#!/bin/bash
#===============================================================================
#
# DIRECTORY:
#   /home/*/.local/share/nautilus/scripts/05a-Windows/
# OR
#   /home/*/.gnome2/nautilus-sctipts/05a-Windows/ (deprecated)
#
# FILE:
#   05-E01-pwdump
#
# USAGE:
#   Right click on a EWF image (.E01) and
#   choose this nautilus script from the context menu.
#
# OPTIONS:
#   none
#
# DESCRIPTION:
#   Extracts the Hashes from older and newer Windows versions in pwdump format.
#
# REQUIREMENTS:
#   bash, zenity, awk, sleuthkit and sed
#
# BUGS:
#   ---
#
# NOTES:
#   Tested on
#   - Debian 8+
#   - Arch Linux
#
# AUTHOR:
#   Patrick Neumann, patrick@neumannsland.de
#
# COMPANY:
#   (privately)
#
# VERSION:
#   0.9 (beta)
#
# LINK TO THE MOST CURRENT VERSIONS:
#   https://...
#
# CREATED:
#   21.03.2020
#
# COPYRIGHT (C):
#   2015-2020 - Patrick Neumann
#
# LICENSE:
#   This program is free software: you can redistribute it and/or modify
#   it under the terms of the GNU General Public License as published by
#   the Free Software Foundation, either version 3 of the License, or
#   (at your option) any later version.
#
# WARRANTY:
#   This program is distributed in the hope that it will be useful,
#   but WITHOUT ANY WARRANTY; without even the implied warranty of
#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#   GNU General Public License for more details.
#
#   You should have received a copy of the GNU General Public License
#   along with this program. If not, see <http://www.gnu.org/licenses/>.
#
# TODO:
#   ----
#
# HISTORY:
#   0.9 - Patrick Neumann - Initial (public) release
#
#===============================================================================

#-------------------------------------------------------------------------------
# Additional supported Distribution(s) (add before Library!).
#-------------------------------------------------------------------------------
# fred-report-templates have to be copied manually to!
SUPPORTED_OSR="arch"

#-------------------------------------------------------------------------------
# Check for library (casualscripter_nautilus-scripts_functions.sh).
#-------------------------------------------------------------------------------
readonly LIBRARY="${0%/*/*}/.casualscripter_nautilus-scripts_functions.sh"
if [ ! -f "${LIBRARY}" ] ; then
  zenity --error \
         --text \
         "ERROR: casualscripter_nautilus-scripts_functions.sh MISSING!"
  exit 1
fi

source "${LIBRARY}"

#-------------------------------------------------------------------------------
# Checks (see library "casualscripter_nautilus-scripts_functions.sh").
#-------------------------------------------------------------------------------
check_dep "${AWK_BIN}" "awk"
check_dep "${FCAT_BIN}" "sleuthkit"
check_dep "${SED_BIN}" "sed"

# problem:
#   samdump (ophcrack) is not working since Windows 10 1607 anymore!
# explanation:
#   http://www.insecurity.be/blog/2018/01/21/retrieving-ntlm-hashes-and-what-changed-technical-writeup/
# solution:
#   https://github.com/ict/creddump7 (incl. Python 3 support!)
check_dep "${PWDUMP_BIN}" "pwdump.py"

check_ext "${SOURCE}" "[eE]01"

check_tmp

#-------------------------------------------------------------------------------
# A little bit of configuration before the magic.
#-------------------------------------------------------------------------------
readonly OFFSET="$( choose_partition "${SOURCE}" | ${AWK_BIN} -F "_" '{ print $3; }' )"

readonly SYSTEM_HIVE="${TMP}/${OFFSET}-SYSTEM.hive"
readonly SAM_HIVE="${TMP}/${OFFSET}-SAM.hive"
readonly PWDUMP="${TMP}/pwdump-${OFFSET}.txt"

#-------------------------------------------------------------------------------
# ...
#-------------------------------------------------------------------------------
if [ ! -f "${PWDUMP}" ] ; then
  if ! [ -f "${SYSTEM_HIVE}" ] ; then
    ${FCAT_BIN} -o "${OFFSET}" "/Windows/System32/config/SYSTEM" "${SOURCE}" > "${SYSTEM_HIVE}"
  fi

  if ! [ -f "${SAM_HIVE}" ] ; then
    ${FCAT_BIN} -o "${OFFSET}" "/Windows/System32/config/SAM" "${SOURCE}" > "${SAM_HIVE}"
  fi

  if ! [ -s "${SYSTEM_HIVE}" ] ; then
    ${RM_BIN} "${SYSTEM_HIVE}" "${SAM_HIVE}"
    error_exit "no usable registry hives found"
  fi

  ${PWDUMP_BIN} "${SYSTEM_HIVE}" "${SAM_HIVE}" > "${PWDUMP}"

  # cleanup some default/global/empty accounts...
  ${SED_BIN} --in-place '/DefaultAccount/ d' "${PWDUMP}"
  ${SED_BIN} --in-place '/WDAGUtilityAccount/ d' "${PWDUMP}"
  ${SED_BIN} --in-place '/HomeGroupUser/ d' "${PWDUMP}"
  ${SED_BIN} --in-place '/UpdatusUser/ d' "${PWDUMP}" # added by older nVidia graphic drivers
  ${SED_BIN} --in-place '/31d6cfe0d16ae931b73c59d7e0c089c0/ d' "${PWDUMP}" # empty password
fi | ${ZENITY_BIN} --progress \
                   --title="pwdump" \
                   --text="Please wait..." \
                   --pulsate

#-------------------------------------------------------------------------------
# Display content of the resultfile "pwdump.txt".
#-------------------------------------------------------------------------------
display_resultfile "${PWDUMP}"

exit 0