-
Notifications
You must be signed in to change notification settings - Fork 122
Expand file tree
/
Copy pathSharpDPAPI.cs
More file actions
87 lines (83 loc) · 3.65 KB
/
Copy pathSharpDPAPI.cs
File metadata and controls
87 lines (83 loc) · 3.65 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
using System;
using System.Collections.Generic;
using System.IO;
using System.Text;
namespace SharpDPAPI
{
public class SharpDPAPI
{
public static void ParseDpapi(StringBuilder sb, List<byte[]> Dpapikeys, List<byte[]> machineMasterKeys, List<byte[]> userMasterKeys, string credDirs = null, string vaultDirs = null, string certDirs = null)
{
sb.AppendLine(" [*] SYSTEM master key cache");
Dictionary<string, string> mappings = DecryptSystemMasterKeys(sb, Dpapikeys, machineMasterKeys, userMasterKeys);
foreach (KeyValuePair<string, string> kvp in mappings)
{
sb.AppendLine(String.Format("{0}:{1}", kvp.Key, kvp.Value));
}
var originalConsoleOut = Console.Out;
using (var writer = new StringWriter())
{
Console.SetOut(writer);
Console.WriteLine(" [*] Dpapi cred blobs");
var credFiles = Directory.EnumerateFiles(credDirs, "*.*", SearchOption.AllDirectories);
if (credDirs != null && credFiles.GetEnumerator().MoveNext())
{
Triage.TriageCredFolder(credDirs, mappings);
}
var vaultFiles = Directory.EnumerateFiles(vaultDirs, "*.*", SearchOption.AllDirectories);
if (vaultDirs != null && vaultFiles.GetEnumerator().MoveNext())
{
foreach (var dir in Directory.GetDirectories(vaultDirs))
{
Triage.TriageVaultFolder(dir, mappings);
}
}
var certFiles = Directory.EnumerateFiles(certDirs, "*.*", SearchOption.AllDirectories);
if (certDirs != null && certFiles.GetEnumerator().MoveNext())
{
Triage.TriageCertFolder(certDirs, mappings);
}
writer.Flush();
sb.AppendLine(writer.GetStringBuilder().ToString());
}
Console.SetOut(originalConsoleOut);
}
private static Dictionary<string, string> DecryptSystemMasterKeys(StringBuilder sb, List<byte[]> Dpapikeys, List<byte[]> machineMasterKeys = null, List<byte[]> userMasterKeys = null)
{
var mappings = new Dictionary<string, string>();
if (machineMasterKeys != null)
{
foreach (byte[] masteyKeyBytes in machineMasterKeys)
{
try
{
// use the "machine" DPAPI key
var plaintextMasterkey = Dpapi.DecryptMasterKeyWithSha(masteyKeyBytes, Dpapikeys[0]);
mappings.Add(plaintextMasterkey.Key, plaintextMasterkey.Value);
}
catch (Exception e)
{
sb.AppendLine(String.Format("[-] Error triaging {0} ", e.Message));
}
}
}
if (userMasterKeys != null)
{
foreach (byte[] masteyKeyBytes in userMasterKeys)
{
try
{
// use the "user" DPAPI key
var plaintextMasterKey = Dpapi.DecryptMasterKeyWithSha(masteyKeyBytes, Dpapikeys[1]);
mappings.Add(plaintextMasterKey.Key, plaintextMasterKey.Value);
}
catch (Exception e)
{
sb.AppendLine(String.Format("[-] Error triaging {0} ", e.Message));
}
}
}
return mappings;
}
}
}