Hacking Articles Tips Tricks Videos Tutorials

description :
dec(blob) : 01 00 00 00 3F 3F 3F 3F 01 15 3F 11 3F 7A 00 3F 4F 3F 3F ...
Using a domain DPAPI backup key to first decrypt any discoverable masterkeys: C:\Temp>SharpDPAPI.exe blob /target:C:\Temp\blob2.bin /pvk:HvG1sAAAAAABAAAAAAAAAAAAAAC...(snip)...

__ _ _ _ ___
(_ |_ _. ._ ._ | \ |_) /\ |_) |
__) | | (_| | |_) |_/ | /--\ | _|_
|
v1.5.0

[*] Action: Describe DPAPI blob

[*] Using a domain DPAPI backup key to triage masterkeys for decryption key mappings!

[*] User master key cache:

{0241bc33-44ae-404a-b05d-a35eea8cbc63}:E7E481877B9D51C17E015EB3C1F72FB887363EE3

guidMasterKey : {0241bc33-44ae-404a-b05d-a35eea8cbc63}
size : 314
flags : 0x0
algHash/algCrypt : 32772 (CALG_SHA) / 26115 (CALG_3DES)
description :
dec(blob) : 01 00 00 00 3F 3F 3F 3F 01 15 3F 11 3F 7A 00 3F 4F 3F 3F ...

backupkey
The backupkey command will retrieve the domain DPAPI backup key from a domain controller using the LsaRetrievePrivateData API approach from Mimikatz (https://github.com/gentilkiwi/mimikatz/blob/2fd09bbef0754317cd97c01dbbf49698ae23d9d2/mimikatz/modules/kuhl_m_lsadump.c#L1882-L1927). This private key can then be used to decrypt master key blobs for any user on the domain. And even better, the key never changes ;) Domain admin (or equivalent) rights are needed to retrieve the key from a remote domain controller. The /nowrap flag will prevent wrapping the base64 key on display. This base64 key blob can be decoded to a binary .pvk file that can then be used with Mimikatz' dpapi::masterkey /in:MASTERKEY /pvk:backupkey.pvk module, or used in blob/file /pvk:X form with the masterkeys, credentials, or vault SharpDPAPI commands. By default, SharpDPAPI will try to determine the current domain controller via the DsGetDcName API call. A server can be specified with /server:COMPUTER.domain.com. If you want the key saved to disk instead of output as a base64 blob, use /file:key.pvk. Retrieve the DPAPI backup key for the current domain controller: C:\Temp>SharpDPAPI.exe backupkey

__ _ _ _ ___
(_ |_ _. ._ ._ | \ |_) /\ |_) |
__) | | (_| | |_) |_/ | /--\ | _|_
|
v1.2.0

[*] Action: Retrieve domain DPAPI backup key

[*] Using current domain controller : PRIMARY.testlab.local
[*] Preferred backupkey Guid : 32d021e7-ab1c-4877-af06-80473ca3e4d8
[*] Full preferred backupKeyName : G$BCKUPKEY_32d021e7-ab1c-4877-af06-80473ca3e4d8
[*] Key :
HvG1sAAAAAABAAAAAAAAAAAAAACUBAAABwIAAACkAABSU0EyAAgAAA...(snip)...
Retrieve the DPAPI backup key for the specified DC, outputting the backup key to a file: C:\Temp>SharpDPAPI.exe backupkey /server:primary.testlab.local /file:key.pvk

__ _ _ _ ___
(_ |_ _. ._ ._ | \ |_) /\ |_) |
__) | | (_| | |_) |_/ | /--\ | _|_
|
v1.2.0

[*] Action: Retrieve domain DPAPI backup key

[*] Using server : primary.testlab.local
[*] Preferred backupkey Guid : 32d021e7-ab1c-4877-af06-80473ca3e4d8
[*] Full preferred backupKeyName : G$BCKUPKEY_32d021e7-ab1c-4877-af06-80473ca3e4d8
[*] Backup key written to : key.pvk

search
The search comand will search for potential DPAPI blobs in the registry, files, folders, and base64 blobs. Usage: SharpDPAPI.exe search /type:registry [/path:HKLM\path\to\key] [/showErrors]
SharpDPAPI.exe search /type:folder /path:C:\path\to\folder [/maxBytes:] [/showErrors]
SharpDPAPI.exe search /type:file /path:C:\path\to\file [/maxBytes:]
SharpDPAPI.exe search /type:base64 [/base:]
The search command works by searching for the following bytes, which represent the header (Version + DPAPI provider GUID) of DPAPI blob structure: 0x01, 0x00, 0x00, 0x00, 0xD0, 0x8C, 0x9D, 0xDF, 0x01, 0x15, 0xD1, 0x11, 0x8C, 0x7A, 0x00, 0xC0, 0x4F, 0xC2, 0x97, 0xEB

4 views🎭👨🏻‍💻Hacker's Hub👨🏻‍💻🎭, 21:36

SharpChrome Commands

logins
The logins command will search for Chrome 'Login Data' files and decrypt the saved login passwords. If execution is in an unelevated contect, CryptProtectData() will automatically be used to try to decrypt values. If /browser:edge is specified, the newer Chromium-based Edge browser is triaged. Login Data files can also be decrypted with a) any "{GUID}:SHA1 {GUID}:SHA1 ..." masterkeys passed, b) a /mkfile:FILE of one or more {GUID}:SHA1 masterkey mappings, c) a supplied DPAPI domain backup key (/pvk:BASE64... or /pvk:key.pvk) to first decrypt any user masterkeys, or d) a /password:X to decrypt any user masterkeys, which are then used as a lookup decryption table. DPAPI GUID mappings can be recovered with Mimikatz' sekurlsa::dpapi command. A specific Login Data file can be specified with /target:FILE. A remote /server:SERVER can be specified if a /pvk is also supplied. If triaging newer Chrome/Edge instances, a /statekey:X AES state key can be specified. By default, logins are displayed in a csv format. This can be modified with /format:table for table output. Also, by default only non-null password value entries are displayed, but all values can be displayed with /showall. If run from an elevated context, Login Data files for ALL users will be triaged, otherwise only Login Data files for the current user will be processed.
cookies
The cookies command will search for Chrome 'Cookies' files and decrypt cookie values. If execution is in an unelevated contect, CryptProtectData() will automatically be used to try to decrypt values. If /browser:edge is specified, the newer Chromium-based Edge browser is triaged. Cookie files can also be decrypted with a) any "{GUID}:SHA1 {GUID}:SHA1 ..." masterkeys passed, b) a /mkfile:FILE of one or more {GUID}:SHA1 masterkey mappings, c) a supplied DPAPI domain backup key (/pvk:BASE64... or /pvk:key.pvk) to first decrypt any user masterkeys, or d) a /password:X to decrypt any user masterkeys, which are then used as a lookup decryption table. DPAPI GUID mappings can be recovered with Mimikatz' sekurlsa::dpapi command. A specific Cookies file can be specified with /target:FILE. A remote /server:SERVER can be specified if a /pvk is also supplied. If triaging newer Chrome/Edge instances, a /statekey:X AES state key can be specified. By default, cookies are displayed in a csv format. This can be modified with /format:table for table output, or /format:json for output importable by EditThisCookie (https://chrome.google.com/webstore/detail/editthiscookie/fngmhnnpilhplaeedifhccceomclgfbg?hl=en). Also, by default only non-expired cookie value entries are displayed, but all values can be displayed with /showall. If run from an elevated context, Cookie files for ALL users will be triaged, otherwise only Cookie files for the current user will be processed. The cookies command also has /cookie:REGEX and /url:REGEX arguments to only return cookie names or urls matching the supplied regex. This is useful with /format:json to easily clone access to specific sites.
statekeys
The statekeys command will search for Chrome/Edge AES statekey files (i.e. 'AppData\Local\Google\Chrome\User Data\Local State' and 'AppData\Local\Microsoft\Edge\User Data\Local State') and decrypts them using the same type of arguments that can be supplied for cookies and logins. State keys can also be decrypted with a) any "{GUID}:SHA1 {GUID}:SHA1 ..." masterkeys passed, b) a /mkfile:FILE of one or more {GUID}:SHA1 masterkey mappings, c) a supplied DPAPI domain backup key (/pvk:BASE64... or /pvk:key.pvk) to first decrypt any user masterkeys, or d) a /password:X to decrypt any user masterkeys, which are then used as a lookup decryption table. DPAPI GUID mappings can be recovered with Mimikatz' sekurlsa::dpapi command. If run from an elevated context, state keys for ALL users will be triaged, otherwise only state keys for the current user will be processed.
backupkey

