dpapi.py Add RPC masterkey decryption by imaibou · Pull Request #739 · fortra/impacket

imaibou · 2020-01-03T16:01:57Z

Added feature to decrypt a user's masterkey using the MS-BKRP (BackupKey Remote Protocol). This is already implemented in mimikatz to decrypt masterkeys using the /rpc flag (https://github.com/gentilkiwi/mimikatz/blob/172200295688ccbb76c44c6db0b3b47d39dd0d4d/modules/rpc/kull_m_rpc_bkrp.c#L51-L54)
This makes an RPC call with the user's identity to the function BackuprKey on the DC. The GUID of this operation is BACKUPKEY_RESTORE_GUID and the details can be found on microsoft documentation here: https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-bkrp/7accb903-3863-4385-9c99-11af8c18d656

Added feature to decrypt a user's masterkey using the MS-BKRP (BackupKey Remote Protocol). This is already implemented in mimikatz to decrypt masterkeys using the /rpc flag (https://github.com/gentilkiwi/mimikatz/blob/172200295688ccbb76c44c6db0b3b47d39dd0d4d/modules/rpc/kull_m_rpc_bkrp.c#L51-L54) This makes an RPC call with the user's identity to the function BackuprKey on the DC. The GUID of this operation is BACKUPKEY_RESTORE_GUID and the details can be found on microsoft documentation here: https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-bkrp/7accb903-3863-4385-9c99-11af8c18d656

asolino · 2020-01-03T17:49:56Z

Thanks for the addition @imaibou!, merging.

darkoperator · 2020-07-28T20:58:29Z

any examples using Kerberos? so far only gotten it to work using in -t domain/user:password@dc-ip

asolino · 2020-07-28T21:10:11Z

Hey @darkoperator

Try:

dpapi.py backupkeys  -k -t domain/user[:password]@target

darkoperator · 2020-07-28T22:32:12Z

that would be for a backup key, looking at decrypting the key against the domain using masterkeys, but learned a new way to pull backup keys that is not NTLM with -k :) when using a TGT I noticed I had to hit enter in backupkeys to get it to use the TGT specified in the environment variable since -no-pass is not used for the backup key but saw there is an open ticket for that. Still a useful reply

darkoperator · 2020-07-28T23:29:18Z

The cases where it is failing for me is when I try to use a ticket and when I try to use aesKey, on the key I see it auth correctly in Wireshark, it reports failure on RPC

arlos@ubuntu:~/Desktop/impacket/examples$ python3 ./dpapi.py masterkey -f /home/carlos/Desktop/S-1-5-21-3150103098-694922503-2167627182-1618/9217d96e-b282-4f6a-b382-c41d938c4e81 -k -t acmelabs.pvt/cperez@dc1.acmelabs.pvt -aesKey f645059e5a83ad131deae4d97eb802bfd6e98ce5f43c8f5cd9279db96e4af0dc
Impacket v0.9.22.dev1+20200713.100928.1e84ad60 - Copyright 2020 SecureAuth Corporation

[MASTERKEYFILE]
Version     :        2 (2)
Guid        : 9217d96e-b282-4f6a-b382-c41d938c4e81
Flags       :        0 (0)
Policy      :        0 (0)
MasterKeyLen: 00000088 (136)
BackupKeyLen: 00000068 (104)
CredHistLen : 00000000 (0)
DomainKeyLen: 00000174 (372)

rpc_s_access_denied
carlos@ubuntu:~/Desktop/impacket/examples$ python3 ./dpapi.py masterkey -f /home/carlos/Desktop/S-1-5-21-3150103098-694922503-2167627182-1618/9217d96e-b282-4f6a-b382-c41d938c4e81 -k -t acmelabs.pvt/cperez@dc1.acmelabs.pvt -aesKey f645059e5a83ad131deae4d97eb802bfd6e98ce5f43c8f5cd9279db96e4af0dc -dc-ip 10.120.120.2
Impacket v0.9.22.dev1+20200713.100928.1e84ad60 - Copyright 2020 SecureAuth Corporation

[MASTERKEYFILE]
Version     :        2 (2)
Guid        : 9217d96e-b282-4f6a-b382-c41d938c4e81
Flags       :        0 (0)
Policy      :        0 (0)
MasterKeyLen: 00000088 (136)
BackupKeyLen: 00000068 (104)
CredHistLen : 00000000 (0)
DomainKeyLen: 00000174 (372)

rpc_s_access_denied
carlos@ubuntu:~/Desktop/impacket/examples$ python3 ./dpapi.py masterkey -f /home/carlos/Desktop/S-1-5-21-3150103098-694922503-2167627182-1618/9217d96e-b282-4f6a-b382-c41d938c4e81 -k -t acmelabs.pvt/cperez@dc1.acmelabs.pvt -no-pass
Impacket v0.9.22.dev1+20200713.100928.1e84ad60 - Copyright 2020 SecureAuth Corporation

