o
    j4                  	   @   s   d dl mZ d dlmZ d dlmZ G dd deZg dg dg dg d	g d
g dg dg dgZdd Zdd Z	dd Z
dd ZdS )    )RC4)PackageDecryptor)LONGc                       sp   e Zd Z fddZdd Zdd Zdd Zd	d
 Zdd ZdddZ	dd Z
dd Zdd ZdddZ  ZS )LsaDecryptor_NT5c                    s<   t  dd || || _d | _d | _d | _d | _|   d S )NLsaDecryptor)super__init__decryptor_templatefeedbackfeedback_offsetdes_key
random_keyacquire_crypto_material)selfreaderr	   sysinfo	__class__ /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/lsadecryptor/lsa_decryptor_nt5.pyr      s   zLsaDecryptor_NT5.__init__c                 C   s   |  d |  }| j| | jj| jjfD ](}|| _z| || _	| 
|| _| || _W  d S    dd l}|  Y qd S )NzAcquireing crypto stuff...r   )logfind_signaturer   mover	   feedback_ptr_offsetold_feedback_offsetr   get_feedbackr
   get_keyr   
get_randomr   	traceback	print_exc)r   sigposxr   r   r   r   r      s   
z(LsaDecryptor_NT5.acquire_crypto_materialc                 C   s~   | j jdkr| j|| j }| j| | jdS | j|| j  t| jj}|| j d | }| j| | jdS )Nx86      )	r	   archr   get_ptr_with_offsetr   r   readr   value)r   r    new_ptroffsetnewposr   r   r   r   -   s   zLsaDecryptor_NT5.get_feedbackc                 C   s   | j jdkr%| j|| j j }| j| | j | j}|| j}|S | j|| j j  t| jj	}|| j j d | }| j| | j | j}|| j}|S )Nr"   r$   )
r	   r%   r   r&   desx_key_ptr_offsetr   key_struct_ptrr'   r   r(   )r   r    r)   des_key_ptrr   r*   r+   r   r   r   r   9   s   	zLsaDecryptor_NT5.get_keyc                 C   s   | j jdkr| j|| j j }| j|}| j| n | j|| j j  t| jj}|| j j d | }| j| | j	dS )Nr"   r$      )
r	   r%   r   r&   randomkey_ptr_offsetr   r   r(   r,   r'   )r   r    random_key_ptrr*   r+   r   r   r   r   I   s   zLsaDecryptor_NT5.get_randomc                 C   s   |  d | jd| jj}t|dkr$| j d| jj   td|  dd	dd	 |D   |  d
|d   |d S )Nz.Looking for main struct signature in memory...z
lsasrv.dllr   zsignature not found! %szLSA signature not found!z/Found candidates on the following positions: %s c                 s   s    | ]}t |V  qd S N)hex).0r!   r   r   r   	<genexpr>]   s    z2LsaDecryptor_NT5.find_signature.<locals>.<genexpr>zSelecting first one @ 0x%08x)
r   r   find_in_moduler	   	signaturelenloggerr4   	Exceptionjoin)r   flr   r   r   r   V   s   
zLsaDecryptor_NT5.find_signature   c                 C   sB   d}t |}|r|d dkrt| j}||}|S | |}|S )N    r#   r   )r9   r   r   decrypt_LsaDecryptor_NT5__desx_decrypt)r   	encryptedsegment_size	cleartextsizectxr   r   r   r@   a   s   


zLsaDecryptor_NT5.decryptc                 C   s   |  d |  dt| j| j  |  dt| j| j  |  dt| jj| jj  |  dt| jj| jj  d S )NzRecovered LSA encryption keys
zFeedback ({}): {}zRandom Key ({}): {}z DESX inputwhitening Key ({}): {}z!DESX outputwhitening Key ({}): {})	r   formatr9   r
   r4   r   r   inputWhiteningoutputWhitening)r   r   r   r   dumpp   s
   
"&zLsaDecryptor_NT5.dumpc                 C   s.   t || jj}| j|dd}t || jj}|S )NF)encrypt)xorr   rI   &_LsaDecryptor_NT5__desx_internal_blockrH   )r   chunkr   r   r   __desx_decrypt_internal_blockx   s   z.LsaDecryptor_NT5.__desx_decrypt_internal_blockc                 C   sf   d}d}| j }|t|kr1| |||d  }|t||7 }|||d  }|d7 }|t|ks|S )Nr?   r   r#   )r
   r9   ._LsaDecryptor_NT5__desx_decrypt_internal_blockrL   )r   dataresiIVrN   r   r   r   __desx_decrypt~   s   zLsaDecryptor_NT5.__desx_decryptFc                 C   sz  t j|dd  ddd}t j|d d ddd}t|d}||A d@ }||A }||A }t|d}||A d@ }||A }||A }t|d}||A d	@ }||A }||A }t|d
}||A d@ }||A }||A }t|d}||A d@ }||A }||A }t|d}|rtdddD ]}t||| jjj| \}}t||| jjj|d  \}}qn%tdddD ]}t||| jjj|d  \}}t||| jjj| \}}qt|d}||A d@ }||A }||A }t|d}||A d@ }||N }||N }t|d
}||A d	@ }||N }||N }t|d}||A d@ }||N }||N }t|d}||A d@ }||N }||N }t|d}|j	dddd|j	dddd S )Nr$   littleF)signedl   pa    l        i3333   i	   l   *UU    r      )
int
from_bytesrol32rangeFr   desKeyroundKeyror32to_bytes)r   rQ   rK   LRTarS   r   r   r   __desx_internal_block   sj   





 





 z&LsaDecryptor_NT5.__desx_internal_block)r>   )F)__name__
__module____qualname__r   r   r   r   r   r   r@   rJ   rP   rA   rM   __classcell__r   r   r   r   r      s    	
r   )@            rr   ru   rp        rt   r   rv   rq   r]       rs   rw   rx   rz   r]      r{    r|   ry   r}   r   r   rs   rz   rv   rp   rq   rx   rz   r}   r|   r{   rr   ru   r]   rr   rw   rs   r{   rw   ry   rt   rx   rv   r   rq   rt   ry   rp   r]   r}   r|   ru   )@@r       @  @    @r       @   r      @r   r       @r   r       @r   r   r   r   r   r   r   r   r   r~   r   r   r   r   r~   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r~   r   r   r   r   r   r   r   r   r   r   )@   r/         r            r\     r\    r   r   r   r/   r   r   r   r   r   r    r   r   r   r   r   r   r/   r\   r   r   r   r   r   r   r   r   r   r   r   r   r\   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r/   r   )@@   r#   @r     @  @  @       r   r     @ r    @ @    r#   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r#   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r#   r   r   r   r   r   r   r   r   r   r   )@                  r              r    r   r   r         r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   )@   @    @   r        @  r          @        @      @ @                      r        @  @   r   r      @ @  r   r   @   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   )@ @         B @   B  r          @ r$    B r   r   r   r   r   r   r   r   r   r   @ B  r   r$   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r$   r   r   r   r   r   r   r   r   r   r   r$   r   r   r   r   r   r   )@       r             r>          r          r      r   r   r   r   r   r   r   r      r   r   r   r   r   r>   r   r   r   r   r   r   r   r   r   r   r   r   r   r>   r   r   r   r   r   r   r   r   r   r   r>   r   r   r   r   r   r   r   c                 C   s  |d |A }|d |A }t |d}| td |d@ d  N } | td |d@ d  N } | td |d? d@ d  N } | td |d? d@ d  N } | td |d? d@ d  N } | td	 |d? d@ d  N } | td
 |d? d@ d  N } | td |d? d@ d  N } | |fS )Nr   r\   r$      r]   r#      r               )rf   SymCryptDesSpbox)rh   ri   keyarj   Tbr   r   r   rc     s   
rc   c                 C   s   | |> | d| ? B d@ S Nr   l    r   ndr   r   r   ra        ra   c                 C   s   | |? | d| > B d@ S r   r   r   r   r   r   rf   "  r   rf   c                 C   s   t dd t| |D S )Nc                 s   s    | ]	\}}||A V  qd S r3   r   )r5   abr   r   r   r6   &  s    zxor.<locals>.<genexpr>)byteszip)d1d2r   r   r   rL   %  r   rL   N)unicrypto.symmetricr   %pypykatz.lsadecryptor.package_commonsr   pypykatz.commons.win_datatypesr   r   r   rc   ra   rf   rL   r   r   r   r   <module>   s$    T3