o
    Žõ±jÌ¾  ã                   @   s4  d dl Z d dlZd dlmZmZmZmZmZmZm	Z	m
Z
mZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZ d dlmZ eZeZe	ZeZ eZ!eZ"eZ#e#Z$ee$ƒZ%eZ&e#Z'ee'ƒZ(e(Z)e!Z*ee*ƒZ+eZ eZ,ee,ƒZ-e
Z.ee.ƒZ/eeƒZ0eZ1eZ2e,Z3ee3ƒZ4e1Z5e2Z6e5Z7d Z8dZ9G dd„ dƒZ:G dd„ de j;ƒZ<G d	d
„ d
e j;ƒZ=G dd„ de j>ƒZ?G dd„ de j>ƒZ@G dd„ de j;ƒZAG dd„ de j;ƒZBG dd„ deƒZCeeCƒZDeCZEeDZFG dd„ deƒZGG dd„ deƒZHG dd„ deƒZIG dd„ deƒZJeeJƒZKeeHƒZLeHZMeLZNeHZOeLZPG dd„ deƒZQeeQƒZRG dd „ d eƒZSeeSƒZTG d!d"„ d"eƒZUeeUƒZVG d#d$„ d$eƒZWeeWƒZXG d%d&„ d&eƒZYeeYƒZZG d'd(„ d(eƒZ[G d)d*„ d*eƒZ\ee\ƒZ]G d+d,„ d,eƒZ^ee^ƒZ_G d-d.„ d.eƒZ`ee`ƒZaG d/d0„ d0eƒZbebZcG d1d2„ d2eƒZdG d3d4„ d4eƒZeG d5d6„ d6eƒZfG d7d8„ d8eƒZgeegƒ ƒZhdrd9d:„ZiG d;d<„ d<eƒZjdsd>d?„ZkG d@dA„ dAeƒZlzedBƒjmZnW n eo�yà   eeƒdCk�rÓdDZnneeƒd=k�rÝdEZnn‚ Y nw dFdG„ ZpdtdIdJ„ZqdtdKdL„ZrdMdN„ ZsdOdP„ ZtdQdR„ ZudSdT„ ZvdUdV„ ZwdWdX„ ZxdYdZ„ Zyd[d\„ Zzd]d^„ Z{dud_d`„Z|dadb„ Z}de@j~e@jB e@j€B e@j�B d dfdcdd„Z‚dvdfdg„Zƒdhdi„ Z„e…djk�r˜d dkl†m‡Z‡ d dllˆm‰Z‰ e‰ƒ ZŠd dl‹Z‹eŠ Œ¡  ewdmƒZ�eŠ Ž¡  exe�dnƒZ�e�dodpƒ�Z‘e‘ ’¡ Z“W d  ƒ n	1 �svw   Y  d Z”eie“e”dq�Z•eye�e�e•ƒ\Z–Z—Z˜e™epe—ƒƒ e™e–ƒ dS dS )wé    N)ÚpointerÚc_byteÚc_wcharÚc_char_pÚ	addressofÚc_ubyteÚc_int16Ú
c_longlongÚcastÚbyrefÚ	StructureÚc_charÚc_bufferÚ	string_atÚwindllÚc_void_pÚc_uint32ÚPOINTERÚ	c_wchar_pÚWinErrorÚsizeofÚc_int32Úc_uint16Úcreate_string_buffer)Úhexdumpi@  c                   @   s(   e Zd Zdd„ Zdd„ Zedd„ ƒZdS )ÚSIDc                 C   s   d | _ d | _d | _g | _d S ©N)ÚRevisionÚSubAuthorityCountÚIdentifierAuthorityÚSubAuthority©Úself© r#   ú›/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/kerberos/functiondefs/netsecapi.pyÚ__init__*   s   
zSID.__init__c                 C   sd   d}| j dk r|t| j ƒ7 }n|d| j  dd¡ ¡  ¡  dd¡ 7 }| jD ]
}|dt|ƒ 7 }q%|S )	NzS-1-l        Ú0xé   Úbigé   Ú0ú-)r   ÚstrÚto_bytesÚhexÚupperÚrjustr    )r"   ÚtÚir#   r#   r$   Ú__str__0   s   
&
zSID.__str__c                 C   s¾   | d krd S t | dƒ}t |¡}tƒ }tj| d¡ddd�|_tj| d¡ddd�|_tj| d¡ddd�|_	t | d |jd ƒ}t |¡}t
|jƒD ]}|j tj| d¡ddd�¡ qK|S )	Né   é   ÚlittleF)Úsignedr'   r(   é   )r   ÚioÚBytesIOr   ÚintÚ
from_bytesÚreadr   r   r   Úranger    Úappend)ÚptrÚdataÚbuffÚsidÚ_r#   r#   r$   Úfrom_ptr:   s   


 zSID.from_ptrN)Ú__name__Ú
__module__Ú__qualname__r%   r3   ÚstaticmethodrE   r#   r#   r#   r$   r   )   s
    
r   c                   @   sŒ   e Zd ZdZdZdZdZdZdZdZ	dZ
d	Zd
ZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZ dZ!d Z"d!S )"ÚKERB_PROTOCOL_MESSAGE_TYPEr   r5   é   é   r8   é   r'   é   r4   é	   é
   é   r)   é   é   é   é   é   é   é   é   é   é   é   é   é   é   é   é   é   é   é   N)#rF   rG   rH   ÚKerbDebugRequestMessageÚKerbQueryTicketCacheMessageÚ KerbChangeMachinePasswordMessageÚKerbVerifyPacMessageÚKerbRetrieveTicketMessageÚKerbUpdateAddressesMessageÚKerbPurgeTicketCacheMessageÚKerbChangePasswordMessageÚ KerbRetrieveEncodedTicketMessageÚKerbDecryptDataMessageÚKerbAddBindingCacheEntryMessageÚKerbSetPasswordMessageÚKerbSetPasswordExMessageÚKerbVerifyCredentialsMessageÚKerbQueryTicketCacheExMessageÚKerbPurgeTicketCacheExMessageÚ&KerbRefreshSmartcardCredentialsMessageÚKerbAddExtraCredentialsMessageÚ'KerbQuerySupplementalCredentialsMessageÚKerbTransferCredentialsMessageÚKerbQueryTicketCacheEx2MessageÚKerbSubmitTicketMessageÚ KerbAddExtraCredentialsExMessageÚKerbQueryKdcProxyCacheMessageÚKerbPurgeKdcProxyCacheMessageÚKerbQueryTicketCacheEx3MessageÚ$KerbCleanupMachinePkinitCredsMessageÚ!KerbAddBindingCacheEntryExMessageÚKerbQueryBindingCacheMessageÚKerbPurgeBindingCacheMessageÚ&KerbQueryDomainExtendedPoliciesMessageÚKerbQueryS4U2ProxyCacheMessager#   r#   r#   r$   rJ   K   sB    rJ   c                   @   s8  e Zd ZdZdZdZdZdZdZdZ	dZ
d	Zd
ZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZ dZ!d Z"d!Z#d"Z$d#Z%d$Z&d%Z'd&Z(d'Z)d(Z*d)Z+d*Z,d+Z-d,Z.d-Z/d.Z0d/Z1d0Z2d1Z3d2Z4d3Z5d4Z6d5Z7d6Z8d7Z9d8Z:d9Z;d:Z<d;Z=d<Z>d=Z?d>Z@d?ZAd@ZBdAZCdBZDdCZEdDZFdEZGdFZHdGZIdHZJdIZKdJZLdKZMdLS )MÚSEC_Er   i	 l      l     l     l     l     l     l     l     l     l   	  l   
  l     l     l     l     l     l     l     l     l     l     l      l   !  l   "  l   $  l   %  l   &  l   '  l   (  l   )  l   0  l   1  l   2  l   3  l   4  l   5  l   6  l   7  l   8  l   9  l   :  l   ;  l   <  l   =  l   >  l   ?  l   @  l   A  l   B  l   C  l   E  l   F  l   G  l   H  l   I  l   P  l   Q  l   R  l   S  l   T  l   U  l   V  l   W  l   X  l   Y  l   Z  l   [  l   ]  l   ^  l   _  i!	 i	 i	 N)NrF   rG   rH   ÚOKÚCONTINUE_NEEDEDÚINSUFFICIENT_MEMORYÚINVALID_HANDLEÚUNSUPPORTED_FUNCTIONÚTARGET_UNKNOWNÚINTERNAL_ERRORÚSECPKG_NOT_FOUNDÚ	NOT_OWNERÚCANNOT_INSTALLÚINVALID_TOKENÚCANNOT_PACKÚQOP_NOT_SUPPORTEDÚNO_IMPERSONATIONÚLOGON_DENIEDÚUNKNOWN_CREDENTIALSÚNO_CREDENTIALSÚMESSAGE_ALTEREDÚOUT_OF_SEQUENCEÚNO_AUTHENTICATING_AUTHORITYÚ	BAD_PKGIDÚCONTEXT_EXPIREDÚINCOMPLETE_MESSAGEÚINCOMPLETE_CREDENTIALSÚBUFFER_TOO_SMALLÚWRONG_PRINCIPALÚ	TIME_SKEWÚUNTRUSTED_ROOTÚILLEGAL_MESSAGEÚCERT_UNKNOWNÚCERT_EXPIREDÚENCRYPT_FAILUREÚDECRYPT_FAILUREÚALGORITHM_MISMATCHÚSECURITY_QOS_FAILEDÚUNFINISHED_CONTEXT_DELETEDÚNO_TGT_REPLYÚNO_IP_ADDRESSESÚWRONG_CREDENTIAL_HANDLEÚCRYPTO_SYSTEM_INVALIDÚMAX_REFERRALS_EXCEEDEDÚMUST_BE_KDCÚSTRONG_CRYPTO_NOT_SUPPORTEDÚTOO_MANY_PRINCIPALSÚ
NO_PA_DATAÚPKINIT_NAME_MISMATCHÚSMARTCARD_LOGON_REQUIREDÚSHUTDOWN_IN_PROGRESSÚKDC_INVALID_REQUESTÚKDC_UNABLE_TO_REFERÚKDC_UNKNOWN_ETYPEÚUNSUPPORTED_PREAUTHÚDELEGATION_REQUIREDÚBAD_BINDINGSÚMULTIPLE_ACCOUNTSÚNO_KERB_KEYÚCERT_WRONG_USAGEÚDOWNGRADE_DETECTEDÚSMARTCARD_CERT_REVOKEDÚISSUING_CA_UNTRUSTEDÚREVOCATION_OFFLINE_CÚPKINIT_CLIENT_FAILUREÚSMARTCARD_CERT_EXPIREDÚNO_S4U_PROT_SUPPORTÚCROSSREALM_DELEGATION_FAILUREÚREVOCATION_OFFLINE_KDCÚISSUING_CA_UNTRUSTED_KDCÚKDC_CERT_EXPIREDÚKDC_CERT_REVOKEDÚINVALID_PARAMETERÚDELEGATION_POLICYÚPOLICY_NLTM_ONLYÚRENEGOTIATEÚCOMPLETE_AND_CONTINUEÚCOMPLETE_NEEDEDr#   r#   r#   r$   r…   n   s˜    r…   c                   @   s    e Zd ZdZdZdZdZdZdS )ÚSECPKG_CREDrU   rL   r5   rK   é    N)rF   rG   rH   ÚAUTOLOGON_RESTRICTEDÚBOTHÚINBOUNDÚOUTBOUNDÚPROCESS_POLICY_ONLYr#   r#   r#   r$   rÑ   ¼   s    rÑ   c                   @   sh   e Zd ZdZdZdZdZdZdZdZ	dZ
d	Zd
ZdZdZdZdZdZdZdZdZdZdZdZdZdZdS )ÚISC_REQr5   rK   r8   r4   rU   rÒ   é@   é€   é   i   i   i   i   i    i @  i €  i   i   i   i   i   i    i   N)rF   rG   rH   ÚDELEGATEÚMUTUAL_AUTHÚREPLAY_DETECTÚSEQUENCE_DETECTÚCONFIDENTIALITYÚUSE_SESSION_KEYÚPROMPT_FOR_CREDSÚUSE_SUPPLIED_CREDSÚALLOCATE_MEMORYÚUSE_DCE_STYLEÚDATAGRAMÚ
CONNECTIONÚ
CALL_LEVELÚFRAGMENT_SUPPLIEDÚEXTENDED_ERRORÚSTREAMÚ	INTEGRITYÚIDENTIFYÚNULL_SESSIONÚMANUAL_CRED_VALIDATIONÚ	RESERVED1ÚFRAGMENT_TO_FITÚHTTPr#   r#   r#   r$   rØ   É   s0    rØ   c                   @   s<   e Zd ZdZdZdZdZdZdZdZ	dZ
d	Zd
ZdZdZdS )ÚSECPKG_ATTRrO   l       l   ‚    l   „    l   €    l   †    l   �    rP   l   ƒ    r   é|   r_   N)rF   rG   rH   ÚSESSION_KEYÚC_ACCESS_TOKENÚC_FULL_ACCESS_TOKENÚCERT_TRUST_STATUSÚCREDSÚCREDS_2ÚNEGOTIATION_PACKAGEÚPACKAGE_INFOÚSERVER_AUTH_FLAGSÚSIZESÚSUBJECT_SECURITY_ATTRIBUTESÚENDPOINT_BINDINGSr#   r#   r#   r$   ró   â   s    ró   c                   @   sl   e Zd ZdZdZdZdZdZdZdZ	dZ
d	Zd
ZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdS )ÚSECBUFFER_TYPErV   l      ` rS   rT   r5   r]   r   rM   rQ   r)   r8   rL   r[   r\   rY   rX   rN   r'   rR   rU   rK   rZ   rW   rO   N)rF   rG   rH   ÚSECBUFFER_ALERTÚSECBUFFER_ATTRMASKÚSECBUFFER_CHANNEL_BINDINGSÚSECBUFFER_CHANGE_PASS_RESPONSEÚSECBUFFER_DATAÚSECBUFFER_DTLS_MTUÚSECBUFFER_EMPTYÚSECBUFFER_EXTRAÚSECBUFFER_MECHLISTÚSECBUFFER_MECHLIST_SIGNATUREÚSECBUFFER_MISSINGÚSECBUFFER_PKG_PARAMSÚSECBUFFER_PRESHARED_KEYÚ SECBUFFER_PRESHARED_KEY_IDENTITYÚ$SECBUFFER_SRTP_MASTER_KEY_IDENTIFIERÚ"SECBUFFER_SRTP_PROTECTION_PROFILESÚSECBUFFER_STREAM_HEADERÚSECBUFFER_STREAM_TRAILERÚSECBUFFER_TARGETÚSECBUFFER_TARGET_HOSTÚSECBUFFER_TOKENÚSECBUFFER_TOKEN_BINDINGÚSECBUFFER_APPLICATION_PROTOCOLSÚSECBUFFER_PADDINGr#   r#   r#   r$   r  ñ   s2    r  c                   @   s   e Zd ZdefdefgZdS )ÚFILETIMEÚdwLowDateTimeÚdwHighDateTimeN)rF   rG   rH   ÚDWORDÚ_fields_r#   r#   r#   r$   r    ó    þr  c                   @   s(   e Zd ZdefdefgZedd„ ƒZdS )ÚSecPkgContext_SessionKeyÚSessionKeyLengthÚ
SessionKeyc                 C   s   t | j| jd�S ©N)Úsize)r   r"  r!  r!   r#   r#   r$   ÚBuffer  ó   zSecPkgContext_SessionKey.BufferN)rF   rG   rH   ÚULONGÚLPBYTEr  Úpropertyr%  r#   r#   r#   r$   r     s    r   c                       s4   e Zd ZdeeƒfdeeƒfgZ‡ fdd„Z‡  ZS )Ú	SecHandleÚdwLowerÚdwUpperc                    s"   t t| ƒ ttƒ ƒttƒ ƒ¡ d S r   )Úsuperr*  r%   r   r'  r!   ©Ú	__class__r#   r$   r%   %  s   "zSecHandle.__init__)rF   rG   rH   r   r'  r  r%   Ú__classcell__r#   r#   r.  r$   r*    s
    

þr*  c                   @   sF   e Zd ZdZdefdefdefgZde ej	fdd„Z
edd	„ ƒZd
S )Ú	SecBufferzñStores a memory buffer: size, type-flag, and POINTER. 
	The type can be empty (0) or token (2).
	InitializeSecurityContext will write to the buffer that is flagged "token"
	and update the size, or else fail 0x80090321=SEC_E_BUFFER_TOO_SMALL.ÚcbBufferÚ
BufferTypeÚpvBufferó    c                 C   s4   t |t|ƒd�}t | t|ƒ|jtt|ƒtƒ¡ d S r#  )	r   Úlenr   r%   r   Úvaluer
   r   ÚPVOID)r"   ÚtokenÚbuffer_typeÚbufr#   r#   r$   r%   2  s   $zSecBuffer.__init__c                 C   s   t | jƒt| j| jd�fS r#  )r  r3  r   r4  r2  r!   r#   r#   r$   r%  6  s   zSecBuffer.BufferN)rF   rG   rH   Ú__doc__r'  r8  r  Úmaxtoken_sizer  r  r%   r)  r%  r#   r#   r#   r$   r1  (  s    ýr1  c                   @   sH   e Zd ZdZdefdefdeeƒfgZddd„Zdd	„ Z	e
d
d„ ƒZdS )ÚSecBufferDesczsDescriptor stores SECBUFFER_VERSION=0, number of buffers (e.g. one),
	and POINTER to an array of SecBuffer structs.Ú	ulVersionÚcBuffersÚpBuffersNc                 C   sF   |d urt  | dt|ƒtt|ƒ |Ž ¡ d S t  | ddttƒ ƒ¡ d S )Nr   r5   )r   r%   r6  r1  r   )r"   Ú
secbuffersr#   r#   r$   r%   >  s   $zSecBufferDesc.__init__c                 C   s
   | j | S r   )rA  )r"   Úindexr#   r#   r$   Ú__getitem__D  ó   
zSecBufferDesc.__getitem__c                 C   s*   g }t | jƒD ]}| | j| j¡ q|S r   )r>   r@  r?   rA  r%  )r"   rA   r2   r#   r#   r$   ÚBuffersG  s   zSecBufferDesc.Buffersr   )rF   rG   rH   r<  r'  r   r1  r  r%   rD  r)  rF  r#   r#   r#   r$   r>  :  s    
r>  c                   @   s<   e Zd ZdefdefgZdd„ Zedd„ ƒZedd„ ƒZ	d	S )
ÚLUIDÚLowPartÚHighPartc                 C   s
   t  | ¡S r   )rG  Úluid_to_intr!   r#   r#   r$   Úto_int\  rE  zLUID.to_intc                 C   s   | j d> | j S )NrÒ   )rI  rH  )Úluidr#   r#   r$   rJ  _  r&  zLUID.luid_to_intc                 C   s   t ƒ }| d? |_| d@ |_|S )NrÒ   ì   ÿÿ )rG  rI  rH  )r2   rL  r#   r#   r$   Úfrom_intc  s   

zLUID.from_intN)
rF   rG   rH   r  ÚLONGr  rK  rI   rJ  rN  r#   r#   r#   r$   rG  V  s    þ
rG  c                   @   s.   e Zd ZdefdefdeeƒfgZdd„ ZdS )Ú
LSA_STRINGÚLengthÚMaximumLengthr%  c                 C   s   t | j| jƒ ¡ S r   )r   r%  rR  Údecoder!   r#   r#   r$   Ú	to_stringr  s   zLSA_STRING.to_stringN)rF   rG   rH   ÚUSHORTr   r   r  rT  r#   r#   r#   r$   rP  l  s    
ýrP  c                   @   s:   e Zd ZdefdefdeeƒfgZedd„ ƒZdd„ Z	dS )	ÚLSA_UNICODE_STRINGrQ  rR  r%  c                 C   s<   |   d¡} tƒ }t| t| ƒƒ|_t| ƒd |_t| ƒ|_|S )Nú	utf-16-ler5   )ÚencoderV  r   r6  r%  rR  rQ  )ÚsÚlusr#   r#   r$   Úfrom_string~  s   

zLSA_UNICODE_STRING.from_stringc                 C   s   t | j| jƒ d¡ dd¡S )NrW  ú Ú )r   r%  rR  rS  Úreplacer!   r#   r#   r$   rT  ‡  s   zLSA_UNICODE_STRING.to_stringN)
rF   rG   rH   rU  r   r   r  rI   r[  rT  r#   r#   r#   r$   rV  w  s    
ý
rV  c                   @   s*   e Zd ZdefdefdefgZdd„ ZdS )ÚLSA_LAST_INTER_LOGON_INFOÚLastSuccessfulLogonÚLastFailedLogonÚ*FailedAttemptCountSinceLastSuccessfulLogonc                 C   s   | j | j| jdœS )N©r`  ra  rb  rc  r!   r#   r#   r$   Úto_dict’  s   ýz!LSA_LAST_INTER_LOGON_INFO.to_dictN)rF   rG   rH   ÚLARGE_INTEGERr'  r  rd  r#   r#   r#   r$   r_  Œ  s    ýr_  c                   @   s¢   e Zd Zdefdefdefdefdefdefdefdefd	efd
efdefdefdefdefdefdefdefdefdefdefdefdefdefgZ	dd„ Z
dS )ÚSECURITY_LOGON_SESSION_DATAÚSizeÚLogonIdÚUserNameÚLogonDomainÚAuthenticationPackageÚ	LogonTypeÚSessionÚSidÚ	LogonTimeÚLogonServerÚDnsDomainNameÚUpnÚ	UserFlagsÚLastLogonInfoÚLogonScriptÚProfilePathÚHomeDirectoryÚHomeDirectoryDriveÚ
LogoffTimeÚKickOffTimeÚPasswordLastSetÚPasswordCanChangeÚPasswordMustChangec                 C   sà   i d| j  ¡ “d| j ¡ “d| j ¡ “d| j ¡ “d| j“d| j“dtt	 
| j¡ƒ“d| j“d	| j ¡ “d
| j ¡ “d| j ¡ “d| j“d| j ¡ “d| j ¡ “d| j ¡ “d| j ¡ “d| j ¡ “| j| j| j| j| jdœ¥S )Nrh  ri  rj  rk  rl  rm  rn  ro  rp  rq  rr  rs  rt  ru  rv  rw  rx  )ry  rz  r{  r|  r}  )rh  rK  ri  rT  rj  rk  rl  rm  r,   r   rE   rn  ro  rp  rq  rr  rs  rt  rd  ru  rv  rw  rx  ry  rz  r{  r|  r}  r!   r#   r#   r$   rd  µ  sR   
ÿ
þ
ý
üûúùø
	÷

