FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

Version 1.11.1 · MSKNET/SharpDPAPI@a81031f · GitHub

/ SharpDPAPI Public
forked from GhostPack/SharpDPAPI

Commit a81031f

Browse files
HarmJ0y
committed
Version 1.11.1
-Default elevated SharpChrome triage behavior is to triage the current user unless additional masterkey material is supplied -/target:X can now be a user folder -Bug fixes
1 parent 8730c3d commit a81031f

10 files changed

Lines changed: 314 additions & 554 deletions

File tree

‎CHANGELOG.md‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,21 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
55
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
66

77

8+
## [1.11.1] - 2021-03-05
9+
10+
### Fixed
11+
* **SharpChrome** project
12+
* Chrome statekey usage bug when triaging multiple users
13+
14+
### Changed
15+
* **SharpChrome** project
16+
* Default cookie/logins/statekeys triage behavior is now to triage the current user if elevated, unless pvk/password/masterkeys specified
17+
* `/target:X` can now be a `C:\Users\USER\` folder for any specified triage
18+
* Added Brave statekey triage to `statekeys`
19+
* Cleaned up Chromium triage code
20+
* Removed out of date SharpDPAPI.cna aggressor script
21+
22+
823
## [1.11.0] - 2021-03-01
924

1025
### Added

‎README.md‎

Lines changed: 3 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,6 @@ SharpDPAPI is licensed under the BSD 3-Clause license.
2929
- [Operational Usage](#operational-usage)
3030
- [SharpDPAPI](#sharpdpapi-1)
3131
- [SharpChrome](#sharpchrome)
32-
- [Cobalt Strike Usage](#cobalt-strike-usage)
3332
- [SharpDPAPI Commands](#sharpdpapi-commands)
3433
- [User Triage](#user-triage)
3534
- [masterkeys](#masterkeys)
@@ -164,6 +163,7 @@ SharpDPAPI is licensed under the BSD 3-Clause license.
164163

165164
Targeting:
166165
/target:FILE - triage a specific 'Cookies', 'Login Data', or 'Local State' file location
166+
/target:C:\Users\X\ - triage a specific user folder for any specified command
167167
/server:SERVER - triage a remote server, assuming admin access (note: must use with /pvk:KEY)
168168
/browser:X - triage 'chrome' (the default) or (chromium-based) 'edge'
169169

@@ -205,21 +205,14 @@ SharpChrome is a Chrome-specific implementation of SharpDPAPI capable of **cooki
205205

206206
Since Chrome Cookies/Login Data are saved without CRYPTPROTECT_SYSTEM, CryptUnprotectData() is back on the table. If SharpChrome is run from an unelevated contect, it will attempt to decrypt any logins/cookies for the current user using CryptUnprotectData(). A `/pvk:[BASE64|file.pvk]`, {GUID}:SHA1 lookup table, `/password:X`, or `/mkfile:FILE` of {GUID}:SHA1 values can also be used to decrypt values. Also, the [C# SQL library](https://github.com/akveo/digitsquare/tree/a251a1220ef6212d1bed8c720368435ee1bfdfc2/plugins/com.brodysoft.sqlitePlugin/src/wp) used (with a few modifications) supports [lockless opening](https://github.com/gentilkiwi/mimikatz/pull/199), meaning that Chrome does not have to be closed/target files do not have to be copied to another location.
207207

208-
If Chrome is version 80+, an AES state key is stored in *AppData\Local\Google\Chrome\User Data\Local State* - this key is protected with DPAPI, so we can use CryptUnprotectData()/pvk/masterkey lookup tables to decrypt it. This AES key is then used to protect new cookie and login data entries. This is also the process when `/browser:edge` is specified, for newer Chromium-based Edge browser triage.
208+
If Chrome is version 80+, an AES state key is stored in *AppData\Local\Google\Chrome\User Data\Local State* - this key is protected with DPAPI, so we can use CryptUnprotectData()/pvk/masterkey lookup tables to decrypt it. This AES key is then used to protect new cookie and login data entries. This is also the process when `/browser:edge` or `/browser:brave` is specified, for newer Chromium-based Edge browser triage.
209209

210210
By default, cookies and logins are displayed as a csv - this can be changed with `/format:table` for table output, and `/format:json` for cookies specifically. The json option outputs cookies in a json format that can be imported into the [EditThisCookie](https://chrome.google.com/webstore/detail/editthiscookie/fngmhnnpilhplaeedifhccceomclgfbg?hl=en) Chrome extension for easy reuse.
211211

