐ   rí   rÃ   r¨   ÚencodedAuthenticatorÚencryptedEncodedAuthenticatorÚencodedApReqÚtgsReqrÏ   rÒ   rf   Útgsrá   râ   ÚencTGSRepPartÚnewSessionKeyÚresÚspnrk   rk   rl   r÷   q  sŽ   




üÿ
	
r÷   c                 C   sn  t |ƒ}zttj|d dd … tƒ d�d d�}W |‚ ty#   Y nw tj|d tƒ d�d }|d d }|  |d|¡}tj|tƒ d�d }t	t
|d	 d
 ƒ ƒ } t| j|d	 d  ¡ ƒ}	t
|d ƒ}
|d	  ¡  | ¡ }tj tjj¡}|j|d< t |¡|d< |
|d< t |¡}|  |d|d ¡}|d  ¡  | j|d d< ||d d< t ƒ }t |¡|d< | |	| ¡ fS )NÚResponseTokené   r;   r   r=   rŽ   r‰   é   Úsubkeyr’   r“   ú
seq-numberrê   rë   r„   )r1   rM   r   rN   r   r§   r   rÁ   r   r,   r›   r+   r¹   rW   ÚclearÚclonerU   r¨   r©   rª   r»   r    r¬   r   rš   r¼   ÚgetData)r‰   rå   Ú	auth_dataÚnegTokenResprg   Úap_reprá   râ   ÚencAPRepPartÚsessionKey2ÚsequenceNumberr¨   rú   rû   Úresprk   rk   rl   ÚgetKerberosType3ë  s8   (ýÿ

r  c              
   C   sX  t |tƒrzt|ƒ}W n	 ty   Y nw t |tƒr*zt|ƒ}W n	 ty)   Y nw t |tƒr?zt|ƒ}W n	 ty>   Y nw d| }|d u rX|d u rX|
rXt || |¡\}} }}t| tjj	j
d�}	 |d u rÆ|d u rÅzt|||||||	ƒ\}}}}W nW tyÄ } z>| ¡ tjjj
kr¿|dkr¾|dkr¾|dks›|d u r¾|d u r¾|d u r¾ddlm}m} t d¡ ||ƒ}||ƒ}W Y d }~qa‚ ‚ d }~ww n|d }|d	 }|d
 }|d u �rDt|tjjj
d�}zt|||	|||ƒ\}}}}W nS t�yB } zF| ¡ tjjj
k�r7|dk�r6|dk�r6|dk�s|d u �r6|d u �r6|d u �r6ddlm}m} t d¡ ||ƒ}||ƒ}n‚ ‚ W Y d }~nd }~ww n|d }|d	 }|d
 }nqbtƒ }td g|d< tj|tƒ d�d }tƒ }| |d ¡ tƒ }d|d< ttj jj
ƒ|d< t!ƒ }| "tj#j$j
¡ t %|¡|d< t&|d|j'ƒ t(ƒ }d|d< ||d< t&|d|j)ƒ t*j* +t*j,j-¡}|j.|d< t/ '|¡|d< t0|d< d|d d< t1ƒ }d|d< t2t3B t4B t5B t6B t7B |d< | 8¡ |d d< d|d< t9 :|¡}| ;|d |d ¡}t0|d!< |j<|d! d"< ||d! d	< t= >d#t?¡t@t= >d#tA¡t@td$ ƒ tB t9 :|¡ ƒ |d%< ||| 8¡ fS )&Nzhost/%sro   Tr‚   r   r‹   z)Got KDC_ERR_ETYPE_NOSUPP, fallback to RC4ÚKDC_REPr‰   rå   zMS KRB5 - Microsoft Kerberos 5Ú	MechTypesr;   ræ   rp   rq   rr   rç   rè   ré   ry   rê   rë   Úcksumi€  Ú	cksumtyper�   ÚLgthÚFlagsÚchecksumr  é   rí   r„   ÚBzKRB5 - Kerberos 5Ú	MechToken)Cr”   r•   r	   r–   r8   Ú	parseFiler!   r*   r—   r˜   rR   rÀ   rM   rO   rP   rŠ   r¿   rŒ   r�   r7   rD   ÚNT_SRV_INSTr÷   r/   r0   r   rN   r   r"   rï   r   r›   rœ   rŸ   r    Ú	APOptionsÚmutual_requiredr¥   r   r¬   r   r¦   rU   r¨   r©   rª   r»   r    r   r#   r(   r)   r'   r&   r%   r$   r
  r   rš   r¼   r¹   rA   rB   r4   r3   r2   r5   )ÚusernamerÄ   rÅ   rÆ   rÇ   rÈ   ÚTGTÚTGSÚ
targetNamerZ   ÚuseCacheÚuserNamer×   r‰   ÚoldSessionKeyrå   rd   rŒ   r�   rÊ   rþ   Úblobræ   rù   rÐ   rí   r¨   ÚchkFieldrú   rû   rk   rk   rl   ÚgetKerberosType1  sÒ   
ÿ
ÿ
ÿ 0
€ñý
<

