Commit Graph

162 Commits

Author SHA1 Message Date
harmj0y f74d23bc43 tweaks for retro chromium decryption
- try all keys if username/browser not defined
2025-10-20 21:23:41 -07:00
harmj0y e0312a4e6c Update local_state.py 2025-10-20 11:50:56 -07:00
harmj0y c29d245968 Retro decryption working for statekeys
- Retro decryption working for statekeys (including factoring in chromekeys)
2025-10-20 11:49:29 -07:00
Lee Chagolla-Christensen c2dac2e8a7 Change DB access and update alerting
- Switch from using POSTGRES_CONNECTION_STRING to
  POSTGRES_USER/POSTGRES_PASSWORD/POSTGRES_DATABASE/etc.
- When no apprise URL is configured, use the test echo'ing endpoint
2025-10-18 21:36:27 -07:00
Lee Chagolla-Christensen 3c22897518 standardize postgres access 2025-10-18 17:48:54 -07:00
Lee Chagolla-Christensen 01384800a0 fix broken jwt scanning, ruff linting errors 2025-10-17 15:00:10 -07:00
Lee Chagolla-Christensen 2e48a0d3a5 ruff - auto fixes 2025-10-17 14:29:45 -07:00
Lee Chagolla-Christensen dfef46ce53 fix pydantic deprecations 2025-10-17 14:25:59 -07:00
Lee Chagolla-Christensen fa918973ba make SQL strings private, lint warnings, dead code 2025-10-17 14:20:55 -07:00
Lee Chagolla-Christensen d7ac3f368d Merge branch 'nemesis-2.1.3' of github.com:SpecterOps/Nemesis into nemesis-2.1.3 2025-10-17 11:55:20 -07:00
Lee Chagolla-Christensen 0800ce6bde fix async locking things up, asyncify basic enrichment 2025-10-17 11:53:57 -07:00
harmj0y a6bc09752f Added retroactive chromekey decryption
- Added retroactive chromekey decryption when new plaintext masterkeys are submitted/decrypted
- Fix for SHA1 masterkeys submitted via the web_api (were previously treated like full masterkeys)
2025-10-17 11:40:59 -07:00
Lee Chagolla-Christensen be931be374 async activities,update models,dev mode settings
- Centralize Dapr workflow runtime initialization
- Create an async activity decorator
- Migrate Pydantic v1 Config classes to v2 ConfigDict in models.py
- Set explicit open=True for ConnectionPool instances
- Enable PYTHONDEVMODE in file_enrichment Dockerfile to catch more bugs
- Update VSCode settings for Python interpreter path and format-on-save
2025-10-17 01:09:42 -07:00
Lee Chagolla-Christensen c9358a9a2e make file links merge case insensitive, info --> debug logging 2025-10-16 23:03:42 -07:00
Lee Chagolla-Christensen 1a638757a4 update changelog, CNG description 2025-10-16 17:54:27 -07:00
Lee Chagolla-Christensen e358678b24 Merge branch 'nemesis-2.1.3' of github.com:SpecterOps/Nemesis into nemesis-2.1.3 2025-10-16 16:54:21 -07:00
Lee Chagolla-Christensen e233af29bb change placeholder from UUID to machine GUID 2025-10-16 16:54:13 -07:00
Lee Chagolla-Christensen 160a5a0077 add UUID link placehold, add Local State link to CNG private key 2025-10-16 16:30:05 -07:00
harmj0y 81fae70fc6 Fix for retroactive masterkey decryption
- Fix for retroactive masterkey decryption
2025-10-16 15:50:17 -07:00
harmj0y b129422e8f ABE v3 fixes and state key retroactive decryption
- Fixed decryption of v3 ABE keys via the CNG chromekey
- Schema mod w/ indexes for ABE mks
- New masterkeys now used to retroactively decrypt Local State keys
    - added retry_decrypt_state_keys_for_masterkey for retroactive decryption
- Added more references
2025-10-16 12:01:34 -07:00
Lee Chagolla-Christensen 3527df6f6a windows path normalization, get_drive docs 2025-10-16 02:38:47 -07:00
Lee Chagolla-Christensen 1bd3e0de2a path placeholder replacement 2025-10-16 02:25:18 -07:00
Lee Chagolla-Christensen 998c8c5ee7 get_drive fixes, housekeeping fixes 2025-10-15 23:09:25 -07:00
Lee Chagolla-Christensen e3a23b6f0a fix file browser, add reason 2025-10-15 18:25:46 -07:00
Lee Chagolla-Christensen be115d1808 update to use common.logger 2025-10-15 14:09:29 -07:00
Lee Chagolla-Christensen b63813e300 Standardize path handling and centralize database connection management
- Add centralized PostgreSQL connection string helper in common/db.py
- Replace ntpath with posixpath
- Add get_drive_from_path() helper for extracting drive letters from paths
- Update all modules to use centralized DB connection helper instead of individual Dapr client calls
- Improve path normalization across Chromium, DPAPI, and file enrichment modules
- Added dependencies to local libraries
- Expand file linking tests with comprehensive rule engine test cases
- Refactor masterkey path construction to use posixpath.normpath for proper path joining
- Update state helpers and API models to use centralized connection
- Updated web API to use strongly typed models instead of dicts
  internally
- Improve DPAPI core functionality with better error handling and path normalization
2025-10-15 13:48:50 -07:00
Lee Chagolla-Christensen d1511044a2 fix mime type matching 2025-10-15 00:20:24 -07:00
Lee Chagolla-Christensen cc99cafc28 remove example test 2025-10-15 00:11:38 -07:00
Lee Chagolla-Christensen 7969d77480 remove redundant file normalization(file_enriched.path should be normalize), add initial linking tests 2025-10-15 00:10:53 -07:00
Lee Chagolla-Christensen 7d9dce431c update comment 2025-10-14 23:26:24 -07:00
Lee Chagolla-Christensen 6890c160bb let exceptions actually fail 2025-10-14 23:21:13 -07:00
Lee Chagolla-Christensen 9554724470 remove normalizaiton (enriched file path should be normalized), remove unused code, fix unhandled error conditions 2025-10-14 23:18:05 -07:00
Lee Chagolla-Christensen 38ed2e26f6 strong types in linking code 2025-10-14 22:54:29 -07:00
Lee Chagolla-Christensen b082376679 linting 2025-10-14 21:14:15 -07:00
Lee Chagolla-Christensen 4cd93a703f remove unused linking code 2025-10-14 21:09:29 -07:00
Lee Chagolla-Christensen 45f3fb2c4b Merge branch 'nemesis-2.1.3' of github.com:SpecterOps/Nemesis into nemesis-2.1.3 2025-10-14 20:28:45 -07:00
Lee Chagolla-Christensen a6a7891626 revert to just using dpapick3, added chrome test files 2025-10-14 20:28:23 -07:00
harmj0y 257465ca0e First pass at v3 ABE dec
- First pass at v3 ABE dec
2025-10-14 18:25:39 -07:00
harmj0y 87dacba761 Start of CNG Google Chromekey1/AES key ABE
- Start of CNG Google Chromekey1/AES key decryption for v3 of ABE key
- Added cng file enrichment module
- Entropy can now be passed through for blob decryption
2025-10-14 16:28:58 -07:00
Lee Chagolla-Christensen 614b08af1e fix stupid null byte 2025-10-14 15:18:59 -07:00
Lee Chagolla-Christensen d0163b5a9e add CNG decrypt test (currently failing) 2025-10-14 14:24:44 -07:00
Lee Chagolla-Christensen 42d0a32d6b validate or auto-calc mk sha1 2025-10-14 13:48:55 -07:00
Lee Chagolla-Christensen 7670f9b536 correct MasterKey.is_encrypted 2025-10-14 13:07:53 -07:00
harmj0y 4689dd85f6 Added exif_metadata enrichment module
-Added `exif_metadata` enrichment module
2025-10-14 10:11:47 -07:00
Lee Chagolla-Christensen acc5e9f2b3 add domain backup key ID 2025-10-11 23:46:45 -07:00
Lee Chagolla-Christensen 2a8b653491 fix auto decrypt for unknown MK types 2025-10-11 02:47:14 -07:00
Lee Chagolla-Christensen 9dc4fa22cc added write-once tests 2025-10-11 02:29:36 -07:00
Lee Chagolla-Christensen 51f05a3acd add write-once constraints to DPAPI columns 2025-10-11 02:11:14 -07:00
Lee Chagolla-Christensen e6ff7f9d41 rename MasterKeyFilter to EncryptionFilter 2025-10-11 01:14:30 -07:00
Lee Chagolla-Christensen f613a4b921 reorganize DpapiManager functions, remove close() method 2025-10-11 01:06:17 -07:00