processust / hekatomb

Hekatomb is a python script that connects to LDAP directory to retrieve all computers and users informations. Then it will download all DPAPI blob of all users from all computers and uses Domain backup keys to decrypt them.

The HEKATOMB project

Because Domain Admin rights are not enough.
Hack them all.
🐍

Hekatomb is a python script that connects to LDAP directory to retrieve all computers and users informations.
Then it will download all DPAPI blob of all users from all computers.
Finally, it will extract domain controller private key through RPC uses it to decrypt all credentials.

Changelog

On last version (V 1.5) :
- Fix local packages importation error with pip installation
- Prevent crash when no computers are reachable

V 1.4 :
- Fix LDAP search limitation to 1000 items
- Add LDAP filter for computers to select only "Enabled" computers
- Add function to scan SMB port with multi thread prior to get blob and master key files
- Add a progress bar for files collection
- Added 2 function modules to simplify code readability and maintainability

V 1.3 :
- Compare LDAP usernames with SMB users folders before trying to retrieve blob files to get them faster
- DNSTCP option is no more used, DNS resolution is trying on UDP first and with TCP if it fails

V 1.2.1 :
- Use of the ldap3 library instead of Impacket for LDAP requests
- Fix a bug that prevented querying trusted domains via an external domain account with administrator rights on the trusted domain controller
- Add -smb2 parameter to force the use of SMBv2 protocol when it is available
- LDAP and SMB communications are now more difficult to detect on the network

V 1.2.1 :
- Add installation with Pypi

V 1.2 :
- Increase the LDAP results limit of users or computers extraction (1000 previously)
- Add the possibility to specify a user or a computer to target
- Add the possibility to export results to a CSV file

V 1.1 :
- Domain controller private key extraction through RPC
- Credentials classification by computers and by users

What da fuck is this ?

On Windows, credentials saved in the Windows Credentials Manager are encrypted using Microsoft's Data Protection API and stored as "blob" files in user AppData folder.
Outside of a domain, the user's password hash is used to encrypt these "blobs".
When you are in an Active Directory environment, the Data Protection API uses the domain controller's public key to encrypt these blobs.
With the extracted private key of the domain controller, it is possible to decrypt all the blobs, and therefore to recover all the secrets recorded in the Windows identification manager of all the workstations in the domain.

Hekatomb automates the search for blobs and the decryption to recover all domain users' secrets ☠️

Installation

From Pypi for Debian-based :

pip3 install hekatomb

From BlackArch :

pacman -S hekatomb

From github :

git clone https://github.com/ProcessusT/HEKATOMB
cd HEKATOMB
poetry install
poetry run hekatomb

Usage

Hekatomb uses Impacket syntax :

usage: hekatomb [-h] [-hashes LMHASH:NTHASH] [-pvk PVK] [-dns DNS] [-dnstcp] [-port [port]] [-just-user JUST_USER] [-just-computer JUST_COMPUTER] [-md5] [-debug] [-debugmax] target

Script used to automate domain computers and users extraction from LDAP and extraction of domain controller private key through RPC to collect and decrypt all users' DPAPI secrets saved in Windows credential manager.

positional arguments:
  target                [[domain/]username[:password]@]<targetName or address of DC>

options:
  -h, --help            Show this help message and exit

authentication:
  -hashes LMHASH:NTHASH     NTLM hashes, format is LMHASH:NTHASH

authentication:
  -pvk PVK                  Domain backup keys file
  -dns DNS                  DNS server IP address to resolve computers hostname
  -port [port]              Port to connect to SMB Server
  -smb2                     Force the use of SMBv2 protocol
  -just-user [USERNAME]     Test only specified username
  -just-computer [COMPUTER] Test only specified computer
  -md5                      Print md5 hash insted of clear passwords

verbosity:
  -debug                Turn DEBUG output ON
  -debugmax             Turn DEBUG output TO MAAAAXXXX

Example

hekatomb -hashes :ed0052e5a66b1c8e942cc9481a50d56 DOMAIN.local/administrator@10.0.0.1 -debug 

How to retrieve domain backup keys ?