ü€öË9

ÿÿÿr*  c                   @   s    e Zd ZdZdd„ Zdd„ ZdS )rÂ   zç
    Exception risen when we fail to decrypt a session key within an AS-REP
    message.
    It provides context information such as full AS-REP message but also the
    cipher, key and cipherText used when the error occurred.
    c                 C   s"   || _ || _|| _|| _|| _d S ©N)rÒ   rÔ   r‰   r‘   rá   )ÚselfrÒ   rÔ   r‰   r‘   rá   rk   rk   rl   Ú__init__±  s
   
z"SessionKeyDecryptionError.__init__c                 C   s
   d| j  S )NzSessionKeyDecryptionError: %s)rÒ   ©r,  rk   rk   rl   Ú__str__¸  s   
z!SessionKeyDecryptionError.__str__N)Ú__name__Ú
__module__Ú__qualname__Ú__doc__r-  r/  rk   rk   rk   rl   rÂ   ª  s    rÂ   c                   @   s:   e Zd ZdZddd„Zdd„ Zdd„ Zd	d
„ Zdd„ ZdS )rM   zç
    This is the exception every client should catch regardless of the underlying
    SMB version used. We'll take care of that. NETBIOS exceptions are NOT included,
    since all SMB versions share the same NETBIOS instances.
    r   c                 C   s2   t  | ¡ || _|| _|dkr| jd | _d S d S )Nr   z
error-code)r.   r-  rI   r>   )r,  rI   r>   rk   rk   rl   r-  Â  s   
ÿzKerberosError.__init__c                 C   ó   | j S r+  )rI   r.  rk   rk   rl   rO   É  ó   zKerberosError.getErrorCodec                 C   r4  r+  r=   r.  rk   rk   rl   ÚgetErrorPacketÌ  r5  zKerberosError.getErrorPacketc                 C   s   t j| j S r+  )r*   ÚERROR_MESSAGESrI   r.  rk   rk   rl   ÚgetErrorStringÏ  s   zKerberosError.getErrorStringc           
      C   sT  dt j| j  }z—| jt jjjkrVtj| jd t	ƒ d�d }t
 d|d  ¡ d d… ¡d }|tjv rMtj| d }tj| d }|d	|||f 7 }W |S |d
| 7 }W |S | jt jjjkr�z3t | jd  ¡ ¡\}}|d d  ¡ }tj|tƒ d�\}}|d d d  ¡ }	|d|	› �7 }W W |S  tyœ   Y W |S w W |S  ty©   Y |S w )NzKerberos SessionError: %s(%s)r…   r;   r   z<Lz
data-valuer:   r{   z
NT ERROR: code: 0x%x - %s - %sz#
NT ERROR: unknown error code: 0x%xÚnamezname-stringz. Account is superseded by )r*   r7  rI   rP   ÚKRB_ERR_GENERICrR   r   rN   r>   r   rA   rK   rW   r6   ÚKDC_ERR_CLIENT_REVOKEDr   r¶   r§   )
r,  Ú	retStringÚeDataÚnt_errorÚerror_msg_shortÚerror_msg_verboseÚ_Úoctet_stringÚ
supersededr9  rk   rk   rl   r/  Ò  s<    
òôûûùýýzKerberosError.__str__N)r   r   )	r0  r1  r2  r3  r-  rO   r6  r8  r/  rk   rk   rk   rl   rM   ¼  s    
rM   )r9   )rn   NTNF)F)rn   NNrn   NT)UrU   ÚrandomrE   rA   Úpyasn1.codec.derr   r   Úpyasn1.errorr   Úpyasn1.type.univr   r   Úpyasn1.type.usefulr   Úsixr   Úbinasciir	   r
   Úimpacket.krb5.asn1r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   Úimpacket.krb5.typesr    r!   r"   Úimpacket.krb5.gssapir#   r$   r%   r&   r'   r(   r)   Úimpacket.krb5r*   Úimpacket.krb5.cryptor+   r,   r-   Úimpacket.smbconnectionr.   Úimpacket.spnegor/   r0   r1   r2   r3   r4   r5   Úimpacketr6   r7   Úimpacket.krb5.ccacher8   ÚSystemRandomr­   ÚNotImplementedErrorrm   rÀ   r÷   r  r*  r§   rÂ   rM   rk   rk   rk   rl   Ú<module>   sL   \$ þ

,  
z1
ÿ 