Skip to content

Added support for decrypting DPAPI encrypted certificates - #7

Merged
HarmJ0y merged 1 commit into
GhostPack:masterfrom
leftp:master
May 6, 2020
Merged

HarmJ0y merged 1 commit into
GhostPack:masterfrom
leftp:master

Conversation

@leftp

@leftp leftp commented May 2, 2020

Copy link
Copy Markdown

Added 2 commands for :

  1. certificate - Will search for user encrypted dpapi private keys and decrypt them
  2. machinecerts - Will search for system encrypted dpapi private keys

If private keys match with any in the store, it will base64 output the PKCS1 private key and the certificate from the store.

Based heavily on dpapick https://bitbucket.org/jmichel/dpapick/

Also fixed issue with the parsing of invalid files during machinetriage.

@HarmJ0y
HarmJ0y merged commit 09e3a62 into GhostPack:master May 6, 2020
@HarmJ0y

HarmJ0y commented May 6, 2020

Copy link
Copy Markdown
Member

Awesome work, thanks for the PR!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants