
    i                        S r SSKrSSKrSSKrSSKrSSKrSSKrSSKrSSK	r	SSK
JrJrJr  SSKJr  SSKJrJrJrJr  SSKJrJrJrJr  SSKJrJrJrJrJrJ r J!r!J"r"  SSK#J$r$J%r%J&r&J'r'  SS	K(J)r)  SS
K*J+r+J,r,J-r-J.r.J/r/J0r0J1r1J2r2J3r3J4r4J5r5J6r6J7r7J8r8  Sr9 SSK:r:Sr9Sr< SSK=J>r>  Sr<S\	R~                  \"   S\	R~                  \	R                  \A\	R                  \C\A4   4      4S jrDS\	R~                  \!   S\	R~                  \	R                  \	R                  \A\	R                  4         4S jrGS\S\	R                  \A\	R                  4   4S jrHS\S\	R                  \A\	R                  4   4S jrIS\S\	R~                  \A   S\	R                  \A\	R                  4   4S jrJ  S-S\%S\	R~                  \A   S\	R~                  \A   S\	R                  \A\	R                  4   4S jjrK  S-S\&S\	R~                  \A   S\	R~                  \A   S\	R                  \A\	R                  4   4S jjrLS\MS\	R                  \A\	R                  4   4S jrNS\MS\	R                  \A\	R                  4   4S jrOS\MS\	R                  \A\	R                  4   4S jrPS\MS \4S\	R                  \A\	R                  4   4S! jrQS\MS"\RS\	R                  \	R                  \A\	R                  4      4S# jrSS$\	R                  \A   SS4S% jrTS$\	R                  \A   S\R                  4S& jrV   S.S'\WS\	R~                  \A   S\	R~                  \A   S(\	R~                  \	R                  \A\4      S\	R                  \A\	R                  4   4
S) jjrXS'\WS\	R                  \	R                  \A\	R                  4      4S* jrY\ZS+:X  a  \T" \R                  S,S 5        gg! \; a     GN;f = f! \; a     GN=f = f)/z
Script that can be used to parse a Negotiate token and output a human readable structure. You can pass in an actual
SPNEGO token or just a raw Kerberos or NTLM token, the script should be smart enough to detect the structure of the
input.
    N)unpack_asn1unpack_asn1_object_identifierunpack_asn1_sequence)GSSMech)KerberosV5Msg
parse_enumparse_flagsparse_kerberos_token)hmac_md5ntowfv1ntowfv2rc4k)AuthenticateAvId	Challenge	NegotiateNegotiateFlagsNTClientChallengeV2
TargetInfoVersion)InitialContextTokenNegTokenInitNegTokenRespunpack_token)to_bytes)DistinguishedNameTypeTlsCipherSuiteTlsClientCertificateTypeTlsCompressionMethodTlsContentTypeTlsECCurveTypeTlsECPointFormatTlsExtensionTypeTlsHandshakeMessageTypeTlsProtocolVersionTlsPskKeyExchangeModeTlsServerNameTypeTlsSignatureSchemeTlsSupportedGroupFT)yamlversionreturnc                     U (       d  g U R                   U R                  U R                  [        R                  " U R
                  5      R                  5       U R                  S.$ )N)MajorMinorBuildReservedNTLMRevision)majorminorbuildbase64	b16encodereserveddecoderevision)r+   s    I/home/james-whalen/.local/lib/python3.13/site-packages/spnego/__main__.py_parse_ntlm_versionr<   S   sQ      $$W%5%56==?((     target_infoc                 P   U c  g [         R                  [         R                  [         R                  [         R                  [         R
                  [         R                  /n/ nU R                  5        GH.  u  p4U[         R                  :X  a  S nOX1;   a  UnOU[         R                  :X  a  [        U5      nOU[         R                  :X  a  [        U5      nOU[         R                  :X  at  UR                  UR                  [         R"                  " UR$                  5      R'                  5       [         R"                  " UR(                  5      R'                  5       S.nO$[         R"                  " U5      R'                  5       nUR+                  [-        U5      US.5        GM1     U$ )N)SizeZ4
