Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
def set_privilege(self, privilige_id, thread_or_process = False):
"""
Sets a given privilege
"""
logger.debug('[ProcessManipulator] Setting %s privilege' % privilige_id)
return self.api.ntdll.RtlAdjustPrivilege(privilige_id, enable = True, thread_or_process = thread_or_process)
def get_lsa_bruteforce(self):
#good luck!
logger.info('Testing all available templates! Expect warnings!')
for lsa_dec_template in LsaTemplate.get_template_brute(self.sysinfo):
try:
lsa_dec = LsaDecryptor.choose(self.reader, lsa_dec_template, self.sysinfo)
logger.debug(lsa_dec.dump())
except:
pass
else:
logger.info('Lucky you! Brutefoce method found a -probably- working template!')
return lsa_dec
def list_users(self):
logger.debug('Listing SIDs from registry...')
software_hive = LiveRegistryHive('SOFTWARE')
users = {}
for sid_str in software_hive.enum_key('Microsoft\\Windows NT\\CurrentVersion\\ProfileList'):
if sid_str.endswith('_Classes') or sid_str.startswith('.'):
continue
ptr_sid = self.api.advapi32.ConvertStringSidToSid(sid_str.encode())
name, domain, token_type = self.api.advapi32.LookupAccountSid(None, ptr_sid)
users[sid_str] = User(name, domain, sid_str)
return users
def list_all_tokens(self, force = False):
"""
iterates trough all available processes, fetches all process tokens, gets user information for all tokens
"""
logger.debug('[ProcessManipulator] Listing all tokens...')
try:
res = self.set_privilege(SE_DEBUG)
except Exception as e:
if force is False:
logger.error('Failed to obtain SE_DEBUG privilege!')
raise e
else:
pass
token_infos = []
for pid in self.api.psapi.EnumProcesses():
proc_handle = None
try:
proc_handle = self.api.kernel32.OpenProcess(PROCESS_QUERY_INFORMATION, False, pid)
logger.log(1, '[ProcessManipulator] Proc handle for PID %s is: %s' % (proc_handle, pid))
except Exception as e:
def decrypt_blob(self, dpapi_blob, key = None):
"""
Decrypts a DPAPI_BLOB object
The DPAPI blob has a GUID attributes which indicates the masterkey to be used, also it has integrity check bytes so it is possible to tell is decryption was sucsessfull.
dpapi_blob: DPAPI_BLOB object
key: raw bytes of the decryption key. If not supplied the function will look for keys already cached in the DPAPI object.
returns: bytes of the cleartext data
"""
if key is None:
logger.debug('[DPAPI] Looking for master key with GUID %s' % dpapi_blob.masterkey_guid)
if dpapi_blob.masterkey_guid not in self.masterkeys:
raise Exception('No matching masterkey was found for the blob!')
key = self.masterkeys[dpapi_blob.masterkey_guid]
return dpapi_blob.decrypt(key)
def __get_registry_secrets(self, lr):
"""
Gets the pre-keys from an already parsed OffineRegistry or LiveRegistry object, populates the userkey/machinekey lists, returns the obtained keys
lr: OffineRegistry or LiveRegistry object
return: touple of two lists, [0] userkeys [1] machinekeys
"""
user = []
machine = []
from pypykatz.registry.security.common import LSASecretDPAPI
if lr.security:
for secret in lr.security.cached_secrets:
if isinstance(secret, LSASecretDPAPI):
logger.debug('[DPAPI] Found DPAPI user key in registry! Key: %s' % secret.user_key)
logger.debug('[DPAPI] Found DPAPI machine key in registry! Key: %s' % secret.machine_key)
self.user_keys.append(secret.user_key)
user.append(secret.user_key)
self.machine_keys.append(secret.machine_key)
machine.append(secret.machine_key)
if lr.sam is not None:
for secret in lr.sam.secrets:
if secret.nt_hash:
sid = '%s-%s' % (lr.sam.machine_sid, secret.rid)
x, key2, key3 = self.get_prekeys_from_password(sid, nt_hash = secret.nt_hash)
logger.debug('[DPAPI] NT hash method. Calculated user key for user %s! Key2: %s Key3: %s' % (sid, key2, key3))
user.append(key2)
user.append(key3)
continue
return user, machine