o
    Žõ±jå6  ã                   @   sæ   d dl Z d dlZd dlZd dlZd dlmZ d dlmZmZm	Z	m
Z
mZmZmZmZmZmZmZmZmZmZmZmZmZmZmZ d dlmZ d dlmZ d dlmZ d dlm Z  d dl!m"Z" d d	l#m$Z$ d d
l%m&Z& G dd„ dƒZdS )é    N)ÚKatzSystemInfo)ÚCredmanTemplateÚMsvTemplateÚMsvDecryptorÚWdigestTemplateÚLsaTemplateÚWdigestDecryptorÚLiveSspTemplateÚLiveSspDecryptorÚSspDecryptorÚSspTemplateÚTspkgDecryptorÚTspkgTemplateÚKerberosTemplateÚKerberosDecryptorÚDpapiTemplateÚDpapiDecryptorÚLsaDecryptorÚCloudapTemplateÚCloudapDecryptor)ÚLogonSession)Úlogger)ÚUniversalEncoder)ÚMinidumpFile)ÚCCACHE)ÚKirbi)Ú__version__c                   @   sn  e Zd Zdd„ Zdd„ Zdd„ Zdd„ Zd	d
„ Zedgfdd„ƒZ	edgfdd„ƒZ
edgfdd„ƒZedgfdd„ƒZedgdfdd„ƒZedgfdd„ƒZedgdfdd„ƒZedgfdd„ƒZeddgfdd„ƒZedddgfd d!„ƒZed"dgfd#d$„ƒZd%d&„ Zd'd(„ Zd)d*„ Zd+d,„ Zd-d.„ Zd/d0„ Zd1d2„ Zd3d4„ Zd5d6„ Zd>d8d9„Zd:d;„ Zdgfd<d=„ZdS )?Úpypykatzc                 C   sH   || _ || _g | _d | _d | _d | _d | _i | _g | _g | _	t
ƒ | _d S ©N)ÚreaderÚsysinfoÚcredentialsÚarchitectureÚoperating_systemÚbuildnumberÚlsa_decryptorÚlogon_sessionsÚorphaned_credsÚerrorsr   Úkerberos_ccache)Úselfr   r    © r+   ú„/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/pypykatz.pyÚ__init__   s   zpypykatz.__init__c                 C   s²   i }i |d< | j D ]}| j |  ¡ |d |< q	g |d< | jD ]}|d  | ¡ ¡ qg |d< | jD ]%\}}t|ƒd d t |j	¡¡ }t
 | ¡ ¡ ¡ }|d  ||f¡ q1|S )Nr&   r'   r(   ú
)r&   Úto_dictr'   Úappendr(   ÚstrÚjoinÚ	tracebackÚ	format_tbÚ__traceback__Úbase64Ú	b64encodeÚencodeÚdecode)r*   ÚtÚlsÚocÚpkgÚerrÚerr_strr+   r+   r,   r/   +   s   

zpypykatz.to_dictc                 C   s   t j|  ¡ tddd�S )Né   T)ÚclsÚindentÚ	sort_keys)ÚjsonÚdumpsr/   r   ©r*   r+   r+   r,   Úto_json=   s   zpypykatz.to_jsonc           
      C   sz  d  tj¡d }| jD ]¯}| j|  ¡ D ]¥}|d  |¡d 7 }| jD ]`}| ¡ }|d dkrY|d d urXt|d ƒt|d ƒt|d ƒdddddt|d ƒg	}|d  |¡d 7 }q"| ¡ }t|d ƒdddddt|d	 ƒt|d
 ƒt|d ƒdg
}|d  |¡d 7 }q"| jD ]2\}}t|ƒd d  t	 
|j¡¡ }	t |	 ¡ ¡ ¡ }	|d ddddddd|	g	}|d  |¡d 7 }q†qq|S )Nú:r.   ÚcredtypeÚdpapiÚpasswordÚ
domainnameÚusernameÚ Ú	masterkeyÚsha1_masterkeyÚkey_guidÚ_exception_please_report)r2   r   Úgrep_headerr&   Úto_grep_rowsr'   r/   r1   r(   r3   r4   r5   r6   r7   r8   r9   )
r*   ÚresÚluidÚrowÚcredr:   Úxr=   r>   r?   r+   r+   r,   Úto_grep@   s,   

6€8üôzpypykatz.to_grepc                 C   s\   d}| j D ]}|t| j | ƒd 7 }qt| jƒdkr,|d7 }| jD ]
}|t|ƒd 7 }q!|S )Nz== Logon credentials ==
r.   r   z== Orphaned credentials ==
)r&   r1   Úlenr'   )r*   rU   rV   rX   r+   r+   r,   Ú__str__X   s   

zpypykatz.__str__Úallc                 C   sL   t  ¡ dkr
tdƒ‚ddlm} |ƒ }t |¡}t| ¡ |ƒ}| 	| ¡ |S )NÚWindowsú&Live parsing will only work on Windowsr   ©Ú
LiveReader©
ÚplatformÚsystemÚ	ExceptionÚ*pypykatz.commons.readers.local.live_readerra   r   Úfrom_live_readerr   Úget_buffered_readerÚstart)Úpackagesra   r   r    Úmimir+   r+   r,   Úgo_lived   s   

zpypykatz.go_livec                 C   s˜   t  ¡ dkr
tdƒ‚ddlm} |ƒ }t|ƒdkrtdƒ‚|D ]*\}}ztj|dgd�W   S  tyI } ztd|||f ƒ W Y d }~qd }~ww d S )	Nr^   r_   r   )Úenum_lsass_handleszNo handles found to LSASS!r]   )rj   z7[-] Failed to parse lsass via handle %s[@%s] Reason: %s)	rc   rd   re   Ú>pypykatz.commons.winapi.local.function_defs.live_reader_ctypesrm   r[   r   Úgo_live_phandleÚprint)rj   rm   Úlsass_handlesÚpidÚlsass_handleÚer+   r+   r,   Úgo_handledupo   s   €ÿýzpypykatz.go_handledupc                 C   sP   t  ¡ dkr
tdƒ‚ddlm} || d�}t |¡}t| ¡ |ƒ}| 	|¡ |S )Nr^   r_   r   r`   )Úprocess_handlerb   )rv   rj   ra   r   r    rk   r+   r+   r,   ro   }   s   


zpypykatz.go_live_phandlec                 C   s<   ddl m} | | ¡}t |¡}t| ¡ |ƒ}| |¡ |S )Nr   )ÚZipDumpReader)Ú'pypykatz.commons.readers.zipdump.readerrw   Ú	from_filer   rg   r   rh   ri   )Úfilenamerj   rw   r   r    rk   r+   r+   r,   Úparse_zipdump_fileˆ   s   


zpypykatz.parse_zipdump_filei (  c              
   C   s�   zt  | ¡}| ¡ j|d�}t |¡}W n ty' } zt d¡ |‚d }~ww zt	||ƒ}| 
|¡ W |S  tyG } z| ¡  |‚d }~ww )N©Úsegment_chunk_sizezMinidump parsing error!)r   ÚparseÚ
get_readerrh   r   Úfrom_minidumpre   r   Ú	exceptionr   ri   Úlog_basic_info)rz   rj   Ú	chunksizeÚminidumpr   r    rt   rk   r+   r+   r,   Úparse_minidump_file‘   s$   

€þ
ü€ýzpypykatz.parse_minidump_filec                 C   ó8   t  | ¡}| ¡  ¡ }t |¡}t||ƒ}| |¡ |S )zD
		Parses LSASS minidump file bytes.
		data needs to be bytearray
		)r   Úparse_bytesr   rh   r   r€   r   ri   )Údatarj   r„   r   r    rk   r+   r+   r,   Úparse_minidump_bytes£   ó   



zpypykatz.parse_minidump_bytesc                 C   s<   t  | ¡}| ¡ j|d�}t |¡}t||ƒ}| |¡ |S )zé
		Parses LSASS minidump file based on the file object.
		File object can really be any object as longs as 
		it implements read, seek, tell functions with the 
		same parameters as a file object would.

		handle: file like object
		r|   )r   Úparse_externalr   rh   r   r€   r   ri   )Úhandlerj   rƒ   r„   r   r    rk   r+   r+   r,   Úparse_minidump_external°   s   




z pypykatz.parse_minidump_externalc                 C   r†   )z_
		Parses LSASS minidump file which contents are in a bytes buffer
		buff: io.BytesIO object
		)r   Ú
parse_buffr   rh   r   r€   r   ri   )Úbuffrj   r„   r   r    rk   r+   r+   r,   Úparse_minidump_bufferÁ   rŠ   zpypykatz.parse_minidump_bufferNc                 C   s:   ddl m} | | |¡}t |¡}t||ƒ}| |¡ |S ©Nr   )ÚRekallReader)Ú,pypykatz.commons.readers.rekall.rekallreaderr’   Úfrom_memory_filer   Úfrom_rekallreaderr   ri   )rz   Úoverride_timestamprj   r’   r   r    rk   r+   r+   r,   Úparse_memory_dump_rekallÎ   s   


z!pypykatz.parse_memory_dump_rekallc                 C   s<   ddl m} | | ||¡}t |¡}t||ƒ}| |¡ |S r‘   )r“   r’   Úfrom_sessionr   r•   r   ri   )Úsessionr–   r$   rj   r’   r   r    rk   r+   r+   r,   Ú	go_rekall×   s   


zpypykatz.go_rekallé   c                 C   s>   ddl m}m} || |ƒ}| ¡ }t||ƒ}| |¡ ||ƒS )Nr   )Ú
Vol3ReaderÚvol3_treegrid)Ú.pypykatz.commons.readers.volatility3.volreaderrœ   r�   Úget_sysinfor   ri   )Úvol3_objÚframework_versionrj   rœ   r�   r   r    rk   r+   r+   r,   Úgo_volatility3à   s   


zpypykatz.go_volatility3c                 C   s‚   t  d¡ t  dt ¡ t  d| jjj ¡ t  d| jj ¡ t  d| jj ¡ t  d| jj ¡ t  d| jj	 ¡ t  d¡ d	S )
z=
		In case of error, please attach this to the issues page
		z8===== BASIC INFO. SUBMIT THIS IF THERE IS AN ISSUE =====zpypyKatz version: %szCPU arch: %szOS: %szBuildNumber: %szMajorVersion: %s zMSV timestamp: %sz===== BASIC INFO END =====N)
r   Úinfor   r    r"   Únamer#   r$   Úmajor_versionÚmsv_dll_timestamprF   r+   r+   r,   r‚   ê   s   
zpypykatz.log_basic_infoc                 C   sB   t  | j¡}t | j¡}t| j|| j|| jƒ}| ¡  |j| _d S r   )	r   Úget_templater    r   r   r   r%   ri   r&   )r*   Úcredman_templateÚmsv_templateÚlogoncred_decryptorr+   r+   r,   Úget_logoncreds÷   s
   zpypykatz.get_logoncredsc                 C   sZ   t  d¡ t | j¡D ]}zt | j|| j¡}| ¡  W n   Y qt  d¡ |  S d S )Nz1Testing all available templates! Expect warnings!z@Lucky you! Brutefoce method found a -probably- working template!)	r   Údebugr   Úget_template_bruter    r   Úchooser   Údump)r*   Úlsa_dec_templateÚlsa_decr+   r+   r,   Úget_lsa_bruteforceþ   s   

