
    Xf                         d dl Z d dlmZ d dlmZ d dlmZmZmZ d dl	m
Z
mZ d dlmZmZ d dlmZ d dlmZ d d	lmZ d d
lmZ d dlmZ  e j2                  e      Z G d dej8                  j:                        Zy)    N)unpack)Optional)ARC4DESAES)MD5SHA256)
interfaces	renderers)requirements)registry)versions)hashdump)hivelistc            
          e Zd ZdZdZdZed        Zedededefd       Z	ed	e
j                  d
ededee   fd       Zed	e
j                  dededefd       Zededefd       Zde
j                  d	e
j                  fdZd Zy)LsadumpzDumps lsa secrets from memory)   r   r      r   r   c                     t        j                  ddddg      t        j                  dt        j                  d      t        j                  d	t
        j                  d
      gS )NkernelzWindows kernelIntel32Intel64)namedescriptionarchitecturesr   )r   r   r   )r   	componentversionr   r   )r   ModuleRequirementVersionRequirementr   Hashdumpr   HiveList)clss    _/home/panchajanya/Development/work/volatility3/volatility3/framework/plugins/windows/lsadump.pyget_requirementszLsadump.get_requirements   sd     **,()4
 ++8+<+<i ++8+<+<i
 	
    secretkeyreturnc                    t        j                         }|j                  |       t        dd      D ]  }|j                  |dd         |j	                         }d}t        dt        |      d      D ]e  }t        j                  |t        j                  d      }|||dz    }	t        |	      dk  r|	dt        |	      z
  dz  z  }	||j                  |	      z  }g |S )	zR
        Based on code from http://lab.mediaservice.net/code/cachedump.rb
        r   i     <   r&      s                    )	r	   newupdaterangedigestlenr   MODE_CBCdecrypt)
r#   r'   r(   sha_iaeskeydataiaesbufs
             r$   decrypt_aeszLsadump.decrypt_aes+   s    
 jjl

38$ 	&BJJvb}%	&r3v;+ 	%A''&#,,=CQV$C3x"}SX..CKK$$D	% r&   sechivebootkeyvista_or_laterc                 :   |sy |rd}nd}t         j                  j                  |d|z         }|sy t        |j	                               }|sy |j                  |j                  dz   |j                        }|sy |st        j                         }|j                  |       t        d      D ]  }	|j                  |dd         |j                         }
t        j                  |
      }|j                  |dd       }|d	d
 }|S | j                  ||      }|dd }|S )N	PolEKListPolSecretEncryptionKeyzPolicy\   i  r,   L      r-       D   d   )r   r!   get_hive_keynext
get_valuesreadData
DataLengthr   r/   r0   r1   r2   r   r5   r=   )r#   r>   r?   r@   
policy_keyenc_reg_keyenc_reg_valueobf_lsa_keymd5r7   rc4keyrc4lsa_keys                r$   get_lsa_keyzLsadump.get_lsa_key@   s"    $J1J''44Wj:>UV[3356ll=#5#5#9=;S;ST'')CJJwDk /

;r"-./ZZ\F((6"CkkBr"G d4(G  ook7;GboGr&   r   lsakeyis_vista_or_laterc                 <   t         j                  j                  |d|z   dz         }d }|rqt        |j	                               }|rV|j                  |j                  dz   |j                        }|r+|s| j                  |dd  |      }|S | j                  ||      }|S )NPolicy\Secrets\\CurrValrD   rF   )
r   r!   rJ   rK   rL   rM   rN   rO   decrypt_secretr=   )	r#   r>   r   rY   rZ   enc_secret_keyr'   enc_secret_value
enc_secrets	            r$   get_secret_by_namezLsadump.get_secret_by_namei   s     "**77(4/+=
 #N$=$=$?@$\\$))A-/?/J/J
 ,!$!3!3Jst4Df!M  "%V!Dr&   c                    d}d}t        dt        |      d      D ]  }|||dz    }|||dz    }t        j                  j	                  |      }t        j                  |t
        j                        }	|dt        t        dt        |      z
        dz        z  z   }||	j                  |      z  }|dz  }t        |||dz          dk  st        |||dz          } t        d|dd       \  }
|dd|
z    S )	zPython implementation of SystemFunction005.

