forked from gentilkiwi/mimikatz
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathkull_m_cred.h
291 lines (234 loc) · 8.15 KB
/
kull_m_cred.h
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
/* Benjamin DELPY `gentilkiwi`
https://blog.gentilkiwi.com
Licence : https://creativecommons.org/licenses/by/4.0/
*/
#pragma once
#include "globals.h"
#include "kull_m_dpapi.h"
#include "kull_m_string.h"
const wchar_t KULL_M_CRED_ENTROPY_CRED_DER[37];
const wchar_t KULL_M_CRED_ENTROPYDOM_CRED_DER[37];
#pragma pack(push, 1)
typedef struct _KULL_M_CRED_VAULT_CREDENTIAL_ATTRIBUTE {
DWORD id;
DWORD unk0; // maybe flags
DWORD unk1; // maybe type
DWORD unk2; // 0a 00 00 00
//DWORD unkComplex; // only in complex (and 0, avoid it ?)
DWORD szData; // when parsing, inc bullshit... clean in structure
PBYTE data;
DWORD szIV;
PBYTE IV;
} KULL_M_CRED_VAULT_CREDENTIAL_ATTRIBUTE, *PKULL_M_CRED_VAULT_CREDENTIAL_ATTRIBUTE;
#pragma pack(pop)
#pragma pack(push, 4)
typedef struct _KULL_M_CRED_ATTRIBUTE {
DWORD Flags;
DWORD dwKeyword;
LPWSTR Keyword;
DWORD ValueSize;
LPBYTE Value;
} KULL_M_CRED_ATTRIBUTE, *PKULL_M_CRED_ATTRIBUTE;
typedef struct _KULL_M_CRED_BLOB {
DWORD credFlags;
DWORD credSize;
DWORD credUnk0;
DWORD Type;
DWORD Flags;
FILETIME LastWritten;
DWORD unkFlagsOrSize;
DWORD Persist;
DWORD AttributeCount;
DWORD unk0;
DWORD unk1;
DWORD dwTargetName;
LPWSTR TargetName;
DWORD dwTargetAlias;
LPWSTR TargetAlias;
DWORD dwComment;
LPWSTR Comment;
DWORD dwUnkData;
LPWSTR UnkData;
DWORD dwUserName;
LPWSTR UserName;
DWORD CredentialBlobSize;
LPBYTE CredentialBlob;
PKULL_M_CRED_ATTRIBUTE *Attributes;
} KULL_M_CRED_BLOB, *PKULL_M_CRED_BLOB;
typedef struct _KULL_M_CRED_LEGACY_CRED_BLOB {
DWORD credSize;
DWORD Flags;
DWORD Type;
FILETIME LastWritten;
DWORD unkFlagsOrSize;
DWORD Persist;
DWORD AttributeCount;
DWORD unk0;
DWORD unk1;
DWORD dwTargetName;
LPWSTR TargetName;
DWORD dwComment;
LPWSTR Comment;
DWORD dwTargetAlias;
LPWSTR TargetAlias;
DWORD dwUserName;
LPWSTR UserName;
DWORD CredentialBlobSize;
LPBYTE CredentialBlob;
PKULL_M_CRED_ATTRIBUTE *Attributes;
} KULL_M_CRED_LEGACY_CRED_BLOB, *PKULL_M_CRED_LEGACY_CRED_BLOB;
typedef struct _KULL_M_CRED_LEGACY_CREDS_BLOB {
DWORD dwVersion;
DWORD structSize;
DWORD __count;
PKULL_M_CRED_LEGACY_CRED_BLOB *Credentials;
} KULL_M_CRED_LEGACY_CREDS_BLOB, *PKULL_M_CRED_LEGACY_CREDS_BLOB;
typedef struct _KULL_M_CRED_VAULT_POLICY_KEY {
GUID unk0;
GUID unk1;
DWORD dwKeyBlob;
PVOID KeyBlob;
} KULL_M_CRED_VAULT_POLICY_KEY, *PKULL_M_CRED_VAULT_POLICY_KEY;
typedef struct _KULL_M_CRED_VAULT_POLICY {
DWORD version;
GUID vault;
DWORD dwName;
LPWSTR Name;
DWORD unk0;
DWORD unk1;
DWORD unk2;
DWORD dwKey;
PKULL_M_CRED_VAULT_POLICY_KEY key;
} KULL_M_CRED_VAULT_POLICY, *PKULL_M_CRED_VAULT_POLICY;
typedef struct _KULL_M_CRED_VAULT_CREDENTIAL_ATTRIBUTE_MAP {
DWORD id;
DWORD offset; //maybe 64
DWORD unk;
} KULL_M_CRED_VAULT_CREDENTIAL_ATTRIBUTE_MAP, *PKULL_M_CRED_VAULT_CREDENTIAL_ATTRIBUTE_MAP;
typedef struct _KULL_M_CRED_VAULT_CREDENTIAL {
GUID SchemaId;
DWORD unk0; // 4
FILETIME LastWritten;
DWORD unk1; // ffffffff
DWORD unk2; // flags ?
DWORD dwFriendlyName;
LPWSTR FriendlyName;
DWORD dwAttributesMapSize;
PKULL_M_CRED_VAULT_CREDENTIAL_ATTRIBUTE_MAP attributesMap;
DWORD __cbElements;
PKULL_M_CRED_VAULT_CREDENTIAL_ATTRIBUTE *attributes;
} KULL_M_CRED_VAULT_CREDENTIAL, *PKULL_M_CRED_VAULT_CREDENTIAL;
typedef struct _KULL_M_CRED_VAULT_CLEAR_ENTRY {
DWORD id;
DWORD size;
BYTE data[ANYSIZE_ARRAY];
} KULL_M_CRED_VAULT_CLEAR_ENTRY, *PKULL_M_CRED_VAULT_CLEAR_ENTRY;
typedef struct _KULL_M_CRED_VAULT_CLEAR {
DWORD version;
DWORD count;
DWORD unk;
PKULL_M_CRED_VAULT_CLEAR_ENTRY *entries;
} KULL_M_CRED_VAULT_CLEAR, *PKULL_M_CRED_VAULT_CLEAR;
#pragma pack(pop)
typedef struct _KULL_M_CRED_APPSENSE_DN {
char type[12];
DWORD credBlobSize;
DWORD unkBlobSize;
BYTE data[ANYSIZE_ARRAY];
} KULL_M_CRED_APPSENSE_DN, *PKULL_M_CRED_APPSENSE_DN;
PKULL_M_CRED_BLOB kull_m_cred_create(PVOID data/*, DWORD size*/);
void kull_m_cred_delete(PKULL_M_CRED_BLOB cred);
void kull_m_cred_descr(DWORD level, PKULL_M_CRED_BLOB cred);
BOOL kull_m_cred_attributes_create(PVOID data, PKULL_M_CRED_ATTRIBUTE **Attributes, DWORD count);
void kull_m_cred_attributes_delete(PKULL_M_CRED_ATTRIBUTE *Attributes, DWORD count);
void kull_m_cred_attributes_descr(DWORD level, PKULL_M_CRED_ATTRIBUTE *Attributes, DWORD count);
PKULL_M_CRED_ATTRIBUTE kull_m_cred_attribute_create(PVOID data/*, DWORD size*/);
void kull_m_cred_attribute_delete(PKULL_M_CRED_ATTRIBUTE Attribute);
void kull_m_cred_attribute_descr(DWORD level, PKULL_M_CRED_ATTRIBUTE Attribute);
PKULL_M_CRED_LEGACY_CREDS_BLOB kull_m_cred_legacy_creds_create(PVOID data/*, DWORD size*/);
void kull_m_cred_legacy_creds_delete(PKULL_M_CRED_LEGACY_CREDS_BLOB creds);
void kull_m_cred_legacy_creds_descr(DWORD level, PKULL_M_CRED_LEGACY_CREDS_BLOB creds);
PKULL_M_CRED_LEGACY_CRED_BLOB kull_m_cred_legacy_cred_create(PVOID data/*, DWORD size*/);
void kull_m_cred_legacy_cred_delete(PKULL_M_CRED_LEGACY_CRED_BLOB cred);
void kull_m_cred_legacy_cred_descr(DWORD level, PKULL_M_CRED_LEGACY_CRED_BLOB cred);
PCWCHAR kull_m_cred_CredType(DWORD type);
PCWCHAR kull_m_cred_CredPersist(DWORD persist);
PKULL_M_CRED_VAULT_POLICY kull_m_cred_vault_policy_create(PVOID data/*, DWORD size*/);
void kull_m_cred_vault_policy_delete(PKULL_M_CRED_VAULT_POLICY policy);
