PCredz — Questo strumento estrae numeri di carte di credito, NTLM (DCE-RPC, HTTP, SQL, LDAP, ecc.), Kerberos (AS-REQ Pre-Auth etype 23), HTTP Basic, SNMP, POP, SMTP, FTP, IMAP, ecc. da un file pcap o da un'interfaccia live. | Kitploit

-m 5600

# Build the container
docker build -t pcredz .

# Run with current directory mounted
docker run --rm -v $(pwd):/data pcredz -f /data/capture.pcap

# For live capture (requires --net=host)
docker run --rm --net=host -v $(pwd):/data pcredz -i eth0 -v

# Parse a single PCAP file
./Pcredz -f capture.pcap

# Parse all PCAP files in a directory (recursive)
./Pcredz -d /path/to/pcap/directory/

# Live capture on an interface (requires root)
sudo ./Pcredz -i eth0

# Verbose mode (show duplicate credentials)
./Pcredz -f capture.pcap -v

# Custom output directory
./Pcredz -f capture.pcap -o /tmp/pcredz-output/

Required (choose one):
  -f FILE         PCAP file to parse
  -d DIR          Directory to parse recursively
  -i INTERFACE    Interface for live capture

Optional:
  -v              Verbose mode (print duplicate credentials)
  -t              Print timestamps
  -o DIR          Output directory for logs (default: ./)
  -c              Disable credit card scanning
  --disable PROTO Disable protocol (can be used multiple times)
                  Options: NTLM, HTTP, FTP, IRC, LDAP, SMTP, Kerberos, SNMP, MSSQL
  --exclude-host IP  Exclude host IP from capture (can be used multiple times)
  -h              Show help message

logs/
├── NTLMv1.txt              # NTLMv1 hashes (hashcat -m 5500)
├── NTLMv2.txt              # NTLMv2 hashes (hashcat -m 5600)
├── MSKerb.txt              # Kerberos hashes (hashcat -m 7500)
├── HTTP-Basic.txt          # HTTP Basic auth credentials
├── HTTP-PasswordFields.txt # HTTP form fields and API keys
├── FTP-Plaintext.txt       # FTP credentials
├── IRC-Plaintext.txt       # IRC credentials
├── SMTP-Plaintext.txt      # SMTP credentials
├── LDAP-Simple.txt         # LDAP Simple Bind credentials
├── MSSQL-Plaintext.txt     # MSSQL credentials
└── SNMPv1.txt              # SNMP community strings

./Pcredz -f capture.pcap

# Output:
# 192.168.1.10:445 > 192.168.1.20:1024
# NTLMv2 complete hash is: admin::DOMAIN:1122334455667788:ABC123...

# Use with hashcat:
hashcat -m 5600 logs/NTLMv2.txt wordlist.txt

# Process all PCAPs in a directory tree
./Pcredz -d /forensics/network-captures/

# Parsing /forensics/network-captures/day1/morning.pcap...
# Parsing /forensics/network-captures/day1/afternoon.pcap...
# ...

# Disable specific protocols (reduce noise)
./Pcredz -f capture.pcap --disable HTTP --disable SNMP

# Only capture NTLM hashes
./Pcredz -f capture.pcap --disable HTTP --disable FTP --disable IRC \
  --disable LDAP --disable SMTP --disable Kerberos --disable SNMP --disable MSSQL

# Focus on cleartext credentials only
./Pcredz -f capture.pcap --disable NTLM --disable Kerberos

# Exclude your own IP during live capture (common use case)
sudo ./Pcredz -i eth0 --exclude-host 192.168.1.50 -v

# Exclude multiple hosts
./Pcredz -f capture.pcap --exclude-host 192.168.1.100 --exclude-host 10.0.0.5

# Pentesting: capture target credentials, not your own
sudo ./Pcredz -i eth0 --exclude-host $(hostname -I | awk '{print $1}') -v

PCredz

Più Popolari

Supporto del livello di collegamento

Installazione

Docker (Consigliato)

Linux

Utilizzo

Esempi di base

Opzioni

File di output

Esempi

Estrarre hash NTLM

Cattura dal vivo

Elaborazione batch

Filtraggio dei protocolli

Esclusione degli host

Prestazioni

Ottimizzazioni

Benchmark

Risoluzione dei problemi

pcapy-ng non trovato

Permesso negato (cattura dal vivo)

Nessuna credenziale trovata

Contributi

Licenza

Autore