o
    Žõ±jÀR  ã                   @   s‚   d dl mZmZ d dlZd dlZd dlZd dlmZ d dlm	Z	 d dl
mZ d dlmZ d dlmZ d dlmZ G d	d
„ d
ƒZdS )é    )ÚUniversalEncoderÚhexdumpN)Ú
DPAPI_BLOB)ÚCredentialFile)ÚMasterKeyFile)Ú
VAULT_VPOL)Ú	RegFinder)ÚPVKFilec                   @   s4   e Zd Zdd„ Zdd„ Zdd„ Zdd„ Zd	d
„ ZdS )ÚDPAPICMDHelperc                 C   s   dg| _ dg| _d S )NÚdpapi)Úlive_keywordsÚkeywords)Úself© r   ú‹/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/dpapi/cmdhelper.pyÚ__init__   s   zDPAPICMDHelper.__init__c           &      C   s¦  t jdd�}|jdd�}d|_d|_|jddd�}|jd	g d
¢ddd� |jdddd� |jddd�}|jddd� |jddd�}|jddd� |jddd� |jddd�}|jddd� |jddd�}	|	jdd d� |jd!d"d�}
|
jd!d#d� |jd$d%d�}|jd$d&d� |jd'd%d�}|jd'd(d� |jd)d*d�}|jd+d,d�}|jd-d.d�}|jd/td0d1� |jd2d3d4d5� |jd6d7d� |jddd8d� |jd9d:|gd;� t jdd�}|jd<d�}d|_d<|_|jd=d>d�}|jd?d@d� |jd=dAd� |jddBdCd� |jdDdEd�}|jd?d@d� |jdFdGd� |jddBdCd� |jdHdId�}|jd?d@d� |jdJdKd� |jddBdCd� |jdLdMd�}|jdNdOd� |jdPdQd� |jdRdSd� |jddBdCd� |jd9dTd�}| ¡ }d|_dU|_|jdVdW|gd;� |jdXdYd�}|jdZd[d� |jddBd\d� |jd]d^d�}|jd_d`d� |jdadbd�}|jdcddd� |jdVded� |jddBd\d� |jdfdgd�}|jdcddd� |jdhded� |jddBd\d� |jdidjd�}|jdkdld� |jddmd� |jddnd�}|jddod� |jdpdqdrds� |jddtd�}|jdkdld� |jddud� |jd!dvd�}|jdkdld� |jd!dwd� |jddxd�} | jdkdld� | jddyd� |jd+dzd�}!|!jdkdld� |!jd{d|d� |!jd}d~d� |!jdd€d� |!jd�d‚dƒd„� |jd)d…d�}"|"jdkdld� |"jd†d‡d� |jdˆd‰d�}#|#jdŠg d‹¢dŒd�� |#jdŽd�d� |jd�d‘d�}$|$jdkdld� |$jd’d“d� |jd”d•d�}%|%jd–d—d� |%jd˜d™d� |%jdšd›d� |%jdœd�d� d S )žNF)Úadd_helpzSLIVE DPAPI commands work under the current user context. Except: keys, wifi, chrome)ÚhelpTÚlivedpapicommandÚkeyszq[ADMIN ONLY]  Dump all local DPAPI related keys. Aggressively. Recommended: use file output. !This takes a while!z--method)ÚlsassÚregistryÚallr   zWhere to look for the keys)ÚchoicesÚdefaultr   z-oz	--outfilezOutput file base nameÚvpolz.Decrypting VPOL file with current user contextÚvpolfilezVPOL file to decryptÚvcredzDecrypt VCREDz*VPOL file to use to decrypt the VCRED fileÚ	vcredfilezVCRED file to decryptÚcredzDecrypt CRED fileÚcredfilezCRED file to decryptÚblobzDecrypt raw dpapi blob hexzblob string in hex formatÚsecurestringzDecrypt securestring hexzsecurestring in hex formatÚblobfileÚ zDecrypt raw dpapi blob in fileÚsecurestringfilezDecrypt securestring from fileÚwifiz*[ADMIN ONLY] Decrypt stored WIFI passwordsÚchromezk[ADMIN ONLY] !TAKES SUPER-LONG! Decrypt all chrome passwords for all users (admin) or for the current user.ÚtcapzQ[ADMIN ONLY] Obtains users stored DPAPI creds via SeTrustedCredmanAccessPrivilegeÚ	targetpidz&PID of the process of the target user.)Útyper   z--sourcezwinlogon.exez2A process that has SeTrustedCredmanAccessPrivilege)r   r   z
--tempfilez%PID of the process of the target userzOutput file namer   zfDPAPI (live) related commands. This will use winAPI to decrypt secrets using the current user context.)r   ÚparentsÚprekey_commandÚpasswordzGenerate prekeys from passwordÚsidzSID of the userzPassword of the userz
--out-filezbKey candidates will be stored in this file. Easier to handle this way in the masterkeyfil command.ÚntzGenerate prekeys from NT hashÚnthashzNT hash of the userÚsha1zGenerate prekeys from SHA1 hashÚsha1hashzSHA1 hash of the userr   z&Generate prekeys from registry secretsÚsystemzSYSTEM hiveÚsamzSAM hiveÚsecurityzSECURITY hivez DPAPI (offline) related commandsÚdapi_moduleÚprekeyzPrekey generationÚminidumpz.Dump masterkeys and prekeys from minidump fileÚminidumpfilezpath to minidump filezWMaster and Backup keys will be stored in this file. Easier to handle in other commands.ÚpreferredkeyzGet preferred masterkey GUIDÚpreferredkeyfilez path to preferred masterkey fileÚ	masterkeyzDecrypt masterkey fileÚmasterkeyfilezpath to masterkey filezAPath to prekey file, which has multiple decryption key candidatesÚmasterkeypvkz$Decrypt masterkey file with PVK fileÚpvkfileÚ
credentialzDecrypt credential fileÚmkfz.Keyfile generated by the masterkey -o command.zpath to credential filezDecrypt vcred filezpath to vcred filez	--vpolkeyú+zeKey obtained by decrypting the corresponding VPOL file, in hex format. Remember to try both VPOL keys)Únargsr   zDecrypt vpol filezpath to vpol filezDecrypt securestringzOpath to securestring file (hex data expected!), or the securestring in hex formzDecrypt blobz?path to blob file (hex data expected!), or the blob in hex formzDecrypt Google Chrome secretsÚ
localstatezLocal State filez--logindatazLogin Data filez	--cookieszCookies filez--jsonÚ
store_truezPrint in JSON format)Úactionr   z Decrypt Windows WIFI config fileÚwifixmlzWIFI config XML fileÚdescribez$Print information on given structureÚdatatype)r!   r<   Úpvkr   r@   zType of structure)r   r   Údatazfilepath or hex-encoded dataÚ	cloudapkdz(Decrypt KeyValue structure from CloudAPKÚkeyvaluez!KeyValue string obtained from PRTÚwinhellopinzGet winhello hashÚmkdz_Directory path for all machine masterkeys. Usually: C:\System32\Microsoft\Protect\S-1-5-18\UserÚregdirzgDirectory path for all registry hives. Usually: C:\System32\config\. SAM, SYSTEM, SECURITY hives neededÚngcdirzkDirectory path of NGC folder. Usually: C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Ngc\Ú
