o
    Žõ±j  ã                   @   s~   d dl Z d dlZd dlmZ d dlmZ d dlmZmZ d dl	m
Z
mZ d dlmZ d dlmZ d dlmZmZ dd
d„ZdS )é    N)Úlogger)ÚCredBackupCredentials)ÚProcessÚ!PROCESS_QUERY_LIMITED_INFORMATION)Úenable_debug_privilegeÚRtlAdjustPrivilege)ÚSetThreadToken)ÚCryptUnprotectData)ÚCREDENTIAL_BLOBÚCredentialFileúwinlogon.exec                 C   sx  d }�zzÆ|d u rt jdd�}|j}t d| ¡ | ¡  tƒ  t|tdd�}| 	¡ }t
|ƒ tddd� t| tdd�}| ¡ }t||ƒ t|d	ƒ�}	t|	 ¡ ƒ}W d   ƒ n1 s[w   Y  g }
t |¡}|j}|jd
kr�t |¡}|
 |¡ ||jd … }t|ƒdkr�t |¡}|
 |¡ ||jd … }t|ƒdks†||
d fW W zt |¡ t d¡ W S  tyÊ } zt dt|ƒ ¡ W Y d }~S d }~ww  t�y } z;t d| ¡ |d |fW  Y d }~W zt |¡ t d¡ W S  t�y } zt dt|ƒ ¡ W Y d }~S d }~ww d }~ww zt |¡ t d¡ W w  t�y; } zt dt|ƒ ¡ W Y d }~w d }~ww )NF)ÚdeletezTemp file path: %sT)ÚnameÚaccessÚopené   )Úthread_or_process)Úpidr   r   Úrbé   r   zTemp file removedzFailed to remove temp file! %szdpapi_trustedcredman err! %s)ÚtempfileÚNamedTemporaryFiler   r   ÚdebugÚcloser   r   r   Úduplicate_tokenr   r   Úget_process_tokenr   r   r	   Úreadr   Ú
from_bytesÚdataÚunkr
   ÚappendÚsizeÚlenÚosÚunlinkÚ	ExceptionÚstr)Ú
target_pidÚspecial_processÚtemp_file_pathÚdec_dataÚtfÚ	pwinlogonÚwinlogon_tokenÚpuserprocessÚpuserprocess_tokenÚfÚresultsÚxfÚ	blobsdataÚresÚe© r6   úˆ/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/dpapi/extras.pyÚdpapi_trustedcredman   sx   
ÿ





ý
€þù
€þ€ù
€þr8   )r   N)r   r#   Úpypykatzr   Ú4pypykatz.commons.winapi.local.function_defs.advapi32r   Ú&pypykatz.commons.readers.local.processr   r   Ú0pypykatz.commons.readers.local.common.privilegesr   r   r   Ú!pypykatz.dpapi.functiondefs.dpapir	   Ú(pypykatz.dpapi.structures.credentialfiler
   r   r8   r6   r6   r6   r7   Ú<module>   s   