
    he                        d Z ddlZddlmZ ddlmZ ddlmZmZm	Z	m
Z
mZmZmZmZmZmZmZmZmZmZmZmZmZmZ ddlmZ ddlmZmZ ddlmZm Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z*m+Z+m,Z,m-Z-m.Z.m/Z/m0Z0m1Z1m2Z2m3Z3m4Z4 dd	l5m6Z6m7Z7 dd
l8m9Z9  G d de          Z:i Z; G d de+          Z< G d de+          Z= G d de+          Z> G d de+          Z? G d de+          Z@ G d de+          ZA G d de+          ZB G d de+          ZC G d de+          ZDeDe;d<    G d  d!e          ZEeEe;d"<    G d# d$e          ZFeFe;d%<    G d& d'e          ZGeGe;d(<   eGe;d)<   eGe;d*<   eGe;d+<    G d, d-e+          ZHd. ZI G d/ d0e7          ZJeJe;d1<   	 dd2lKmLZL n# eM$ r eNZLY nw xY w G d3 d4eL          ZO G d5 d6eL          ZP G d7 d8eL          ZQ G d9 d:e+          ZR G d; d<e+          ZS G d= d>e+          ZT G d? d@e+          ZU G dA dBe+          ZV G dC dDe+          ZW G dE dFe+          ZX G dG dHe2e.          ZY G dI dJe+          ZZ G dK dLe+          Z[eLeNk    re[e;dM<    G dN dOe+          Z\ G dP dQe+          Z]e]e;dR<    G dS dTe          Z^e^e;dU<    G dV dWe          Z_e_e;dX<    G dY dZe          Z` G d[ d\e          Za G d] d^e          Zbebed_<   dS )`z
[MS-PAC]

https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-pac/166d8064-c863-41e1-9c23-edaaa5f36962
Up to date with version: 23.0
    N)conf)log_runtime)ConditionalFieldFieldLenFieldFieldListField
FlagsFieldLEIntEnumFieldLELongField
LEIntFieldLEShortFieldMultipleTypeFieldPacketFieldPacketListFieldStrFieldStrFieldUtf16StrFixedLenFieldStrLenFieldUtf16UTCTimeField	XStrFieldXStrLenField)Packet)_AUTHORIZATIONDATA_VALUES_KRB_S_TYPES)NDRByteFieldNDRConfFieldListFieldNDRConfPacketListFieldNDRConfStrLenFieldNDRConfVarStrLenFieldUtf16NDRConfVarStrNullFieldUtf16NDRConformantStringNDRFieldListFieldNDRFullPointerFieldNDRInt3264EnumFieldNDRIntFieldNDRLongField	NDRPacketNDRPacketFieldNDRSerialization1HeaderNDRSerializeType1PacketLenFieldNDRShortFieldNDRSignedLongFieldNDRUnionField_NDRConfFieldndr_deserialize1ndr_serialize1)_NTLMPayloadField_NTLMPayloadPacket)	WINNT_SIDc                   z    e Zd Z eddddddddd	d
ddddddd           edd           edd          gZd ZdS )PAC_INFO_BUFFERulType   zLogon informationzCredentials informationzServer SignaturezKDC Signaturez"Client name and ticket informationz"Constrained delegation informationzUPN and DNS informationzClient claims informationzDevice informationzDevice claims informationzTicket SignaturezPAC AttributeszPAC RequestorzExtended KDC Signature)r6            
                              cbBufferSizeNOffsetc                     t           j        S N)r   padding_layer)selfpayloads     ]/mounts/lovelace/software/anaconda3/lib/python3.11/site-packages/scapy/layers/msrpce/mspac.pydefault_payload_classz%PAC_INFO_BUFFER.default_payload_classe   s    !!    )__name__
__module____qualname__r	   r   r
   fields_descrL    rM   rK   r4   r4   K   s        /5.+@@5707.,+4 	
 	
( 	
>4((Hd##-K2" " " " "rM   r4   c            
           e Zd ZdZ edddd            edddd            e edd	d
 d           d          gZdS )RPC_UNICODE_STRING      LengthNBufferc                     |dz  S Nr7   rR   _xs     rK   <lambda>zRPC_UNICODE_STRING.<lambda>r   s    QQRU rM   )size_ofadjustMaximumLengthc                     |dz  S r[   rR   r\   s     rK   r_   zRPC_UNICODE_STRING.<lambda>t   s
    !a% rM    c                     | j         dz  S r[   )rb   pkts    rK   r_   zRPC_UNICODE_STRING.<lambda>z   s    S%6!%; rM   c                     | j         dz  S r[   )rX   rf   s    rK   r_   zRPC_UNICODE_STRING.<lambda>{   s    szQ rM   )size_is	length_isTdeferred)rN   rO   rP   	ALIGNMENTr*   r"   r   rQ   rR   rM   rK   rT   rT   o   s        Ihh?S?STTTT8<P<P	
 	
 	
 	&&<<77	   	
 	
 	
KKKrM   rT   c                   B    e Zd ZdZ edd           edd          gZdS )FILETIMErV   rV   dwLowDateTimer   dwHighDateTimeNrN   rO   rP   rm   r$   rQ   rR   rM   rK   ro   ro      s7        I;22KK@PRS4T4TUKKKrM   ro   c                   B    e Zd ZdZ edd           edd          gZdS )GROUP_MEMBERSHIPrp   
RelativeIdr   
AttributesNrs   rR   rM   rK   ru   ru      s5        I;|Q//\11M1MNKKKrM   ru   c                   ,    e Zd Z eddd          gZdS )CYPHER_BLOCKdatard   rW   lengthNrN   rO   rP   r   rQ   rR   rM   rK   ry   ry      s(        ##FBq999:KKKrM   ry   c                   0    e Zd Z edg ed           gZdS )USER_SESSION_KEYrz   c                     dS r[   rR   r]   s    rK   r_   zUSER_SESSION_KEY.<lambda>   s    RS rM   
count_fromN)rN   rO   rP   r   ry   rQ   rR   rM   rK   r   r      s+        "?62|TTTUKKKrM   r   c                   ,    e Zd Z eddd          gZdS )RPC_SID_IDENTIFIER_AUTHORITYValuerd   r8   r{   Nr}   rR   rM   rK   r   r      s(        ##GR:::;KKKrM   r   c                       e Zd ZdZdgZ edd           eddd           ed e            e           edg  e	d	d          d
 d          gZ
d ZdS )SIDrU   SubAuthorityRevisionr   SubAuthorityCountNr`   IdentifierAuthorityrd   c                     | j         S rG   )r   rf   s    rK   r_   zSID.<lambda>   s	     5 rM   T)ri   conformant_in_structc                 *    t          j        |           S rG   )r2   summary)rI   s    rK   r   zSID.summary   s     &&&rM   )rN   rO   rP   rm   DEPORTED_CONFORMANTSr   r'   r   r   r$   rQ   r   rR   rM   rK   r   r      s        I*+Z##($GGG!((**(	
 	

