How to use the pypykatz.dpapi.structures.blob.DPAPI_BLOB.from_bytes function in pypykatz

To help you get started, we’ve selected a few pypykatz examples, based on popular ways it is used in public projects.

Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.

github skelsec / pypykatz / pypykatz / dpapi / dpapi.py View on Github external
def decrypt_blob_bytes(self, data, key = None):
		"""
		Decrypts DPAPI_BLOB bytes.
		
		data: DPAPI_BLOB bytes
		returns: bytes of the cleartext data
		"""
		blob = DPAPI_BLOB.from_bytes(data)
		return self.decrypt_blob(blob, key = key)
github skelsec / pypykatz / pypykatz / dpapi / structures / credentialfile.py View on Github external
def from_buffer(buff):
		sk = CredentialFile()
		sk.version = int.from_bytes(buff.read(4), 'little', signed = False)
		sk.size = int.from_bytes(buff.read(4), 'little', signed = False)
		sk.unk = int.from_bytes(buff.read(4), 'little', signed = False)
		sk.data = buff.read(sk.size)
		sk.blob = DPAPI_BLOB.from_bytes(sk.data)
		return sk
github skelsec / pypykatz / pypykatz / dpapi / structures / vault.py View on Github external
def from_buffer(buff):
		sk = VAULT_VPOL()		
		sk.version = int.from_bytes(buff.read(4), 'little', signed = False)
		sk.guid = GUID(buff).value
		sk.description_length = int.from_bytes(buff.read(4), 'little', signed = False)
		sk.description = buff.read(sk.description_length)
		sk.unk0 = buff.read(12)
		sk.size = int.from_bytes(buff.read(4), 'little', signed = False)
		sk.guid2 = GUID(buff).value
		sk.guid3 = GUID(buff).value
		sk.key_size = int.from_bytes(buff.read(4), 'little', signed = False)
		sk.blob = DPAPI_BLOB.from_bytes(buff.read(sk.key_size))
		
		return sk
github skelsec / pypykatz / pypykatz / dpapi / structures / blob.py View on Github external
else:
			return None
		
	def __str__(self):
		t = '== DPAPI_BLOB ==\r\n'
		for k in self.__dict__:
			if isinstance(self.__dict__[k], list):
				for i, item in enumerate(self.__dict__[k]):
					t += '   %s: %s: %s' % (k, i, str(item))
			else:
				t += '%s: %s \r\n' % (k, str(self.__dict__[k]))
		return t
		
if __name__ == '__main__':
	data = bytes.fromhex('01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dc64974c99aa6c43bb30ff39b3dd407c0000000002000000000003660000c000000010000000f1af675a51c8283cf81abb6fb600110f0000000004800000a0000000100000009bf4e56d6c32dd59bce655496a94444c1000000088438c8f61d966ac220b4ca50933c8ee14000000314eaa780e358e70c586fb47bee0e27549be480e')
	db = DPAPI_BLOB.from_bytes(data)
	print(str(db))