o
    àý°j˜4  ã                
   @   sÈ  d dl mZ d dl mZ d dlZd dlZd dlZd dlZd dlZd dlZd dl	Z	d dl
mZ d dlmZ d dlmZmZ d dlmZ d dlmZ d d	lmZ d d
lmZ d dlmZ d dlmZ d dlmZmZm Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z) d dl*m+Z+m,Z,m-Z-m.Z. d dl/m0Z0m1Z1 d dl2m3Z3m4Z4m5Z5m6Z6m7Z7m8Z8m9Z9m:Z:m;Z;m<Z< d dl=m>Z>m?Z?m(Z( d dl@mAZA G dd„ dƒZBeCdk�rbeDejEƒ e F¡ ZGeGjHdddd� eGjHddddd� eGjHddd d� eGjHd!dd"d� eG Id#¡ZJeJjHd$dd%d&d'� eKe	jLƒd(k�reG M¡  e	 Nd(¡ eG O¡ ZPe QePjRePjS¡ eePjTePjUƒ\ZVZWZXZYZYZYzeBePjZeWeXeVePjUƒZ[e[ \¡  W dS  e]�ya Z^ ze _¡ j`ejak�rOd dlbZbeb c¡  e deee^ƒ¡ W Y dZ^[^dS dZ^[^ww dS ))é    )Údivision)Úprint_functionN)Ú	unhexlify)Úb)ÚdecoderÚencoder)ÚnoValue)Úversion)ÚTypeSerialization1)Úlogger)Úparse_identity)Ú	constants)ÚAP_REQÚAS_REPÚTGS_REQÚAuthenticatorÚTGS_REPÚseq_setÚseq_set_iterÚPA_FOR_USER_ENCÚEncTicketPartÚAD_IF_RELEVANTÚTicket)ÚKeyÚ_enctype_tableÚ_HMACMD5ÚEnctype)ÚgetKerberosTGTÚsendReceive)
ÚPACTYPEÚPAC_INFO_BUFFERÚKERB_VALIDATION_INFOÚPAC_CLIENT_INFO_TYPEÚPAC_CLIENT_INFOÚPAC_SERVER_CHECKSUMÚPAC_SIGNATURE_DATAÚPAC_PRIVSVR_CHECKSUMÚPAC_UPN_DNS_INFOÚUPN_DNS_INFO)Ú	PrincipalÚKerberosTimer   )Úhexdumpc                   @   s&   e Zd Zdd„ Zd	dd„Zdd„ ZdS )
ÚS4U2SELFc                 C   sF  t j|tƒ d�d }t j|d d d tƒ d�d }t|d d  ¡ ƒ}|d }t|d ƒD ]ò}t|ƒ}|d |d d d … d |d	 … }t 	¡ j
tjkrVtd
|d  ƒ |d dkr“t|ƒ}|t|ƒd d … }	tƒ }
|
 |	¡ |
 |	t|
 ¡ ƒd … ¡ |
 ¡  tƒ  td|
d  ¡ ƒ tƒ  nx|d tkr­t|ƒ}t 	¡ j
tjkr¬| ¡  tƒ  n^|d tkrÇt|ƒ}t 	¡ j
tjkrÆ| ¡  tƒ  nD|d tkrát|ƒ}t 	¡ j
tjkrà| ¡  tƒ  n*|d tk�rt|ƒ}t 	¡ j
tjk�r| ¡  t||d d … ƒ tƒ  nt|ƒ t 	¡ j
tjk�rtdƒ |t|ƒd … }q.d S )N©Úasn1Specr   zauthorization-datazad-dataÚBuffersÚcBuffersÚOffseté   ÚcbBufferSizez	TYPE 0x%xÚulTypeé   é   zDomain SID:ÚLogonDomainIdÚDnsDomainNameOffsetzP################################################################################)r   Údecoder   r   r   ÚasOctetsÚranger    ÚloggingÚ	getLoggerÚlevelÚDEBUGÚprintr
   Úlenr!   Ú
fromStringÚfromStringReferentsÚgetDataÚdumpÚformatCanonicalr"   r#   r$   r%   r&   r'   r(   r+   )ÚselfÚdataÚencTicketPartÚadIfRelevantÚpacTypeÚbuffÚbufferNÚ
infoBufferÚtype1ÚnewdataÚkerbdataÚ
clientInfoÚsignatureDataÚupn© rU   ú†/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/../../../bin/getPac.pyÚprintPac9   sf   ÿ$
€€€€ÕzS4U2SELF.printPacÚ Nc                 C   sJ   || _ || _| ¡ | _|| _d| _d| _|d ur#| d¡\| _| _d S d S )NrX   ú:)Ú_S4U2SELF__usernameÚ_S4U2SELF__passwordÚupperÚ_S4U2SELF__domainÚ_S4U2SELF__behalfUserÚ_S4U2SELF__lmhashÚ_S4U2SELF__nthashÚsplit)rG   Ú
behalfUserÚusernameÚpasswordÚdomainÚhashesrU   rU   rV   Ú__init__o   s   
ÿzS4U2SELF.__init__c                 C   s”  t | jtjjjd�}t|| j| jt	| j
ƒt	| jƒƒ\}}}}tj|tƒ d�d }tƒ }| |d ¡ tƒ }d|d< ttjjjƒ|d< tƒ }	t |	¡|d< t|d|jƒ tƒ }
d|
d	< t|d
 ƒ|
d
< t ƒ }| |d
d¡ t|
d|jƒ tj tjj¡}|j|
d< t  |¡|
d< t! "¡ j#t!j$kržt! %d¡ t&|
 '¡ ƒ t&dƒ t( )|
¡}| *|d|d ¡}t+|d< |j,|d d< ||d d< t( )|¡}t-ƒ }d|d< ttjj-jƒ|d< t+|d< t+|d d< ttj.j/jƒ|d d d< ||d d d< t | j0tjjjd�}t1 2dtjjj¡}|t3| j0ƒt3| jƒ d 7 }t! "¡ j#t!j$k�r#t! %d¡ t4|ƒ t5 6|d|¡}t! "¡ j#t!j$k�r<t! %d¡ t4|ƒ t7ƒ }t|d|jƒ | j|d< t+|d< ttj8j9jƒ|d d< ||d d < d!|d"< t! "¡ j#t!j$k�rxt! %d#¡ t&| '¡ ƒ t( )|¡}t+|d d$< ttj.j:jƒ|d d$ d< ||d d$ d< t|d%ƒ}tƒ }	|	 ;tj<j=j¡ |	 ;tj<j>j¡ |	 ;tj<j?j¡ |	 ;tj<j@j¡ |	 ;tj<jAj¡ t |	¡|d&< t | jtjjBjd�}t|d'|jƒ t|d
 ƒ|d(< tj tjj¡tjCd$d)� }t  |¡|d*< tD Ed+¡|d,< tF|dt|j,ƒttjGjHjƒfƒ | tIƒ ¡}tF|d-|fƒ t! "¡ j#t!j$k�r5t! %d.¡ t&| '¡ ƒ t( )|¡}tJ|| jd ƒ}tj|tKƒ d�d }t! "¡ j#t!j$k�r_t! %d/¡ t&| '¡ ƒ |d d0 d }tLt|d d0 d ƒ }| jd1k�r�tM| jtNƒ�r�| jd2k�r�tO|j,t	| jƒƒ}n|j,tPjQk�rŸ| RtSd1d ¡}n| RtS| j T¡ | j d ¡}z| U|d3t|ƒ¡}W n   | U|d3|¡}Y |  V|¡ d S )4N)Útyper-   r   Úticketé   Úpvnozmsg-typez
ap-optionszauthenticator-vnoÚcrealmÚcnameÚcusecÚctimeÚAUTHENTICATORÚ
é   ÚauthenticatorÚetypeÚcipherÚpadatazpadata-typezpadata-valuez<Is   KerberosÚS4UByteArrayé   ÚCheckSumÚuserNameÚ	userRealmÚcksumÚ	cksumtypeÚchecksumÚKerberoszauth-packager   r5   zreq-bodyzkdc-optionsÚsnameÚrealm)ÚdaysÚtillé   Únoncezadditional-ticketsz	Final TGSr   zenc-partrX   ó    é   )Wr)   rZ   r   ÚPrincipalNameTypeÚNT_PRINCIPALÚvaluer   r[   r]   r   r_   r`   r   r9   r   r   Ú	from_asn1r   ÚintÚApplicationTagNumbersÚlistÚencodeFlagsr   Úto_asn1r   ÚstrÚcomponents_to_asn1ÚdatetimeÚnowÚtimezoneÚutcÚmicrosecondr*   r<   r=   r>   r?   Údebugr@   ÚprettyPrintr   ÚencodeÚencryptr   Úenctyper   ÚPreAuthenticationDataTypesÚ
PA_TGS_REQr^   ÚstructÚpackr   r+   r   r~   r   ÚChecksumTypesÚhmac_md5ÚPA_FOR_USERÚappendÚ
KDCOptionsÚforwardableÚ	renewableÚrenewable_okÚcanonicalizeÚenc_tkt_in_skeyÚ
NT_UNKNOWNÚ	timedeltaÚrandomÚgetrandbitsr   ÚEncryptionTypesÚrc4_hmacÚ
TicketAsn1r   r   r   Ú
isinstanceÚbytesr   r   ÚRC4Ústring_to_keyrd   r\   ÚdecryptrW   )rG   rz   Útgtru   ÚoldSessionKeyÚ
sessionKeyÚ
decodedTGTri   ÚapReqÚoptsrs   Ú
clientNamer”   ÚencodedAuthenticatorÚencryptedEncodedAuthenticatorÚencodedApReqÚtgsReqrw   ÚcheckSumÚpaForUserEncÚencodedPaForUserEncÚreqBodyÚ
serverNameÚmyTicketÚmessageÚrÚtgsÚ
cipherTextÚ	newCipherÚkeyÚ	plainTextrU   rU   rV   rE   y   sÎ   ÿ









ÿ


&zS4U2SELF.dump)rX   rX   rX   N)Ú__name__Ú
__module__Ú__qualname__rW   rg   rE   rU   rU   rU   rV   r,   7   s    
6
r,   Ú__main__ÚcredentialsÚstorezYdomain/username[:password]. Valid domain credentials to use for grabbing targetUser's PAC)ÚactionÚhelpz-targetUserTz&the target user to retrieve the PAC of)rÕ   ÚrequiredrÖ   z-debugÚ
store_truezTurn DEBUG output ONz-tsz&Adds timestamp to every logging outputÚauthenticationz-hasheszLMHASH:NTHASHz$NTLM hashes, format is LMHASH:NTHASH)rÕ   ÚmetavarrÖ   r5   )fÚ
__future__r   r   Úargparser“   r<   r­   ÚrerŸ   ÚsysÚbinasciir   Úsixr   Úpyasn1.codec.derr   r   Úpyasn1.type.univr   Úimpacketr	   Úimpacket.dcerpc.v5.rpcrtr
   Úimpacket.examplesr   Úimpacket.examples.utilsr   Úimpacket.krb5r   Úimpacket.krb5.asn1r   r   r   r   r   r   r   r   r   r   r   r±   Úimpacket.krb5.cryptor   r   r   r   Úimpacket.krb5.kerberosv5r   r   Úimpacket.krb5.pacr   r    r!   r"   r#   r$   r%   r&   r'   r(   Úimpacket.krb5.typesr)   r*   Úimpacket.winregistryr+   r,   rÏ   r@   ÚBANNERÚArgumentParserÚparserÚadd_argumentÚadd_argument_groupÚgrouprA   ÚargvÚ
print_helpÚexitÚ
parse_argsÚoptionsÚinitÚtsr˜   rÓ   rf   re   rc   rd   Ú_Ú
targetUserÚdumperrE   Ú	ExceptionÚer=   r>   r?   Ú	tracebackÚ	print_excÚerrorr‘   rU   rU   rU   rV   Ú<module>   sh   40 
p


€üæ