CustomData	MachineId)r   Value)r   nb_computer_namenb_domain_namedns_computer_namedns_domain_namedns_tree_nametarget_nameitemseolflagsr	   	timestampstrsingle_hostsizez4r6   r7   custom_datar9   
machine_idappendr   )r>   text_valuesinfoav_id	raw_valuevalues         r;   _parse_ntlm_target_infor[   b   sE     	K D'--/DHHE!Edjj 	*Ednn$	NEd&&&!ll$..y/D/DELLN#--i.B.BCJJL	E $$Y/668EZ.?@) 0, Kr=   datac           
      
   U R                  5       n[        U R                  [        S9[        R
                  " SUSS 5      S   [        R
                  " SUSS 5      S   [        R
                  " SUSS 5      S   S	.[        R
                  " SUSS
 5      S   [        R
                  " SUS
S 5      S   [        R
                  " SUSS 5      S   S	.[        U R                  5      U R                  U R                  S.S.nU$ )N	enum_type<H      r      <I   LenMaxLenBufferOffset          )
DomainNameWorkstation)r   DomainNameFieldsWorkstationFieldsr   Payload)
packr	   rM   r   structunpackr<   r+   domain_nameworkstationr\   b_datamsgs      r;   _parse_ntlm_negotiaterz      s    YY[F &djjNK==vb}5a8mmD&B-8;"MM$r">qA
 ==vb}5a8mmD&B-8;"MM$r">qA

 't||4**++
C& Jr=   c                    U R                  5       n[        R                  " SUSS 5      S   [        R                  " SUSS 5      S   [        R                  " SUSS 5      S   S.[        U R                  [
        S	9[        R                  " US
S 5      R                  5       [        R                  " USS 5      R                  5       [        R                  " SUSS 5      S   [        R                  " SUSS 5      S   [        R                  " SUSS 5      S   S.[        U R                  5      U R                  [        U R                  5      S.S.nU$ )Nr`         r   ra   rd   rc   rf   r^   re   rl   (   *   ,   0   )
TargetNamer   )TargetNameFieldsr   ServerChallenger1   TargetInfoFieldsr   rq   )rr   rs   rt   r	   rM   r   r6   r7   r9   r<   r+   rJ   r[   r>   rw   s      r;   _parse_ntlm_challenger      s1   YY[F ==vb}5a8mmD&B-8;"MM$r">qA

 &djjNK!++F2bM:AAC$$VBr]3::<==vb}5a8mmD&B-8;"MM$r">qA

 't||4**1$2B2BC
C* Jr=   passwordc                 ~   U R                  5       n[        R                  " SUSS 5      S   [        R                  " SUSS 5      S   [        R                  " SUSS 5      S   S.[        R                  " SUSS	 5      S   [        R                  " SUS	S
 5      S   [        R                  " SUS
S 5      S   S.[        R                  " SUSS 5      S   [        R                  " SUSS 5      S   [        R                  " SUSS 5      S   S.[        R                  " SUSS 5      S   [        R                  " SUSS 5      S   [        R                  " SUSS 5      S   S.[        R                  " SUSS 5      S   [        R                  " SUSS 5      S   [        R                  " SUSS 5      S   S.[        R                  " SUSS 5      S   [        R                  " SUSS 5      S   [        R                  " SUSS 5      S   S.[        U R                  [
        S9[        U R                  5      U R                  (       a.  [        R                  " U R                  5      R                  5       OS S S U R                  U R                  U R                  S S.S.
nS nU R                  nU R                   nU(       a  S S S.nU(       a  [#        U5      S
:X  a-  SUS'   [        R                  " U5      R                  5       US'   OYSUS'   [        R                  " US S 5      R                  5       US'   [        R                  " USS  5      R                  5       US '   XsS!   S"'   U(       Ga  S S S#.n[#        U5      S
:X  a.  S$US'   [        R                  " U5      R                  5       US%'   GOdUS S n	S&US'   [        R                  " U	5      R                  5       US%'   [$        R                  " USS  5      n
USS  nU
R&                  U
R(                  [        R                  " SUS'S( 5      S   [        R                  " SUS(S) 5      S   [+        U
R,                  5      [        R                  " U
R.                  5      R                  5       [        R                  " SUS
S 5      S   [1        U
R2                  5      [        R                  " SUS*S  5      S   S+.	US,'   U(       a-  [5        US!   S-   [7        U5      US!   S.   5      n[9        X5      nXS!   S/'   U R:                  (       a4  [        R                  " U R:                  5      R                  5       US!   S0'   U R                  [
        R<                  -  (       a}  U R                  [
        R>                  -  (       d"  U R                  [
        R@                  -  (       a9  S nU(       a/  [C        U[D        RF                  " [H        U R:                  5      5      nOUnU(       a$  [        R                  " U5      R                  5       OS1US2'   U$ )3Nr`   r|   r}   r   ra   rd   rc   rf      re   rk      rl   $   &   r~   r   .   r   4   6   8   <   r^   )LmChallengeResponseNtChallengeResponserm   UserNamern   EncryptedRandomSessionKey)
LmChallengeResponseFieldsNtChallengeResponseFieldsro   UserNameFieldsrp   EncryptedRandomSessionKeyFieldsr   r   MICrq   )ResponseType
LMProofStrLMv1r   r   LMv2ChallengeFromClientrq   r   )r   
NTProofStrNTLMv1r   NTLMv2         )	RespType
HiRespType	Reserved1	Reserved2	TimeStampr   	Reserved3AvPairs	Reserved4ClientChallenger   rm   r   r   zFailed to derive
SessionKey)%rr   rs   rt   r	   rM   r   r<   r+   micr6   r7   r9   ru   	user_namerv   lm_challenge_responsent_challenge_responselenr   	resp_typehi_resp_typerO   
time_stampchallenge_from_clientr[   av_pairsr   r   r   encrypted_random_session_keykey_exchsignsealr   typingcastbytes)r\   r   rx   ry   key_exchange_keylm_response_datant_response_datalm_responsent_responsent_proof_str	challengeb_challengeresponse_key_ntsession_keys                 r;   _parse_ntlm_authenticater      s   YY[F ==vb}5a8mmD&B-8;"MM$r">qA&
 ==vb}5a8mmD&B-8;"MM$r">qA&
 ==vb}5a8mmD&B-8;"MM$r">qA
 ==vb}5a8mmD&B-8;"MM$r">qA
 ==vb}5a8mmD&B-8;"MM$r">qA
 ==vb}5a8mmD&B-8;"MM$r">qA,

 &djjNK&t||46:hhv)002D#'#'**++)-
E*)CX 1111 5

  3'7#8B#>*0K'(.(8(89I(J(Q(Q(SK% +1K'(.(8(89I#29N(O(V(V(XK%171A1ABRSUSVBW1X1_1_1aK-.0;I,- 5

  B&*2K'(.(8(89I(J(Q(Q(SK% ,CR0L*2K'(.(8(8(F(M(M(OK%+223CBC3HII*23/K &//'44#]]4Qq1AB1E#]]4Qq1AB1E !5!56'-'7'7	8W8W'X'_'_'a#]]4R1CDQG293E3EF#]]4RS1AB1E
.K)* ")#i.*DghFWY\]fYghtYu"v#+O#J 0;I,-((6<6F6FtGhGh6i6p6p6rI23zzN+++n>Q>Q1QUYU_U_bpbubuUu/UDDeDe1fgK 'BM((5<<>SeCJr=   secretencodingc                    U R                   (       a)  U R                    Vs/ s H  n[        U[        S9PM     snOS nS nU R                  (       a  [	        U R                  XS9nU=(       d    SnUU R
                  b  [        U R
                  5      OS UU R                  b.  [        R                  " U R                  5      R                  5       OS S.nU R                  (       d  U R                  (       a`  U R                  (       a  U R                  R                  U5      OS U R                  (       a  U R                  R                  U5      OS S.US'   U$ s  snf )Nr^   r   r   utf-8)	mechTypesreqFlags	mechTokenmechListMIC)hintNamehintAddressnegHints)
mech_typesr   r   
mech_tokenparse_token	req_flagsr	   mech_list_micr6   r7   r9   	hint_namehint_address)r\   r   r   mr   r   ry   s          r;   _parse_spnego_initr   >  s   
 QUP_P_DOOLOq*Q'2OLeiJJ S
"7H  37>>3MK/SWHLHZHZHfv''(:(:;BBDlp	C ~~** <@>>--h7tAEARAR4,,33H=X\
J
 J- Ms   Ec                 r   U R                   (       a  [        U R                   [        S9OS nS nU R                  (       a  [	        U R                  XS9nU R
