Crypto and DPAPI cleaning

dptechma · Jun 3, 2015 · 552fe7a · 552fe7a
1 parent 64ba953
commit 552fe7a
Show file tree

Hide file tree

Showing 16 changed files with 707 additions and 340 deletions.
diff --git a/inc/globals.h b/inc/globals.h
@@ -17,7 +17,6 @@
 #include <wchar.h>
 #include "../modules/kull_m_output.h"
 //#define KERBEROS_TOOLS
-//#define DPAPI_TOOLS
 //#define LSASS_DECRYPT
 //#define LSARPDATA
 #define NET_MODULE
@@ -68,6 +67,9 @@ DWORD MIMIKATZ_NT_MAJOR_VERSION, MIMIKATZ_NT_MINOR_VERSION, MIMIKATZ_NT_BUILD_NU
 
 #define RtlEqualLuid(L1, L2) (((L1)->LowPart == (L2)->LowPart) && ((L1)->HighPart == (L2)->HighPart))
 #define RtlEqualGuid(L1, L2) (RtlEqualMemory(L1, L2, sizeof(GUID)))
+
+#define KIWI_MINIMUM(a,b) (((a) < (b)) ? (a) : (b))
+
 #define LM_NTLM_HASH_LENGTH	16
 
 #define KULL_M_WIN_BUILD_XP		2600

diff --git a/mimikatz/mimikatz.c b/mimikatz/mimikatz.c
@@ -23,6 +23,7 @@ const KUHL_M * mimikatz_modules[] = {
 #ifdef NET_MODULE
 	&kuhl_m_net,
 #endif
+	&kuhl_m_dpapi,
 };
 
 int wmain(int argc, wchar_t * argv[])

diff --git a/mimikatz/mimikatz.h b/mimikatz/mimikatz.h
@@ -23,6 +23,7 @@
 #ifdef NET_MODULE
 #include "modules/kuhl_m_net.h"
 #endif
+#include "modules/kuhl_m_dpapi.h"
 #include "modules/kuhl_m_kernel.h"
 
 #include <io.h>

diff --git a/mimikatz/mimikatz.vcxproj b/mimikatz/mimikatz.vcxproj
@@ -88,6 +88,7 @@
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
   <ItemGroup>
     <ClCompile Include="..\modules\kull_m_asn1.c" />
+    <ClCompile Include="..\modules\kull_m_crypto.c" />
     <ClCompile Include="..\modules\kull_m_dpapi.c" />
     <ClCompile Include="..\modules\kull_m_file.c" />
     <ClCompile Include="..\modules\kull_m_handle.c" />
@@ -109,6 +110,7 @@
     <ClCompile Include="modules\kerberos\kuhl_m_kerberos_pac.c" />
     <ClCompile Include="modules\kerberos\kuhl_m_kerberos_ticket.c" />
     <ClCompile Include="modules\kuhl_m_crypto.c" />
+    <ClCompile Include="modules\kuhl_m_dpapi.c" />
     <ClCompile Include="modules\kuhl_m_event.c" />
     <ClCompile Include="modules\kuhl_m_kernel.c" />
     <ClCompile Include="modules\kuhl_m_lsadump.c" />
@@ -140,6 +142,7 @@
   </ItemGroup>
   <ItemGroup>
     <ClInclude Include="..\modules\kull_m_asn1.h" />
+    <ClInclude Include="..\modules\kull_m_crypto.h" />
     <ClInclude Include="..\modules\kull_m_crypto_system.h" />
     <ClInclude Include="..\modules\kull_m_dpapi.h" />
     <ClInclude Include="..\modules\kull_m_file.h" />
@@ -166,6 +169,7 @@
     <ClInclude Include="modules\kerberos\kuhl_m_kerberos_ticket.h" />
     <ClInclude Include="modules\kuhl_m.h" />
     <ClInclude Include="modules\kuhl_m_crypto.h" />
+    <ClInclude Include="modules\kuhl_m_dpapi.h" />
     <ClInclude Include="modules\kuhl_m_event.h" />
     <ClInclude Include="modules\kuhl_m_kernel.h" />
     <ClInclude Include="modules\kuhl_m_lsadump.h" />

diff --git a/mimikatz/mimikatz.vcxproj.filters b/mimikatz/mimikatz.vcxproj.filters
@@ -149,6 +149,12 @@
     <ClCompile Include="modules\kuhl_m_minesweeper.c">
       <Filter>local modules</Filter>
     </ClCompile>
+    <ClCompile Include="modules\kuhl_m_dpapi.c">
+      <Filter>local modules</Filter>
+    </ClCompile>
+    <ClCompile Include="..\modules\kull_m_crypto.c">
+      <Filter>common modules</Filter>
+    </ClCompile>
   </ItemGroup>
   <ItemGroup>
     <ClInclude Include="mimikatz.h" />
@@ -317,6 +323,12 @@
     <ClInclude Include="modules\kuhl_m_minesweeper.h">
       <Filter>local modules</Filter>
     </ClInclude>
+    <ClInclude Include="modules\kuhl_m_dpapi.h">
+      <Filter>local modules</Filter>
+    </ClInclude>
+    <ClInclude Include="..\modules\kull_m_crypto.h">
+      <Filter>common modules</Filter>
+    </ClInclude>
   </ItemGroup>
   <ItemGroup>
     <Filter Include="local modules">

diff --git a/mimikatz/modules/kuhl_m_crypto.c b/mimikatz/modules/kuhl_m_crypto.c
@@ -24,53 +24,6 @@ const KUHL_M kuhl_m_crypto = {
 	ARRAYSIZE(kuhl_m_c_crypto), kuhl_m_c_crypto, kuhl_m_crypto_init, kuhl_m_crypto_clean
 };
 
-const KUHL_M_CRYPTO_DWORD_TO_DWORD kuhl_m_crypto_system_stores[] = {
-	{L"CERT_SYSTEM_STORE_CURRENT_USER",					CERT_SYSTEM_STORE_CURRENT_USER},
-	{L"CERT_SYSTEM_STORE_CURRENT_USER_GROUP_POLICY",	CERT_SYSTEM_STORE_CURRENT_USER_GROUP_POLICY},
-	{L"CERT_SYSTEM_STORE_LOCAL_MACHINE",				CERT_SYSTEM_STORE_LOCAL_MACHINE},
-	{L"CERT_SYSTEM_STORE_LOCAL_MACHINE_GROUP_POLICY",	CERT_SYSTEM_STORE_LOCAL_MACHINE_GROUP_POLICY},
-	{L"CERT_SYSTEM_STORE_LOCAL_MACHINE_ENTERPRISE",		CERT_SYSTEM_STORE_LOCAL_MACHINE_ENTERPRISE},
-	{L"CERT_SYSTEM_STORE_CURRENT_SERVICE",				CERT_SYSTEM_STORE_CURRENT_SERVICE},
-	{L"CERT_SYSTEM_STORE_USERS",						CERT_SYSTEM_STORE_USERS},
-	{L"CERT_SYSTEM_STORE_SERVICES",						CERT_SYSTEM_STORE_SERVICES},
-};
-
-const KUHL_M_CRYPTO_NAME_TO_REALNAME kuhl_m_crypto_provider_names[] = {
-	{L"MS_DEF_PROV",									MS_DEF_PROV},
-	{L"MS_ENHANCED_PROV",								MS_ENHANCED_PROV},
-	{L"MS_STRONG_PROV",									MS_STRONG_PROV},
-	{L"MS_DEF_RSA_SIG_PROV",							MS_DEF_RSA_SIG_PROV},
-	{L"MS_DEF_RSA_SCHANNEL_PROV",						MS_DEF_RSA_SCHANNEL_PROV},
-	{L"MS_DEF_DSS_PROV",								MS_DEF_DSS_PROV},
-	{L"MS_DEF_DSS_DH_PROV",								MS_DEF_DSS_DH_PROV},
-	{L"MS_ENH_DSS_DH_PROV",								MS_ENH_DSS_DH_PROV},
-	{L"MS_DEF_DH_SCHANNEL_PROV",						MS_DEF_DH_SCHANNEL_PROV},
-	{L"MS_SCARD_PROV",									MS_SCARD_PROV},
-	{L"MS_ENH_RSA_AES_PROV_XP",							MS_ENH_RSA_AES_PROV_XP},
-	{L"MS_ENH_RSA_AES_PROV",							MS_ENH_RSA_AES_PROV},
-};
-
-const KUHL_M_CRYPTO_DWORD_TO_DWORD kuhl_m_crypto_provider_types[] = {
-	{L"PROV_RSA_FULL",									PROV_RSA_FULL},
-	{L"PROV_RSA_SIG",									PROV_RSA_SIG},
-	{L"PROV_DSS",										PROV_DSS},
-	{L"PROV_FORTEZZA",									PROV_FORTEZZA},
-	{L"PROV_MS_EXCHANGE",								PROV_MS_EXCHANGE},
-	{L"PROV_SSL",										PROV_SSL},
-	{L"PROV_RSA_SCHANNEL",								PROV_RSA_SCHANNEL},
-	{L"PROV_DSS_DH",									PROV_DSS_DH},
-	{L"PROV_EC_ECDSA_SIG",								PROV_EC_ECDSA_SIG},
-	{L"PROV_EC_ECNRA_SIG",								PROV_EC_ECNRA_SIG},
-	{L"PROV_EC_ECDSA_FULL",								PROV_EC_ECDSA_FULL},
-	{L"PROV_EC_ECNRA_FULL",								PROV_EC_ECNRA_FULL},
-	{L"PROV_DH_SCHANNEL",								PROV_DH_SCHANNEL},
-	{L"PROV_SPYRUS_LYNKS",								PROV_SPYRUS_LYNKS},
-	{L"PROV_RNG",										PROV_RNG},
-	{L"PROV_INTEL_SEC",									PROV_INTEL_SEC},
-	{L"PROV_REPLACE_OWF",								PROV_REPLACE_OWF},
-	{L"PROV_RSA_AES",									PROV_RSA_AES},
-};
-
 PCP_EXPORTKEY K_CPExportKey = NULL;
 PNCRYPT_OPEN_STORAGE_PROVIDER K_NCryptOpenStorageProvider = NULL;
 PNCRYPT_ENUM_KEYS K_NCryptEnumKeys = NULL;
@@ -175,8 +128,8 @@ NTSTATUS kuhl_m_crypto_l_stores(int argc, wchar_t * argv[])
 {
 	DWORD dwSystemStore, nbStore = 0;
 	PCWCHAR szSystemStore;
-	kull_m_string_args_byName(argc, argv, L"systemstore", &szSystemStore, kuhl_m_crypto_system_stores[0].name);
-	dwSystemStore = kuhl_m_crypto_system_store_to_dword(szSystemStore);
+	kull_m_string_args_byName(argc, argv, L"systemstore", &szSystemStore, L"CURRENT_USER"/*kuhl_m_crypto_system_stores[0].name*/);
+	dwSystemStore = kull_m_crypto_system_store_to_dword(szSystemStore);
 	kprintf(L"Asking for System Store \'%s\' (0x%08x)\n", szSystemStore, dwSystemStore);
 
