tijldeneut / dpapick3 Goto Github PK

Probably I'm doing something wrong but if I try

mkp = masterkey.MasterKeyPool()
mkp.loadDirectory(masterkey_location)
mkp.addCredhistFile(sid,os.path.join(add_path,"Protect", "CREDHIST"))
#print(mkp.creds[sid])
mkp.try_credential(sid,password)

Traceback (most recent call last):
  File "/root/temp/master.py", line 26, in <module>
    mkp.try_credential(sid,password)
  File "/usr/local/lib/python3.10/dist-packages/dpapick3/masterkey.py", line 508, in try_credential
    self.creds[userSID].decryptWithPassword(password)                                                                                                                                       
  File "/usr/local/lib/python3.10/dist-packages/dpapick3/credhist.py", line 244, in decryptWithPassword
    return self.decryptWithHash(hashlib.sha1(pwd.encode("UTF-16LE")).digest())
  File "/usr/local/lib/python3.10/dist-packages/dpapick3/credhist.py", line 235, in decryptWithHash
    entry.decryptWithHash(curhash)
  File "/usr/local/lib/python3.10/dist-packages/dpapick3/credhist.py", line 148, in decryptWithHash
    self.decryptWithKey(crypto.derivePwdHash(pwdhash, str(self.userSID)))
  File "/usr/local/lib/python3.10/dist-packages/dpapick3/crypto.py", line 312, in derivePwdHash
    return hmac.new(pwdhash, (userSID + "\0").encode("UTF-16LE"), digestmod=getDigestmod(digest)).digest()
  File "/usr/lib/python3.10/hmac.py", line 184, in new
    return HMAC(key, msg, digestmod)
  File "/usr/lib/python3.10/hmac.py", line 53, in __init__
    raise TypeError("key: expected bytes or bytearray, but got %r" % type(key).__name__)
TypeError: key: expected bytes or bytearray, but got 'NoneType'

I can see that the credhist file is loaded if I remove the # on the print(mkp.creds[sid]) line, but I'm stuck on this

dpapick3 0.4.0

Hi,
thanks for your great work here first of all.
I am trying to decrypt credentials on a system where DPAPI is used with TBAL and a Microsoft account.
As written by PassScape for example (and also outputted by the diana-regdecrypt script), the 96 bytes from the LSA secret M$_CLOUDAP_TBAL_{4416F0BD-3A59-4590-9579-DA6E08AF19B3_ should be able to decrypt the masterkeys.
However, I did not manage to decrypt them with the try_credential_hash function, which I though should be the right place.
Is there something I am doing wrong?
Best wishes

Hi, I am trying to automate the decryption of Chrome web logins using the dpapick3 library and following the example of the browserdec from dpapilab-ng.

I extract the user hashes using samdump2 and I put the resulting ntlm hash in the try_credential_hash but it's not decrypting. I have also added the CREDHIST using the addCredhistFile but I still don't get any decrypted keys.

I've seen that inside the try_credential hash I still don't get any entries in self.creds[userSID].entries_list

self.creds[userSID].decryptWithHash(pwdhash)
for cred in self.creds[userSID].entries_list:
      mk.decryptWithHash(userSID, cred.pwdhash)
      if cred.ntlm is not None and not mk.decrypted:
           mk.decryptWithHash(userSID, cred.ntlm)
      if mk.decrypted:
           self.creds[userSID].validate()
           break

I've also tried running the browserdec.py script with the following arguments:
python3 browserdec.py -t "paht to local state" --loginfile "path to login data" --mkfile "path to mk file" -a "ntlm user hash" -s "user SID" -v and I don't get any results, however, if i replace the hash option with the user password I am able to decrypt the web data.

I know that in the browserdec script it is mentioned that it expects a sha-1 hash of the user password, but in the try_credential_hash function it seems to support ntlm as well. Am I missing something? Shouldn't the decryption be possible using NTLM user hashes as well? If not do you know any other ways that I can obtain sha-1 hashes instead of ntlm from a forensic offine windows copy?

Test files are available upon request.

Hi,

I'm trying to use your example filegeneric.py.

I have correctly extracted the private domain key using DSInternals command, it generates pvk file.

I have the Master key and the SID, but when I launch the command

python3 ~/filegeneric.py --sid S-1-5-21-xxx-xxx-xxx-500 --masterkey AppData/Roaming/Microsoft/Protect/S-1-5-21-xxx-xxx-xxx-500 --pkey ntds_capi_xxx-xxx-xxx-xxx-xxx.pvk --debug

I'm facing this error

Traceback (most recent call last):
  File "/xxx/lib/python3.10/site-packages/dpapick3/masterkey.py", line 536, in try_domain
    try: mk.domainkey.decryptWithDCKey(privkeyfile)
AttributeError: 'NoneType' object has no attribute 'decryptWithDCKey'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/xxx/filegeneric.py", line 80, in <module>
    decrn = mkp.try_domain(options.pkey)
  File "/xxx/python3.10/site-packages/dpapick3/masterkey.py", line 537, in try_domain
    except: mk.domainkey.decryptWithPVKKey(privkeyfile)
AttributeError: 'NoneType' object has no attribute 'decryptWithPVKKey'

First I've tried using dpapiclab-ng, which uses your lib, but same error.
The I tried directly yours to be sure that the identify problem source.

Do you know where it could comes ?