                  b  [        U R
                  5      OS UUU R                  b.  [        R                  " U R                  5      R                  5       OS S.nU$ )Nr^   r   )negStatesupportedMechresponseTokenr   )
supported_mechr   r   response_tokenr   	neg_stater   r6   r7   r9   )r\   r   r   r   r   ry   s         r;   _parse_spnego_respr   \  s    
 LPK^K^Z 3 3wGdhNN$T%8%8[ 37..2LJt~~.RV''HLHZHZHfv''(:(:;BBDlp	C Jr=   viewc                    [        [        R                  " SU S S 5      S   5      nU SS  n U S S nU SS  n [        R                  " SU S S 5      S   nU SS  n U S U nXS  n [        R                  " SU S S 5      S   nU SS  n U S U nXS  n / nU(       a_  [        [        R                  " SUS S 5      S   5      nUR	                  UR
                   SUR                  S 35        USS  nU(       a  M_  [        R                  " SU S S 5      S   n	U SS  n U S U	 n
X	S  n / nU
(       aN  [        [        R                  " SU
S S 5      S   5      nUR	                  [        U5      5        U
SS  n
U
(       a  MN  [        R                  " SU S S 5      S   nU SS  n U S U nXS  n [        US	5      n[        U5      [        R                  " U5      R                  5       [        R                  " U5      R                  5       UUUS
.$ )N>Hr   r   rl   B    - 0x04XT)ProtocolVersionRandom	SessionIDCipherSuitesCompressionMethods
Extensions)r%   rs   rt   r   rU   namerZ   r   r   _parse_tls_extensionsr6   r7   r9   )r   protocol_versionrandomsession_id_len
session_idcipher_suites_lencipher_suites_viewcipher_suitescscompression_methods_lencompression_methods_viewcompression_methodscmextensions_lenextensions_view
extensionss                   r;   !_parse_tls_handshake_client_hellor  p  sQ    *&--d2Ah*G*JK8D#2YF9D]]3Ra1!4N8Do~&J DdD!H5a88D001"#DM
FMM$0B2A0FGJKybhhs^<=/3 

 %mmCbq:1=8D#$<%<=()D
"!&--5Mbq5Q"RST"UV"":b>2#;AB#?  #
"
 ]]4bq215N8D?N+O D&=J &&67""6*113%%j188:%1  r=   c                    [        [        R                  " SU S S 5      S   5      nU SS  n U S S nU SS  n [        R                  " SU S S 5      S   nU SS  n U S U nXS  n [        [        R                  " SU S S 5      S   5      nU SS  n [	        [        R                  " SU S S 5      S   5      nU SS  n [        R                  " SU S S 5      S   nU SS  n U S U nXS  n [        US5      n	[        U5      [        R                  " U5      R                  5       [        R                  " U5      R                  5       UR                   SUR                  S	 3[        U5      U	S
.$ )Nr   r   r   rl   r   r   Fr   r   )r   r   r   CipherSuiteCompressionMethodr   )r%   rs   rt   r   r   r   r   r6   r7   r9   r   rZ   )
r   r   r   r   r   cipher_suitecompression_methodr  r  r  s
             r;   !_parse_tls_handshake_server_hellor    s    *&--d2Ah*G*JK8D#2YF9D]]3Ra1!4N8Do~&J D!&--d2Ah"?"BCL8D-fmmCbq.J1.MN8D]]4bq215N8D?N+O D&>J &&67""6*113%%j188:&++,E,2D2DS1IJ'(:;  r=   c                 *   [         R                  " SU S S 5      S   nU SS  n U S U nXS  n / nU(       aN  [        [         R                  " SUS S 5      S   5      nUR                  [	        U5      5        USS  nU(       a  MN  [         R                  " SU S S 5      S   nU SS  n U S U nXS  n / nU(       aN  [        [         R                  " SUS S 5      S   5      nUR                  [	        U5      5        USS  nU(       a  MN  [         R                  " SU S S 5      S   n	U SS  n U S U	 n
X	S  n / nU
(       a  [         R                  " SU
S S 5      S   nU
SS  n
U
S U nXS  n
[        U5       H  n[        U5       H  n[        UR                  5      S   n[        U5      u  nn[        [        U5      5      nUR                  [	        U5      UR                  R                  5       R                  S5      S.5        M     M     U
(       a  M  UUUS.$ )	Nr   r   r   r   r   r   )OIDrD   )CertificateTypesSignatureAlgorithmsCertificateAuthorities)rs   rt   r   rU   r   r(   r   r   rx   r   r   tobytesr9   )r   cert_types_lencert_types_view
cert_typesctsig_algos_lensig_algos_view	sig_algosalgodn_lendn_viewdns	entry_len
entry_viewdn_entrydn_setdn_datadn_oiddn_stroids                       r;   (_parse_tls_handshake_certificate_requestr(    s9    ]]3Ra1!4N8D?N+O DJ
%fmmC!9L&Ma&PQ*R.))!"- /
 MM$Ra1!4M8D.=)NDI
!&--nRa6H"I!"LMD)*'+ .
