
    Xf<                         d dl Z d dlZd dlZd dlmZmZ d dlmZmZm	Z	 d dl
mZmZmZ d dlmZ d dlmZmZ d dlmZ d dlmZ d d	lmZ  ej2                  e      Z G d
 dej8                  j:                        Zy)    N)packunpack)ListOptionalTuple)AESARC4DES)MD5)
interfaces	renderers)requirements)registry)hivelistc                      e Zd ZdZdZdZed        Zg dZg dZ	dZ
dZd	Zd
ZdZdZdZedej$                  defd       Zedej$                  deej.                  j0                     fd       Zedej$                  dee   fd       Zedej$                  dedee   fd       Zededededee   fd       Zedej>                  dej$                  dedee eef      fd       Z!ede"de eef   fd       Z#ed edefd!       Z$ed"e"deded#efd$       Z%edej>                  dej$                  dee   fd%       Z&dej$                  dej$                  fd&Z'd' Z(y())HashdumpzDumps user hashes from memory)   r   r   )   r   r   c                     t        j                  ddddg      t        j                  dt        j                  d      gS )	NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturesr   )r   r   r   )r   pluginversion)r   ModuleRequirementPluginRequirementr   HiveList)clss    `/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/hashdump.pyget_requirementszHashdump.get_requirements   sG     **,()4
 **(9(99	
 		
    (   r   r   r   r      r%      r&      r'      r(      r)      r*      r+      r,      r-      r.      r/      r0      r1      r2       r3   #   r4   %   r5   &   r6   )   r7   *   r8   ,   r9   /   r:   1   r;   2   r<   4   r=   7   r>   8   r?   ;   r@   =   rA   >   rB   @   rC   C   rD   E   rE   F   rF   I   rG   J   rH   L   rI   O   rJ   Q   rK   R   rL   T   rM   W   rN   X   rO   [   rP   ]   rQ   ^   rR   a   rS   b   rT   d   rU   g   rV   h   rW   k   rX   m   rY   n   rZ   p   r[   s   r\   u   r]   v   r^   y   r_   z   r`   |   ra      rb      rc      rd      re      rf      rg      rh      ri      rj      rk      rl      rm      rn      ro      rp      rq      rr      rs      rt      ru      rv      rw      rx      ry      rz      r{      r|      r}      r~      r      r      r      r      r      r      r      r      r      r      r      r      r      r      r      r      r      r      r      r      r      r      r      r      r      r      r      r      r      r      r      r      r      r      r      r   )r'      r%   r   r(   	   r)      r      r      r*   
      r&   s/   !@#$%^&*()qwertyUIOPAzxcvbnmQQQQQQQQQQQQ)(*@&% s)   0123456789012345678901234567890123456789 s   NTPASSWORD s   LMPASSWORD s   KGS!@#$%s   Ӵ5Ӵ5s   1j1<Yhivekeyc                     d }	 |r|j                  |      }|S # t        $ r. t        j                  d|j	                          d| d       Y |S w xY w)Nz)Unable to load the required registry key \z from this memory image)get_keyKeyErrorvolloginfoget_name)r!   r   r   results       r"   get_hive_keyzHashdump.get_hive_keyI  sb    	c*
 	  	KK;DMMO;LBseSjk 		s    3AAsamhivereturnc                     d}| j                  ||      }|sg S |j                         D cg c]  }|j                  dk7  s| c}S c c}w )NzSAM\Domains\Account\UsersNames)r   get_subkeysName)r!   r   user_key_pathuser_keyks        r"   get_user_keyszHashdump.get_user_keysU  sK     7##G];I#//1GaQVVw5FGGGs   A Asyshivec                    d}d|ddz   }g d}| j                  ||      }|sy d}|D ]_  }| j                  ||dz   |z         }d }	|r)|j                  |j                  dz   |j                        }	|	 y ||	j	                  d	      z  }a t        j                  |      }
t        t        t        |
            D cg c]  }|
| j                  |       c}      }|S c c}w )
Nr   
ControlSet03z\Control\Lsa)JDSkew1GBGData r   r%   	utf-16-le)r   readClassClassLengthdecodebinascii	unhexlifybytesrangelenbootkey_perm_table)r!   r   cslsa_baselsa_keyslsabootkeylkr   
class_databootkey_stribootkey_scrambleds                r"   get_bootkeyzHashdump.get_bootkeya  s    2w'*::1w1 	6B""7HtOb,@ACJ$\\#))a-I
!z((55G	6 ((1!=B3{CS=TU[//23U
 !  Vs   ;Cr   c                    d}|sy | j                  ||      }|sy d }|j                         D ]?  }|j                         dk(  s|j                  |j                  dz   |j
                        }A |sy |d   }|dk(  rt        j                         }|j                  |dd | j                  z   |z   | j                  z          |j                         }	t        j                  |	      }
|
j                  |dd       }|S |d	k(  rE|d
d }|dd }t        j                  |t        j                   |      }|j#                  |      }|d d S y )NzSAM\Domains\AccountFr%   r   r   r[   rc      r   x      rw   r+   )r   
get_valuesr   r   r   
DataLengthhashlibmd5updateaqwertyanumdigestr	   newencryptr   MODE_CBCdecrypt)r!   r   r   sam_account_pathsam_account_keysam_datavrevisionr   rc4_keyrc4hbootkeyivencryptedHBootKeyciphers                  r"   get_hbootkeyzHashdump.get_hbootkey~  sK    3**74DE ++- 	BAzz|s""<<
ALLA	B D>q=++-CJJxT*S[[87BSXXMNjjlG((7#C{{d#H O]$t$B (d 3WWWcllB7F~~&78HCR= r$   r   enc_hashsaltc                 ~   | j                  |      \  }}t        j                  |t        j                        }t        j                  |t        j                        }	t	        j                  |d d t        j
                  |      }
|
j                  |      }|j                  |d d       |	j                  |dd       z   S )Nr+   r'   )
sid_to_keyr
   r   MODE_ECBr   r   r   )r!   ridr   r   _lmntstrr   des_k1des_k2des1des2r   obfkeys               r"   decrypt_single_salted_hashz#Hashdump.decrypt_single_salted_hash  s     >>#.wwvs||,wwvs||,#2d;)||F2AJ'$,,1RL+
 