        Decrypts a block of data with DES using given key.
        Note that key can be longer than 7 bytes.r&   r             z<LNrD   )r1   r3   r   r!   sidbytes_to_keyr   r/   MODE_ECBintabsr5   r   )r#   r'   r(   decrypted_datajr:   	enc_block	block_keydes_keydesdec_data_lens              r$   r^   zLsadump.decrypt_secret   s    q#f+q) 	(Aq1q5)IAAI''77	BG'''3<<0C!Gc#a#i.6H2IA2M.N$NNIckk N FA3q1q5>"Q&AA'	( !~bq'9:a!l"233r&   syshivec              #     K   | j                   j                  | j                  d      }t        j                  | j                   |j
                        }t        j                  j                  |      }| j                  |||      }|st        j                  d       y |st        j                  d       y t        j                  j                  |d      }|st        j                  d       y |j                         D ]  }t        j                  j                  |d|j                         j                  d      d	   z   d
z         }	|	sLt!        |	j#                               }
|
sh|j%                  |
j&                  dz   |
j(                        }|s|s| j+                  |dd  |      }n| j-                  ||      }d|j/                         |j1                  d      |ff  y w)Nr   )contextsymbol_tablezUnable to find bootkeyzUnable to find lsa keyzPolicy\SecretszUnable to find secrets keyr\   \   r]   rD   rF   r   latin1)rt   modulesconfigr   rZ   symbol_table_namer   r!   get_bootkeyrX   vollogwarningrJ   get_subkeysget_key_pathsplitrK   rL   rM   rN   rO   r^   r=   get_namedecode)selfrr   r>   r   r@   r?   rY   secrets_keyr(   sec_val_keyr`   ra   r'   s                r$   
_generatorzLsadump._generator   s     %%dkk(&;<!33LLv/G/G
 ##//8!!'7NCNN34NN34''44W>OPNN78**, 	IC"++88#c&6&6&8&>&>t&DQ&GG+UK #K$:$:$<=#  %%)+;+F+FJ !,,Z-=vF))*f=s||~v}}X'>GHH-	Is   G#G%c                    | j                   j                  dd       }d x}}| j                  j                  | j                   d      }t        j
                  j                  | j                  | j                  |j                  |j                  |d n|g      D ]m  }|j                         j                  d      d   j                         dk(  r|}|j                         j                  d      d   j                         dk(  sl|}o t        j                  dt        fd	t        fd
t         fg| j#                  ||            S )Noffsetr   )hive_offsetsrv   SYSTEMSECURITYKeySecretHex)rz   getrt   ry   r   r"   
list_hivesconfig_path
layer_namer{   r   r   upperr   TreeGridstrbytesr   )r   r   rr   r>   r   hives         r$   runzLsadump.run   s"   40  '%%dkk(&;<%%00LL$$!'fX 1 
 
	D }}$$T*2.446(B}}$$T*2.446*D
	 !!S\Hc?UEN;OOGW-
 	
r&   N)__name__
__module____qualname____doc___required_framework_version_versionclassmethodr%   r   r=   r   RegistryHiveboolr   rX   r   rb   r^   r   r    r&   r$   r   r      s   '"+H
 
  U u  ( &++&6;&MQ&	%& &P &&  	
   4 4E 4 4 42.I,,.I7?7L7L.I`
r&   r   )loggingstructr   typingr   Crypto.Cipherr   r   r   Crypto.Hashr   r	   volatility3.frameworkr
   r   #volatility3.framework.configurationr   volatility3.framework.layersr   %volatility3.framework.symbols.windowsr   volatility3.plugins.windowsr   $volatility3.plugins.windows.registryr   	getLoggerr   r}   pluginsPluginInterfacer   r   r&   r$   <module>r      sW       ( ( # 7 < 1 : 0 9			8	$M
j  00 M
r&   