o
    �õ±j%Ê  ã                   @  s  d dl mZ d dlmZ d dlZd dlZd dlZd dlZd dlZd dl	Z	d dl
mZ d dlmZ d dlmZ d dlmZ d dlmZmZmZmZmZmZmZmZmZmZmZmZmZm Z m!Z!mZm"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z*m+Z+m,Z,m-Z-m.Z.m/Z/m0Z0m1Z1m2Z2m3Z3m4Z4m5Z5m6Z6m7Z7m8Z8m9Z9 d d	l:m;Z;m<Z<m=Z= d d
l>m?Z?m@Z@ d dlAmBZBmCZCmDZDmEZEmFZFmGZGmHZH d dlImJZJmKZKmLZLmMZM d dlNmOZO d dlPmQZQ d dlRmSZSmTZT d dlUmVZV d dlWmXZX d dlYmZZZm[Z[m\Z\m]Z]m^Z^ d dl_m`Z` d dlambZb d dlcmdZd d dlcmeZe G dd„ dƒZfdS )é    )Úannotations)ÚhashlibN)ÚList)Úlogger)ÚCCACHE)ÚKerberosSPN)(ÚMETHOD_DATAÚ
ETYPE_INFOÚETYPE_INFO2ÚPADATA_TYPEÚPA_PAC_REQUESTÚPA_ENC_TS_ENCÚEncryptedDataÚ	krb5_pvnoÚKDC_REQ_BODYÚAS_REQÚTGS_REPÚ
KDCOptionsÚPrincipalNameÚEncASRepPartÚEncTGSRepPartr   ÚRealmÚChecksumÚ	APOptionsÚAuthenticatorÚTicketÚAP_REQÚTGS_REQÚ	CKSUMTYPEÚPA_FOR_USER_ENCÚPA_PAC_OPTIONSÚPA_PAC_OPTIONSTypesÚEncTicketPartÚChangePasswdDataMSÚEncryptionKeyÚEncKrbPrivPartÚHostAddressÚKRB_PRIVÚAP_REPÚKERB_KEY_LIST_REQÚ	S4UUserIDÚS4UUserIDOptionsÚPA_S4U_X509_USERÚTransitedEncodingÚTicketFlags)ÚKRB5ChangePasswordÚKRB5CHPWReplyÚKRB5CHPWResultCode)ÚKerberosErrorCodeÚKerberosError)ÚKeyÚ_enctype_tableÚ_HMACMD5ÚEnctypeÚ_checksum_tableÚ_SHA1AES128Ú_SHA1AES256)Ú
PaDataTypeÚEncryptionTypeÚ	NAME_TYPEÚMESSAGE_TYPE)ÚAuthenticatorChecksum)ÚGSSAPIFlags)ÚAIOKerberosClientSocketÚAIOKerberosPWChangeClientSocket)ÚKerberosCredential)ÚKerberosTarget)ÚPKAuthenticatorÚAuthPackÚPA_PK_AS_REPÚKDCDHKeyInfoÚPA_PK_AS_REQ)ÚChannelBindingsStruct)Úconstruct_apreq_from_tgs_tgt)Úcms)Úcorec                   @  sT  e Zd ZdJdd„Zdd„ Zd	d
„ Zg d¢dddddfdKdd„Zg d¢dfdLdd„Zg d¢dfdMdd„Zdd„ Z	dd„ Z
ddg d¢ddfdNd"d#„ZdOd%d&„Zddg d'¢fdOd(d)„Zg d*¢ejejejejejejejgfd+d,„Zdg d-¢fd.d/„Zd0d1„ Zg d-¢dfdPd4d5„Zdd6g dfd7d8„Zd9d:„ Zd;d<„ ZdQd=d>„ZdRdSdFdG„ZdTdUdHdI„ZdS )VÚAIOKerberosClientÚccredrC   ÚtargetrD   c                 C  s„   || _ || _t| jƒ| _tƒ | _|d ur"| j jd u rtƒ n| j j| _d | _d | _d | _d | _	d | _
d | _d | _d | _d | _d | _d S ©N)Ú
credentialrP   rA   Úksocr   ÚccacheÚpkinit_tkeyÚkerberos_session_keyÚkerberos_TGTÚkerberos_TGT_encpartÚkerberos_TGSÚkerberos_cipherÚkerberos_cipher_typeÚkerberos_keyÚserver_saltÚserver_supp_enc_methods)ÚselfrO   rP   © r`   ú‰/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/minikerberos/aioclient.pyÚ__init__)   s    
zAIOKerberosClient.__init__c                 Ã  s   �| S rQ   r`   )r_   r`   r`   ra   Ú
__aenter__<   s   €zAIOKerberosClient.__aenter__c                 Ã  s   �d S rQ   r`   )r_   Úexc_typeÚexcÚ	tracebackr`   r`   ra   Ú	__aexit__?   s   €zAIOKerberosClient.__aexit__)ÚforwardableÚ	renewableÚ	proxiableNFTÚkdcoptsú	List[str]Úwith_pacÚboolÚreturnr   c                 C  sJ  t  d¡ g }|du r$i }	ttdƒƒ|	d< tddiƒ ¡ |	d< | |	¡ t  d|j ¡ tj 	tj
j¡}
|du rž|d u rt|
jd	d
�|
jdœƒ ¡ }t|j | _|j| _| j| d urb| j|  ¡ nd | _t| jj| jj|| jd�ƒ| _| j | jd|d ¡}n|}
|}i }ttdƒƒ|d< t|j|dœƒ ¡ |d< | |¡ i }tt|ƒƒ|d< tt j!j| jj" #d¡dœƒ|d< | jj$ %¡ |d< tt j!jd| jj$ %¡ gdœƒ|d< |
tj&dd� jd	d
�|d< |
tj&dd� jd	d
�|d< t' (d¡|d< |jg|d< |d u�r|D ]	}|| ||< �qi }t)|d< t*j+j|d< ||d< t,|ƒ|d < t-|ƒS )!Nz'Constructing TGT request with auth dataTúPA-PAC-REQUESTúpadata-typeúinclude-pacúpadata-valuez$Selecting common encryption type: %sFr   ©Úmicrosecond)ÚpatimestampÚpausec)Úsalté   zENC-TIMESTAMP©ÚetypeÚcipherúkdc-optionsú/©z	name-typeúname-stringÚcnameÚrealmÚkrbtgtÚsname©ÚdaysÚtillÚrtimeé   Únoncer{   Úpvnoúmsg-typeÚpadataúreq-body).r   ÚdebugÚintr   r   ÚdumpÚappendÚnameÚdatetimeÚnowÚtimezoneÚutcr   Úreplaceru   r5   ÚvaluerZ   r[   r^   Úencoder]   r4   ÚenctyperR   Úget_key_for_enctyper\   Úencryptr   r   Úsetr   r=   Ú	PRINCIPALÚusernameÚsplitÚdomainÚupperÚ	timedeltaÚsecretsÚrandbitsr   r>   Ú
KRB_AS_REQr   r   )r_   Úsupported_encryption_methodrk   ÚenctimestampÚnewnowÚ
no_preauthÚkdc_req_body_extrarm   ÚpadatasÚ	pa_data_1r•   Ú	timestampÚenc_timestampÚ	pa_data_2Úkdc_req_bodyÚkeyÚkdc_reqr`   r`   ra   Úbuild_asreq_ltsC   sR   

"
 "
z!AIOKerberosClient.build_asreq_lts)rh   ri   zrenewable-okc                 C  s€  ddl m} |jdkrtdƒ‚tj tjj¡}i }tt	|ƒƒ|d< t
tjj| jj d¡dœƒ|d< | jj ¡ |d	< t
tjjd
| jj ¡ gdœƒ|d< |tjdd� jdd�|d< |tjdd� jdd�|d< t d¡|d< |jg|d< t|ƒ}t | ¡ ¡ ¡ }i }	|j|	d< |jdd�|	d< t d¡|	d< ||	d< i }
| jjj|
d< | jjj|
d< d|
d< i }d|d< |  |
¡|d< i }| !|¡|d< | jj "¡ |d< i }t#|	ƒ|d< | $|¡|d< | jjj%|d < t&|ƒ}| jj'| ¡ d!d"�}t(ƒ }||d#< g }|d!u �ri }t)t*d$ƒƒ|d%< t+d&d!iƒ ¡ |d'< | ,|¡ i }t-j.j|d%< | ¡ |d'< | ,|¡ i }d(|d)< d*|d+< ||d,< ||d-< t/|ƒS ).Nr   )Úkeysé   z5RC4 encryption is not supported for certificate auth!r}   r~   r   r�   r‚   rƒ   r„   ry   r…   rt   r‡   rˆ   r‰   rŠ   r{   ÚcusecÚctimeÚ
paChecksumÚpÚgÚqz1.2.840.10046.2.1Ú	algorithmÚ
parametersÚ
public_keyÚpkAuthenticatorÚclientPublicValueÚclientDHNonceT)Úwrap_signedÚsignedAuthPackrp   rq   rr   rs   é   r‹   é
   rŒ   r�   rŽ   )0Ú
asn1cryptor¶   r™   Ú	Exceptionr”   r•   r–   r—   r   rž   r   r=   rŸ   rR   r    r¡   r¢   r£   ÚSRV_INSTr¤   r˜   r¥   r¦   r   r   Úsha1r‘   Údigestru   Údhparamsr»   r¼   ÚDomainParametersÚPublicKeyAlgorithmÚget_public_keyrE   ÚPublicKeyInfoÚdh_noncerF   Úsign_authpackrI   r�   r   r   r’   r;   Ú	PK_AS_REQr   )r_   r¨   rk   rm   r¶   r•   Úkdc_req_body_datar²   ÚchecksumÚauthenticatorÚdpÚpkaÚspkiÚauthpackÚsigned_authpackÚpayloadr­   Ú	pa_data_0r®   Úasreqr`   r`   ra   Úbuild_asreq_pkinitx   sl   
 "



z$AIOKerberosClient.build_asreq_pkinitc                 Ã  sh   �| j jd ur| j|||d�}n| j|||d�}t d¡ | j | ¡ ¡I d H }|j	dkr2t
|dƒ‚|S )N©rm   zSending TGT request to serverÚ	KRB_ERRORzPreauth failed!)rR   Úcertificaterà   rµ   r   r�   rS   Úsendrecvr‘   r“   r3   )r_   r¨   rk   rm   ÚreqÚrepr`   r`   ra   Ú
do_preauthÄ   s   €


zAIOKerberosClient.do_preauthc              
   C  s°   zA| j d u r
tdƒ‚| j  | jj| jj| jj¡\}}}|d ur!|‚|| _|d | _t	|d |d ƒ| _
t|d  | _|d | _W dS  tyW } z
d |fW  Y d }~S d }~ww )NúNo CCACHE file foundúenc-partÚkeytypeÚkeyvalue)TN)rT   rÉ   Úget_tgtrR   r    r¢   Úccache_spn_strict_checkrW   rX   r4   rV   r5   rZ   r[   )r_   ÚtgtÚ	keystructÚerrÚer`   r`   ra   Útgt_from_ccacheÑ   s    
"

€ÿz!AIOKerberosClient.tgt_from_ccachec                 C  sê   t  ¡ | _t |d ¡jD ]L}t|d ƒ}|tjks|tjkrY|tjkr,t |d ¡}n|tjkr8t |d ¡}|jD ]}|d | jt	|d ƒ< t
 dt	|d ƒj|d f ¡ q;q| j | j¡}| j | j¡}|| jvrqtdƒ‚||fS )Nze-datarq   rs   rx   r{   z/Server supports encryption type %s with salt %sz,Preferred enc type not in supported enctypes)ÚcollectionsÚOrderedDictr^   r   ÚloadÚnativer;   r	   r
   r<   r   r�   r“   rR   Úget_common_enctypesÚget_preferred_enctyperÉ   )r_   ræ   Ú
enc_methodÚ	data_typeÚenc_info_listÚenc_infoÚcommon_enctypesÚpreferred_enc_typer`   r`   ra   Ú"select_preferred_encryption_methodâ   s"   



