Added py3 and py2 compatibility + many bugfix

tools/MultiRelay/creddump/framework/win32/lsasecrets.py

@@ -13,26 +13,33 @@
 # You should have received a copy of the GNU General Public License
 # along with creddump.  If not, see <http://www.gnu.org/licenses/>.
 
+# pylint: disable=missing-docstring
+
 """
 @author:       Brendan Dolan-Gavitt
 @license:      GNU General Public License 2.0 or later
 @contact:      bdolangavitt@wesleyan.edu
 """
 
-from framework.win32.rawreg import *
-from framework.addrspace import HiveFileAddressSpace
-#from framework.win32.hashdump import get_bootkey,str_to_key
-from Crypto.Hash import MD5
-from Crypto.Cipher import ARC4,DES
+from Crypto.Hash import MD5, SHA256
+from Crypto.Cipher import ARC4, DES, AES
 
-def get_lsa_key(secaddr, bootkey):
+from framework.win32.rawreg import get_root, open_key, subkeys, unpack
+from framework.addrspace import HiveFileAddressSpace
+from framework.win32.hashdump import get_bootkey, str_to_key
+
+
+def get_lsa_key(secaddr, bootkey, vista):
     root = get_root(secaddr)
     if not root:
         return None
 
-    enc_reg_key = open_key(root, ["Policy", "PolSecretEncryptionKey"])
+    if vista:
+        enc_reg_key = open_key(root, ["Policy", "PolEKList"])
+    else:
+        enc_reg_key = open_key(root, ["Policy", "PolSecretEncryptionKey"])
+
     if not enc_reg_key:
-        exit(1)
         return None
 
     enc_reg_value = enc_reg_key.ValueList.List[0]
@@ -40,48 +47,73 @@ def get_lsa_key(secaddr, bootkey):
         return None
 
     obf_lsa_key = secaddr.read(enc_reg_value.Data.value,
-            enc_reg_value.DataLength.value)
+                               enc_reg_value.DataLength.value)
     if not obf_lsa_key:
         return None
 
-    md5 = MD5.new()
-    md5.update(bootkey)
-    for i in range(1000):
-        md5.update(obf_lsa_key[60:76])
-    rc4key = md5.digest()
+    if not vista:
+        md5 = MD5.new()
+        md5.update(bootkey)
+        for __ in range(1000):
+            md5.update(obf_lsa_key[60:76])
+        rc4key = md5.digest()
+        rc4 = ARC4.new(rc4key)
+        lsa_key = rc4.decrypt(obf_lsa_key[12:60])
+        lsa_key = lsa_key[0x10:0x20]
+    else:
+        lsa_key = decrypt_aes(obf_lsa_key, bootkey)
+        lsa_key = lsa_key[68:100]
 
-    rc4 = ARC4.new(rc4key)
-    lsa_key = rc4.decrypt(obf_lsa_key[12:60])
+    return lsa_key
 
-    return lsa_key[0x10:0x20]
 
 def decrypt_secret(secret, key):
     """Python implementation of SystemFunction005.
 
     Decrypts a block of data with DES using given key.
     Note that key can be longer than 7 bytes."""
-    decrypted_data = ''
-    j = 0   # key index
-    for i in range(0,len(secret),8):
-        enc_block = secret[i:i+8]
-        block_key = key[j:j+7]
+    decrypted_data = bytearray()
+    j = 0  # key index
+    for i in range(0, len(secret), 8):
+        enc_block = secret[i:i + 8]
+        block_key = key[j:j + 7]
         des_key = str_to_key(block_key)
 
         des = DES.new(des_key, DES.MODE_ECB)
         decrypted_data += des.decrypt(enc_block)
-        
+
         j += 7
-        if len(key[j:j+7]) < 7:
-            j = len(key[j:j+7])
+        if len(key[j:j + 7]) < 7:
+            j = len(key[j:j + 7])
 
     (dec_data_len,) = unpack("<L", decrypted_data[:4])
-    return decrypted_data[8:8+dec_data_len]
+    return decrypted_data[8:8 + dec_data_len]
 
-def get_secret_by_name(secaddr, name, lsakey):
+
+def decrypt_aes(secret, key):
+    sha = SHA256.new()
+    sha.update(key)
+    for _i in range(1, 1000 + 1):
+        sha.update(secret[28:60])
+    aeskey = sha.digest()
+
+    data = bytearray()
+    for i in range(60, len(secret), 16):
+        aes = AES.new(aeskey, AES.MODE_CBC, b"\x00" * 16)
+        buf = secret[i: i + 16]
+        if len(buf) < 16:
+            buf += (16 - len(buf)) * b"\00"
+
+        data += aes.decrypt(buf)
+
+    return data
+
+
+def get_secret_by_name(secaddr, name, lsakey, vista):
     root = get_root(secaddr)
     if not root:
         return None
-    
+
     enc_secret_key = open_key(root, ["Policy", "Secrets", name, "CurrVal"])
     if not enc_secret_key:
         return None
@@ -91,47 +123,57 @@ def get_secret_by_name(secaddr, name, lsakey):
         return None
 
     enc_secret = secaddr.read(enc_secret_value.Data.value,
-            enc_secret_value.DataLength.value)
+                              enc_secret_value.DataLength.value)
     if not enc_secret:
         return None
 
-    return decrypt_secret(enc_secret[0xC:], lsakey)
+    if vista:
+        secret = decrypt_aes(enc_secret, lsakey)
+    else:
+        secret = decrypt_secret(enc_secret[0xC:], lsakey)
 
-def get_secrets(Key, secaddr):
+    return secret
+
+
+def get_secrets(sysaddr, secaddr, vista):
     root = get_root(secaddr)
     if not root:
         return None
 
-    bootkey = Key
-    lsakey = get_lsa_key(secaddr, bootkey)
+    bootkey = get_bootkey(sysaddr)
+    lsakey = get_lsa_key(secaddr, bootkey, vista)
 
     secrets_key = open_key(root, ["Policy", "Secrets"])
     if not secrets_key:
-        print "no secret"
         return None
-    
+
     secrets = {}
     for key in subkeys(secrets_key):
         sec_val_key = open_key(key, ["CurrVal"])
         if not sec_val_key:
             continue
-        
+
         enc_secret_value = sec_val_key.ValueList.List[0]
         if not enc_secret_value:
             continue
-        
+
         enc_secret = secaddr.read(enc_secret_value.Data.value,
-                enc_secret_value.DataLength.value)
+                                  enc_secret_value.DataLength.value)
         if not enc_secret:
             continue
 
-        secret = decrypt_secret(enc_secret[0xC:], lsakey)
+        if vista:
+            secret = decrypt_aes(enc_secret, lsakey)
+        else:
+            secret = decrypt_secret(enc_secret[0xC:], lsakey)
+
         secrets[key.Name] = secret
 
     return secrets
 
-def get_file_secrets(Key, secfile):
+
+def get_file_secrets(sysfile, secfile, vista):
+    sysaddr = HiveFileAddressSpace(sysfile)
     secaddr = HiveFileAddressSpace(secfile)
 
-    return get_secrets(Key, secaddr)
-
+    return get_secrets(sysaddr, secaddr, vista)