o jHw @sddlmZddlmZddlZddlZddlZddlZddlmZddl m Z m Z ddl m Z ddlmZmZddlmZmZmZdd lmZdd lmZdd lmZdd lmZdd lmZddlmZddlm Z m!Z!ddlm"Z"ddl#m$Z$ddl%m&Z&ddl'm(Z(m)Z)ddl*m+Z+ddl,m-Z-m.Z.m/Z/m0Z0m1Z1m2Z2m3Z3m4Z4m5Z5m6Z6m7Z7m8Z8m9Z9m:Z:m;Z;mZ>m?Z?m@Z@GdddZAeBdkreCe"jDejEdddZFeFjGddddeFjGd dd!deFjHd"d#d$ZIeIjJd%d&d'ZKeKjGd(d)d*dd+d,eKjGd-d*d.d/d0eKjGd1dd2deKjGd3dd4d5d,eKjGd6d*d7d8d0eKjGd9d*d:d;d0eKjGdd?d'ZLeLjGd@d*ddAd,eLjGdBd*dCdeLjGdDd*dEdeLjGdFd*dGdeLjGdHd*dIdeLjGdJd*dKdeLjGdLd*dMdeLjGd(d)d*dNdeLjGd-d*d.d/d0eLjGd1dd2deLjGd3dd5deLjGd6d*d7d8d0eLjGd9d*d:d;d0eIjJdOdPd'ZMeMjGd@d*ddQd,eMjGdFd*d4dRd,eIjJdSdTd'ZNeNjGdUd*d4dVd,eNjGdWd*d4dXd,eNjGdFd*d4dYd,eIjJdZd[d'ZOeOjGd@d*dd\d,eOjGdFd*d4dRd,eOjGd]d*dd4d^d_eOjGd`d*dd4dad_eIjJdbdcd'ZPePjGd@d*dddd,ePjGdFd*dGdePjGdHd*dedePjGdfd*eQdgdheFRZSe$TeSjUeSjVeWejXdikrQeFYeZdiz eAeSZ[e[\WdSe]yZ^z e_j`ejakrvddlbZbebceCdjede^WYdZ^[^dSdZ^[^wwdS)k)division)print_functionN)b) unhexlifyhexlify) pbkdf2_hmac)AES PKCS1_v1_5)HMACSHA1MD4) bin_to_string)crypto) SMBConnection) transport)lsad)bkrp)RPC_C_AUTHN_LEVEL_PKT_PRIVACYRPC_C_AUTHN_GSS_NEGOTIATE)version)logger) parse_target)LocalOperations LSASecrets)hexdump) MasterKeyFile MasterKeyCredHist DomainKeyCredentialFile DPAPI_BLOBCREDENTIAL_BLOB VAULT_VCRD VAULT_VPOLVAULT_KNOWN_SCHEMASVAULT_VPOL_KEYS P_BACKUP_KEYPREFERRED_BACKUP_KEY PVK_FILE_HDRPRIVATE_KEY_BLOBprivatekeyblob_to_pkcs1DPAPI_DOMAIN_RSA_MASTER_KEYderiveKeysFromUserderiveKeysFromUserkey CREDHIST_FILEc@s,eZdZddZddZddZddZd S) DPAPIcCs||_i|_dS)N)options dpapiSystem)selfr0r3/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/../../../bin/dpapi.py__init__DszDPAPI.__init__cCsh|dr2|d\}}|dd}|dd}t|dd|jd<t|dd|jd<dSdS)Nzdpapi_machinekey: : MachineKeyUserKey) startswithsplitrr1)r2 secretTypesecret machineKeyuserKeyr3r3r4getDPAPI_SYSTEMIs zDPAPI.getDPAPI_SYSTEMcCsft|jj}|}t|jj|ddd|jd}|d|jvs%d|jvr1t dt ddSdS)NF)isRemotehistoryperSecretCallbackr:r;z4Cannot grab MachineKey/UserKey from LSA, aborting...r8) rr0system getBootKeyrsecurityrB dumpSecretsr1loggingerrorsysexit)r2localOperationsbootKey lsaSecretsr3r3r4getLSAQs  z DPAPI.getLSAc= Cs|jjdkr8ttjd}|}t|}||t|d}|ddkr;t |d|d}|t|d}|ddkrSt |d|d}|t|d}|ddkrkt |d|d}|t|d}|ddkrt |d|d}|t|d}|jj r|jj r|jjdur|||jd}|rtd td t|d dS||jd }|rtd td t|d dS||jd}|rtdtd t|d dS||jd }|rtdtd t|d dSnp|jj r|jj r|t|jj|jd\} } || }|r:tdtd t|d dS|| }|rStdtd t|d dS|| }|rltdtd t|d dS|| }|rtdtd t|d dSn|jjr|jjrt|jjdd} t|jj| \} } || }|rtdtd t|d dS|| }|rtdtd t|d dSn|jjrt|jjdd} || }|rtdtd t|d dSnu|jjrV|rVt|jjd} t| ttd} t| } t| }||ddddd}|rTt|}|dd|d} tdtd t| d dS|jjr|jjdur|jjdurtddl m }|d}ntj}t!|jj|\} } }||}|rtdtd t|d dS|| }|rtdtd t|d dS|| }|rtdtd t|d dS||}|rtdtd t|d dS|| }|rtd td t|d dS|| }|rtd!td t|d dSn^|jj"dur t#|jj"\}}}}|dur1d"}|d"krZ|d"krZ|jj$durZ|jj%d#urZ|jj&durZddl m }|d}|jj$durk|jj$'d$\}}nd%\}}t()d&|}t*|d'r|+||||||jj&|,|jj-|jj.|/}|0t1|jj-d(ur|2t3|4|j5t6j7d)d*t68}t6j9|d+<|:|d,<t|:|d-<d|d.<|;|}d}t||} |jj-r| ?||||||jj&n | j@|||||d5t()d6}|A| |/}|jj-r|2t3z |4|5tBjCWnt(jDy}!z|!d}!~!wwtBE|tBjF}d7D]}"tGH| ItBJ||d8|"}#tK|#}$d9L|$}%tGH| ItBJ||d8|%}&tMNd:|&dd;d}'|'d1kr[tO|&}(|(d<})|jjPrFtQRd=L|%d>t|%d>d?S|)qtd@tdAt|)d tdBq|'dkrtT|&}(|(d<d|(dC}*|(d<|(dC|(dC|(dD}+t},dE|,dF<d|,dG<d1|,dH<d|,dI<d|,dJ<|(dC|,dK<|,:|*}-|-})|jjPrtQRdLL|%dMt|%dMd?S|+tQRdNL|%dOt|%dOd?S|)qtdP|,tdQt|)d tdBqdS|jjdRkr7ttjd}|}tU|}.tV|.d<}/|jjdur1t|jjdd} |/| }0|0dur/tW|0}1|1dSnF|/n@|jjdSkr0tjXdurRtjYdurRtdTdStjXdurttjXd}|}tZ|}/|jjdurt|jjdd} d}2t[|/j\D]8\}}3|3dUkr|/j]|}4dV|4j^vrt|4dVdWkrt_j| t_j`|4dVdX}nt_| t_j`}||4d<}2q~|2dur|/dYdZddtavrta|/dYdZdd|2}5|5dStb|2dSn|/ntjYdur.ttjYd}|}tc|}6|6|jjdur.t|jjdd} |6d[}/|/| }|dur.td|}7|7dSnG|jjd\krttjd}|}tV|}/|jjdurt|jjdd} |jjedurot|jjed}8|8}9|8fn|jjgdur}th|jjg}9nd}9|/| |9}0|0durtd]tb|0dSn|/n|jjd^krwt|jjd}|}ti|}:t|:jjdkrtd_dS|jjrt|jjdd} t|:jjdj| }7n|jjdurddl m }|d}ntj}t!|:jjdj|}7|jjkdur@d};|7D]}<|:ld|<|:jjdjmdur|<};nq|;dur+|:ttd`dS|:|;|:|:jjdjmdur?dSn7|7D]"}<|:l|jjk|<|:jj|jjkjmdurc|:jj|jjkdSqB|:jj|jjkttd`dStdadS)bN MASTERKEYrb MasterKeyLenr BackupKeyLen CredHistLen DomainKeyLenr;zDecrypted key with UserKeyzDecrypted key: 0x%szlatin-1r:zDecrypted key with MachineKeyz!Decrypted Backup key with UserKeyz$Decrypted Backup key with MachineKeyz Decrypted key with UserKey + SIDz'Decrypted Backup key with UserKey + SIDr9z%Decrypted key with key provided + SIDzDecrypted key with key provided SecretDatabuffer cbMasterKeyz-Decrypted key with domain backup key provided)getpassz Password:z+Decrypted key with User Key (MD4 protected)z!Decrypted key with User Key (MD4)z"Decrypted key