[MASTERKEYFILE]
Version     :        2 (2)
Guid        : 9217d96e-b282-4f6a-b382-c41d938c4e81
Flags       :        0 (0)
Policy      :        0 (0)
MasterKeyLen: 00000088 (136)
BackupKeyLen: 00000068 (104)
CredHistLen : 00000000 (0)
DomainKeyLen: 00000174 (372)

Kerberos SessionError: KDC_ERR_PREAUTH_FAILED(Pre-authentication information was invalid)
carlos@ubuntu:~/Desktop/impacket/examples$ python3 ./dpapi.py masterkey -f /home/carlos/Desktop/S-1-5-21-3150103098-694922503-2167627182-1618/9217d96e-b282-4f6a-b382-c41d938c4e81 -k -t acmelabs.pvt/cperez@dc1.acmelabs.pvt -no-pass -dc-ip 10.120.120.2
Impacket v0.9.22.dev1+20200713.100928.1e84ad60 - Copyright 2020 SecureAuth Corporation

[MASTERKEYFILE]
Version     :        2 (2)
Guid        : 9217d96e-b282-4f6a-b382-c41d938c4e81
Flags       :        0 (0)
Policy      :        0 (0)
MasterKeyLen: 00000088 (136)
BackupKeyLen: 00000068 (104)
CredHistLen : 00000000 (0)
DomainKeyLen: 00000174 (372)

Kerberos SessionError: KDC_ERR_PREAUTH_FAILED(Pre-authentication information was invalid)

Any insight on what I could be doing wrong is greatly appreciated

asolino · 2020-07-29T00:27:35Z

Please run it with -debug (you gotta add -debug before the subcommand, in this case masterkey)

darkoperator · 2020-07-29T00:35:32Z

carlos@ubuntu:~/Desktop/impacket/examples$ python3 ./dpapi.py -debug masterkey -f /home/carlos/Desktop/S-1-5-21-3150103098-694922503-2167627182-1618/9217d96e-b282-4f6a-b382-c41d938c4e81 -k -t acmelabs.pvt/cperez@dc1.acmelabs.pvt -no-pass
Impacket v0.9.22.dev1+20200713.100928.1e84ad60 - Copyright 2020 SecureAuth Corporation

[+] Impacket Library Installation Path: /usr/local/lib/python3.8/dist-packages/impacket-0.9.22.dev1+20200713.100928.1e84ad60-py3.8.egg/impacket
[MASTERKEYFILE]
Version     :        2 (2)
Guid        : 9217d96e-b282-4f6a-b382-c41d938c4e81
Flags       :        0 (0)
Policy      :        0 (0)
MasterKeyLen: 00000088 (136)
BackupKeyLen: 00000068 (104)
CredHistLen : 00000000 (0)
DomainKeyLen: 00000174 (372)

[+] Trying to connect to KDC at ACMELABS.PVT
[+] Trying to connect to KDC at ACMELABS.PVT
Traceback (most recent call last):
  File "./dpapi.py", line 536, in <module>
    executer.run()
  File "./dpapi.py", line 290, in run
    dce.connect()
  File "/usr/local/lib/python3.8/dist-packages/impacket-0.9.22.dev1+20200713.100928.1e84ad60-py3.8.egg/impacket/dcerpc/v5/rpcrt.py", line 801, in connect
    return self._transport.connect()
  File "/usr/local/lib/python3.8/dist-packages/impacket-0.9.22.dev1+20200713.100928.1e84ad60-py3.8.egg/impacket/dcerpc/v5/transport.py", line 504, in connect
    self.__smb_connection.kerberosLogin(self._username, self._password, self._domain, self._lmhash,
  File "/usr/local/lib/python3.8/dist-packages/impacket-0.9.22.dev1+20200713.100928.1e84ad60-py3.8.egg/impacket/smbconnection.py", line 361, in kerberosLogin
    raise e
  File "/usr/local/lib/python3.8/dist-packages/impacket-0.9.22.dev1+20200713.100928.1e84ad60-py3.8.egg/impacket/smbconnection.py", line 345, in kerberosLogin
    return self._SMBConnection.kerberosLogin(user, password, domain, lmhash, nthash, aesKey, kdcHost, TGT,
  File "/usr/local/lib/python3.8/dist-packages/impacket-0.9.22.dev1+20200713.100928.1e84ad60-py3.8.egg/impacket/smb3.py", line 654, in kerberosLogin
    tgt, cipher, oldSessionKey, sessionKey = getKerberosTGT(userName, password, domain, lmhash, nthash, aesKey, kdcHost)
  File "/usr/local/lib/python3.8/dist-packages/impacket-0.9.22.dev1+20200713.100928.1e84ad60-py3.8.egg/impacket/krb5/kerberosv5.py", line 299, in getKerberosTGT
    tgt = sendReceive(encoder.encode(asReq), domain, kdcHost)
  File "/usr/local/lib/python3.8/dist-packages/impacket-0.9.22.dev1+20200713.100928.1e84ad60-py3.8.egg/impacket/krb5/kerberosv5.py", line 78, in sendReceive
    raise krbError
impacket.krb5.kerberosv5.KerberosError: Kerberos SessionError: KDC_ERR_PREAUTH_FAILED(Pre-authentication information was invalid)
Kerberos SessionError: KDC_ERR_PREAUTH_FAILED(Pre-authentication information was invalid)
carlos@ubuntu:~/Desktop/impacket/examples$ python3 ./dpapi.py -debug masterkey -f /home/carlos/Desktop/S-1-5-21-3150103098-694922503-2167627182-1618/9217d96e-b282-4f6a-b382-c41d938c4e81 -k -t acmelabs.pvt/cperez@dc1.acmelabs.pvt -aesKey f645059e5a83ad131deae4d97eb802bfd6e98ce5f43c8f5cd9279db96e4af0dc
Impacket v0.9.22.dev1+20200713.100928.1e84ad60 - Copyright 2020 SecureAuth Corporation

