Add parsing for 'Export' hives and boot key computation from class names #1840
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
This PR enables the parsing of registry hive files exported using
regedit.exe
orreg.exe export
, along with the manual computation of the boot key. This functionality allowssecretsdump.py
to dump SAM and LSA secrets from these files.registry-read.py / winregistry.py
The registry files exported via
regedit
areUTF-16 LE
text files, which differ from the binary format produced byreg save
. I implemented a parser inwinregistry.py
to handle these exported text files, and they can now be read usingregistry-read.py
with the-format export
option.Boot key recovery
In
secretsdump.py
, boot key recovery typically relies on extracting class names from four specific registry keys within the LSA hive. However, the "export" hive format does not contain this metadata, making it impossible to retrieve the class names directly. You can recover the class names using two techniques outlined in the article “Dumping LSA secrets: a story about task decorrelation” written by @Dfte which inspired this PR.Once you recover the class names, you can compute the
bootKey
using the following flags:secretsdump.py
I introduced the
-sam-export
and-security-export
flags to support dumping SAM and LSA secrets from these exported registry files: