o
    àý°j”  ã                   @   sÖ  d dl Z d dlZd dlZd dlZd dlZd dlZd dlmZ d dlm	Z	 d dl
mZ d dlmZmZ d dlmZ d dlmZ d dlmZmZ d d	lmZ d d
lmZ d dlmZmZ d dlmZmZm Z  d dl!m"Z" d dl#m$Z$ d dl%m&Z&m'Z'm(Z(m)Z) d dl*m+Z+ eZ,G dd„ deƒZ-G dd„ deƒZ.G dd„ deƒZ/G dd„ deƒZ0G dd„ deƒZ1G dd„ deƒZ2i dd“dd “d!d"“d#d$“d%d&“d'd(“d)d*“d+d,“d-d.“d/d0“d1d2“d3d4“d5d6“d7d8“d9d:“d;d<“d=d>“i d?d@“dAdB“dCdD“dEdF“dGdH“dIdJ“dKdL“dMdN“dOdP“dQdR“dSdT“dUdV“dWdX“dYdZ“d[d\“d]d^“d_d`“¥i dadb“dcdd“dedf“dgdh“didj“dkdl“dmdn“dodp“dqdr“dsdt“dudv“dwdx“dydz“d{d|“d}d~“dd€“d�d‚“¥i dƒd„“d…d†“d‡dˆ“d‰dŠ“d‹dŒ“d�dŽ“d�d�“d‘d’“d“d”“d•d–“d—d˜“d™dš“d›dœ“d�dž“dŸd “d¡d¢“d£d¤“¥i d¥d¦“d§d¨“d©dª“d«d¬“d­d®“d¯d°“d±d²“d³d´“dµd¶“d·d¸“d¹dº“d»d¼“d½d¾“d¿dÀ“dÁdÂ“dÃdÄ“dÅdÆ“¥dÇdÈdÉdÊdËdÌdÍdÎdÏdÐdÑdÒœ¥Z3dÓdÔ„ Z4dÕdÖ„ Z5d×dØ„ Z6dÙdÚ„ Z7dÛdÜ„ Z8e9dÝk�rée8ƒ  dS dS )Þé    N)ÚSequence)ÚMD4)ÚEnum)Ú	unhexlifyÚhexlify)Údecoder)Úversion)ÚFILETIMEÚPRPC_SID)ÚTypeSerialization1)Úlogger)Ú	constantsÚpac)ÚTGS_REPÚEncTicketPartÚAD_IF_RELEVANT)ÚCCache)ÚChecksumTypes)ÚKeyÚ_enctype_tableÚInvalidChecksumÚgenerate_kerberos_keys)ÚLDAP_SIDc                   @   ó   e Zd ZdZdZdS )Ú
User_Flagsé    é   N)Ú__name__Ú
__module__Ú__qualname__ÚLOGON_EXTRA_SIDSÚLOGON_RESOURCE_GROUPS© r"   r"   úŽ/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/../../../bin/describeTicket.pyr   .   ó    r   c                   @   s   e Zd ZdZdZdZdS )ÚSE_GROUP_Attributesé   é   é   N)r   r   r   ÚSE_GROUP_MANDATORYÚSE_GROUP_ENABLED_BY_DEFAULTÚSE_GROUP_ENABLEDr"   r"   r"   r#   r%   3   s    r%   c                   @   sd   e Zd ZdZdZdZdZdZdZdZ	dZ
d	Zd
ZdZdZdZdZdZdZdZdZdZdZdZdZdS )ÚUSER_ACCOUNT_Codesr&   r'   r(   é   é   r   é@   é€   é   r   i   é   é   é    i @  i €  é   é   é   é   é   é    N)r   r   r   ÚUSER_ACCOUNT_DISABLEDÚUSER_HOME_DIRECTORY_REQUIREDÚUSER_PASSWORD_NOT_REQUIREDÚUSER_TEMP_DUPLICATE_ACCOUNTÚUSER_NORMAL_ACCOUNTÚUSER_MNS_LOGON_ACCOUNTÚUSER_INTERDOMAIN_TRUST_ACCOUNTÚUSER_WORKSTATION_TRUST_ACCOUNTÚUSER_SERVER_TRUST_ACCOUNTÚUSER_DONT_EXPIRE_PASSWORDÚUSER_ACCOUNT_AUTO_LOCKEDÚ$USER_ENCRYPTED_TEXT_PASSWORD_ALLOWEDÚUSER_SMARTCARD_REQUIREDÚUSER_TRUSTED_FOR_DELEGATIONÚUSER_NOT_DELEGATEDÚUSER_USE_DES_KEY_ONLYÚUSER_DONT_REQUIRE_PREAUTHÚUSER_PASSWORD_EXPIREDÚ+USER_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATIONÚUSER_NO_AUTH_DATA_REQUIREDÚUSER_PARTIAL_SECRETS_ACCOUNTÚUSER_USE_AES_KEYSr"   r"   r"   r#   r,   9   s.    r,   c                   @   sl   e Zd ZdZdZdZdZdZdZdZ	dZ
d	Zd
ZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdS )ÚUF_FLAG_Codesr&   r'   r-   r.   r   r/   r0   r1   r   r2   r3   r4   r5   r6   r7   r8   r9   r:   i  @ i  € i   i   i   i   N)r   r   r   Ú	UF_SCRIPTÚUF_ACCOUNTDISABLEÚUF_HOMEDIR_REQUIREDÚ
UF_LOCKOUTÚUF_PASSWD_NOTREQDÚUF_PASSWD_CANT_CHANGEÚ"UF_ENCRYPTED_TEXT_PASSWORD_ALLOWEDÚUF_TEMP_DUPLICATE_ACCOUNTÚUF_NORMAL_ACCOUNTÚUF_INTERDOMAIN_TRUST_ACCOUNTÚUF_WORKSTATION_TRUST_ACCOUNTÚUF_SERVER_TRUST_ACCOUNTÚUF_DONT_EXPIRE_PASSWDÚUF_MNS_LOGON_ACCOUNTÚUF_SMARTCARD_REQUIREDÚUF_TRUSTED_FOR_DELEGATIONÚUF_NOT_DELEGATEDÚUF_USE_DES_KEY_ONLYÚUF_DONT_REQUIRE_PREAUTHÚUF_PASSWORD_EXPIREDÚ)UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATIONÚUF_NO_AUTH_DATA_REQUIREDÚUF_PARTIAL_SECRETS_ACCOUNTÚUF_USE_AES_KEYSr"   r"   r"   r#   rQ   R   s2    rQ   c                   @   r   )ÚUpn_Dns_Flagsr&   r'   N)r   r   r   ÚU_UsernameOnlyÚS_SidSamSuppliedr"   r"   r"   r#   rj   m   r$   rj   c                   @   r   )ÚAttributes_Flagsr&   r'   N)r   r   r   ÚPAC_WAS_REQUESTEDÚPAC_WAS_GIVEN_IMPLICITLYr"   r"   r"   r#   rm   r   r$   rm   Ú498z'Enterprise Read-Only Domain ControllersÚ512zDomain AdminsÚ513zDomain UsersÚ514zDomain GuestsÚ515zDomain ComputersÚ516zDomain ControllersÚ517zCert PublishersÚ518zSchema AdminsÚ519zEnterprise AdminsÚ520zGroup Policy Creator OwnersÚ521zRead-Only Domain ControllersÚ522zCloneable ControllersÚ525zProtected UsersÚ526z
Key AdminsÚ527zEnterprise Key AdminsÚ553zRAS and IAS ServersÚ571z'Allowed RODC Password Replication GroupÚ572z&Denied RODC Password Replication GroupzS-1-1-0ÚEveryonezS-1-2-0ÚLocalzS-1-2-1zConsole LogonzS-1-3-0zCreator OwnerzS-1-3-1zCreator GroupzS-1-3-2zOwner ServerzS-1-3-3zGroup ServerzS-1-3-4zOwner RightszS-1-5-1ÚDialupzS-1-5-2ÚNetworkzS-1-5-3ÚBatchzS-1-5-4ÚInteractivezS-1-5-6ÚServicezS-1-5-7zAnonymous LogonzS-1-5-8ÚProxyzS-1-5-9zEnterprise Domain ControllerszS-1-5-10ÚSelfzS-1-5-11zAuthenticated UserszS-1-5-12zRestricted CodezS-1-5-13zTerminal Server UserzS-1-5-14zRemote Interactive LogonzS-1-5-15zThis OrganizationzS-1-5-17ÚIUSRzS-1-5-18zSystem (or LocalSystem)zS-1-5-19zNT Authority (LocalService)zS-1-5-20zNetwork ServicezS-1-5-32-544ÚAdministratorszS-1-5-32-545ÚUserszS-1-5-32-546ÚGuestszS-1-5-32-547zPower UserszS-1-5-32-548zAccount OperatorszS-1-5-32-549zServer OperatorszS-1-5-32-550zPrint OperatorszS-1-5-32-551zBackup OperatorszS-1-5-32-552ÚReplicatorszS-1-5-32-554zBuiltin\Pre-WindowszS-1-5-32-555zBuiltin\Remote Desktop UserszS-1-5-32-556z'Builtin\Network Configuration OperatorszS-1-5-32-557z&Builtin\Incoming Forest Trust BuilderszS-1-5-32-558z!Builtin\Performance Monitor UserszS-1-5-32-559zBuiltin\Performance Log UserszS-1-5-32-560z*Builtin\Windows Authorization Access GroupzS-1-5-32-561z'Builtin\Terminal Server License ServerszS-1-5-32-562zBuiltin\Distributed COM UserszS-1-5-32-568zBuiltin\IIS_IUSRSzS-1-5-32-569zBuiltin\Cryptographic OperatorszS-1-5-32-573zBuiltin\Event Log ReaderszS-1-5-32-574z'Builtin\Certificate Service DCOM AccesszS-1-5-32-575z!Builtin\RDS Remote Access ServerszS-1-5-32-576zBuiltin\RDS Endpoint ServerszS-1-5-32-577zBuiltin\RDS Management ServerszS-1-5-32-578zBuiltin\Hyper-V AdministratorszS-1-5-32-579z+Builtin\Access Control Assistance OperatorszS-1-5-32-580zBuiltin\Remote Management UserszS-1-5-64-10zNTLM AuthenticationzS-1-5-64-14zSChannel AuthenticationzS-1-5-64-21zDigest AuthenticationzS-1-5-80z
NT Servicez
S-1-5-80-0zAll Servicesz
S-1-5-83-0z#NT VIRTUAL MACHINE\Virtual Machinesz	S-1-5-113zLocal Accountz	S-1-5-114z0Local Account and member of Administrators groupz
S-1-5-1000zOther Organizationz
S-1-15-2-1zAll app packageszS-1-16-0zML UntrustedzS-1-16-4096zML LowzS-1-16-8192z	ML MediumzML Medium PluszML Highz	ML SystemzML Protected ProcesszML Secure Processz*Authentication authority asserted identityzService asserted identityzFresh public key identityzKey trust identityzKey property MFAzKey property attestation)zS-1-16-8448zS-1-16-12288zS-1-16-16384zS-1-16-20480zS-1-16-28672zS-1-18-1zS-1-18-2zS-1-18-3zS-1-18-4zS-1-18-5zS-1-18-6c                 C   s4  t  | j¡}t dt|jƒ ¡ t|jƒD �]�\}}t d| ¡ | ¡ }t	j
|d tƒ d�d }t|d jƒ 
d¡}t dd	|f ¡ t dd
|d  ¡  d¡d  
d¡f ¡ t dd|d  ¡  d¡d  
d¡f ¡ |d  ¡  d¡d  
d¡}t dd|f ¡ t dd|d  ¡  d¡d  
d¡f ¡ t ddtj |d d ¡ d¡f ¡ tj |d d ¡tj ¡ k rÒt ddtj |d d ¡ d¡f ¡ nt ddtj |d d ¡ d¡f ¡ tj |d d ¡tj ¡ k �rt ddtj |d d ¡ d¡f ¡ nt ddtj |d d ¡ d¡f ¡ g }tjD ]}	|d d|	j ? d@ dk�r>| t |	j¡j¡ �q$t dd|d d |¡f ¡ |d  d! d" }
t |
¡j}t |d# d$ ¡j}t dd%|f ¡ t dd&t |d# d' ¡ 
d¡f ¡ | d(¡d d)k�rït d*¡ d }|d+k�r¦|d,k�r¦t d-| ¡ n=|d+k�r¶t||| j| j d.�}n-| j�rÞ| j !d/¡�rÑd0| j "d/¡ #¡ | j  #¡ f }n| j}t|||| j d.�}nt $d1¡ |�rït dd2|f ¡ t d3d4 | ¡ d( t%d5d6„ |d  d7 d8 D ƒƒ¡}t d9d|f ¡ t d9d|d  d: f ¡ t d;d<t |
¡j|
f ¡ |d  d! d=  &¡ �sMt d>¡ t d?d@|d  d! d= f ¡ t dA¡ t'| j(| j)| j*| j+| j,| j| j ƒ}zt dB||
f ¡ ||
 }t dCt|jƒ 
d¡ ¡ W n3 t-�y²   t|ƒdk�r¥t $dDt |
¡j|
d dEd6„ | .¡ D ƒ¡¡ nt $dFt |
¡j|
¡ Y qw z|d  d! dG }t/t0|
ƒ }| 1|dH|¡}W n t2�yç   t $dI¡ | j,�råt dJ¡ t dK¡ Y qw t dL¡ t	j
|t3ƒ d�d }t4|d# d$ t5|d# d' ƒƒ}t	j
|dM d dN t6ƒ d�d }t7 8|d dN  9¡ ¡}t:|| ƒ}t d3dO | ¡ |D ]e}t%| .¡ ƒd }t dP| ¡ || D ]N}|| | }t;|t<ƒ�rŠt;|t=ƒ�sŠt|ƒdk�r�t dQ||d f ¡ |dd … D ]}t dRdS|  ¡ �qr�qFt dT| ¡ �qFt dQ||f ¡ �qF�q1qd S )UNz"Number of credentials in cache: %dzParsing credential[%d]:ÚKDC_REP)Úasn1Specr   Ú
sessionKeyúutf-8z	%-30s: %szTicket Session Keyz	User NameÚclientó   @z
User Realmr&   ÚserverzService NamezService Realmz
Start TimeÚtimeÚ	starttimeú%d/%m/%Y %H:%M:%S %pÚendtimez%-30s: %s (expired)zEnd TimeÚ
renew_tillÚ	RenewTillÚtktflagsé   z%-30s: (0x%x) %sÚFlagsú, Úticketúenc-partÚetypeÚkeyÚkeytypeÚKeyTypezBase64(key)Úkeyvalueú/Úkrbtgtz$Attempting to create Kerberoast hashÚrc4_hmacÚaes256_cts_hmac_sha1_96zKService ticket uses encryption key type %s, unable to extract hash and salt)Ú
decodedTGSÚspnÚusernameÚdomainú$z	host%s.%szJAES256 in use but no '-u/--user' passed, unable to generate crackable hashzKerberoast hashz%-30s:z5Decoding unencrypted data in credential[%d]['ticket']c                 S   ó   g | ]}t |ƒ‘qS r"   ©Ústr)Ú.0Úsname_componentr"   r"   r#   Ú
<listcomp>  ó    z parse_ccache.<locals>.<listcomp>Úsnameúname-stringz  %-28s: %sÚrealmz  %-28s: %s (etype %d)zEncryption typeÚkvnozNo kvno in ticket, skippingz  %-28s: %dzKey version number (kvno)zHandling Kerberos keysz&Ticket is encrypted with %s (etype %d)zUsing corresponding key: %sz‚Could not find the correct encryption key! Ticket is encrypted with %s (etype %d), but only keytype(s) %s were calculated/suppliedc                 S   r±   r"   r²   )r´   Úenctyper"   r"   r#   r¶   3  r·   zrCould not find the correct encryption key! Ticket is encrypted with %s (etype %d), but no keys/creds were suppliedÚcipherr'   zUCiphertext integrity failed. Most likely the account password or AES key is incorrectzMake sure the salt/username/domain are set and with the proper values. In case of a computer account, append a "$" to the name.z±Remember: the encrypted-part of the ticket is secured with one of the target service's Kerberos keys. The target service is the one who owns the 'Service Name' SPN printed abovezTicket successfully decryptedzauthorization-datazad-dataz-Decoding credential[%d]['ticket']['enc-part']z  %-28sz    %-26s: %sz                                 z%sz
    %-26s:)>r   ÚloadFiler¡   ÚloggingÚinfoÚlenÚcredentialsÚ	enumerateÚtoTGSr   Údecoder   r   ÚcontentsÚprettyPrintÚsplitÚdatetimeÚfromtimestampÚstrftimeÚnowr   ÚTicketFlagsÚvalueÚappendÚnameÚjoinÚEncryptionTypesÚbase64Ú	b64encodeÚdebugÚkerberoast_from_ccacheÚuserr¯   ÚendswithÚrstripÚlowerÚerrorÚlistÚ	isNoValuer   Úrc4ÚaesÚpasswordÚhex_passÚsaltÚKeyErrorÚkeysr   ÚintÚdecryptr   r   r   Úbytesr   r   ÚPACTYPEÚasOctetsÚ	parse_pacÚ
isinstancer   r³   )ÚargsÚccacheÚcred_numberÚcredsÚ	rawTicketÚdecodedTicketr’   r­   ÚflagsÚkr£   Ú	etype_encÚkeyTypeÚkerberoast_hashr×   Úekeysr¤   Ú
cipherTextÚ	newCipherÚ	plainTextÚencTicketPartÚadIfRelevantÚpacTypeÚ
parsed_pacÚelement_typeÚelement_type_nameÚ	attributerÎ   Úsubvaluer"   r"   r#   Úparse_ccacheÜ   sÖ   ***(*( *(
€&

 
$

"
ý
þö


û
 
ÿõü�r  c           >      C   sF
  dd„ }dd„ }g }| d }t | d ƒD �]}t |¡}| d |d d d … d |d	 … }|d
 tjk�rVt|ƒ}	|t|	ƒd d … }
t ¡ }| |
¡ | |
t| 	¡ ƒd … ¡ i }||d ƒ|d< ||d ƒ|d< ||d ƒ|d< ||d ƒ|d< ||d ƒ|d< ||d ƒ|d< ||d ƒ|d< ||d ƒ|d< |d |d< |d |d< |d |d< |d |d < |d! |d"< |d# |d$< |d% |d&< |d' |d(< |d) |d*< |d+ |d,< |d- |d.< |d/ |d0< d1d2„ ||d3 ƒD ƒ}d4 
|¡|d5< g }d6}|D ]}t |¡}|�r| d7|› d8|› �¡ qü|d97 }qü|d6k�r.| d:|› d;|d9k�r)d<nd=› �¡ ||d>< |d? }g }tD ]}||j@ �rH| |j¡ �q:d@|d4 
|¡f |dA< t|dB ƒ dC¡|dD< |dE |dF< |dG |dH< |dI dJk�rz|dI |dK< n|dI  ¡ |dK< |dL }g }tD ]}||j@ �r˜| |j¡ �qŠd@|d4 
|¡f |dM< |dN |dO< g }|dP D ]T}|dQ  ¡ }|dR }g }tD ]}||j@ �rÏ| |j¡ �qÁt |d=¡}|�sït| dS¡ƒdk�rït | dS¡dT d=¡}|�r÷dU|› �}| dV||d4 
|¡f ¡ �q±||dW< |dX dJk�r|dX |dY< n|dX  ¡ |dY< |dZ |d[< d4 
d\d2„ ||d] ƒD ƒ¡|d^< t|d_ ƒ dC¡|d_< |d` |d`< |da |da< | db|i¡ �nÂ|d
 tjk�r±t ¡ }| |¡ i }z
||dc ƒ|dd< W n+   z|t|d de… ƒƒ|dd< W n t�y� } zt |¡ W Y d }~nd }~ww Y |df  dg¡|dh< | di|i¡ �ng|d
 tjk�rWt |¡}|dj }|dk } || | | …  dg¡}!|dl }"|dm }#||#|#|" …  dg¡}$|dn }%g }&tD ]}'|%|'j@ �rú|& |'j¡ �qìi }d7|%› d8d4 
|&¡› �|dn< |!|do< |$|dp< tj j|&v �rNt !|¡}|dq }(|dr })||)|)|( …  dg¡}*|ds }+|dt },t"||,|,|+ … ƒ}-|*|du< |- ¡ |dv< | dw|i¡ �nÁ|d
 tj#k�rƒt $|¡}.i }t%|.dx ƒj|dy< t|.dz ƒ dC¡|dz< | d{|i¡ �n•|d
 tj&k�r¯t $|¡}.i }t%|.dx ƒj|dy< t|.dz ƒ dC¡|dz< | d||i¡ �ni|d
 tj'k�rˆt (|¡}/i }0d}|/j)d~ |/j)d~ f |0d~< |/j)d }1d€|1t* +|/j)d ¡jf |0d�< |j,�söd‚|0d�< t dƒ¡ | d„|0i¡ �n"| d„|0i¡ t-|1 }2t.|1t/|j,ƒƒ}3|2 0|3d…|/j)d† ¡}4t|4ƒ}	|4t|	ƒd d … }
t 1|
¡}5i }6|5d‡ |6dˆ< | d‰|6i¡ |5dŠ D ]M}7i }8|7d‹ |8dŒ< |7d� |8dŽ< | d�|8i¡ t 2dJ 
|7dŠ ¡¡}9i }:|9d~ |:d�< |9dn |:d‘< t|9d’ ƒ dC¡|:d“< t|9d” ƒ dC¡|:d•< | d–|:i¡ �q9n�|d
 tj3k�r¸t 4|¡};i }|;d— |d—< |;j)d˜ j)d™ |d˜< |;dš  dC¡|dš< | d›|i¡ n`|d
 tj5k�ròt 6|¡}<|<dn }%g }&t7D ]}'|%|'j@ �rÛ|& |'j¡ �qÍdnd7|%› d8d4 
|&¡› �i}| dœ|i¡ n&|d
 tj8k�rt 9|¡}=dv|=dv  ¡ i}| d�|i¡ n	t :dž|d
  ¡ |t|ƒd … }q|S )ŸNc                 S   s~   | d }| d }d}|dkr=|dkr=|}|dK }||O }t j|d d� ¡ d	kr=t   d
ddd	d	d	¡t j|d d�  d¡}|S )NÚdwLowDateTimeÚdwHighDateTimezInfinity (absolute time)l   ÿÿ iÿÿÿr   é
   )Úmicrosecondsr   iA  r&   r™   )rÉ   Ú	timedeltaÚtotal_secondsrË   )Údatar  r  Ú
v_FILETIMEÚ	temp_timer"   r"   r#   ÚPACparseFILETIMEd  s   *z#parse_pac.<locals>.PACparseFILETIMEc                 S   s8   g }| D ]}i }|d |d< |d |d< |  |¡ q|S )NÚ
RelativeIdÚ
Attributes)rÏ   )r
  ÚgroupsÚgroupÚgroupMembershipr"   r"   r#   ÚPACparseGroupIdst  s   z#parse_pac.<locals>.PACparseGroupIdsÚBuffersÚcBuffersÚOffsetr-   ÚcbBufferSizeÚulTyper(   Ú	LogonTimez
Logon TimeÚ
LogoffTimezLogoff TimeÚKickOffTimezKickoff TimeÚPasswordLastSetzPassword Last SetÚPasswordCanChangezPassword Can ChangeÚPasswordMustChangezPassword Must ChangeÚLastSuccessfulILogonÚLastFailedILogonÚFailedILogonCountÚEffectiveNamezAccount NameÚFullNamez	Full NameÚLogonScriptzLogon ScriptÚProfilePathzProfile PathÚHomeDirectoryzHome DirÚHomeDirectoryDrivez	Dir DriveÚ
LogonCountzLogon CountÚBadPasswordCountzBad Password CountÚUserIdzUser RIDÚPrimaryGroupIdz	Group RIDÚ
GroupCountzGroup Countc                 S   ó   g | ]}t |d  ƒ‘qS ©r  r²   ©r´   Úgidr"   r"   r#   r¶      ó    zparse_pac.<locals>.<listcomp>ÚGroupIdsr    ÚGroupsr   ú(z) r&   ú+z Unknown custom groupÚsÚ zGroups (decoded)Ú	UserFlagsz(%s) %sz
User FlagsÚUserSessionKeyr“   zUser Session KeyÚLogonServerzLogon ServerÚLogonDomainNamezLogon Domain NameÚLogonDomainIdó    zLogon Domain SIDÚUserAccountControlzUser Account ControlÚSidCountzExtra SID CountÚ	ExtraSidsÚSidr  ú-éÿÿÿÿú z	%s%s (%s)z
Extra SIDsÚResourceGroupDomainSidzResource Group Domain SIDÚResourceGroupCountzResource Group Countc                 S   r-  r.  r²   r/  r"   r"   r#   r¶   ã  r1  ÚResourceGroupIdszResource Group IdsÚLMKeyÚSubAuthStatusÚ	Reserved3Ú	LoginInfoÚClientIdz	Client Idr   ÚNamez	utf-16-lezClient NameÚ
ClientNameÚ	UpnLengthÚ	UpnOffsetÚDnsDomainNameLengthÚDnsDomainNameOffsetrŸ   ÚUPNzDNS Domain NameÚSamNameLengthÚSamNameOffsetÚ	SidLengthÚ	SidOffsetÚSamAccountNameÚUserSidÚUpnDnsÚSignatureTypezSignature TypeÚ	SignatureÚServerChecksumÚKDCChecksumz	(0x%x) %dÚVersionÚEncryptionTypez	(0x%x) %szEncryption Typez%<Cannot decrypt, --asrep-key missing>z5No ASREP key supplied, cannot decrypt PAC CredentialszCredential Infor.   ÚSerializedDataÚCredentialCountz  Credential Countz  Credential DataÚCredentialsÚPackageNamez      Package NameÚCredentialSizez      Credential Sizez      SecPkg Credentialsz        Versionz        FlagsÚ
LmPasswordz        LmPaswordÚ
NtPasswordz        NtPaswordz        NTLM CredentialsÚS4U2proxyTargetÚTransitedListSizeÚDataÚS4UTransitedServicesÚDelegationInfozAttributes InfozRequestor Infoz:Unsupported PAC structure: %s. Please raise an issue or PR);Úranger   ÚPAC_INFO_BUFFERÚPAC_LOGON_INFOr   rÁ   ÚKERB_VALIDATION_INFOÚ
fromStringÚfromStringReferentsÚgetDatarÑ   ÚMsBuiltInGroupsÚgetrÏ   r   rÎ   rÐ   r   rÅ   ÚformatCanonicalr,   r%   rÈ   ÚPAC_CLIENT_INFO_TYPEÚPAC_CLIENT_INFOr	   Ú	Exceptionr¿   rÛ   ÚPAC_UPN_DNS_INFOÚUPN_DNS_INFOrj   rl   ÚUPN_DNS_INFO_FULLr   ÚPAC_SERVER_CHECKSUMÚPAC_SIGNATURE_DATAr   ÚPAC_PRIVSVR_CHECKSUMÚPAC_CREDENTIALS_INFOÚPAC_CREDENTIAL_INFOÚfieldsr   rÒ   Ú	asrep_keyr   r   r   ræ   ÚPAC_CREDENTIAL_DATAÚNTLM_SUPPLEMENTAL_CREDENTIALÚPAC_DELEGATION_INFOÚS4U_DELEGATION_INFOÚPAC_ATTRIBUTES_INFOÚPAC_ATTRIBUTE_INFOrm   ÚPAC_REQUESTOR_INFOÚPAC_REQUESTORrÕ   )>rý   rì   r  r  Úparsed_tuPACÚbuffÚbufferNÚ
infoBufferr
  Útype1ÚnewdataÚkerbdataÚparsed_dataÚall_groups_idr  Úunknown_countr0  Ú
group_namer8  ÚUser_Flags_FlagsÚflagÚUACÚ	UAC_FlagsÚ	extraSidsÚextraSidÚsidÚ
attributesÚattributes_flagsÚ
clientInfoÚeÚupnrO  rP  ÚUpnNamerQ  rR  ÚDnsNamerò   Ú
attr_flagsÚflag_librT  rU  ÚSamNamerV  rW  rA  ÚsignatureDataÚcredential_infoÚparsed_credential_infoÚcredinfo_enctyperù   r¤   Úplain_credential_dataÚcredential_dataÚparsed_credential_dataÚ
credentialÚparsed_secpkg_supplemental_credÚntlm_supplemental_credÚparsed_ntlm_supplemental_credÚdelegationInfoÚattributeInfoÚrequestorInfor"   r"   r#   rê   c  s   

$



$€€€
 
€ÿ€
€






ô

€ÿ
ÿrê   c              
   C   s   �z@|s| d d j  ¡ }n| ¡ }|sd}| d¡}| d d d tjjjkr\dtjjj||| dd	¡t| d d d
 d d…  	¡ ƒ 
¡ t| d d d
 dd …  	¡ ƒ 
¡ f }|W S | d d d tjjjkrœdtjjj||| dd	¡t| d d d
 dd …  	¡ ƒ 
¡ t| d d d
 d d…  	¡ ƒj
f }|W S | d d d tjjjkrÝdtjjj||| dd	¡t| d d d
 dd …  	¡ ƒ 
¡ t| d d d
 d d…  	¡ ƒ 
¡ f }|W S | d d d tjjjk�rdtjjj||| dd	¡t| d d d
 d d…  	¡ ƒ 
¡ t| d d d
 dd …  	¡ ƒ 
¡ f }|W S t d| d d d d | d d d d | d d d f ¡ |W S  t�yO } z‚ d }~ww )Nr¡   rº   ÚUSERr°   r¢   r£   z$krb5tgs$%d$*%s$%s$%s*$%s$%sú:ú~r½   r.   z$krb5tgs$%d$%s$%s$*%s*$%s$%siôÿÿÿz,Skipping %s/%s due to incompatible e-type %dr¸   r¹   r   r&   )Ú_valueÚupperrÙ   r   rÒ   rª   rÎ   Úreplacer   ré   rÅ   Úaes128_cts_hmac_sha1_96r«   Údes_cbc_md5r¿   rÕ   ry  )r¬   r­   r®   r¯   Úentryr¡  r"   r"   r#   rÖ   x  sX   
""ýí" ýò""ý÷""ýý$þ€ÿrÖ   c                  C   s|  t jddd�} | jdddd� | jdd	d
d� | jdd	dd� |  ¡ }d|_d|_|jdddddd� |jddddddd� |jdddddd� |jdddd d!d� |jd"d#dd$d%d� |jd&dd'd(d� |jd)dd*d+d� |  ¡ }d,|_d-|_|jd.dd*d/d� ttjƒd0kr‘|  	¡  t 
d0¡ |  ¡ }|js¯|jr¤|js¤|  d1¡ n|js¯|jr¯|  d2¡ |jr¼d3|jvr¼|  d4¡ |S )5NTzKTicket describer. Parses ticket, decrypts the enc-part, and parses the PAC.)Úadd_helpÚdescriptionr¡   ÚstorezPath to ticket.ccache)ÚactionÚhelpz-debugÚ
store_truezTurn DEBUG output ONz-tsz&Adds timestamp to every logging outputz(Ticket decryption credentials (optional)a  Tickets carry a set of information encrypted by one of the target service account's Kerberos keys.(example: if the ticket is for user:"john" for service:"cifs/service.domain.local", you need to supply credentials or keys of the service account who owns SPN "cifs/service.domain.local")z-pz
--passwordÚPASSWORDz)Cleartext password of the service account)rÂ  ÚmetavarrÃ  z-hpz--hex-passwordrá   ÚHEXPASSWORDz#Hex password of the service account)ÚdestrÂ  rÆ  rÃ  z-uz--userr¶  zName of the service accountz-dz--domainÚDOMAINzFQDN Domainz-sz--saltÚSALTzqSalt for keys calculation (DOMAIN.LOCALSomeuser for users, DOMAIN.LOCALhostsomemachine.domain.local for machines)z--rc4ÚRC4zRC4 KEY (i.e. NT hash)z--aesÚHEXKEYzAES128 or AES256 keyz#PAC Credentials decryption materialaÄ  [MS-PAC] section 2.6 (PAC Credentials) describes an element that is used to send credentials for alternate security protocols to the client during initial logon.This PAC credentials is typically used when PKINIT is conducted for pre-authentication. This structure contains LM and NT hashes.The information is encrypted using the AS reply key. Attack primitive known as UnPAC-the-Hash. (https://www.thehacker.recipes/ad/movement/kerberos/unpac-the-hash)z--asrep-keyz+AS reply key for PAC Credentials decryptionr&   z]without -s/--salt, and with -u/--user, argument -d/--domain is required to calculate the saltz]without -s/--salt, and with -d/--domain, argument -u/--user is required to calculate the saltÚ.z-Domain supplied in -d/--domain should be FQDN)ÚargparseÚArgumentParserÚadd_argumentÚadd_argument_groupÚtitlerÀ  rÁ   ÚsysÚargvÚ
print_helpÚexitÚ
parse_argsrâ   r×   r¯   rÛ   )ÚparserÚticket_decryptionr©  rì   r"   r"   r#   r×  £  s<   


r×  c               
   C   s|   t tjƒ tƒ } t | j| j¡ zt| ƒ W d S  t	y= } zt
 ¡ jt
jkr+t ¡  t
 t|ƒ¡ W Y d }~d S d }~ww )N)Úprintr   ÚBANNERr×  r   ÚinitÚtsrÕ   r  ry  r¿   Ú	getLoggerÚlevelÚDEBUGÚ	tracebackÚ	print_excrÛ   r³   )rì   r¡  r"   r"   r#   ÚmainÐ  s   
€ýrã  Ú__main__):r¿   rÓ  rá  rÎ  rÉ   rÓ   Útypingr   ÚCryptodome.Hashr   Úenumr   Úbinasciir   r   Úpyasn1.codec.derr   Úimpacketr   Úimpacket.dcerpc.v5.dtypesr	   r
   Úimpacket.dcerpc.v5.rpcrtr   Úimpacket.examplesr   Úimpacket.krb5r   r   Úimpacket.krb5.asn1r   r   r   Úimpacket.krb5.ccacher   Úimpacket.krb5.constantsr   Úimpacket.krb5.cryptor   r   r   r   Úimpacket.ldap.ldaptypesr   ÚPSIDr   r%   r,   rQ   rj   rm   rt  r  rê   rÖ   r×  rã  r   r"   r"   r"   r#   Ú<module>   s¼  ÿþýüûúùø	÷
öõôóòñðïîíìëêéèçæåäãâá à!ß"Þ#Ý$Ü%Û&Ú'Ù(Ø)×*Ö+Õ,Ô-Ó.Ò/Ñ0Ð1Ï2Î3Í4Ì5Ë6Ê7É8È9Ç:Æ;Å<Ä=Ã>Â?Á@ÀA¿B¾C½D¼E»FºG¹H¸I·J¶KµL´M³N²O±P°Q¯R®S­T¬U«V d   +-

ÿ