o
    Žõ±j  ã                   @   sV   d dl Z d dlZd dlmZ d dlmZ d dlmZ G dd„ dƒZG dd„ deƒZ	dS )	é    N)Úlogger)ÚPackageDecryptor)ÚPRTL_AVL_TABLEc                   @   s,   e Zd Zdd„ Zdd„ Zdd„ Zdd„ Zd	S )
ÚTspkgCredentialc                 C   s(   d| _ d | _d | _d | _d| _d | _d S )NÚtspkgó    ©ÚcredtypeÚusernameÚ
domainnameÚpasswordÚpassword_rawÚluid©Úself© r   ú¡/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/lsadecryptor/packages/tspkg/decryptor.pyÚ__init__   s   
zTspkgCredential.__init__c                 C   sD   i }| j |d< | j|d< | j|d< | j|d< | j|d< | j|d< |S )Nr	   r
   r   r   r   r   r   ©r   Útr   r   r   Úto_dict   s   





zTspkgCredential.to_dictc                 C   s   t  |  ¡ ¡S )N)ÚjsonÚdumpsr   r   r   r   r   Úto_json    s   zTspkgCredential.to_jsonc                 C   sJ   d| j  }|d| j 7 }|d| j 7 }|d| j 7 }|d| j ¡  7 }|S )Nz	== TSPKG [%x]==
z		username %s
z		domainname %s
z		password %s
z		password (hex)%s
)r   r
   r   r   r   Úhexr   r   r   r   Ú__str__#   s   
zTspkgCredential.__str__N)Ú__name__Ú
__module__Ú__qualname__r   r   r   r   r   r   r   r   r      s
    
r   c                       s,   e Zd Z‡ fdd„Zdd„ Zdd„ Z‡  ZS )ÚTspkgDecryptorc                    s"   t ƒ  d|||¡ || _g | _d S )NÚTspkg)Úsuperr   Údecryptor_templateÚcredentials)r   Úreaderr"   Úlsa_decryptorÚsysinfo©Ú	__class__r   r   r   ,   s   
zTspkgDecryptor.__init__c                 C   s8   |   d| jj¡}| j || jj ¡}| j |¡}||fS )Nz	TSpkg.dll)Úfind_signaturer"   Ú	signaturer$   Úget_ptr_with_offsetÚ
avl_offsetÚget_ptr)r   ÚpositionÚptr_entry_locÚ	ptr_entryr   r   r   Úfind_first_entry2   s   zTspkgDecryptor.find_first_entryc              
   C   s®  z|   ¡ \}}W n ty" } z|  d| ¡ W Y d }~d S d }~ww g }| j |¡ zt| jƒ | j¡}W n tyP } zt d| ¡ W Y d }~d S d }~ww |  	|j
j|¡ |D ]y}|  || jjj¡ | j |¡ | j | j¡}|j | j¡}|d urÔtƒ }	|j|	_|jj | j¡|	_|jj | j¡|	_|jjjdkrÎ|jj | j¡}
|	j d¡du rÅ| j|
dd�\|	_|	_ |	jd urÄ|	j !¡ |	_n	|  |
¡\|	_|	_ | j "|	¡ q[d S )Nz"Failed to find structs! Reason: %sz*Failed to prcess TSPKG package! Reason: %sr   ú$T)Úbytes_expected)#r1   Ú	ExceptionÚlogr$   Úmover   Úreadr   ÚerrorÚwalk_avlÚBalancedRootÚ
RightChildÚlog_ptrr"   Úcredential_structr   Ú
pTsPrimaryr   ÚLocallyUniqueIdentifierr   r#   ÚUserNameÚread_stringr   ÚDomainer
   ÚPasswordÚLengthÚread_maxdataÚendswithÚdecrypt_passwordr   r   r   Úappend)r   Úentry_ptr_valueÚentry_ptr_locÚeÚresult_ptr_listÚ
start_nodeÚptrr=   Úprimary_credentialÚcÚenc_datar   r   r   Ústart8   sL   €þ€þ
€€çzTspkgDecryptor.start)r   r   r   r   r1   rR   Ú__classcell__r   r   r'   r   r   +   s    r   )
Úior   Úpypykatzr   Ú%pypykatz.lsadecryptor.package_commonsr   Úpypykatz.commons.win_datatypesr   r   r   r   r   r   r   Ú<module>   s   