 	KA55!%	
 	
 	
K"' ' ' ' 'rM   r   c                   j    e Zd ZdZ e ed e            e          d           edd          gZdS )KERB_SID_AND_ATTRIBUTESrU   SidTrk   rw   r   N)	rN   rO   rP   rm   r"   r'   r   r$   rQ   rR   rM   rK   r   r      sP        INN5##%%==MMML!$$KKKrM   r   c            	       0   e Zd ZdZg  ed e            e           ed e            e           ed e            e           ed e            e           ed e            e           ed e            e           ed e            e           ed	 e            e           ed
 e            e           ed e            e           ed e            e           ed e            e           edd           edd           edd           edd           eddd           e	 e
d e            ged           d           edd           ed e            e           ed e            e           ed e            e           e	 ed e            e          d           ed g  ed!d          d" #           ed$d           ed%g  ed!d          d& #           ed'dd(           e	 e
d( e            ged)           d           e	 ed* e            e          d           ed+dd,           e	 e
d, e            ged-           d          ZdS ).KERB_VALIDATION_INFOrU   	LogonTime
LogoffTimeKickOffTimePasswordLastSetPasswordCanChangePasswordMustChangeEffectiveNameFullNameLogonScriptProfilePathHomeDirectoryHomeDirectoryDrive
LogonCountr   BadPasswordCountUserIdPrimaryGroupId
GroupCountNGroupIdsr   c                     | j         S rG   r   rf   s    rK   r_   zKERB_VALIDATION_INFO.<lambda>       CN rM   ri   Trk   	UserFlagsUserSessionKeyLogonServerLogonDomainNameLogonDomainId	Reserved1rd   c                     dS r[   rR   r   s    rK   r_   zKERB_VALIDATION_INFO.<lambda>       ST rM   )rj   UserAccountControl	Reserved3c                     dS )Nr9   rR   r   s    rK   r_   zKERB_VALIDATION_INFO.<lambda>   r   rM   SidCount	ExtraSidsc                     | j         S rG   r   rf   s    rK   r_   zKERB_VALIDATION_INFO.<lambda>       CL rM   ResourceGroupDomainSidResourceGroupCountResourceGroupIdsc                     | j         S rG   )r   rf   s    rK   r_   zKERB_VALIDATION_INFO.<lambda>   	    C$: rM   )rN   rO   rP   rm   r'   ro   rT   r*   r$   r"   r   ru   r   r   r!   r   rQ   rR   rM   rK   r   r      s       I:{HHJJ99:|XXZZ::: 	}hhjj(;;: 	(((**h??	:
 	*HHJJAA: 	+XXZZBB: 	(:(:(<(<>PQQ: 	z#5#5#7#79KLL: 	}&8&8&:&:<NOO: 	}&8&8&:&:<NOO: 	(:(:(<(<>PQQ: 	+-?-?-A-ACUVV: 	lA&&: 	(!,,: 	Ha  :  	$a((!:" 	L$
;;;#:$ 	""!!##$ 22	   	
 	
 	
%:6 	K##7:8 	')9)9););=MNN9:: 	}&8&8&:&:<NOO;:< 	(*<*<*>*>@RSS=:> 	NN?CCEE3GGRVWWW?:@ 	+r;;r1+=+=UUUA:B 	(!,,C:D 	+r;;r1+=+=UUUE:F 	Jk:::G:H 	""((**+'00	   	
 	
 	
I:Z 	N3SSUUC@@4	
 	
 	
[:` 	($8JKKKa:b 	"""!!##$ ::	   	
 	
 	
c:KKKrM   r   r6   c                   b    e Zd Z edd           eddddddd	d
           edd          gZdS )PAC_CREDENTIAL_INFOVersionr   EncryptionTyper6   zDES-CBC-CRCzDES-CBC-MD5AES128_CTS_HMAC_SHA1_96AES256_CTS_HMAC_SHA1_96zRC4-HMAC)r6      rA   rB      SerializedDatarM   N)rN   rO   rP   r   r	   r   rQ   rR   rM   rK   r   r      sd        
9a  ))55& 
	
 
	
 		"C((KKKrM   r   r7   c                   l    e Zd Z edddg dd           edddd	
           eddd           gZdS )PAC_CLIENT_INFOClientIdN<Q)iA  r6   r6   r   r   r   g    cA)fmtepochcustom_scaling
NameLengthName<H)	length_ofr   rM   c                     | j         S rG   )r   rf   s    rK   r_   zPAC_CLIENT_INFO.<lambda>  s    cn rM   length_from)rN   rO   rP   r   r   r   rQ   rR   rM   rK   r   r     sm        $.C.C.CTW	
 	
 	
 	lDFEEE2L2LMMMKKKrM   r   r:   c                   \    e Zd Z edde           eddd            edd          gZdS )PAC_SIGNATURE_DATASignatureTypeN	SignaturerM   c                 B    ddddd                     | j        d          S )NrV   r@   r<   )r6   l   v r?   r@   r   )getr   rf   s    rK   r_   zPAC_SIGNATURE_DATA.<lambda>,  s1    	% %
 c##Q'' rM   r   RODCIdentifier)rN   rO   rP   r	   r   r   r   rQ   rR   rM   rK   r   r   "  se        	
 	

 	( (		
 		
 		
 	!3''!KKKrM   r   r8   r9   r@   rC   c            
           e Zd ZdZ ed e            e           eddd           e ed e            ged           d	
          gZ	dS )S4U_DELEGATION_INFOrU   S4U2proxyTargetTransitedListSizeNS4UTransitedServicesr   c                     | j         S rG   )r   rf   s    rK   r_   zS4U_DELEGATION_INFO.<lambda>I  	    C$9 rM   r   Trk   )
rN   rO   rP   rm   r'   rT   r$   r"   r   rQ   rR   rM   rK   r   r   ?  s        I(*<*<*>*>@RSS'7MNNN""&##%%&"99	   	
 	
 	
KKKrM   r   c                    | j         d         D ]\  }}|                     d          j        |                             | |          }||         }|                     |dz             .|d|         t          j        d|          z   ||dz   d         z   }|                     |dz             1|d|dz            t          j        d|          z   ||dz   d         z   }||z  }|S )z:Util function to build the offset and populate the lengthsPayloadLenNr   r7   BufferOffsetrV   )fields	get_field
fields_mapi2lengetfieldvalstructpack)rI   p
pay_offsetr   
field_namevaluer|   offsets           rK   _pac_post_buildr   S  s    ![3 	 	
E	**5jAGGeTT
#J.//7'6'
V[v6666A:<<HAJ788@,FQJ,&+dJ"?"??!FQJLL/QAf

HrM   c                      e Zd Z edd           edd           edd           edd           edddd	d
g           e edd          d            e edd          d            e edd          d            e edd          d            e edd edd           edd           edd           e	d e
            e
          g          d fg edd edd           edd          g                    g
Zd ZdS )UPN_DNS_INFOUpnLenNUpnBufferOffsetDnsDomainNameLenDnsDomainNameBufferOffsetFlagsr   US
SamNameLenc                     | j         j        S rG   r   r  rf   s    rK   r_   zUPN_DNS_INFO.<lambda>t  
    	 rM   SamNameBufferOffsetc                     | j         j        S rG   r  rf   s    rK   r_   zUPN_DNS_INFO.<lambda>y  r  rM   SidLenc                     | j         j        S rG   r  rf   s    rK   r_   zUPN_DNS_INFO.<lambda>~  r  rM   SidBufferOffsetc                     | j         j        S rG   r  rf   s    rK   r_   zUPN_DNS_INFO.<lambda>  r  rM   r      UpnrM   DnsDomainNameSamNamer   c                     | j         j        S rG   r  rf   s    rK   r_   zUPN_DNS_INFO.<lambda>  s
    	 rM   r<   c                 j    d}ddd}| j         j        rd}d|d<   d|d<   t          | |||          |z   S )	Nr<   r   rV   )r  r  r  r  r@   r   )r   r  r   )rI   rg   payr   r   s        rK   
post_buildzUPN_DNS_INFO.post_build  sg    
 
 :< 	F "F9F5M	  	
rM   )rN   rO   rP   r   r   r   r   r0   r   r   r2   rQ   r  rR   rM   rK   r   r   b  s       Xt$$&--'..0$77
		
 	
 	Lt,,##	
 	

 	L.55##	
 	

 	L4((##	
 	

 	L*D11##	
 	

 	 &%!)M%55)M/3??)M)S99'Kyy{{IFF		 	 ,+" !M%--!M/377 %	
 	
E=K~
 
 
 
