o
    Žõ±jN  ã                   @   s^   d Z ddlmZ ddlmZ ddlT ddlZddlZddlZddl	m
Z
 G dd„ de
jƒZdS )	zTamas Jos <info@skelsec.com>é    )Úpypykatz)ÚRekallReader)Ú*N)Úcommonc                       sÎ   e Zd ZdZ	 dZeddddd�eddd	d
�eddd	d
�eddddd�gZeddd�eddd�eddd�eddd�eddd�eddd�eddd�eddd�edd d�ed!d"d�g
Z‡ fd#d$„Zd%d&„ Z	‡  Z
S )'ÚPypykatzz<Extract and decrypt passwords from the LSA Security Service.r   Úoverride_timestampÚintFz9The msv dll file timestamp detection fails in some cases.)ÚnameÚtypeÚrequiredÚhelpÚout_filezThe file name to write.)r	   r   r   Úkerberos_dirÚjsonÚboolz(Write credentials to file in JSON format)r	   r   r
   r   ÚLUIDé   )r	   ÚwidthÚTypeé   ÚSessé   ÚSIDé   ÚModuleé   ÚInfoÚDomainé   ÚUserÚSTypeé	   ÚSecretéP   c                    s   t t| ƒj|i |¤Ž d S )N)Úsuperr   Ú__init__)ÚselfÚargsÚkwargs©Ú	__class__© ú“/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/plugins/pypykatz_rekall.pyr%   3   s   zPypykatz.__init__c                 c   s&  � | j j ¡ }t | j | jj¡}| jjrA| jjrA| j j	 
d¡ t| jjdƒ�}tj||tddd� W d   ƒ n1 s;w   Y  nm| jjr”| j j	 
d¡ t| jjdƒ�8}| d¡ |jD ]'}| dt|j| ƒ ¡ t|jƒd	krƒ| d
¡ |jD ]	}| t|ƒ¡ qyq\W d   ƒ n1 sŽw   Y  n| j j	 
d¡ |jD ]}|j|  ¡ D ]}|V  q§qž| jj�rtj | jj¡}| j j	 
d| ¡ t d¡}d|t d¡ ¡ f }	|j tj ||	¡¡ |jD ]}|j| jD ]}
|
j D ]}| !|¡ qïqêqâ|jD ]}|j"dk�r|j D ]}| !|¡ �qqüd S )Nz&Dumping results to file in JSON formatÚwé   T)ÚclsÚindentÚ	sort_keyszDumping results to filezFILE: ======== MEMORY =======
Ú
r   z
== Orphaned credentials ==
zDumping resultszWriting kerberos tickets to %sÚrekall_memoryz%s_%s.ccacheÚkerberos)#ÚsessionÚpluginsÚccr   Ú	go_rekallÚplugin_argsr   r   r   ÚloggingÚinfoÚopenÚdumpÚUniversalEncoderÚwriteÚlogon_sessionsÚstrÚlenÚorphaned_credsÚto_rowr   ÚosÚpathÚabspathÚntpathÚbasenameÚurandomÚhexÚkerberos_ccacheÚto_fileÚjoinÚkerberos_credsÚticketsÚto_kirbiÚcredtype)r&   r7   ÚmimiÚfÚluidÚcredÚrowÚ	directoryÚbase_filenameÚccache_filenameÚkcredÚticketr+   r+   r,   Úcollect6   s\   €ÿ€



€úý€
ÿ



ÿÿ

€zPypykatz.collect)Ú__name__Ú
__module__Ú__qualname__Ú__doc__Ú_Pypykatz__nameÚdictÚ_Pypykatz__argsÚtable_headerr%   r]   Ú__classcell__r+   r+   r)   r,   r      s<    ÿÿÿÿö









ör   )Ú
__author__Úpypykatz.pypykatzr   Ú,pypykatz.commons.readers.rekall.rekallreaderr   Úpypykatz.commons.commonr   rH   rE   Úrekall.plugins.windowsr   ÚWindowsCommandPluginr   r+   r+   r+   r,   Ú<module>   s   