SharpDPAPI

SharpDPAPI هو منفذ C# لبعض وظائف DPAPI من مشروع @gentilkiwi Mimikatz.

لم أبتكر هذه المنطق، إنه مجرد نقل من Mimikatz لفهم العملية بشكل أفضل وتشغيلها لتناسب سير عملنا.

المشروع الفرعي SharpChrome هو تكييف لعمل @gentilkiwi و @djhohnstein، وتحديداً مشروع SharpChrome الخاص به. ومع ذلك، يستخدم هذا الإصدار من SharpChrome نسخة مختلفة من مكتبة C# SQL التي تدعم الفتح بدون قفل. تم بناء SharpChrome كمشروع منفصل في SharpDPAPI بسبب حجم مكتبة SQLite المستخدمة.

يمكن فحص كل من Chrome ومتصفحات Edge الجديدة المبنية على Chromium باستخدام SharpChrome.

يستخدم SharpChrome أيضًا نسخة مصغرة من كود BCrypt P/Invoke الخاص بـ @AArnott والمُصدر بموجب ترخيص MIT.

إذا كنت غير معتاد على DPAPI، اطلع على هذه التدوينة لمزيد من المعلومات الأساسية. لمزيد من المعلومات حول بيانات الاعتماد والخزائن فيما يتعلق بـ DPAPI، اطلع على إدخال الويكي حول هذا الموضوع.

@harmj0y هو المؤلف الرئيسي لهذا النقل.

SharpDPAPI مرخص بموجب ترخيص BSD 3-Clause.

جدول المحتويات

SharpDPAPI

خلفية

استخدام سطر أوامر SharpDPAPI

  __                 _   _       _ ___
 (_  |_   _. ._ ._  | \ |_) /\  |_) |
 __) | | (_| |  |_) |_/ |  /--\ |  _|_
                |
  v1.20.0

Retrieve a domain controller's DPAPI backup key, optionally specifying a DC and output file:

  SharpDPAPI backupkey [/nowrap] [/server:SERVER.domain] [/file:key.pvk]


The *search* comand will search for potential DPAPI blobs in the registry, files, folders, and base64 blobs:

    search /type:registry [/path:HKLM\path\to\key] [/showErrors]
    search /type:folder /path:C:\path\to\folder [/maxBytes:<numOfBytes>] [/showErrors]
    search /type:file /path:C:\path\to\file [/maxBytes:<numOfBytes>]
    search /type:base64 [/base:<base64 string>]


Machine/SYSTEM Triage:

    machinemasterkeys       -   triage all reachable machine masterkey files (elevates to SYSTEM to retrieve the DPAPI_SYSTEM LSA secret)
    machinecredentials      -   use 'machinemasterkeys' and then triage machine Credential files
    machinevaults           -   use 'machinemasterkeys' and then triage machine Vaults
    machinetriage           -   run the 'machinecredentials' and 'machinevaults' commands


User Triage:

    Arguments for the 'masterkeys' command:

        /target:FILE/folder     -   triage a specific masterkey, or a folder full of masterkeys (otherwise triage local masterkeys)
        /pvk:BASE64...          -   use a base64'ed DPAPI domain private key file to first decrypt reachable user masterkeys
        /pvk:key.pvk            -   use a DPAPI domain private key file to first decrypt reachable user masterkeys
        /password:X             -   decrypt the target user's masterkeys using a plaintext password (works remotely)
        /ntlm:X                 -   decrypt the target user's masterkeys using a NTLM hash (works remotely)
        /credkey:X              -   decrypt the target user's masterkeys using a DPAPI credkey (domain or local SHA1, works remotely)
        /rpc                    -   decrypt the target user's masterkeys by asking domain controller to do so
        /server:SERVER          -   triage a remote server, assuming admin access
        /hashes                 -   output usermasterkey file 'hashes' in JTR/Hashcat format (no decryption)


    Arguments for the credentials|vaults|rdg|keepass|triage|blob|ps commands:

        Decryption:
            /unprotect          -   force use of CryptUnprotectData() for 'ps', 'rdg', or 'blob' commands
            /pvk:BASE64...      -   use a base64'ed DPAPI domain private key file to first decrypt reachable user masterkeys
            /pvk:key.pvk        -   use a DPAPI domain private key file to first decrypt reachable user masterkeys
            /password:X         -   decrypt the target user's masterkeys using a plaintext password (works remotely)
            /ntlm:X             -   decrypt the target user's masterkeys using a NTLM hash (works remotely)
            /credkey:X          -   decrypt the target user's masterkeys using a DPAPI credkey (domain or local SHA1, works remotely)
            /rpc                -   decrypt the target user's masterkeys by asking domain controller to do so
            GUID1:SHA1 ...      -   use a one or more GUID:SHA1 masterkeys for decryption
            /mkfile:FILE        -   use a file of one or more GUID:SHA1 masterkeys for decryption

        Targeting:
            /target:FILE/folder -   triage a specific 'Credentials','.rdg|RDCMan.settings', 'blob', or 'ps' file location, or 'Vault' folder
            /server:SERVER      -   triage a remote server, assuming admin access
                                    Note: must use with /pvk:KEY or /password:X
                                    Note: not applicable to 'blob' or 'ps' commands


Certificate Triage:

    Arguments for the 'certificates' command:
        /showall                                        -   show all decrypted private key files, not just ones that are linked to installed certs (the default)
        /machine                                        -   use the local machine store for certificate triage
        /mkfile | /target                               -   for /machine triage
        [all decryption args from User Triage above]


Note: in most cases, just use *triage* if you're targeting user DPAPI secrets and *machinetriage* if you're going after SYSTEM DPAPI secrets.
      These functions wrap all the other applicable functions that can be automatically run.

الأكثر شعبية

SharpDPAPI

SharpDPAPI

جدول المحتويات

خلفية

استخدام سطر أوامر SharpDPAPI

استخدام سطر أوامر SharpChrome