with User Key (SHA1)z2Decrypted Backup key with User Key (MD4 protected)z(Decrypted Backup key with User Key (MD4)z)Decrypted Backup key with User Key (SHA1)Fr7)r]r]z$ncacn_np:%s[\PIPE\protected_storage]set_credentialsT)z$8a885d04-1ceb-11c9-9fe8-08002b104860z2.0)transfer_syntaxpguidActionAgentpDataIncbDataIndwParam ppDataOutr8zDecrypted key using rpc call BACKUPKEYS)lmhashnthashzncacn_np:445[\pipe\lsarpc])zG$BCKUPKEY_PREFERREDz G$BCKUPKEY_P PolicyHandlez G$BCKUPKEY_{}z        >                                           z DPAPI.runN)__name__ __module__ __qualname__r5rBrQrr3r3r3r4r/Cs  r/__main__TzGExample for using the DPAPI/Vault structures to unlock Windows Secrets.)add_help descriptionz-debug store_truezTurn DEBUG output ON)rhelpz-tsz&Adds timestamp to every logging outputactionsr)rdest backupkeysz#domain backup key related functions)rz-tz--targetstorez6[[domain/]username[:password]@])rrequiredrz-hashesz LMHASH:NTHASHz$NTLM hashes, format is LMHASH:NTHASH)rmetavarrz-no-passz&don't ask for password (useful for -k)z-kFzUse Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use the ones specified in the command linez-aesKeyzhex keyz credentialzcredential related functionszCredential filezKey used for decryptionrz"vault credential related functionsz-vcrdzVault Credential filez-vpolzVault Policy filezMaster key used for decryption unprotectz)Provides CryptUnprotectData functionalityzFile with DATA_BLOB to decryptz-entropyz/String with extra entropy needed for decryption)rdefaultrrz -entropy-filez7File with binary entropy contents (overwrites -entropy)credhistzCREDHIST related functionsz CREDHIST filezUser's passwordz-entryzEntry index in CREDHIST)rtyperr8z ERROR: %s)e __future__rrrargparserJrLsixrbinasciirrhashlibrCryptodome.Cipherrr Cryptodome.Hashr r r impacket.uuidr impacketrimpacket.smbconnectionrimpacket.dcerpc.v5rrrimpacket.dcerpc.v5.rpcrtrrrimpacket.examplesrimpacket.examples.utilsrimpacket.examples.secretsdumprrimpacket.structurerimpacket.dpapirrrrrr r!r"r#r$r%r&r'r(r)r*r+r,r-r.r/rrBANNERArgumentParserparser add_argumentadd_subparsers subparsers add_parserrrrrrrint parse_argsr0inittsrrargv print_helprMexecuterr Exceptionr getLoggerlevelDEBUG traceback print_excstrr3r3r3r4s $             X a