def run_category(category_selected, subcategories={}, system_module=False): constant.module_to_exec_at_end = { "winapi": [], "dpapi": [], } modules = create_module_dic() categories = [category_selected] if category_selected != 'all' else get_categories() for category in categories: for r in run_modules(modules[category], subcategories, system_module): yield r if not system_module: if constant.is_current_user: # Modules using Windows API (CryptUnprotectData) can be called from the current session for module in constant.module_to_exec_at_end.get('winapi', []): for m in run_module(title=module['title'], module=module['module']): yield m if constant.module_to_exec_at_end.get('dpapi', []): if are_masterkeys_retrieved(): for module in constant.module_to_exec_at_end.get('dpapi', []): for m in run_module(title=module['title'], module=module['module']): yield m else: if constant.module_to_exec_at_end.get('dpapi', []) or constant.module_to_exec_at_end.get('winapi', []): if are_masterkeys_retrieved(): # Execute winapi/dpapi modules - winapi decrypt blob using dpapi without calling CryptUnprotectData for i in ['winapi', 'dpapi']: for module in constant.module_to_exec_at_end.get(i, []): for m in run_module(title=module['title'], module=module['module']): yield m
def run_category(category_selected, subcategories={}, system_module=False): constant.module_to_exec_at_end = { "winapi": [], "dpapi": [], } modules = create_module_dic() categories = [category_selected] if category_selected != 'all' else get_categories() for category in categories: for r in run_modules(modules[category], subcategories, system_module): yield r if not system_module: if constant.is_current_user: # Modules using Windows API (CryptUnprotectData) can be called from the current session for module in constant.module_to_exec_at_end.get('winapi', []): for m in run_module(title=module['title'], module=module['module']): yield m if constant.module_to_exec_at_end.get('dpapi', []): if are_masterkeys_retrieved(): for module in constant.module_to_exec_at_end.get('dpapi', []): for m in run_module(title=module['title'], module=module['module']): yield m else: if constant.module_to_exec_at_end.get('dpapi', []) or constant.module_to_exec_at_end.get('winapi', []): if are_masterkeys_retrieved(): # Execute winapi/dpapi modules - winapi decrypt blob using dpapi without calling CryptUnprotectData for i in ['winapi', 'dpapi']: for module in constant.module_to_exec_at_end.get(i, []): for m in run_module(title=module['title'], module=module['module']): yield m
def Win32CryptUnprotectData(cipherText, entropy=False, is_current_user=True, user_dpapi=False): if python_version == 2: cipherText = str(cipherText) decrypted = None if is_current_user: bufferIn = c_buffer(cipherText, len(cipherText)) blobIn = DATA_BLOB(len(cipherText), bufferIn) blobOut = DATA_BLOB() if entropy: bufferEntropy = c_buffer(entropy, len(entropy)) blobEntropy = DATA_BLOB(len(entropy), bufferEntropy) if CryptUnprotectData(byref(blobIn), None, byref(blobEntropy), None, None, 0, byref(blobOut)): decrypted = getData(blobOut) else: if CryptUnprotectData(byref(blobIn), None, None, None, None, 0, byref(blobOut)): decrypted = getData(blobOut) if not decrypted: can_decrypt = True if not (user_dpapi and user_dpapi.unlocked): from lazagne.config.dpapi_structure import are_masterkeys_retrieved can_decrypt = are_masterkeys_retrieved() if can_decrypt: try: decrypted = user_dpapi.decrypt_encrypted_blob(cipherText) except: # The encrypted blob cannot be parsed - weird (could happen with chrome v80) return None if decrypted is False: decrypted = None else: # raise ValueError('MasterKeys not found') pass if not decrypted: if not user_dpapi: # raise ValueError('DPApi unavailable') pass elif not user_dpapi.unlocked: # raise ValueError('DPApi locked') pass return decrypted