Windows Secrets Dump: Enable inline credentials dump

[cdelafuente-r7]

This improves the Windows Secrets Dump module by retrieving the credentials without touching the disk. This is based on this Impacket PR.

This technique takes advantage of the WriteDACL privileges held by local administrators to set temporary read permissions on the SAM and SECURITY registry hives. With this, it is not necessary to write these hives to disk and parse them, like it was with the original implementation.

This technique is enabled by default and can be disable by setting the INLINE option to false.

The logic has been delegated to a new class Msf::Util::WindowsRegistry::RemoteRegistry, which takes care of setting the registry key security descriptor (DACL) to give enough permission to read it. It also takes care of restoring the original security descriptor immediately after the read operation. It also takes care of backing it up to a local file in case the restoring operation fails for some reason. The user will be able to restore it manually using a separate module, which will be added soon.

⚠️ Important ⚠️
These changes need this RubySMB related PR to be landed to work.

Verification

List the steps needed to make sure this thing works

• Start msfconsole
• use auxiliary/gather/windows_secrets_dump
• run rhost=<remote host> smbuser=<username> smbpass=<user's password> verbose=true
• Verify the security descriptor is correctly set on the registry keys
• Verify the SAM and SECURITY hives are read correctly and the module retrieves the credentials the same way it does without this technique
• Verify the original unmodified security descriptor are correctly restored on the registry keys. This can be observed in the MSF logs.
• Re-run the module with inline=false
• Verify the results are the same as with the inline technique enabled

[cdelafuente-r7]

Thanks @smcintyre-r7 for your review. I believe I answered to all your comments and made the requested changes.

[smcintyre-r7]

I just finished testing the latest changes and everything appears to be working correctly. I checked running the module with the INLINE option both enabled and disabled. Each time, I confirmed with process monitor that the temporary file was online written when INLINE=false.

I think this is ready to go.

[smcintyre-r7]

Release Notes

This updates the windows_secrets_dump module to enable accessing the necessary registry data without writing it to disk first.