Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add parsing for 'Export' hives and boot key computation from class names #1840

Open
wants to merge 4 commits into
base: master
Choose a base branch
from

Conversation

MaxToffy
Copy link

Summary

This PR enables the parsing of registry hive files exported using regedit.exe or reg.exe export, along with the manual computation of the boot key. This functionality allows secretsdump.py to dump SAM and LSA secrets from these files.

registry-read.py / winregistry.py

The registry files exported via regedit are UTF-16 LE text files, which differ from the binary format produced by reg save. I implemented a parser in winregistry.py to handle these exported text files, and they can now be read using registry-read.py with the -format export option.

exportFormat

registryRead

Boot key recovery

In secretsdump.py, boot key recovery typically relies on extracting class names from four specific registry keys within the LSA hive. However, the "export" hive format does not contain this metadata, making it impossible to retrieve the class names directly. You can recover the class names using two techniques outlined in the article “Dumping LSA secrets: a story about task decorrelation” written by @Dfte which inspired this PR.

Once you recover the class names, you can compute the bootKey using the following flags:

getBootKey

secretsdump.py

I introduced the -sam-export and -security-export flags to support dumping SAM and LSA secrets from these exported registry files:

dumping

@Dfte
Copy link

Dfte commented Oct 21, 2024

MAN THIS IS SO HOOOOOOOOOT !!! Thanks you for that PR!!

@anadrianmanrique anadrianmanrique added the medium Medium priority item label Oct 25, 2024
MaxToffy and others added 2 commits October 30, 2024 14:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
medium Medium priority item
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants