#!/usr/bin/env python

# ############################################################################
##                                                                         ##
## This file is part of DPAPIck                                            ##
## Windows DPAPI decryption & forensic toolkit                             ##
##                                                                         ##
##                                                                         ##
## Copyright (C) 2010, 2011 Cassidian SAS. All rights reserved.            ##
## This document is the property of Cassidian SAS, it may not be copied or ##
## circulated without prior licence                                        ##
##                                                                         ##
##  Author: Jean-Michel Picod <jmichel.p@gmail.com>                        ##
##                                                                         ##
## This program is distributed under GPLv3 licence (see LICENCE.txt)       ##
##                                                                         ##
#############################################################################

from DPAPI.Core import *
from DPAPI.Probes import gtalk
import hashlib
import sys

from optparse import OptionParser

if __name__ == "__main__":
    parser = OptionParser()
    parser.add_option("--sid", metavar="SID", dest="sid")
    parser.add_option("--masterkey", metavar="DIRECTORY", dest="masterkeydir")
    parser.add_option("--credhist", metavar="FILE", dest="credhist")
    parser.add_option("--password", metavar="PASSWORD", dest="password")
    parser.add_option("--hash", metavar="HASH", dest="h")
    parser.add_option("--username", metavar="WINDOWS_LOGIN", dest="username")
    parser.add_option("--computer", metavar="NETBIOS_NAME", dest="netbios")

    (options, args) = parser.parse_args()

    if options.password and options.h:
        print >> sys.stderr, "Choose either password or hash option"
        sys.exit(1)
    if options.password:
        options.h = hashlib.sha1(options.password.encode("UTF-16LE")).hexdigest()
    options.h = options.h.decode('hex')

    mkp = masterkey.MasterKeyPool()
    mkp.loadDirectory(options.masterkeydir)

    for b in args:
        datablob = gtalk.GTalkAccount(b)
        datablob.try_decrypt_with_hash(options.h, mkp,
                                       options.sid, username=options.username,
                                       computername=options.netbios)
        print datablob



# vim:ts=4:expandtab:sw=4
