o
    j                     @   s  d dl Z d dlmZmZmZmZmZ d dlmZm	Z	m
Z
 d dlmZmZmZmZmZmZmZmZmZmZ d dlmZ d dlmZ G dd deZG d	d
 d
eZG dd dZG dd deZG dd dZG dd deZG dd dZG dd deZ G dd dZ!G dd deZ"G dd dZ#G dd deZ$G dd  d Z%G d!d" d"eZ&G d#d$ d$Z'G d%d& d&eZ(G d'd( d(Z)G d)d* d*eZ*G d+d, d,Z+G d-d. d.eZ,G d/d0 d0Z-G d1d2 d2Z.G d3d4 d4eZ/G d5d6 d6Z0G d7d8 d8eZ1G d9d: d:Z2G d;d< d<eZ3G d=d> d>Z4G d?d@ d@Z5G dAdB dBZ6G dCdD dDeZ7G dEdF dFZ8G dGdH dHeZ9G dIdJ dJZ:G dKdL dLeZ;G dMdN dNZ<G dOdP dPeZ=G dQdR dRZ>G dSdT dTeZ?G dUdV dVZ@G dWdX dXeZAG dYdZ dZZBG d[d\ d\eZCG d]d^ d^ZDG d_d` d`eZEG dadb dbZFG dcdd ddeZGG dedf dfZHG dgdh dheZIG didj djZJG dkdl dleZKG dmdn dnZLG dodp dpeZMG dqdr drZNG dsdt dteZOG dudv dvZPG dwdx dxeZQG dydz dzZRG d{d| d|ZSG d}d~ d~ZTG dd dZUdS )    N)ULONG64FILETIMEPCWSTRSIZE_TBOOL)KatzSystemArchitectureWindowsMinBuildWindowsBuild)
POINTERPVOIDULONG
LIST_ENTRYDWORDLSA_UNICODE_STRINGPKERB_EXTERNAL_NAMEKIWI_GENERIC_PRIMARY_CREDENTIALLUIDPLSAISO_DATA_BLOB)PackageTemplate)hexdumpc                       s(   e Zd Z fddZedd Z  ZS )KerberosTemplatec                    s<   t  d| d | _d | _d | _d | _d | _d | _d | _d S )NKerberos)	super__init__	signaturefirst_entry_offsetkerberos_session_structkerberos_ticket_structkeys_list_structhash_password_structcsp_info_struct)selfsysinfo	__class__ /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/lsadecryptor/packages/kerberos/templates.pyr      s   
zKerberosTemplate.__init__c                 C   s>  t | }| jtjkrtjj| j  krtjjk r3n nd|_	d|_
t|_t|_t|_t|_t|_|S tjj| j  krBtjjk r[n nd|_	d|_
t|_t|_t|_t|_t|_|S tjj| j  krjtjjk rn nd|_	d|_
t|_t|_t|_t|_t|_|S tjj| j  krtjjk rn nd|_	d|_
t|_t|_t|_t|_t|_|S tjj| j  krtj jk rn nd|_	d|_
t|_t|_t|_t|_t!|_|S tj j| j  krtj"jk rn nd|_	d|_
t#|_t|_t|_t|_t$|_|S tj"j| j  krtj%jk r%n nd|_	d|_
t#|_t&|_t|_t|_t$|_|S tj%j| j  kr6tj'jk rOn nd|_	d|_
t(|_t)|_t|_t*|_t$|_|S tj'j| j  kr`tj+jk ryn nd|_	d|_
t(|_t,|_t|_t*|_t$|_|S | jtj+jkrd|_	d|_
t-|_t,|_t|_t*|_t$|_|S t.d| j| jf | jtj/krtjj| j  krtjjk rn nd|_	d|_
t|_t|_t|_t|_t|_|S tjj| j  krtjjk rn nd|_	d|_
t|_t|_t|_t|_t|_|S tjj| j  krtjjk r'n nd|_	d	|_
t|_t|_t|_t|_t|_|S tjj| j  kr8tjjk rQn nd|_	d	|_
t|_t|_t|_t|_t|_|S tjj| j  krbtj0jk r{n nd
|_	d|_
t|_t|_t|_t|_t!|_|S tj0j| j  krtj jk rn nd|_	d|_
t|_t|_t|_t|_t!|_|S tj j| j  krtj"jk rn nd|_	d|_
t1|_t|_t|_t|_t$|_|S tj"j| j  krtj2jk rn nd|_	d|_
t3|_t)|_t|_t*|_t$|_|S tj2j| jkrd|_	d|_
t3|_t)|_t|_t*|_t$|_|S t.d| j )Ns   H;s   HH   zECould not identify template! Architecture: %s sysinfo.buildnumber: %ss   }9Pis   SPVis   W8Phis   V0PWis   V0PSzUnknown architecture! %s)4r   architecturer   X64r   WIN_XPvaluebuildnumberWIN_2K3r   r   KIWI_KERBEROS_LOGON_SESSION_51r    KIWI_KERBEROS_INTERNAL_TICKET_51r   KIWI_KERBEROS_KEYS_LIST_5r   KERB_HASHPASSWORD_5r   KIWI_KERBEROS_CSP_INFOS_5r    	WIN_VISTAKIWI_KERBEROS_LOGON_SESSION KIWI_KERBEROS_INTERNAL_TICKET_52WIN_7 KIWI_KERBEROS_INTERNAL_TICKET_60KIWI_KERBEROS_KEYS_LIST_6KERB_HASHPASSWORD_6KIWI_KERBEROS_CSP_INFOS_60WIN_8KIWI_KERBEROS_INTERNAL_TICKET_6r	   WIN_10_1507KIWI_KERBEROS_CSP_INFOS_62WIN_10_1511KIWI_KERBEROS_LOGON_SESSION_10KIWI_KERBEROS_CSP_INFOS_10WIN_10_1607 KIWI_KERBEROS_INTERNAL_TICKET_10WIN_11_2022#KIWI_KERBEROS_LOGON_SESSION_10_1607%KIWI_KERBEROS_INTERNAL_TICKET_10_1607KERB_HASHPASSWORD_6_1607WIN_11_24H2 KIWI_KERBEROS_INTERNAL_TICKET_11 KIWI_KERBEROS_LOGON_SESSION_24H2	ExceptionX86WIN_BLUE"KIWI_KERBEROS_LOGON_SESSION_10_X86WIN_10_1903'KIWI_KERBEROS_LOGON_SESSION_10_1607_X86)r"   templater%   r%   r&   get_template   sx  " 7 " - " $ "  "  " 	 &&u&lc&U&K&B&9&0&'&&zKerberosTemplate.get_template)__name__
__module____qualname__r   staticmethodrS   __classcell__r%   r%   r#   r&   r      s    
r   c                          e Zd Z fddZ  ZS )PKERB_SMARTCARD_CSP_INFO_5c                       t  |t d S N)r   r   KERB_SMARTCARD_CSP_INFO_5r!   readerr#   r%   r&   r         z#PKERB_SMARTCARD_CSP_INFO_5.__init__rT   rU   rV   r   rX   r%   r%   r#   r&   rZ          rZ   c                   @   $   e Zd Zdd Zdd Zdd ZdS )r]   c                 C   sr   |  }t|j| _t|j| _t|j| _t|j| _t|j| _|  | }|	|| d }t
|| _d S )N   )tellr   r,   ContextInformationr   nCardNameOffsetnReaderNameOffsetnContainerNameOffsetnCSPNameOffsetreadioBytesIObBufferr!   r_   sizeposdiffdatar%   r%   r&   r      s   z"KERB_SMARTCARD_CSP_INFO_5.__init__c                 C      |  }||d d}d}d}|dk r5|dkrn|d}|dkr'|d7 }nd}||7 }|d7 }|dk s||d |ddd	S 
Nr                    z	utf-16-le  re   seekrk   decodereplacer!   buffertposrq   rs   inccr%   r%   r&   read_wcharnull   "   


z(KERB_SMARTCARD_CSP_INFO_5.read_wcharnullc                 C   X   i }|  | j| j|d< |  | j| j|d< |  | j| j|d< |  | j| j|d< |S NCardName
ReaderNameContainerNameCSPNamer   rn   rg   rh   ri   rj   r!   tr%   r%   r&   	get_infos     z#KERB_SMARTCARD_CSP_INFO_5.get_infosNrT   rU   rV   r   r   r   r%   r%   r%   r&   r]      s    r]   c                       rY   )PKERB_SMARTCARD_CSP_INFOc                    r[   r\   )r   r   KERB_SMARTCARD_CSP_INFOr^   r#   r%   r&   r     r`   z!PKERB_SMARTCARD_CSP_INFO.__init__ra   r%   r%   r#   r&   r     rb   r   c                   @   rc   )r   c                 C   s   |  }t|j| _t|j| _t|j| _t|j| _t|j| _	t
|jd | _t
|jd | _t
|jd | _t
|jd | _|  | }||| d }t|| _d S )N   rd   )re   r   r,   MessageTyper   rf   r   SpaceHolderForWow64flagsKeySpecr   rg   rh   ri   rj   rk   rl   rm   rn   ro   r%   r%   r&   r     s   z KERB_SMARTCARD_CSP_INFO.__init__c                 C   rt   ru   r}   r   r%   r%   r&   r   "  r   z&KERB_SMARTCARD_CSP_INFO.read_wcharnullc                 C   r   r   r   r   r%   r%   r&   r   5  r   z!KERB_SMARTCARD_CSP_INFO.get_infosNr   r%   r%   r%   r&   r     s    r   c                       rY   )PKIWI_KERBEROS_CSP_INFOS_5c                    r[   r\   )r   r   r3   r^   r#   r%   r&   r   ?  r`   z#PKIWI_KERBEROS_CSP_INFOS_5.__init__ra   r%   r%   r#   r&   r   >  rb   r   c                   @      e Zd Zdd ZdS )r3   c                 C   s^   t || _t|| _t|| _t|| _t|| _t|j| _	t|j| _
t|| j
d| _d S N)rp   )r   PinCoder   unk0unk1CertificateInfosunkDatar   r,   FlagsCspDataLengthr]   CspDatar^   r%   r%   r&   r   C  s   




z"KIWI_KERBEROS_CSP_INFOS_5.__init__NrT   rU   rV   r   r%   r%   r%   r&   r3   B      r3   c                       rY   )PKIWI_KERBEROS_CSP_INFOS_60c                    r[   r\   )r   r   r;   r^   r#   r%   r&   r   N  r`   z$PKIWI_KERBEROS_CSP_INFOS_60.__init__ra   r%   r%   r#   r&   r   M  rb   r   c                   @   r   )r;   c                 C   sr   t || _t|j| _t|j| _t|j| _t|j| _t|j| _	t|j| _
t|j| _t|| jd| _d S r   )r   r   r   r,   r   r   r   r   r   r   unkFlagsr   r   r   r^   r%   r%   r&   r   S  s   
z#KIWI_KERBEROS_CSP_INFOS_60.__init__Nr   r%   r%   r%   r&   r;   R  r   r;   c                       rY   )PKIWI_KERBEROS_CSP_INFOS_62c                    r[   r\   )r   r   r?   r^   r#   r%   r&   r   _  r`   z$PKIWI_KERBEROS_CSP_INFOS_62.__init__ra   r%   r%   r#   r&   r   ^  rb   r   c                   @   r   )r?   c                 C   s~   t || _t|j| _t|j| _t|j| _t|j| _t|j| _t	|j| _
t	|j| _t	|j| _t|| jd| _d S r   )r   r   r   r,   r   r   r   unk2r   r   r   r   r   r   r   r^   r%   r%   r&   r   d  s   
z#KIWI_KERBEROS_CSP_INFOS_62.__init__Nr   r%   r%   r%   r&   r?   c  r   r?   c                       rY   )PKIWI_KERBEROS_CSP_INFOS_10c                    r[   r\   )r   r   rB   r^   r#   r%   r&   r   q  r`   z$PKIWI_KERBEROS_CSP_INFOS_10.__init__ra   r%   r%   r#   r&   r   p  rb   r   c                   @   r   )rB   c                 C   s   t || _t|j| _t|j| _t|j| _t|j| _t|j| _t	|j| _
t	|j| _t|j| _t	|j| _t|| jd| _d S r   )r   r   r   r,   r   r   r   r   r   r   r   r   unk3r   r   r   r^   r%   r%   r&   r   u  s   
z#KIWI_KERBEROS_CSP_INFOS_10.__init__Nr   r%   r%   r%   r&   rB   t  r   rB   c                       rY   )PKIWI_KERBEROS_LOGON_SESSION_51c                    r[   r\   )r   r   r/   r^   r#   r%   r&   r     r`   z(PKIWI_KERBEROS_LOGON_SESSION_51.__init__ra   r%   r%   r#   r&   r     rb   r   c                   @   r   )r/   c                 C   s~  t |j| _t|| _t|| _t|j| _t |j| _t |j| _	t|j| _
t|j| _t|j| _t|j| _|d t|j| _t|j| _t |j| _t |j| _t|j| _t|j| _t|j| _t|| _t |j| _t |j| _t |j| _t |j| _t|j| _t|j| _t|j| _ t|j| _!t|| _"t|j| _#t|| _$t|| _%t|| _&t|| _'d S N   )(r   r,   
UsageCountr   r   r   r   r   r   unk4unk5unk6unk7r   LocallyUniqueIdentifieralignr   unk8unk9unk10unk11unk12unk13unk14r   credentialsunk15unk16unk17unk18unk19unk20unk21unk22pKeyListunk24	Tickets_1	Tickets_2	Tickets_3SmartcardInfosr^   r%   r%   r&   r     sB   







z'KIWI_KERBEROS_LOGON_SESSION_51.__init__Nr   r%   r%   r%   r&   r/     r   r/   c                       rY   )PKIWI_KERBEROS_LOGON_SESSIONc                    r[   r\   )r   r   r5   r^   r#   r%   r&   r     r`   z%PKIWI_KERBEROS_LOGON_SESSION.__init__ra   r%   r%   r#   r&   r     rb   r   c                   @   r   )r5   c                 C   s  t |j| _|  t|| _t|j| _t |j| _t |j| _	t|j| _
t|j| _t|j| _t|j| _|d t|j| _t|j| _t |j| _t |j| _t|j| _t|j| _t|j| _t|| _t |j| _t |j| _t |j| _t |j| _t|j| _t|j| _t|j| _t|j| _ t|| _!t|j| _"|  t|| _#t|j| _$t|| _%t|j| _&t|| _'t|j| _(t|| _)d S r   )*r   r,   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   unk23r   r   r   unk25r   unk26r   r^   r%   r%   r&   r     sJ   






z$KIWI_KERBEROS_LOGON_SESSION.__init__Nr   r%   r%   r%   r&   r5     r   r5   c                       rY   )$PKIWI_KERBEROS_10_PRIMARY_CREDENTIALc                    r[   r\   )r   r   #KIWI_KERBEROS_10_PRIMARY_CREDENTIALr^   r#   r%   r&   r     r`   z-PKIWI_KERBEROS_10_PRIMARY_CREDENTIAL.__init__ra   r%   r%   r#   r&   r     rb   r   c                   @   r   )r   c                 C   s.   t || _t || _t|j| _t || _d S r\   )r   UserNameDomainer   r,   r   Passwordr^   r%   r%   r&   r     s   

z,KIWI_KERBEROS_10_PRIMARY_CREDENTIAL.__init__Nr   r%   r%   r%   r&   r     r   r   c                       rY   )PKIWI_KERBEROS_LOGON_SESSION_10c                    r[   r\   )r   r   rA   r^   r#   r%   r&   r     r`   z(PKIWI_KERBEROS_LOGON_SESSION_10.__init__ra   r%   r%   r#   r&   r     rb   r   c                   @   r   )rO   c                 C   s  t |j| _|  t|| _t|j| _t |j| _|  t	|j| _
t|j| _t|j| _t|j| _t|j| _|  t	|j| _t|j| _t |j| _|  t	|j| _t|j| _t|j| _t|j| _|d t|| _t |j| _t |j| _t |j| _t |j| _|d t|j| _t|j| _t|j| _t|j| _ t|j| _!t|j| _"t|j| _#t|| _$t|j| _%|  t|| _&t	|j| _'t|| _(t	|j| _)t|| _*t	|j| _+t|| _,d S r   -r   r,   r   r   r   r   r   r   unk1br   r   r   r   r   r   r   r   r   unk8br   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   unk27r   unk28r   unk29r   r^   r%   r%   r&   r     sX   







z+KIWI_KERBEROS_LOGON_SESSION_10_X86.__init__Nr   r%   r%   r%   r&   rO     r   rO   c                   @   r   )rA   c                 C   s  t |j| _|  t|| _t|j| _t |j| _|  t	|j| _
t|j| _t|j| _t|j| _t|j| _t	|j| _t|j| _t |j| _|  t	|j| _t|j| _t|j| _t|j| _t|| _t |j| _t |j| _t |j| _t |j| _t|j| _t|j| _t|j| _t|j| _ t|j| _!t|j| _"t|j| _#t|| _$t|j| _%t|| _&t	|j| _'t|| _(t	|j| _)t|| _*t	|j| _+t|| _,d S r\   r   r^   r%   r%   r&   r   !  sP   





z'KIWI_KERBEROS_LOGON_SESSION_10.__init__Nr   r%   r%   r%   r&   rA      r   rA   c                       rY   )-PKIWI_KERBEROS_10_PRIMARY_CREDENTIAL_1607_ISOc                    r[   r\   )r   r   ,KIWI_KERBEROS_10_PRIMARY_CREDENTIAL_1607_ISOr^   r#   r%   r&   r   M  r`   z6PKIWI_KERBEROS_10_PRIMARY_CREDENTIAL_1607_ISO.__init__ra   r%   r%   r#   r&   r   L  rb   r   c                   @   r   )r   c                 C   s"   t |j| _|  t|| _d S r\   )r   r,   
StructSizer   r   isoBlobr^   r%   r%   r&   r   R  s   z5KIWI_KERBEROS_10_PRIMARY_CREDENTIAL_1607_ISO.__init__Nr   r%   r%   r%   r&   r   Q  r   r   c                       rY   ))PKIWI_KERBEROS_10_PRIMARY_CREDENTIAL_1607c                    r[   r\   )r   r   (KIWI_KERBEROS_10_PRIMARY_CREDENTIAL_1607r^   r#   r%   r&   r   X  r`   z2PKIWI_KERBEROS_10_PRIMARY_CREDENTIAL_1607.__init__ra   r%   r%   r#   r&   r   W  rb   r   c                   @   r   )r   c                 C   sL   t || _t || _t|j| _t|j| _|  t || _	t
|| _d S r\   )r   r   r   r   r,   unkFunctionr   typer   r   r   IsoPasswordr^   r%   r%   r&   r   \  s   