void kull_m_cred_vault_policy_descr(DWORD level, PKULL_M_CRED_VAULT_POLICY policy);
PKULL_M_CRED_VAULT_POLICY_KEY kull_m_cred_vault_policy_key_create(PVOID data/*, DWORD size*/);
void kull_m_cred_vault_policy_key_delete(PKULL_M_CRED_VAULT_POLICY_KEY key);
void kull_m_cred_vault_policy_key_descr(DWORD level, PKULL_M_CRED_VAULT_POLICY_KEY key);
PKULL_M_CRED_VAULT_CREDENTIAL kull_m_cred_vault_credential_create(PVOID data/*, DWORD size*/);
void kull_m_cred_vault_credential_create_attribute_from_data(PBYTE ptr, PKULL_M_CRED_VAULT_CREDENTIAL_ATTRIBUTE attribute);
void kull_m_cred_vault_credential_delete(PKULL_M_CRED_VAULT_CREDENTIAL credential);
void kull_m_cred_vault_credential_descr(DWORD level, PKULL_M_CRED_VAULT_CREDENTIAL credential);
void kull_m_cred_vault_credential_attribute_descr(DWORD level, PKULL_M_CRED_VAULT_CREDENTIAL_ATTRIBUTE attribute);
PKULL_M_CRED_VAULT_CLEAR kull_m_cred_vault_clear_create(PVOID data/*, DWORD size*/);
void kull_m_cred_vault_clear_delete(PKULL_M_CRED_VAULT_CLEAR clear);
void kull_m_cred_vault_clear_descr(DWORD level, PKULL_M_CRED_VAULT_CLEAR clear);
/*
24 00 00 00
01 00 00 00
02 00 00 00
4b 44 42 4d KDBM 'MBDK'
01 00 00 00
10 00 00 00
xx xx xx (16)
34 00 00 00
01 00 00 00
01 00 00 00
4b 44 42 4d KDBM 'MBDK'
01 00 00 00
20 00 00 00
xx xx xx (32)
*/
typedef struct _KULL_M_CRED_VAULT_POLICY_KEY_MBDK {
DWORD keySize;
DWORD version;
DWORD type; // ?
DWORD tag;
DWORD unk0;
KIWI_HARD_KEY key;
} KULL_M_CRED_VAULT_POLICY_KEY_MBDK, *PKULL_M_CRED_VAULT_POLICY_KEY_MBDK;
/*
38 02 00 00
01 00 00 00
02 00 00 00
30 02 00 00
4b 53 53 4d KSSM 'MSSK'
02 00 01 00
01 00 00 00
10 00 00 00
80 00 00 00 (128)
10 00 00 00
xx xx xx (16)
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
xx xx xx (16)
yy yy yy (..)
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
a0 00 00 00
40 01 00 00
00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00
38 02 00 00
01 00 00 00
01 00 00 00
30 02 00 00
4b 53 53 4d KSSM 'MSSK'
02 00 01 00
01 00 00 00
10 00 00 00
00 01 00 00 (256)
20 00 00 00 (32)
xx xx xx (32)
00 00 00 00
xx xx xx (32)
yy yy yy (..)
e0 00 00 00
c0 01 00 00
00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00
*/
BOOL kull_m_cred_vault_policy_key(PVOID data, DWORD size, BYTE aes128[AES_128_KEY_SIZE], BYTE aes256[AES_256_KEY_SIZE]);