 	if(!CertEnumSystemStore(dwSystemStore, NULL, &nbStore, kuhl_m_crypto_l_stores_enumCallback_print))
@@ -208,8 +161,8 @@ NTSTATUS kuhl_m_crypto_l_certificates(int argc, wchar_t * argv[])
 
 	BOOL export = kull_m_string_args_byName(argc, argv, L"export", NULL, NULL);
 
-	kull_m_string_args_byName(argc, argv, L"systemstore", &szSystemStore, kuhl_m_crypto_system_stores[0].name);
-	dwSystemStore = kuhl_m_crypto_system_store_to_dword(szSystemStore);
+	kull_m_string_args_byName(argc, argv, L"systemstore", &szSystemStore, L"CURRENT_USER"/*kuhl_m_crypto_system_stores[0].name*/);
+	dwSystemStore = kull_m_crypto_system_store_to_dword(szSystemStore);
 	kull_m_string_args_byName(argc, argv, L"store", &szStore, L"My");
 
 	kprintf(L" * System Store  : \'%s\' (0x%08x)\n"
@@ -247,7 +200,7 @@ NTSTATUS kuhl_m_crypto_l_certificates(int argc, wchar_t * argv[])
 
 										if(CryptAcquireCertificatePrivateKey(pCertContext, CRYPT_ACQUIRE_ALLOW_NCRYPT_KEY_FLAG /* CRYPT_ACQUIRE_SILENT_FLAG NULL */, NULL, &monProv, &keySpec, &keyToFree))
 										{
-											kprintf(L"\tType           : %s (0x%08x)\n", kuhl_m_crypto_keytype_to_str(keySpec), keySpec);
+											kprintf(L"\tType           : %s (0x%08x)\n", kull_m_crypto_keytype_to_str(keySpec), keySpec);
 
 											if(keySpec != CERT_NCRYPT_KEY_SPEC)
 											{
@@ -315,11 +268,11 @@ NTSTATUS kuhl_m_crypto_l_keys(int argc, wchar_t * argv[])
 	BOOL export = kull_m_string_args_byName(argc, argv, L"export", NULL, NULL);
 
