o
    Žõ±jí#  ã                   @   s‚   d dl mZ d dl mZ d dlmZmZmZmZmZ d dl	Z	d dl
mZmZmZmZ d dlmZmZ d dlmZ G dd	„ d	ƒZdS )
é    )Úhashlib)Úhmac)ÚRC4ÚAESÚMODE_CBCÚDESÚexpand_DES_keyN)Ú
LSA_SECRETÚLSA_SECRET_BLOBÚLSA_SECRET_XPÚ	NL_RECORD)ÚLSADCCSecretÚ	LSASecret)Úloggerc                   @   sl   e Zd Zddd„Zeddd„ƒZdd„ Zd	d
„ Zdd„ Zdd„ Z	dd„ Z
dd„ Zdd„ Zdd„ Zdd„ ZdS )ÚSECURITYNc                 C   s:   || _ || _|| _d| _d| _d | _d | _g | _g | _d S )Né (  T)	ÚhiveÚsystem_hiveÚbootkeyÚdcc_iteration_countÚlsa_secret_key_vista_typeÚlsa_keyÚNKLM_keyÚ
dcc_hashesÚcached_secrets)ÚselfÚsecurity_hiver   r   © r   ú–/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/registry/security/security.pyÚ__init__   s   
zSECURITY.__init__éè  c                 C   s*   t  | ¡}t|ƒD ]}| |¡ q	| ¡ S ©N)r   Úsha256ÚrangeÚupdateÚdigest)ÚkeyÚvalueÚroundsÚctxÚ_r   r   r   Úsha256_multi&   s   
zSECURITY.sha256_multic                    s:  t  d¡ | jdu rdt |¡‰t | jˆjd d… ¡}d}t	|ƒ}d‰ ‡ ‡fdd„t
dtˆjdd … ƒˆ ƒD ƒD ]}t|ƒˆ k rJ|d	ˆ t|ƒ  7 }|| |¡7 }q8t |¡‰ˆjd
d … d d… | _n,t | j¡}t
dƒD ]}| |dd… ¡ qnt| ¡ ƒ}| |dd… ¡‰ˆdd… | _t  d| j ¡  ¡ | jS )Nz [SECURITY] Decrypting LSA key...Té    ó    é   c                    ó&   g | ]}ˆj d d… ||ˆ  … ‘qS ©r,   N©Údata©Ú.0Úi©ÚnÚrecordr   r   Ú
<listcomp>5   ó   & z,SECURITY.decrypt_lsa_key.<locals>.<listcomp>r   ó    é4   r    é<   éL   é   z[SECURITY] LSA key value: %s)r   Údebugr   r	   Ú
from_bytesr   r+   r   r2   r   r#   ÚlenÚdecryptr
   Úsecretr   r   Úmd5r$   r   r%   Úhex)r   r2   r&   Ú
secret_decÚcipherÚblockr)   r5   r   r6   r   Údecrypt_lsa_key-   s*   


.
zSECURITY.decrypt_lsa_keyc                 C   s^   t  d¡ | j dd¡}|d u r(| j dd¡}|s t  d¡ d S d| _t  d¡ |  |d ¡S )Nz[SECURITY] Fetching LSA key...zPolicy\PolEKList\defaultFz%Policy\PolSecretEncryptionKey\defaultz[SECURITY] LSA key not found!z,[SECURITY] LSA secrets default to VISTA typeé   )r   r@   r   Ú	get_valuer   rJ   )r   r'   r   r   r   Úget_lsa_keyI   s   


zSECURITY.get_lsa_keyc                 C   sÀ   d}t j|d d… ddd�}|t|ƒ| d … }|}tdt|ƒdƒD ]5}|d d… }t|d d… ƒ}t|ƒ}	||	 |¡7 }|dd … }|dd … }t|ƒdk rW|t|ƒd … }q"t |¡}
|
jS )	Nr-   é   ÚlittleF)Úsignedr   é   é   )	ÚintrA   rB   r#   r   r   rC   r   rD   )r   r&   r'   Údec_blobÚenc_sizeÚt_keyr*   Úenc_blobÚdes_keyr)   rD   r   r   r   Údecrypt_secretX   s    €
zSECURITY.decrypt_secretc                    s  t  d¡ | jd u r|  ¡  | j d¡}|d u r!t  d¡ tdƒ‚| jdu rud| _	t
 |d ¡‰t | jˆjd d… ¡}t|ƒ}d	‰ ‡ ‡fd
d„tdtˆjdd … ƒˆ ƒD ƒD ]}t|ƒˆ k ri|dd	t|ƒ  7 }|  j	| |¡7  _	qWn
|  | j|d ¡| _	t  d| j	 ¡  ¡ | j	S )Nz [SECURITY] Fetching NK$LM key...z$Policy\Secrets\NL$KM\CurrVal\defaultz+[SECURITY] Could not find NL$KM in registryz#Could not find NL$KM in registry :(Tr-   rK   r,   r.   c                    r/   r0   r1   r3   r6   r   r   r9   z   r:   z)SECURITY.get_NKLM_key.<locals>.<listcomp>r   r;   z[SECURITY] NL$KM key: %s)r   r@   r   rM   r   rL   ÚerrorÚ	Exceptionr   r   r	   rA   r   r+   r2   r   r#   rB   rC   rY   rF   )r   r'   r&   rH   rI   r   r6   r   Úget_NKLM_keyj   s*   



.ýzSECURITY.get_NKLM_keyc                 C   s   |d@ dkr||d@  S |S )Né   r   r   )r   r2   r   r   r   Ú__pad…   s   zSECURITY.__padc              	      sp  t  d¡ | j dd¡}|d u rt  d¡ d S | j |¡}|g kr(t  d¡ d S d|v r1| d¡ d|v rVt  d¡ | d¡ | j d¡d	 ‰ˆd
krQˆd@ | _nˆd | _|  ¡  |  	¡  |D ]Ô}t  d| ¡ | j d| 
¡  ¡d	 }t |¡‰ˆjdk�r4ˆjd	@ d	krà| jdu rÉd}t| jdd… tˆjd�}d‰ ‡ ‡fdd„tdtˆjƒˆ ƒD ƒD ]}t|ƒdk rÀ|ddt|ƒ  7 }|| |¡7 }q®ntj| jˆjdd� ¡ }t|ƒ}| ˆj¡}nt  d| ¡ q`|d d… }	t |dd … ¡}
|
 ˆj¡ 
d¡}|
 |   ˆj¡|   ˆj!¡ ¡ |
 ˆj"¡ 
d¡}| jdu �r dnd	}t#||||	| jˆj$d�}| j% &|¡ q`| j%S ) Nz[SECURITY] dump_dcc invokedÚCacheFz[SECURITY] No DCC secrets foundó
   NL$Controls   NL$IterationCountz&[SECURITY] DCC Setting iteration countzCache\NL$IterationCountrK   r   l    |ÿ i   z![SECURITY] DCC Checking value: %szCache\%ss                   Tr-   r.   r,   )ÚIVc                    s   g | ]}ˆj ||ˆ  … ‘qS r   )ÚEncryptedDatar3   r6   r   r   r9   ³   s    z%SECURITY.dump_dcc.<locals>.<listcomp>r   r;   rE   )Ú	digestmodz0[SECURITY] DCC Skipping value %s, unknown formetéH   z	utf-16-leé   )Ú	iterationÚlast_write_ts)'r   r@   r   Úfind_keyÚlist_valuesÚremoverL   r   rM   r\   Údecoder   rA   ra   ÚFlagsr   r   r   r   r#   rB   rb   rC   r   Únewr%   r   ÚioÚBytesIOÚreadÚ
UserLengthÚseekÚ_SECURITY__padÚDomainNameLengthÚDnsDomainNameLengthr   Ú	LastWriter   Úappend)r   Ú	cache_regÚvaluesr'   Úrecord_dataÚ	plaintextrH   rI   r&   Údcc_hashÚblobÚusernameÚdomainÚversionrD   r   r6   r   Údump_dcc‹   sd   








&ý€zSECURITY.dump_dccc              	      s²  t  d¡ |  ¡  |  ¡  | j d¡}|d u rt  d¡ d S d|v r'| d¡ |D ]­}dD ]¨}d ||¡}t  d| ¡ | j |d¡}|rÎ|d	 d
krÎt  	d	d||d	 f ¡ | j
du r¯t |d	 ¡‰t | jˆjd d… ¡}d}t|ƒ}d‰ ‡ ‡fdd„td
tˆjdd … ƒˆ ƒD ƒD ]}	t|	ƒˆ k rž|	dˆ t|	ƒ  7 }	|| |	¡7 }qŒt |¡‰ˆj}
n	|  | j|d	 ¡}
t ||
|dk| j¡}|d urÍ| j |¡ q-t  d| ¡ q-q)d S )Nz[SECURITY] get_secretszPolicy\Secretsz*[SECURITY] No cached secrets found in hiver`   )ÚCurrValÚOldValzPolicy\Secrets\{}\{}\defaultz [SECURITY] Parsing secrets in %sFrK   r   z[SECURITY] Key %s Value %sTr,   r-   r.   c                    r/   r0   r1   r3   r6   r   r   r9   ì   r:   z(SECURITY.get_secrets.<locals>.<listcomp>r;   rƒ   z'[SECURITY] Could not open %s, skipping!)r   r@   rM   r�   r   Úenum_keyrj   ÚformatrL   Úlogr   r	   rA   r   r+   r   r2   r   r#   rB   rC   r
   rD   rY   r   Úprocessr   r   rw   )r   ÚkeysÚkey_nameÚvlÚkey_pathÚvr&   rG   rH   rI   rT   rD   r   r6   r   Úget_secretsÐ   sH   



.
€åÿzSECURITY.get_secretsc                 C   s–   i }| j |d< | jrdnd|d< | j|d< d |d< | jd ur#| j|d< g |d< | jD ]}|d  | ¡ ¡ q*g |d< | jD ]}|d  | ¡ ¡ q=|S )	Nr   ÚVISTAÚOLDÚsecrets_formatr   zNK$LMÚdccr   )r   r   r   r   r   rw   Úto_dictr   ©r   ÚtrD   r   r   r   r’   ý   s   





zSECURITY.to_dictc                 C   s’   d}|d| j  7 }|| jrdd nd7 }|d| j ¡  7 }| jd ur+|d| j ¡  7 }| jD ]
}|d| ¡  7 }q.| jD ]
}|dt|ƒ 7 }q<|S )	Nz5============== SECURITY hive secrets ==============
zIteration count: %s
zSecrets structure format : %s
rŽ   r�   zLSA Key: %s
zNK$LM Key: %s
z%s
)	r   r   r   rF   r   r   Úto_lopthr   Ústrr“   r   r   r   Ú__str__  s   


zSECURITY.__str__r!   )r    )Ú__name__Ú
__module__Ú__qualname__r   Ústaticmethodr+   rJ   rM   rY   r\   rs   r�   r�   r’   r—   r   r   r   r   r      s    
E-r   )Ú	unicryptor   r   Úunicrypto.symmetricr   r   r   r   r   rn   Ú%pypykatz.registry.security.structuresr	   r
   r   r   Ú!pypykatz.registry.security.commonr   r   Úpypykatz.registryr   r   r   r   r   r   Ú<module>   s   	