tijldeneut / dpapick3 Goto Github PK
View Code? Open in Web Editor NEWLicense: GNU General Public License v3.0
License: GNU General Public License v3.0
Probably I'm doing something wrong but if I try
mkp = masterkey.MasterKeyPool()
mkp.loadDirectory(masterkey_location)
mkp.addCredhistFile(sid,os.path.join(add_path,"Protect", "CREDHIST"))
#print(mkp.creds[sid])
mkp.try_credential(sid,password)
Traceback (most recent call last):
File "/root/temp/master.py", line 26, in <module>
mkp.try_credential(sid,password)
File "/usr/local/lib/python3.10/dist-packages/dpapick3/masterkey.py", line 508, in try_credential
self.creds[userSID].decryptWithPassword(password)
File "/usr/local/lib/python3.10/dist-packages/dpapick3/credhist.py", line 244, in decryptWithPassword
return self.decryptWithHash(hashlib.sha1(pwd.encode("UTF-16LE")).digest())
File "/usr/local/lib/python3.10/dist-packages/dpapick3/credhist.py", line 235, in decryptWithHash
entry.decryptWithHash(curhash)
File "/usr/local/lib/python3.10/dist-packages/dpapick3/credhist.py", line 148, in decryptWithHash
self.decryptWithKey(crypto.derivePwdHash(pwdhash, str(self.userSID)))
File "/usr/local/lib/python3.10/dist-packages/dpapick3/crypto.py", line 312, in derivePwdHash
return hmac.new(pwdhash, (userSID + "\0").encode("UTF-16LE"), digestmod=getDigestmod(digest)).digest()
File "/usr/lib/python3.10/hmac.py", line 184, in new
return HMAC(key, msg, digestmod)
File "/usr/lib/python3.10/hmac.py", line 53, in __init__
raise TypeError("key: expected bytes or bytearray, but got %r" % type(key).__name__)
TypeError: key: expected bytes or bytearray, but got 'NoneType'
I can see that the credhist file is loaded if I remove the # on the print(mkp.creds[sid]) line, but I'm stuck on this
dpapick3 0.4.0
Hi,
thanks for your great work here first of all.
I am trying to decrypt credentials on a system where DPAPI is used with TBAL and a Microsoft account.
As written by PassScape for example (and also outputted by the diana-regdecrypt script), the 96 bytes from the LSA secret M$_CLOUDAP_TBAL_{4416F0BD-3A59-4590-9579-DA6E08AF19B3_
should be able to decrypt the masterkeys.
However, I did not manage to decrypt them with the try_credential_hash function, which I though should be the right place.
Is there something I am doing wrong?
Best wishes
Hi, I am trying to automate the decryption of Chrome web logins using the dpapick3 library and following the example of the browserdec from dpapilab-ng.
I extract the user hashes using samdump2 and I put the resulting ntlm hash in the try_credential_hash but it's not decrypting. I have also added the CREDHIST using the addCredhistFile but I still don't get any decrypted keys.
I've seen that inside the try_credential hash I still don't get any entries in self.creds[userSID].entries_list
self.creds[userSID].decryptWithHash(pwdhash)
for cred in self.creds[userSID].entries_list:
mk.decryptWithHash(userSID, cred.pwdhash)
if cred.ntlm is not None and not mk.decrypted:
mk.decryptWithHash(userSID, cred.ntlm)
if mk.decrypted:
self.creds[userSID].validate()
break
I've also tried running the browserdec.py script with the following arguments:
python3 browserdec.py -t "paht to local state" --loginfile "path to login data" --mkfile "path to mk file" -a "ntlm user hash" -s "user SID" -v
and I don't get any results, however, if i replace the hash option with the user password I am able to decrypt the web data.
I know that in the browserdec script it is mentioned that it expects a sha-1 hash of the user password, but in the try_credential_hash function it seems to support ntlm as well. Am I missing something? Shouldn't the decryption be possible using NTLM user hashes as well? If not do you know any other ways that I can obtain sha-1 hashes instead of ntlm from a forensic offine windows copy?
Test files are available upon request.
Hi,
I'm trying to use your example filegeneric.py.
I have correctly extracted the private domain key using DSInternals command, it generates pvk
file.
I have the Master key and the SID, but when I launch the command
python3 ~/filegeneric.py --sid S-1-5-21-xxx-xxx-xxx-500 --masterkey AppData/Roaming/Microsoft/Protect/S-1-5-21-xxx-xxx-xxx-500 --pkey ntds_capi_xxx-xxx-xxx-xxx-xxx.pvk --debug
I'm facing this error
Traceback (most recent call last):
File "/xxx/lib/python3.10/site-packages/dpapick3/masterkey.py", line 536, in try_domain
try: mk.domainkey.decryptWithDCKey(privkeyfile)
AttributeError: 'NoneType' object has no attribute 'decryptWithDCKey'
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "/xxx/filegeneric.py", line 80, in <module>
decrn = mkp.try_domain(options.pkey)
File "/xxx/python3.10/site-packages/dpapick3/masterkey.py", line 537, in try_domain
except: mk.domainkey.decryptWithPVKKey(privkeyfile)
AttributeError: 'NoneType' object has no attribute 'decryptWithPVKKey'
First I've tried using dpapiclab-ng, which uses your lib, but same error.
The I tried directly yours to be sure that the identify problem source.
Do you know where it could comes ?
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.