o
    Žõ±j  ã                   @   sV   d dl Z d dlZd dlmZ d dlmZ d dlmZ G dd„ dƒZG dd„ deƒZ	dS )	é    N)ÚPackageDecryptor)ÚLSA_UNICODE_STRING)Úhexdumpc                   @   s,   e Zd Zdd„ Zdd„ Zdd„ Zdd„ Zd	S )
ÚWdigestCredentialc                 C   s(   d| _ d | _d | _d | _d| _d | _d S )NÚwdigestó    ©ÚcredtypeÚusernameÚ
domainnameÚpasswordÚpassword_rawÚluid©Úself© r   ú£/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/lsadecryptor/packages/wdigest/decryptor.pyÚ__init__   s   
zWdigestCredential.__init__c                 C   sD   i }| j |d< | j|d< | j|d< | j|d< | j|d< | j|d< |S )Nr	   r
   r   r   r   r   r   ©r   Útr   r   r   Úto_dict   s   





zWdigestCredential.to_dictc                 C   s   t  |  ¡ ¡S )N)ÚjsonÚdumpsr   r   r   r   r   Úto_json   s   zWdigestCredential.to_jsonc                 C   sJ   d| j  }|d| j 7 }|d| j 7 }|d| j 7 }|d| j ¡  7 }|S )Nz	== WDIGEST [%x]==
z		username %s
z		domainname %s
z		password %s
z		password (hex)%s
)r   r
   r   r   r   Úhexr   r   r   r   Ú__str__"   s   
zWdigestCredential.__str__N)Ú__name__Ú
__module__Ú__qualname__r   r   r   r   r   r   r   r   r      s
    	r   c                       s4   e Zd Z‡ fdd„Zdd„ Zdd„ Zdd„ Z‡  ZS )	ÚWdigestDecryptorc                    s"   t ƒ  d|||¡ || _g | _d S )NÚWdigest)Úsuperr   Údecryptor_templateÚcredentials)r   Úreaderr"   Úlsa_decryptorÚsysinfo©Ú	__class__r   r   r   +   s   
zWdigestDecryptor.__init__c                 C   sž   |   d| jj ¡  ¡ |  d| jj¡}|   dt|ƒ ¡ |   dt|| jj ƒ ¡ | j || jj ¡}|   dt|ƒ ¡ | j |¡}|   dt|ƒ ¡ ||fS )Nz Scanning for Wdigest structs! %szwdigest.dllzSignature @ %szSignature (corrected) @ %szFirst entry ptr @ %szFirst entry -> %s)	Úlogr"   Ú	signaturer   Úfind_signatureÚfirst_entry_offsetr$   Úget_ptr_with_offsetÚget_ptr)r   ÚpositionÚptr_entry_locÚ	ptr_entryr   r   r   Úfind_first_entry0   s   z!WdigestDecryptor.find_first_entryc                 C   sô   t ƒ }|j|_| j |jj| jj ¡ t| jƒ}t| jƒ}t| jƒ}| 	| j¡|_
| 	| j¡|_| | j¡|_|j
 d¡du rW| j|jdd�\|_|_|jdurV|j ¡ |_n
|  |j¡\|_|_|j
dkrr|jdkrr|jdu rrdS | j |¡ dS )z«
		Changed the wdigest parsing, the struct only contains the pointers in the linked list, the actual data is read by 
		adding an offset to the current entry's position
		ú$T)Úbytes_expectedNÚ )r   r   r$   ÚmoveÚ
this_entryÚvaluer"   Úprimary_offsetr   Úread_stringr
   r   Úread_maxdataÚencrypted_passwordÚendswithÚdecrypt_passwordr   r   r   r#   Úappend)r   Úwdigest_entryÚwcÚUserNameÚ
DomainNameÚPasswordr   r   r   Ú	add_entry;   s$   



€zWdigestDecryptor.add_entryc              
   C   sr   z|   ¡ \}}W n ty" } z|  d| ¡ W Y d }~d S d }~ww | j |¡ | j | j¡}|  || j¡ d S )Nz*Failed to find Wdigest structs! Reason: %s)	r2   Ú	Exceptionr)   r$   r6   r"   Ú
list_entryÚ	walk_listrE   )r   Úentry_ptr_valueÚentry_ptr_locÚeÚ	entry_ptrr   r   r   ÚstartY   s   €þzWdigestDecryptor.start)r   r   r   r   r2   rE   rM   Ú__classcell__r   r   r'   r   r   *   s
    r   )
Úior   Ú%pypykatz.lsadecryptor.package_commonsr   Úpypykatz.commons.win_datatypesr   Úpypykatz.commons.commonr   r   r   r   r   r   r   Ú<module>   s   