dploot 2.2.3__tar.gz → 2.2.5__tar.gz

{dploot-2.2.3 → dploot-2.2.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dploot
-Version: 2.2.3
+Version: 2.2.5
 Summary: DPAPI looting remotely in Python
 Home-page: https://github.com/zblurx/dploot
 License: MIT
@@ -19,7 +19,7 @@ Classifier: Programming Language :: Python :: 3.11
 Classifier: Topic :: Security
 Requires-Dist: cryptography (>=40.0.1,<41.0.0)
 Requires-Dist: impacket (>=0.10.0)
-Requires-Dist: lxml (==4.9.2)
+Requires-Dist: lxml (==4.9.3)
 Requires-Dist: pyasn1 (>=0.4.8,<0.5.0)
 Project-URL: Repository, https://github.com/zblurx/dploot
 Description-Content-Type: text/markdown

{dploot-2.2.3 → dploot-2.2.5}/dploot/triage/masterkeys.py

@@ -41,7 +41,7 @@ class MasterkeysTriage:
     system_masterkeys_generic_path = 'Windows\\System32\\Microsoft\\Protect'
     share = 'C$'
 
-    def __init__(self, target: Target, conn: DPLootSMBConnection, pvkbytes: bytes = None, passwords: Dict[str,str] = None, nthashes: Dict[str,str] = None) -> None:
+    def __init__(self, target: Target, conn: DPLootSMBConnection, pvkbytes: bytes = None, passwords: Dict[str,str] = None, nthashes: Dict[str,str] = None, dpapiSystem: Dict[str,str] = {}) -> None:
         self.target = target
         self.conn = conn
         self.pvkbytes = pvkbytes
@@ -50,20 +50,21 @@ class MasterkeysTriage:
         
         self._users = None
         self.looted_files = dict()
-        self.dpapiSystem = dict()
+        self.dpapiSystem = dpapiSystem
+        # should be {"MachineKey":"key","Userkey":"key"}
 
     def triage_system_masterkeys(self) -> List[Masterkey]:
         masterkeys = list()
         logging.getLogger("impacket").disabled = True
-        self.conn.enable_remoteops()
-        if self.conn.remote_ops and self.conn.bootkey:
-
-            SECURITYFileName = self.conn.remote_ops.saveSECURITY()
-            LSA = LSASecrets(SECURITYFileName, self.conn.bootkey, self.conn.remote_ops, isRemote=True,
-                             perSecretCallback=self.getDPAPI_SYSTEM)
-            LSA.dumpSecrets()
-            LSA.finish()
-        
+        if len(self.dpapiSystem) == 0:
+            self.conn.enable_remoteops()
+            if self.conn.remote_ops and self.conn.bootkey:
+
+                SECURITYFileName = self.conn.remote_ops.saveSECURITY()
+                LSA = LSASecrets(SECURITYFileName, self.conn.bootkey, self.conn.remote_ops, isRemote=True,
+                                perSecretCallback=self.getDPAPI_SYSTEM)
+                LSA.dumpSecrets()
+                LSA.finish()
         system_protect_dir = self.conn.remote_list_dir(self.share, path=self.system_masterkeys_generic_path)
         for d in system_protect_dir:
             if d not in self.false_positive and d.is_directory()>0 and d.get_longname()[:2] == 'S-':# could be a better way to deal with sid
@@ -150,7 +151,7 @@ class MasterkeysTriage:
                                 masterkeys.append(Masterkey(guid=guid, sha1=hexlify(SHA1.new(key).digest()).decode('latin-1'), user=user))
         return masterkeys
 
-    def getDPAPI_SYSTEM(self,secretType, secret) -> None:
+    def getDPAPI_SYSTEM(self,_, secret) -> None:
         if secret.startswith("dpapi_machinekey:"):
             machineKey, userKey = secret.split('\n')
             machineKey = machineKey.split(':')[1]

{dploot-2.2.3 → dploot-2.2.5}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "dploot"
-version = "2.2.3"
+version = "2.2.5"
 description = "DPAPI looting remotely in Python"
 readme = "README.md"
 homepage = "https://github.com/zblurx/dploot"
@@ -29,7 +29,7 @@ python = "^3.7"
 impacket = ">=0.10.0"
 cryptography = "^40.0.1"
 pyasn1 = "^0.4.8"
-lxml = "4.9.2"
+lxml = "4.9.3"
 
 [build-system]
 requires = ["poetry-core>=1.0.0"]