
    5i"~                        d dl Z d dlZd dlZd dlmZmZ d dlmZ d dlm	Z	 d dl
mZ d dlmZ d dlmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZm Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z) d dl*m+Z+m,Z, d d	l-m.Z.m/Z/m0Z0m1Z1 d d
l2m3Z3m4Z4m5Z5m6Z6 d dl7m8Z8 d dl9m:Z:m;Z;m<Z<m=Z=m>Z> d dl?m@Z@ d dlAmBZB d dlCmDZD d dlEmFZF d dlGmHZH d dlGmIZI  G d d          ZJdS )    N)ListDict)hashlib)logger)CCACHE)KerberosClientSocket)METHOD_DATA
ETYPE_INFOETYPE_INFO2PADATA_TYPEPA_PAC_REQUESTPA_ENC_TS_ENCEncryptedData	krb5_pvnoKDC_REQ_BODYAS_REQTGS_REP
KDCOptionsPrincipalNameEncASRepPartEncTGSRepPartr   RealmChecksum	APOptionsAuthenticatorTicketAP_REQTGS_REQ	CKSUMTYPEPA_FOR_USER_ENCPA_PAC_OPTIONSPA_PAC_OPTIONSTypesEncTicketPart)KerberosErrorCodeKerberosError)Key_enctype_table_HMACMD5Enctype)
PaDataTypeEncryptionType	NAME_TYPEMESSAGE_TYPE)AuthenticatorChecksum)PKAuthenticatorAuthPackPA_PK_AS_REPKDCDHKeyInfoPA_PK_AS_REQ)KerberosCredential)KerberosTarget)KerberosSPN)construct_apreq_from_tgs_tgt)cms)corec                      e Zd ZdedefdZg ddddddfdee         d	ed
e	fdZ
g ddfd	ed
e	fdZg ddfd	efdZd Zd Zddg dddfded	efdZdefdZddZg dej        ej        ej        ej        ej        ej        ej        gfdZdg dej        ej        ej        gfdZej        ej        ej        gfdZddg dfdZd Zd Z dS ) KerbrosClientccredtargetc                    || _         || _        t          | j                  | _        |j        t                      n|j        | _        d | _        d | _        d | _        d | _	        d | _
        d | _        d | _        d | _        d | _        d S )N)
credentialr=   r   ksocccacher   kerberos_session_keykerberos_TGTkerberos_TGT_encpartkerberos_TGSkerberos_cipherkerberos_cipher_typekerberos_keyserver_saltpkinit_tkey)selfr<   r=   s      I/home/kali/Ninja/venv/lib/python3.11/site-packages/minikerberos/client.py__init__zKerbrosClient.__init__   s    $/$+"4;//$)!L0el$+"$$"$$$"$$$$    )forwardable	renewable	proxiableNFTkdcoptswith_pacreturnc                    t          j        d           g }|du r\i }	t          t          d                    |	d<   t	          ddi                                          |	d<   |                    |	           t          j        d|j        z             t          j        	                    t          j
        j                  }
|du r)|t          |
                    d	
          |
j        d                                          }t          |j                 | _        |j        | _        t'          | j        j        | j                            || j                            | _        | j                            | j        d|d           }n|}
|}i }t          t          d                    |d<   t5          |j        |d                                          |d<   |                    |           i }t7          t9          |                    |d<   t;          t<          j        j        | j        j         !                    d          d          |d<   | j        j"        #                                |d<   t;          t<          j        j        d| j        j"        #                                gd          |d<   |
t          j$        d          z                       d	
          |d<   |
t          j$        d          z                       d	
          |d<   tK          j&        d          |d<   |j        g|d<   ||D ]}||         ||<   i }tN          |d<   tP          j)        j        |d<   ||d<   tU          |          |d <   tW          |          S )!Nz'Constructing TGT request with auth dataTPA-PAC-REQUESTpadata-typeinclude-pacpadata-valuez$Selecting common encryption type: %sFr   microsecond)patimestamppausec)salt   zENC-TIMESTAMPetypecipherkdc-options/z	name-typezname-stringcnamerealmkrbtgtsnamedaystillrtime   noncera   pvnomsg-typepadatareq-body),r   debugintr   r   dumpappendnamedatetimenowtimezoneutcr   replacer[   r'   valuerF   rG   r&   enctyper?   get_key_for_enctyperI   rH   encryptr   r   setr   r,   	PRINCIPALusernamesplitdomainupper	timedeltasecretsrandbitsr   r-   
KRB_AS_REQr   r   )rK   supported_encryption_methodrR   enctimestampnewnow
no_preauthkdc_req_body_extrarS   padatas	pa_data_1rz   	timestampenc_timestamp	pa_data_2kdc_req_bodykeykdc_reqs                    rL   build_asreq_ltszKerbrosClient.build_asreq_lts.   s   ,8999'9!+.>"?"?@@9]-}d.CDDIIKK9^
>>),58S8XXYYYh/344#5ckkak.H.HTWTcddeejjllI)*E*KLD ; ADD08$/:]:]^y  CG  CS:]  ;T  ;T  U  UD(001BAyRVWWMM
C M9!+o">">??9],7R7Xdq-r-rssxxzz9^
>>), *3w<< 8 8,}'i6I6O`d`o`x`~`~  @C  aD  aD  )E  )E  F  F,w/06688,w'i6I6Oaikokz  lB  lH  lH  lJ  lJ  aK  )L  )L  M  M,w 2 : : ::CCPQCRR,v!3!;!;!;;DDQRDSS,w!*2..,w6<=,w#  0 0s*3/L''&/$/5'*'($\22'*	rN   )rO   rP   zrenewable-okc                    ddl m} |j        dk    rt          d          t          j                            t          j        j                  }i }t          t          |                    |d<   t          t          j        j        | j        j                            d          d          |d<   | j        j                                        |d	<   t          t          j        j        d
| j        j                                        gd          |d<   |t	          j        d          z                       d          |d<   |t	          j        d          z                       d          |d<   t+          j        d          |d<   |j        g|d<   t/          |          }t1          j        |                                                                          }i }	|j        |	d<   |                    d          |	d<   t+          j        d          |	d<   ||	d<   i }
| j        j        j        |
d<   | j        j        j        |
d<   d|
d<   i }d|d<   |                     |
          |d<   i }|!                    |          |d<   | j        j        "                                |d<   i }tG          |	          |d<   |$                    |          |d<   | j        j        j%        |d <   tM          |          }| j        '                    |                                d!"          }tQ                      }||d#<   g }|d!u r\i }tS          tU          d$                    |d%<   tW          d&d!i                                          |d'<   |,                    |           i }tZ          j.        j        |d%<   |                                |d'<   |,                    |           i }d(|d)<   d*|d+<   ||d,<   ||d-<   t_          |          S ).Nr   )keys   z5RC4 encryption is not supported for certificate auth!rc   rd   re   rf   rg   rh   ri   r_   rj   rZ   rl   rm   rn   ro   ra   cusecctime
paChecksumpgqz1.2.840.10046.2.1	algorithm
parameters
public_keypkAuthenticatorclientPublicValueclientDHNonceT)wrap_signedsignedAuthPackrV   rW   rX   rY      rp   
   rq   rr   rs   )0
asn1cryptor   r~   	Exceptionry   rz   r{   r|   r   r   r   r,   r   r?   r   r   r   r   SRV_INSTr   r}   r   r   r   r   sha1rv   digestr[   dhparamsr   r   DomainParametersPublicKeyAlgorithmget_public_keyr/   PublicKeyInfodh_noncer0   sign_authpackr3   ru   r   r   rw   r*   	PK_AS_REQr   )rK   r   rR   rS   r   rz   kdc_req_body_datar   checksumauthenticatordppkaspkiauthpacksigned_authpackpayloadr   	pa_data_0r   asreqs                       rL   build_asreq_pkinitz KerbrosClient.build_asreq_pkinitb   s4    &",,	J	K	KK 	h/344#%/G%=%=M",9;N;Teiete}  fD  fD  EH  fI  fI  .J  .J   K   KG#5;;==G,9;M;Semoso~  pF  pL  pL  pN  pN  eO  .P  .P   Q   QG #h&8a&@&@&@ @IIVWIXXF #h&8a&@&@&@ @IIVWIXXG&/33G ; ABG/00, \,++--..5577(-?-;;1;55-"+B//- (- 
"O$&"S'O$&"S'"S'
#(#k++B//#l	$--c22${/>>@@$| ( / > >("&"4"4T":":("o6?(?h(O11(--//QU1VV/NN'-'
'9!+.>"?"?@@9]-}d.CDDIIKK9^
>>))'17)M%llnn)N	..
%%-%
%/"%
	rN   c                 6   | j         j        |                     |||          }n|                     |||          }t	          j        d           | j                            |                                          }|j	        dk    rt          |d          |S )N)rS   zSending TGT request to server	KRB_ERRORzPreauth failed!)r?   certificater   r   r   rt   r@   sendrecvrv   rx   r%   )rK   r   rR   rS   reqreps         rL   
do_preauthzKerbrosClient.do_preauth   s    	_ ,		 	 !<gPX	 	Y	Y33			97X		V	V3 	,.///	388::&&#X	s-	.	..	*rN   c                    	 | j         t          d          | j                             | j        j        | j        j        | j        j                  \  }}}|||| _        |d         | _        t          |d         |d                   | _
        t          |d                  | _        |d         | _        dS # t          $ r}d |fcY d }~S d }~ww xY w)NNo CCACHE file foundenc-partkeytypekeyvalue)TN)rA   r   get_tgtr?   r   r   ccache_spn_strict_checkrC   rD   r&   rB   r'   rF   rG   )rK   tgt	keystructerres        rL   tgt_from_ccachezKerbrosClient.tgt_from_ccache   s    
k
*
+
++,,T_-EtG]_c_n  `G  H  H3	3	o
I4":4"9Y#7:9NOO4(9)=>4(34
*	   
'>>>>>>s   B2B6 6
C C	C	Cc           	         t          j                    }t          j        |d                   j        D ]}t          |d                   }|t
          j        k    s|t
          j        k    r|t
          j        k    rt          j        |d                   }n*|t
          j        k    rt          j        |d                   }|j        D ]X}|d         |t          |d                   <   t          j
        dt          |d                   j        d|d                    Y| j                            |          }||vrt          d          ||         }||                                }|| _        |S )	Nze-datarW   rY   r^   ra   z Server supports encryption type z with salt z,Preferred enc type not in supported enctypes)collectionsOrderedDictr	   loadnativer*   r
   r   r+   r   rt   rx   r?   get_preferred_enctyper   encoderI   )	rK   r   supp_enc_methods
enc_method	data_typeenc_info_listenc_infopreferred_enc_typer^   s	            rL   "select_preferred_encryption_methodz0KerbrosClient.select_preferred_encryption_method   s    !,..$S]33: B Bj*]3449:(((I9O,O,OJ)))_Z%?@@]]	j,	,	, %j&@AA]!( B B;CF;KnXg%6778\\~V^_fVgGhGhGmGmGmowx~oo  A  B  B  B  B<<=MNN///	A	B	BB	,	-$	
++--4$	rN   override_snamec           	         |                                  \  }}|dS t          j        d           t          j                            t          j        j                  }i }	t          t          |                    |	d<   t          t          j        j        | j        j                            d          d          |	d<   | j        j                                        |	d<   |Ct          t          j        j        d| j        j                                        gd          |	d	<   n6t          t          j        j        |                                d          |	d	<   |t          j        d
          z                       d          |	d<   |t          j        d
          z                       d          |	d<   t-          j        d          |	d<   || j                                        |	d<   n||	d<   i }
|du rEt3          t5          d                    |
d<   t7          ddi                                          |
d<   i }t:          |d<   t<          j        j        |d<   tA          |
          dk    r|
g|d<   tC          |	          |d<   tE          |          }t          j        d| j#        $                                z             | j#        %                    |                                d          }|j&        dk    r|j'        }|| _(        |dk    s| j        j)        du r|S tT          |d          d                  | _+        |d          d         | _,        t[          | j+        j.        | j        /                    ta          |d          d                                       | _1        n|j'        d!         td          j3        j        k    rti          |          |j'        }t          j        d"           | 5                    |          }| 6                    |          }t          j        d#           |j'        }|| _(        | j        j7        q| 8                    |          \  | _9        | _:        | _+        |j        | _,        | j;        <                    | j(        | j9        d$           t          j        d%           dS |d          d&         }| j+        =                    | j1        d'|          }	 t}          j?        |          j'        | _9        ns# t          $ rf}t          j        d(           	 t          j?        |          j'        | _9        n(# t          $ r}t          jB        d)           |d}~ww xY wY d}~nd}~ww xY wt[          | j+        j.        | j9        d*         d+                   | _:        | j;        <                    | j(        | j9        d$           t          j        d%           dS ),aJ  
		decrypt_tgt: used for asreproast attacks
		Steps performed:
			1. Send and empty (no encrypted timestamp) AS_REQ with all the encryption types we support
			2. Depending on the response (either error or AS_REP with TGT) we either send another AS_REQ with the encrypted data or return the TGT (or fail miserably)
			3. PROFIT
		Nz2Generating initial TGT without authentication datarc   rd   re   rf   rg   rh   ri   r_   rj   r   rZ   rl   rm   rn   ro   ra   TrV   rW   rX   rY   rp   rq   rr   rs   zSending initial TGT to %sF)throwr   r   
error-codez1Got reply from server, asikg to provide auth dataz"Got valid TGT response from server)override_ppzGot valid TGTrb      z(EncAsRepPart load failed, is this linux?z+Failed to load decrypted part of the reply!r   r   )Cr   r   rt   ry   rz   r{   r|   r   r   r   r,   r   r~   r?   r   r   r   r   r   get_principalnamer   r}   r   r   get_supported_enctypesru   r   r   rv   r   r-   r   lenr   r   r@   get_addr_strr   rx   r   rC   	nopreauthr'   rF   rG   r&   r   r   r+   rH   r$   KDC_ERR_PREAUTH_REQUIREDr%   r   r   r   decrypt_asrep_certrD   rB   rA   add_tgtdecryptr   r   r   r   error)rK   override_etypedecrypt_tgtrR   r   rS   _r   rz   r   r   r   r   r   r   
cipherTexttempr   s                     rL   get_TGTzKerbrosClient.get_TGT   s    !!&!S[	6,CDDDh/344#, *3w<< 8 8,}'i6I6O`d`o`x`~`~  @C  aD  aD  )E  )E  F  F,w/06688,w(y7J7Pbjlpl{  mC  mI  mI  mK  mK  bL  *M  *M  N  N< )y7I7O`n  aA  aA  aC  aC  *D  *D  E  E<!3!;!;!;;DDQRDSS,v!3!;!;!;;DDQRDSS,w!*2..,w?AACC<)<)!+.>"?"?@@9]-}d.CDDIIKK9^''&/$/5'*^^a!{78$\22'*w#,*TY-C-C-E-EEFFF	388::u55#X	34 Udo74??J(Z)AB4":w744/79\9\]klopzl{  }D  mE  ^F  ^F  :G  :G  H  H4 
j"3"L"RRR


	3	<CDDD!%!H!H!M!M	4	5	53	<4555	34	_ ,PTPgPghkPlPlM4d79M:@4;t($*CSWXXX	<   	6 J):


&
&t'8!Z
H
H4 , 1$ 7 7 >D
   
L;<<<!.!3D!9!9!@T   \?@@@W   #4#7#?AZ[`AablAmnn4;t($*CSWXXX	<   	6s<   *T	 	
U9U4(UU4
U,U''U,,U44U9spn_userc                 &   	 | j         t          d          | j                             |          \  }}}||t          |d         |d                   }t	          |          j        }||d         |d fS # t          $ r}d d d |fcY d }~S d }~ww xY w)Nr   r   r   r   )rA   r   get_tgsr&   r   r   )rK   r   tgsr   r   r   r   s          rL   tgs_from_ccachezKerbrosClient.tgs_from_ccacheM  s    
k
*
+
++,,X663	3	o
I	Yy!9Z#8	9	93		3
s:T
))	   
dA
s   A3A6 6
B BBBc                 	   |                      |          \  }}}}||||fS | j        (|                                 \  }}|t          d          t	          j        d|                                z             t          j                            t          j	        j
                  }	i }
t          t          g d                    |
d<   |j                                        |
d<   t          t           j        j        |                                d          |
d<   |	t          j        d	
          z                       d          |
d<   t-          j        d          |
d<   |r||
d<   n| j        dk    rdg|
d<   n| j        g|
d<   i }t2          |d<   t5          | j        d                   |d<   | j        d         |d<   |	j        |d<   |	                    d          |d<   |rQt9                      }d|_        d|_        i }d|d<   |                                |d<   tA          |          |d<   d|d<   | j!        "                    | j#        dtI          |          %                                d          }i }t2          |d<   tL          j'        j        |d <   tQ          t                                |d!<   tS          | j        d"                   |d"<   tU          | j        |d#          |d$<   i }tV          j,        j        |d%<   t[          |          %                                |d&<   i }t2          |d<   tL          j.        j        |d <   |g|d'<   t_          |
          |d(<   tY          |          }t	          j        d)           | j0        1                    |%                                          }|j2        d*k    rtg          |d+          t	          j        d,           |j4        }tk          j6        | j!        7                    | j#        d-|d.         d/                             j4        }tq          |d0         d1         |d0         d2                   }| j9        :                    ||           t	          j        d3           || _;        |||fS )4a  
		Requests a TGS ticket for the specified user.
		Retruns the TGS ticket, end the decrpyted encTGSRepPart.

		spn_user: KerberosTarget: the service user you want to get TGS for.
		override_etype: None or list of etype values (int) Used mostly for kerberoasting, will override the AP_REQ supported etype values (which is derived from the TGT) to be able to recieve whatever tgs tiecket 
		NzNo TGT found in CCACHE!z$Constructing TGS request for user %s)rO   rP   renewable_okcanonicalizerc   rg   re   ri   r_   rj   r   rZ   rl   rn   ro   ra   ir   authenticator-vnocrealmrf   r   r   s                   i  	cksumtyper   cksumz
seq-number   rp   rq   
ap-optionsticketr`   r   rW   rY   rr   rs   z"Constructing TGS request to serverr   zget_TGS failed!zGot TGS reply, decrypting...   r   rb   r   r   r   zGot valid TGS reply)<r  rC   r   r   r   rt   get_formatted_pnamery   rz   r{   r|   r   r   r   r   r   r,   r   r~   r   r   r}   r   r   rG   r   r   r[   r.   flagschannel_bindingto_bytesr   rF   r   rB   r   rv   r-   
KRB_AP_REQr   r   r   r*   r   r   KRB_TGS_REQr   r@   r   rx   r%   r   r   r   r   r&   rA   add_tgsrE   )rK   r   r   is_linuxr   encTGSRepPartr   r   r   rz   r   authenticator_dataacchksumauthenticator_data_encap_reqr   r   r   r   s                       rL   get_TGSzKerbrosClient.get_TGS\  s    "&!5!5h!?!?#}c3[
}c
!! 
  ""61c	o
-
.
.. 	,58T8T8V8VVWWWh/344#, *3/i/i/i+j+j k k,}"///11,w'i6H6N_g_y_y_{_{(|(|}},w 2 : : ::CCPQCRR,v!*2..,w 8)<
4''  DL!67L,5()!&t'8'B!C!CX $ 1' :W #W # : :W (228"266+6* "*&!1!1g&'l#/778QSTVcdvVwVwV|V|V~V~  AE  F  F&&.#.4&"355))&D-h788&)D4MYo*p*pqq&)'/5)M$Vnn1133)N ''&/$06'* k'($\22'*#,3444	388::&&#X	s-	.	..,-...
#$T%9%A%A$B[]^`cdn`opx`y%z%z{{  C-M% +]5-A*-MNN#+c=))),$%%%$	mS	  rN   )rO   rP   r  zenc-tkt-in-skeyc                 2	   | j         s(t          j        d           |                                  | j                            |          }t          j                            t          j        j	                  }i }t          |d<   t          | j         d                   |d<   | j         d         |d<   |j        |d<   |                    d          |d<   | j                            | j        d	t#          |                                          d           }i }t          |d
<   t&          j        j        |d<   t-          t/                                |d<   t1          | j         d                   |d<   t3          | j        |d          |d<   i }t6          j        j        |d<   t;          |                                          |d<   i }	t=          t/          |                    |	d<   t?          t@          j!        j        | j        j"        #                    d          d          |	d<   | j        j$        %                                |	d<   |t          j&        d          z                       d          |	d<   tO          j(        d          |	d<   dg|	d<   t1          | j         d                   g|	d<   i }
t          |
d
<   t&          j)        j        |
d<   |g|
d<   tU          |	          |
d <   t9          |
          }t          j        d!           | j+        ,                    |                                          }|j-        d"k    r%d#}|j.        d$         d%k    rd&}t_          ||          t          j        d'           |j.        }t`          tc          |d         d(         d                            }|d         d(         d)         }|2                    | j        d*|          }tg          j4        |          j.        }tk          j4        | j        2                    | j        d+|d(         d)                             j.        }tm          |d,         d-         |d,         d.                   }| j7        8                    ||           t          j        d/           ||||fS )0Nz+[U2U] TGT is not available! Fetching TGT...r  r  rf   r   r   rZ   r   r	  rp   rq   r
  r  r`   r   rW   rY   rc   rd   re   ri   rg   r_   rj   rl   rn   ro   r   ra   additional-ticketsrr   rs   z[U2U] Sending request to serverr   z[U2U] failed!r      zc[U2U] Failed to get U2U! Error code (16) indicates that delegation is not enabled for this account!z[U2U] Got reply, decrypting...r   rb      r  r   r   r   z[U2U] Got valid TGS reply)9rC   r   rt   r   r?   r   ry   rz   r{   r|   r   r   r[   r}   rF   r   rB   r   rv   r-   r  r~   r   r   r   r   rG   r*   r   r   r   r   r,   r   r   r   r   r   r   r   r   r  r   r@   r   rx   r   r%   r'   ru   r   r#   r   r   r&   rA   r  )rK   rR   r   supp_encrz   r  r  r  pa_data_authkrb_tgs_bodykrb_tgs_reqr   replyemsgr   rb   	encticketdecdata	decticketr  r   s                        rL   U2UzKerbrosClient.U2U  s\   		 	<=>>><<>>>_223CDD(h/344#,5()!&t'8'B!C!CX $ 1' :W #W # : :W  /778QSTVcdvVwVwV|V|V~V~  AE  F  F&&.#.4&"355))&D-h788&)D4MYo*p*pqq&, * 2 8,}!'!4!4!6!6,~ , *3w<< 8 8,}'i6I6O`d`o`x`~`~  @C  aD  aD  )E  )E  F  F,w/06688,w 2 : : ::CCPQCRR,v!*2..,w$,w(.t/@/J(K(K'L,#$ +!+f(4:+j'.+h(66+j 	#,0111
)

SXXZZ
(
(%
Z;
4l< B&&pD	ud	#	##,/000##c(mJ7@AAB&(mJ'1)NN44aCC' ))0)$T%9%A%A$B[]^`cdn`opx`y%z%z{{  C-M% +]5-A*-MNN#+c=))),*+++	mS)	++rN   )rO   rP   r  c                 B   | j         s(t          j        d           |                                  | j                            |          }d}t          j                            t          j        j	                  }i }t          |d<   t          | j         d                   |d<   | j         d         |d<   |j        |d<   |                    d          |d	<   | j                            | j        d
t#          |                                          d          }	i }
t          |
d<   t&          j        j        |
d<   t-          t/                                |
d<   t1          | j         d                   |
d<   t3          | j        |	d          |
d<   i }t6          j        j        |d<   t;          |
                                          |d<   t<          j        j                             ddd          }||j!        "                                z  }||j#        "                                z  }||"                                z  }t          j        d|$                                z             t          j        d|z             tK          j&        | j        d|          }t          j        d|$                                z             i }tO          tQ          d                    |d<   ||d<   i }tS          t<          j        j        |*                                d          |d<   |j#        |d <   tW          |          |d!<   ||d"<   i }tO          tY          d#                    |d<   t[          |                                          |d<   |Ft]          |t^                    r|g}nLt]          |t`                    r|}n4|*                                }n| j        j!        1                    d$          }i }te          t/          |                    |d%<   tS          t<          j3        j        |d          |d&<   | j        j#        4                                |d'<   |t          j5        d()          z                       d          |d*<   tm          j7        d+          |d,<   | j        j8        g|d-<   i }t          |d<   t&          j9        j        |d<   ||g|d.<   tu          |          |d/<   t9          |          }t          j        d0           | j;        <                    |                                          }|j=        d1k    r%d2}|j>        d3         d4k    rd5}t          ||          t          j        d6           |j>        }t          jA        | j        B                    | j        d7|d8         d9                             j>        }t          |d:         d;         |d:         d<                   }| jD        E                    ||           t          j        d=           || _F        |||fS )>z0
		user_to_impersonate : KerberosTarget class
		z0[S4U2self] TGT is not available! Fetching TGT...Kerberosr  r  rf   r   r   rZ   r   r	  Nrp   rq   r
  r  r`   r   rW   rY      littleFsignedz[S4U2self] S4UByteArray: %s   z[S4U2self] chksum_data: %sHMAC_MD5r  r   re   userName	userRealmr  zauth-packagezPA-FOR-USERrd   rc   ri   rg   r_   rj   rl   rn   ro   ra   rr   rs   z$[S4U2self] Sending request to serverr   zS4U2self failed!r   r  zlS4U2self: Failed to get S4U2self! Error code (16) indicates that delegation is not enabled for this account!z#[S4U2self] Got reply, decrypting...r  r   rb   r   r   r   z[S4U2self] Got valid TGS reply)GrC   r   rt   r   r?   r   ry   rz   r{   r|   r   r   r[   r}   rF   r   rB   r   rv   r-   r  r~   r   r   r   r   rG   r*   r   r   r,   r   r  r   r   r   hexr(   r   ru   r   r   r   r   r   r    
isinstancestrlistr   r   UNKNOWNr   r   r   r   r   r  r   r@   r   rx   r   r%   r   r   r   r&   rA   r  rE   )rK   user_to_impersonater   rR   r   r   auth_package_namerz   r  r  r  r!  S4UByteArraychksum_datar  pa_for_user_encpa_for_userr"  r#  r   r$  r%  r   r  r   s                            rL   S4U2selfzKerbrosClient.S4U2self  s    
	 	<BCCC<<>>>_223CDD( h/344# ,5()!&t'8'B!C!CX $ 1' :W #W # : :W/778QSTVcdvVwVwV|V|V~V~  AE  F  F&&.#.4&"355))&D-h788&)D4MYo*p*pqq& , * 2 8,}!'!4!4!6!6,~ $*33Ax%3PP,%.55777,%,33555,#**,,,,,,|/?/?/A/AABBB,,|;<<<!$";RNN+,+koo.?.??@@@ &Ij1122&"& / -I<O<Ufy  gL  gL  gN  gN  /O  /O  !P  !P/*!4!;/+%f--/'$5/.!+";}#=#=>>+m / @ @ E E G G+n 3 ,zHH8T"" ,HH))++HHo&,,S118 , *3w<< 8 8,}'i6G6M^f(g(ghh,w/06688,w 2 : : ::CCPQCRR,v!*2..,w4<=,w +!+f(4:+j'5+h(66+j#,5666
)

SXXZZ
(
(%
Z;
4l< B&&yD	ud	#	##,4555#$T%9%A%A$B[]^`cdn`opx`y%z%z{{  C-M% +]5-A*-MNN#+c=))),/000$	mS	  rN   c                    t          j        dd                    |                                          z             t          j                            t          j        j                  }| j        	                    |          }i }t          t          d                    |d<   t          dt          t          dg                    i                                          |d<   i }t           |d<   t#          | j        d	                   |d	<   | j        d
         |d
<   |j        |d<   |                    d          |d<   | j                            | j        dt1          |                                          d           }i }	t           |	d<   t2          j        j        |	d<   t9          t                                |	d<   t;          | j        d                   |	d<   t=          | j        |d          |	d<   i }
t@          j!        j        |
d<   tE          |	                                          |
d<   i }tG          t          g d                    |d<   tI          tJ          j&        j        |                                d          |d<   | j        j'        (                                |d<   |t	          j)        d          z                       d          |d<   tU          j+        d          |d<   | j        j,        g|d <   |g|d!<   i }t           |d<   t2          j-        j        |d<   |
|g|d"<   t]          |          |d#<   tC          |          }| j/        0                    |                                          }|j1        d$k    r%d%}|j2        d&         d'k    rd(}tg          ||          t          j        d)           |j2        }ti          j5        | j        6                    | j        d*|d+         d,                             j2        }to          |d-         d.         |d-         d/                   }| j8        9                    ||           t          j        d0           |||fS )1Nz[S4U2proxy] Impersonating %srd   zPA-PAC-OPTIONSrW   r~   z%resource-based constrained delegationrY   r  r  rf   r   r   rZ   r   r	  rp   rq   r
  r  r`   r   )rO   rP   zconstrained-delegationr  rc   re   ri   rg   r_   rj   rl   rn   ro   ra   r  rr   rs   r   zS4U2proxy failed!r   r  znS4U2proxy: Failed to get S4U2proxy! Error code (16) indicates that delegation is not enabled for this account!z+[S4U2proxy] Got server reply, decrypting...r  r   rb   r   r   r   z[S4U2proxy] Got valid TGS reply):r   rt   joinr   ry   rz   r{   r|   r?   r   ru   r   r!   r"   r   rv   r   r   rC   r[   r}   rF   r   rB   r   r-   r  r~   r   r   r   rG   r*   r   r   r   r   r,   r   r   r   r   r   r   r   r  r   r@   r   rx   r   r%   r   r   r   r&   rA   r  )rK   s4uself_ticketr   r   rz   r   pa_pac_optsr  r  r  
pa_tgs_reqr"  r#  r   r$  r%  r   r  r   s                      rL   	S4U2proxyzKerbrosClient.S4U2proxyx  s4   ,-9S9S9U9U0V0VVWWWh/344#_223CDD(+";/?#@#@AA+m .:McSzR{N|N|:}:}/~    !E  !E  !G  !G+n ,5()!&t'8'B!C!CX $ 1' :W #W # : :W/778QSTVcdvVwVwV|V|V~V~  AE  F  F&&.#.4&"355))&D-h788&)D4MYo*p*pqq&*(06*]%f~~2244*^ , *3/s/s/s+t+t u u,}'i6H6N_g_y_y_{_{(|(|}},w/06688,w 2 : : ::CCPQCRR,v!*2..,w4<=,w(6'7,#$ +!+f(4:+j%{3+h(66+j#
)

SXXZZ
(
(%
Z;
4l< B&&{D	ud	#	##,<===#$T%9%A%A$B[]^`cdn`opx`y%z%z{{  C-M% +]5-A*-MNN#+c=))),0111	mS	  rN   r   c           	      8    t          ||| j        ||||          S )N)r  
seq_numberap_optscb_data)r7   rC   )rK   r   r  
sessionkeyr  rG  rH  rI  s           rL   construct_apreqzKerbrosClient.construct_apreq  s1    	%
 
 
 rN   c                 l    |                      |          \  }}}|                     |d         |          S )Nr  )r?  rE  )rK   target_userservice_spnr   r  r   s         rL   getSTzKerbrosClient.getST  s2     MM+66#}c	H{	3	33rN   c                    d }|d         D ]/}|d         dk    r!t          j        |d                   j        } n0t          d          	 t          j                            |d                   j        }n9#  t          j                            |d         dd                    j        }Y nxY w|d	         }|d
         dk    rt          d          t          j        |d                   j        }t          d                    dgd |d         D             z             d          }t          	                    t          j        |d                                                   dd          dd          }| j        j                            |          }	|d         }
|	| j        j        j        z   |
z   }|d         d         }t"          |         }|t$          j        k    r ||d          | _        nA|t$          j        k    r ||d          | _        n|t$          j        k    rt/          d          t1          |j        | j                  }|d         d         }|                    |d|          }t7          j        |          j        }t"          t          |d         d                             }t1          |j        |d         d!                   }|||fS )"Nc                 ^   d}d}t          |          |k     rt          j        t          |g          | z                                             }t          |          t          |          z   |k    r||d |t          |          z
           z  }n||z  }|dz  }t          |          |k     |S )NrN   r   r_   )r   r   r   bytesr   )r~   keysizeoutput
currentNumcurrentDigests        rL   truncate_keyz6KerbrosClient.decrypt_asrep_cert.<locals>.truncate_key  s    6:	Vw		L
|!4!4u!<==DDFFM
6{{S''''11}3gF3344V

mF!OJ 
Vw		 =rN   rr   rW   r0  rY   zPA_PK_AS_REP not found!dhSignedData   encap_content_infocontent_typez1.3.6.1.5.2.3.2z%Keyinfo content type unexpected valuecontent 1c                 ,    g | ]}t          |          S  )r6  ).0xs     rL   
<listcomp>z4KerbrosClient.decrypt_asrep_cert.<locals>.<listcomp>  s    MMM1AMMMrN   subjectPublicKeyr  r	  bigFr.  serverDHNoncer   ra       r  zBRC4 key truncation documentation missing. it is different from AESrb   r   r   r   r   )r1   r   r   r   r8   
SignedDatar2   ru   rA  
from_bytesr9   	BitStringrv   r?   r   exchanger   r'   r)   AES256rJ   AES128RC4NotImplementedErrorr&   r   r   r   )rK   as_reprW  papkasrepsdkeyinfoauthdatapubkey
shared_keyserver_noncefullKeyra   rb   r   enc_datadec_dataencasrepsession_keys                      rL   r   z KerbrosClient.decrypt_asrep_cert  s      8 . .b2> 233:G	E  
,	-	--AGN344;22AGN3BCC899@222#$'^ 111	:	;	;;wy1229(rwwuMM9K0LMMMMNNPQRR&>>$.2D)EFFKKMMabbQSXch>ii&'0088*),1::\I'

W
%%% &
gn"l7B//4"l7B//4	a	b	bb 	FND,--#J)(^^CH--(x((/(3xy9::;&FNHUOJ$?@@+	;	&&s   *A7 74B-)NF)!__name__
__module____qualname__r4   r5   rM   r   r6  boolr   r   r   r   r   r   r6   r   r  r  r+   DES_CBC_CRCDES_CBC_MD4DES_CBC_MD5DES3_CBC_SHA1ARCFOUR_HMAC_MD5AES256_CTS_HMAC_SHA1_96AES128_CTS_HMAC_SHA1_96r)  r?  rE  rK  rO  r   r`  rN   rL   r;   r;      s,       , ^     MtLsLs  CG  PT  ch  C  UY 2 2S	 2  NR 2  ^d 2 2 2 2h FpEoEo  BF I Iz~ I  KQ I I I IV >h=g=gy}  rv      "  6 %)HoHoHo  OS  ei e
 e
  AL e
  ^b e
 e
 e
 e
NK    ^! ^! ^! ^!@ WVVlz  mG  HV  Hb  cq  c}  ~L  ~Z  [i  [z  {I  {a  bp  bH  lI F, F, F, F,T 59DnDnDn  ES  Ed  es  eK  LZ  Lr  Ds o! o! o! o!d DRCbcq  dJ  KY  Kq  Cr C! C! C! C!L DHVWcequ 	 	 	 	4 4 48' 8' 8' 8' 8'rN   r;   )Kr   ry   r   typingr   r   	unicryptor   minikerberosr   minikerberos.common.ccacher   !minikerberos.network.clientsocketr   "minikerberos.protocol.asn1_structsr	   r
   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r    r!   r"   r#   minikerberos.protocol.errorsr$   r%    minikerberos.protocol.encryptionr&   r'   r(   r)   minikerberos.protocol.constantsr*   r+   r,   r-    minikerberos.protocol.structuresr.   minikerberos.protocol.rfc4556r/   r0   r1   r2   r3   minikerberos.common.credsr4   minikerberos.common.targetr5   minikerberos.common.spnr6   !minikerberos.protocol.ticketutilsr7   r   r8   r9   r;   r`  rN   rL   <module>r     s4                             - - - - - - B B B B B BE E E E E E E E E E E E E E E E E E E E E E E E E E E E E E E E E E E E E E E E E E E E E E E E E E E E E E E E E E E E J I I I I I I I S S S S S S S S S S S S _ _ _ _ _ _ _ _ _ _ _ _ B B B B B B m m m m m m m m m m m m m m 8 8 8 8 8 8 5 5 5 5 5 5 / / / / / / J J J J J J            g' g' g' g' g' g' g' g' g' g'rN   