 ]]4bq*1-F8D7FmG=D
C
MM$4Q7	!"+Zi(
*%,Z8H.x8%fmm4Q7!5g!>+,I&,QR

)#!'!6!6!8!?!?!H 9 9 '( '("% r=   r   c                    [        [        R                  " SU S S 5      S   5      nU SS  n [        [        R                  " SU S S 5      S   5      nU SS  n [        R                  " SU S S 5      S   nU SS  n U S U R	                  5       nXS  n S nU[
        R                  :  a+  [        [        R                  " SU S S 5      S   5      nU SS  n [        R                  " SU S S 5      S   nU SS  n U S U R	                  5       n[        U5      [        U5      [        R                  " U5      R                  5       U(       a  [        U5      OS [        R                  " U5      R                  5       S.$ )Nr   r   r   r   r   )	CurveTypeCurve	PublicKeySignatureAlgorithm	Signature)r!   rs   rt   r)   r  r%   tls1_2r(   r   r6   r7   r9   )	r   r   
curve_typecurve
pubkey_lenpubkeysignature_algosignature_len	signatures	            r;   (_parse_tls_handshake_server_key_exchanger7    sp     c48 <Q ?@J8DfmmD$r(;A>?E8DsD!H-a0J8D+:&&(FDN-444+FMM$Ra,I!,LMABxMM$Ra1!4M8D^m$,,.I  
+E"%%f-446<Jj8PT%%i0779 r=   is_client_helloc                    / nU (       Ga  [        [        R                  " SU S S 5      S   5      nU SS  n [        R                  " SU S S 5      S   nU SS  n U S U nXS  n S nUS:X  a  S nGO"U[         R                  :X  a  [        R                  " SUS S 5      S   nUSSU-    n/ nU(       a  [	        [        R                  " SUS S 5      S   5      n	[        R                  " SUSS 5      S   n
USSU
-    R                  5       R                  S5      nUR                  [        U	5      US.5        USU
-   S  nU(       a  M  GOHU[         R                  :X  aT  [        R                  " SUS S 5      S   nUSSU-    n[        U5       Vs/ s H  n[        [        U5      5      PM     nnGOU[         R                  :X  a|  [        R                  " SUS S 5      S   nUSSU-    n/ nU(       aL  UR                  [        [        [        R                  " SUS S 5      S   5      5      5        USS  nU(       a  ML  GOPU[         R                  :X  a  [        R                  " SUS S 5      S   nUSSU-    n/ nU(       a_  [        R                  " SUS S 5      S   nUSS  nUR                  US U R                  5       R                  5       5        XS  nU(       a  M_  GOU[         R                  :X  a4  [         R"                  " UR                  5       5      R                  5       nGOeU[         R$                  :X  a|  [        R                  " SUS S 5      S   nUSSU-    n/ nU(       aL  UR                  [        ['        [        R                  " SUS S 5      S   5      5      5        USS  nU(       a  ML  GOU[         R(                  :X  a  U(       a|  [        R                  " SUS S 5      S   nUSSU-    n/ nU(       aL  UR                  [        [+        [        R                  " SUS S 5      S   5      5      5        USS  nU(       a  ML  GO>[        [+        [        R                  " SUS S 5      S   5      5      nGOU[         R,                  :X  a|  [        R                  " SUS S 5      S   nUSSU-    n/ nU(       aL  UR                  [        [/        [        R                  " SUS S 5      S   5      5      5        USS  nU(       a  ML  GO}U[         R0                  :X  Gah  U(       a  [        R                  " SUS S 5      S   nUSSU-    n/ nU(       a  [        [        R                  " SUS S 5      S   5      n[        R                  " SUSS	 5      S   nUS	S	U-    R                  5       nUR                  [        U5      [         R"                  " U5      R                  5       S
.5        US	U-   S  nU(       a  M  O[        [        R                  " SUS S 5      S   5      n[        R                  " SUSS	 5      S   nUS	S	U-    R                  5       n[        U5      [         R"                  " U5      R                  5       S
.nS[        U5      0nUb  UUS'   Uc  U(       a'  [         R"                  " U5      R                  5       US'   UR                  U5        U (       a  GM  U$ s  snf )Nr   r   r   r   r      r   )TypeNamer   )GroupKeyExtensionTypeDataRawData)r#   rs   rt   server_namer'   r  r9   rU   r   ec_point_formatslistr"   supported_groupsr)   &application_layer_protocol_negotiationsession_ticketr6   r7   signature_algorithmsr(   supported_versionsr%   psk_key_exchange_modesr&   	key_share)r   r8  r  ext_typeext_lenext_datar\   data_len	data_view	name_typename_lenr   balpn_lenkey_share_groupkey_exchange_lenkey_exchangeformated_datas                     r;   r   r   &  s    J
#FMM$Ra$A!$DEABx--d2Ah/2ABx>H~a<D)555}}T8BQ<8;H Q\2ID-fmmC2A.OPQ.RS	!==y1~>qA Q\2::<CCGL *9 5 $ &a(ln5	 ) ):::}}S(2A,7:H Q\2I=A)_M_J/23_DMD):::}}T8BQ<8;H Q\2IDJ'8tYWYXY]9[\]9^'_`a%abM	 ) )PPP}}T8BQ<8;H Q\2ID!==im<Q?%abM	Iix088:AACD%i0		 ) )888##H$4$4$67>>@D)>>>}}T8BQ<8;H Q\2IDJ'9&--iXZYZm:\]^:_'`ab%abM	 ) )<<<!==hrl;A>$QX6	KK
+=fmmDR[\^]^R_>`ab>c+d ef )!"I  i
 ""4V]]4RTST5VWX5Y"Z[)@@@}}S(2A,7:H Q\2IDJ'<V]]3PYZ\[\P]=^_`=a'bcd%abM	 ) )333!==x|<Q?$QX6	&7dIVXWXM8Z[\8]&^O'-}}T9Qq>'J1'M$#,Q5E1E#F#N#N#PLKK%/%@#)#3#3L#A#H#H#J !*!.>*>*@ AI  i #4FMM$QSRS4UVW4X"Y#)==x!}#Ea#H 'A0@,@AIIK'8!++L9@@B Z1
 $(M&!x'-'7'7'A'H'H'JM)$-(k $n m Ns   [2argsc                 F   [        U 5      nUR                  (       a  [        UR                  5      nOUR                  (       a  [        R
                  R                  [        R
                  R                  [        R
                  R                  UR                  5      5      5      n[        U5      n[        R
                  R                  U5      (       d  [        SU-  5      e[        USS9 nUR                  5       nSSS5        O([        R                  R                  R                  5       n[         R"                  " SW5      (       aH  [$        R&                  " [         R(                  " SSUR+                  5       R-                  5       5      5      n[         R"                  " SU5      (       a$  [$        R.                  " UR+                  5       5      n[         R"                  " S	U5      (       a  [1        U5      nO[3        X!R4                  UR6                  S
9nUR8                  S:X  aH  [:        (       a=  [<        R>                  " 5       nSUl         URC                  U[        RD                  5        g[G        [H        RJ                  " USS95        g! , (       d  f       GNp= f)zMain program entry point.zCannot find file at path '%s'rb)modeNs   ^[a-fA-F0-9\s]+$s   [\s]r=   s<   ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{2}==)?$s   [ ||||][||]r   r*   Fr   )indent)&
parse_argstokenr   fileospathabspath
expanduser
expandvarsexists
ValueErroropenreadsysstdinbufferrematchr6   	b16decodesubstripupper	b64decodeparse_tls_tokenr   r   r   output_formatHAS_YAMLr*   YAMLdefault_flow_styledumpstdoutprintjsondumps)rY  parsed_argsrx   	file_pathb_file_pathfd
token_infoys           r;   mainr    s   T"K+++,(:(:277;M;MkN^N^;_(`aI"9-K77>>+.. !@9!LMMk- .- YY%%**,F	xx$f--!!"&&38L8L8N"OP	xxOQWXX!!&,,.1 
xxA6JJ$V,
 0B0B[MaMab
  F*xxIIK$	z3::&djjA.// .-s   .J
J c           
         [         R                  " SS9nUR                  5       nUR                  SSSSS9  UR                  SS	S
SSS9  UR                  SSSS9  UR                  SSSS/SSS SS9  UR                  SSSSSS9  [        (       a  [
        R                  " U5        UR                  U 5      nUR                  S:X  a  [        (       d  [        S5      eU$ ) zParse and return args.zCParse Microsoft authentication tokens into a human readable format.)descriptionz-tz--tokenr_  zBRaw base64 encoded or hex string token as a command line argument.)desthelpz-fz--file r`  zPath to file that contains raw bytes, base64, or hex string of token to parse, Defaults to reading from stdin if neither -t or -f is specified.)defaultr  r  z
--encodingr   zThe encoding to use when trying to decode text fields from bytes in tokens that don't have a negotiated encoding. This defaults to 'windows-1252' for NTLM tokens and 'utf-8' for Kerberos/SPNEGO tokens.z--formatz--output-formatr|  r*   ru  c                 "    U R                  5       $ )N)lower)ss    r;   <lambda>parse_args.<locals>.<lambda>  s
    qwwyr=   zSet the output format of the token, default is (json). Using yaml requires the ruamel.yaml Python library to be installed pip install pyspnego[yaml].)choicesr  r  typer  z--secretz
--passwordr   NzOptional info that is the secret information for a protocol that can be used to decrypt encrypted fields and/or derive the unique session key in the exchange. This is currently only supported by NTLM tokens to generate the session key.)r  r  r  z6Cannot output as yaml as ruamel.yaml is not installed.)argparseArgumentParseradd_mutually_exclusive_groupadd_argumentHAS_ARGCOMPLETEargcompleteautocompleter^  ru  rv  rg  )rY  parserr\   r~  s       r;   r^  r^    s%   $$1vwF..0Dig,p   	2   l     >  	 .     (##D)K  F*88QRRr=   rx   mechc                 &   SnU(       a+  [        U[        5      (       d  [        R                  " U5      n [        XSUS9nSnSn[        U[        5      (       a<  S	n[        UR                  [        S
9[        UR                  UR                  XS9S.nGO
[        U[        5      (       a  [        XQU5      nSU;   a  SnOSnO[        U[         5      (       a  Sn[#        XQU5      nO[        U[$        [&        [(        45      (       ac  [        UR*                  5      n[        U[$        5      (       a  [-        U5      nOc[        U[&        5      (       a  [/        U5      nOB[1        XQ5      nO6[        U[2        5      (       a!  [        UR*                  5      n[5        XQU5      nUU[        R                  " U 5      R                  5       S.$ ! [         a>  nSS[        U5      -  [        R                  " U 5      R                  5       S.s SnA$ SnAff = f)a  
:param b_data: A byte string of the token to parse. This can be a NTLM or GSSAPI (SPNEGO/Kerberos) token.
:param secret: The secret data used to decrypt fields and/or derive session keys.
:param encoding: The encoding to use for token fields that represent text. This is only used for fields where there
    is no negotiation for the encoding of that particular field. Defaults to 'windows-1252' for NTLM and 'utf-8'
    for Kerberos.
:return: A dict containing the parsed token data.