5 views🎭👨🏻‍💻Hacker's Hub👨🏻‍💻🎭, 21:36

Hacking Articles Tips Tricks Videos Tutorials

The backupkey command will retrieve the domain DPAPI backup key from a domain controller using the LsaRetrievePrivateData API approach from Mimikatz (https://github.com/gentilkiwi/mimikatz/blob/2fd09bbef0754317cd97c01dbbf49698ae23d9d2/mimikatz/modules/kuhl_m_lsadump.c#L1882-L1927). This private key can then be used to decrypt master key blobs for any user on the domain. And even better, the key never changes ;) Domain admin (or equivalent) rights are needed to retrieve the key from a remote domain controller. The /nowrap flag will prevent wrapping the base64 key on display. This base64 key blob can be decoded to a binary .pvk file that can then be used with Mimikatz' dpapi::masterkey /in:MASTERKEY /pvk:backupkey.pvk module, or used in blob/file /pvk:X form with the masterkeys, credentials, or vault SharpDPAPI commands. By default, SharpDPAPI will try to determine the current domain controller via the DsGetDcName API call. A server can be specified with /server:COMPUTER.domain.com. If you want the key saved to disk instead of output as a base64 blob, use /file:key.pvk.
Compile Instructions
We are not planning on releasing binaries for SharpDPAPI, so you will have to compile yourself :) SharpDPAPI has been built against .NET 3.5 and is compatible with Visual Studio 2019 Community Edition (https://visualstudio.microsoft.com/vs/community/). Simply open up the project .sln, choose "Release", and build.
Targeting other .NET versions
SharpDPAPI's default build configuration is for .NET 3.5, which will fail on systems without that version installed. To target SharpDPAPI for .NET 4 or 4.5, open the .sln solution, go to Project -> SharpDPAPI Properties and change the "Target framework" to another version.
Sidenote: Running SharpDPAPI Through PowerShell
If you want to run SharpDPAPI in-memory through a PowerShell wrapper, first compile the SharpDPAPI and base64-encode the resulting assembly: [Convert]::ToBase64String([IO.File]::ReadAllBytes("C:\Temp\SharpDPAPI.exe")) | Out-File -Encoding ASCII C:\Temp\SharpDPAPI.txt
SharpDPAPI can then be loaded in a PowerShell script with the following (where "aa..." is replaced with the base64-encoded SharpDPAPI assembly string): $SharpDPAPIAssembly = [System.Reflection.Assembly]::Load([Convert]::FromBase64String("aa..."))
The Main() method and any arguments can then be invoked as follows: [SharpDPAPI.Program]::Main("machinemasterkeys")

Sidenote Sidenote: Running SharpDPAPI Over PSRemoting
Due to the way PSRemoting handles output, we need to redirect stdout to a string and return that instead. Luckily, SharpDPAPI has a function to help with that. If you follow the instructions in Sidenote: Running SharpDPAPI Through PowerShell (https://github.com/GhostPack/SharpDPAPI#sidenote-running-sharpdpapi-through-powershell) to create a SharpDPAPI.ps1, append something like the following to the script: [SharpDPAPI.Program]::MainString("machinemasterkeys")
You should then be able to run SharpDPAPI over PSRemoting with something like the following: $s = New-PSSession dc.theshire.local
Invoke-Command -Session $s -FilePath C:\Temp\SharpDPAPI.ps1
Alternatively, SharpDPAPI /consoleoutfile:C:\FILE.txt argument will redirect all output streams to the specified file.

Download SharpDPAPI (https://github.com/GhostPack/SharpDPAPI)

4 views🎭👨🏻‍💻Hacker's Hub👨🏻‍💻🎭, 21:36

Hacking Articles Tips Tricks Videos Tutorials

4 viewsFeed Reader Bot, 21:50

Hacking Articles Tips Tricks Videos Tutorials

Photo

Hacking on Medium
Why the US Was Defeated by Hackers

https://cdn-images-1.medium.com/max/1280/1*x6TU8MpviQWNuwqLPmmy4g.jpeg
The moment one of its own, a young American contractor, saw first lady Michelle Obama’s emails pop up on his phone, it was a sign the US…

Continue reading on Medium »

4 viewsFeed Reader Bot, 21:50

Hacking Articles Tips Tricks Videos Tutorials

4 viewsFeed Reader Bot, 21:50

Hacking Articles Tips Tricks Videos Tutorials

Photo

Hacking on Medium
Automate Web App Analysis With RapidScan

https://cdn-images-1.medium.com/max/2048/1*EuEHhaDDf-m4Ud9dU_KOug.jpeg
Without automation, conducting simplified tools analysis (running the security analysis tools one at a time) is very frustrating for a…

Continue reading on Medium »