def get_user_hashes(cls, user: registry.CM_KEY_NODE,
samhive: registry.RegistryHive,
hbootkey: bytes) -> Optional[Tuple[bytes, bytes]]:
## Will sometimes find extra user with rid = NAMES, returns empty strings right now
try:
rid = int(str(user.get_name()), 16)
except ValueError:
return None
sam_data = None
for v in user.get_values():
if v.get_name() == 'V':
sam_data = samhive.read(v.Data + 4, v.DataLength)
if not sam_data:
return None
lm_offset = unpack("<L", sam_data[0x9c:0xa0])[0] + 0xCC
lm_len = unpack("<L", sam_data[0xa0:0xa4])[0]
nt_offset = unpack("<L", sam_data[0xa8:0xac])[0] + 0xCC
nt_len = unpack("<L", sam_data[0xac:0xb0])[0]
lm_revision = sam_data[lm_offset + 2:lm_offset + 3]
lmhash = None
if lm_revision == b'\x01':
if lm_len == 20:
enc_lm_hash = sam_data[lm_offset + 0x04:lm_offset + 0x14]
lmhash = cls.decrypt_single_hash(rid, hbootkey, enc_lm_hash,
cls.almpassword)
elif lm_revision == b'\x02':
if lm_len == 56:
lm_salt = sam_data[lm_offset + 4:lm_offset + 20]
enc_lm_hash = sam_data[lm_offset + 20:lm_offset + 52]
lmhash = cls.decrypt_single_salted_hash(
rid, hbootkey, enc_lm_hash, cls.almpassword, lm_salt)
# NT hash decryption
nthash = None
nt_revision = sam_data[nt_offset + 2:nt_offset + 3]
if nt_revision == b'\x01':
if nt_len == 20:
enc_nt_hash = sam_data[nt_offset + 4:nt_offset + 20]
nthash = cls.decrypt_single_hash(rid, hbootkey, enc_nt_hash,
cls.antpassword)
elif nt_revision == b'\x02':
if nt_len == 56:
nt_salt = sam_data[nt_offset + 8:nt_offset + 24]
enc_nt_hash = sam_data[nt_offset + 24:nt_offset + 56]
nthash = cls.decrypt_single_salted_hash(
rid, hbootkey, enc_nt_hash, cls.antpassword, nt_salt)
return lmhash, nthash
def get_user_name(cls, user: registry.CM_KEY_NODE, samhive: registry.RegistryHive) -> Optional[bytes]:
value = None
for v in user.get_values():
if v.get_name() == 'V':
value = samhive.read(v.Data + 4, v.DataLength)
if not value:
return None
name_offset = unpack("<L", value[0x0c:0x10])[0] + 0xCC
name_length = unpack("<L", value[0x10:0x14])[0]
if name_length > len(value):
return None
username = value[name_offset:name_offset + name_length]
return username