"€
z4AIOKerberosClient.select_preferred_encryption_methodÚoverride_snamer   c                 Ã  sÒ  �|   ¡ \}}|du rdS t d¡ tj tjj¡}i }	tt|ƒƒ|	d< t	t
jj| jj d¡dœƒ|	d< | jj ¡ |	d< |du rRt	t
jjd| jj ¡ gdœƒ|	d	< nt	t
jj| ¡ dœƒ|	d	< |tjd
d� jdd�|	d< |tjd
d� jdd�|	d< t d¡|	d< |du rŽ| j ¡ |	d< n||	d< | jjdur³d}dd„ |	d D ƒ|	d< t|	d ƒdkr³ddg|	d< |	d du sÁt|	d ƒdkrÇg d¢|	d< i }
|du rßttdƒƒ|
d< tddiƒ ¡ |
d< i }t|d< t j!j|d< t|
ƒdkrö|
g|d< t"|	ƒ|d < t#|ƒ}t d!| j$ %¡  ¡ | j$ &| ¡ ¡I dH }|j'd"k�rS|j(}|| _)|d#k�s-| jj*du �r/|S t+|d$ d  | _,|d$ d | _-t.| j,j/| j 0t1|d$ d ƒ¡ƒ| _2�n |j(d% t3j4jk�rat5|ƒ‚|j(}t d&¡ d}|  6|¡\}}|du �rØz| j7||d'�I dH }W n» t5�y× } zG|j8t3j9k�r•|‚| :|¡ |D ],}z| j7||d'�I dH }W  n! t5�yÈ } z|j8t3j9k�r½|‚W Y d}~�qœd}~ww t;d(ƒ‚W Y d}~nld}~ww t<|t=ƒd#u �rã|g}|D ]Y}t1t|ƒƒ}z| j7||d'�I dH }W n3 t5�y } z|j8t3j9k�r|‚t d)|j' ¡ W Y d}~�qåd}~w t;�y, } z|‚d}~ww |j'd"k�r5 n
t d)|j' ¡ �qå|du �rHt;d(ƒ‚t d*¡ |j(}|| _)| jjdu�r{|  >|¡\| _?| _@| _,|j| _-| jAjB| j)| j?dd+� t d,¡ dS |d$ d- }| j, C| j2d.|¡}z	tD E|¡j(| _?W n6 t;�yÉ } z)t d/¡ z	tF E|¡j(| _?W n t;�y¾ } zt Gd0¡ |‚d}~ww W Y d}~nd}~ww t.| j,j/| j?d1 d2 ƒ| _@| jAjB| j)| j?dd+� t d,¡ dS )3aJ  
		decrypt_tgt: used for asreproast attacks
		Steps performed:
			1. Send and empty (no encrypted timestamp) AS_REQ with all the encryption types we support
			2. Depending on the response (either error or AS_REP with TGT) we either send another AS_REQ with the encrypted data or return the TGT (or fail miserably)
			3. PROFIT
		Nz2Generating initial TGT without authentication datar}   r~   r   r�   r‚   rƒ   r„   ry   r…   r   rt   r‡   rˆ   r‰   rŠ   r{   c                 S  s   g | ]}|d kr|‘qS )r·   r`   ©Ú.0Úxr`   r`   ra   Ú
<listcomp>  s    z-AIOKerberosClient.get_TGT.<locals>.<listcomp>é   é   )r·   r  r  Trp   rq   rr   rs   r‹   rŒ   r�   rŽ   zSending initial TGT to %srâ   Fré   ú
error-codez1Got reply from server, askig to provide auth datará   z2Failed to get TGT with any of the provided etypes!zFailed to get TGT with etype %sz"Got valid TGT response from server)Úoverride_ppzGot valid TGTr|   é   z(EncAsRepPart load failed, is this linux?z+Failed to load decrypted part of the reply!r³   rë   )Hrò   r   r�   r”   r•   r–   r—   r   rž   r   r=   rŸ   r™   rR   r    r¡   r¢   r£   rÊ   Úget_principalnamer¤   r˜   r¥   r¦   Úget_supported_enctypesrã   Úlenr�   r   r   r‘   r   r>   r§   r   r   rS   Úget_addr_strrä   r“   rö   rW   Ú	nopreauthr5   rZ   r[   r4   r›   rœ   r<   r\   r2   ÚKDC_ERR_PREAUTH_REQUIREDr3   rÿ   rç   Ú	errorcodeÚKDC_ERR_ETYPE_NOTSUPPÚremoverÉ   Ú
isinstanceÚlistÚdecrypt_asrep_certrX   rV   rT   Úadd_tgtÚdecryptr   rõ   r   Úerror)r_   Úoverride_etypeÚdecrypt_tgtrk   r   rm   Ú_rð   r•   r²   r®   r´   rå   ræ   Úpreauth_repr¨   Úall_common_enctypesrñ   r{   Ú	etype_intÚ
cipherTextÚtempr`   r`   ra   Úget_TGTû   sú   €

 $
(


ÿ€ÿû€õ€€ÿ




€þÿ€ý
zAIOKerberosClient.get_TGTÚspn_userc              
   C  s¼   zE| j d u r
tdƒ‚| j  |¡\}}}|d ur|‚t|d |d ƒ}t|d |d dœƒ ¡ }td|dœƒ|d< t|ƒj}||d |d fW S  ty] } zd d d |fW  Y d }~S d }~ww )Nrè   rê   rë   ©rê   rë   r   rz   ré   )	rT   rÉ   Úget_tgsr4   r$   r‘   r   r   rö   )r_   r"  Útgsrï   rð   r³   Úkeydatarñ   r`   r`   ra   Útgs_from_ccachež  s   

€ÿz!AIOKerberosClient.tgs_from_ccache)rh   ri   Úrenewable_okÚcanonicalizec                 Ã  s  �|   |¡\}}}}|du r|||fS | jdu r&|  ¡ \}	}|dur&tdƒ‚t d| ¡  ¡ tj tj	j
¡}
i }tt|ƒƒ|d< | jd d d d |d	< ttjj| ¡ d
œƒ|d< |
tjdd� jdd�|d< t d¡|d< |rw||d< n| jdkr‚dg|d< n| jdg|d< i }t|d< t| jd ƒ|d< | jd |d< |
j|d< |
jdd�|d< |rÍtƒ }d|_d|_i }d|d< | ¡ |d< t|ƒ|d< d|d< | j  | j!dt"|ƒ #¡ d¡}i }t|d < t$j%j|d!< t&tƒ ƒ|d"< t'| jd ƒ|d< t(| j|d#œƒ|d$< i }t)j*j|d%< t+|ƒ #¡ |d&< i }t|d < t$j,j|d!< |g|d'< t-|ƒ|d(< t*|ƒ}t d)¡ | j. /| #¡ ¡I dH }|j0d*k�rGt1|d+ƒ‚t d,¡ |j2}t3 4| j 5| j!d-|d. d/ ¡¡j2}t6|d0 d1 |d0 d2 ƒ}| j7 8||¡ t d3¡ || _9|||fS )4a…  
		Requests a TGS ticket for the specified user.
		Retruns the TGS ticket, end the decrpyted encTGSRepPart.

		spn_user: KerberosTarget: the service user you want to get TGS for.
		override_etype: None or list of etype values (int) Used mostly for kerberoasting, will override the AP_REQ supported etype values (which is derived from the TGT) to be able to recieve whatever tgs tiecket 
		NzNo TGT found in CCACHE!z$Constructing TGS request for user %sr}   Úticketr„   r€   ry   r‚   r   r…   r   rt   r‡   r‰   rŠ   r{   i€ÿÿÿr·   úauthenticator-vnoÚcrealmr�   r¸   r¹   s                   i€  Ú	cksumtyperÖ   Úcksumú
seq-numberé   r‹   rŒ   ú
ap-optionsrz   r×   rq   rs   r�   rŽ   z"Constructing TGS request to serverrâ   zget_TGS failed!zGot TGS reply, decrypting...é   ré   r|   r³   rê   rë   zGot valid TGS reply):r'  rW   rò   rÉ   r   r�   Úget_formatted_pnamer”   r•   r–   r—   r   rž   r   r=   rÊ   r™   r
  r¤   r˜   r¥   r¦   r[   r   r   ru   r?   ÚflagsÚchannel_bindingÚto_bytesr   rZ   r�   rV   r   r‘   r>   Ú
KRB_AP_REQr   r   r   r;   r   r   ÚKRB_TGS_REQr   rS   rä   r“   r3   rö   r   rõ   r  r4   rT   Úadd_tgsrY   )r_   r"  r  Úis_linuxr4  r%  ÚencTGSRepPartr³   rð   r  r•   r²   Úauthenticator_dataÚacÚchksumÚauthenticator_data_encÚap_reqr®   r´   rå   ræ   r`   r`   ra   Úget_TGS±  s€   €









"

zAIOKerberosClient.get_TGS)rh   ri   r)  zenc-tkt-in-skeyc                 Ã  sÎ  �| j st d¡ |  ¡ I d H  | j |¡}tj tjj	¡}i }t
|d< t| j d ƒ|d< | j d |d< |j|d< |jdd�|d< | j | jd	t|ƒ ¡ d ¡}i }t
|d
< tjj|d< ttƒ ƒ|d< t| j d ƒ|d< t| j|dœƒ|d< i }tjj|d< t|ƒ ¡ |d< i }	tt|ƒƒ|	d< tt j!j| jj" #d¡dœƒ|	d< | jj$ %¡ |	d< |tj&dd� jdd�|	d< t' (d¡|	d< dg|	d< t| j d ƒg|	d< i }
t
|
d
< tj)j|
d< |g|
d< t*|	ƒ|
d < t|
ƒ}t d!¡ | j+ ,| ¡ ¡I d H }|j-d"k�rd#}|j.d$ d%k�rd&}t/||ƒ‚t d'¡ |j.}t0t1|d d( d ƒ }|d d( d) }| 2| jd*|¡}t3 4|¡j.}t5 4| j 2| jd+|d( d) ¡¡j.}t6|d, d- |d, d. ƒ}| j7 8||¡ t d/¡ ||||fS )0Nz+[U2U] TGT is not available! Fetching TGT...r+  r,  r�   r¸   r   rt   r¹   r0  r‹   rŒ   r1  r*  rz   r×   rq   rs   r}   r~   r   r„   r‚   ry   r…   r‡   r‰   rŠ   r·   r{   úadditional-ticketsr�   rŽ   z[U2U] Sending request to serverrâ   z[U2U] failed!r  é   zc[U2U] Failed to get U2U! Error code (16) indicates that delegation is not enabled for this account!z[U2U] Got reply, decrypting...ré   r|   é   r2  r³   rê   rë   z[U2U] Got valid TGS reply)9rW   r   r�   r!  rR   rø   r”   r•   r–   r—   r   r   ru   r˜   rZ   r�   rV   r   r‘   r>   r7  r™   r   rž   r   r   r[   r;   r   r   r   r   r=   rŸ   r    r¡   r¢   r£   r¤   r¥   r¦   r8  r   rS   rä   r“   rö   r3   r5   r�   r  r"   rõ   r   r4   rT   r9  )r_   rk   Úsupp_enc_methodsÚsupp_encr•   r<  r?  r@  Úpa_data_authÚkrb_tgs_bodyÚkrb_tgs_reqrå   ÚreplyÚemsgr%  r|   Ú	encticketÚdecdataÚ	decticketr;  r³   r`   r`   ra   ÚU2U  sl   €

 




"
zAIOKerberosClient.U2U)rh   ri   r)  c                 Ã  s°  �| j st d¡ |  ¡ I dH  d}tj tjj¡}i }t|d< t	| j d ƒ|d< | j d |d< |j
|d< |jdd	�|d
< | j | jdt|ƒ ¡ d¡}i }t|d< tjj|d< ttƒ ƒ|d< t| j d ƒ|d< t| j|dœƒ|d< i }	tjj|	d< t|ƒ ¡ |	d< tjjjdddd�}
|
|j  ¡ 7 }
|
|j!  ¡ 7 }
|
|  ¡ 7 }
t d|
 "¡  ¡ t d|
 ¡ t# $| jd|
¡}t d| "¡  ¡ i }t%t&dƒƒ|d< ||d< i }t'tjj| (¡ dœƒ|d< |j!|d < t)|ƒ|d!< ||d"< i }t%t*d#ƒƒ|d< t+|ƒ ¡ |d< |du�rt,|t-ƒ�r|g}nt,|t.ƒ�r|}n| (¡ }n| j/j 0d$¡}i }t1t|ƒƒ|d%< t'tj2j|dœƒ|d&< | j/j! 3¡ |d'< |tj4d(d)� jdd	�|d*< t5 6d+¡|d,< | jj7g|d-< i }t|d< tj8j|d< |	|g|d.< t9|ƒ|d/< t|ƒ}t d0¡ | j: ;| ¡ ¡I dH }|j<d1k�ržd2}|j=d3 d4k�r™d5}t>||ƒ‚t d6¡ |j=}t? @| j A| jd7|d8 d9 ¡¡j=}tB|d: d; |d: d< ƒ}| jC D||¡ t d=¡ || _E|||fS )>ú0
		user_to_impersonate : KerberosTarget class
		z0[S4U2self] TGT is not available! Fetching TGT...NÚKerberosr+  r,  r�   r¸   r   rt   r¹   r0  r‹   rŒ   r1  r*  rz   r×   rq   rs   é   ÚlittleF©Úsignedz[S4U2self] S4UByteArray: %sr  z[S4U2self] chksum_data: %sÚHMAC_MD5r-  rÖ   r   ÚuserNameÚ	userRealmr.  zauth-packagezPA-FOR-USERr~   r}   r„   r‚   ry   r…   r‡   r‰   rŠ   r{   r�   rŽ   z$[S4U2self] Sending request to serverrâ   úS4U2self failed!r  rC  úlS4U2self: Failed to get S4U2self! Error code (16) indicates that delegation is not enabled for this account!z#[S4U2self] Got reply, decrypting...r2  ré   r|   r³   rê   rë   z[S4U2self] Got valid TGS reply)FrW   r   r�   r!  r”   r•   r–   r—   r   r   ru   r˜   rZ   r�   rV   r   r‘   r>   r7  r™   r   rž   r   r   r[   r;   r   r   r=   rŸ   r6  r    rš   r¢   Úhexr6   rÖ   r�   r   r   r
  r   r   r   r  Ústrr  rR   r¡   r   ÚUNKNOWNr£   r¤   r¥   r¦   r›   r8  r   rS   rä   r“   rö   r3   r   rõ   r  r4   rT   r9  rY   )r_   Úuser_to_impersonater"  rk   Úauth_package_namer•   r<  r?  r@  rG  ÚS4UByteArrayÚchksum_datar>  Úpa_for_user_encÚpa_for_userrH  rI  rå   rJ  rK  r%  r;  r³   r`   r`   ra   ÚS4U2selfZ  s˜   €







"

zAIOKerberosClient.S4U2selfc                 Ã  s˜  �t  dd | ¡ ¡ ¡ tj tjj¡}i }tt	dƒƒ|d< t
dttdgƒƒiƒ ¡ |d< i }t|d< t| jd	 ƒ|d	< | jd
 |d
< |j|d< |jdd�|d< | j | jdt|ƒ ¡ d ¡}i }t|d< tjj|d< ttƒ ƒ|d< t| jd ƒ|d< t| j|dœƒ|d< i }tjj|d< t |ƒ ¡ |d< i }	t!tg d¢ƒƒ|	d< t"t#j$j| ¡ dœƒ|	d< | j%j& '¡ |	d< |tj(dd� jdd�|	d< t) *d¡|	d< | jj+g|	d < |g|	d!< i }
t|
d< tj,j|
d< ||g|
d"< t-|	ƒ|
d#< t|
ƒ}| j. /| ¡ ¡I d H }|j0d$k�rd%}|j1d& d'k�rd(}t2||ƒ‚t  d)¡ |j1}t3 4| j 5| jd*|d+ d, ¡¡j1}t6|d- d. |d- d/ ƒ}| j7 8||¡ t  d0¡ |||fS )1Nz[S4U2proxy] Impersonating %sr~   úPA-PAC-OPTIONSrq   r™   z%resource-based constrained delegationrs   r+  r,  r�   r¸   r   rt   r¹   r0  r‹   rŒ   r1  r*  rz   r×   )rh   ri   zconstrained-delegationr)  r}   r   r„   r‚   ry   r…   r‡   r‰   rŠ   r{   rB  r�   rŽ   râ   zS4U2proxy failed!r  rC  znS4U2proxy: Failed to get S4U2proxy! Error code (16) indicates that delegation is not enabled for this account!z+[S4U2proxy] Got server reply, decrypting...r2  ré   r|   r³   rê   rë   z[S4U2proxy] Got valid TGS reply)9r   r�   Újoinr
  r”   r•   r–   r—   r�   r   r    r!   rž   r‘   r   r   rW   ru   r˜   rZ   r�   rV   r   r>   r7  r™   r   r   r   r[   r;   r   r   r   r   r=   rÊ   rR   r¢   r£   r¤   r¥   r¦   r›   r8  r   rS   rä   r“   rö   r3   r   rõ   r  r4   rT   r9  )r_   Ús4uself_ticketr"  r•   Úpa_pac_optsr<  r?  r@  Ú
pa_tgs_reqrH  rI  rå   rJ  rK  r%  r;  r³   r`   r`   ra   Ú	S4U2proxyÌ  sb   €