cryptokeysz|Directory path of cryptokeys folder. Usually: C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Crypto\Keys\)ÚargparseÚArgumentParserÚadd_subparsersÚrequiredÚdestÚ
add_parserÚadd_argumentÚint)&r   ÚparserÚlive_parserÚlive_subcommand_parserÚlive_dpapi_subparsersÚlive_keys_parserÚlive_vpol_parserÚlive_vcred_parserÚlive_cred_parserÚlive_blob_parserÚlive_securestring_parserÚlive_blobfile_parserÚlive_securestringfile_parserÚlive_wifi_parserÚlive_chrome_parserÚlive_tcap_parserÚprekey_subcommand_parserÚdpapi_prekey_subparsersÚprekey_passwdÚ	prekey_ntÚprekey_sha1Úprekey_registryÚdpapi_groupÚdpapi_subparsersÚdpapi_minidump_groupÚdpapi_preferredkey_groupÚdpapi_masterkey_groupÚdpapi_masterkeypvk_groupÚdpapi_credential_groupÚdpapi_vcred_groupÚdpapi_vpol_groupÚdpapi_securestring_groupÚdpapi_blob_groupÚdpapi_chrome_groupÚdpapi_wifi_groupÚdpapi_describe_groupÚdpapi_cloudapkd_groupÚdpapi_winhellopin_groupr   r   r   Úadd_args   sÐ   zDPAPICMDHelper.add_argsc                 C   sb   t | jƒdkr|j| jv r|  |¡ t | jƒdkr+|jdkr-|j| jv r/|  |¡ d S d S d S d S )Nr   Úlive)Úlenr   ÚcommandÚrunr   ÚmoduleÚrun_live)r   Úargsr   r   r   Úexecute¦   s
   
$ÿzDPAPICMDHelper.executec                 C   sö  ddl m} |ƒ }|jdkr�|jdkr5|jd u rtdƒ‚|jd u r*|jd u r*tdƒ‚| |j|j|j¡ n`|jdkr\|j	d u rCtdƒ‚|j
}|j
d u rSdd l}| ¡ }|j|j	|d	� n9|jd
kry|jd u sk|j	d u rotdƒ‚|j|j	|jd� n|jdkr•|jd u sˆ|j	d u rŒtdƒ‚|j|j	|jd� | |j¡ d S |jdkrÌ|jd u r«tdƒ‚| |j¡ | |j¡ |jd urÆ| |jd ¡ d S | ¡  d S |jdkrÙ| |j¡ d S |jdk�r|jd u rètdƒ‚| |j¡ | |j¡ t|jƒdk�r
t|jƒdk�r
tdƒ d S | |j¡ d S |jdk�r>| |j|j¡ t|jƒdk�r6t|jƒdk�r6tdƒ d S | |j¡ d S |jdk�rZ|  |j!¡ | "|j#¡}td| $¡  ƒ d S |jdk�rt|  |j!¡ | %|j&¡}t| '¡ ƒ d S |jdk�rš|  |j!¡ | (|j)¡\}}	td| $¡  ƒ td|	 $¡  ƒ d S |jdk�rñ|j*d u �s®t|j*ƒdk�r²tdƒ‚d d!„ |j*D ƒ|_+| ,|j-¡}
|
D ]+}t.t|
| ƒƒD ]}|
| | d u�rëtd"|j/|f ƒ tt0|
| | ƒƒ �qÍ�qÃd S |jd#k�r>|  |j!¡ zt1 2|j3¡ W n t�y$ } ztd$| ƒ | 4|j3¡}W Y d }~nd }~ww | 5|j3¡}td%| $¡  ƒ td&| 6d'¡ ƒ d S |jd(k�r‹|  |j!¡ zt1 2|j7¡ W n t�yq } ztd$| ƒ | 4|j7¡}W Y d }~nd }~ww | 5|j7¡}td%| $¡  ƒ td&| 6d'¡ ƒ d S |jd)k�r&|  |j!¡ i }i |d*< |j8|d* d+< |j9d u�r±|j9|d* d,< |j:d u�r¾|j:|d* d-< |j;|d.d/�}