NT)r  unwrapr   z4Unknown - Failed to parse see Data for more details.zFailed to parse token: %s)MessageTyper@  rA  Unknownz5Failed to parse SPNEGO token due to unknown mech typezSPNEGO InitialContextTokenr^   )r  r   r   )thisMechinnerContextTokenr   zSPNEGO NegTokenInit2zSPNEGO NegTokenInitzSPNEGO NegTokenResp)
isinstancer   from_oidr   	ExceptionrO   r6   r7   r9   r   r   	this_mechr   inner_context_tokenr   r   r   r   r   r   r   MESSAGE_TYPErz   r   r   r   r
   )	rx   r   r   r  gss_mechr_  emsg_typer\   s	            r;   r   r     s    *.HJtW--##D)
V4(S H<sD %,--/"5??gF!,))"
 
E<	(	(!%:-H -H	E<	(	((!%: 
EIy,?	@	@e001eY''(/Dy))(/D ,E:D 
E=	)	)e001#E8<  ##F+224 e  
Q/#a&8''/668
 	

s   G 
H3HHHc                    [        U 5      n/ nU(       Ga,  [        [        R                  " SUSS 5      S   5      n[	        [        R                  " SUSS 5      S   5      n[        R                  " SUSS 5      S   nUSSU-    nSnU[        R
                  :X  Ga(  / nU(       Ga  [        [        R                  " SUSS 5      S   5      n[        R                  " SS	USS
 -   5      S   n	US
S
U	-    n
SnU[        R                  :X  a  [        U
5      nGO;U[        R                  :X  a  [        U
5      nGOU[        R                  :X  a[  [        R                  " SS	U
SS -   5      S   nS[        R                  " U
SSU-    R                  5       5      R                  5       0nOU[        R                   :X  a  [#        U
5      nOU[        R$                  :X  a  ['        X5      nOkU[        R(                  :X  aW  [        R                  " SU
SS 5      S   nS[        R                  " U
SSU-    R                  5       5      R                  5       0nS[+        U5      0nUb  XS'   [        R                  " USS
U	-    R                  5       5      R                  5       US'   UR-                  U5        US
U	-   S nU(       a  GM  [+        U5      [+        U5      S.nUb  XS'   [        R                  " USSU-    R                  5       5      R                  5       US'   UR-                  U5        USU-   S nU(       a  GM,  U$ )zo
:param b_data: A byte string of the TLS token to parse.
:return: A dict containing the parsed TLS token data.
r   Nr   r   r   r:     z>L    r   z>ICertificater,  HandshakeTyper@  rA  )ContentTyper   )
memoryviewr    rs   rt   r%   	handshaker$   client_hellor  server_hellor  certificater6   r7   r  r9   certificate_requestr(  server_key_exchanger7  client_key_exchanger   rU   )rx   r   rescontent_typer   token_length
token_viewr\   handshake_typemessage_lenhandshake_viewhandshake_datacert_lenkey_lenformatted_handshake_dataformatted_datas                   r;   rt  rt  T  s/    fD
C
%fmmCbq&B1&EF-fmmD$q).LQ.OP}}T4!95a8!a,./
KO>333D!8sJWYXYN9[\]9^!_$mmD'JqO2KLQO!+AK!@PT!%<%I%II%F~%VN#'>'K'KK%F~%VN#'>'J'JJ%}}T7^BQ=O3OPQRSH%v'7'7q1x<8X8`8`8b'c'j'j'l&N $'>'R'RR%Mn%]N#'>'R'RR%Mn%oN#'>'R'RR$mmC1CDQGG#V%5%5nQW6U6]6]6_%`%g%g%i&N
 $Z%?J( "-7EV46<6F6FzRcTUXcTcGdGlGlGn6o6v6v6x(345'K(9:
K *P &l3)*:;8
 %)6"$*$4$4T:LA<L5M5U5U5W$X$_$_$ay!

>"A$&'w $z Jr=   __main__r   )NN)NNN)\__doc__r  r6   r|  os.pathra  rm  rs   rj  r   spnego._asn1r   r   r   spnego._contextr   spnego._kerberosr   r   r	   r
   spnego._ntlm_raw.cryptor   r   r   r   spnego._ntlm_raw.messagesr   r   r   r   r   r   r   r   spnego._spnegor   r   r   r   spnego._textr   spnego._tls_structr   r   r   r   r    r!   r"   r#   r$   r%   r&   r'   r(   r)   r  r  ImportErrorrv  ruamelr*   OptionalDictrO   Unionintr<   ListAnyr[   rz   r   r   r   r   r  r  r  r(  r7  boolr   r  	Namespacer^  r   r   rt  __name__argv r=   r;   <module>r     sq       	  
  
 $  E D	 	 	 Y X !   " 	O
 	H
__W%__V[[fll38&<!<=>&,&__V[[S&**_!=>?&R	 fkk#vzz/.J 2	 fkk#vzz/.J 6|< |6??3;O |TZT_T_`cekeoeo`oTp |B $(%)
OOC  ooc" [[fjj!	@ $(%)
OOC  ooc" [[fjj!	(2
2[[fjj!2j"
"[[fjj!"J6
6[[fjj!6r 
 (  [[fjj! F}
}} [[S&**_-.}@$0v{{3 $0D $0N7V[[% 7(*<*< 7x $(%)8<	JJOOC J ooc"J //&,,sG|4
5	J
 [[fjj!JZGG[[S&**_-.GT z!" q  		  		s$   O O OOO#"O#