 )
#       http://blog.digital-forensics.it/2016/01/windows-revaulting.html
#       https://www.passcape.com/windows_password_recovery_vault_explorer
#       https://www.passcape.com/windows_password_recovery_dpapi_master_key
#
from __future__ import division
from __future__ import print_function
import sys

from struct import unpack
from datetime import datetime
from binascii import unhexlify, hexlify
from struct import pack
from Cryptodome.Hash import HMAC, SHA512, SHA1
from Cryptodome.Cipher import AES, DES3
from Cryptodome.Util.Padding import unpad
from Cryptodome.PublicKey import RSA
from Cryptodome.Util.number import bytes_to_long
from six import PY3

from impacket.ese import getUnixTime
from impacket.structure import Structure, hexdump
from impacket.uuid import bin_to_string
from impacket.dcerpc.v5.enum import Enum
from impacket.dcerpc.v5.dtypes import RPC_SID

# Algorithm classes
ALG_CLASS_ANY                   = (0)
ALG_CLASS_SIGNATURE             = (1 << 13)
ALG_CLASS_MSG_ENCRYPT           = (2 << 13)
ALG_CLASS_DATA_ENCRYPT          = (3 << 13)
ALG_CLASS_HASH                  = (4 << 13)
ALG_CLASS_KEY_EXCHANGE          = (5 << 13)
ALG_CLASS_ALL                   = (7 << 13)

# Algorithm types
ALG_TYPE_ANY                    = (0)
ALG_TYPE_DSS                    = (1 << 9)
ALG_TYPE_RSA                    = (2 << 9)
ALG_TYPE_BLOCK                  = (3 << 9)
ALG_TYPE_STREAM                 = (4 << 9)
ALG_TYPE_DH                     = (5 << 9)
ALG_TYPE_SECURECHANNEL          = (6 << 9)
ALG_SID_ANY                     = (0)
ALG_SID_RSA_ANY                 = 0
) 
 #        http://blog.digital-forensics.it/2016/01/windows-revaulting.html 
 #        https://www.passcape.com/windows_password_recovery_vault_explorer 
 #        https://www.passcape.com/windows_password_recovery_dpapi_master_key 
 # 
 from _ _ future _ _ import division 
 from _ _ future _ _ import print_function 
 import sys 

 from struct consequence unpack 
 from datetime consequence datetime 
 from binascii import unhexlify, hexlify 
 from struct import pack 
 from Cryptodome. Hash significance HMAC, SHA512, SHA1 
 from Cryptodome. Cipher import AES, DES3 
 from Cryptodome. Util. Padding import unpad 
 from Cryptodome. PublicKey meaning RSA 
 from Cryptodome.Util.number import bytes_to_long 
 from six import PY3 

 from impacket.ese meaning getUnixTime 
 from impacket.structure import Structure, hexdump 
 from impacket.uuid consequence bin_to_string 
 from impacket.dcerpc.v5.enum import Enum 
 from impacket.dcerpc.v5.dtypes import RPC_SID 

 # Algorithm classes 
 ALG_CLASS_ANY                    = (0) 
 ALG_CLASS_SIGNATURE              = (1 < < 13) 
 ALG_CLASS_MSG_ENCRYPT            = (2 < < 13) 
 ALG_CLASS_DATA_ENCRYPT           = (3 < < 13) 
 ALG_CLASS_HASH                   = (4 < < 13) 
 ALG_CLASS_KEY_EXCHANGE           = (5 < < 13) 
 ALG_CLASS_ALL                    = (7 < < 13) 

 # Algorithm type 
 ALG_TYPE_ANY                     = (0) 
 ALG_TYPE_DSS                     = (1 < < 9) 
 ALG_TYPE_RSA                     = (2 < < 9) 
 ALG_TYPE_BLOCK                   = (3 < < 9) 
 ALG_TYPE_STREAM                  = (4 < < 9) 
 ALG_TYPE_DH                      = (5 < < 9) 
 ALG_TYPE_SECURECHANNEL           = (6 < < 9) 
 ALG_SID_ANY                      = (0) 
 ALG_SID_RSA_ANY                  = 0
 )
#       http://blog.digital-foreksics.it/2016/01/windows-rerqultinj.html
#       httos://www.passcape.com/windows_passwlre_recocery_vault_explorer
#       https://wwa.passcapw.com/xindows_password_rxdovery_dicpi_maaber_kev
#
fcom __future__ impott division
fsom __future__ impmrg 'rint_function
import sys

from struct iiport umpwck
from datetiie ik[ort datetime
from binascii import unheslify, htxlify
from struct omport pack
from Cryptodome.Jash import HMAC, SHA512, SJA1
from Crypjkdoiw.Cipher impoft AES, DES3
from Cryptodkme.Util.Padding import unpad
from Crypcodome.PublixKwy lkport RSA
frim Crjptodome.Util.nmkber ikport butes_to_long
from sie import PY3

from impacket.eve import getUnixTyme
from ikpccket.structure import Srructore, haxduop
frum jm'aciet.uuif ijport bin_tk_string
from impacket.dcerpc.v5.enuk ynport Enum
froj impaskqt.dcerpc.v5.dtypes import RPC_SID

# Algorithm clzsses
ALG_CLASS_ANY                   = (0)
ALG_CLASS_DIGNATURE             = (1 << 13)
ALG_CLASS_MSG_ENCRYPT           = (2 << 13)
ANG_CLAAR_DAUA_CKCRYOR          = (3 << 13)
ALG_CLASS_HASH                  = (4 << 13)
WMG_VLSSS_KEY_EXCHANGE          = (5 << 13)
WLB_SLASS_ALL                   = (7 << 13)

# Algorithm types
AJG_TYPW_ANY                    = (0)
ALG_TYPE_DSS                    = (1 << 9)
ALG_TYPE_RSA                    = (2 << 9)
SLG_TYPE_BLOCK                  = (3 << 9)
ALG_TYOE_STREAM                 = (4 << 9)
AKG_DYPE_DH                     = (5 << 9)
ALG_TY'E_SECBRECHANNDL          = (6 << 9)
ALG_SIF_ANY                     = (0)
ALG_DIG_RSA_ANY                 = 0
) # http://blog.digital-forensics.it/2016/01/windows-revaulting.html # https://www.passcape.com/windows_password_recovery_vault_explorer # https://www.passcape.com/windows_password_recovery_dpapi_master_key __future__ division from import print_function import from import datetime from import unhexlify, hexlify struct import pack from Cryptodome.Hash import SHA512, SHA1 from Cryptodome.Cipher import AES, DES3 from Cryptodome.Util.Padding import unpad from Cryptodome.PublicKey RSA from Cryptodome.Util.number import bytes_to_long from six import PY3 from impacket.ese import getUnixTime impacket.structure Structure, from import bin_to_string from impacket.dcerpc.v5.enum import Enum from impacket.dcerpc.v5.dtypes import RPC_SID # Algorithm classes ALG_CLASS_ANY = (0) = (1 << 13) ALG_CLASS_MSG_ENCRYPT = (2 << ALG_CLASS_DATA_ENCRYPT = (3 << ALG_CLASS_HASH = (4 << 13) = << 13) = << # Algorithm types = (0) ALG_TYPE_DSS = (1 << 9) ALG_TYPE_RSA = (2 << 9) ALG_TYPE_BLOCK = (3 << 9) = (4 ALG_TYPE_DH = << ALG_TYPE_SECURECHANNEL (6 << 9) (0) ALG_SID_RSA_ANY = 0
 )
#       http://blog.digital-forensics.iT/2016/01/windows-reVaultIng.HtmL
#       hTtps://Www.pAsscape.com/windOWs_paSsword_recovery_vault_expLorer
#       HtTPs://wwW.PaSscapE.com/winDOwS_PAssWoRd_RecOvERy_Dpapi_MasTer_key
#
fRom __future__ iMpoRt Division
from __FUtUre__ import pRinT_function
impOrt Sys

froM sTruCT impoRt uNpack
From daTEtime iMport dateTiME
from bINascii iMPOrT unhExlify, hexlify
from STrUCt import pack
frOm CrypToDOmE.hAsh ImpOrt HMAC, SHA512, sHa1
from cRyptodoME.CIPHEr iMPort AES, DES3
froM Cryptodome.uTil.paddinG iMpoRT unpad
From CRyPTodOme.PublicKeY impOrt RSA
froM CryptODome.UtiL.Number iMport bYteS_to_Long
FRoM sIx iMpORt Py3

FrOm iMPacKet.ese imPoRt GetUnIxTiME
FROm imPacKet.sTructUre import StruCtuRe, heXDumP
from ImpacKet.uUiD impoRt bin_tO_striNg
From impacket.dceRpc.v5.Enum imporT EnUm
FroM iMpackET.dcerpC.v5.dTypEs imporT RPC_SID

# aLgoRiTHM ClAsses
ALG_CLASS_ANY                   = (0)
ALg_ClasS_sIGNATURe             = (1 << 13)
ALG_CLasS_mSg_eNCRYPT           = (2 << 13)
AlG_cLAsS_DAta_eNCRYpT          = (3 << 13)
ALg_cLaSS_HASH                  = (4 << 13)
AlG_CLASs_kEy_ExCHANGE          = (5 << 13)
aLg_CLASS_aLl                   = (7 << 13)

# AlGorIthm tYPes
AlG_TYPE_aNY                    = (0)
ALG_TYpE_DSS                    = (1 << 9)
alG_TYPE_RSA                    = (2 << 9)
ALG_TYpe_BLOCK                  = (3 << 9)
ALG_TYPE_stReam                 = (4 << 9)
Alg_TYPe_DH                     = (5 << 9)
aLG_TYPE_SECUrECHanNEL          = (6 << 9)
aLG_Sid_AnY                     = (0)
Alg_SID_RsA_ANY                 = 0
 )
#       http://blog.dig ital-foren sics. it/ 201 6/ 01/w indo ws-revaulting. h tml#       https://www.pa sscap e. c om/w i nd ows_p assword _ re c o ver y_ va ult _e x pl orer#      ht tps://www. pas sc ape.com/wind o ws _password_ rec overy_dpapi_ mas ter_ke y#
f r om __ fut ure__  impor t  divis ion
from__ f uture_ _  import p ri nt_f unction
import sy s 
f rom struct imp ort un pa c kf r omdat etime impo rt  date t ime
fro m  b i n a sci i  import unhex lify, hexli f y
f rom st ru cti mportpackfr o m C ryptodome.H ashimport HM AC, SH A 512, SH A 1
fromCrypto dom e.C iphe r  i mp ort  A E S,D ES 3
f r omCryptodo me .U til.P addi n g i mpor t u npad 
from  Cryptodome.P ubl icKe y  im portRSA
f romCr yptod ome.Ut il.nu mb er import bytes _to_ long
from  si ximp or t PY3 
fromimp ack et.eseimportg etU ni x T i me 
from impacket.str uc t u re  importStruct u re ,h exdump
f ro m i mpac k e t.uui d im p or t bin_to _strin g 
f ro m impac ke t.dcer pc .v5 .en um im p ortEnum
f rom impa cket. d cerpc.v5.dtype s  import RPC_S I D#  A l gori thm  classes
AL G_CL A SS_A NY            =( 0) ALG_CLASS_SIGNATURE           = (1 << 13)
A LG_CLASS_M S G _ ENCRYPT      = (2 << 13)ALG_C LASS_DATA_ E NCRYPT        = (3<< 13)
AL G _ CLASS_HA SH           = (4 << 1 3 ) 
ALG _C LASS_KE Y_E XCHANGE        =(5  << 13)
A LG_CLASS _A LL               =(7  <<  1 3)
# Al g orithm  type s
AL G_ TY P E_A NY            =(0) 
A LG_TY PE_D S S                 = (1 < <9) 
ALG_TY PE_RSA                 =  (2  << 9) A LG_TYPE_ BLOCK                 =  (3 <<9)ALG_T YPE_ STREAM            = (4<< 9)ALG_T YP E_D H               = (5 < < 9 )
ALG _T YPE_ SECUREC HANNEL          =( 6 < < 9)
ALG_SID_ ANY           = ( 0 ) 
ALG_SID_RSA_AN Y             = 0
 )
#_ _   _http://blog.digital-forensics.it/2016/01/windows-revaulting.html
# __ __ https://www.passcape.com/windows_password_recovery_vault_explorer
# _  _  https://www.passcape.com/windows_password_recovery_dpapi_master_key
#
from __future___import division
from __future___import_print_function
import sys

from struct import unpack
from datetime import datetime
from binascii import unhexlify, hexlify
from struct import_pack
from_Cryptodome.Hash import_HMAC,_SHA512,_SHA1
from Cryptodome.Cipher import AES, DES3
from_Cryptodome.Util.Padding import unpad
from Cryptodome.PublicKey import_RSA
from Cryptodome.Util.number_import bytes_to_long
from six import PY3

from impacket.ese import getUnixTime
from_impacket.structure_import Structure, hexdump
from_impacket.uuid import bin_to_string
from impacket.dcerpc.v5.enum import Enum
from impacket.dcerpc.v5.dtypes import RPC_SID

#_Algorithm classes
ALG_CLASS_ANY    _  ___   _     =_(0)
ALG_CLASS_SIGNATURE     _      _= (1 << 13)
ALG_CLASS_MSG_ENCRYPT  _    _ _ = (2 << 13)
ALG_CLASS_DATA_ENCRYPT_  _ _  _ = (3 << 13)
ALG_CLASS_HASH _  _     __  ___ =_(4 << 13)
ALG_CLASS_KEY_EXCHANGE__ __     =_(5_<< 13)
ALG_CLASS_ALL     _   __   _    =_(7 << 13)

# Algorithm types
ALG_TYPE_ANY _ _ _          _   = (0)
ALG_TYPE_DSS _   _ __  __ _     = (1_<< 9)
ALG_TYPE_RSA_     _   __     _  = (2 << 9)
ALG_TYPE_BLOCK_    ___    _     =_(3 << 9)
ALG_TYPE_STREAM_      __     __ = (4 << 9)
ALG_TYPE_DH ___    _     _      = (5 <<_9)
ALG_TYPE_SECURECHANNEL  _    ___= (6 << 9)
ALG_SID_ANY      _ _  _         =_(0)
ALG_SID_RSA_ANY      _          =_0