o j< @sddlZddlZddlZddlZddlZddlmZmZddlm Z m Z ddl m Z ddl mZddlmZmZddlmZmZmZmZmZmZmZmZmZmZmZdd lmZdd l m!Z!m"Z"m#Z#m$Z$dd l%m&Z&m'Z'dd l(m)Z)m*Z*m+Z+d Z,dZ-dZ.GdddeZ/dddddddddd Z0Gdddej1Z2GdddeZ3d d!Z4Gd"d#d#e5Z6  $d.d%d&Z7d'd(Z8d)d)d)d)ddde,df d*d+Z9d)d)d)d)ddde,df d,d-Z:dS)/N) namedtypeuniv)decoderencoder)LOG)Enum)getKerberosTGT sendReceive) _sequence_component_sequence_optional_componentseq_setRealm PrincipalName AuthenticatorAS_REPAP_REQAP_REPKRB_PRIVEncKrbPrivPart)CCache)PrincipalNameTypeApplicationTagNumbers AddressType encodeFlags)Keyget_random_bytes) Principal KerberosTimeTicketiizkadmin/changepwc@s0eZdZdZdZdZdZdZdZdZ dZ d Z d S) KPasswdResultCodesrrN) __name__ __module__ __qualname__SUCCESS MALFORMED HARDERROR AUTHERROR SOFTERROR ACCESSDENIED BAD_VERSIONINITIAL_FLAG_NEEDEDUNKNOWNr4r4/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/impacket/krb5/kpasswd.pyr 4sr zpassword changed successfullyz!protocol error: malformed requestz%server error (KRB5_KPASSWD_HARDERROR)zLauthentication failed (may also indicate that the target user was not found)z1password change rejected (KRB5_KPASSWD_SOFTERROR)z access deniedzprotocol error: bad versionz#protocol error: initial flag neededz unknown error) rrr!r"r#r$r%r&r'c@s:eZdZeeddeedde edde Z dS)ChangePasswdData newpasswdrtargnamer targrealmr!N) r(r)r*r NamedTypesr r OctetStringr rr componentTyper4r4r4r5r6Ms   r6c@s$eZdZdZdZdZdZdZdZdS)PasswordPolicyFlagsrr!r# N) r(r)r*Complex NoAnonChange NoClearChange LockoutAdminsStoreCleartextRefusePasswordChanger4r4r4r5r=Ysr=cstd}d}t|t|ks|dddkrtt||ddd|d|fd d tDd }|S) Nz!HIIIQQl@T$rr!srr#r$cs g|] }|jd@r|jqS)r")valuename).0flag propertiesr4r5 os z)_decodePasswordPolicy..) minLengthhistorymaxAgeminAgeflags)lenstructcalcsize ValueErrorunpackr=) ppolicyString ppolicyStruct ticksInADaypasswordPolicyr4rKr5_decodePasswordPolicybs"   r\c@s eZdZdS) KPasswdErrorN)r(r)r*r4r4r4r5r]wsr] localhostc Cs| dur ttdd} | durtjtjj} t|ts"| d}t } d| d<|| d<t | d|j | j | d<t| | d <| | d <tj| d <|j| d d <|j| d d <t | } ||d| d}tdt| t}d|d<ttjj|d<tt|d<t |d|jtj|d<|j|dd<||dd<t |}t }||d<|r|r|!|d<tj|d<t"j#j|dd<||ddd<t |}tdt|t$}t ||d<| |d <tj|d<t%j&j|dd <| |dd!<t |}||d"|d}td#t|t'}d|d<ttj'j|d<tj|d$<|j|d$d<||d$d<t |}t(|}t(|}d%||}t)*d&|t+|}|||}|S)'Nr#bigutf-8r$zauthenticator-vnocrealmcnamecusecctimez seq-numbersubkeykeytypekeyvalue zb64(authenticator): {}pvnozmsg-typez ap-optionsticket authenticatoretypecipherr7r9r8z name-typez name-stringrzb64(changePasswdData): {} user-dataz s-addressz addr-typeaddress b64(encKrbPrivPart): {}enc-partr%!HHH),int from_bytesrdatetimenowtimezoneutc isinstancebytesencoderr components_to_asn1 microsecondrto_asn1rnoValueenctypecontentsrencryptrdebugformatbase64 b64encoderrrGrlistr6upperr NT_PRINCIPALrrIPv4rrSrTpackKRB5_KPASSWD_PROTOCOL_VERSION) principaldomain newPasswdtgsrm sessionKeysubKeytargetPrincipal targetDomainsequenceNumberrwhostnamerkencodedAuthenticatorencryptedEncodedAuthenticatorapReq apReqEncodedchangePasswdDataencodedChangePasswdDataencKrbPrivPartencodedEncKrbPrivPartencryptedEncKrbPrivPartkrbPrivkrbPrivEncodedapReqLen krbPrivLen messageLenencodedr4r4r5createKPasswdRequest{sv                   rc Csd}t|}z!|d|}t||\}}}||||}|||d} Wntdztj|tdd} tj| tdd} Wntd| dd} z ||d| } Wntd t d t | z#tj| tdd}|d }t|dd d |d d}}Wntdt d ||zt|}Wn tytd}Ynwzt|}dj di|}Wn%ttjfyz|d}Wntyt|d}YnwYnw|tjjk}||||fS)Nrsz(kpasswd: malformed reply from the serverasn1SpecrzBkpasswd: malformed AP_REP or KRB_PRIV in the reply from the serverrrrmrpz=kpasswd: cannot decrypt KRB_PRIV in the reply from the serverrqrnr!r_zNkpasswd: malformed EncKrbPrivPart in the KRB_PRIV in the reply from the serverzresultCode: {}, message: {}r'zPassword policy: Minimum length: {minLength} Password history: {history} Flags: {flags} Maximum password age: {maxAge} days Minimum password age: {minAge} daysr`zlatin-1r4)rTrUrWr]rdecoderrdecryptrrrrrrasOctetsrtruRESULT_MESSAGESKeyErrorr\rVerrorUnicodeDecodeErrorbinasciihexlifyr r+rG)rrmr headerStruct headerLenheaders_apRepLen apRepEncodedrapReprrrrresult resultCodemessageresultCodeMessageppolicysuccessr4r4r5decodeKPasswdReplysb    &       rc Cs&t||dd|||||||| | | dS)ad Change the password of the requesting user with RFC 3244 Kerberos Change-Password protocol. At least one of oldPasswd, (oldLmhash, oldNthash) or (TGT, aesKey) should be defined. :param string clientName: username of the account changing their password :param string domain: domain of the account changing their password :param string newPasswd: new password for the account :param string oldPasswd: current password of the account :param string oldLmhash: current LM hash of the account :param string oldNthash: current NT hash of the account :param string aesKey: current AES key of the account :param string TGT: TGT of the account. It must be a TGT with a SPN of kadmin/changepw :param string kdcHost: KDC address/hostname, used for Kerberos authentication :param string kpasswdHost: KDC exposing the kpasswd service (TCP/464, UDP/464), used when sending the password change requests (Default: same as kdcHost) :param int kpasswdPort: TCP port where kpasswd is exposed (Default: 464) :param string subKey: Subkey to use to encrypt the password change request (Default: generate a random one) :return void: Raise an KPasswdError exception on error. N) setPassword) clientNamerr oldPasswd oldLmhash oldNthashaesKeyTGTkdcHost kpasswdHost kpasswdPortrr4r4r5changePasswords   rc Cs| dur| } t|tjjd}| durTtdrTtd}zt|}WnYn+t d |t }| |d}|durK| } td ||n td ||| durit||||||| t d\}}}}n | d }| d }| d }tj|td d }t}||d| durt|j}t|j|} t||||||| || }t||| | }t||| \}}}}|rdS|}|r|d|7}t|)a Set the password of a target account with RFC 3244 Kerberos Set-Password protocol. Requires "Reset password" permission on the target, for the user. At least one of oldPasswd, (oldLmhash, oldNthash) or (TGT, aesKey) should be defined. :param string clientName: username of the account performing the reset :param string domain: domain of the account performing the reset :param string targetName: username of the account whose password will be changed :param string targetDomain: domain of the account whose password will be changed :param string newPasswd: new password for the target account :param string oldPasswd: current password of the account performing the reset :param string oldLmhash: current LM hash of the account performing the reset :param string oldNthash: current NT hash of the account performing the reset :param string aesKey: current AES key of the account performing the reset :param string TGT: TGT of the account performing the reset It must be a TGT with a SPN of kadmin/changepw :param string kdcHost: KDC address/hostname, used for Kerberos authentication :param string kpasswdHost: KDC exposing the kpasswd service (TCP/464, UDP/464), used when sending the password change requests (Default: same as kdcHost) :param int kpasswdPort: TCP port where kpasswd is exposed (Default: 464) :param string subKey: Subkey to use to encrypt the password change request (Default: generate a random one) :return bool: True if successful, raise an KPasswdError exception on error. N)type KRB5CCNAMEzUsing Kerberos cache: {}FzUsing TGT for {} from cache {}z%No valid TGT for {} found in cache {}) serverNameKDC_REPrmrrrrjz: )rrrrGosgetenvrloadFilerrrKRB5_KPASSWD_TGT_SPN getCredentialtoTGTinfor rrrr from_asn1rkeysizerrrr rr]) rr targetNamerrrrrrrrrrruserNamerccachercredstgtrm oldSessionKeyrrj subKeyBytes kpasswordReq kpasswordReprrrr errorMessager4r4r5r=sP     r)NNNNr^);rrrvrrT pyasn1.typerrpyasn1.codec.derrrimpacketrimpacket.dcerpc.v5.enumr kerberosv5r r asn1r r r rrrrrrrrrr constantsrrrrcryptorrtypesrrrKRB5_KPASSWD_PORTrrr rSequencer6r=r\ Exceptionr]rrrrr4r4r4r5sV  4      \ F "