 	
r$   userc                    	 t        t        |j                               d      }d }|j	                         D ]?  }|j                         dk(  s|j                  |j                  dz   |j                        }A |sy t        d|dd       d   dz   }t        d|dd	       d   }t        d|d
d       d   dz   }	t        d|dd       d   }
||dz   |dz    }d }|dk(  r/|dk(  ri||dz   |dz    }| j                  |||| j                        }n?|dk(  r:|dk(  r5||dz   |dz    }||dz   |dz    }| j                  |||| j                  |      }d }||	dz   |	dz    }|dk(  r2|
dk(  r)||	dz   |	dz    }| j                  |||| j                        }||fS |dk(  r:|
dk(  r5||	dz   |	dz    }||	dz   |	dz    }| j                  |||| j                  |      }||fS # t        $ r Y y w xY w)Nr+   Vr%   <L   r   r      ru   rw      r{   r   r            r?   r=   r'      )intstrr   
ValueErrorr   r   r   r   r   decrypt_single_hashalmpasswordr  antpassword)r!   r  r   r   r   r   r   	lm_offsetlm_len	nt_offsetnt_lenlm_revisionlmhashenc_lm_hashlm_saltnthashnt_revisionenc_nt_hashnt_salts                      r"   get_user_hasheszHashdump.get_user_hashes  sl   
	c$--/*B/C " 	BAzz|s""<<
ALLA	B 4$t!45a84?	htD12154$t!45a84?	htD1215y1}y1}='!|&y4'7)d:JK00; G#|"9q=9r>B&y2~	BG77;
 y1}y1}='!|&y1}y2~F00; v~ G#|"9q=9r>B&y2~	BG77; v~]  		s   #G 	GGsidc                     |dz  |dz	  dz  |dz	  dz  |dz	  dz  g}||dd z  }|d   g|dd z   }||dd z  }| j                  t        |            | j                  t        |            fS )zITakes rid of a user and converts it to a key to be used by the DES cipher   r'   r+   r  r   r   )sidbytes_to_keyr   )r!   r&  bytestr1bytestr2s       r"   r   zHashdump.sid_to_key  s     $JAXBY$BY$	
 	HQqM!QK=8Aa=0HQqM!""5?3S5H5H(O6
 