|
d0 D ])\}}}}|j<�rçtt<j=t>d1|||| 6¡ d2�t?d3�ƒ �qÉtd4||||f ƒ �qÉ|
d, D ],\}}}}}|j<�rtt<j=t>d5||||| 6¡ d6�t?d3�ƒ �q÷td7|||||f ƒ �q÷d S |jd8k�rK|  |j!¡ | @|jA¡}| B|¡}td9|d: |d; f ƒ d S |jd<k�r‹tC D|jE¡}| |d= |d> |d? ¡ | F|jG¡ | H|jI|jJ¡}t|ƒdk�rtd@ƒ d S |D ]}t|ƒ �q�d S |jdAk�rùdBdC„ }z||jKƒ}W n   tdDƒ‚|jL M¡ dEk�r²tN O|¡}
n?|jL M¡ dFk�rÀtP O|¡}
n1|jL M¡ dGk�rÎtQ O|¡}
n#|jL M¡ dHk�rÜtR O|¡}
n|jL M¡ dIk�rêtS O|¡}
ntdJ|jL ƒ‚ttT|
ƒƒ d S d S )KNr   ©ÚDPAPIr7   r   z3SYSTEM hive must be specified for registry parsing!zUEither SAM or SECURITY hive must be supplied for registry parsing! Best to have both.r-   z8SID must be specified for generating prekey in this mode)r-   r/   zDNT hash and SID must be specified for generating prekey in this mode)Únt_hashr1   zFSHA1 hash and SID must be specified for generating prekey in this mode)Ú	sha1_hashr8   z5minidump file must be specified for mindiump parsing!Ú_prekeysr:   r<   z4Etieher KEY or path to prekey file must be supplied!z$Failed to decrypt the masterkeyfile!r>   rL   zClear key: %sr@   r   úVPOL key1: %súVPOL key2: %sr   zVPOL key bust be specified!c                 S   s   g | ]}t  |¡‘qS r   )ÚbytesÚfromhex)Ú.0Úxr   r   r   Ú
<listcomp>  s    z&DPAPICMDHelper.run.<locals>.<listcomp>úAttributeID: %s Key %sr"   z	Error! %súHEX: %súSTR: %sú	utf-16-ler!   r'   ÚpypykatzrD   ÚcookiesÚ	logindataF)ÚthrowÚloginsÚlogin)r*   ÚfileÚurlÚuserr-   )Úclsú"file: %s user: %s pass: %s url: %sÚcookie)r*   rŸ   ÚdomainÚnameÚpathÚvalueú1file: %s host_key: %s name: %s path: %s value: %sr&   ú%s : %sr¦   ÚkeyrN   ÚSYSTEMÚSECURITYÚSAMzNo results!rH   c                 S   sX   d }zt | dƒ�}| ¡ }W d   ƒ W |S 1 sw   Y  W |S    t | ¡}Y |S )NÚrb)ÚopenÚreadr�   r‘   )r“   rK   Úfr   r   r   Úread_file_or_hex]  s   
ÿüþz,DPAPICMDHelper.run.<locals>.read_file_or_hexzCould not load data!ÚBLOBÚ	MASTERKEYÚVPOLÚPVKÚ
CREDENTIALzUnknown data format %s)UÚpypykatz.dpapi.dpapirŠ   r6   r,   r3   Ú	Exceptionr4   r5   Úget_prekeys_form_registry_filesr.   r-   ÚgetpassÚget_prekeys_from_passwordr0   r2   Údump_pre_keysÚout_filer9   Úget_masterkeys_from_lsass_dumpÚdump_masterkeysÚdump_preferred_masterkey_guidr;   r7   Úload_prekeysÚdecrypt_masterkey_filer=   r‚   Ú
masterkeysÚ
backupkeysÚprintÚdecrypt_masterkey_file_with_pvkr?   Úload_masterkeysrA   Údecrypt_cloudap_keyrM   ÚhexÚdecrypt_credential_filer   Úto_textÚdecrypt_vpol_filer   ÚvpolkeyÚ