"

zAIOKerberosClient.S4U2proxyÚkeylist_reqú	List[int]c                 Ã  s  �| j st d¡ |  ¡ I dH  tj tjj¡}i }t|d< t	| j d ƒ|d< | j d |d< |j
|d< |jdd�|d	< | j | jd
t|ƒ ¡ d¡}i }t|d< tjj|d< ttƒ ƒ|d< t| j d ƒ|d< t| j|dœƒ|d< i }tjj|d< t|ƒ ¡ |d< t d¡}	i }
|	|
d< ttj j| !¡ dœƒ|
d< |j" #¡ |
d< d|
d< t$dƒ|
d< t%|
ƒ}| jj&t'j(krÂt)dƒ}t* +| jd| ¡ ¡}n4| jj&t'j,krØt)dƒ}t- +| jd| ¡ ¡}n| jj&t'j.krît)dƒ}t/ +| jd| ¡ ¡}nt0d| jj& ƒ‚t d| 1¡  ¡ i }t2|ƒ|d< ||d < i }t2t3d!ƒƒ|d< t4||d"œƒ ¡ |d< i }t2t3d#ƒƒ|d< t5d$t6td%gƒƒiƒ ¡ |d< i }t7t|ƒƒ|d&< ttj8jd'| j9j"gdœƒ|d(< | j9j" #¡ |d)< |tj:d*d+� jdd�|d,< |	|d< | jj&g|d-< i }t|d< tj;j|d< |||g|d.< |du�r¤i }t2t3d/ƒƒ|d< t<|ƒ ¡ |d< |d.  =|¡ t>|ƒ|d0< t|ƒ}t d1¡ | j? @| ¡ ¡I dH }|jAd2k�rÕd3}|jBd4 d5k�rÐd6}tC||ƒ‚t d7¡ |jB}tD E| j F| jd8|d9 d: ¡¡jB}tG|d; d< |d; d= ƒ}| jH I||¡ t d>¡ || _J|||fS )?rP  z,[dMSA] TGT is not available! Fetching TGT...Nr+  r,  r�   r¸   r   rt   r¹   r0  r‹   rŒ   r1  r*  rz   r×   rq   rs   r‰   rŠ   r   zsubject-certificatei   (ÚoptionsÚHMAC_SHA1_96_AES_256é   ÚHMAC_SHA1_96_AES_128rV  zUnsupported encryption type: %sz[dMSA] chksum_data: %sr-  rÖ   zFOR-X509-USER)zuser-idrÖ   re  r™   zBranch Awarer}   rƒ   r„   r‚   ry   r…   r‡   r{   r�   zPA-KEY-LISTrŽ   z [dMSA] Sending request to serverrâ   rY  r  rC  rZ  z[dMSA] Got reply, decrypting...r2  ré   r|   r³   rê   rë   z[dMSA] Got valid TGS reply)KrW   r   r�   r!  r”   r•   r–   r—   r   r   ru   r˜   rZ   r�   rV   r   r‘   r>   r7  r™   r   rž   r   r   r[   r;   r   r   r¥   r¦   r   r=   rŸ   r
  r¢   r£   r+   r*   r›   r7   ÚAES256r   r:   rÖ   ÚAES128r9   ÚRC4r6   ÚNotImplementedErrorr[  r�   r   r,   r    r!   r   rÊ   rR   r¤   r8  r)   r’   r   rS   rä   r“   rö   r3   r   rõ   r  r4   rT   r9  rY   )r_   r^  rk   rk  r•   r<  r?  r@  rG  Ú
BODY_NONCEÚuserid_dataÚuseridÚchecksum_typera  r>  Úpa_s4urh  rH  rI  Ú
pa_keylistrå   rJ  rK  r%  r;  r³   r`   r`   ra   Údmsa  s®   €


þý



"

zAIOKerberosClient.dmsar   c              	   C  s   t ||| j||||d�S )N)r4  Ú
seq_numberÚap_optsÚcb_data)rK   rW   )r_   r%  r;  Ú
sessionkeyr4  r|  r}  r~  r`   r`   ra   Úconstruct_apreq…  s   ùz!AIOKerberosClient.construct_apreqc                 Ã  s.   �|   |¡I d H \}}}|  |d |¡I d H S )Nr*  )rd  rj  )r_   Útarget_userÚservice_spnr%  r;  r³   r`   r`   ra   ÚgetST�  s   €zAIOKerberosClient.getSTc                 C  sÒ  dd„ }|d D ]}|d dkrt  |d ¡j} nqtdƒ‚ztj |d ¡j}W n   tj |d d	d … ¡j}Y |d
 }|d dkrJtdƒ‚t |d ¡j}td dgdd„ |d D ƒ ¡dƒ}tj	t
 |d ¡ ¡ dd … ddd�}| jj |¡}	|d }
|	| jjj |
 }|d d }t| }|tjkr¡||dƒ| _n|tjkr­||dƒ| _n	|tjkr¶tdƒ‚t|j| jƒ}|d d }| |d |¡}t |¡j}tt|d! d" ƒ }t|j|d! d# ƒ}|||fS )$Nc                 S  s~   d}d}t |ƒ|k r=t t|gƒ|  ¡ ¡ }t |ƒt |ƒ |kr/||d |t |ƒ … 7 }	 |S ||7 }|d7 }t |ƒ|k s
|S )Nó    r   ry   )r  r   rË   ÚbytesrÌ   )r™   ÚkeysizeÚoutputÚ
currentNumÚcurrentDigestr`   r`   ra   Útruncate_key—  s   ýúz:AIOKerberosClient.decrypt_asrep_cert.<locals>.truncate_keyr�   rq   r  rs   zPA_PK_AS_REP not found!ÚdhSignedDataé   Úencap_content_infoÚcontent_typez1.3.6.1.5.2.3.2z%Keyinfo content type unexpected valueÚcontentÚ Ú1c                 S  s   g | ]}t |ƒ‘qS r`   )r\  r  r`   r`   ra   r  ´  s    z8AIOKerberosClient.decrypt_asrep_cert.<locals>.<listcomp>ÚsubjectPublicKeyrD  r0  ÚbigFrT  ÚserverDHNonceré   r{   é    rC  zBRC4 key truncation documentation missing. it is different from AESr|   r	  r³   rê   rë   )rG   rõ   rö   rÉ   rL   Ú
SignedDatarH   r�   rf  Ú
from_bytesrM   Ú	BitStringr‘   rR   rÍ   ÚexchangerÒ   r5   r7   rq  rU   rr  rs  rt  r4   r›   r  r   )r_   Úas_reprŠ  ÚpaÚpkasrepÚsdÚkeyinfoÚauthdataÚpubkeyÚ
shared_keyÚserver_nonceÚfullKeyr{   r|   r³   Úenc_dataÚdec_dataÚencasrepÚsession_keyr`   r`   ra   r  •  sF   þ$&



z$AIOKerberosClient.decrypt_asrep_certc                 Ã  s¤  �	 ddl m} ddlm} tƒ }||_d|_| jj 	¡ |_|  
¡ I dH  t d¡ |  |¡I dH \}}}	t d¡ tdƒD ]i}
|d	 d
 d  	¡ }||krP nX|}|| 	¡ krZ nNt d| ¡ | ||¡}| jj|dd�}tj|dd�}z||||jƒ}| ¡ }| |||¡I dH \}}}	}W q> ty§ } z
td|t|ƒf ƒ‚d}~ww | ||¡}|}|dur¶|}| jj|dd�}tj|dd�}||||jƒ}|||	|fS )zCross domain TGT referralr   )ÚKerberosClientFactory)ÚKirbirƒ   Nz"Getting TGS for otherdomain krbtgtzGot referral ticket!rÇ   r„   r€   ry   zUThe referral ticket is not for the target domain, getting new referral ticket from %séX   ©ÚportÚkirbi)Úencodingz:Failed to get referral ticket from domain "%s"! Reason: %s)Úminikerberos.common.factoryr¨  Úminikerberos.common.kirbir©  r   r    ÚservicerR   r¢   r£   r!  r   r�   rA  ÚrangeÚfrom_ticketdatarP   Úget_newtargetrC   Ú
from_kirbiÚproxiesÚ
get_clientÚget_referral_ticketrÉ   r\  )r_   Útarget_domainÚ	target_ipÚ
prev_snamer¨  r©  Úcrossrealm_spnr%  Úencpartr³   r  r„   r­  ÚnewtÚnewcÚnew_factoryÚ	newclientrñ   Útarget_addrr`   r`   ra   r¸  Ï  sN   €

 €þz%AIOKerberosClient.get_referral_ticketÚ	localhostÚnew_passwordr\  Ú
targetuserÚtargetrealmÚhostnamer0   c                 Ã  s˜  �| j st d¡ |  ¡ I dH  |du r"t | jj¡}t| jj	|ƒ}t
j
 t
jj¡}t|j	|dœƒ}t|j	 }	i }
| ¡ |
d< |durl| d¡dkrQ| d¡\}}ttjj|gdœƒ|
d< |durc|n| jj ¡ |
d	< nttjj| jjgdœƒ|
d< | jj ¡ |
d	< i }t|
ƒ ¡ |d
< d|d< td| ¡ dœƒ|d< ttt jjt!|j	|	 "|dt#|ƒ ¡ d¡dœƒdœƒ ¡ }i }t|d< t$| j d ƒ|d< | j d |d< |j%|d< |j&dd�|d< d|d< ||d< | j "| j'dt(|ƒ ¡ d¡}i }t|d< t j)j|d< t*t+ƒ ƒ|d< t,| j d ƒ|d< t!| j-|dœƒ|d< t.|ƒ ¡ }t/||ƒ 0¡ }t d ¡ | j1j2| j1 3¡ d!d"�}t4|ƒ}| 5|¡I dH }t/ 6|¡}| 7|	|¡}|S )#z.
		Changes the password of the current user
		z6[ChangePassword] TGT is not available! Fetching TGT...Nr#  Ú	newpasswdú@éÿÿÿÿr   ÚtargnameÚ	targrealmz	user-datar   r/  ry   )z	addr-typeÚaddressz	s-addressé   rz   )r‹   rŒ   ré   r+  r,  r�   r¸   rt   r¹   Úsubkeyé   r‹   rŒ   r1  r*  r×   z*[ChangePassword] Sending request to serveriÐ  r«  )8rW   r   r�   r!  ÚosÚurandomrZ   r†  r4   r›   r”   r•   r–   r—   r$   r5   rš   Úfindr¡   r   r=   rŸ   r™   rR   r¢   r£   r    r#   r‘   r&   r'   r   r>   r   r�   r%   r   ru   r˜   rV   r   r7  r   rž   r   r[   r   r/   r6  rP   r´  Úget_hostname_or_iprB   rä   r—  Úparse_reply)r_   rÄ  rÏ  rÅ  rÆ  rÇ  Ú
subkeydatar•   Úsubkey_structÚsubkey_cipherÚchangepwstructÚ
privstructÚprivdatar<  r?  r@  Úap_req_encodedÚmessager¾  ÚksocketÚresponserJ  Úprivresponser`   r`   ra   Úchange_password  sl   €

