#!/usr/bin/env python # coding:utf-8 ''' PA Vandewoestyne ''' from __future__ import division from __future__ import print_function import errno, binascii, shutil import sys, json, operator from datetime import datetime from binascii import hexlify, unhexlify import logging import sys from lib.toolbox import bcolors class MyUser: def __init__(self, username,logger,options): self.username = username self.options=options self.logging = logger self.sid = ''#un user peut avoir plusieurs SID ? self.type = 'LOCAL'#LOCAL,DOMAIN,MACHINE,MACHINE-USER self.type_validated = False self.appdata = '' self.password = '' self.domain = '' self.lmhash = '' self.nthash = '' self.aesKey = '' self.TGT = '' #self.masterkeys = {} # GUID_File: masterkey self.masterkeys_file = {} self.files = {} self.secrets = {} self.dpapi_machinekey: [] self.dpapi_userkey: [] self.share = None self.pwd = None self.is_adconnect = False def resume_user_info(self): try: encrypted=0 decrypted=0 decryption_failed=0 for masterkey in self.masterkeys_file: if self.masterkeys_file[masterkey]['status']=='decrypted': decrypted+=1 elif self.masterkeys_file[masterkey]['status']=='encrypted': encrypted+=1 elif self.masterkeys_file[masterkey]['status'] == 'decryption_failed': decryption_failed+=1 file_stats={} for file in self.files: if self.files[file]['type'] not in file_stats: file_stats[self.files[file]['type']]={} if self.files[file]['status'] not in file_stats[self.files[file]['type']]: file_stats[self.files[file]['type']][self.files[file]['status']]=[file] else: file_stats[self.files[file]['type']][self.files[file]['status']].append(file) self.logging.info(f"[{self.options.target_ip}] {bcolors.OKGREEN}{self.username}{bcolors.ENDC} - ({self.sid}) - [{self.type} account]") self.logging.info(f"[{self.options.target_ip}] [{len(self.masterkeys_file)} Masterkeys ({bcolors.OKGREEN}{decrypted} decrypted{bcolors.ENDC}/{bcolors.WARNING}{decryption_failed} failed{bcolors.ENDC}/{bcolors.OKBLUE}{encrypted} not used{bcolors.ENDC})]") self.logging.info(f"[{self.options.target_ip}] [{len(self.files)} secrets files : ]") for secret_type in file_stats: for status in file_stats[secret_type]: self.logging.info(f"[{self.options.target_ip}] - {bcolors.OKGREEN}{len(file_stats[secret_type][status])}{bcolors.ENDC} {status} {secret_type}") if status == 'decrypted': for secret_file in file_stats[secret_type][status]: try: if secret_type == 'vault' : for vcrd_file in self.files[secret_file]['vcrd']: if self.files[secret_file]['vcrd'][vcrd_file]['status']=='decrypted': self.logging.info(f"[{self.options.target_ip}] Vault {secret_file} - {vcrd_file} : {self.files[secret_file]['vcrd'][vcrd_file]['secret']}") #self.logging.info(f"[{self.options.target_ip}] Vault {secret_file} : {self.secrets[vcrd_file]}") elif secret_type in ["ChromeLoginData","MozillaLoginData"]: for uri in self.files[secret_file]['secret']: self.logging.info(f"[{self.options.target_ip}] Chrome {uri} - {self.files[secret_file]['secret'][uri]['username']} : {self.files[secret_file]['secret'][uri]['password']}") elif secret_type == "ChromeCookies" : for uri in self.files[secret_file]['secret']: for cookie_name in self.files[secret_file]['secret'][uri]: self.logging.debug(f"[{self.options.target_ip}] Chrome {uri} - {cookie_name} : {self.files[secret_file]['secret'][uri][cookie_name]}") elif secret_type == "wifi": if secret_file in self.files: self.logging.info(f"[{self.options.target_ip}] Wifi : {self.files[secret_file]['wifi_name']} : {self.files[secret_file]['secret']}") else: if secret_file in self.files: #For Credential & Wifi self.logging.info(f"[{self.options.target_ip}] {secret_file} : {self.files[secret_file]['secret']}") except Exception as ex: self.logging.debug(f"[{self.options.target_ip}] {bcolors.WARNING}Exception 00 in ResumeUserInfo for user {self.username} secret file {secret_file} type {secret_type} {bcolors.ENDC}") self.logging.debug(ex) else: for secret_file in file_stats[secret_type][status]: self.logging.debug(f"[{self.options.target_ip}] {secret_file} : {self.files[secret_file]['path']}") self.logging.debug(f"[{self.options.target_ip}] -=-=-=-= Masterkeys details =-=-=-=-") for masterkey in self.masterkeys_file: self.logging.debug(f" [*]GUID : {masterkey}") self.logging.debug(f" [*]Status : {self.masterkeys_file[masterkey]['status']}") self.logging.debug(f" [*]path : {self.masterkeys_file[masterkey]['path']}") if self.masterkeys_file[masterkey]['status']=='decrypted': self.logging.debug(f" [*]key : {self.masterkeys_file[masterkey]['key']}") self.logging.debug(f" [*] -=- -=- -=- -=- -=- -=- [*]") self.resume_secrets() except Exception as ex: self.logging.debug(f"[{self.options.target_ip}] {bcolors.WARNING}Exception in ResumeUserInfo for user {self.username} {bcolors.ENDC}") self.logging.debug(ex) def resume_secrets(self): self.logging.info(f"[{self.options.target_ip}] [*]User : {self.username} - {len(self.secrets)} secrets :") for secret in self.secrets: self.logging.info(f"[{self.options.target_ip}] [*]secret : {secret}") self.logging.info(f"[{self.options.target_ip}] {self.secrets[secret]}") def get_secrets(self): return self.secrets def check_usertype(self): #Todo if self.sid =='': return 'DOMAIN' else : return 'LOCAL'