 
rM   r   r<   )IntEnumc                       e Zd ZdZdZdZdZdS )
CLAIM_TYPEr6   r7   r   r8   N)rN   rO   rP   CLAIM_TYPE_INT64CLAIM_TYPE_UINT64CLAIM_TYPE_STRINGCLAIM_TYPE_BOOLEANrR   rM   rK   r  r    s(        rM   r  c                       e Zd ZdZdZdS )CLAIMS_SOURCE_TYPEr6   r7   N)rN   rO   rP   CLAIMS_SOURCE_TYPE_ADCLAIMS_SOURCE_TYPE_CERTIFICATErR   rM   rK   r  r    s        %&"""rM   r  c                       e Zd ZdZdZdZdZdS )CLAIMS_COMPRESSION_FORMATr   r7   r   rV   N)rN   rO   rP   COMPRESSION_FORMAT_NONECOMPRESSION_FORMAT_LZNT1COMPRESSION_FORMAT_XPRESSCOMPRESSION_FORMAT_XPRESS_HUFFrR   rM   rK   r!  r!    s(          !%&"""rM   r!  c            	       d    e Zd ZdZ eddd           e edg ed           d	          gZdS )
CLAIM_ENTRY_sub0rU   
ValueCountNInt64Valuesr   c                     | j         S rG   r(  rf   s    rK   r_   zCLAIM_ENTRY_sub0.<lambda>  r   rM   r   Trk   )	rN   rO   rP   rm   r$   r"   r   r+   rQ   rR   rM   rK   r'  r'    sl        IL$>>>!!"22	   	
 	
 	
KKKrM   r'  c            	       d    e Zd ZdZ eddd           e edg ed           d	          gZdS )
CLAIM_ENTRY_sub1rU   r(  NUint64Valuesr   c                     | j         S rG   r+  rf   s    rK   r_   zCLAIM_ENTRY_sub1.<lambda>  s    cn rM   r   Trk   	rN   rO   rP   rm   r$   r"   r   r%   rQ   rR   rM   rK   r-  r-    sj        IL$???!!L:T:T   		
 	
 	
KKKrM   r-  c                       e Zd ZdZ eddd           e edg  e edd          d	          d
           d	          gZdS )CLAIM_ENTRY_sub2rU   r(  NStringValuesr   	StringValrd   Trk   c                     | j         S rG   r+  rf   s    rK   r_   zCLAIM_ENTRY_sub2.<lambda>  r   rM   r   )	rN   rO   rP   rm   r$   r"   r   r   rQ   rR   rM   rK   r2  r2    s        IL$???!!##//R@@!   32   	
 	
 	
KKKrM   r2  c            	       d    e Zd ZdZ eddd           e edg ed           d	          gZdS )
CLAIM_ENTRY_sub3rU   r(  NBooleanValuesr   c                     | j         S rG   r+  rf   s    rK   r_   zCLAIM_ENTRY_sub3.<lambda>  s    s~ rM   r   Trk   r0  rR   rM   rK   r7  r7    sj        IL$@@@!!\;U;U   		
 	
 	
KKKrM   r7  c                   ^   e Zd ZdZ e edd          d           edde           e e	d e
            e
          d	 d
 ff e	d e            e          d d ff e	d e            e          d d ff e	d e            e          d d ffg eddd          dd          gZdS )CLAIM_ENTRYrU   Idrd   Trk   Typer   Valuesc                 @    t          | dd           t          j        k    S Nr=  )getattrr  r  rf   s    rK   r_   zCLAIM_ENTRY.<lambda>  s    VT(B(B):); rM   c                 ,    |j         t          j        k    S rG   )tagr  r  r]   vals     rK   r_   zCLAIM_ENTRY.<lambda>   s    :3N(N rM   c                 @    t          | dd           t          j        k    S r@  )rA  r  r  rf   s    rK   r_   zCLAIM_ENTRY.<lambda>'      VT(B(B);)< rM   c                 ,    |j         t          j        k    S rG   )rC  r  r  rD  s     rK   r_   zCLAIM_ENTRY.<lambda>*      :3O(O rM   c                 @    t          | dd           t          j        k    S r@  )rA  r  r  rf   s    rK   r_   zCLAIM_ENTRY.<lambda>1  rG  rM   c                 ,    |j         t          j        k    S rG   )rC  r  r  rD  s     rK   r_   zCLAIM_ENTRY.<lambda>4  rI  rM   c                 @    t          | dd           t          j        k    S r@  )rA  r  r  rf   s    rK   r_   zCLAIM_ENTRY.<lambda>;  s    VT(B(B)<)= rM   c                 ,    |j         t          j        k    S rG   )rC  r  r  rD  s     rK   r_   zCLAIM_ENTRY.<lambda>>  s    :3P(P rM   r{   )r7   rW   )HI)align
switch_fmtN)rN   rO   rP   rm   r"   r   r#   r  r,   r'   r'  r-  r2  r7  r   rQ   rR   rM   rK   r;  r;    sq       I77bAADQQQFAz22 #N8-=-=-?-?AQRR; ; ON	 #N8-=-=-?-?AQRR< < PO	 #N8-=-=-?-?AQRR< < PO	 #N8-=-=-?-?AQRR= = QP	?)T Xr!444![.	
 .	
 .	
2KKKrM   r;  c            
           e Zd ZdZ edde           eddd           e ed e	            ge	d 	          d
          gZ
dS )CLAIMS_ARRAYrU   usClaimsSourceTyper   ulClaimsCountNClaimEntriesr   c                     | j         S rG   )rU  rf   s    rK   r_   zCLAIMS_ARRAY.<lambda>S  s	    C$5 rM   r   Trk   )rN   rO   rP   rm   r#   r  r$   r"   r   r;  rQ   rR   rM   rK   rS  rS  I  s        I0!5GHHOT>BBB""55	   	
 	
 	
KKKrM   rS  c                       e Zd ZdZ eddd           e ed e            ged           d	           ed
d           eddd           e e	ddd           d	          gZ
dS )
CLAIMS_SETrU   ulClaimsArrayCountNClaimsArraysr   c                     | j         S rG   )rZ  rf   s    rK   r_   zCLAIMS_SET.<lambda>c  r   rM   r   Trk   usReservedTyper   ulReservedFieldSizeReservedFieldrd   c                     | j         S rG   r^  rf   s    rK   r_   zCLAIMS_SET.<lambda>k  	    9P rM   )rN   rO   rP   rm   r$   r"   r   rS  r*   r   rQ   rR   rM   rK   rY  rY  Z  s        I($GGG"" ::	   	
 	
 	
 	&**)4III-P-P   		
 	
 	
KKKrM   rY  c                   (    e Zd ZdZdZd Zd Zd ZdS )_CLAIMSClaimSetTc                 z    |j         t          j        k    rt          |t          d          S t          |          S )NFndr64)r   )usCompressionFormatr!  r"  r.   rY  r    )rI   rg   ss      rK   m2iz_CLAIMSClaimSet.m2iv  s<    "&?&WWW#Az???? 'Q////rM   c                 x    |d         }|j         t          j        k    rt          |          S t	          |          S Nr   )rh  r!  r"  r/   bytes)rI   rg   rE  s      rK   i2mz_CLAIMSClaimSet.i2m}  s9    !f"&?&WWW!#&&& ::rM   c                 f    |j         t          j        k    r|                     |          d         S |S rl  )rh  r!  r"  _subval)rI   rg   r^   s      rK   valueofz_CLAIMSClaimSet.valueof  s.    "&?&WWW<<??1%%HrM   N)rN   rO   rP   CONFORMANT_STRINGLENGTH_FROMrj  rn  rq  rR   rM   rK   rd  rd  r  sL        K0 0 0      rM   rd  c                       e Zd ZdZ eddd           e edddd           d	           ed
de           eddd           e	dd           eddd           e e
ddd           d	          gZdS )CLAIMS_SET_METADATArU   ulClaimsSetSizeN	ClaimsSetr   c                     | j         S rG   )rv  rf   s    rK   r_   zCLAIMS_SET_METADATA.<lambda>  s	    S=P rM   r   Trk   rh  r   ulUncompressedClaimsSetSizer]  r^  r_  rd   c                     | j         S rG   ra  rf   s    rK   r_   zCLAIMS_SET_METADATA.<lambda>  rb  rM   )rN   rO   rP   rm   r$   r"   rd  r#   r!  r*   r   rQ   rR   rM   rK   ru  ru    s        I%t[AAAOT41P1P   		
 	