212212
The **cookies** command also has `/cookie:REGEX` and `/url:REGEX` arguments to only return cookie names or urls matching the supplied regex. This is useful with `/format:json` to easily clone access to specific sites.
213213

214-
### Cobalt Strike Usage
214+
Specific cookies/logins/statekey files can be specified with `/target:X`, and a user folder can be specified with `/target:C:\Users\USER\` for any triage command.
215215

216-
SharpDPAPI has an Aggressor script (**SharpDPAPI.cna**) that automates the usage of SharpDPAPI through Cobalt Strike. Before usage, replace `$SharpDPAPI::AssemblyPath` in the .cna with the location of your compiled SharpDPAPI assembly.
217-
218-
Loading **SharpDPAPI.cna** will register a new **sharpDPAPI** Beacon command. If **beacon> sharpDPAPI -dump** is run, the current Beacon will execute `sekurlsa::dpapi` Mimikatz command to extract any DPAPI keys from LSASS (assuming elevation) followed by `dpapi::cache` to display the {GUID}:SHA1 mappings. The decrypted master key SHA1s are stored in the credential store.
219-
220-
Running **beacon> sharpDPAPI** will execute SharpDPAPI with the `triage` command with any GUID:SHA1 masterkey mappings extracted for that host. This allows for effective triage of all Credentials and Vaults on a host _for any currently logged in users_.
221-
222-
_TODO: implement machine key triage functions in SharpDPAPI.cna_
223216

224217
## SharpDPAPI Commands
225218

‎SharpChrome/Commands/Cookies.cs‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -150,24 +150,26 @@ public void Execute(Dictionary<string, string> arguments)
150150
{
151151
Console.WriteLine("[*] Target 'Cookies' File: {0}\r\n", target);
152152
}
153-
154153
Chrome.ParseChromeCookies(masterkeys, target, displayFormat, showAll, unprotect, cookieRegex, urlRegex, setneverexpire, stateKeyBytes, quiet);
155154
}
155+
else if (Directory.Exists(target) && target.ToLower().Contains("users"))
156+
{
157+
Chrome.TriageChromeCookies(masterkeys, server, target, displayFormat, showAll, unprotect, cookieRegex, urlRegex, setneverexpire, stateKey, browser, quiet);
158+
}
156159
else
157160
{
158-
Console.WriteLine("\r\n[X] '{0}' is not a valid file.", target);
161+
Console.WriteLine("\r\n[X] '{0}' is not a valid file or user directory.", target);
159162
}
160163
}
161164
else
162165
{
163-
if (arguments.ContainsKey("/server") && !arguments.ContainsKey("/pvk") && !arguments.ContainsKey("/password") && !quiet)
166+
if (arguments.ContainsKey("/server") && (masterkeys.Count == 0))
164167
{
165-
Console.WriteLine("[X] The '/server:X' argument must be used with '/pvk:BASE64...' or '/password:X' !");
168+
Console.WriteLine("[X] The '/server:X' argument must be used with '/pvk:BASE64...', '/password:X' , or masterkey specification !");
166169
}
167170
else
168171
{
169-
// last "true" -> indicates we want to triage Edge
170-
Chrome.TriageChromeCookies(masterkeys, server, displayFormat, showAll, unprotect, cookieRegex, urlRegex, setneverexpire, stateKey, browser, quiet);
172+
Chrome.TriageChromeCookies(masterkeys, server, "", displayFormat, showAll, unprotect, cookieRegex, urlRegex, setneverexpire, stateKey, browser, quiet);
171173
}
172174
}
173175
}

‎SharpChrome/Commands/Logins.cs‎

Lines changed: 11 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ public void Execute(Dictionary<string, string> arguments)
1919
bool quiet = false; // don't display headers/logos/etc. (for csv/json output)
2020
string stateKey = ""; // decrypted AES statekey to use for cookie decryption
2121
string browser = "chrome"; // alternate Chromiun browser to specify, currently supported: "chrome", "edge", "brave"
22+
string target = ""; // target file/user folder to triage
2223

2324

2425
if (arguments.ContainsKey("/quiet"))
@@ -106,7 +107,7 @@ public void Execute(Dictionary<string, string> arguments)
106107

107108
if (arguments.ContainsKey("/target"))
108109
{
109-
string target = arguments["/target"].Trim('"').Trim('\'');
110+
target = arguments["/target"].Trim('"').Trim('\'');
110111
byte[] stateKeyBytes = null;
111112

