o j - @sddlZddlZddlZddlZddlmZddlmZddlm Z ddl m Z ddl m Z mZmZddlmZddlmZmZGd d d Zed krejjdur[ed eje_eejejd ddZejddddejddddejddddejddddejddddejddddd ejd!dd"dd ejd#dd$dd ejd%dd&ded'ejd(dd)de d*Z!e!jd+dd,de d-Z!e!jd.dd/d0d1e!jd2dd3de!jd4dd5de!jd6dd7d8d1e!jd9dd:de d;Z!e!jdd1e!jd?dd=d@d1e"ej#dAkr e$e%dAe&Z'e(e'j)e'j*e e'j+\Z,Z-Z.Z/e'j0dur>e/e'_0e,durEdBZ,e'j1durWe2e'j1e-e,e'd e'_3e.dBkr}e-dBkr}e'j4dur}e'j5dur}e'j6dur}ddCl7m7Z7e7dDZ.e'j6durd e'_3ee/e-e.e,e'Z8ze89WdSe:yZ;ze<j=ej>krddl?Z?e?@eAe;WYdZ;[;dSdZ;[;wwdS)EN)version)logger) parse_target) SMBConnection) LSASecretsRemoteOperations SAMHashes)Keytab) unhexlifyhexlifyc@s.eZdZd ddZddZddZd d ZdS) DumpSecretsNcCs||_|j|_||_||_||_d|_d|_|j|_ |j |_ d|_ d|_ d|_d|_|j|_|j|_|j|_|j|_|j|_|j|_|j|_|j|_|j dur[|j !d\|_|_dSdS)Nr :)"_DumpSecrets__remoteName target_ip_DumpSecrets__remoteHost_DumpSecrets__username_DumpSecrets__password_DumpSecrets__domain_DumpSecrets__lmhash_DumpSecrets__nthash outputfile_DumpSecrets__outputFileNameaesKey_DumpSecrets__aesKey_DumpSecrets__smbConnection_DumpSecrets__remoteOps_DumpSecrets__SAMHashes_DumpSecrets__LSASecretsbootkey_DumpSecrets__bootkeyk_DumpSecrets__doKerberoshistory_DumpSecrets__historydc_ip_DumpSecrets__kdcHostnosam_DumpSecrets__nosamnocache_DumpSecrets__nocachenolsa_DumpSecrets__nolsathrottle_DumpSecrets__throttlehashessplit)self remoteNameusernamepassworddomainoptionsr7/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/../../../bin/regsecrets.py__init__Cs0 zDumpSecrets.__init__c Csbt|j|j|_|jr |j|j|j|j|j |j |j |j dS|j |j|j|j|j |j dS)N)rrrrr" kerberosLoginrrrrrrr&loginr1r7r7r8connect]s  "zDumpSecrets.connectc Csz;d}z|t|j|j|j|_|jWnty4}zt dt |WYd}~nd}~ww|j s[z|j }Wn:tyZ}zt dt |WYd}~n$d}~ww|j dri|j dd|_ t|j }tdt|d|durtd|jszt||j|j|jd|_|j|jdur|j|jWn+ty}ztjtjkrddl}|t d t |WYd}~nd}~wwz8t||j|j|jd |_ |j!s|j "|jdur|j #|j|j$s|j %|jdur|j &|jWn-ty5}z tjtjkr"ddl}|t d t |WYd}~nd}~ww|'WdStt(fy}z4tjtjkrXddl}|t |z|'Wntd YWYd}~dSWYd}~dSd}~ww) NzRemoteOperations failed: %s0xzTarget system bootKey: 0x%szutf-8zFailed to fetch bootKey) remoteOpsr#r-rz SAM hashes extraction failed: %s)r#r-z LSA hashes extraction failed: %szFailed to perform cleanup...))r=rrr"r&renableRegistry Exceptionloggingerrorstrr getBootKey startswithr infor decoder(rr$r.rdumprexport getLoggerlevelDEBUG traceback print_excrrr*dumpCachedHashes exportCachedr, dumpSecrets exportSecretscleanupKeyboardInterrupt)r1bootKeyerOr7r7r8rJes           zDumpSecrets.dumpcCs(td|jr |j|jdS)NzCleaning up... )rCrHrfinishrlogoffr<r7r7r8rUs  zDumpSecrets.cleanup)r r r N)__name__ __module__ __qualname__r9r=rJrUr7r7r7r8r Bs   @r __main__utf8TzfPerforms various techniques to dump secrets from the remote machine without executing any agent there.)add_help descriptiontargetstorez6[[domain/]username[:password]@])actionhelpz-ts store_truez&Adds timestamp to every logging outputz-debugzTurn DEBUG output ONz-systemzSYSTEM hive to parsez-bootkeyzbootkey for SYSTEM hivez-nosamzDo not retrieve SAM informationF)rdredefaultz-nocachez#Do not retrieve MSCache informationz-nolsazDo not retrieve LSASecretsz -throttlez&Throttle in seconds between operations)rdrergtypez -outputfilezJbase output filename. Extensions will be added for sam, secrets and cachedzdisplay optionsz-historyzCDump password history (NTDS and SAM hashes), and LSA secrets OldValauthenticationz-hashesz LMHASH:NTHASHz$NTLM hashes, format is LMHASH:NTHASH)rdmetavarrez-no-passz&don't ask for password (useful for -k)z-kzUse Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use the ones specified in the command linez-aesKeyzhex keyzs3      j          8