øzpypykatz.get_lsa_bruteforcec              
   C   s€   zt  | j¡}t | j|| j¡}| ¡  W |S  ty? } zt 	dt
|ƒ ¡ |  ¡ }|d u r3tdƒ‚|W  Y d }~S d }~ww )Nz?Failed to automatically detect correct LSA template! Reason: %szAll detection methods failed.)r   r§   r    r   r®   r   r¯   re   r   r¬   r1   r²   )r*   r°   r±   rt   r+   r+   r,   Úget_lsa
  s   
ù€ûzpypykatz.get_lsac                 C   óf   t  | j¡}t| j|| j| jƒ}| ¡  |jD ]}|j| j	v r*| j	|j j
 |¡ q| j |¡ qd S r   )r   r§   r    r   r   r%   ri   r!   rV   r&   Úwdigest_credsr0   r'   )r*   Údecryptor_templateÚ	decryptorrX   r+   r+   r,   Úget_wdigest  ó   
üzpypykatz.get_wdigestc                 C   r´   r   )r   r§   r    r   r   r%   ri   r!   rV   r&   Útspkg_credsr0   r'   )r*   Útspkg_dec_templateÚ	tspkg_decrX   r+   r+   r,   Ú	get_tspkg#  r¹   zpypykatz.get_tspkgc                 C   r´   r   )r   r§   r    r   r   r%   ri   r!   rV   r&   Ú	ssp_credsr0   r'   ©r*   Údec_templateÚdecrX   r+   r+   r,   Úget_ssp-  r¹   zpypykatz.get_sspc                 C   r´   r   )r	   r§   r    r
   r   r%   ri   r!   rV   r&   Úlivessp_credsr0   r'   )r*   Úlivessp_dec_templateÚlivessp_decrX   r+   r+   r,   Úget_livessp7  r¹   zpypykatz.get_livesspc                 C   r´   r   )r   r§   r    r   r   r%   ri   r!   rV   r&   Údpapi_credsr0   r'   r¿   r+   r+   r,   Ú	get_dpapiA  r¹   zpypykatz.get_dpapiTc                 C   s˜   t  | j¡}t| j|| j| j|d�}| ¡  |jD ]0}|jD ]}|j	D ]}| j
 t|j	| ƒ¡ q#q|j| jv rC| j|j j |¡ q| j |¡ qd S )N)Úwith_tickets)r   r§   r    r   r   r%   ri   r!   ÚticketsÚ
kirbi_datar)   Ú	add_kirbir   rV   r&   Úkerberos_credsr0   r'   )r*   rÉ   rÀ   rÁ   rX   ÚticketÚfnr+   r+   r,   Úget_kerberosK  s   


ÿøzpypykatz.get_kerberosc                 C   sr   t  | j¡}|d u rd S t| j|| j| jƒ}| ¡  |jD ]}|j| j	v r0| j	|j j
 |¡ q| j |¡ qd S r   )r   r§   r    r   r   r%   ri   r!   rV   r&   Úcloudap_credsr0   r'   )r*   Úcloudap_dec_templateÚcloudap_decrX   r+   r+   r,   Úget_cloudapY  s   
üzpypykatz.get_cloudapc              
   C   sÔ  |   ¡ | _d|v sd|v r.z|  ¡  W n ty- } z| j d|f¡ W Y d }~nd }~ww d|v s6d|v rWz|  ¡  W n tyV } z| j d|f¡ W Y d }~nd }~ww d|v scd|v scd|v r‘zd}d|v snd|v rpd}|  |¡ W n ty� } z| j d|f¡ W Y d }~nd }~ww d|v s™d|v rºz|  ¡  W n ty¹ } z| j d|f¡ W Y d }~nd }~ww d	|v sÂd|v rãz|  	¡  W n tyâ } z| j d	|f¡ W Y d }~nd }~ww d
|v sìd|v �rz|  
¡  W n t�y } z| j d
|f¡ W Y d }~nd }~ww d|v �sd|v �r:z|  ¡  W n t�y9 } z| j d|f¡ W Y d }~nd }~ww d|v �sDd|v �rhz|  ¡  W d S  t�yg } z| j d|f¡ W Y d }~d S d }~ww d S )NÚmsvr]   ÚwdigestÚkerberosÚkticketsFTÚtspkgÚssprJ   ÚcloudapÚlivessp)r³   r%   r«   re   r(   r0   r¸   rÐ   r½   rÂ   rÈ   rÔ   rÆ   )r*   rj   rt   rÉ   r+   r+   r,   ri   e  sz   
€ÿ€ÿ€ÿ€ÿ€ÿ€ÿ€ÿ€ÿýzpypykatz.start)T) Ú__name__Ú
__module__Ú__qualname__r-   r/   rG   rZ   r\   Ústaticmethodrl   ru   ro   r{   r…   r‰   r�   r�   r—   rš   r¢   r‚   r«   r²   r³   r¸   r½   rÂ   rÆ   rÈ   rÐ   rÔ   ri   r+   r+   r+   r,   r      sP    

	





r   )'rc   rD   r3   r6   Úpypykatz.commons.commonr   Úpypykatz.lsadecryptorr   r   r   r   r   r   r	   r
   r   r   r   r   r   r   r   r   r   r   r   Ú,pypykatz.lsadecryptor.packages.msv.decryptorr   r   r   r   Úminidump.minidumpfiler   Úminikerberos.common.ccacher   Úminikerberos.common.kirbir   Úpypykatz._versionr   r+   r+   r+   r,   Ú<module>   s   T