import optparse, os, sys, time, re

from Crypto.Cipher import AES

try:

import dpapick3.blob as blob

import dpapick3.masterkey as masterkey

import dpapick3.registry as registry

except ImportError:

raise ImportError('Missing dpapick3, please install via pip install dpapick3.')

def checkParameters(options, args):

return True

def reverseByte(bByteInput):

return bytes.fromhex(sReversed)

def parseGUID(bData):

return reverseByte(bData[:4]).hex() + '-' + reverseByte(bData[4:6]).hex() + '-' + reverseByte(bData[6:8]).hex() + '-' + bData[8:10].hex() + '-' + bData[10:].hex()

def parseTimestamp(bData):

iTimestamp = int(reverseByte(bData).hex(), 16)

return time.strftime('%Y-%m-%d %H:%M:%S', time.localtime(iTimestamp / 10000000 - 11644473600))

def getSchemaType(sGUID):

return 'Unknown'

def decryptBlob(oMKP, oBlob):

else: return None

def parsePolicy(bData, boolVerbose = False):

return bStoreBlob

def parsePolicyEntries(bData, boolVerbose = False):

return arrKeys[0], arrKeys[1]

def parseVCRD(bData, boolVerbose = False):

return (bIV, bData, sSchemaType) ## This assumes there is only one IV + Data per vault

def parseContainers(bData, boolVerbose = False):

return dicContainers

def parseSID(bData):

return sResult

def parseFinalData(bData, boolVerbose = False):

return (sEncData, sIV, sEncPwd)

if __name__ == '__main__':

"""Utility core."""

usage = (

'usage: %prog [options] Vault Directory\n\n'

'It tries to decrypt Vault VCRD files.\n'

'E.g.: Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Vault\\<GUID>\n'

'or : %ProgramData%\\Microsoft\\Vault\\<GUID>\n'

'or : %localappdata%\\Microsoft\\Vault\\<GUID>\n'

'# Provide system MK data for system credentials:\n'

'\\Windows\\System32\\Microsoft\\Protect\\S-1-5-18\\User\n'

'or user MK data for user credentials:\n'

'%appdata%\\Microsoft\\Protect\\<SID>')

parser = optparse.OptionParser(usage=usage)

parser.add_option('--masterkey', metavar='DIRECTORY', dest='masterkeydir')

parser.add_option('--credhist', metavar='FILE', dest='credhist')

parser.add_option('--sid', metavar='SID', dest='sid')

parser.add_option('--password', metavar='PASSWORD', dest='password')

parser.add_option('--pwdhash', metavar='HASH', dest='pwdhash', help='Example for empth hash: da39a3ee5e6b4b0d3255bfef95601890afd80709')

parser.add_option('--pvk', '-k', help='Optional: Depending on MK; domain RSA PVK keyfile')

parser.add_option('--system', metavar='HIVE', dest='system', default=os.path.join('Windows','System32','config','SYSTEM'))

parser.add_option('--security', metavar='HIVE', dest='security', default=os.path.join('Windows','System32','config','SECURITY'))

parser.add_option('--clearmasterkey', metavar='HEX', dest='mkclearhex', help='Provide manually decrypted DPAPI key here')

(options, args) = parser.parse_args()

boolDecrypt = checkParameters(options, args)

## Step 1: prepare DPAPI data

oMKP = masterkey.MasterKeyPool()

oMKP.loadDirectory(options.masterkeydir)

if options.security and options.system:

oReg = registry.Regedit()

oSecrets = oReg.get_lsa_secrets(options.security, options.system)

oSystemKey = oSecrets.get('DPAPI_SYSTEM')['CurrVal']

oMKP.addSystemCredential(oSystemKey)

oMKP.try_credential_hash(None, None)

else:

if options.credhist: oMKP.addCredhistFile(options.sid, options.credhist)

if options.pvk: oMKP.try_domain(options.pvk)

if options.password: oMKP.try_credential(options.sid, options.password)

elif options.pwdhash: oMKP.try_credential_hash(options.sid, bytes.fromhex(options.pwdhash))

## Step 2: Parse and DPAPI decrypt Policy.vpol

sVpol = os.path.join(args[0], 'Policy.vpol')

if os.path.exists(sVpol):

with open(sVpol, 'rb') as f: oVpolBlob = parsePolicy(f.read())

if boolDecrypt:

bVpolCleartext = decryptBlob(oMKP, oVpolBlob)

if not bVpolCleartext: exit('[-] Unable to decrypt Policy.vpol')

bKeyAES128, bKeyAES256 = parsePolicyEntries(bVpolCleartext)

print('[+] Decrypted vpol file, AES key {}'.format(bKeyAES256.hex()))

else: print('[+] Found vpol file, to decrypt, we need masterkey with GUID: {}'.format(oVpolBlob.mkguid))

## Step 3: Parse and AES decrypt VCRD

sUsername = ''

iCount = 0

for sFile in os.listdir(args[0]):

if sFile.lower().endswith('.vcrd'):

sFilepath = os.path.join(args[0], sFile)

print('---- Working on ' + sFile + ' ----')

with open(sFilepath, 'rb') as oVcrdfile:

iCount += 1

bIV, bData, sSchemaType = parseVCRD(oVcrdfile.read(), not boolDecrypt) ## parseVCRD verifies the vault type (GUIDs at the top of this file)

#bIV, bData, sSchemaType = parseVCRD(oVcrdfile.read(), True) ## parseVCRD verifies the vault type (GUIDs at the top of this file)

if boolDecrypt and bKeyAES256 and bData:

cipher = AES.new(bKeyAES256, AES.MODE_CBC, iv = bIV)

bDecrypted = cipher.decrypt(bData)

dicContainers = parseContainers(bDecrypted) ## dicContainers[ContainerID] = bData

if dicContainers[1].startswith('NGC'.encode('UTF-16LE')): ## Should be "NGC Local Accoount Logon Vault Resource" in utf-16le

sSID = parseSID(dicContainers[2])

print('[+] Schema Type : {}'.format(sSchemaType))

print('[+] User SID : {}'.format(sSID))

parseFinalData(dicContainers[3], True)

else:

print('[+] Decryption successful')

print(' Schema Type : {}'.format(sSchemaType))

for sCont in dicContainers:

print(' Container ID : {}'.format(sCont))

try: print(' Container Data : {}'.format(dicContainers[sCont].decode('UTF-16LE')))

except: print(' Container Data : {}'.format(dicContainers[sCont].hex()))

print('#'*70)

if iCount == 0: print('[-] No Vault VCRD files were found')