 	
 	!%	
 	
 	14MMM&**)4III-P-P   		
 	
 	
#KKKrM   ru  c                   :    e Zd Z ed e            e          gZdS )PAC_CLIENT_CLAIMS_INFOClaimsN)rN   rO   rP   r'   ru  rQ   rR   rM   rK   r|  r|    s/        !>(,?,?,A,ACVWWXKKKrM   r|  r=   c            
           e Zd ZdZ e ed e            e          d           edd           e ed e	            ge	d 	          d          gZ
d
S )DOMAIN_GROUP_MEMBERSHIPrU   DomainIdTrk   r   r   r   c                     | j         S rG   r   rf   s    rK   r_   z DOMAIN_GROUP_MEMBERSHIP.<lambda>  r   rM   r   N)rN   rO   rP   rm   r"   r'   r   r$   r   ru   rQ   rR   rM   rK   r  r    s        INN:ssuucBBTRRRL!$$""!!##$ 22	   	
 	
 	
KKKrM   r  c                      e Zd ZdZ edd           edd           e ed e            e          d           edd           e ed	 e	            ge	d
           d           edd           e ed e
            ge
d           d           edd           e ed e            ged           d          g	ZdS )PAC_DEVICE_INFOrU   r   r   r   AccountDomainIdTrk   AccountGroupCountAccountGroupIdsc                     | j         S rG   )r  rf   s    rK   r_   zPAC_DEVICE_INFO.<lambda>  r   rM   r   r   r   c                     | j         S rG   r   rf   s    rK   r_   zPAC_DEVICE_INFO.<lambda>  r   rM   DomainGroupCountDomainGroupc                     | j         S rG   )r  rf   s    rK   r_   zPAC_DEVICE_INFO.<lambda>  s	    C$8 rM   N)rN   rO   rP   rm   r$   r"   r'   r   r   ru   r   r  rQ   rR   rM   rK   r  r    s{       IHa  $a((N,cceeS99D	
 	
 	
 	'++""!!!##$ 99	   	
 	
 	
 	J""""((**+'00	   	
 	
 	
 	&**""((**+'88	   	
 	
 	
7$KKKrM   r  r>   c                   f    e Zd Z edd           eddg edddddd	          d
           gZdS )PAC_ATTRIBUTES_INFOFlagsLengthr7   r   PAC_WAS_REQUESTEDrd   r   r   PAC_WAS_GIVEN_IMPLICITLY)r6   r7   c                     | j         dz   dz  S )Nr9   rW   )r  rf   s    rK   r_   zPAC_ATTRIBUTES_INFO.<lambda>  s    COa$7A#= rM   r   N)rN   rO   rP   r   r   r   rQ   rR   rM   rK   r  r    sq        
=!$$ !J 3 : 	  >=	
 	
 	
KKKrM   r  rA   c                   :    e Zd Z ed e            e          gZdS )PAC_REQUESTORr   N)rN   rO   rP   r   r2   rQ   rR   rM   rK   r  r    s,        E99;;	22KKKrM   r  rB   c                        e Zd Z fdZ xZS )_PACTYPEBuffersc                    d}t          |          t          |j                  k    r>t          j        d           t	          t
          |                               |||          S dt          |j                  z  dz   }t          |          D ]\  }}|                     ||          }|j        |         }	t          |	t                    st          |	t                    rt          t          |	                    }
nt          |	          }
|j        +|d d         t          j        d|
          z   |dd          z   }|j        +|d d         t          j        d|          z   |dd          z   }||
z  }|| dz  z  }||z  }||z   S )NrM   z5Size of 'Buffers' does not match size of 'Payloads' !r@   rW   rV   <Ir   )lenPayloadsr   warningsuperr  addfield	enumeratern  
isinstancer&   r(   r/   rD   r   r   rE   )rI   rg   ri  rE  resr   ivr^   r  lgth	__class__s              rK   r  z_PACTYPEBuffers.addfield  s   s88s3<(((( WXXX$//88aEEEc#,'''!+cNN 	 	DAqa  A,q/C#y))  Z=T-U-U  >#..//3xx~%bqbEFKd333ae;xbqbEFKf555"##>dNFw!m#F1HCC3wrM   )rN   rO   rP   r  __classcell__)r  s   @rK   r  r    s8                rM   r  c                       e Zd Zd Zd ZdS )_PACTYPEPayloadsc                     t          |t                    st          |t                    rt          |          }nt	          |          }|dt          |           dz  z  z   S )N    rW   )r  r&   r(   r/   rm  r  )rI   rg   rE  ri  s       rK   rn  z_PACTYPEPayloads.i2m1  s\    c9%% 	C9P)Q)Q 	s##AAc