ö
õô
ó
ò
ñ
ð
ïêz#SECURITY_LOGON_SESSION_DATA.to_dictN)rF   rG   rH   r'  rG  rV  r8  re  r_  r  rd  r#   r#   r#   r$   rf  š  s4    érf  c                       s:   e Zd ZdefdefdefdefgZd	‡ fdd„	Z‡  ZS )
ÚKERB_PURGE_TKT_CACHE_REQUESTÚMessageTyperh  Ú
ServerNameÚ	RealmNamer   Nc                    ó.   t |tƒr
t |¡}tt| ƒ tjj	|¡ d S r   )
Ú
isinstancer;   rG  rN  r-  r~  r%   rJ   rk   r7  )r"   ÚlogonidÚ
servernameÚrealnamer.  r#   r$   r%   Ú  ó   

z%KERB_PURGE_TKT_CACHE_REQUEST.__init__)r   NN)	rF   rG   rH   r  rG  rP  r  r%   r0  r#   r#   r.  r$   r~  Ò  s    ür~  c                   @   sB   e Zd ZdefdefdefdefdefdefdefgZdd	„ Zd
S )ÚKERB_TICKET_CACHE_INFOr€  r�  Ú	StartTimeÚEndTimeÚ	RenewTimeÚEncryptionTypeÚTicketFlagsc                 C   s*   | j  ¡ | j ¡ | j| j| j| j| jdœS )N)r€  r�  r‰  rŠ  r‹  rŒ  r�  )r€  rT  r�  r‰  rŠ  r‹  rŒ  r�  r!   r#   r#   r$   rd  ë  s   ùzKERB_TICKET_CACHE_INFO.to_dictN)	rF   rG   rH   rV  re  rO  r'  r  rd  r#   r#   r#   r$   rˆ  à  s    ù
rˆ  c                   @   s*   e Zd ZdefdefdefgZdd„ ZdS )ÚKERB_CRYPTO_KEYÚKeyTyperQ  ÚValuec                 C   s   | j t| j| jƒdœS )N)r�  ÚKey)r�  r   r�  rQ  r!   r#   r#   r$   rd  þ  s   þzKERB_CRYPTO_KEY.to_dictN)rF   rG   rH   rO  r'  r8  r  rd  r#   r#   r#   r$   rŽ  ÷  s    ýrŽ  c                   @   ó"   e Zd ZdefdefdefgZdS )ÚKERB_EXTERNAL_NAMEÚNameTypeÚ	NameCountÚNamesN)rF   rG   rH   ÚSHORTrU  rV  r  r#   r#   r#   r$   r“    ó
    ýr“  c                   @   sx   e Zd Zdefdefdefdefdefdefdefdefd	efd
efdefdefdefdefdefdefgZdd„ Z	dS )ÚKERB_EXTERNAL_TICKETÚServiceNameÚ
TargetNameÚ
ClientNameÚ
DomainNameÚTargetDomainNameÚAltTargetDomainNamer"  r�  ÚFlagsÚKeyExpirationTimer‰  rŠ  Ú
RenewUntilÚTimeSkewÚEncodedTicketSizeÚEncodedTicketc                 C   s   | j  ¡ t| j| jƒdœS )N)r‘  ÚTicket)r"  rd  r   r¥  r¤  r!   r#   r#   r$   Úget_data"  s   þzKERB_EXTERNAL_TICKET.get_dataN)
rF   rG   rH   r8  rV  rŽ  r'  re  r  r§  r#   r#   r#   r$   r™    s&    ðr™  c                       s.   e Zd ZdefdefgZd‡ fdd„	Z‡  ZS )ÚKERB_QUERY_TKT_CACHE_REQUESTr  rh  r   c                    r‚  r   )
rƒ  r;   rG  rN  r-  r¨  r%   rJ   rf   r7  )r"   r„  r.  r#   r$   r%   0  r‡  z%KERB_QUERY_TKT_CACHE_REQUEST.__init__©r   )rF   rG   rH   r  rG  r  r%   r0  r#   r#   r.  r$   r¨  *  s
    þr¨  c                   @   s   e Zd ZdefdefgZdS )Ú"KERB_QUERY_TKT_CACHE_RESPONSE_SIZEr  ÚCountOfTicketsN)rF   rG   rH   r  r'  r  r#   r#   r#   r$   rª  6  r  rª  c                   @   r’  )ÚKERB_QUERY_TKT_CACHE_RESPONSEr  r«  ÚTicketsN)rF   rG   rH   r  r'  rˆ  r  r#   r#   r#   r$   r¬  ;  r˜  r¬  c                   @   s4   e Zd ZdefdefdefdefdefdefgZdS )ÚKERB_SUBMIT_TKT_REQUESTr  rh  r�  r‘  ÚKerbCredSizeÚKerbCredOffsetN)rF   rG   rH   r  rG  r'  rŽ  r  r#   r#   r#   r$   r®  B  s    úr®  c                    sz   t d }t|tƒrt |¡}G ‡ fdd„dtƒ}|ƒ }tjj|_	||_
d|_tƒ |_tˆ ƒ|_ttˆ ƒ ˆ Ž |_||_|S )Nr8   c                       sL   e Zd ZdZdefdefdefdefdefdefdefd	ee	” ƒ fgZ
d
S )z2submit_tkt_helper.<locals>.KERB_SUBMIT_TKT_REQUESTr8   r  rh  r�  rQ  r�  r¯  r°  Ú
TicketDataN)rF   rG   rH   Ú_pack_r  rG  r'  r8  r   r6  r  r#   ©Úticket_datar#   r$   r®  S  s    ÷r®  r   )ÚKERB_SUBMIT_TKT_REQUEST_OFFSETrƒ  r;   rG  rN  r   rJ   rz   r7  r  rh  r�  rŽ  r‘  r6  r¯  r   r±  r°  )r´  r„  Úoffsetr®  Úreqr#   r³  r$   Úsubmit_tkt_helperN  s   




