o
    j4                  
   @   s  d dl mZ d dl mZ d dlZd dlZd dlZd dlZd dlZd dlZd dl	Z	d dl
mZ d dlmZ d dlmZmZ d dlmZ d dlmZ d d	lmZ d d
lmZ d dlmZ d dlmZ d dlmZmZm Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z) d dl*m+Z+m,Z,m-Z-m.Z. d dl/m0Z0m1Z1 d dl2m3Z3m4Z4m5Z5m6Z6m7Z7m8Z8m9Z9m:Z:m;Z;m<Z< d dl=m>Z>m?Z?m(Z( d dl@mAZA G dd dZBeCdkrbeDejE eF ZGeGjHdddd eGjHddddd eGjHddd d eGjHd!dd"d eGId#ZJeJjHd$dd%d&d' eKe	jLd(kreGM  e	Nd( eGO ZPeQePjRePjS eePjTePjU\ZVZWZXZYZYZYzeBePjZeWeXeVePjUZ[e[\  W dS  e]ya Z^ ze_ j`ejakrOd dlbZbebc  edeee^ W Y dZ^[^dS dZ^[^ww dS ))    )division)print_functionN)	unhexlify)b)decoderencoder)noValue)version)TypeSerialization1)logger)parse_identity)	constants)AP_REQAS_REPTGS_REQAuthenticatorTGS_REPseq_setseq_set_iterPA_FOR_USER_ENCEncTicketPartAD_IF_RELEVANTTicket)Key_enctype_table_HMACMD5Enctype)getKerberosTGTsendReceive)
PACTYPEPAC_INFO_BUFFERKERB_VALIDATION_INFOPAC_CLIENT_INFO_TYPEPAC_CLIENT_INFOPAC_SERVER_CHECKSUMPAC_SIGNATURE_DATAPAC_PRIVSVR_CHECKSUMPAC_UPN_DNS_INFOUPN_DNS_INFO)	PrincipalKerberosTimer   )hexdumpc                   @   s&   e Zd Zdd Zd	ddZdd ZdS )
S4U2SELFc                 C   sF  t j|t dd }t j|d d d t dd }t|d d  }|d }t|d D ]}t|}|d |d d d  d |d	  }t	 j
tjkrVtd
|d   |d dkrt|}|t|d d  }	t }
|
|	 |
|	t|
 d   |
  t  td|
d   t  nx|d tkrt|}t	 j
tjkr|  t  n^|d tkrt|}t	 j
tjkr|  t  nD|d tkrt|}t	 j
tjkr|  t  n*|d tkrt|}t	 j
tjkr|  t||d d   t  nt| t	 j
tjkrtd |t|d  }q.d S )Nasn1Specr   zauthorization-datazad-dataBufferscBuffersOffset   cbBufferSizez	TYPE 0x%xulType      zDomain SID:LogonDomainIdDnsDomainNameOffsetzP################################################################################)r   decoder   r   r   asOctetsranger    logging	getLoggerlevelDEBUGprintr
   lenr!   
fromStringfromStringReferentsgetDatadumpformatCanonicalr"   r#   r$   r%   r&   r'   r(   r+   )selfdataencTicketPartadIfRelevantpacTypebuffbufferN
infoBuffertype1newdatakerbdata
clientInfosignatureDataupn rU   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/../../../bin/getPac.pyprintPac9   sf   $
zS4U2SELF.printPac Nc                 C   sJ   || _ || _| | _|| _d| _d| _|d ur#|d\| _| _d S d S )NrX   :)_S4U2SELF__username_S4U2SELF__passwordupper_S4U2SELF__domain_S4U2SELF__behalfUser_S4U2SELF__lmhash_S4U2SELF__nthashsplit)rG   
behalfUserusernamepassworddomainhashesrU   rU   rV   __init__o   s   
zS4U2SELF.__init__c                 C   s  t | jtjjjd}t|| j| jt	| j
t	| j\}}}}tj|t dd }t }||d  t }d|d< ttjjj|d< t }	t|	|d< t|d|j t }
d|
d	< t|d
 |
d
< t  }||d
d t|
d|j tjtjj}|j|
d< t ||
d< t!" j#t!j$krt!%d t&|
'  t&d t()|
}|*|d|d }t+|d< |j,|d d< ||d d< t()|}t- }d|d< ttjj-j|d< t+|d< t+|d d< ttj.j/j|d d d< ||d d d< t | j0tjjjd}t12dtjjj}|t3| j0t3| j d 7 }t!" j#t!j$kr#t!%d t4| t56|d|}t!" j#t!j$kr<t!%d t4| t7 }t|d|j | j|d< t+|d< ttj8j9j|d d< ||d d < d!|d"< t!" j#t!j$krxt!%d# t&|'  t()|}t+|d d$< ttj.j:j|d d$ d< ||d d$ d< t|d%}t }	|	;tj<j=j |	;tj<j>j |	;tj<j?j |	;tj<j@j |	;tj<jAj t|	|d&< t | jtjjBjd}t|d'|j t|d
 |d(< tjtjjtjCd$d) }t ||d*< tDEd+|d,< tF|dt|j,ttjGjHjf |tI }tF|d-|f t!" j#t!j$kr5t!%d. t&|'  t()|}tJ|| jd }tj|tK dd }t!" j#t!j$kr_t!%d/ t&|'  |d d0 d }tLt|d d0 d  }| jd1krtM| jtNr| jd2krtO|j,t	| j}n|j,tPjQkr|RtSd1d }n|RtS| jT | j d }z|U|d3t|}W n   |U|d3|}Y | V| d S )4N)typer-   r   ticket   pvnozmsg-typez
ap-optionszauthenticator-vnocrealmcnamecusecctimeAUTHENTICATOR
   authenticatoretypecipherpadatazpadata-typezpadata-valuez<Is   KerberosS4UByteArray   CheckSumuserName	userRealmcksum	cksumtypechecksumKerberoszauth-packager   r5   zreq-bodyzkdc-optionssnamerealm)daystill   noncezadditional-ticketsz	Final TGSr   zenc-partrX          )Wr)   rZ   r   PrincipalNameTypeNT_PRINCIPALvaluer   r[   r]   r   r_   r`   r   r9   r   r   	from_asn1r   intApplicationTagNumberslistencodeFlagsr   to_asn1r   strcomponents_to_asn1datetimenowtimezoneutcmicrosecondr*   r<   r=   r>   r?   debugr@   prettyPrintr   encodeencryptr   enctyper   PreAuthenticationDataTypes
PA_TGS_REQr^   structpackr   r+   r   r~   r   ChecksumTypeshmac_md5PA_FOR_USERappend
KDCOptionsforwardable	renewablerenewable_okcanonicalizeenc_tkt_in_skey
NT_UNKNOWN	timedeltarandomgetrandbitsr   EncryptionTypesrc4_hmac
TicketAsn1r   r   r   
isinstancebytesr   r   RC4string_to_keyrd   r\   decryptrW   )rG   rz   tgtru   oldSessionKey
sessionKey
decodedTGTri   apReqoptsrs   
clientNamer   encodedAuthenticatorencryptedEncodedAuthenticatorencodedApReqtgsReqrw   checkSumpaForUserEncencodedPaForUserEncreqBody
serverNamemyTicketmessagertgs
cipherText	newCipherkey	plainTextrU   rU   rV   rE   y   s   












&zS4U2SELF.dump)rX   rX   rX   N)__name__
__module____qualname__rW   rg   rE   rU   rU   rU   rV   r,   7   s    
6
r,   __main__credentialsstorezYdomain/username[:password]. Valid domain credentials to use for grabbing targetUser's PAC)actionhelpz-targetUserTz&the target user to retrieve the PAC of)r   requiredr   z-debug
store_truezTurn DEBUG output ONz-tsz&Adds timestamp to every logging outputauthenticationz-hasheszLMHASH:NTHASHz$NTLM hashes, format is LMHASH:NTHASH)r   metavarr   r5   )f
__future__r   r   argparser   r<   r   rer   sysbinasciir   sixr   pyasn1.codec.derr   r   pyasn1.type.univr   impacketr	   impacket.dcerpc.v5.rpcrtr
   impacket.examplesr   impacket.examples.utilsr   impacket.krb5r   impacket.krb5.asn1r   r   r   r   r   r   r   r   r   r   r   r   impacket.krb5.cryptor   r   r   r   impacket.krb5.kerberosv5r   r   impacket.krb5.pacr   r    r!   r"   r#   r$   r%   r&   r'   r(   impacket.krb5.typesr)   r*   impacket.winregistryr+   r,   r   r@   BANNERArgumentParserparseradd_argumentadd_argument_groupgrouprA   argv
print_helpexit
parse_argsoptionsinittsr   r   rf   re   rc   rd   _
targetUserdumperrE   	Exceptioner=   r>   r?   	traceback	print_excerrorr   rU   rU   rU   rV   <module>   sh   40 
p


