o
    Žõ±jµ<  ã                   @   sr   d dl Z d dlZd dlZd dlmZ d dlmZ d dlmZmZm	Z	 G dd„ dƒZ
G dd„ dƒZG d	d
„ d
ƒZdS )é    N)Úlogger)Úhexdump)ÚKatzSystemArchitectureÚWindowsBuildÚWindowsMinBuildc                   @   s,   e Zd Zdd„ Zdd„ Zdd„ Zdd„ Zd	S )
ÚRDPCredentialc                 C   s4   d| _ d | _d| _d| _d| _d | _d| _d| _d S )NÚrdpÚ ó    )ÚcredtypeÚ
domainnameÚusernameÚpasswordÚpassword_rawÚisencryptedÚ
servernameÚ
serverfqdn©Úself© r   ú˜/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/rdp/packages/creds/decryptor.pyÚ__init__   ó   
zRDPCredential.__init__c                 C   s:   i }| j |d< | j|d< | j|d< | j|d< | j|d< |S )Nr   r   r   r   r   )r   ÚcachedirÚPRTÚkey_guidÚ	dpapi_key©r   Útr   r   r   Úto_dict   s   




zRDPCredential.to_dictc                 C   s   t  |  ¡ ¡S ©N)ÚjsonÚdumpsr   r   r   r   r   Úto_json   s   zRDPCredential.to_jsonc                 C   sŽ   d}|d| j  7 }|d| j 7 }|d| j 7 }z|d| j ¡  7 }W n   |d| j 7 }Y |dt| jƒ 7 }|d| j 7 }|d| j 7 }|S )	Nz	== RDP Credential ==
z		domainname %s
z		username %s
z		password '%s'
z		password_raw %s
z		isencrypted: %s
z		servername: '%s'
z		serverfqdn: '%s'
)	r   r   r   r   ÚhexÚstrr   r   r   r   r   r   r   Ú__str__!   s   zRDPCredential.__str__N)Ú__name__Ú
__module__Ú__qualname__r   r   r#   r&   r   r   r   r   r   
   s
    
	r   c                   @   s2   e Zd Zddd„Zdd„ Zddd„Zdd	d
„ZdS )ÚRDPCredentialDecryptorMstscFc                 C   s(   || _ || _|| _|| _g | _|| _d S r    )ÚprocessÚreaderÚsysinfoÚdecryptor_templateÚcredentialsÚ
find_first)r   r+   r,   r.   r-   r0   r   r   r   r   2   s   
z$RDPCredentialDecryptorMstsc.__init__c                 C   s&   |  d¡}|dkrd}|d |d … S )Nó     r   r
   é   )Úfind)r   ÚchunckÚmarkerr   r   r   Úfind_string:   s   
z'RDPCredentialDecryptorMstsc.find_stringé (  c                 C   sÄ  | j  ¡ }| ¡ }| ¡ }|D �]Ï}| | jj|¡}|D �]Á}| j  |¡ | j | j ¡}|j	t
dƒk�rÞ|jdk�rÞ|jdk �rÞ|jdk�rÞ|jdk �rÞ|jj�rÞ	 �zo| j  |jj¡ tƒ }	t|jƒD �]H}
| j | j ¡}|j�r­|jdk�r­|jdk �r­	 | j  ¡ }�z| j  |j¡ | j  d¡}|  |¡}| d¡}|dkr§|d |… }| d¡}g d	¢}||v �rŠd
}|jdkrÃ|jrÁdnd}|jdkrà| j  |j¡ | j  d¡}|  |¡}| d¡}nE|jdk�r%|j�r%|j�r%| j  |j¡ | j  |j¡}|jd@ �r#| jd u �r|}n| j |j|jd¡}t|ƒdk�r"|dd … }n|}|d u �r,d}|dk�r5||	_nU|dk�r>||	_ nL|dk�rG||	_!nC|dk�rP||	_"n:|dk�ry|jd@ �ry||	_#| jd u �rkd
|	_$d|	_%n|	j# d¡ &d¡|	_$d|	_%n|dk�rŠ||	_#| d¡|	_$d|	_%W n t'�y¦ } zt( )d *|¡¡ W Y d }~nd }~ww | j  |¡ qd|	j!�rÁ| j+ ,|	¡ | j-�rÁW   d S W q t'�yÝ } zt( )d *|¡¡ W Y d }~qd }~ww qqd S )Nl   Í+•7 é
   iô  r   é   i   ó    zutf-8)
Ú
ServerNameÚ
ServerFqdnÚServerNameUsedForAuthenticationÚUserSpecifiedServerNameÚUserNameÚDomainÚPasswordÚSmartCardReaderNameÚRDmiUsernameÚPasswordContainsSCardPinr	   é   ÚTRUEÚFALSEé   ú	utf-16-leé   i   r
   r;   r<   r?   r@   rA   Tú Fz	Error: {}).r,   Ú
get_readerÚget_handlerÚ
get_memoryÚsearchr.   Ú	signatureÚmoveÚproperties_structÚunkh0ÚintÚunkd1ÚcbPropertiesÚpPropertiesÚvaluer   ÚrangeÚproperty_structÚ
szPropertyÚdwTypeÚtellÚreadr6   r3   ÚdecodeÚpvDataÚunkp2ÚdwFlagsr+   Údpapi_memory_unprotectÚlenr   r   r   r   r   r   r   ÚrstripÚ	Exceptionr   ÚdebugÚformatr/   Úappendr0   )r   Ú	chunksizer,   ÚhandlerÚmemory_segmentsÚmsÚxÚaddrÚ
propertiesÚcredÚiÚpropertyÚcurrent_addrr4   Ústringr5   r[   ÚszPropertiesrX   Úer   r   r   Úfind_entries@   s¶   



