#!/usr/bin/env python

# SECUREAUTH LABS. Copyright 2018 SecureAuth Corporation. All rights reserved.

#

# This software is provided under under a slightly modified version

# of the Apache Software License. See the accompanying LICENSE file

# for more information.

#

# Author:

# Alberto Solino (@agsolino)

#

# Description:

# Example for using the DPAPI/Vault structures to unlock Windows Secrets.

#

# Examples:

#

# You can unlock masterkeys, credentials and vaults. For the three, you will specify the file name (using -file for

# masterkeys and credentials, and -vpol and -vcrd for vaults).

# If no other parameter is sent, the contents of these resource will be shown, with their encrypted data as well.

# If you specify a -key blob (in the form of '0xabcdef...') that key will be used to decrypt the contents.

# In the case of vaults, you might need to also provide the user's sid (and the user password will be asked).

# For system secrets, instead of a password you will need to specify the system and security hives.

#

# References: All of the work done by these guys. I just adapted their work to my needs.

# https://www.passcape.com/index.php?section=docsys&cmd=details&id=28

# https://github.com/jordanbtucker/dpapick

# https://github.com/gentilkiwi/mimikatz/wiki/howto-~-credential-manager-saved-credentials (and everything else Ben did )

# http://blog.digital-forensics.it/2016/01/windows-revaulting.html

# https://www.passcape.com/windows_password_recovery_vault_explorer

# https://www.passcape.com/windows_password_recovery_dpapi_master_key

#

from __future__ import division

from __future__ import print_function

import struct

import argparse

import logging

import sys

import re

from binascii import unhexlify, hexlify

from hashlib import pbkdf2_hmac

from Cryptodome.Cipher import AES, PKCS1_v1_5

from Cryptodome.Hash import HMAC, SHA1, MD4

from impacket.uuid import bin_to_string

from impacket import crypto

from impacket.smbconnection import SMBConnection

from impacket.dcerpc.v5 import transport

from impacket.dcerpc.v5 import lsad

from impacket import version

from impacket.examples import logger

from impacket.examples.secretsdump import LocalOperations, LSASecrets

from impacket.structure import hexdump

from impacket.dpapi import MasterKeyFile, MasterKey, CredHist, DomainKey, CredentialFile, DPAPI_BLOB, \

CREDENTIAL_BLOB, VAULT_VCRD, VAULT_VPOL, VAULT_KNOWN_SCHEMAS, VAULT_VPOL_KEYS, P_BACKUP_KEY, PREFERRED_BACKUP_KEY, \

PVK_FILE_HDR, PRIVATE_KEY_BLOB, privatekeyblob_to_pkcs1, DPAPI_DOMAIN_RSA_MASTER_KEY

class DPAPI:

print('Cannot decrypt (specify -key or -sid whenever applicable) ')

if __name__ == '__main__':

# Init the example's logger theme

logger.init()

print(version.BANNER)

parser = argparse.ArgumentParser(add_help=True, description="Nose")

parser.add_argument('-debug', action='store_true', help='Turn DEBUG output ON')

subparsers = parser.add_subparsers(help='actions', dest='action')

# A domain backup key command

backupkeys = subparsers.add_parser('backupkeys', help='domain backup key related functions')

backupkeys.add_argument('-t', '--target', action='store', required=True, help='[[domain/]username[:password]@]<targetName or address>')

backupkeys.add_argument('-k', action='store_true', required=False, help='use kerberos')

backupkeys.add_argument('--export', action='store_true', required=False, help='export keys to file')

# A masterkey command

masterkey = subparsers.add_parser('masterkey', help='masterkey related functions')

masterkey.add_argument('-file', action='store', required=True, help='Master Key File to parse')

masterkey.add_argument('-sid', action='store', help='SID of the user')

masterkey.add_argument('-pvk', action='store', help='Domain backup privatekey to use for decryption')

masterkey.add_argument('-key', action='store', help='Specific key to use for decryption')

masterkey.add_argument('-password', action='store', help='User\'s password. If you specified the SID and not the password it will be prompted')

masterkey.add_argument('-system', action='store', help='SYSTEM hive to parse')

masterkey.add_argument('-security', action='store', help='SECURITY hive to parse')

# A credential command

credential = subparsers.add_parser('credential', help='credential related functions')

credential.add_argument('-file', action='store', required=True, help='Credential file')

credential.add_argument('-key', action='store', required=False, help='Key used for decryption')

# A vault command

vault = subparsers.add_parser('vault', help='vault credential related functions')

vault.add_argument('-vcrd', action='store', required=False, help='Vault Credential file')

vault.add_argument('-vpol', action='store', required=False, help='Vault Policy file')

vault.add_argument('-key', action='store', required=False, help='Master key used for decryption')

options = parser.parse_args()

if len(sys.argv)==1:

parser.print_help()

sys.exit(1)

if options.debug is True:

logging.getLogger().setLevel(logging.DEBUG)

else:

logging.getLogger().setLevel(logging.INFO)

try:

executer = DPAPI(options)

executer.run()

except Exception as e:

if logging.getLogger().level == logging.DEBUG:

import traceback

traceback.print_exc()

print(str(e))