o
    j%                     @  s  d dl mZ d dlmZ d dlZd dlZd dlZd dlZd dlZd dl	Z	d dl
mZ d dlmZ d dlmZ d dlmZ d dlmZmZmZmZmZmZmZmZmZmZmZmZmZm Z m!Z!mZm"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z*m+Z+m,Z,m-Z-m.Z.m/Z/m0Z0m1Z1m2Z2m3Z3m4Z4m5Z5m6Z6m7Z7m8Z8m9Z9 d d	l:m;Z;m<Z<m=Z= d d
l>m?Z?m@Z@ d dlAmBZBmCZCmDZDmEZEmFZFmGZGmHZH d dlImJZJmKZKmLZLmMZM d dlNmOZO d dlPmQZQ d dlRmSZSmTZT d dlUmVZV d dlWmXZX d dlYmZZZm[Z[m\Z\m]Z]m^Z^ d dl_m`Z` d dlambZb d dlcmdZd d dlcmeZe G dd dZfdS )    )annotations)hashlibN)List)logger)CCACHE)KerberosSPN)(METHOD_DATA
ETYPE_INFOETYPE_INFO2PADATA_TYPEPA_PAC_REQUESTPA_ENC_TS_ENCEncryptedData	krb5_pvnoKDC_REQ_BODYAS_REQTGS_REP
KDCOptionsPrincipalNameEncASRepPartEncTGSRepPartr   RealmChecksum	APOptionsAuthenticatorTicketAP_REQTGS_REQ	CKSUMTYPEPA_FOR_USER_ENCPA_PAC_OPTIONSPA_PAC_OPTIONSTypesEncTicketPartChangePasswdDataMSEncryptionKeyEncKrbPrivPartHostAddressKRB_PRIVAP_REPKERB_KEY_LIST_REQ	S4UUserIDS4UUserIDOptionsPA_S4U_X509_USERTransitedEncodingTicketFlags)KRB5ChangePasswordKRB5CHPWReplyKRB5CHPWResultCode)KerberosErrorCodeKerberosError)Key_enctype_table_HMACMD5Enctype_checksum_table_SHA1AES128_SHA1AES256)
PaDataTypeEncryptionType	NAME_TYPEMESSAGE_TYPE)AuthenticatorChecksum)GSSAPIFlags)AIOKerberosClientSocketAIOKerberosPWChangeClientSocket)KerberosCredential)KerberosTarget)PKAuthenticatorAuthPackPA_PK_AS_REPKDCDHKeyInfoPA_PK_AS_REQ)ChannelBindingsStruct)construct_apreq_from_tgs_tgt)cms)corec                   @  sT  e Zd ZdJddZdd Zd	d
 Zg ddddddfdKddZg ddfdLddZg ddfdMddZdd Z	dd Z
ddg dddfdNd"d#ZdOd%d&Zddg d'fdOd(d)Zg d*ejejejejejejejgfd+d,Zdg d-fd.d/Zd0d1 Zg d-dfdPd4d5Zdd6g dfd7d8Zd9d: Zd;d< ZdQd=d>ZdRdSdFdGZdTdUdHdIZdS )VAIOKerberosClientccredrC   targetrD   c                 C  s   || _ || _t| j| _t | _|d ur"| j jd u rt n| j j| _d | _d | _d | _d | _	d | _
d | _d | _d | _d | _d | _d S N)
credentialrP   rA   ksocr   ccachepkinit_tkeykerberos_session_keykerberos_TGTkerberos_TGT_encpartkerberos_TGSkerberos_cipherkerberos_cipher_typekerberos_keyserver_saltserver_supp_enc_methods)selfrO   rP    r`   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/minikerberos/aioclient.py__init__)   s    
zAIOKerberosClient.__init__c                   s   | S rQ   r`   )r_   r`   r`   ra   
__aenter__<   s   zAIOKerberosClient.__aenter__c                   s   d S rQ   r`   )r_   exc_typeexc	tracebackr`   r`   ra   	__aexit__?   s   zAIOKerberosClient.__aexit__)forwardable	renewable	proxiableNFTkdcopts	List[str]with_pacboolreturnr   c                 C  sJ  t d g }|du r$i }	ttd|	d< tddi |	d< ||	 t d|j  tj	tj
j}
|du r|d u rt|
jd	d
|
jd }t|j | _|j| _| j| d urb| j|  nd | _t| jj| jj|| jd| _| j| jd|d }n|}
|}i }ttd|d< t|j|d |d< || i }tt||d< tt j!j| jj"#dd|d< | jj$% |d< tt j!jd| jj$% gd|d< |
tj&dd jd	d
|d< |
tj&dd jd	d
|d< t'(d|d< |jg|d< |d ur|D ]	}|| ||< qi }t)|d< t*j+j|d< ||d< t,||d < t-|S )!Nz'Constructing TGT request with auth dataTPA-PAC-REQUESTpadata-typeinclude-pacpadata-valuez$Selecting common encryption type: %sFr   microsecond)patimestamppausec)salt   zENC-TIMESTAMPetypecipherkdc-options/z	name-typename-stringcnamerealmkrbtgtsnamedaystillrtime   noncer{   pvnomsg-typepadatareq-body).r   debugintr   r   dumpappendnamedatetimenowtimezoneutcr   replaceru   r5   valuerZ   r[   r^   encoder]   r4   enctyperR   get_key_for_enctyper\   encryptr   r   setr   r=   	PRINCIPALusernamesplitdomainupper	timedeltasecretsrandbitsr   r>   
KRB_AS_REQr   r   )r_   supported_encryption_methodrk   enctimestampnewnow
no_preauthkdc_req_body_extrarm   padatas	pa_data_1r   	timestampenc_timestamp	pa_data_2kdc_req_bodykeykdc_reqr`   r`   ra   build_asreq_ltsC   sR   

"
 "
z!AIOKerberosClient.build_asreq_lts)rh   ri   zrenewable-okc                 C  s  ddl m} |jdkrtdtjtjj}i }tt	||d< t
tjj| jjdd|d< | jj |d	< t
tjjd
| jj gd|d< |tjdd jdd|d< |tjdd jdd|d< td|d< |jg|d< t|}t|  }i }	|j|	d< |jdd|	d< td|	d< ||	d< i }
| jjj|
d< | jjj|
d< d|
d< i }d|d< | |
|d< i }|!||d< | jj" |d< i }t#|	|d< |$||d< | jjj%|d < t&|}| jj'| d!d"}t( }||d#< g }|d!u ri }t)t*d$|d%< t+d&d!i |d'< |,| i }t-j.j|d%< | |d'< |,| i }d(|d)< d*|d+< ||d,< ||d-< t/|S ).Nr   )keys   z5RC4 encryption is not supported for certificate auth!r}   r~   r   r   r   r   r   ry   r   rt   r   r   r   r   r{   cusecctime
paChecksumpgqz1.2.840.10046.2.1	algorithm
parameters
public_keypkAuthenticatorclientPublicValueclientDHNonceT)wrap_signedsignedAuthPackrp   rq   rr   rs      r   
   r   r   r   )0
asn1cryptor   r   	Exceptionr   r   r   r   r   r   r   r=   r   rR   r   r   r   r   SRV_INSTr   r   r   r   r   r   sha1r   digestru   dhparamsr   r   DomainParametersPublicKeyAlgorithmget_public_keyrE   PublicKeyInfodh_noncerF   sign_authpackrI   r   r   r   r   r;   	PK_AS_REQr   )r_   r   rk   rm   r   r   kdc_req_body_datar   checksumauthenticatordppkaspkiauthpacksigned_authpackpayloadr   	pa_data_0r   asreqr`   r`   ra   build_asreq_pkinitx   sl   
 "



z$AIOKerberosClient.build_asreq_pkinitc                   sh   | j jd ur| j|||d}n| j|||d}td | j| I d H }|j	dkr2t
|d|S )Nrm   zSending TGT request to server	KRB_ERRORzPreauth failed!)rR   certificater   r   r   r   rS   sendrecvr   r   r3   )r_   r   rk   rm   reqrepr`   r`   ra   
do_preauth   s   


zAIOKerberosClient.do_preauthc              
   C  s   zA| j d u r
td| j | jj| jj| jj\}}}|d ur!||| _|d | _t	|d |d | _
t|d  | _|d | _W dS  tyW } z
d |fW  Y d }~S d }~ww )NNo CCACHE file foundenc-partkeytypekeyvalue)TN)rT   r   get_tgtrR   r   r   ccache_spn_strict_checkrW   rX   r4   rV   r5   rZ   r[   )r_   tgt	keystructerrer`   r`   ra   tgt_from_ccache   s    
"

z!AIOKerberosClient.tgt_from_ccachec                 C  s   t  | _t|d jD ]L}t|d }|tjks|tjkrY|tjkr,t|d }n|tjkr8t|d }|jD ]}|d | jt	|d < t
dt	|d j|d f  q;q| j| j}| j| j}|| jvrqtd||fS )Nze-datarq   rs   rx   r{   z/Server supports encryption type %s with salt %sz,Preferred enc type not in supported enctypes)collectionsOrderedDictr^   r   loadnativer;   r	   r
   r<   r   r   r   rR   get_common_enctypesget_preferred_enctyper   )r_   r   
enc_method	data_typeenc_info_listenc_infocommon_enctypespreferred_enc_typer`   r`   ra   "select_preferred_encryption_method   s"   



