o jS9 @s0ddlZddlZddlZddlZddlZddlZddlZddlZddlZddl m Z ddl Z ddl m Z ddlmZddlmZddlmZmZddlmZmZmZmZmZGdd d eZd d Zd d ZddZe dkre!ej"eZ#e$e#j%e#j&e#j'(dkre#j)durej*+e#j)reddZ,e&de#j)e-e#j)dZ.d/e.0Z1e.2e,3e#j)e1Z4e,5e4dSe!ddSdSee#\Z6Z7Z8Z9Z:Z;zee#e6e7e8e9e:e;Ze,?e#j@WdSeAyZBzeCjDejEkreFeGeHeBWYdZB[BdSdZB[BwwdS)N)minidom)AES)unpad)version)loggerutils) SMBConnectionSMB2_DIALECT_002SMB2_DIALECT_21 SMB_DIALECT SessionErrorcsReZdZdZfddZddZdddZd d Zd d Zd dZ ddZ Z S)GetGPPasswordszdocstring for GetGPPasswords.cstt|||_||_dS)N)superr __init__smbshare)selfrr __class__/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/../../../bin/Get-GPPPassword.pyr+s zGetGPPasswords.__init__cCsjtd|j}g}tt|D]}|||dddtd||dddqtdS)NzListing shares... shi1_netnamez - %s)logginginfor listSharesrangelenappendprint)rrespshareskrrr list_shares0s   zGetGPPasswords.list_sharesxmlc Csttd|g}|dg}t|dkrg}|D]}td|zn|jj|j|dddD]_}|dvr|rOtd|| ||dq.| d |rtd ||| ||}t|dkr| || |||d q.td |q.Wqt y} z t| WYd} ~ qd} ~ ww|}td t|t|dks|S)NzSearching *.%s files.../rzSearching in %s *)password).z..zFound directory %s/r(zFound matching file %s)filenameresultsz Found file %szNext iteration with %d folders.)rrrdebugrlistPathr get_longname is_directoryrendswithparseshowr ) rbase_dir extensionfiles searchdirs next_dirssdir sharedfiler*errrfind_cpasswords9s>      zGetGPPasswords.find_cpasswordsc Cs:g}zt|}|jdj}dd}|dkr_|jD]B}dd|jD}|D]5} | dD]-} ||d|| dfd || d fd || d fd ||| d fd || jd fg|d q,q%qW|S|dkr|jD]B}dd|jD}|D]5} | dD]-} ||d|| dfd|| dfd || d fd ||| d fd || jd fg|d qyqrqfW|S|jD]B}dd|jD}|D]5} | dD]-} ||d|| dfd|| dfd || d fd ||| d fd || jd fg|d qqqW|Sty} zt j t j kr t t t| WYd} ~ |Sd} ~ ww)NrcSs||dur ||SdS)N) getAttribute)element attributerrr]sz6GetGPPasswords.parse_xmlfile_content..ScheduledTaskscS g|] }t|tjjjr|qSr isinstancer$domrElement.0crrr b z8GetGPPasswords.parse_xmlfile_content.. PropertiesnamerunAs cpasswordr'changed)tagName attributesfileGroupscSrArrBrFrrrrIrrJnewNameuserNamecSrArrBrFrrrrIrJ)r parseString childNodesrPgetElementsByTagNamerdecrypt_password parentNode Exceptionr getLoggerlevelDEBUG traceback print_excr+str) rr) filecontentr*rootxmltype read_or_emptytopnode task_nodestaskpropertyr9rrrparse_xmlfile_contentWs       4     $     z$GetGPPasswords.parse_xmlfile_contentc Csg}|dd}t}z |j|j||jWn%ty1}z t ||WYd}~Sd}~wt y=}zd}~ww| }t |d}|durr||}d|vrit||||}||Std||Std||S)Nr%\encodingrNzNo cpassword was found in %szGOutput cannot be correctly decoded, are you sure the text is readable ?)replaceioBytesIOrgetFilerwriter rerrorr[getvaluecharset_normalizerdetectdecoderstripr+rjclose)rr)r*fhr9outputrlrbrrrr0s6     zGetGPPasswords.parsecCst|dkrFd}d}t|d}|dkr|dd}n|dks#|dkr+|d d|7}t|}t|tj|}t|||j}| d St d d S) Nrs Nlby 3lsr=z utf-16-lez,cpassword is empty, cannot decrypt anything.r;) rbase64 b64decodernewMODE_CBCrdecrypt block_sizervrr+)r pw_enc_b64keyivpadpw_encctxpw_decrrrrYs     zGetGPPasswords.decrypt_passwordcCsh|D]/}td|dtdd|df|dD]\}}|dkr-td||fqtqdS)NzFound a %s XML file:rPz %-10s: %srRrQrN)rrr)rr*resultattrvaluerrrr1szGetGPPasswords.show)r$) __name__ __module__ __qualname____doc__rr#r:rjr0rYr1 __classcell__rrrrr (s  @r cCs8tjddd}|jdddd|jdtd dd d |jd td d dd |jdtd ddd |jdddd|jdddd|d}|jddddd|jdddd|jdddd|jd dd!d"d|d#}|jd$dd%d&d|jd'dd%d(d|jd)d*d+gd,d+d-d.d/ttjd0kr|t d0| S)1NTz8Group Policy Preferences passwords finder and decryptor.)add_help descriptiontargetstorezb[[domain/]username[:password]@] or LOCAL (if you want to parse local files))actionhelpz-xmlfileFz+Group Policy Preferences XML files to parse)typerequireddefaultrz-shareSYSVOLz SMB Sharez -base-dirr%z#Directory to search in (Default: /)z-ts store_truez&Adds timestamp to every logging outputz-debugzTurn DEBUG output ONauthenticationz-hashesz LMHASH:NTHASHz$NTLM hashes, format is LMHASH:NTHASH)rmetavarrz-no-passz&Don't ask for password (useful for -k)z-kzUse Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use the ones specified in the command linez-aesKeyzhex keyzsd    *