"ýü


z!AIOKerberosClient.change_passwordc                 Ã  sn  �| j j d¡}t|ƒdkrt|d ƒ}nd}| j  tjtjtj	g¡}|du r+t
dƒ‚| j  |¡}t|j|ƒ}t|j }t d¡}	tj}
t|
j|	ƒ}t|
j|	dœƒ}tj tjj¡}i }ttg d	¢ƒƒ|d
< ||d< |durp|n| j j ¡ |d< ttjj|gdœƒ|d< tdddœƒ|d< |jdd�|d< |jdd�|d< |tjdd� }||d< ||d< t |ƒ}| !|d| "¡ d¡}i }t#|d< | j j ¡ |d< ttj$jd| j j ¡ gdœƒ|d< t%j&j|d< t'|d> |j|dœƒ|d < i }t#|d!< |d |d< |j(|d"< |jdd�|d#< ttjj|gdœƒ|d< t)|ƒ}ttjj }| !|d$| "¡ d¡}i }t#|d< t%j*j|d< t+tƒ ƒ|d%< t'tjj|d&œƒ|d'< t,t#|d |d |d  d(œƒ|d)< i }t-j.j|d*< t/|ƒ "¡ |d+< i }t-j0j|d*< t1tjjtjjtj	jtj2jtj3jgƒ "¡ |d+< i }t4td,gƒƒ|d-< ttj$jd| j j ¡ gdœƒ|d< |d |d< |tjdd� jdd�|d.< t5 6d/¡|d0< tjjtjjtj	jtj2jtj3jg|d1< i }t#|d< t%j7j|d< ||g|d2< t8|ƒ|d3< t.|ƒ}t9 :d4¡ | j; <| "¡ ¡I dH }|j=d5k�rt>|d6ƒ‚t9 :d7¡ |j?}tt|d  d1 ƒ }t@ A| B|d8|d  d9 ¡¡j?}| jC D||¡ t9 :d:¡ |||fS );zÇ
		To be used with an RODC krbtgt_##### account.
		This function creates and sends a TGS request to the KDC service, posing as the krbtgt_##### account and requests the keylist of the target user.
		r  rD  ry   r   Nz.No preferred enctype found for krbtgt account!r•  r#  )Ú	forwardedri   z
enc-pa-repr4  r³   r,  r   r�   r„  )ztr-typeÚcontentsÚ	transitedrt   ÚauthtimeÚ	starttimeéd   r…   Úendtimez
renew-tillr‹   r‚   rƒ   r„   rŒ   rC  )Úkvnor{   r|   ré   r+  r¸   r¹   r0  r1  rz   r×   )ztkt-vnor‚   r„   ré   r*  rq   rs   r)  r}   r‡   r‰   rŠ   r{   r�   rŽ   z*[KeylistPartial] Sending request to serverrâ   zKeylistPartial failed!z-[KeylistPartial] Got TGS reply, decrypting...r2  r|   z$[KeylistPartial] Got valid TGS reply)ErR   r    r¡   r  r�   rø   r<   ÚAES256_CTS_HMAC_SHA1_96ÚAES128_CTS_HMAC_SHA1_96ÚARCFOUR_HMAC_MD5Ú
ValueErrorrœ   r4   r™   r5   rÑ  rÒ  r$   r”   r•   r–   r—   r.   rž   r¢   r£   r   r=   rŸ   r-   r˜   r¤   r"   r�   r‘   r   rÊ   r>   ÚKRB_TGS_REPr   ru   r   r7  r   r   r;   r   r   ÚKEY_LIST_REQr)   ÚDES_CBC_CRCÚDES_CBC_MD5r   r¥   r¦   r8  r   r   r�   rS   rä   r“   r3   rö   r   rõ   r  rT   r9  )r_   rÅ  rÆ  ÚpartsÚkdcnumÚkrbtgt_enctypeÚkrbtgt_key_dataÚ
krbtgt_keyÚkrbtgt_cipherÚsessionkey_dataÚsessionkey_enctyper  Úencticket_keyr•   rL  rè  Úencticket_encÚpartial_tgt_datar<  r×   r|   Úenc_authenticatorr@  r®   r±   Útgs_body_dataÚtgs_req_dataÚtgs_reqrJ  r%  r;  r`   r`   ra   ÚkeylistK  sà   €ýÿ

þÿ"ýÿ
üûù
"û




zAIOKerberosClient.keylist)rO   rC   rP   rD   )rk   rl   rm   rn   ro   r   )rm   rn   ro   r   )rm   rn   )r   r   rm   rn   )r"  r   )rk  rl  )NN)NNNrÃ  )
rÄ  r\  rÅ  r\  rÆ  r\  rÇ  r\  ro   r0   rQ   )rÅ  r\  rÆ  r\  ) Ú__name__Ú
__module__Ú__qualname__rb   rc   rg   rµ   rà   rç   rò   rÿ   r!  r'  rA  r<   rð  ÚDES_CBC_MD4rñ  ÚDES3_CBC_SHA1rì  rê  rë  rO  rd  rj  r{  r€  rƒ  r  r¸  rá  r  r`   r`   r`   ra   rN   (   s.    
5L 
$.`IrEt
:2JrN   )gÚ
__future__r   Ú	unicryptor   ró   r”   r¥   rÑ  ÚioÚasyncioÚtypingr   Úminikerberosr   Úminikerberos.common.ccacher   Úminikerberos.common.spnr   Ú"minikerberos.protocol.asn1_structsr   r	   r
   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r    r!   r"   r#   r$   r%   r&   r'   r(   r)   r*   r+   r,   r-   r.   Úminikerberos.protocol.rfc3244r/   r0   r1   Úminikerberos.protocol.errorsr2   r3   Ú minikerberos.protocol.encryptionr4   r5   r6   r7   r8   r9   r:   Úminikerberos.protocol.constantsr;   r<   r=   r>   Ú minikerberos.protocol.structuresr?   Úminikerberos.gssapi.gssapir@   Ú$minikerberos.network.aioclientsocketrA   rB   Úminikerberos.common.credsrC   Úminikerberos.common.targetrD   Úminikerberos.protocol.rfc4556rE   rF   rG   rH   rI   Ú#minikerberos.gssapi.channelbindingsrJ   Ú!minikerberos.protocol.ticketutilsrK   rÈ   rL   rM   rN   r`   r`   r`   ra   Ú<module>   s8    ¨	$