"
z4AIOKerberosClient.select_preferred_encryption_methodoverride_snamer   c                   s  |   \}}|du rdS td tjtjj}i }	tt||	d< t	t
jj| jjdd|	d< | jj |	d< |du rRt	t
jjd| jj gd|	d	< nt	t
jj| d|	d	< |tjd
d jdd|	d< |tjd
d jdd|	d< td|	d< |du r| j |	d< n||	d< | jjdurd}dd |	d D |	d< t|	d dkrddg|	d< |	d du st|	d dkrg d|	d< i }
|du rttd|
d< tddi |
d< i }t|d< t j!j|d< t|
dkr|
g|d< t"|	|d < t#|}td!| j$%   | j$&| I dH }|j'd"krS|j(}|| _)|d#ks-| jj*du r/|S t+|d$ d  | _,|d$ d | _-t.| j,j/| j0t1|d$ d | _2n |j(d% t3j4jkrat5||j(}td& d}| 6|\}}|du rz| j7||d'I dH }W n t5y } zG|j8t3j9kr||:| |D ],}z| j7||d'I dH }W  n! t5y } z|j8t3j9kr|W Y d}~qd}~ww t;d(W Y d}~nld}~ww t<|t=d#u r|g}|D ]Y}t1t|}z| j7||d'I dH }W n3 t5y } z|j8t3j9kr|td)|j'  W Y d}~qd}~w t;y, } z|d}~ww |j'd"kr5 n
td)|j'  q|du rHt;d(td* |j(}|| _)| jjdur{| >|\| _?| _@| _,|j| _-| jAjB| j)| j?dd+ td, dS |d$ d- }| j,C| j2d.|}z	tDE|j(| _?W n6 t;y } z)td/ z	tFE|j(| _?W n t;y } ztGd0 |d}~ww W Y d}~nd}~ww t.| j,j/| j?d1 d2 | _@| jAjB| j)| j?dd+ td, dS )3aJ  
		decrypt_tgt: used for asreproast attacks
		Steps performed:
			1. Send and empty (no encrypted timestamp) AS_REQ with all the encryption types we support
			2. Depending on the response (either error or AS_REP with TGT) we either send another AS_REQ with the encrypted data or return the TGT (or fail miserably)
			3. PROFIT
		Nz2Generating initial TGT without authentication datar}   r~   r   r   r   r   r   ry   r   r   rt   r   r   r   r   r{   c                 S  s   g | ]}|d kr|qS )r   r`   .0xr`   r`   ra   
<listcomp>  s    z-AIOKerberosClient.get_TGT.<locals>.<listcomp>      )r   r  r  Trp   rq   rr   rs   r   r   r   r   zSending initial TGT to %sr   Fr   
error-codez1Got reply from server, askig to provide auth datar   z2Failed to get TGT with any of the provided etypes!zFailed to get TGT with etype %sz"Got valid TGT response from server)override_ppzGot valid TGTr|      z(EncAsRepPart load failed, is this linux?z+Failed to load decrypted part of the reply!r   r   )Hr   r   r   r   r   r   r   r   r   r   r=   r   r   rR   r   r   r   r   r   get_principalnamer   r   r   r   get_supported_enctypesr   lenr   r   r   r   r   r>   r   r   r   rS   get_addr_strr   r   r   rW   	nopreauthr5   rZ   r[   r4   r   r   r<   r\   r2   KDC_ERR_PREAUTH_REQUIREDr3   r   r   	errorcodeKDC_ERR_ETYPE_NOTSUPPremover   
isinstancelistdecrypt_asrep_certrX   rV   rT   add_tgtdecryptr   r   r   error)r_   override_etypedecrypt_tgtrk   r   rm   _r   r   r   r   r   r   r   preauth_repr   all_common_enctypesr   r{   	etype_int
cipherTexttempr`   r`   ra   get_TGT   s   