 	kull_m_string_args_byName(argc, argv, L"provider", &szProvider, L"MS_ENHANCED_PROV");
-	if(!(pProvider = kuhl_m_crypto_provider_to_realname(szProvider)))
+	if(!(pProvider = kull_m_crypto_provider_to_realname(szProvider)))
 		pProvider = szProvider;
 
 	kull_m_string_args_byName(argc, argv, L"providertype", &szProviderType, L"PROV_RSA_FULL");
-	if(!(dwProviderType = kuhl_m_crypto_provider_type_to_dword(szProviderType)))
+	if(!(dwProviderType = kull_m_crypto_provider_type_to_dword(szProviderType)))
 		dwProviderType = wcstoul(szProviderType, NULL, 0);
 
 	if(kull_m_string_args_byName(argc, argv, L"machine", NULL, NULL))
@@ -356,7 +309,7 @@ NTSTATUS kuhl_m_crypto_l_keys(int argc, wchar_t * argv[])
 							for(ks = AT_KEYEXCHANGE, hCapiKey = 0; (ks <= AT_SIGNATURE) && !CryptGetUserKey(hCryptKeyProv, ks, &hCapiKey); ks++);
 							if(hCapiKey)
 							{
-								kprintf(L"\tType           : %s (0x%08x)\n", kuhl_m_crypto_keytype_to_str(ks), ks);
+								kprintf(L"\tType           : %s (0x%08x)\n", kull_m_crypto_keytype_to_str(ks), ks);
 								kuhl_m_crypto_printKeyInfos(0, hCapiKey);
 								if(export)
 									kuhl_m_crypto_exportKeyToFile(0, hCapiKey, ks, szStore, i, containerName);
@@ -625,51 +578,6 @@ wchar_t * kuhl_m_crypto_generateFileName(const wchar_t * term0, const wchar_t *
 	return buffer;
 }
 
-DWORD kuhl_m_crypto_system_store_to_dword(PCWSTR name)
-{
-	DWORD i;
-	if(name)
-		for(i = 0; i < ARRAYSIZE(kuhl_m_crypto_system_stores); i++)
-			if((_wcsicmp(name, kuhl_m_crypto_system_stores[i].name) == 0) || (_wcsicmp(name, kuhl_m_crypto_system_stores[i].name + 18) == 0))
-				return kuhl_m_crypto_system_stores[i].id;
-	return 0;
-}
-
-DWORD kuhl_m_crypto_provider_type_to_dword(PCWSTR name)
-{
-	DWORD i;
-	if(name)
-		for(i = 0; i < ARRAYSIZE(kuhl_m_crypto_provider_types); i++)
-			if((_wcsicmp(name, kuhl_m_crypto_provider_types[i].name) == 0) || (_wcsicmp(name, kuhl_m_crypto_provider_types[i].name + 5) == 0))
-				return kuhl_m_crypto_provider_types[i].id;
-	return 0;
-}
-
-PCWCHAR kuhl_m_crypto_provider_to_realname(PCWSTR name)
-{
-	DWORD i;
-	if(name)
-		for(i = 0; i < ARRAYSIZE(kuhl_m_crypto_provider_names); i++)
-			if((_wcsicmp(name, kuhl_m_crypto_provider_names[i].name) == 0) || (_wcsicmp(name, kuhl_m_crypto_provider_names[i].name + 3) == 0))
-				return kuhl_m_crypto_provider_names[i].realname;
-	return NULL;
-}
-
-const wchar_t * kuhl_m_crypto_keytype_to_str(const DWORD keyType)
-{
-	switch (keyType)
-	{
-	case AT_KEYEXCHANGE:
-		return L"AT_KEYEXCHANGE";
-	case AT_SIGNATURE:
-		return L"AT_SIGNATURE";
-	case CERT_NCRYPT_KEY_SPEC:
-		return L"CNG Key";
-	default:
-		return L"?";
-	}
-}
-
 BYTE PATC_WIN5_CPExportKey_EXPORT[]	= {0xeb};
 BYTE PATC_W6AL_CPExportKey_EXPORT[]	= {0x90, 0xe9};
 #ifdef _M_X64

diff --git a/mimikatz/modules/kuhl_m_crypto.h b/mimikatz/modules/kuhl_m_crypto.h
@@ -5,6 +5,7 @@
 */
 #pragma once
 #include "kuhl_m.h"
+#include "../modules/kull_m_crypto.h"
 #include "../modules/kull_m_process.h"
 #include "../modules/kull_m_service.h"
 #include "../modules/kull_m_memory.h"
@@ -34,11 +35,6 @@ typedef struct _KUHL_M_CRYPTO_NAME_TO_REALNAME{
 	PCWSTR	realname;
 } KUHL_M_CRYPTO_NAME_TO_REALNAME, *PKUHL_M_CRYPTO_NAME_TO_REALNAME;
 
-/*typedef struct _GENERICKEY_BLOB {
-	BLOBHEADER BlobHeader;
-	DWORD dwKeyLen;
-} GENERICKEY_BLOB, *PGENERICKEY_BLOB;*/
-
 #define PVK_FILE_VERSION_0				0
 #define PVK_MAGIC						0xb0b5f11e // bob's file
 #define PVK_NO_ENCRYPT					0
@@ -68,11 +64,7 @@ NTSTATUS kuhl_m_crypto_p_capi(int argc, wchar_t * argv[]);
 NTSTATUS kuhl_m_crypto_p_cng(int argc, wchar_t * argv[]);
 
 BOOL WINAPI kuhl_m_crypto_l_stores_enumCallback_print(const void *pvSystemStore, DWORD dwFlags, PCERT_SYSTEM_STORE_INFO pStoreInfo, void *pvReserved, void *pvArg);
-DWORD kuhl_m_crypto_system_store_to_dword(PCWSTR name);
-DWORD kuhl_m_crypto_provider_type_to_dword(PCWSTR name);
-PCWCHAR kuhl_m_crypto_provider_to_realname(PCWSTR name);
 
-const wchar_t * kuhl_m_crypto_keytype_to_str(const DWORD keyType);
 void kuhl_m_crypto_printKeyInfos(HCRYPTPROV_OR_NCRYPT_KEY_HANDLE monProv, HCRYPTKEY maCle);
 void kuhl_m_crypto_exportKeyToFile(NCRYPT_KEY_HANDLE hCngKey, HCRYPTKEY hCapiKey, DWORD keySpec, const wchar_t * store, const DWORD index, const wchar_t * name);
 void kuhl_m_crypto_exportCert(PCCERT_CONTEXT pCertificate, BOOL havePrivateKey, const wchar_t * systemStore, const wchar_t * store, const DWORD index, const wchar_t * name);

diff --git a/mimikatz/modules/kuhl_m_dpapi.c b/mimikatz/modules/kuhl_m_dpapi.c
@@ -0,0 +1,32 @@
+/*	Benjamin DELPY `gentilkiwi`
+	http://blog.gentilkiwi.com
+	benjamin@gentilkiwi.com
+	Licence : http://creativecommons.org/licenses/by/3.0/fr/
+*/
+#include "kuhl_m_dpapi.h"
+
+const KUHL_M_C kuhl_m_c_dpapi[] = {
+	{kuhl_m_dpapi_masterkeys,		L"masterkeys",		L""},
+};
+const KUHL_M kuhl_m_dpapi = {
+	L"dpapi",	L"", NULL,
+	ARRAYSIZE(kuhl_m_c_dpapi), kuhl_m_c_dpapi, NULL, NULL
+};
+
+NTSTATUS kuhl_m_dpapi_masterkeys(int argc, wchar_t * argv[])
+{
+	PKULL_M_DPAPI_MASTERKEYS masterkeys;
+	PBYTE buffer;
+	DWORD szBuffer;
+
+	if(argc && kull_m_file_readData(argv[0], &buffer, &szBuffer))
+	{
+		if(masterkeys = kull_m_dpapi_masterkeys_create(buffer))
+		{
+			kull_m_dpapi_masterkeys_descr(masterkeys);
+			kull_m_dpapi_masterkeys_delete(masterkeys);
+		}
+		LocalFree(buffer);
+	}
+	return STATUS_SUCCESS;
+}
diff --git a/mimikatz/modules/kuhl_m_dpapi.h b/mimikatz/modules/kuhl_m_dpapi.h
@@ -0,0 +1,13 @@
+/*	Benjamin DELPY `gentilkiwi`
+	http://blog.gentilkiwi.com
+	benjamin@gentilkiwi.com
+	Licence : http://creativecommons.org/licenses/by/3.0/fr/
+*/
+#pragma once
+#include "kuhl_m.h"
+#include "../modules/kull_m_file.h"
+#include "../modules/kull_m_dpapi.h"
+
+const KUHL_M kuhl_m_dpapi;
+
+NTSTATUS kuhl_m_dpapi_masterkeys(int argc, wchar_t * argv[]);