
    Xf]                         d dl Z d dlmZ d dlmZ d dlmZmZ d dlm	Z	 d dl
mZmZ d dlmZ d dlmZ d d	lmZ d d
lmZmZ d dlmZ  e j0                  e      Z G d dej6                  j8                        Zy)    N)unpack)Tuple)ARC4AES)HMAC)
interfaces	renderers)requirements)registry)versions)hashdumplsadump)hivelistc                       e Zd ZdZdZdZed        Zede	j                  dedefd       Zed	ed
edefd       Zededeeeeeef   fd       Zedededededeeeeef   f
d       Zd Zd Zy)	CachedumpzDumps lsa secrets from memory)   r   r      r   r   c                    t        j                  ddddg      t        j                  dt        j                  d      t        j                  d	t
        j                  d      t        j                  d
t        j                  d      gS )NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturesr   r   )r   pluginversionr   r   )r   r   r   )	r
   ModuleRequirementPluginRequirementr   HiveListr   Lsadumpr   Hashdump)clss    a/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/cachedump.pyget_requirementszCachedump.get_requirements   s     **,()4
 **(9(99 **w	 **(9(99
 	
    sechivelsakeyis_vista_or_laterc                 F    t         j                  j                  | d||      S )NzNL$KM)r   r!   get_secret_by_name)r'   r(   r)   s      r$   get_nlkmzCachedump.get_nlkm.   s%     11Wf&7
 	
r&   edatanlkmxpc                    |rNt        j                  ||      }|j                         }t        j                  |      }|j	                  |       }|S t        j                  |dd t
        j                  |      }d}t        dt        |       d      D ]@  }	| |	|	dz    }
t        |
      dk  r|
dt        |
      z
  dz  z  }
||j                  |
      z  }B |S )N       r&   r       )
r   newdigestr   encryptr   MODE_CBCrangelendecrypt)r-   r.   chr/   hmac_md5rc4keyrc4dataaesibufs              r$   decrypt_hashzCachedump.decrypt_hash6   s    xxb)H__&F((6"C;;u%D  ''$r"+s||R8CD1c%j"- )AB's8b=BSMV33CC((	)
 r&   
cache_datareturnc                     t        d| d d       \  }}t        | dd       dk(  r||dddfS t        d| dd       \  }| dd	 }| d
d  }|||||fS )Nz<HH   <   >   r   r&   z<H@   P   `   )r   r9   )rD   	uname_len
domain_lendomain_name_lenr;   enc_datas         r$   parse_cache_entryzCachedump.parse_cache_entryH   s|    "(
2A"?Jz"R !Q&z1c377#D*R*;<2bc?:"EEr&   dec_datarM   rN   rO   c                    d}d|dz  dz  z  }t        ||z   |z         }d|dz  dz  z  }t        ||z   |z         }| dd }| |||z    j                  dd      }	| |||z    j                  dd      }
| |||z    j                  dd      }|	|
||fS )zYGet the data from the cache and separate it into the username, domain name, and hash dataH   r   Nr1   z	utf-16-lereplace)intdecode)rR   rM   rN   rO   uname_offsetpaddomain_offsetdomain_name_offsethashhusernamedomaindomain_names               r$   parse_decrypted_cachezCachedump.parse_decrypted_cacheR   s    
 IMQ&'L94s:;JNa'( !;c!AB$L<)+CDKK
 --**DELL
 !3o!E

&i
( 	 &+u55r&   c              #   "  K   |r|s/|t         j                  d       |t         j                  d       y t        j                  j	                  |      }|st         j                  d       y | j
                  j                  | j                  d      }t        j                  | j
                  |j                        }t        j                  j                  |||      }|st         j                  d       y | j                  |||      }|st         j                  d       y t        j                  j                  |d      }|st         j                  d	       y |j!                         D ]  }	|	j"                  d
k(  r|j%                  |	j&                  dz   |	j(                        }
|
?| j+                  |
      \  }}}}}|dk(  st-        |      dk(  rj| j/                  ||||       }| j1                  ||||      \  }}}}d||||ff  y w)NzUnable to locate SYSTEM hivezUnable to locate SECURITY hivezUnable to find bootkeyr   )contextsymbol_tablezUnable to find lsa keyzUnable to find nlkma keyCachezUnable to find cache keyz
NL$ControlrG   r   )vollogwarningr   r"   get_bootkeyrb   modulesconfigr   r)   symbol_table_namer   r!   get_lsa_keyr,   get_hive_key
get_valuesNamereadData
DataLengthrQ   r9   rC   r`   )selfsyshiver'   bootkeyr   vista_or_laterr(   r.   cache
cache_itemr?   rM   rN   rO   rP   r;   rR   r]   r^   r_   r\   s                        r$   
_generatorzCachedump._generatori   s    g=>?@##//8NN34%%dkk(&;<!33LLv/G/G
 ,,Wg~NNN34}}Wfn=NN56!!..w@NN56**, 	>J,.<<
! 3Z5J5JKD| &&t, A~RA((4=OPH595O5O)Z62Xv{E xe<==-	>s   HHc                    | j                   j                  dd       }d x}}| j                  j                  | j                   d      }t        j
                  j                  | j                  | j                  |j                  |j                  |d n|g      D ]m  }|j                         j                  d      d   j                         dk(  r|}|j                         j                  d      d   j                         dk(  sl|}o t        j                  dt        fd	t        fd
t        fdt         fg| j#                  ||            S )Noffsetr   )hive_offsets\SYSTEMSECURITYUsernameDomainzDomain nameHash)ri   getrb   rh   r   r    
list_hivesconfig_path
layer_namerj   get_namesplitupperr	   TreeGridstrbytesrx   )rr   rz   rs   r'   r   hives         r$   runzCachedump.run   s+   40  '%%dkk(&;<%%00LL$$!'fX 1 
 
	D }}$$T*2.446(B}}$$T*2.446*D
	 !!#3-1EPUWOOGW-
 	
r&   N)__name__
__module____qualname____doc___required_framework_version_versionclassmethodr%   staticmethodr   RegistryHiver   boolr,   rC   r   rV   rQ   r   r`   rx   r    r&   r$   r   r      s   '"+H
 
$ 
&&
05
JN
 
 E    " Fe Fc3UE6Q0R F F 66$'6586KN6	sCe#	$6 6,8>t
r&   r   )loggingstructr   typingr   Crypto.Cipherr   r   Crypto.Hashr   volatility3.frameworkr   r	   #volatility3.framework.configurationr
   volatility3.framework.layersr   %volatility3.framework.symbols.windowsr   volatility3.plugins.windowsr   r   $volatility3.plugins.windows.registryr   	getLoggerr   re   pluginsPluginInterfacer   r   r&   r$   <module>r      sT       #  7 < 1 : 9 9			8	$c

""22 c
r&   