X f<ddlZddlZddlZddlmZmZddlmZmZm Z ddl m Z m Z m Z ddlmZddlmZmZddlmZddlmZdd lmZejeZGd d ejjZdS) N)packunpack)ListOptionalTuple)AESARC4DES)MD5) interfaces renderers) requirements)registry)hivelistc eZdZdZdZdZedZgdZgdZ dZ dZ d Z d Z d Zd Zd ZedejdefdZedejdeejjfdZedejdeefdZedejdedeefdZededededeefdZedejdejdedee eeffdZ!ede"de eeffdZ#ed edefd!Z$ed"e"deded#efd$Z%edejdejdeefd%Z&dejdejfd&Z'd'Z(d(S))HashdumpzDumps user hashes from memory)rr)rrcvtjddddgtjdtjdgS) NkernelzWindows kernelIntel32Intel64)name description architecturesr)rrr)rpluginversion)rModuleRequirementPluginRequirementrHiveList)clss `/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/hashdump.pyget_requirementszHashdump.get_requirementssR  *,()4     *(99     (rrrrr%r&r' r( r)r*r+r,r-r.r/r0r1r2 r3#r4%r5&r6)r7*r8,r9/r:1r;2r<4r=7r>8r?;r@=rA>rB@rCCrDErEFrFIrGJrHLrIOrJQrKRrLTrMWrNXrO[rP]rQ^rRarSbrTdrUgrVhrWkrXmrYnrZpr[sr\ur]vr^yr_zr`|rarbrcrdrerfrgrhrirjrkrlrmrnrorprqrrrsrtrurvrwrxryrzr{r|r}r~rrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr)r'r%rr( r)rr r* r&s/!@#$%^&*()qwertyUIOPAzxcvbnmQQQQQQQQQQQQ)(*@&%s)0123456789012345678901234567890123456789s NTPASSWORDs LMPASSWORDsKGS!@#$%sӴ5Ӵ5s1j1z*Hashdump.get_user_keys.._s$GGGaQVw5F5F5F5F5Fr$)r get_subkeys)r!r user_key_pathuser_keys r" get_user_keyszHashdump.get_user_keysUsK7 ##G];; IGG8//11GGGGr$syshivec d}d|ddz}gd}||}|sdSd}|D]b}||dz|z}d} |r#||jdz|j} | dS|| d z }ct j| t fd tt D} | S) Nr ControlSet03z \Control\Lsa)JDSkew1GBGDatarr% utf-16-lec6g|]}j|S)bootkey_perm_table)ri bootkey_strr!s r"rz(Hashdump.get_bootkey..zs& U U U[/2 3 U U Ur$) rreadClass ClassLengthdecodebinascii unhexlifybytesrangelen) r!rcslsa_baselsa_keyslsabootkeylkr class_databootkey_scrambledrs ` @r" get_bootkeyzHashdump.get_bootkeyas  ''''*::111w11 4 6 6B""7HtOb,@AACJ J$\\#)a-II !tt z((55 5GG(11 ! U U U U UU3{CSCS=T=T U U U  ! r$rcd}|sdS|||}|sdSd}|D]=}|dkr#||jdz|j}>|sdS|d}|dkrt j}||dd|j z|z|j z| } tj | } | |dd} | S|d krS|d d } |d d } tj |tj| }|| } | dd SdS)NzSAM\Domains\AccountFr%rrr[rcrxrwr+)r get_valuesrrr DataLengthhashlibmd5updateaqwertyanumdigestr newencryptrMODE_CBCdecrypt)r!rrsam_account_pathsam_account_keysam_datavrevisionrrc4_keyrc4hbootkeyivencryptedHBootKeyciphers r" get_hbootkeyzHashdump.get_hbootkey~s3 4**74DEE 4 ++-- B BAzz||s"""<< ALAA 4D> q==+--C JJxT *S[87BSXM N N NjjllG(7##C{{d#HO ]]$t)$B (d 3 WWclB77F~~&788HCRC= tr$renc_hashsaltc||\}}tj|tj}tj|tj} t j|ddtj|} | |} || dd| | ddzS)Nr+r') sid_to_keyr rMODE_ECBrrr) r!ridrr_lmntstrrdes_k1des_k2des1des2robfkeys r"decrypt_single_salted_hashz#Hashdump.decrypt_single_salted_hashs>>#..wvs|,,wvs|,,#2# d;;))||F2A2J''$,, 1R4L+ +   r$userc tt|d}n#t$rYdSwxYwd}|D]=}|dkr#||jdz|j}>|sdStd|ddddz}td|dd d}td|d d ddz} td|d d d} ||d z|dz} d} | dkr4|dkr-||dz|dz} | ||| |j } nJ| dkrD|dkr>||dz|dz}||dz|dz} | ||| |j |} d}|| d z| dz}|dkr4| dkr-|| dz| dz}| ||||j }nJ|dkrD| dkr>|| dz| dz}|| dz| dz}| ||||j |}| |fS)Nr+Vr%#AB&y2~ B'FG 77; y1}y1}<= ' ! !||&y1}y2~'EF 00;G # #||"9q=9r>#AB&y2~ B'FG 77;v~s/2 AAsidc|dz|dz dz|dz dz|dz dzg}||ddz }|dg|ddz}||ddz }|t||t|fS)zITakes rid of a user and converts it to a key to be used by the DES cipherr'r+rrr)sidbytes_to_keyr)r!r+bytestr1bytestr2s r"rzHashdump.sid_to_keys $J AX  BY$  BY$    HQqSM!QK=8AaC=0HQqSM!""5??33S5H5H (OO6 6   r$sc |ddz |ddzdz|ddz z|ddzdz|ddz z|ddzdz|ddz z|dd zdz|ddz z|dd zdz|ddz z|dd zdz|ddz z|dd zg}td D]&}||dz||<|j||||<'t|S)z=Builds final DES key from the strings generated in sid_to_keyrrrrrrr&r%rr2?rbr')r odd_parityr)r!r1rrs r"r.zHashdump.sidbytes_to_keys aDAIdTka AaDAI .dTka AaDAI .dTka AaDAI .dTka AaDAI .dTka AaDAI .dTka AaDAI . aD4K  q , ,AVq[CF^CF+CFFSzzr$rlmntstrc&||\}}tj|tj}tj|tj}t j} | |ddt d|z|z| } tj| } | |} | | dd| | ddzS)Nr+rr') rr rrr rrrr rr) r!rrrr5rrr r rrrr s r"rzHashdump.decrypt_single_hash s>>#..wvs|,,wvs|,,gii 8ETE?T$__4w>???**,,hwX&&||F2A2J''$,, 122J+ +   r$cxd}|D]=}|dkr#||jdz|j}>|sdSt d|ddddz}t d|ddd}|t |krdS||||z}|S) Nrr%rrr+rrr)rrrrrrr)r!r rvaluer name_offset name_lengthusernames r" get_user_namezHashdump.get_user_names"" ? ?Azz||s"" QVaZ>> 4T5d#344Q7$> T5d#344Q7 U # #4{['@@Ar$c# K|td|td||}|||}|r||D]}||||}|r|\}}|||} | tj} nt| dd} ttj |p|j d} ttj |p|j d} tt|d} d| | | | ffVdStd dS) Nz,SYSTEM address is None: No system hive foundz&SAM address is None: No SAM hive foundrignore)errorszlatin-1r+rzHbootkey is not valid)rdebugrrrr*r<r NotAvailableValuerrhexlifyempty_lmempty_ntrrwarning) selfrrrrr retr#r&rlmoutntoutrs r" _generatorzHashdump._generator3s ? LLG H H H ? LLA B B B""7++$$Wg66  4**733 9 9**4(CC9%(NFF --dG<rvs,((((((((((((((((((((77777777<<<<<<EEEEEE999999  8 $ $P  P  P  P  P  z!1P  P  P  P  P  r$