* Added SAM history parsing to secretsdump.py and secretsdump.py
* Update impacket/examples/regsecrets.py
Co-authored-by: Gabriel Gonzalez <gabriel.gonzalez@fortra.com>
* Update impacket/examples/secretsdump.py
Co-authored-by: Gabriel Gonzalez <gabriel.gonzalez@fortra.com>
* Update impacket/examples/secretsdump.py
Co-authored-by: Gabriel Gonzalez <gabriel.gonzalez@fortra.com>
* Update impacket/examples/regsecrets.py
Co-authored-by: Gabriel Gonzalez <gabriel.gonzalez@fortra.com>
* Update help message for -history argument
Clarified help message for -history argument to specify NTDS and SAM hashes.
* Clarify -history argument help text
Updated help text for the -history argument to clarify that it dumps NTDS and SAM hashes.
---------
Co-authored-by: Gabriel Gonzalez <gabriel.gonzalez@fortra.com>
* Added support for "export" hive format + compute bootkey from class names
* Fixing bug when key does not exist
* Better data extraction to avoid special characters errors
* Fix remote dumping errors
* Fix conflicts
* Reverting changes in examples/secretsdump and impacket/examples/secretsdump. Will be handled in a new PR
* Implemented Registry as an abstract class. Implemented winregistry.get_registry_parser as a factory function to instantiate right parser based in given hive parameter. Refactor registry-read and secretsdump to leverage this factory.
* Enhancing -system description in secretsdump\nClarifying that SYSTEM hive has to be in binary format
* Update the description of the `system` flag
---------
Co-authored-by: gabrielg5 <gabriel.gonzalez@fortra.com>
* Implemented also NTDS.dit download using ShadowSnapshot method via WMI
* Added some debug msgs
* Finished, but error when decrypting. Also with other methods. Found bug?
* Finished, but error when decrypting. Also with other methods. Found bug?
* Adding checks for correct options usage. https://github.com/fortra/impacket/pull/2021#pullrequestreview-3227404992
---------
Co-authored-by: Peter Gabaldon <peter@pgj11.com>
* Added functionality to the SAMHashes Class of the secrestdump.py library to be able to print the user status for SAM dumps. There was already a user-status flag for the NTDS dumps, but not for the SAM dumps. Now, when directly calling secretsdump.py to make a SAM dump, the user can specify the -user-status flag, just like with the NTDS dump. Alternatively, when other tools are using the Secretsdump library, they can simply initiate the SAMHashes class with the printUserStatus flag set to True. The default is False, so if you don't specify anything when calling the Secretsdump Library it will do exactly as it did before. This should not break any existing tools.
* Added some extra checks to make sure the account is no longer marked as "locked" when the lockout duration has passed. In the previous interation, the "locked" mark was only removed after the locked account was used at least once after being unlocked.
---------
Co-authored-by: Mark Bregman <mark.bregman@fox-it.com>
* Standardized examples logger init method
* Fixing missing import
* Standardized examples init_ldap_session function #1
* Calling new shared function _ldap3_kerberos_login from example addcomputer
* Removed considering -debug in each example. Now it's handled in utils.
* Standardized EMPTY_LM_HASH in impacket.examples.utils
* Unify parse_identity function (phase 1)
* Standardized parse_identity
* Renamed "_ldap3_kerberos_login" to "ldap3_kerberos_login" (as it is called from outside)
* Standardize "logger" init in regsecrets.py
* Standardized LDAP login into a single function in utils.py:ldap_login
* Starting remote 'Shadow Snapshot Method'
* Continue :)
* Added options
* Logic error hehe :)
* Ups :S
* Remote Shadow Snapshot Working. Path calculated well. Need to fix download
* Download not working. SMB access is protected. Run copy command remotely? Too much noise I think :S
* Could not find a way to copy using WMI using GLOBALROOT path. Failing back to RCE; noisy :(
* Working
* Working
* Working
* Added debug log
* Working without RCE, download from ShadowCopy using SMB
* Removed commented code and unused methods
* Delete ShadowCopy after downlodaing SAM/SYSTEM/SECURITY
---------
Co-authored-by: Pedro Gabaldon <peter@pgj11.com>
* Added ability to specify an output file for smbclient.py to log commands / output while using the smbclient shell
* Improved logging to output file for smbclient
* Added increased control over execution of secretsdump.py, including ability to skip specific users when dumping NTDS.dit or skip SAM hive when dumping remote machine
* Improved relaying to ADCS endpoints
* Improved relaying to ADCS endpoints
* Requested ADCS certificates are now saved to lootdir specified in command line
* Improved writing certificate to file
* Improved log file for smbclient.py
* Bug fix with smbclient output file after rebase
* Bug fix with outputfile logic
Implementation of a new credential dumping method. This PR includes:
- examples/keylistattack.py: A new example with the implementation of the attack.
- examples/secretsdump.py: A new option (use-keylist) to dump credentials with the new attack instead of default the DRSUAPI method.
- impacket/examples/secretsdump.py: Modifications to the library to support the new attack.
This was a pending change to:
- Use the same tagline, copyright and license notice across files.
- Remove authors' contacts that are no longer valid (due to affiliation changes).
- Update repository location.
- Update license file with missing licenses (althought those were already in source files).
This doesn't include any change on the source code, nor any change on current copyright or licenses. Just formatting and phrasing to make our and distro's maintainers life easier.
In reviewing #1051 (and related #347) we found out that there's some ugly duplicated code that's better suited for an utils function.
The expected target format is:
`<DOMAIN></USERNAME><:PASSWORD>@HOSTNAME`
This PR:
- Moved target parsing routine to an utils module.
- Added unit tests for the new function.
- Using the new function across example scripts that accept a target.
* Allows to chose different exec methods when -use-vss mode is chosen:
1. smbexec (default): Creates a service executing the desired commands
2. wmiexec: Executes commands through Win32Process.Create() API
3. mmcexec: Executes commands through DCOM MMC object (Kerberos not supported here)
Replaced all instances of `#!/usr/bin/python` with `#!/usr/bin/env python` so impacket's examples and scripts can be run inside a virtualenv without having to call python.
alexisbalbachan