
    Xf                         d dl Z d dlmZ d dlmZ d dlmZmZmZ d dl	m
Z
mZ d dlmZmZ d dlmZ d dlmZ d d	lmZ d d
lmZ d dlmZ  e j        e          Z G d dej        j                  ZdS )    N)unpack)Optional)ARC4DESAES)MD5SHA256)
interfaces	renderers)requirements)registry)versions)hashdump)hivelistc            
          e Zd ZdZdZdZed             Zedededefd            Z	ed	e
j        d
ededee         fd            Zed	e
j        dededefd            Zededefd            Zde
j        d	e
j        fdZd ZdS )LsadumpzDumps lsa secrets from memory)   r   r      r   r   c                     t          j        ddddg          t          j        dt          j        d          t          j        d	t
          j        d
          gS )NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturesr   )r   r   r   )r   	componentversionr   r   )r   ModuleRequirementVersionRequirementr   Hashdumpr   HiveList)clss    _/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/lsadump.pyget_requirementszLsadump.get_requirements   ss     *,()4  
 +8+<i   +8+<i  
 	
    secretkeyreturnc                    t          j                    }|                    |           t          dd          D ]}|                    |dd                     |                                }d}t          dt          |          d          D ]r}t          j        |t          j        d          }|||dz            }	t          |	          dk     r|	dt          |	          z
  dz  z  }	||                    |	          z  }s|S )	zR
        Based on code from http://lab.mediaservice.net/code/cachedump.rb
        r   i     <   r&      s                    )	r	   newupdaterangedigestlenr   MODE_CBCdecrypt)
r#   r'   r(   sha_iaeskeydataiaesbufs
             r$   decrypt_aeszLsadump.decrypt_aes+   s    
 jll

38$$ 	& 	&BJJvbe}%%%%r3v;;++ 	% 	%A'&#,==CQV$C3xx"}}SXX..CKK$$$DDr&   sechivebootkeyvista_or_laterc                    |sd S |rd}nd}t           j                            |d|z             }|sd S t          |                                          }|sd S |                    |j        dz   |j                  }|sd S |st          j	                    }|
                    |           t          d          D ]}	|
                    |dd                     |                                }
t          j	        |
          }|                    |dd                   }|d	d
         }n |                     ||          }|dd         }|S )N	PolEKListPolSecretEncryptionKeyzPolicy\   i  r,   L      r-       D   d   )r   r!   get_hive_keynext
get_valuesreadData
DataLengthr   r/   r0   r1   r2   r   r5   r=   )r#   r>   r?   r@   
policy_keyenc_reg_keyenc_reg_valueobf_lsa_keymd5r7   rc4keyrc4lsa_keys                r$   get_lsa_keyzLsadump.get_lsa_key@   sj     	4 	2$JJ1J'44Wj:>UVV 	4[335566 	4ll=#5#9=;STT 	4 	&'))CJJwDkk / /

;r"u-....ZZ\\F(6""CkkBrE" G d4i(GGook7;;GbfoGr&   r   lsakeyis_vista_or_laterc                 X   t           j                            |d|z   dz             }d }|rt          |                                          }|r\|                    |j        dz   |j                  }|r7|s|                     |dd          |          }n| 	                    ||          }|S )NPolicy\Secrets\\CurrValrD   rF   )
r   r!   rJ   rK   rL   rM   rN   rO   decrypt_secretr=   )	r#   r>   r   rY   rZ   enc_secret_keyr'   enc_secret_value
enc_secrets	            r$   get_secret_by_namezLsadump.get_secret_by_namei   s     "*77(4/+=
 
  
	E#N$=$=$?$?@@ E$\\$)A-/?/J 
  E, E!$!3!3Jstt4Df!M!M!$V!D!Dr&   c                 ^   d}d}t          dt          |          d          D ]}|||dz            }|||dz            }t          j                            |          }t          j        |t
          j                  }	|dt          t          dt          |          z
            dz            z  z   }||	
                    |          z  }|dz  }t          |||dz                      dk     rt          |||dz                      }t          d|dd                   \  }
|dd|
z            S )	zPython implementation of SystemFunction005.

        Decrypts a block of data with DES using given key.
        Note that key can be longer than 7 bytes.r&   r             z<LNrD   )r1   r3   r   r!   sidbytes_to_keyr   r/   MODE_ECBintabsr5   r   )r#   r'   r(   decrypted_datajr:   	enc_block	block_keydes_keydesdec_data_lens              r$   r^   zLsadump.decrypt_secret   s:    q#f++q)) 	( 	(Aq1q5y)IAAII'77	BBG''3<00C!Gc#a#i..6H2I2IA2M.N.N$NNIckk  N FA3q1q5y>""Q&&AAI'' ~bqb'9::a!l"2233r&   syshivec              #     K   | j         j        | j        d                  }t          j        | j         |j                  }t          j                            |          }| 	                    |||          }|st                              d           d S |st                              d           d S t          j                            |d          }|st                              d           d S |                                D ]}t          j                            |d|                                                    d          d	         z   d
z             }	|	sWt!          |	                                          }
|
s{|                    |
j        dz   |
j                  }|s|s|                     |dd          |          }n|                     ||          }d|                                |                    d          |ffV  d S )Nr   )contextsymbol_tablezUnable to find bootkeyzUnable to find lsa keyzPolicy\SecretszUnable to find secrets keyr\   \   r]   rD   rF   r   latin1)rt   modulesconfigr   rZ   symbol_table_namer   r!   get_bootkeyrX   vollogwarningrJ   get_subkeysget_key_pathsplitrK   rL   rM   rN   rO   r^   r=   get_namedecode)selfrr   r>   r   r@   r?   rY   secrets_keyr(   sec_val_keyr`   ra   r'   s                r$   
_generatorzLsadump._generator   s&      %dk(&;<!3Lv/G
 
 
 #//88!!'7NCC 	NN34444 	NN34444'44W>OPP 	NN78884**,, 	I 	IC"+88#c&6&6&8&8&>&>t&D&DQ&GG+U K  #K$:$:$<$<==#   %)+;+F J  ! >,,Z-=vFF))*f==s||~~v}}X'>'>GHHHHH-	I 	Ir&   c                    | j                             dd           }d x}}| j        j        | j         d                  }t          j                            | j        | j        |j        |j	        |d n|g          D ]}|
                                                    d          d                                         dk    r|}|
                                                    d          d                                         dk    r|}t          j        dt          fd	t          fd
t           fg|                     ||                    S )Noffsetr   )hive_offsetsrv   SYSTEMSECURITYKeySecretHex)rz   getrt   ry   r   r"   
list_hivesconfig_path
layer_namer{   r   r   upperr   TreeGridstrbytesr   )r   r   rr   r>   r   hives         r$   runzLsadump.run   s/   400  '%dk(&;<%00L$!'fX 1 
 
 
	 
	D }}$$T**2.4466(BB}}$$T**2.4466*DD!S\Hc?UEN;OOGW--
 
 	
r&   N)__name__
__module____qualname____doc___required_framework_version_versionclassmethodr%   r   r=   r   RegistryHiveboolr   rX   r   rb   r^   r   r    r&   r$   r   r      sr       ''"+H
 
 [
  U u    [( &+&6;&MQ&	%& & & [&P &  	
     [4 4E 4 4 4 4 [42.I,.I7?7L.I .I .I .I`
 
 
 
 
r&   r   )loggingstructr   typingr   Crypto.Cipherr   r   r   Crypto.Hashr   r	   volatility3.frameworkr
   r   #volatility3.framework.configurationr   volatility3.framework.layersr   %volatility3.framework.symbols.windowsr   volatility3.plugins.windowsr   $volatility3.plugins.windows.registryr   	getLoggerr   r}   pluginsPluginInterfacer   r   r&   r$   <module>r      s2                ( ( ( ( ( ( ( ( ( ( # # # # # # # # 7 7 7 7 7 7 7 7 < < < < < < 1 1 1 1 1 1 : : : : : : 0 0 0 0 0 0 9 9 9 9 9 9		8	$	$M
 M
 M
 M
 M
j 0 M
 M
 M
 M
 M
r&   