-
Notifications
You must be signed in to change notification settings - Fork 388
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
SkelSec
committed
May 2, 2024
1 parent
c91dcdc
commit 91f9bdd
Showing
8 changed files
with
310 additions
and
15 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,5 +1,5 @@ | ||
|
|
||
| __version__ = "0.6.9" | ||
| __version__ = "0.6.10" | ||
| __banner__ = \ | ||
| """ | ||
| # pypyKatz %s | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Empty file.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,50 @@ | ||
| import pathlib | ||
| from typing import Iterator, List | ||
|
|
||
| from winacl.dtyp.wcee.cryptoapikey import CryptoAPIKeyFile, CryptoAPIKeyProperties | ||
|
|
||
| class CryptoKeysFinder: | ||
| def __init__(self): | ||
| self.startdir = ['ServiceProfiles','LocalService','AppData','Roaming','Microsoft','Crypto','Keys'] | ||
| self.entries:List[CryptoAPIKeyFile] = [] | ||
|
|
||
| def __iter__(self) -> Iterator[CryptoAPIKeyFile]: | ||
| return iter(self.entries) | ||
|
|
||
| @staticmethod | ||
| def from_windir(win_dir: str | pathlib.Path, raise_error: bool = True): | ||
| if isinstance(win_dir, str): | ||
| win_dir = pathlib.Path(win_dir).absolute() | ||
|
|
||
| if not win_dir.is_dir(): | ||
| if raise_error: | ||
| raise ValueError(f'{win_dir} is not a directory') | ||
| return CryptoKeysFinder() | ||
|
|
||
| cryptokeys_dir = win_dir | ||
| for directory in CryptoKeysFinder().startdir: | ||
| cryptokeys_dir = cryptokeys_dir / directory | ||
| if not cryptokeys_dir.is_dir(): | ||
| raise ValueError(f'{cryptokeys_dir} does not exist') | ||
|
|
||
| return CryptoKeysFinder.from_dir(cryptokeys_dir) | ||
|
|
||
| @staticmethod | ||
| def from_dir(cryptokeys_dir: str | pathlib.Path, raise_error: bool = True): | ||
| if isinstance(cryptokeys_dir, str): | ||
| cryptokeys_dir = pathlib.Path(cryptokeys_dir).absolute() | ||
| if not cryptokeys_dir.is_dir(): | ||
| if raise_error: | ||
| raise ValueError(f'{cryptokeys_dir} is not a directory') | ||
| return CryptoKeysFinder() | ||
|
|
||
| finder = CryptoKeysFinder() | ||
|
|
||
| for filepath in cryptokeys_dir.iterdir(): | ||
| if filepath.is_dir(): | ||
| continue | ||
|
|
||
| key = CryptoAPIKeyFile.from_bytes(filepath.read_bytes()) | ||
| finder.entries.append(key) | ||
|
|
||
| return finder |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,78 @@ | ||
| import pathlib | ||
| from typing import Iterator, List | ||
|
|
||
| class NGCProtector: | ||
| def __init__(self): | ||
| self.sid = None | ||
| self.path = None | ||
| self.provider = None | ||
| self.guid = None | ||
|
|
||
|
|
||
| class NGCProtectorFinder: | ||
| def __init__(self): | ||
| self.startdir = ['ServiceProfiles','LocalService','AppData','Local','Microsoft','Ngc'] | ||
| self.entries:List[NGCProtector] = [] | ||
|
|
||
| def __iter__(self) -> Iterator[NGCProtector]: | ||
| return iter(self.entries) | ||
|
|
||
| @staticmethod | ||
| def from_windir(win_dir: str | pathlib.Path, raise_error: bool = True): | ||
| if isinstance(win_dir, str): | ||
| win_dir = pathlib.Path(win_dir).absolute() | ||
|
|
||
| if not win_dir.is_dir(): | ||
| raise ValueError(f'{win_dir} is not a directory') | ||
|
|
||
| ngc_dir = win_dir | ||
| for directory in NGCProtectorFinder().startdir: | ||
| ngc_dir = ngc_dir / directory | ||
| if not ngc_dir.is_dir(): | ||
| raise ValueError(f'{ngc_dir} does not exist') | ||
|
|
||
| return NGCProtectorFinder.from_dir(ngc_dir, raise_error=raise_error) | ||
|
|
||
| @staticmethod | ||
| def from_dir(ngc_dir: str | pathlib.Path, raise_error: bool = True): | ||
| if isinstance(ngc_dir, str): | ||
| ngc_dir = pathlib.Path(ngc_dir).absolute() | ||
| if not ngc_dir.is_dir(): | ||
| if raise_error: | ||
| raise ValueError(f'{ngc_dir} is not a directory') | ||
| return NGCProtectorFinder() | ||
| finder = NGCProtectorFinder() | ||
|
|
||
| for directory in ngc_dir.iterdir(): | ||
| if not directory.is_dir(): | ||
| continue | ||
| if directory.name.startswith('{') and directory.name.endswith('}'): | ||
| sid_file_path = ngc_dir / directory / '1.dat' | ||
| fpd = ngc_dir / directory / 'Protectors' / '1' | ||
| if not sid_file_path.exists(): | ||
| print(f'NGC missing SID file at: {sid_file_path}') | ||
| continue | ||
|
|
||
| if not fpd.exists(): | ||
| print(f'NGC missing Protector directory at: {directory}') | ||
| continue | ||
|
|
||
| sid = sid_file_path.read_text('utf-16-le').strip('\x00') | ||
| pfp = fpd / '1.dat' | ||
| if not pfp.exists(): | ||
| print(f'NGC missing Protector file at: {pfp}') | ||
| continue | ||
|
|
||
| gfp = fpd / '2.dat' | ||
| if not gfp.exists(): | ||
| print(f'NGC missing GUID file at: {gfp}') | ||
| continue | ||
|
|
||
|
|
||
| protector = NGCProtector() | ||
| protector.sid = sid | ||
| protector.provider = pfp.read_text('utf-16-le').strip('\x00') | ||
| protector.guid = gfp.read_text('utf-16-le').strip('\x00') | ||
| protector.path = fpd | ||
| finder.entries.append(protector) | ||
| return finder |
Oops, something went wrong.