z1KIWI_KERBEROS_10_PRIMARY_CREDENTIAL_1607.__init__Nr   r%   r%   r%   r&   r   [  r   r   c                       rY   )$PKIWI_KERBEROS_LOGON_SESSION_10_1607c                    r[   r\   )r   r   rF   r^   r#   r%   r&   r   f  r`   z-PKIWI_KERBEROS_LOGON_SESSION_10_1607.__init__ra   r%   r%   r#   r&   r   e  rb   r   c                   @   r   )rF   c                 C   s  t |j| _|  t|| _t|j| _t |j| _|  t	|j| _
t|j| _t|j| _t|j| _t|j| _t	|j| _t|j| _t |j| _|  t	|j| _t|j| _t|j| _t|j| _|d t|| _t |j| _t |j| _t |j| _t |j| _t|j| _t|j| _t|j| _t|j| _ t|j| _!t|j| _"|  t|| _#t|j| _$t|| _%t	|j| _&t|| _'t	|j| _(t|| _)t	|j| _*t|| _+d S r   ),r   r,   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r^   r%   r%   r&   r   k  sR   






z,KIWI_KERBEROS_LOGON_SESSION_10_1607.__init__Nr   r%   r%   r%   r&   rF   j  r   rF   c                   @   r   )rK   c                 C   s  t |j| _|  t|| _t |j| _|  t|j| _t	|j| _
t	|j| _t	|j| _t|j| _t|j| _t	|j| _t |j| _|  t|j| _t	|j| _t	|j| _|d t|| _t |j| _t |j| _t |j| _t |j| _t	|j| _t	|j| _t	|j| _t	|j| _t	|j| _t	|j| _ |  t	|| _!t	|j| _"t|| _#t|j| _$t|| _%t|j| _&t|| _'t|j| _(t	|| _)d S r   )*r   r,   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r^   r%   r%   r&   r     sN   






z)KIWI_KERBEROS_LOGON_SESSION_24H2.__init__Nr   r%   r%   r%   r&   rK     r   rK   c                   @   r   )rQ   c                 C   s  t |j| _|  t|| _t|j| _t |j| _|  t	|j| _
t|j| _t|j| _t|j| _t|j| _t	|j| _t|j| _t |j| _|  t	|j| _t|j| _t|j| _t|j| _t |j| _t|| _t |j| _t |j| _t |j| _t |j| _t|j| _t|j| _t|j| _ t|j| _!t|j| _"t|j| _#|  t|| _$t|j| _%t|| _&t	|j| _'t|| _(t	|j| _)t|| _*t	|j| _+t|| _,d S r\   )-r   r,   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   unkAlignr   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r^   r%   r%   r&   r     sR   





z0KIWI_KERBEROS_LOGON_SESSION_10_1607_X86.__init__Nr   r%   r%   r%   r&   rQ     r   rQ   c                       rY   )!PKIWI_KERBEROS_INTERNAL_TICKET_51c                    r[   r\   )r   r   r0   r^   r#   r%   r&   r     r`   z*PKIWI_KERBEROS_INTERNAL_TICKET_51.__init__ra   r%   r%   r#   r&   r     rb   r   c                   @   r   )r0   c                 C   s  t || _t || _t|j| _t|j| _t|| _t|| _	t
|| _t
|| _t
|| _t
|| _t|| _tj|dddd| _t|j| _t|j| _t|| _t|j| _t|j| _t|j| _t|j| _t|j| _t|j| _t|j| _ t|j| _!t|j| _"t|j| _#t|j| _$t%|j| _&t|j| _'t|j| _(t|j| _)t|j| _*t|j| _+t|| _,d S Nrd   bigF	byteordersigned)-r   FlinkBlinkr   r,   r   r   r   ServiceName
TargetNamer   
DomainNameTargetDomainNameDescriptionAltTargetDomainName
ClientNameint
from_bytesrk   TicketFlagsr   r   KeyTypeKIWI_KERBEROS_BUFFERKeyr   r   r   r   r   r   r   	StartTimeEndTime
RenewUntilr   r   r   domainr   strangeNamesr   TicketEncType
TicketKvnoTicketr^   r%   r%   r&   r     sB   









z)KIWI_KERBEROS_INTERNAL_TICKET_51.__init__Nr   r%   r%   r%   r&   r0   
  r   r0   c                       rY   )!PKIWI_KERBEROS_INTERNAL_TICKET_52c                    r[   r\   )r   r   r6   r^   r#   r%   r&   r   /  r`   z*PKIWI_KERBEROS_INTERNAL_TICKET_52.__init__ra   r%   r%   r#   r&   r  .  rb   r  c                   @   r   )r6   c                 C   n  t || _t || _t|j| _t|j| _t|| _t|| _	t
|| _t
|| _t
|| _t
|| _t|| _t|j| _tj|dddd| _t|j| _t|j| _t|| _t|j| _t|j| _t|j| _t|j| _t|j| _t|j| _ t|j| _!t|j| _"t#|j| _$t|j| _%t|j| _&t|j| _'t|j| _(t|j| _)t|| _*d S r   )+r  r   r   r   r,   r   r   r   r   r   r   r   r   r   r   r   name0r   r   rk   r   r   r   r   r   r   r   r   r   r   r   r   r  r   r   r   r  r   r  r   r  r  r  r^   r%   r%   r&   r   4  s>   









z)KIWI_KERBEROS_INTERNAL_TICKET_52.__init__Nr   r%   r%   r%   r&   r6   3  r   r6   c                       rY   )!PKIWI_KERBEROS_INTERNAL_TICKET_60c                    r[   r\   )r   r   r8   r^   r#   r%   r&   r   V  r`   z*PKIWI_KERBEROS_INTERNAL_TICKET_60.__init__ra   r%   r%   r#   r&   r
  U  rb   r
  c                   @   r   )r8   c                 C   r  r   )+r
  r   r   r   r,   r   r   r   r   r   r   r   r   r   r   r   r	  r   r   rk   r   r   r   r   r   r   r   r   r   r   r   r   r  r   r   r   r  r   r  r   r  r  r  r^   r%   r%   r&   r   [  s>   









z)KIWI_KERBEROS_INTERNAL_TICKET_60.__init__Nr   r%   r%   r%   r&   r8   Z  r   r8   c                       rY   ) PKIWI_KERBEROS_INTERNAL_TICKET_6c                    r[   r\   )r   r   r=   r^   r#   r%   r&   r     r`   z)PKIWI_KERBEROS_INTERNAL_TICKET_6.__init__ra   r%   r%   r#   r&   r  ~  rb   r  c                   @   r   )r=   c                 C   s  t || _t || _t|j| _t|j| _t|| _t|| _	t
|| _t
|| _t
|| _t
|| _t
|| _t|| _t|j| _tj|dddd| _t|j| _t|j| _|  t|| _t|j| _t|j| _t|j| _t|j| _ t|j| _!t|j| _"t|j| _#t|j| _$t%|j| _&t|j| _'|  t|j| _(t|j| _)t|j| _*t|j| _+|  t|| _,d S r   )-r  r   r   r   r,   r   r   r   r   r   r   r   r   r   r   	KDCServerr   r	  r   r   rk   r   r   r   r   r   r   r   r   r   r   r   r   r   r  r   r   r   r  r   r  r   r  r  r  r^   r%   r%   r&   r     sF   










z(KIWI_KERBEROS_INTERNAL_TICKET_6.__init__Nr   r%   r%   r%   r&   r=     r   r=   c                       rY   )!PKIWI_KERBEROS_INTERNAL_TICKET_10c                    r[   r\   )r   r   rD   r^   r#   r%   r&   r     r`   z*PKIWI_KERBEROS_INTERNAL_TICKET_10.__init__ra   r%   r%   r#   r&   r    rb   r  c                   @   r   )rD   c                 C   s  t || _t || _t|j| _t|j| _t|| _t|| _	t
|| _t
|| _t
|| _t
|| _t
| _t
| _t|| _t|j| _tj|dddd| _t|j| _t|j| _|  t|| _t|j| _t|j| _t|j| _|d t |j| _!t |j| _"t |j| _#t|j| _$t|j| _%t&|j| _'t|j| _(|  t|j| _)t|j| _*t|j| _+t|j| _,|  t|| _-d S )Nrd   r   Fr   r   ).r  r   r   r   r,   r   r   r   r   r   r   r   r   r   r   r  
unk10586_dr   r	  r   r   rk   r   r   r   r   r   r   r   r   r   r   r   r   r   r  r   r   r   r  r   r  r   r  r  r  r^   r%   r%   r&   r     sJ   










z)KIWI_KERBEROS_INTERNAL_TICKET_10.__init__Nr   r%   r%   r%   r&   rD     r   rD   c                       rY   )!PKIWI_KERBEROS_INTERNAL_TICKET_11c                    r[   r\   )r   r   rJ   r^   r#   r%   r&   r     r`   z*PKIWI_KERBEROS_INTERNAL_TICKET_11.__init__ra   r%   r%   r#   r&   r    rb   r  c                   @   r   )rJ   c                 C   s  t || _t || _t|j| _t|j| _t|| _t|| _	t
|| _t
|| _t
|| _t
|| _t
|| _t
|| _t|| _t|j| _tj|dddd| _t|j| _t|j| _t|j| _t|j| _t|| _t|j| _t|j| _t|j| _ t|j| _!t"|j| _#t"|j| _$t"|j| _%t|j| _&t|j| _'t(|j| _)t|j| _*|+  t|j| _,t|j| _-t|j| _.t|j| _/|+  t|| _0d S r   )1r  r   r   r   r,   r   r   r   r   r   r   r   r   r   r   r  r  r   r	  r   r   rk   r   r   r   
unk14393_0unk2xr   r   r   
unk14393_1r   r   r   r   r   r   r  r   r   r   r  r   r   r  r   r  r  r  r^   r%   r%   r&   r     sL   











z)KIWI_KERBEROS_INTERNAL_TICKET_11.__init__Nr   r%   r%   r%   r&   rJ     r   rJ   c                       rY   )&PKIWI_KERBEROS_INTERNAL_TICKET_10_1607c                    r[   r\   )r   r   rG   r^   r#   r%   r&   r   
  r`   z/PKIWI_KERBEROS_INTERNAL_TICKET_10_1607.__init__ra   r%   r%   r#   r&   r  	  rb   r  c                   @   r   )rG   c                 C   s  t || _t || _t|j| _t|j| _t|| _t|| _	t
|| _t
|| _t
|| _t
|| _t
|| _t
|| _t|| _t|j| _tj|dddd| _t|j| _t|j| _t|j| _|  t|| _t|j| _t|j| _t|j| _ t|j| _!t"|j| _#t"|j| _$t"|j| _%t|j| _&t|j| _'t(|j| _)t|j| _*|  t|j| _+t|j| _,t|j| _-t|j| _.|  t|| _/d S r   )0r  r   r   r   r,   r   r   r   r   r   r   r   r   r   r   r  r  r   r	  r   r   rk   r   r   r   r  r   r   r   r   r  r   r   r   r   r   r   r  r   r   r   r  r   r  r   r  r  r  r^   r%   r%   r&   r     sL   











z.KIWI_KERBEROS_INTERNAL_TICKET_10_1607.__init__Nr   r%   r%   r%   r&   rG     r   rG   c                       rY   )PKERB_HASHPASSWORD_GENERICc                    r[   r\   )r   r   KERB_HASHPASSWORD_GENERICr^   r#   r%   r&   r   9  r`   z#PKERB_HASHPASSWORD_GENERIC.__init__ra   r%   r%   r#   r&   r  8  rb   r  c                   @   r   )r  c                 C   s.   t |j| _|  t|j| _t|| _d S r\   )r   r,   Typer   r   Sizer   	Checksumpr^   r%   r%   r&   r   =  s   z"KERB_HASHPASSWORD_GENERIC.__init__Nr   r%   r%   r%   r&   r  <  r   r  c                       rY   )PKERB_HASHPASSWORD_5c                    r[   r\   )r   r   r2   r^   r#   r%   r&   r   F  r`   zPKERB_HASHPASSWORD_5.__init__ra   r%   r%   r#   r&   r  E  rb   r  c                   @   r   )r2   c                 C   s   t || _t|| _d S r\   )r   saltr  genericr^   r%   r%   r&   r   J  s   
zKERB_HASHPASSWORD_5.__init__Nr   r%   r%   r%   r&   r2   I  r   r2   c                       rY   )PKERB_HASHPASSWORD_6c                    r[   r\   )r   r   r:   r^   r#   r%   r&   r   O  r`   zPKERB_HASHPASSWORD_6.__init__ra   r%   r%   r#   r&   r  N  rb   r  c                   @   r   )r:   c                 C   s"   t || _t|| _t|| _d S r\   )r   r  r   stringToKeyr  r  r^   r%   r%   r&   r   S  s   

zKERB_HASHPASSWORD_6.__init__Nr   r%   r%   r%   r&   r:   R  r   r:   c                       rY   )PKERB_HASHPASSWORD_6_1607c                    r[   r\   )r   r   rH   r^   r#   r%   r&   r   \  r`   z"PKERB_HASHPASSWORD_6_1607.__init__ra   r%   r%   r#   r&   r  [  rb   r  c                   @   r   )rH   c                 C   s0   t || _t|j| _t|j| _t|| _d S r\   )r   r  r   r,   r  r   r  r  r^   r%   r%   r&   r   _  s   
z!KERB_HASHPASSWORD_6_1607.__init__Nr   r%   r%   r%   r&   rH   ^  r   rH   c                       rY   )PKIWI_KERBEROS_KEYS_LIST_5c                    r[   r\   )r   r   r1   r^   r#   r%   r&   r   f  r`   z#PKIWI_KERBEROS_KEYS_LIST_5.__init__ra   r%   r%   r#   r&   r  e  rb   r  c                   @      e Zd Zdd Zdd ZdS )r1   c                 C   sD   t |j| _t |j| _t|j| _t|j| _| | _g | _	d S r\   )
r   r,   r   cbItemr   r   r   re   KeyEntries_start
KeyEntriesr^   r%   r%   r&   r   j  s   

z"KIWI_KERBEROS_KEYS_LIST_5.__init__c                 C   0   | | j t| jD ]
}| j|| qd S r\   mover"  ranger!  r#  appendr!   r_   keyentries_type_r%   r%   r&   rk   s     zKIWI_KERBEROS_KEYS_LIST_5.readNrT   rU   rV   r   rk   r%   r%   r%   r&   r1   i  s    	r1   c                       rY   )PKIWI_KERBEROS_KEYS_LIST_6c                    r[   r\   )r   r   r9   r^   r#   r%   r&   r   y  r`   z#PKIWI_KERBEROS_KEYS_LIST_6.__init__ra   r%   r%   r#   r&   r.  x  rb   r.  c                   @   r   )r9   c                 C   s\   t |j| _t |j| _t|j| _t|j| _t|j| _t|j| _|	 | _
g | _d S r\   )r   r,   r   r!  r   r   r   r   r   re   r"  r#  r^   r%   r%   r&   r   |  s   

z"KIWI_KERBEROS_KEYS_LIST_6.__init__c                 C   r$  r\   r%  r)  r%   r%   r&   rk     r,  zKIWI_KERBEROS_KEYS_LIST_6.readNr-  r%   r%   r%   r&   r9   {  s    r9   c                       rY   )PKIWI_KERBEROS_ENUM_DATA_TICKETc                    r[   r\   )r   r   KIWI_KERBEROS_ENUM_DATA_TICKETr^   r#   r%   r&   r     r`   z(PKIWI_KERBEROS_ENUM_DATA_TICKET.__init__ra   r%   r%   r#   r&   r/    rb   r/  c                   @   r   )r0  c                 C   s   t |j| _t |j| _d S r\   )r   r,   isTicketExportisFullTicketr^   r%   r%   r&   r     s   z'KIWI_KERBEROS_ENUM_DATA_TICKET.__init__Nr   r%   r%   r%   r&   r0    r   r0  c                   @   r   )r   c                 C   s(   t |j| _|  t|| _d | _d S r\   )r   r,   Lengthr   r   ValueDatar^   r%   r%   r&   r     s   

zKIWI_KERBEROS_BUFFER.__init__c                 C   s   | j || j| _| jS r\   )r4  read_rawr3  r5  r^   r%   r%   r&   rk     s   zKIWI_KERBEROS_BUFFER.readNr-  r%   r%   r%   r&   r     s    r   c                   @   r   )KerberosHashPasswordc                 C   s   d | _ d | _d | _d | _d S r\   )r  
iterationsaes128aes256r!   r%   r%   r&   r     s   
zKerberosHashPassword.__init__Nr   r%   r%   r%   r&   r7    r   r7  c                   @   s,   e Zd Zdd Zdd Zdd Zdd Zd	S )
KerberosCredentialc                 C   s.   d | _ d | _d | _d | _d | _d | _d | _d S r\   )luidusername
domainnamepasswordpassword_raw
aes_key128
aes_key256r;  r%   r%   r&   r     s   
zKerberosCredential.__init__c                 C   sh   d}|d| j  7 }|d| j 7 }| jr|d| j 7 }| jr&|d| j  7 }| jr2|d| j  7 }|S )Nz		== Kerberos ==
z		Username: %s
z		Domain: %s
z		Password: %s
z		AES128 Key: %s
z		AES256 Key: %s
)r>  r?  r@  rB  hexrC  r   r%   r%   r&   __str__  s   zKerberosCredential.__str__c                 C   s`   i }d|d< | j |d< | j|d< | j|d< | j|d< | jr$| j |d< | jr.| j |d< |S )	Nkerberoscredtyper>  r?  r@  rA  r9  r:  )r>  r?  r@  rA  rB  rD  rC  r   r%   r%   r&   to_dict  s   



zKerberosCredential.to_dictc                 C   sd   g }| j r|d| j| jddd| j  ddf  | jr0|d| j| jdddd| j df  |S )Nz kerberos	%s	%s	%s	%s	%s	%s	%s	%sr|   )rB  r(  r>  r?  rD  rC  )r!   linesr%   r%   r&   to_grep_line  s0   

zKerberosCredential.to_grep_lineN)rT   rU   rV   r   rE  rH  rJ  r%   r%   r%   r&   r<    s
    	r<  )Vrl   minidump.win_datatypesr   r   r   r   r   pypykatz.commons.commonr   r   r	   pypykatz.commons.win_datatypesr
   r   r   r   r   r   r   r   r   r   %pypykatz.lsadecryptor.package_commonsr   r   r   rZ   r]   r   r   r   r3   r   r;   r   r?   r   rB   r   r/   r   r5   r   r   r   rO   rA   r   r   r   r   r   rF   rK   rQ   r   r0   r  r6   r
  r8   r  r=   r  rD   r  rJ   r  rG   r  r  r  r2   r  r:   r  rH   r  r1   r.  r9   r/  r0  r   r7  r<  r%   r%   r%   r&   <module>   s   0 P)-&)7,
<,3$"$*)+*		