
    Xf]                         d dl Z d dlmZ d dlmZ d dlmZmZ d dlm	Z	 d dl
mZmZ d dlmZ d dlmZ d d	lmZ d d
lmZmZ d dlmZ  e j        e          Z G d dej        j                  ZdS )    N)unpack)Tuple)ARC4AES)HMAC)
interfaces	renderers)requirements)registry)versions)hashdumplsadump)hivelistc                      e Zd ZdZdZdZed             Zede	j
        dedefd            Zed	ed
edefd            Zededeeeeeef         fd            Zedededededeeeeef         f
d            Zd Zd ZdS )	CachedumpzDumps lsa secrets from memory)   r   r      r   r   c                     t          j        ddddg          t          j        dt          j        d          t          j        d	t
          j        d          t          j        d
t          j        d          gS )NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturesr   r   )r   pluginversionr   r   )r   r   r   )	r
   ModuleRequirementPluginRequirementr   HiveListr   Lsadumpr   Hashdump)clss    a/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/cachedump.pyget_requirementszCachedump.get_requirements   s     *,()4  
 *(99   *w	   *(99  
 	
    sechivelsakeyis_vista_or_laterc                 F    t           j                            | d||          S )NzNL$KM)r   r!   get_secret_by_name)r'   r(   r)   s      r$   get_nlkmzCachedump.get_nlkm.   s(     11Wf&7
 
 	
r&   edatanlkmxpc                    |rSt          j        ||          }|                                }t          j        |          }|                    |           }nt          j        |dd         t
          j        |          }d}t          dt          |           d          D ]R}	| |	|	dz            }
t          |
          dk     r|
dt          |
          z
  dz  z  }
||	                    |
          z  }S|S )N       r&   r       )
r   newdigestr   encryptr   MODE_CBCrangelendecrypt)r-   r.   chr/   hmac_md5rc4keyrc4dataaesibufs              r$   decrypt_hashzCachedump.decrypt_hash6   s     	)xb))H__&&F(6""C;;u%%DD '$r"u+s|R88CD1c%jj"-- ) )ABJ's88b==BSMV33CC(((r&   
cache_datareturnc                     t          d| d d                   \  }}t          | dd                   dk    r||dddfS t          d| dd                   \  }| dd	         }| d
d          }|||||fS )Nz<HH   <   >   r   r&   z<H@   P   `   )r   r9   )rD   	uname_len
domain_lendomain_name_lenr;   enc_datas         r$   parse_cache_entryzCachedump.parse_cache_entryH   s    "(
2A2"?"?Jz"R% !!Q&&z1c377#D*RU*;<<2bcc?:"EEr&   dec_datarM   rN   rO   c                 l   d}d|dz  dz  z  }t          ||z   |z             }d|dz  dz  z  }t          ||z   |z             }| dd         }| |||z                                dd          }	| |||z                                dd          }
| |||z                                dd          }|	|
||fS )zYGet the data from the cache and separate it into the username, domain name, and hash dataH   r   Nr1   z	utf-16-lereplace)intdecode)rR   rM   rN   rO   uname_offsetpaddomain_offsetdomain_name_offsethashhusernamedomaindomain_names               r$   parse_decrypted_cachezCachedump.parse_decrypted_cacheR   s    
 IMQ&'L94s:;;JNa'( !;c!ABB$L<)+CCDKK
 
 --**DDELL
 
 !3o!EE

&i
(
( 	 &+u55r&   c              #   Z  K   |r|s:|t                               d           |t                               d           d S t          j                            |          }|st                               d           d S | j        j        | j        d                  }t          j	        | j        |j
                  }t          j                            |||          }|st                               d           d S |                     |||          }|st                               d           d S t          j                            |d          }|st                               d	           d S |                                D ]}	|	j        d
k    r|                    |	j        dz   |	j                  }
|
4|                     |
          \  }}}}}|dk    st-          |          dk    ri|                     ||||           }|                     ||||          \  }}}}d||||ffV  d S )NzUnable to locate SYSTEM hivezUnable to locate SECURITY hivezUnable to find bootkeyr   )contextsymbol_tablezUnable to find lsa keyzUnable to find nlkma keyCachezUnable to find cache keyz
NL$ControlrG   r   )vollogwarningr   r"   get_bootkeyrb   modulesconfigr   r)   symbol_table_namer   r!   get_lsa_keyr,   get_hive_key
get_valuesNamereadData
DataLengthrQ   r9   rC   r`   )selfsyshiver'   bootkeyr   vista_or_laterr(   r.   cache
cache_itemr?   rM   rN   rO   rP   r;   rR   r]   r^   r_   r\   s                        r$   
_generatorzCachedump._generatori   s^      	g 	=>>>?@@@4#//88 	NN34444%dk(&;<!3Lv/G
 
 
 ,,Wg~NN 	NN34444}}Wfn== 	NN56664!..w@@ 	NN56664**,, 	> 	>J,..<<
! 3Z5JKKD| &&t,, A~~RA((4=OPPH595O5O)Z6 62Xv{E xe<=====-	> 	>r&   c                    | j                             dd           }d x}}| j        j        | j         d                  }t          j                            | j        | j        |j        |j	        |d n|g          D ]}|
                                                    d          d                                         dk    r|}|
                                                    d          d                                         dk    r|}t          j        dt          fd	t          fd
t          fdt           fg|                     ||                    S )Noffsetr   )hive_offsets\SYSTEMSECURITYUsernameDomainzDomain nameHash)ri   getrb   rh   r   r    
list_hivesconfig_path
layer_namerj   get_namesplitupperr	   TreeGridstrbytesrx   )rr   rz   rs   r'   r   hives         r$   runzCachedump.run   s8   400  '%dk(&;<%00L$!'fX 1 
 
 
	 
	D }}$$T**2.4466(BB}}$$T**2.4466*DD!#3-1EPUWOOGW--
 
 	
r&   N)__name__
__module____qualname____doc___required_framework_version_versionclassmethodr%   staticmethodr   RegistryHiver   boolr,   rC   r   rV   rQ   r   r`   rx   r    r&   r$   r   r      sg       ''"+H
 
 [
$ 
&
05
JN
 
 
 \
 E      \" Fe Fc3UE6Q0R F F F \F 66$'6586KN6	sCe#	$6 6 6 \6,8> 8> 8>t
 
 
 
 
r&   r   )loggingstructr   typingr   Crypto.Cipherr   r   Crypto.Hashr   volatility3.frameworkr   r	   #volatility3.framework.configurationr
   volatility3.framework.layersr   %volatility3.framework.symbols.windowsr   volatility3.plugins.windowsr   r   $volatility3.plugins.windows.registryr   	getLoggerr   re   pluginsPluginInterfacer   r   r&   r$   <module>r      s,                # # # # # # # #       7 7 7 7 7 7 7 7 < < < < < < 1 1 1 1 1 1 : : : : : : 9 9 9 9 9 9 9 9 9 9 9 9 9 9		8	$	$c
 c
 c
 c
 c

"2 c
 c
 c
 c
 c
r&   