 	
r$   sc           	      |   |d   dz	  |d   dz  dz  |d   dz	  z  |d   dz  dz  |d   dz	  z  |d   dz  dz  |d   dz	  z  |d   d	z  dz  |d   dz	  z  |d   d
z  dz  |d   dz	  z  |d   dz  dz  |d   dz	  z  |d   dz  g}t        d      D ]"  }||   dz  ||<   | j                  ||      ||<   $ t        |      S )z=Builds final DES key from the strings generated in sid_to_keyr   r   r   r   r   r   r&   r%   r   r2   ?   rb   r'   )r   
odd_parityr   )r!   r,  r   r   s       r"   r)  zHashdump.sidbytes_to_key  s    aDAIdTkaAaDAI.dTkaAaDAI.dTkaAaDAI.dTkaAaDAI.dTkaAaDAI.dTkaAaDAI.aD4K	
 q 	,AVq[CF^^CF+CF	, Szr$   r   lmntstrc                    | j                  |      \  }}t        j                  |t        j                        }t        j                  |t        j                        }t	        j                         }	|	j                  |d d t        d|      z   |z          |	j                         }
t        j                  |
      }|j                  |      }|j                  |d d       |j                  |dd        z   S )Nr+   r  r'   )r   r
   r   r   r   r   r   r   r	   r   r   )r!   r   r   r   r0  r  r  r  r  r   r   r   r  s                r"   r  zHashdump.decrypt_single_hash  s     >>#.wwvs||,wwvs||,ggi

8ET?T$_4w>?**,hhwX&||F2AJ'$,,12J+
 
 	
r$   c                 0   d }|j                         D ]?  }|j                         dk(  s|j                  |j                  dz   |j                        }A |sy t        d|dd       d   dz   }t        d|dd       d   }|t        |      kD  ry ||||z    }|S )	Nr
  r%   r  r   r+   r   r  r  )r   r   r   r   r   r   r   )r!   r  r   valuer   name_offsetname_lengthusernames           r"   get_user_namezHashdump.get_user_name  s     " 	?Azz|s"QVVaZ>	? T5d#34Q7$>T5d#34Q7U#{['@Ar$   c              #     K   |t         j                  d       |t         j                  d       | j                  |      }| j                  ||      }|r| j	                  |      D ]  }| j                  |||      }|s|\  }}| j                  ||      }	|	t        j                         }	nt        |	dd      }	t        t        j                  |xs | j                        d      }
t        t        j                  |xs | j                        d      }t        t        |j                               d      }d|	||
|ff  y t         j!                  d	       y w)
Nz,SYSTEM address is None: No system hive foundz&SAM address is None: No SAM hive foundr   ignore)errorszlatin-1r+   r   zHbootkey is not valid)r   debugr   r   r   r%  r7  r   NotAvailableValuer  r   hexlifyempty_lmempty_ntr  r   warning)selfr   r   r   r   r  retr  r!  r   lmoutntoutr   s                r"   
_generatorzHashdump._generator3  s:     ?LLGH?LLAB""7+$$Wg6**73 9**4(C%(NFF  --dG<D|(::<"4XF 0 01H4== I9UE 0 01H4== I9UEc$--/2B7CtS%788!9$ NN23s   A=E CEc                    | j                   j                  dd       }d }d }| j                  j                  | j                   d      }t        j
                  j                  | j                  | j                  |j                  |j                  |d n|g      D ]m  }|j                         j                  d      d   j                         dk(  r|}|j                         j                  d      d   j                         dk(  sl|}o t        j                  dt        fd	t         fd
t        fdt        fg| j#                  ||            S )Noffsetr   )hive_offsetsr   SYSTEMSAMUserr   r  r!  )configgetcontextmodulesr   r    
list_hivesconfig_path
layer_namesymbol_table_namer   splitupperr   TreeGridr  r  rE  )rA  rG  r   r   r   r   s         r"   runzHashdump.runQ  s(   40%%dkk(&;<%%00LL$$!'fX 1 
 
	D }}$$T*2.446(B}}$$T*2.446%?
	 !!c]UCL8S/Hc?KOOGW-
 	
r$   N))__name__
__module____qualname____doc___required_framework_version_versionclassmethodr#   r/  r   r   r   r  r  lmkeyr>  r?  r   RegistryHiver  r   r   r   objectsObjectInterfacer   r   r   r   r   r  CM_KEY_NODEr   r%  r  r   r)  r  r7  rE  rX   r$   r"   r   r      s   '"+H

 

AJH( BG8D!K!KERHRH	 5 5 	C 	 	 	H++	H	j  00	1	H 	H !("7"7 !HUO ! !8 &++&6;&	%& &P 

!

-2

DI

	%

 

 4''42:2G2G4SX4	%u%	&4 4l 
S 
U5%<%8 
 
  %  " 

!&
27
BG
 
" ''2:2G2G	% &4,,47?7L7L4<
r$   r   )r   r   loggingstructr   r   typingr   r   r   Crypto.Cipherr   r	   r
   Crypto.Hashr   volatility3.frameworkr   r   #volatility3.framework.configurationr   0volatility3.framework.symbols.windows.extensionsr   $volatility3.plugins.windows.registryr   	getLoggerrY  r   pluginsPluginInterfacer   re  r$   r"   <module>rr     sZ        ( ( ( (  7 < E 9			8	$P	
z!!11 P	
r$   