Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Adding regsecrets and dpapidump #1898

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

laxaa
Copy link
Contributor

@laxaa laxaa commented Feb 19, 2025

Hello there, this PR includes two different scripts.

regsecrets.py:

This script is a modification of secretsdump.py that uses a different technique to extract registry secrets (the logic regarding DCSync operations has been removed). It does not write files on the disk and does not perform reg save like operations. This allow recovering the SAM database and the LSA secrets while being less prone to detection by security product.
All required keys are accessed using registry queries. To access keys within the SAM and SECURITY hives, the dwOption of BaseRegOpenKey allows passing the REG_OPTION_BACKUP_RESTORE value to disable any ACL checks performed, thus, allowing to access these registry keys normally restricted to the SYSTEM user.
One may wonder why not integrating these changes in the original secretsdump.py. From my point view, the original script already integrates a high number of cases and I was afraid of making its logic even more bloated than its currently is, making testing of every case very complicated and increasing the risk of bugs. However, if the maintaining team thinks it's better to integrate this new extraction logic into the original script, I could give it a go.

dpapidump.py:

This script is basically a copy of the SystemDPAPIdump.py from @clavoillotte in #1137 that integrates the extraction of secrets from regsecrets.py while integrating other small modifications:

  • The collections of information related to SCCM in the WMI database has been enhanced to match those retrieved by sccmhunter.
  • Disable the retrieval of the credentials file related to virtualapp/didlogical, this credential has always the same file name and does not contain useful information security wise.
  • Various small bug fixes and code improvements.

@LukeLauterbach
Copy link

Independently tested on Windows 11 and Server 2022 without issue. Although tests were performed on devices with base Defender, which doesn't even catch SecretsDump, so take it with a grain of salt.
image

@anadrianmanrique anadrianmanrique added Examples medium Medium priority item labels Feb 21, 2025
@anadrianmanrique anadrianmanrique self-assigned this Feb 21, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Examples medium Medium priority item
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants