[SHEHZADE//ABDULLAH ANSARI]
Red Team Consultant @ Google | MS in Cybersecurity @ NYU
● Notice //GitHub (@shehzade) is temporarily suspended pending an automated false-positive review. All tools are hosted on this Code Mirror and available on request (contact); GitHub links will return once reinstated.
Offline extractor and decryptor for SCCM/MECM Network Access Account (NAA) credentials and policy secrets from dead-disk WMI repositories and DPAPI master keys.
$
git clone https://shehzade.io/repos/naa-dump-offline.git
Copy
Source ZIP (290.0 KB)
Prebuilt Binaries
77 lines · 1.6 KB
| 1 | package dpapi |
| 2 | |
| 3 | import ( |
| 4 | "crypto/hmac" |
| 5 | "encoding/binary" |
| 6 | "fmt" |
| 7 | "hash" |
| 8 | "strings" |
| 9 | "unicode/utf16" |
| 10 | ) |
| 11 | |
| 12 | const ( |
| 13 | CALG_3DES = 0x6603 |
| 14 | CALG_AES_128 = 0x660e |
| 15 | CALG_AES_192 = 0x660f |
| 16 | CALG_AES_256 = 0x6610 |
| 17 | CALG_SHA1 = 0x8004 |
| 18 | CALG_HMAC = 0x8009 |
| 19 | CALG_SHA_256 = 0x800c |
| 20 | CALG_SHA_384 = 0x800d |
| 21 | CALG_SHA_512 = 0x800e |
| 22 | ) |
| 23 | |
| 24 | func DeriveKeyDPAPI(passphrase, salt []byte, keyLen, count int, newHash func() hash.Hash) []byte { |
| 25 | var keyMaterial []byte |
| 26 | i := uint32(1) |
| 27 | for len(keyMaterial) < keyLen { |
| 28 | U := make([]byte, len(salt)+4) |
| 29 | copy(U, salt) |
| 30 | binary.BigEndian.PutUint32(U[len(salt):], i) |
| 31 | i++ |
| 32 | |
| 33 | h := hmac.New(newHash, passphrase) |
| 34 | h.Write(U) |
| 35 | derived := h.Sum(nil) |
| 36 | |
| 37 | for r := 0; r < count-1; r++ { |
| 38 | h = hmac.New(newHash, passphrase) |
| 39 | h.Write(derived) |
| 40 | actual := h.Sum(nil) |
| 41 | for b := range derived { |
| 42 | derived[b] ^= actual[b] |
| 43 | } |
| 44 | } |
| 45 | keyMaterial = append(keyMaterial, derived...) |
| 46 | } |
| 47 | return keyMaterial[:keyLen] |
| 48 | } |
| 49 | |
| 50 | func FormatGUID(b []byte) string { |
| 51 | if len(b) < 16 { |
| 52 | return "" |
| 53 | } |
| 54 | d1 := binary.LittleEndian.Uint32(b[0:4]) |
| 55 | d2 := binary.LittleEndian.Uint16(b[4:6]) |
| 56 | d3 := binary.LittleEndian.Uint16(b[6:8]) |
| 57 | return fmt.Sprintf("%08x-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x", |
| 58 | d1, d2, d3, b[8], b[9], b[10], b[11], b[12], b[13], b[14], b[15]) |
| 59 | } |
| 60 | |
| 61 | func NormalizeGUID(s string) string { |
| 62 | s = strings.TrimSpace(s) |
| 63 | s = strings.TrimPrefix(s, "{") |
| 64 | s = strings.TrimSuffix(s, "}") |
| 65 | return strings.ToLower(s) |
| 66 | } |
| 67 | |
| 68 | func DecodeUTF16LE(b []byte) string { |
| 69 | if len(b) == 0 { |
| 70 | return "" |
| 71 | } |
| 72 | u16 := make([]uint16, len(b)/2) |
| 73 | for i := range u16 { |
| 74 | u16[i] = binary.LittleEndian.Uint16(b[i*2:]) |
| 75 | } |
| 76 | return strings.TrimRight(string(utf16.Decode(u16)), "\x00") |
| 77 | } |