Added Chromium-based Edge support for SharpChrome
Added /consoleoutfile support for SharpDPAPI/SharpChrome
Added "statekeys" command to SharpChrome
Fixed SharpChrome cookie bug for expires times of 0
Added the "search" command to search for DPAPI blobs
Removed certificate triage from the machinetriage/triage commands
Code cleanup and some refactoring
-Landed @leftp's PR for user and machine certificate private key extraction
-Added cert triage to the "triage" and "machinetriage" commands
-Using /password:X now causes the DPAPI masterkey cache to be output
-Combined TriageUserMasterKeysWithPass into TriageUserMasterKeys
-'/password:X' now properly works in SharpDPAPI while elevated, as well as remotely
-'/password:X' now works for SharpChrome, elevated + remotely
-Added *ps* command to decrypt exported PSCredential .xmls (thanks for the idea @gentilkiwi ;)
-Added README section for the *blob* command
-Misc. small output tweaks
-When using /server:X, .RDG files parsed from RDCMan.settings files are translated to UNC paths for parsing
-triage command when used against a remote /server:X now works properly
-Added **blob** function to describe a raw DPAPI blob
-Added **rdg** function to triage RDCMan.settings/.RDG files and decrypt any saved RDP passwords
-Added IsTextUnicode() for vault/credential/blob decryption display, showing hex if unicode is detected
-Added /target:C:\FOLDER\ option for the **masterkeys** function, for offline masterkey decryption
-Updated README
-Added remote server support for user triage functions
-Added machine triage (machinemasterkeys, machinecredentials, machinevaults, machinetriage)
-Expanded Vault credential format to handle vault credential clear attributes
-Expanded machine vault/credential search locations
-Broke out commands/files into the same general structure as Rubeus
P.S. this release was a huge PITA, hopefully it's appreciated ;)
Much <3 to @gentilkiwi for his excellent examples, and @tifkin_ for inspiring this work!
harmj0y