o js @sddlmZGdddZdS)) RDPCredParserc@s4eZdZddZddZddZddZd d Zd S) RDPCMDHelpercCsdg|_dg|_dS)Nrdp) live_keywordskeywords)selfr/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/rdp/cmdhelper.py__init__ s zRDPCMDHelper.__init__c Cs|jddd}|}d|_d|_|jddd}|jdtd d |jd d d d|jddd}|jdtd d |jd d dd|jddd}|}d|_d|_|jddd} | jddgd| jddd|jddd} | jddgd| jddddS)Nra)helpTlive_rdp_modulelogonpasswordsz#Parse RDP credentials (SERVER side)z--pidz+Search a specific process PID for RDP creds)typer z--all store_truez;Looks for all processes which use the rdp DLL rdpcorets.dll)actionr mstscz#Parse RDP credentials (CLIENT side)z9Looks for all processes which use the rdp DLL mstscax.dllz(Parse RDP credentials from minidump file rdp_modulezgParse RDP credentials (SERVER side) from minidump file. Plain-text passwords only for WINVER <= Win2012cmdminidump)choices memoryfilezpath to the dump filezgParse RDP credentials (CLIENT side) from minidump file. Unable to recover plain-text passwords offline.) add_parseradd_subparsersrequireddest add_argumentint) rparser live_parser live_grouplive_rdp_subparserslive_logonpasswords_grouplive_mstsc_groupgrouprdp_subparserslogonpasswords_group mstsc_grouprrr add_argss(zRDPCMDHelper.add_argscCsbt|jdkr|j|jvr||t|jdkr+|jdkr-|j|jvr/||dSdSdSdS)Nrlive)lenrcommandrunrmodulerun_live)rargsrrr execute-s  $ zRDPCMDHelper.executecCs<tj|j|j|jd}|D]}|jD]}tt|qq dS)N)pidall_rdpr )rgo_liver1allr credentialsprintstrrr/ credparsers credparsercredrrr r.4s  zRDPCMDHelper.run_livecCs6t|j|j}|D]}|jD]}tt|qq dS)N)rparse_minidump_filerrr5r6r7r8rrr r,:s  zRDPCMDHelper.runN)__name__ __module__ __qualname__r r(r0r.r,rrrr r s  rN)pypykatz.rdp.parserrrrrrr s