112113
if (!String.IsNullOrEmpty(stateKey))
@@ -122,21 +123,23 @@ public void Execute(Dictionary<string, string> arguments)
122123
}
123124
Chrome.ParseChromeLogins(masterkeys, target, displayFormat, showAll, unprotect, stateKeyBytes, quiet);
124125
}
126+
else if(Directory.Exists(target) && target.ToLower().Contains("users"))
127+
{
128+
Chrome.TriageChromeLogins(masterkeys, server, target, displayFormat, showAll, unprotect, stateKey, browser, quiet);
129+
}
125130
else
126131
{
127-
Console.WriteLine("\r\n[X] '{0}' is not a valid file.", target);
132+
Console.WriteLine("\r\n[X] '{0}' is not a valid file or user directory.", target);
128133
}
129134
}
130135
else
131136
{
132-
if (arguments.ContainsKey("/server") && !arguments.ContainsKey("/pvk") && !arguments.ContainsKey("/password"))
133-
{
134-
Console.WriteLine("[X] The '/server:X' argument must be used with '/pvk:BASE64...' or '/password:X' !");
135-
}
136-
else
137+
if (arguments.ContainsKey("/server") && (masterkeys.Count == 0))
137138
{
138-
Chrome.TriageChromeLogins(masterkeys, server, displayFormat, showAll, unprotect, stateKey, browser, quiet);
139+
Console.WriteLine("[!] Warning: the '/server:X' argument must be used with '/pvk:BASE64...', '/password:X' , or masterkey specification for successful decryption!");
139140
}
141+
142+
Chrome.TriageChromeLogins(masterkeys, server, target, displayFormat, showAll, unprotect, stateKey, browser, quiet);
140143
}
141144
}
142145
}

‎SharpChrome/Commands/Statekeys.cs‎

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ public class Statekeys : ICommand
1111
public void Execute(Dictionary<string, string> arguments)
1212
{
1313
Console.WriteLine("\r\n[*] Action: Chromium Statekey Extraction\r\n");
14-
arguments.Remove("cookies");
14+
arguments.Remove("statekeys");
1515

1616
string server = ""; // used for remote server specification
1717
bool unprotect = false; // whether to force CryptUnprotectData()
@@ -67,21 +67,22 @@ public void Execute(Dictionary<string, string> arguments)
6767
{
6868
Chrome.TriageStateKeys(masterkeys, server, unprotect, target);
6969
}
70+
else if (Directory.Exists(target) && target.ToLower().Contains("users"))
71+
{
72+
Chrome.TriageStateKeys(masterkeys, server, unprotect, "", target);
73+
}
7074
else
7175
{
72-
Console.WriteLine("\r\n[X] '{0}' is not a valid file.", target);
76+
Console.WriteLine("\r\n[X] '{0}' is not a valid file or user directory.", target);
7377
}
7478
}
7579
else
7680
{
77-
if (arguments.ContainsKey("/server") && !arguments.ContainsKey("/pvk") && !arguments.ContainsKey("/password"))
78-
{
79-
Console.WriteLine("[X] The '/server:X' argument must be used with '/pvk:BASE64...' or '/password:X' !");
80-
}
81-
else
81+
if (arguments.ContainsKey("/server") && (masterkeys.Count == 0))
8282
{
83-
Chrome.TriageStateKeys(masterkeys, server, unprotect);
83+
Console.WriteLine("[!] Warning: the '/server:X' argument must be used with '/pvk:BASE64...', '/password:X' , or masterkey specification for successful decryption!");
8484
}
85+
Chrome.TriageStateKeys(masterkeys, server, unprotect);
8586
}
8687
}
8788
}

‎SharpChrome/Domain/Info.cs‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ public static void ShowUsage()
1818
string usage = @"
1919
Retrieve a domain controller's DPAPI backup key, optionally specifying a DC and output file:
2020
21-
SharpChrome backupkey [/server:SERVER.domain] [/file:key.pvk]
21+
SharpChrome backupkey [/nowrap] [/server:SERVER.domain] [/file:key.pvk]
2222
2323
2424
Global arguments for the 'cookies', 'logins', and 'statekeys' commands:
@@ -34,6 +34,7 @@ public static void ShowUsage()
3434
3535
Targeting:
3636
/target:FILE - triage a specific 'Cookies', 'Login Data', or 'Local State' file location
37+
/target:C:\Users\X\ - triage a specific user folder for any specified command
3738
/server:SERVER - triage a remote server, assuming admin access (note: must use with /pvk:KEY)
3839
/browser:X - triage 'chrome' (the default) or (chromium-based) 'edge'/'brave'
3940

0 commit comments

Comments
 (0)
Back | FazBrowse Home | New Git URL