README.md (5417B)
1 # naa-dump-offline 2 3 Offline tool to carve and decrypt SCCM/MECM Network Access Account (NAA) credentials and policy secrets from dead-disk artifacts (`OBJECTS.DATA`, registry hives, and DPAPI master keys). 4 5  6 7 ## Table of Contents 8 9 - [Why / The Gap This Fills](#why--the-gap-this-fills) 10 - [How It Works](#how-it-works) 11 - [Required Files](#required-files) 12 - [Build](#build) 13 - [Usage](#usage) 14 - [Find the required MasterKey GUID](#find-the-required-masterkey-guid) 15 - [Decrypt with registry hives and MasterKey file](#decrypt-with-registry-hives-and-masterkey-file) 16 - [Decrypt with a pre-decrypted MasterKey](#decrypt-with-a-pre-decrypted-masterkey) 17 - [License](#license) 18 19 ## Why / The Gap This Fills 20 21 Techniques documented under [CRED-4](https://github.com/subat0mik/Misconfiguration-Manager/blob/main/attack-techniques/CRED/CRED-4/cred-4_description.md) in Misconfiguration Manager cover extracting NAA credentials from client disk storage. Existing tooling like SharpSCCM (`local secrets -m disk`) accomplishes this on live Windows targets by invoking Win32/WMI APIs and modifying registry ACLs on `HKLM\SECURITY\Policy\Secrets\DPAPI_SYSTEM\CurrVal` and `HKLM\SECURITY\Policy\PolEKList` to access machine keys. That workflow requires on-host code execution and generates observable telemetry. 22 23 Doing this offline previously meant chaining multiple scripts across Python, PowerShell, and C# to dump hives, extract LSA secrets, decrypt DPAPI master keys, and carve WMI records out of CIM repository files. Cross-platform support was also limited for teams triaging disk images or volume shadow copies on Linux or macOS. 24 25 `naa-dump-offline` consolidates the full extraction chain into a single compiled Go binary with no external runtime dependencies. It parses the raw file structures directly (registry hives, DPAPI MasterKey files, and WMI B-Tree records) to carve and decrypt NAA credentials completely offline without running code on the target host. 26 27 ## How It Works 28 29 When an SCCM client receives policy containing Network Access Account credentials or task sequence secrets, the values are DPAPI-encrypted under the `NT AUTHORITY\SYSTEM` context and stored in the WMI repository (`C:\Windows\System32\wbem\Repository\OBJECTS.DATA`). 30 31 Instead of querying WMI on a live host, `naa-dump-offline` parses the raw files offline: 32 1. Scans `OBJECTS.DATA` for encrypted SCCM policy DPAPI blobs and identifies which SYSTEM MasterKey GUID is needed. 33 2. Extracts the BootKey from the `SYSTEM` hive and decrypts the `DPAPI_SYSTEM` LSA secret from the `SECURITY` hive. 34 3. Uses the `DPAPI_SYSTEM` user/machine keys to decrypt the target SYSTEM MasterKey file. 35 4. Decrypts the carved WMI blobs, decompresses any zlib-packed `PolicyXML` streams, and extracts plaintext credentials. 36 37 ## Required Files 38 39 | File | Default Path | 40 |---|---| 41 | `OBJECTS.DATA` | `C:\Windows\System32\wbem\Repository\OBJECTS.DATA` | 42 | `SYSTEM` | `C:\Windows\System32\config\SYSTEM` | 43 | `SECURITY` | `C:\Windows\System32\config\SECURITY` | 44 | `<GUID>` | `C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\<GUID>` | 45 46 ## Build 47 48 Requires Go 1.21+. 49 50 ```bash 51 make build 52 ``` 53 54 Cross-compile for Linux, Windows, and macOS: 55 56 ```bash 57 make build-all 58 ``` 59 60 ## Usage 61 62 ```text 63 Usage: naa-dump-offline -o OBJECTS.DATA [options] 64 65 Options: 66 -o, -objects string 67 Path to OBJECTS.DATA file 68 -sys, -system string 69 Path to SYSTEM registry hive 70 -sec, -security string 71 Path to SECURITY registry hive 72 -m, -master-key string 73 Path to MasterKey file 74 -k string 75 Decrypted MasterKey in hex (optional) 76 -json 77 Output results in JSON format 78 -v Verbose output (show decrypted policy secrets) 79 ``` 80 81 ### Find the required MasterKey GUID 82 83 Pull `OBJECTS.DATA` first and run without registry keys to see which MasterKey file you need to grab from the target: 84 85 ```bash 86 ./naa-dump-offline -o OBJECTS.DATA 87 ``` 88 89 ```text 90 [*] Scanning OBJECTS.DATA for encrypted policy blobs... 91 [+] Found 19 encrypted blobs (6 unique) 92 - MasterKey GUID: f5145914-dec0-40ee-a2d2-a40376c4b3e6 (19 blobs) 93 94 [*] Required MasterKey file: 95 %SystemRoot%\System32\Microsoft\Protect\S-1-5-18\User\f5145914-dec0-40ee-a2d2-a40376c4b3e6 96 ``` 97 98 ### Decrypt with registry hives and MasterKey file 99 100 Once you pull `SYSTEM`, `SECURITY`, and the target MasterKey file: 101 102 ```bash 103 ./naa-dump-offline -o OBJECTS.DATA -sys SYSTEM -sec SECURITY -m f5145914-dec0-40ee-a2d2-a40376c4b3e6 104 ``` 105 106 ```text 107 [*] Scanning OBJECTS.DATA for encrypted policy blobs... 108 [+] Found 19 encrypted blobs (6 unique) 109 - MasterKey GUID: f5145914-dec0-40ee-a2d2-a40376c4b3e6 (19 blobs) 110 [*] Parsing SYSTEM hive: SYSTEM 111 [+] BootKey: 0xfb354c003764f5e1ea29204b5f162a9d 112 [*] Parsing SECURITY hive: SECURITY 113 [+] DPAPI UserKey: 0xd6b33ef5cfe833c357590f5d48f5a87db0adcccf 114 [+] DPAPI MachineKey: 0x27c72e12f2827ac91ef78520240249fa914f1f62 115 [*] Decrypting MasterKey from f5145914-dec0-40ee-a2d2-a40376c4b3e6 116 [+] MasterKey (f5145914-dec0-40ee-a2d2-a40376c4b3e6): 0x77e2f2fea604d8ce4620cd6cbf5aa706... 117 [*] Decrypting 6 policy blobs... 118 119 [+] Extracted credentials: 120 sccm.lab\sccm-naa:123456789 121 ``` 122 123 ### Decrypt with a pre-decrypted MasterKey 124 125 If you already have the 64-byte MasterKey in hex: 126 127 ```bash 128 ./naa-dump-offline -o OBJECTS.DATA -k 77e2f2fea604d8ce4620cd6cbf5aa7063542e4ad31d064a3c6b8dbd25bed5d01... 129 ``` 130 131 ## License 132 133 Apache License 2.0