 $
(








zAIOKerberosClient.get_TGTspn_userc              
   C  s   zE| j d u r
td| j |\}}}|d ur|t|d |d }t|d |d d }td|d|d< t|j}||d |d fW S  ty] } zd d d |fW  Y d }~S d }~ww )Nr   r   r   r   r   r   rz   r   )	rT   r   get_tgsr4   r$   r   r   r   r   )r_   r"  tgsr   r   r   keydatar   r`   r`   ra   tgs_from_ccache  s   

z!AIOKerberosClient.tgs_from_ccache)rh   ri   renewable_okcanonicalizec                   s  |  |\}}}}|du r|||fS | jdu r&|  \}	}|dur&tdtd|   tjtj	j
}
i }tt||d< | jd d d d |d	< ttjj| d
|d< |
tjdd jdd|d< td|d< |rw||d< n| jdkrdg|d< n| jdg|d< i }t|d< t| jd |d< | jd |d< |
j|d< |
jdd|d< |rt }d|_d|_i }d|d< | |d< t||d< d|d< | j | j!dt"|# d}i }t|d < t$j%j|d!< t&t |d"< t'| jd |d< t(| j|d#|d$< i }t)j*j|d%< t+|# |d&< i }t|d < t$j,j|d!< |g|d'< t-||d(< t*|}td) | j./|# I dH }|j0d*krGt1|d+td, |j2}t34| j5| j!d-|d. d/ j2}t6|d0 d1 |d0 d2 }| j78|| td3 || _9|||fS )4a  
		Requests a TGS ticket for the specified user.
		Retruns the TGS ticket, end the decrpyted encTGSRepPart.

		spn_user: KerberosTarget: the service user you want to get TGS for.
		override_etype: None or list of etype values (int) Used mostly for kerberoasting, will override the AP_REQ supported etype values (which is derived from the TGT) to be able to recieve whatever tgs tiecket 
		NzNo TGT found in CCACHE!z$Constructing TGS request for user %sr}   ticketr   r   ry   r   r   r   r   rt   r   r   r   r{   ir   authenticator-vnocrealmr   r   r   s                   i  	cksumtyper   cksum
seq-number   r   r   
ap-optionsrz   r   rq   rs   r   r   z"Constructing TGS request to serverr   zget_TGS failed!zGot TGS reply, decrypting...   r   r|   r   r   r   zGot valid TGS reply):r'  rW   r   r   r   r   get_formatted_pnamer   r   r   r   r   r   r   r=   r   r   r
  r   r   r   r   r[   r   r   ru   r?   flagschannel_bindingto_bytesr   rZ   r   rV   r   r   r>   
KRB_AP_REQr   r   r   r;   r   r   KRB_TGS_REQr   rS   r   r   r3   r   r   r   r  r4   rT   add_tgsrY   )r_   r"  r  is_linuxr4  r%  encTGSRepPartr   r   r  r   r   authenticator_dataacchksumauthenticator_data_encap_reqr   r   r   r   r`   r`   ra   get_TGS  s   









"

zAIOKerberosClient.get_TGS)rh   ri   r)  zenc-tkt-in-skeyc                   s  | j std |  I d H  | j|}tjtjj	}i }t
|d< t| j d |d< | j d |d< |j|d< |jdd|d< | j| jd	t| d }i }t
|d
< tjj|d< tt |d< t| j d |d< t| j|d|d< i }tjj|d< t| |d< i }	tt||	d< tt j!j| jj"#dd|	d< | jj$% |	d< |tj&dd jdd|	d< t'(d|	d< dg|	d< t| j d g|	d< i }
t
|
d
< tj)j|
d< |g|
d< t*|	|
d < t|
}td! | j+,| I d H }|j-d"krd#}|j.d$ d%krd&}t/||td' |j.}t0t1|d d( d  }|d d( d) }|2| jd*|}t34|j.}t54| j2| jd+|d( d) j.}t6|d, d- |d, d. }| j78|| td/ ||||fS )0Nz+[U2U] TGT is not available! Fetching TGT...r+  r,  r   r   r   rt   r   r0  r   r   r1  r*  rz   r   rq   rs   r}   r~   r   r   r   ry   r   r   r   r   r   r{   additional-ticketsr   r   z[U2U] Sending request to serverr   z[U2U] failed!r     zc[U2U] Failed to get U2U! Error code (16) indicates that delegation is not enabled for this account!z[U2U] Got reply, decrypting...r   r|      r2  r   r   r   z[U2U] Got valid TGS reply)9rW   r   r   r!  rR   r   r   r   r   r   r   r   ru   r   rZ   r   rV   r   r   r>   r7  r   r   r   r   r   r[   r;   r   r   r   r   r=   r   r   r   r   r   r   r   r   r8  r   rS   r   r   r   r3   r5   r   r  r"   r   r   r4   rT   r9  )r_   rk   supp_enc_methodssupp_encr   r<  r?  r@  pa_data_authkrb_tgs_bodykrb_tgs_reqr   replyemsgr%  r|   	encticketdecdata	decticketr;  r   r`   r`   ra   U2U  sl   

