nitinsukhija20 / creddump Goto Github PK
View Code? Open in Web Editor NEWThis project forked from moyix/creddump
Automatically exported from code.google.com/p/creddump
License: GNU General Public License v3.0
This project forked from moyix/creddump
Automatically exported from code.google.com/p/creddump
License: GNU General Public License v3.0
OVERVIEW creddump is a python tool to extract various credentials and secrets from Windows registry hives. It currently extracts: * LM and NT hashes (SYSKEY protected) * Cached domain passwords * LSA secrets It essentially performs all the functions that bkhive/samdump2, cachedump, and lsadump2 do, but in a platform-independent way. It is also the first tool that does all of these things in an offline way (actually, Cain & Abel does, but is not open source and is only available on Windows). REQUIREMENTS alldump has only been tested on python 2.5. It should work on 2.4 as well, but will likely need modification before it will work on 2.3 or below. python-crypto is required for its MD5/DES/RC4 support. To obtain it, see: http://www.amk.ca/python/code/crypto For lsadump: system and SECURITY hives For cachedump: system and SECURITY hives For pwdump: system and SAM hives USAGE Dump cached domain hashes: usage: ./cachedump.py <system hive> <security hive> Dump LSA secrets: usage: ./lsadump.py <system hive> <security hive> Dump local password hashes: usage: ./pwdump.py <system hive> <SAM hive> FEATURES * Platform independent operation. The only inputs are the hive files from the system--we don't rely on any Windows functionality at all. * Open-source and (hopefully!) readble implementations of Windows obfuscation algorithms used to protect LSA secrets, cached domain passwords, and * A reasonably forgiving registry file parser in pure Python. Look through framework/types.py and framework/win32/rawreg.py to see how it works. * The first complete open-source implementation of advapi32's SystemFunction005. The version in the Wine source code does not appear to allow for keys longer than 7 bytes, while the Windows version (and this version) does. See decrypt_secret() in framework/win32/lsasecrets.py AUTHOR creddump is written by Brendan Dolan-Gavitt ([email protected]). For more information on Syskey, LSA secrets, cached domain credentials, and lots of information on volatile memory forensics and reverse engineering, check out: http://moyix.blogspot.com/ CREDITS * AAron Walters. Much of the data type parsing code is taken from Volatility, an excellent memory analysis framework written in Python. He's also a really nice guy, and has helped me out a lot in my research. https://www.volatilesystems.com/default/volatility * Massimiliano Montoro (mao), for reversing the mechanism Windows uses to derive the LSA key so that it can be computed directly from the hive files, as decribed in this post: http://oxid.netsons.org/phpBB2/viewtopic.php?t=149 http://www.oxid.it/ * Jeremy Allison, for the details of the obfuscation applied to password hashes in the SAM, as implemented in the original pwdump. http://us4.samba.org/samba/ftp/pwdump/ * Nicola Cuomo, for his excellent description of the syskey mechanism and how it is used to encrypt the SAM in Windows 2000 and above. http://www.studenti.unina.it/~ncuomo/syskey/ * Eyas[at]xfocus.org, for x_dialupass2.cpp, which demonstrates how to read LSA secrets directly from the registry, given the LSA key. http://www.xfocus.net/articles/200411/749.html [Note: the above is in Chinese, but quite comprehensible if you use Google Translate and can read C ;)] * Nicholas Ruff, for his perl implementation of des_set_odd_parity, which he apparently took from SSLEAY: http://seclists.org/pen-test/2005/Jan/0180.html * Arnaud Pilon, for the details of how to retrieve cached domain, as implemented in cachedump. http://www.securiteam.com/tools/5JP0I2KFPA.html * S�bastien Ke, for his cute hexdump recipe: http://aspn.activestate.com/ASPN/Cookbook/Python/Recipe/142812 LICENSE This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see <http://www.gnu.org/licenses/>.
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.