r¸  c                       sL   e Zd ZdefdefdefdefdefdefdefgZ	d‡ fd
d„	Z
‡  ZS )ÚKERB_RETRIEVE_TKT_REQUESTr  rh  r›  r�  ÚCacheOptionsrŒ  ÚCredentialsHandler   r4   c              	      s>   t |tƒr
t |¡}tt| ƒ tjj	|t
 |¡|||d ¡ d S r   )rƒ  r;   rG  rN  r-  r¹  r%   rJ   rm   r7  rV  r[  )r"   Ú
targetnameÚticketflagsÚcacheoptionsÚencryptiontyper„  r.  r#   r$   r%   ‡  s   


ùz"KERB_RETRIEVE_TKT_REQUEST.__init__)r   r4   r   r   )rF   rG   rH   r  rG  rV  r'  rO  r8  r  r%   r0  r#   r#   r.  r$   r¹  |  s    ù
r¹  r4   c                    sÖ   t |tƒr
t |¡}|  d¡d }t|ƒ‰ G ‡ fdd„dtƒ}|ƒ }tjj	|_
||_||_||_||_tt|ƒ |Ž |_t|ƒt|ƒ }	|	ˆ  }
|
|
ttƒ  }tƒ }t|  d¡ƒ|_ˆ |_t|ttƒƒ|_||_|S )NrW  s     c                       sJ   e Zd Zdefdefdefdefdefdefdefdefd	e	”  fg	Z
d
S )z6retrieve_tkt_helper.<locals>.KERB_RETRIEVE_TKT_REQUESTr  rh  r›  r�  rº  rŒ  r»  ÚUNKÚTargetNameDataN)rF   rG   rH   r  rG  rV  r'  rO  r8  r   r  r#   ©Útargetname_len_allocr#   r$   r¹  £  s    
÷r¹  )rƒ  r;   rG  rN  rX  r6  r   rJ   rm   r7  r  rh  r�  rº  rŒ  r   rÁ  r   r   r   rV  rQ  rR  r
   r   r   r%  r›  )r¼  r„  r½  r¾  r¿  Útemp_offsetÚtargetname_encr¹  r·  Ú
struct_endÚtargetname_startÚtargetname_start_paddedÚ
lsa_targetr#   rÂ  r$   Úretrieve_tkt_helper•  s*   
	

rÊ  c                   @   s   e Zd ZdefgZdS )ÚKERB_RETRIEVE_TKT_RESPONSEr¦  N)rF   rG   rH   r™  r  r#   r#   r#   r$   rË  Î  s    ÿrË  éÿÿÿÿr8   rM  l   ÿÿÿÿ c                 C   s   t t| ƒƒS r   )r   ÚLsaNtStatusToWinError)Ú
ret_statusr#   r#   r$   Úget_lsa_errorÞ  s   rÏ  r#   c                 C   s   | st ƒ ‚| S )z«
	Error checking for most Win32 API calls.

	The function is assumed to return an integer, which is C{0} on error.
	In that case the C{WindowsError} exception is raised.
	)r   ©ÚresultÚfuncÚ	argumentsr#   r#   r$   ÚRaiseIfZeroá  s   rÔ  c                 C   s   | t kr
tt| ƒƒ‚| S )z¹
	Error checking for Win32 Registry API calls.

	The function is assumed to return a Win32 error code. If the code is not
	C{ERROR_SUCCESS} then a C{WindowsError} exception is raised.
	)ÚERROR_SUCCESSr   rÍ  rÐ  r#   r#   r$   ÚLsaRaiseIfNotErrorSuccessì  s   rÖ  c                 C   s6   t jj}tg|_t|_|| ƒ}|dkrtd|  ƒ‚|S )Ni=  zERROR_MR_MID_NOT_FOUND for %s)r   ÚAdvapi32rÍ  ÚNTSTATUSÚargtypesr'  ÚrestypeÚ	Exception)ÚerrcodeÚ_LsaConnectUntrustedÚresr#   r#   r$   rÍ  ø  s   rÍ  c                 C   ó(   t jj}tg|_t|_t|_|| ƒ d S r   )	r   ÚSecur32ÚLsaFreeReturnBufferr8  rÙ  rØ  rÚ  rÖ  Úerrcheck)ÚpbufferÚ_LsaFreeReturnBufferr#   r#   r$   rá    s
   rá  c                  C   s4   t jj} tg| _t| _t| _t	t
ƒ}| t|ƒƒ |S r   )r   rà  ÚLsaConnectUntrustedÚPHANDLErÙ  rØ  rÚ  rÖ  râ  ÚHANDLEÚINVALID_HANDLE_VALUEr   )rÝ  Ú
lsa_handler#   r#   r$   rå    s   rå  c                 C   rß  r   )	r   rà  ÚLsaDeregisterLogonProcessrç  rÙ  rØ  rÚ  rÖ  râ  )ré  Ú_LsaDeregisterLogonProcessr#   r#   r$   rê    s   rê  c                 C   s†   t jj}tttg|_t|_t	|_
t| tƒr|  ¡ } tƒ }t| ƒ|_t| ƒ|_t| ƒd |_ttƒ}tdƒ}|t|ƒt|ƒt|ƒƒ |S ©Nr5   r   )r   rà  ÚLsaRegisterLogonProcessÚPLSA_STRINGræ  ÚPLSA_OPERATIONAL_MODErÙ  rØ  rÚ  rÖ  râ  rƒ  r,   rX  rP  r   r%  r6  rQ  rR  rç  rè  ÚLSA_OPERATIONAL_MODEr   )Úlogon_process_nameÚ_LsaRegisterLogonProcessÚpnameré  Údummyr#   r#   r$   rí  #  s   


rí  c                 C   s|   t jj}tttg|_t|_t	|_
t|tƒr| ¡ }tƒ }t|ƒ|_t|ƒ|_t|ƒd |_tdƒ}|| t|ƒt|ƒƒ |jS rì  )r   rà  ÚLsaLookupAuthenticationPackagerç  rî  ÚPULONGrÙ  rØ  rÚ  rÖ  râ  rƒ  r,   rX  rP  r   r%  r6  rQ  rR  r'  r   r7  )ré  Úpackage_nameÚ_LsaLookupAuthenticationPackageró  Ú
package_idr#   r#   r$   rõ  :  s   


rõ  c           
   	   C   s¸   t jj}tttttttg|_t	|_
t|_t|tƒs"t|ƒ}t|ƒ}ntt|ƒƒ}tƒ }tdƒ}ttƒ}|| |t|ƒ|t|ƒt|ƒt|ƒƒ d}d }	|jdkrVt||jƒ}|}	||j|	fS )Nr   ó    )r   rà  ÚLsaCallAuthenticationPackagerç  r'  r8  rö  Ú	PNTSTATUSrÙ  r  rÚ  rÖ  râ  rƒ  r   Úbytesr6  r   rØ  rè  r   r7  r   )
ré  rù  ÚmessageÚ_LsaCallAuthenticationPackageÚmessage_lenÚreturn_msg_pÚreturn_msg_lenÚreturn_statusÚ
return_msgÚfree_ptrr#   r#   r$   rû  O  s$   

$
rû  c                     s�   t jj} ttg| _t| _t| _	t
dƒ‰ tƒ }| tˆ ƒt|ƒƒ G ‡ fdd„dtƒ}t|ƒ}g }t||ƒ}|jjD ]	}| | ¡ ¡ q8t|ƒ |S )Nr   c                       s   e Zd Zde” j fgZdS )z+LsaEnumerateLogonSessions.<locals>.LUIDListÚLogonIdsN)rF   rG   rH   rG  r7  r  r#   ©ÚLogonSessionCountr#   r$   ÚLUIDListw  s    ÿr	  )r   rà  ÚLsaEnumerateLogonSessionsrö  r8  rÙ  rØ  rÚ  rÖ  râ  r'  r   r   r   r   r
   Úcontentsr  r?   rK  rá  )Ú_LsaEnumerateLogonSessionsÚ
start_luidr	  Ú	PLUIDListÚ	res_luidsÚpluidsrL  r#   r  r$   r
  l  s   

r
  c                 C   sj   t jj}ttg|_t|_t|_	t
| tƒrt | ¡} tƒ }|t| ƒt|ƒƒ t|tƒ}|j ¡ }t|ƒ |S r   )r   rà  ÚLsaGetLogonSessionDataÚPLUIDr8  rÙ  rØ  rÚ  rÖ  râ  rƒ  r;   rG  rN  r   r   r
   ÚPSECURITY_LOGON_SESSION_DATAr  rd  rá  )rL  Ú_LsaGetLogonSessionDataÚppsessiondataÚpsessiondataÚsessiondatar#   r#   r$   r  ‡  s   




r  c                 C   sˆ   dd„ }t jj}tttttttttg	|_	t
|_||_d }| r%t|  d¡ƒ}t| d¡ƒ}	tƒ }
tƒ }|||	|||d d t|
ƒt|ƒƒ	 |
S )Nc                 S   s(   t | ƒt jkr	| S tdd| t | ƒf ƒ‚)Nú!%s failed with error code %s (%s)ÚAcquireCredentialsHandle©r…   r†   rÛ  rÐ  r#   r#   r$   Úerrcž  s   z&AcquireCredentialsHandle.<locals>.errcÚascii)r   rà  ÚAcquireCredentialsHandleAÚ	PSEC_CHARr'  r  r8  ÚPCredHandleÚ
PTimeStamprÙ  r  rÚ  râ  ÚLPSTRrX  Ú
CredHandleÚ	TimeStampr   )Úclient_namer÷  Ú	tragetspnÚ
cred_usageÚpluidÚauthdatar  Ú_AcquireCredentialsHandleÚcnÚpnÚcredsÚtsr#   r#   r$   r  �  s    r  c                 C   sB   dd„ }t jj}tttg|_t|_||_	|t
| ƒ|jt
|ƒƒ}d S )Nc                 S   s,   t | ƒt jkrt | ƒS tdd| t | ƒf ƒ‚)Nr  ÚQueryContextAttributesr  rÐ  r#   r#   r$   r  ·  s   z$QueryContextAttributes.<locals>.errc)r   rà  ÚQueryContextAttributesWÚPCtxtHandler'  r8  rÙ  r  rÚ  râ  r   r7  )ÚctxÚattrÚ
sec_structr  Ú_QueryContextAttributesrÞ  r#   r#   r$   r.  µ  s   r.  c                 C   s$  dd„ }t jj}tttttttttttt	g|_
t|_||_|r't| d¡ƒ}nd }tƒ }	tƒ }
tƒ }|r;tt|ƒgƒ}|sbtƒ }|t| ƒd |t|ƒd||rQt|ƒnd dt|ƒt|	ƒt|
ƒt|ƒƒ}n#|t| ƒt|ƒ|t|ƒd||rut|ƒnd dt|ƒt|	ƒt|
ƒt|ƒƒ}|	j}|||t|
jƒ|fS )Nc                 S   s>   t | ƒt jt jt jt jt jfv rt | ƒS tdd| t | ƒf ƒ‚)Nr  ÚInitializeSecurityContext)r…   r†   rÏ   rÐ   r‡   r�   rÛ  rÐ  r#   r#   r$   r  Í  s    z'InitializeSecurityContext.<locals>.errcr  r   )r   rà  ÚInitializeSecurityContextAr  r0  r  r'  ÚPSecBufferDescrö  r   rÙ  r  rÚ  râ  r!  rX  r>  r#  r1  Ú
CtxtHandler   r;   rF  rØ   r7  )r,  Útargetr1  ÚflagsÚTargetDataRepr9  r  Ú_InitializeSecurityContextÚptargetÚnewbufÚoutputflagsÚexpiryrÞ  rA   r#   r#   r$   r5  Ç  s&   DFr5  Tc                    s–   g }t |ƒ}t| ||ƒ\}}}|dkr|du rtt|ƒƒ‚|S t |¡‰ ˆ jdkrIG ‡ fdd„dtƒ}	|	 |¡}
|
jD ]	}| 	| 
¡ ¡ q;t|ƒ |S )Nr   Tc                       s(   e Zd Zdefdefde” j fgZdS )zIget_ticket_cache_info_helper.<locals>.KERB_QUERY_TKT_CACHE_RESPONSE_ARRAYr  r«  r­  N)rF   rG   rH   r  r'  rˆ  r«  r  r#   ©Úresponse_preparser#   r$   Ú#KERB_QUERY_TKT_CACHE_RESPONSE_ARRAYû  s
    ýrC  )r¨  rû  r   rÍ  rª  Úfrom_buffer_copyr«  r   r­  r?   rd  rá  )ré  rù  rL  ÚthrowrÑ  rþ  Úret_msgrÎ  Úfree_prtrC  ÚresponseÚticketr#   rA  r$   Úget_ticket_cache_info_helperî  s   



rJ  c           
      C   sb   t ||d�}t| ||ƒ\}}}i }|dkrtt|ƒƒ‚t|ƒdkr/t |¡}	|	j ¡ }t	|ƒ |S )N©r„  r   )
rÊ  rû  r   rÍ  r6  rË  rD  r¦  r§  rá  )
ré  rù  rL  Útarget_namerþ  rF  rÎ  r  rI  Úrespr#   r#   r$   Úextract_ticket
  s   

rN  Ú__main__)ÚRtlAdjustPrivilege)ÚProcessManipulatorÚHELLOOOÚkerberosztest_9.kirbiÚrbrK  r©  )r   r   r4   r   r   )Nr#   )NN)T)šÚenumr9   Úctypesr   r   r   r   r   r   r   r	   r
   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   Úpypykatz.commons.commonr   ÚBYTEÚUCHARr—  rU  rO  ÚLPWSTRÚLPVOIDr8  ÚPPVOIDr  rç  ræ  ÚLPHANDLErØ  rü  r'  rö  re  ÚPLARGE_INTEGERr(  r!  ÚCHARrð  rï  ÚPCHARÚSEC_CHARr  rÕ  r=  r   ÚEnumrJ   r…   ÚIntFlagrÑ   rØ   ró   r  r  Ú	PFILETIMEr#  r   r   r*  r1  r>  r7  Ú
PSecHandler"  r  r8  r0  rG  r  rP  rî  rV  ÚPLSA_UNICODE_STRINGr_  ÚPLSA_LAST_INTER_LOGON_INFOrf  r  r~  rˆ  ÚPKERB_TICKET_CACHE_INFOrŽ  ÚPKERB_CRYPTO_KEYr“  ÚPKERB_EXTERNAL_NAMEr™  ÚPKERB_EXTERNAL_TICKETr¨  rª  r¬  r®  rµ  r¸  r¹  rÊ  rË  r7  rè  Ú	TypeErrorrÏ  rÔ  rÖ  rÍ  rá  rå  rê  rí  rõ  rû  r
  r  r  r.  rì   rà   rß   rÞ   r5  rJ  rN  rF   Ú0pypykatz.commons.readers.local.common.privilegesrP  Ú*pypykatz.commons.winapi.processmanipulatorrQ  ÚpmÚsysÚ	getsystemré  Ú
dropsystemrù  ÚopenÚfr=   r´  rL  rþ  rF  rÎ  r  Úprintr#   r#   r#   r$   Ú<module>   s    h"#N		5


.
9€ú

	
&
'


ÿÓ