 




"
zAIOKerberosClient.U2U)rh   ri   r)  c                   s  | j std |  I dH  d}tjtjj}i }t|d< t	| j d |d< | j d |d< |j
|d< |jdd	|d
< | j| jdt| d}i }t|d< tjj|d< tt |d< t| j d |d< t| j|d|d< i }	tjj|	d< t| |	d< tjjjdddd}
|
|j  7 }
|
|j!  7 }
|
|  7 }
td|
"   td|
  t#$| jd|
}td|"   i }t%t&d|d< ||d< i }t'tjj|( d|d< |j!|d < t)||d!< ||d"< i }t%t*d#|d< t+| |d< |durt,|t-r|g}nt,|t.r|}n|( }n| j/j0d$}i }t1t||d%< t'tj2j|d|d&< | j/j!3 |d'< |tj4d(d) jdd	|d*< t56d+|d,< | jj7g|d-< i }t|d< tj8j|d< |	|g|d.< t9||d/< t|}td0 | j:;| I dH }|j<d1krd2}|j=d3 d4krd5}t>||td6 |j=}t?@| jA| jd7|d8 d9 j=}tB|d: d; |d: d< }| jCD|| td= || _E|||fS )>0
		user_to_impersonate : KerberosTarget class
		z0[S4U2self] TGT is not available! Fetching TGT...NKerberosr+  r,  r   r   r   rt   r   r0  r   r   r1  r*  rz   r   rq   rs      littleFsignedz[S4U2self] S4UByteArray: %sr  z[S4U2self] chksum_data: %sHMAC_MD5r-  r   r   userName	userRealmr.  zauth-packagezPA-FOR-USERr~   r}   r   r   ry   r   r   r   r   r{   r   r   z$[S4U2self] Sending request to serverr   S4U2self failed!r  rC  lS4U2self: Failed to get S4U2self! Error code (16) indicates that delegation is not enabled for this account!z#[S4U2self] Got reply, decrypting...r2  r   r|   r   r   r   z[S4U2self] Got valid TGS reply)FrW   r   r   r!  r   r   r   r   r   r   ru   r   rZ   r   rV   r   r   r>   r7  r   r   r   r   r   r[   r;   r   r   r=   r   r6  r   r   r   hexr6   r   r   r   r   r
  r   r   r   r  strr  rR   r   r   UNKNOWNr   r   r   r   r   r8  r   rS   r   r   r   r3   r   r   r  r4   rT   r9  rY   )r_   user_to_impersonater"  rk   auth_package_namer   r<  r?  r@  rG  S4UByteArraychksum_datar>  pa_for_user_encpa_for_userrH  rI  r   rJ  rK  r%  r;  r   r`   r`   ra   S4U2selfZ  s   







"

zAIOKerberosClient.S4U2selfc                   s  t dd|   tjtjj}i }tt	d|d< t
dttdgi |d< i }t|d< t| jd	 |d	< | jd
 |d
< |j|d< |jdd|d< | j| jdt| d }i }t|d< tjj|d< tt |d< t| jd |d< t| j|d|d< i }tjj|d< t | |d< i }	t!tg d|	d< t"t#j$j| d|	d< | j%j&' |	d< |tj(dd jdd|	d< t)*d|	d< | jj+g|	d < |g|	d!< i }
t|
d< tj,j|
d< ||g|
d"< t-|	|
d#< t|
}| j./| I d H }|j0d$krd%}|j1d& d'krd(}t2||t d) |j1}t34| j5| jd*|d+ d, j1}t6|d- d. |d- d/ }| j78|| t d0 |||fS )1Nz[S4U2proxy] Impersonating %sr~   PA-PAC-OPTIONSrq   r   z%resource-based constrained delegationrs   r+  r,  r   r   r   rt   r   r0  r   r   r1  r*  rz   r   )rh   ri   zconstrained-delegationr)  r}   r   r   r   ry   r   r   r   r   r{   rB  r   r   r   zS4U2proxy failed!r  rC  znS4U2proxy: Failed to get S4U2proxy! Error code (16) indicates that delegation is not enabled for this account!z+[S4U2proxy] Got server reply, decrypting...r2  r   r|   r   r   r   z[S4U2proxy] Got valid TGS reply)9r   r   joinr
  r   r   r   r   r   r   r    r!   r   r   r   r   rW   ru   r   rZ   r   rV   r   r>   r7  r   r   r   r   r[   r;   r   r   r   r   r=   r   rR   r   r   r   r   r   r   r8  r   rS   r   r   r   r3   r   r   r  r4   rT   r9  )r_   s4uself_ticketr"  r   pa_pac_optsr<  r?  r@  
pa_tgs_reqrH  rI  r   rJ  rK  r%  r;  r   r`   r`   ra   	S4U2proxy  sb   



"

zAIOKerberosClient.S4U2proxykeylist_req	List[int]c                   s  | j std |  I dH  tjtjj}i }t|d< t	| j d |d< | j d |d< |j
|d< |jdd|d	< | j| jd
t| d}i }t|d< tjj|d< tt |d< t| j d |d< t| j|d|d< i }tjj|d< t| |d< td}	i }
|	|
d< ttj j|! d|
d< |j"# |
d< d|
d< t$d|
d< t%|
}| jj&t'j(krt)d}t*+| jd| }n4| jj&t'j,krt)d}t-+| jd| }n| jj&t'j.krt)d}t/+| jd| }nt0d| jj& td|1   i }t2||d< ||d < i }t2t3d!|d< t4||d" |d< i }t2t3d#|d< t5d$t6td%gi |d< i }t7t||d&< ttj8jd'| j9j"gd|d(< | j9j"# |d)< |tj:d*d+ jdd|d,< |	|d< | jj&g|d-< i }t|d< tj;j|d< |||g|d.< |duri }t2t3d/|d< t<| |d< |d. =| t>||d0< t|}td1 | j?@| I dH }|jAd2krd3}|jBd4 d5krd6}tC||td7 |jB}tDE| jF| jd8|d9 d: jB}tG|d; d< |d; d= }| jHI|| td> || _J|||fS )?rP  z,[dMSA] TGT is not available! Fetching TGT...Nr+  r,  r   r   r   rt   r   r0  r   r   r1  r*  rz   r   rq   rs   r   r   r   zsubject-certificatei   (optionsHMAC_SHA1_96_AES_256   HMAC_SHA1_96_AES_128rV  zUnsupported encryption type: %sz[dMSA] chksum_data: %sr-  r   zFOR-X509-USER)zuser-idr   re  r   zBranch Awarer}   r   r   r   ry   r   r   r{   r   zPA-KEY-LISTr   z [dMSA] Sending request to serverr   rY  r  rC  rZ  z[dMSA] Got reply, decrypting...r2  r   r|   r   r   r   z[dMSA] Got valid TGS reply)KrW   r   r   r!  r   r   r   r   r   r   ru   r   rZ   r   rV   r   r   r>   r7  r   r   r   r   r   r[   r;   r   r   r   r   r   r=   r   r
  r   r   r+   r*   r   r7   AES256r   r:   r   AES128r9   RC4r6   NotImplementedErrorr[  r   r   r,   r    r!   r   r   rR   r   r8  r)   r   r   rS   r   r   r   r3   r   r   r  r4   rT   r9  rY   )r_   r^  rk   rk  r   r<  r?  r@  rG  
BODY_NONCEuserid_datauseridchecksum_typera  r>  pa_s4urh  rH  rI  
pa_keylistr   rJ  rK  r%  r;  r   r`   r`   ra   dmsa  s   






"

zAIOKerberosClient.dmsar   c              	   C  s   t ||| j||||dS )N)r4  
seq_numberap_optscb_data)rK   rW   )r_   r%  r;  
sessionkeyr4  r|  r}  r~  r`   r`   ra   construct_apreq  s   z!AIOKerberosClient.construct_apreqc                   s.   |  |I d H \}}}| |d |I d H S )Nr*  )rd  rj  )r_   target_userservice_spnr%  r;  r   r`   r`   ra   getST  s   zAIOKerberosClient.getSTc                 C  s  dd }|d D ]}|d dkrt |d j} nqtdztj|d j}W n   tj|d d	d  j}Y |d
 }|d dkrJtdt|d j}tddgdd |d D  d}tj	t
|d  dd  ddd}| jj|}	|d }
|	| jjj |
 }|d d }t| }|tjkr||d| _n|tjkr||d| _n	|tjkrtdt|j| j}|d d }||d |}t|j}tt|d! d"  }t|j|d! d# }|||fS )$Nc                 S  s~   d}d}t ||k r=tt|g|   }t |t | |kr/||d |t |  7 }	 |S ||7 }|d7 }t ||k s
|S )N    r   ry   )r  r   r   bytesr   )r   keysizeoutput
currentNumcurrentDigestr`   r`   ra   truncate_key  s   z:AIOKerberosClient.decrypt_asrep_cert.<locals>.truncate_keyr   rq   r  rs   zPA_PK_AS_REP not found!dhSignedData   encap_content_infocontent_typez1.3.6.1.5.2.3.2z%Keyinfo content type unexpected valuecontent 1c                 S  s   g | ]}t |qS r`   )r\  r  r`   r`   ra   r    s    z8AIOKerberosClient.decrypt_asrep_cert.<locals>.<listcomp>subjectPublicKeyrD  r0  bigFrT  serverDHNoncer   r{       rC  zBRC4 key truncation documentation missing. it is different from AESr|   r	  r   r   r   )rG   r   r   r   rL   
SignedDatarH   r   rf  
from_bytesrM   	BitStringr   rR   r   exchanger   r5   r7   rq  rU   rr  rs  rt  r4   r   r  r   )r_   as_repr  papkasrepsdkeyinfoauthdatapubkey
shared_keyserver_noncefullKeyr{   r|   r   enc_datadec_dataencasrepsession_keyr`   r`   ra   r    sF   $&



z$AIOKerberosClient.decrypt_asrep_certc                   s  	 ddl m} ddlm} t }||_d|_| jj	 |_| 
 I dH  td | |I dH \}}}	td tdD ]i}
|d	 d
 d 	 }||krP nX|}||	 krZ nNtd|  |||}| jj|dd}tj|dd}z||||j}| }||||I dH \}}}	}W q> ty } z
td|t|f d}~ww |||}|}|dur|}| jj|dd}tj|dd}||||j}|||	|fS )zCross domain TGT referralr   )KerberosClientFactory)Kirbir   Nz"Getting TGS for otherdomain krbtgtzGot referral ticket!r   r   r   ry   zUThe referral ticket is not for the target domain, getting new referral ticket from %sX   portkirbi)encodingz:Failed to get referral ticket from domain "%s"! Reason: %s)minikerberos.common.factoryr  minikerberos.common.kirbir  r   r   servicerR   r   r   r!  r   r   rA  rangefrom_ticketdatarP   get_newtargetrC   
from_kirbiproxies
get_clientget_referral_ticketr   r\  )r_   target_domain	target_ip
prev_snamer  r  crossrealm_spnr%  encpartr   r  r   r  newtnewcnew_factory	newclientr   target_addrr`   r`   ra   r    sN   

 z%AIOKerberosClient.get_referral_ticket	localhostnew_passwordr\  
targetusertargetrealmhostnamer0   c                   s  | j std |  I dH  |du r"t| jj}t| jj	|}t
j
t
jj}t|j	|d}t|j	 }	i }
| |
d< |durl|ddkrQ|d\}}ttjj|gd|
d< |durc|n| jj |
d	< nttjj| jjgd|
d< | jj |
d	< i }t|
 |d
< d|d< td| d|d< ttt jjt!|j	|	"|dt#| ddd }i }t|d< t$| j d |d< | j d |d< |j%|d< |j&dd|d< d|d< ||d< | j"| j'dt(| d}i }t|d< t j)j|d< t*t+ |d< t,| j d |d< t!| j-|d|d< t.| }t/||0 }td  | j1j2| j13 d!d"}t4|}|5|I dH }t/6|}|7|	|}|S )#z.
		Changes the password of the current user
		z6[ChangePassword] TGT is not available! Fetching TGT...Nr#  	newpasswd@r   targname	targrealmz	user-datar   r/  ry   )z	addr-typeaddressz	s-address   rz   )r   r   r   r+  r,  r   r   rt   r   subkey   r   r   r1  r*  r   z*[ChangePassword] Sending request to serveri  r  )8rW   r   r   r!  osurandomrZ   r  r4   r   r   r   r   r   r$   r5   r   findr   r   r=   r   r   rR   r   r   r   r#   r   r&   r'   r   r>   r   r   r%   r   ru   r   rV   r   r7  r   r   r   r[   r   r/   r6  rP   r  get_hostname_or_iprB   r   r  parse_reply)r_   r  r  r  r  r  
subkeydatar   subkey_structsubkey_cipherchangepwstruct
privstructprivdatar<  r?  r@  ap_req_encodedmessager  ksocketresponserJ  privresponser`   r`   ra   change_password  sl   

"


z!AIOKerberosClient.change_passwordc                   sn  | j jd}t|dkrt|d }nd}| j tjtjtj	g}|du r+t
d| j |}t|j|}t|j }td}	tj}
t|
j|	}t|
j|	d}tjtjj}i }ttg d	|d
< ||d< |durp|n| j j |d< ttjj|gd|d< tddd|d< |jdd|d< |jdd|d< |tjdd }||d< ||d< t |}|!|d|" d}i }t#|d< | j j |d< ttj$jd| j j gd|d< t%j&j|d< t'|d> |j|d|d < i }t#|d!< |d |d< |j(|d"< |jdd|d#< ttjj|gd|d< t)|}ttjj }|!|d$|" d}i }t#|d< t%j*j|d< t+t |d%< t'tjj|d&|d'< t,t#|d |d |d  d(|d)< i }t-j.j|d*< t/|" |d+< i }t-j0j|d*< t1tjjtjjtj	jtj2jtj3jg" |d+< i }t4td,g|d-< ttj$jd| j j gd|d< |d |d< |tjdd jdd|d.< t56d/|d0< tjjtjjtj	jtj2jtj3jg|d1< i }t#|d< t%j7j|d< ||g|d2< t8||d3< t.|}t9:d4 | j;<|" I dH }|j=d5krt>|d6t9:d7 |j?}tt|d  d1  }t@A|B|d8|d  d9 j?}| jCD|| t9:d: |||fS );z
		To be used with an RODC krbtgt_##### account.
		This function creates and sends a TGS request to the KDC service, posing as the krbtgt_##### account and requests the keylist of the target user.
		r  rD  ry   r   Nz.No preferred enctype found for krbtgt account!r  r#  )	forwardedri   z
enc-pa-repr4  r   r,  r   r   r  )ztr-typecontents	transitedrt   authtime	starttimed   r   endtimez
renew-tillr   r   r   r   r   rC  )kvnor{   r|   r   r+  r   r   r0  r1  rz   r   )ztkt-vnor   r   r   r*  rq   rs   r)  r}   r   r   r   r{   r   r   z*[KeylistPartial] Sending request to serverr   zKeylistPartial failed!z-[KeylistPartial] Got TGS reply, decrypting...r2  r|   z$[KeylistPartial] Got valid TGS reply)ErR   r   r   r  r   r   r<   AES256_CTS_HMAC_SHA1_96AES128_CTS_HMAC_SHA1_96ARCFOUR_HMAC_MD5
ValueErrorr   r4   r   r5   r  r  r$   r   r   r   r   r.   r   r   r   r   r=   r   r-   r   r   r"   r   r   r   r   r>   KRB_TGS_REPr   ru   r   r7  r   r   r;   r   r   KEY_LIST_REQr)   DES_CBC_CRCDES_CBC_MD5r   r   r   r8  r   r   r   rS   r   r   r3   r   r   r   r  rT   r9  )r_   r  r  partskdcnumkrbtgt_enctypekrbtgt_key_data
krbtgt_keykrbtgt_ciphersessionkey_datasessionkey_enctyper  encticket_keyr   rL  r  encticket_encpartial_tgt_datar<  r   r|   enc_authenticatorr@  r   r   tgs_body_datatgs_req_datatgs_reqrJ  r%  r;  r`   r`   ra   keylistK  s   

"

"




zAIOKerberosClient.keylist)rO   rC   rP   rD   )rk   rl   rm   rn   ro   r   )rm   rn   ro   r   )rm   rn   )r   r   rm   rn   )r"  r   )rk  rl  )NN)NNNr  )
r  r\  r  r\  r  r\  r  r\  ro   r0   rQ   )r  r\  r  r\  ) __name__
__module____qualname__rb   rc   rg   r   r   r   r   r   r!  r'  rA  r<   r  DES_CBC_MD4r  DES3_CBC_SHA1r  r  r  rO  rd  rj  r{  r  r  r  r  r  r  r`   r`   r`   ra   rN   (   s.    
5L 
$.`IrEt
:2JrN   )g
__future__r   	unicryptor   r   r   r   r  ioasynciotypingr   minikerberosr   minikerberos.common.ccacher   minikerberos.common.spnr   "minikerberos.protocol.asn1_structsr   r	   r
   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r    r!   r"   r#   r$   r%   r&   r'   r(   r)   r*   r+   r,   r-   r.   minikerberos.protocol.rfc3244r/   r0   r1   minikerberos.protocol.errorsr2   r3    minikerberos.protocol.encryptionr4   r5   r6   r7   r8   r9   r:   minikerberos.protocol.constantsr;   r<   r=   r>    minikerberos.protocol.structuresr?   minikerberos.gssapi.gssapir@   $minikerberos.network.aioclientsocketrA   rB   minikerberos.common.credsrC   minikerberos.common.targetrD   minikerberos.protocol.rfc4556rE   rF   rG   rH   rI   #minikerberos.gssapi.channelbindingsrJ   !minikerberos.protocol.ticketutilsrK   r   rL   rM   rN   r`   r`   r`   ra   <module>   s8    	$