vault_keysÚdecrypt_vcrd_filer   ÚrangeÚidr   r�   r‘   r"   Údecrypt_securestring_fileÚdecrypt_securestring_hexÚdecoder!   rD   rš   r›   Údecrypt_all_chromeÚjsonÚdumpsÚdictr   Úparse_wifi_config_filerG   Údecrypt_wifi_config_file_innerr   Úfrom_dirrP   Údecrypt_masterkey_directoryrO   Úwinhello_pin_hash_offlinerQ   rR   rK   rI   Úupperr   Ú
from_bytesr   r   r	   r   Ústr)r   r‡   rŠ   r   Úpwr¼   ÚplainÚ	cred_blobÚkey1Úkey2ÚresÚattrÚiÚeÚdec_secÚdb_pathsÚ	file_pathr    r¡   r-   Úhost_keyr¦   r§   r¨   Úwificonfig_encÚ
wificonfigÚhivesÚresultsÚhr³   rK   r   r   r   r„   ­   s6  












  €ýÿ€þ€þ(*ü
ÿ	æzDPAPICMDHelper.runc                 C   s¸  t  ¡  ¡ dkrtdƒ‚|jdkrfddlm} ||j|j|j	ƒ\}}}|d ur-t
|ƒ d S |jd urYt|jdƒ�}|D ]}| | ¡ d ¡ q;W d   ƒ d S 1 sRw   Y  d S |D ]}t
| ¡ ƒ q[d S ddlm} |d	d
�}	|jdkr¢ddlm}
 |
|jƒ}	|jd ur˜|	 |jd ¡ |	 |jd ¡ d S |	 ¡  |	 ¡  d S |jdkrµ|	 |j¡}t
| ¡ ƒ d S |jdkrÔ|	 |j¡\}}t
d| ¡  ƒ t
d| ¡  ƒ d S |jdk�r|	 |j¡\}}|	 |j¡}|D ])}tt|| ƒƒD ]}|| | d u�rt
d|j|f ƒ t
t|| | ƒƒ qôqêd S |jdk�r5|	  |j!¡}t
d| ¡  ƒ t
d| "d¡ ƒ d S |jdk�rX|j#d }|	 $|¡}t
d| ¡  ƒ t
d| "d¡ ƒ d S |jdk�rn|	  |j%¡}t
d| ¡  ƒ d S |jdk�r„|	 $|j&¡}t
d| ¡  ƒ d S |jdk�r¾|	 '¡ }|d D ]\}}}}t
d||||f ƒ �q’|d D ]\}}}}}t
d |||||f ƒ �q¨d S |jd!k�rØ|	 (¡ D ]}t
d"|d# |d$ f ƒ �qÈd S d S )%NÚwindowsz#Live commands only work on Windows!r(   r   )Údpapi_trustedcredmanÚwz
r‰   T)Ú
use_winapir   )Úprepare_dpapi_liver�   Ú_masterkeysr   r   rŽ   r�   r   r•   r"   r–   r—   r˜   r%   r!   r#   r'   r�   r£   rš   r©   r&   rª   r¦   r«   ))Úplatformr3   Úlowerrº   r   Úpypykatz.dpapi.extrasrö   r)   ÚsourceÚtempfilerÇ   Úoutfiler°   ÚwriterÍ   r¹   rŠ   rù   Úmethodr¾   rÁ   rÌ   r    rÎ   r   rË   rÑ   r   rÒ   r‚   rÓ   r   rÕ   r"   rÖ   rK   rÔ   r!   r#   Údecrypt_all_chrome_liveÚdecrypt_wifi_live)r   r‡   rö   ÚrawdataÚcredsÚerrr²   r   rŠ   r   rù   rå   ræ   rç   rè   ré   rê   rì   rK   rî   r    r¡   r-   rï   r¦   r§   r¨   rñ   r   r   r   r†   x  sš   

ÿ
ÿúþ



ý

€ýÿ

ÿþzDPAPICMDHelper.run_liveN)Ú__name__Ú
__module__Ú__qualname__r   r€   rˆ   r„   r†   r   r   r   r   r
      s      Lr
   )Úpypykatz.commons.commonr   r   rS   rØ   rû   Úpypykatz.dpapi.structures.blobr   Ú(pypykatz.dpapi.structures.credentialfiler   Ú'pypykatz.dpapi.structures.masterkeyfiler   Úpypykatz.dpapi.structures.vaultr   Úpypykatz.dpapi.finders.registryr   Úwinacl.dtyp.wcee.pvkfiler	   r
   r   r   r   r   Ú<module>   s    