lgandx/pcredzDieses Tool extrahiert Kreditkartennummern, NTLM (DCE-RPC, HTTP, SQL, LDAP, usw.), Kerberos (AS-REQ Pre-Auth etype 23), HTTP Basic, SNMP, POP, SMTP, FTP, IMAP, usw. aus einer pcap-Datei oder von einer Live-Schnittstelle.
PCredz extrahiert Anmeldedaten und Authentifizierungstokens aus Netzwerkverkehr (PCAP-Dateien oder Live-Erfassung).
Extrahiert Anmeldedaten aus IPv4- und IPv6-Datenverkehr:
-m 5500-m 5600-m 7500logs/CredentialDump-Session.log-v verwendet wird)# Build the container
docker build -t pcredz .
# Run with current directory mounted
docker run --rm -v $(pwd):/data pcredz -f /data/capture.pcap
# For live capture (requires --net=host)
docker run --rm --net=host -v $(pwd):/data pcredz -i eth0 -v
Debian/Ubuntu:
sudo apt-get install python3-pip libpcap-dev
pip3 install pcapy-ng
Fedora/RHEL:
sudo dnf install python3-pip libpcap-devel
pip3 install pcapy-ng
Arch Linux:
sudo pacman -S python-pip libpcap
pip3 install pcapy-ng
# Parse a single PCAP file
./Pcredz -f capture.pcap
# Parse all PCAP files in a directory (recursive)
./Pcredz -d /path/to/pcap/directory/
# Live capture on an interface (requires root)
sudo ./Pcredz -i eth0
# Verbose mode (show duplicate credentials)
./Pcredz -f capture.pcap -v
# Custom output directory
./Pcredz -f capture.pcap -o /tmp/pcredz-output/
Required (choose one):
-f FILE PCAP file to parse
-d DIR Directory to parse recursively
-i INTERFACE Interface for live capture
Optional:
-v Verbose mode (print duplicate credentials)
-t Print timestamps
-o DIR Output directory for logs (default: ./)
-c Disable credit card scanning
--disable PROTO Disable protocol (can be used multiple times)
Options: NTLM, HTTP, FTP, IRC, LDAP, SMTP, Kerberos, SNMP, MSSQL
--exclude-host IP Exclude host IP from capture (can be used multiple times)
-h Show help message
Alle Anmeldedaten werden im Verzeichnis logs/ gespeichert:
logs/
├── NTLMv1.txt # NTLMv1 hashes (hashcat -m 5500)
├── NTLMv2.txt # NTLMv2 hashes (hashcat -m 5600)
├── MSKerb.txt # Kerberos hashes (hashcat -m 7500)
├── HTTP-Basic.txt # HTTP Basic auth credentials
├── HTTP-PasswordFields.txt # HTTP form fields and API keys
├── FTP-Plaintext.txt # FTP credentials
├── IRC-Plaintext.txt # IRC credentials
├── SMTP-Plaintext.txt # SMTP credentials
├── LDAP-Simple.txt # LDAP Simple Bind credentials
├── MSSQL-Plaintext.txt # MSSQL credentials
└── SNMPv1.txt # SNMP community strings
Plus ein Sitzungsprotokoll:
CredentialDump-Session.log # Complete session with timestamps
./Pcredz -f capture.pcap
# Output:
# 192.168.1.10:445 > 192.168.1.20:1024
# NTLMv2 complete hash is: admin::DOMAIN:1122334455667788:ABC123...
# Use with hashcat:
hashcat -m 5600 logs/NTLMv2.txt wordlist.txt
sudo ./Pcredz -i eth0 -v
# Captures and displays credentials in real-time
# Press Ctrl+C to stop
# Process all PCAPs in a directory tree
./Pcredz -d /forensics/network-captures/
# Parsing /forensics/network-captures/day1/morning.pcap...
# Parsing /forensics/network-captures/day1/afternoon.pcap...
# ...
# Disable specific protocols (reduce noise)
./Pcredz -f capture.pcap --disable HTTP --disable SNMP
# Only capture NTLM hashes
./Pcredz -f capture.pcap --disable HTTP --disable FTP --disable IRC \
--disable LDAP --disable SMTP --disable Kerberos --disable SNMP --disable MSSQL
# Focus on cleartext credentials only
./Pcredz -f capture.pcap --disable NTLM --disable Kerberos
# Exclude your own IP during live capture (common use case)
sudo ./Pcredz -i eth0 --exclude-host 192.168.1.50 -v
# Exclude multiple hosts
./Pcredz -f capture.pcap --exclude-host 192.168.1.100 --exclude-host 10.0.0.5
# Pentesting: capture target credentials, not your own
sudo ./Pcredz -i eth0 --exclude-host $(hostname -I | awk '{print $1}') -v
pip3 install pcapy-ng
# If that fails:
pip3 install --break-system-packages pcapy-ng
Die Live-Erfassung erfordert Root-Rechte:
sudo ./Pcredz -i eth0
-v), um die gesamte Aktivität zu sehenEinen Fehler gefunden oder ein Feature hinzufügen möchtest? Beiträge sind willkommen!
GNU General Public License v3.0
Laurent Gaffie