If no domain backup keys are provided, the script will retrieve it through RPC

hekatomb's Issues

ModuleNotFoundError: No module named 'src'

Traceback (most recent call last):
File "/usr/bin/hekatomb", line 33, in
sys.exit(load_entry_point('hekatomb==1.5', 'console_scripts', 'hekatomb')())
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/bin/hekatomb", line 25, in importlib_load_entry_point
return next(matches).load()
^^^^^^^^^^^^^^^^^^^^
when i run it it give me error like

File "/usr/lib/python3.11/importlib/metadata/init.py", line 202, in load
module = import_module(match.group('module'))
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib/python3.11/importlib/init.py", line 126, in import_module
return _bootstrap._gcd_import(name[level:], package, level)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "", line 1206, in _gcd_import
File "", line 1178, in _find_and_load
File "", line 1128, in _find_and_load_unlocked
File "", line 241, in _call_with_frames_removed
File "", line 1206, in _gcd_import
File "", line 1178, in _find_and_load
File "", line 1142, in _find_and_load_unlocked
ModuleNotFoundError: No module named 'src'

when i installed it it give me

    ********************************************************************************
    Usage of dash-separated 'description-file' will not be supported in future
    versions. Please use the underscore name 'description_file' instead.

    By 2023-Sep-26, you need to update your project and remove deprecated calls
    or your builds will no longer be supported.

    See https://setuptools.pypa.io/en/latest/userguide/declarative_config.html for details.
    ********************************************************************************

Coucou !

Je t'emprunte ton repo pour mon exam de SecOff.
J'espère que tu m'en voudra pas :p

Pour les autres le mdp que vous cherchez est le suivant : Thisisanotherstrongpassword

Keur sur toi Proc <3

Error : Could not extract users from ldap

Bonjour Proc,

ci-dessous un retour et une limite de ton outil.
Dans un domaine avec des milliers d'utilisateurs, on obtient le message d'erreur suivant :

Testing admin rights...
Admin access granted.
Testing LDAP connection...
LDAP connection successfull without encryption.
Retrieving user objects in LDAP directory...
Error : Could not extract users from ldap.
impacket.ldap.ldap.LDAPSearchError: Error in searchRequest -> sizeLimitExceeded:
Retrieving computer objects in LDAP directory...
Error : Could not extract computers from ldap.
OSError: [Errno 9] Bad file descriptor
Creating structure folders to store blob and mkf...
Connnecting to all computers to test user creds existence...
No MKF have been decrypted.
Blobs will not be decrypted.

Error after initial install

OS: Latest Kali

finds ports open with debugmax option, shows successful connection, lists numbers of computers and errors out with:

TypeError: '<' not supported between instances of 'list' and 'int'

[bug] Invalid error message when target is not on the network

I think there should be a specific message for when the target is not reachable, different from an "invalid credentials" message

Not work

From Kali in workgroup
Testing admin rights...
Admin access granted.
Testing LDAP connection...
Error : Could not connect to ldap with SSL encryption. Trying without SSL encryption...
LDAP connection successfull without encryption.
[+] Retrieving user objects in LDAP directory...
Converting ObjectSID in string SID...
Found about 348 users in LDAP directory.
[+] Retrieving computer objects in LDAP directory...
Found about 121 computers in LDAP directory.
[+] Creating structure folders to store blob and mkf...
[+] Scanning computers list on SMB port ...
It seems that 0 computers are online ...
[+] Connnecting to all computers and try to get dpapi blobs and masteles ...
ZeroDivisionError: float division by zero

Tag the source

Could you please tag the source? This allows distributions to get the complete source from GitHub if they want.

Makes it also easier to track changes.

Thanks

No module named ad_ldap