 







€





€€ÿ€
€€ÿ€�ýz(RDPCredentialDecryptorMstsc.find_entriesc                 C   s&   |   |¡ t| jƒst d¡ d S d S )NzNo RDP credentials found!)rx   rd   r/   r   rg   )r   rj   r   r   r   Ústart¾   s   

ÿz!RDPCredentialDecryptorMstsc.startN)F©r7   )r'   r(   r)   r   r6   rx   ry   r   r   r   r   r*   1   s
    

~r*   c                   @   s(   e Zd Zddd„Zdd„ Zdd	d
„ZdS )Ú$RDPCredentialDecryptorLogonpasswordsFr   éÿÿÿÿc                 C   s4   || _ || _|| _|| _g | _|| _|| _|| _d S r    )r+   r,   r-   r.   r/   r0   Úlower_boundÚupper_bound)r   r+   r,   r.   r-   r0   r}   r~   r   r   r   r   Æ   r   z-RDPCredentialDecryptorLogonpasswords.__init__c           
   
   C   s¼  t |jjd@ ƒt dƒkrd}nt |jjd@ ƒsd}nd}z§|r¼|jdkr¼|jdkr¼|jdkr¼|jdkr¼|jdkr¼|jd |j…  d¡}|jd |j…  d¡}|j	d |j… }| j
jtjjkr‘| jd u r|t d	¡ |j	d d
t |jd
 ¡ … }d}d}n%| j |j|jd¡}| d¡ d¡}d}n| d¡}| d¡d d }d}tƒ }||_||_||_||_||_| j |¡ W d S t d¡ W d S  tyÝ }	 zt d|	 ¡ W Y d }	~	d S d }	~	ww )Nl     ~ i   Tl     þ Fi   r   rI   z)Credentials found but they are encrypted!é   r	   rK   r1   r:   zThis RDPCred entry is garbage!z"RDP entry parsing error! Reason %s) r$   Úunk1rX   ÚcbDomainÚ
cbUsernameÚ
cbPasswordr@   r_   r?   rA   r-   Úbuildnumberr   ÚWIN_10r+   r   rg   ÚmathÚceilrc   ÚPassword_addrre   Úsplitr   r   r   r   r   r   r/   ri   rf   )
r   Úrdpcred_entryÚbIsCandidateÚ	domainamer   r   r   r   rq   rw   r   r   r   Ú	add_entryÐ   sD   6


€ÿz.RDPCredentialDecryptorLogonpasswords.add_entryr7   c                 C   s  | j  ¡ }| ¡ }| ¡ }| jdkrt|ƒ| _t|ƒD ]h\}}|| jkrƒ|| jk rƒg }| jj	D ]
}|| 
||¡7 }q/|D ]F}	|	| jj7 }	| j  |	¡ z	| j | j ¡}
W n tyn } zt dt|ƒ ¡ W Y d }~q<d }~ww |  |
¡ t| jƒdkr‚| jr‚  d S q<qd S )Nr|   z+Reading error! (this can be normal here) %sr   )r,   rL   rM   rN   r~   rd   Ú	enumerater}   r.   Ú
signaturesrO   ÚoffsetrQ   Úcred_structrf   r   rg   r%   r�   r/   r0   )r   rj   r,   rk   rl   Úidxrm   rn   rP   ro   rq   rw   r   r   r   ry   û   s2   


€þ
€îz*RDPCredentialDecryptorLogonpasswords.startN)Fr   r|   rz   )r'   r(   r)   r   r�   ry   r   r   r   r   r{   Å   s    

+r{   )r!   Úhashlibr†   Úpypykatzr   Úpypykatz.commons.commonr   r   r   r   r   r*   r{   r   r   r   r   Ú<module>   s    ' 