[+] Impacket Library Installation Path: /usr/local/lib/python3.8/dist-packages/impacket-0.9.22.dev1+20200713.100928.1e84ad60-py3.8.egg/impacket
[MASTERKEYFILE]
Version     :        2 (2)
Guid        : 9217d96e-b282-4f6a-b382-c41d938c4e81
Flags       :        0 (0)
Policy      :        0 (0)
MasterKeyLen: 00000088 (136)
BackupKeyLen: 00000068 (104)
CredHistLen : 00000000 (0)
DomainKeyLen: 00000174 (372)

[+] Trying to connect to KDC at ACMELABS.PVT
[+] Trying to connect to KDC at ACMELABS.PVT
[+] Trying to connect to KDC at ACMELABS.PVT
Traceback (most recent call last):
  File "./dpapi.py", line 536, in <module>
    executer.run()
  File "./dpapi.py", line 299, in run
    resp = dce.request(request)
  File "/usr/local/lib/python3.8/dist-packages/impacket-0.9.22.dev1+20200713.100928.1e84ad60-py3.8.egg/impacket/dcerpc/v5/rpcrt.py", line 857, in request
    answer = self.recv()
  File "/usr/local/lib/python3.8/dist-packages/impacket-0.9.22.dev1+20200713.100928.1e84ad60-py3.8.egg/impacket/dcerpc/v5/rpcrt.py", line 1321, in recv
    raise DCERPCException(rpc_status_codes[status_code])
impacket.dcerpc.v5.rpcrt.DCERPCException: rpc_s_access_denied
rpc_s_access_denied

Should help on #739 (comment)

asolino · 2020-07-29T02:04:45Z

@darkoperator, please git pull and test. If it doesn't work please open an issue.

darkoperator · 2020-07-29T02:27:29Z

worked beutifully! thanks

asolino merged commit bdf2e3d into fortra:master Jan 3, 2020

asolino added a commit that referenced this pull request Jul 29, 2020

Enforce RPC_C_AUTHN_GSS_NEGOTIATE when using Kerberos.

48a3124

Should help on #739 (comment)

Navigation Menu

Uh oh!

dpapi.py Add RPC masterkey decryption - #739

dpapi.py Add RPC masterkey decryption#739
asolino merged 1 commit into
fortra:masterfrom
imaibou:imaibou-dpapi-rpc

imaibou commented Jan 3, 2020

Uh oh!

asolino commented Jan 3, 2020

Uh oh!

darkoperator commented Jul 28, 2020

Uh oh!

asolino commented Jul 28, 2020

Uh oh!

darkoperator commented Jul 28, 2020

Uh oh!

darkoperator commented Jul 28, 2020

Uh oh!

asolino commented Jul 29, 2020

Uh oh!

darkoperator commented Jul 29, 2020

Uh oh!

asolino commented Jul 29, 2020

Uh oh!

darkoperator commented Jul 29, 2020

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

imaibou commented Jan 3, 2020

Uh oh!

asolino commented Jan 3, 2020

Uh oh!

darkoperator commented Jul 28, 2020

Uh oh!

asolino commented Jul 28, 2020

Uh oh!

darkoperator commented Jul 28, 2020

Uh oh!

darkoperator commented Jul 28, 2020

Uh oh!

asolino commented Jul 29, 2020

Uh oh!

darkoperator commented Jul 29, 2020

Uh oh!

asolino commented Jul 29, 2020

Uh oh!

darkoperator commented Jul 29, 2020

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants