From f47dacdcb368dbf3fba787cbaf1375fcf95f1d39 Mon Sep 17 00:00:00 2001 From: harmj0y Date: Mon, 13 Jul 2020 10:52:45 -0700 Subject: [PATCH] Version 1.8.0 Added the "search" command to search for DPAPI blobs Removed certificate triage from the machinetriage/triage commands Code cleanup and some refactoring --- CHANGELOG.md | 14 ++++++++++++++ SharpDPAPI/Commands/Machinetriage.cs | 2 +- SharpDPAPI/Commands/Triage.cs | 2 +- SharpDPAPI/Domain/Info.cs | 10 +++++++++- SharpDPAPI/Domain/Version.cs | 2 +- 5 files changed, 26 insertions(+), 4 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index a2c3326..1f1f501 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,20 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). +## [1.8.0] - 2020-07-13 + +### Added +* **SharpDPAPI** project + * Landed @leechristensen's `search` command to search for DPAPI blobs + +### Removed +* **SharpDPAPI** project + * Removed machine/user certificate triage from the `triage` and `machinetriage` commands + +### Changed +* Code cleanup and refactoring + + ## [1.7.0] - 2020-05-06 ### Added diff --git a/SharpDPAPI/Commands/Machinetriage.cs b/SharpDPAPI/Commands/Machinetriage.cs index 6b31b18..37f92dc 100755 --- a/SharpDPAPI/Commands/Machinetriage.cs +++ b/SharpDPAPI/Commands/Machinetriage.cs @@ -31,7 +31,7 @@ namespace SharpDPAPI.Commands Triage.TriageSystemCreds(mappings); Triage.TriageSystemVaults(mappings); - Triage.TriageSystemCerts(mappings); + //Triage.TriageSystemCerts(mappings); } } } diff --git a/SharpDPAPI/Commands/Triage.cs b/SharpDPAPI/Commands/Triage.cs index 9fe5ace..d0ce2a0 100755 --- a/SharpDPAPI/Commands/Triage.cs +++ b/SharpDPAPI/Commands/Triage.cs @@ -61,7 +61,7 @@ namespace SharpDPAPI.Commands { Triage.TriageUserCreds(masterkeys, server); Triage.TriageUserVaults(masterkeys, server); - Triage.TriageUserCerts(masterkeys, server); + // Triage.TriageUserCerts(masterkeys, server); Console.WriteLine(); if (masterkeys.Count == 0) { diff --git a/SharpDPAPI/Domain/Info.cs b/SharpDPAPI/Domain/Info.cs index 898d370..bdefdfd 100755 --- a/SharpDPAPI/Domain/Info.cs +++ b/SharpDPAPI/Domain/Info.cs @@ -22,12 +22,20 @@ Retrieve a domain controller's DPAPI backup key, optionally specifying a DC and SharpDPAPI backupkey [/server:SERVER.domain] [/file:key.pvk] +The *search* comand will search for potential DPAPI blobs in the registry, files, folders, and base64 blobs: + + search /type:registry [/path:HKLM\path\to\key] [/showErrors] + search /type:folder /path:C:\path\to\folder [/maxBytes:] [/showErrors] + search /type:file /path:C:\path\to\file [/maxBytes:] + search /type:base64 [/base:] + + Machine/SYSTEM Triage: machinemasterkeys - triage all reachable machine masterkey files (elevates to SYSTEM to retrieve the DPAPI_SYSTEM LSA secret) machinecredentials - use 'machinemasterkeys' and then triage machine Credential files machinevaults - use 'machinemasterkeys' and then triage machine Vaults - machinecerts - use 'machinemasterkeys' and then triage machine certificate stores + machinecerts - use 'machinemasterkeys' and then triage machine certificate stores machinetriage - run the 'machinecredentials' and 'machinevaults' commands diff --git a/SharpDPAPI/Domain/Version.cs b/SharpDPAPI/Domain/Version.cs index 4dc085c..0d7d83f 100755 --- a/SharpDPAPI/Domain/Version.cs +++ b/SharpDPAPI/Domain/Version.cs @@ -4,6 +4,6 @@ namespace SharpDPAPI { public static class Version { - public static string version = "1.7.0"; + public static string version = "1.8.0"; } }