A7Aw!m,,,rM   c                    |r|s|g fS g }t          t          |j                            D ]}|j        |         }|j        dt          |j                  z  z
  dz
  }	 t          |j                 }|j        dk    rt          t          |t                    r#t          ||||j        z            |d          }n |||||j        z                      }t          j        |v rt          j        |t          j                 j                  }	|t          j                 j        }
|
s#|                                 t#          d          |
                                 |
                    |	           n4# t          $ r' t          j        ||||j        z                      }Y nw xY w|                    |           d|fS )	Nr@   rW   r   Frf  )loadzDissection failedrM   )ranger  BuffersrE   	_PACTYPESr5   rD   KeyError
issubclassr&   r.   r   	raw_layerrH   r  
underlayershow
ValueErrorremove_payloadadd_payloadappend)rI   rg   ri  resultr  bufr   clsrE  padlays              rK   getfieldz_PACTYPEPayloads.getfield8  s    	! 	b5Ls3;''(( 	 	A+a.CZ"s3;'7'7"77!;FP
+#q(("Nc9-- E*&6C,<#<<=#  CC #a#2B)B BCDDC>S((,#dn2E2JKKKCdn-8C >


()<===&&(((OOC((( P P P(6FS=M4M+M)NOOPMM#F{s   DE44.F%$F%N)rN   rO   rP   rn  r  rR   rM   rK   r  r  0  s2        - - -    rM   r  c                       e Zd ZdZ edddd           edd           ed e            ged	 
           edg d          gZ	dS )PACTYPEzPACTYPE - PACcBuffersNr  r  )count_ofr   r   r   c                     | j         S rG   )r  rf   s    rK   r_   zPACTYPE.<lambda>c  s    3< rM   r   r  )
rN   rO   rP   namer   r   r  r4   r  rQ   rR   rM   rK   r  r  Z  s        Dj$EEE
9j))_//		
 	
 	
 	R..
KKKrM   r     )c__doc__r   scapy.configr   scapy.errorr   scapy.fieldsr   r   r   r   r	   r
   r   r   r   r   r   r   r   r   r   r   r   r   scapy.packetr   scapy.layers.kerberosr   r   scapy.layers.dcerpcr   r   r   r   r   r   r    r!   r"   r#   r$   r%   r&   r'   r(   r)   r*   r+   r,   r-   r.   r/   scapy.layers.ntlmr0   r1   scapy.layers.smb2r2   r4   r  rT   ro   ru   ry   r   r   r   r   r   r   r   r   r   r   r   enumr  ImportErrorobjectr  r  r!  r'  r-  r2  r7  r;  rS  rY  rd  ru  r|  r  r  r  r  r  r  r  rR   rM   rK   <module>r     sM	           # # # # # #                                       (                                                             0        ( ' ' ' ' '
" " " " "f " " "< 	       &V V V V Vy V V V
O O O O Oy O O O
; ; ; ; ;9 ; ; ;V V V V Vy V V V< < < < <9 < < <' ' ' ' ') ' ' '0    i   < < < < <9 < < <~ $	!
    &   $ #	!
    f    !	#
       * "	!!	!$	$$	$
    )   (  S
 S
 S
 S
 S
% S
 S
 S
l 	#   GGG       ' ' ' ' ' ' ' '
' ' ' ' ' ' ' '    y    
 
 
 
 
y 
 
 
    y   &
 
 
 
 
y 
 
 
4 4 4 4 4) 4 4 4n    9   "       0    m%D   4    )   8Y Y Y Y YY Y Y Y f+IcN    i   "& & & & &i & & &R !	#
    &   ( &	$
    F     	$
    o   2' ' ' ' ' ' ' 'T    f    ") #   s   F FF