157 lines
5.0 KiB
Bash
Executable File
157 lines
5.0 KiB
Bash
Executable File
#!/bin/bash
|
|
#===============================================================================
|
|
#
|
|
# DIRECTORY:
|
|
# /home/*/.local/share/nautilus/scripts/05a-Windows/
|
|
# OR
|
|
# /home/*/.gnome2/nautilus-sctipts/05a-Windows/ (deprecated)
|
|
#
|
|
# FILE:
|
|
# 05-E01-pwdump
|
|
#
|
|
# USAGE:
|
|
# Right click on a EWF image (.E01) and
|
|
# choose this nautilus script from the context menu.
|
|
#
|
|
# OPTIONS:
|
|
# none
|
|
#
|
|
# DESCRIPTION:
|
|
# Extracts the Hashes from older and newer Windows versions in pwdump format.
|
|
#
|
|
# REQUIREMENTS:
|
|
# bash, zenity, awk, sleuthkit and sed
|
|
#
|
|
# BUGS:
|
|
# ---
|
|
#
|
|
# NOTES:
|
|
# Tested on
|
|
# - Debian 8+
|
|
# - Arch Linux
|
|
#
|
|
# AUTHOR:
|
|
# Patrick Neumann, patrick@neumannsland.de
|
|
#
|
|
# COMPANY:
|
|
# (privately)
|
|
#
|
|
# VERSION:
|
|
# 0.9 (beta)
|
|
#
|
|
# LINK TO THE MOST CURRENT VERSIONS:
|
|
# https://...
|
|
#
|
|
# CREATED:
|
|
# 21.03.2020
|
|
#
|
|
# COPYRIGHT (C):
|
|
# 2015-2020 - Patrick Neumann
|
|
#
|
|
# LICENSE:
|
|
# This program is free software: you can redistribute it and/or modify
|
|
# it under the terms of the GNU General Public License as published by
|
|
# the Free Software Foundation, either version 3 of the License, or
|
|
# (at your option) any later version.
|
|
#
|
|
# WARRANTY:
|
|
# This program is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU General Public License
|
|
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
#
|
|
# TODO:
|
|
# ----
|
|
#
|
|
# HISTORY:
|
|
# 0.9 - Patrick Neumann - Initial (public) release
|
|
#
|
|
#===============================================================================
|
|
|
|
#-------------------------------------------------------------------------------
|
|
# Additional supported Distribution(s) (add before Library!).
|
|
#-------------------------------------------------------------------------------
|
|
# fred-report-templates have to be copied manually to!
|
|
SUPPORTED_OSR="arch"
|
|
|
|
#-------------------------------------------------------------------------------
|
|
# Check for library (casualscripter_nautilus-scripts_functions.sh).
|
|
#-------------------------------------------------------------------------------
|
|
readonly LIBRARY="${0%/*/*}/.casualscripter_nautilus-scripts_functions.sh"
|
|
if [ ! -f "${LIBRARY}" ] ; then
|
|
zenity --error \
|
|
--text \
|
|
"ERROR: casualscripter_nautilus-scripts_functions.sh MISSING!"
|
|
exit 1
|
|
fi
|
|
|
|
source "${LIBRARY}"
|
|
|
|
#-------------------------------------------------------------------------------
|
|
# Checks (see library "casualscripter_nautilus-scripts_functions.sh").
|
|
#-------------------------------------------------------------------------------
|
|
check_dep "${AWK_BIN}" "awk"
|
|
check_dep "${FCAT_BIN}" "sleuthkit"
|
|
check_dep "${SED_BIN}" "sed"
|
|
|
|
# problem:
|
|
# samdump (ophcrack) is not working since Windows 10 1607 anymore!
|
|
# explanation:
|
|
# http://www.insecurity.be/blog/2018/01/21/retrieving-ntlm-hashes-and-what-changed-technical-writeup/
|
|
# solution:
|
|
# https://github.com/ict/creddump7 (incl. Python 3 support!)
|
|
check_dep "${PWDUMP_BIN}" "pwdump.py"
|
|
|
|
check_ext "${SOURCE}" "[eE]01"
|
|
|
|
check_tmp
|
|
|
|
#-------------------------------------------------------------------------------
|
|
# A little bit of configuration before the magic.
|
|
#-------------------------------------------------------------------------------
|
|
readonly OFFSET="$( choose_partition "${SOURCE}" | ${AWK_BIN} -F "_" '{ print $3; }' )"
|
|
|
|
readonly SYSTEM_HIVE="${TMP}/${OFFSET}-SYSTEM.hive"
|
|
readonly SAM_HIVE="${TMP}/${OFFSET}-SAM.hive"
|
|
readonly PWDUMP="${TMP}/pwdump-${OFFSET}.txt"
|
|
|
|
#-------------------------------------------------------------------------------
|
|
# ...
|
|
#-------------------------------------------------------------------------------
|
|
if [ ! -f "${PWDUMP}" ] ; then
|
|
if ! [ -f "${SYSTEM_HIVE}" ] ; then
|
|
${FCAT_BIN} -o "${OFFSET}" "/Windows/System32/config/SYSTEM" "${SOURCE}" > "${SYSTEM_HIVE}"
|
|
fi
|
|
|
|
if ! [ -f "${SAM_HIVE}" ] ; then
|
|
${FCAT_BIN} -o "${OFFSET}" "/Windows/System32/config/SAM" "${SOURCE}" > "${SAM_HIVE}"
|
|
fi
|
|
|
|
if ! [ -s "${SYSTEM_HIVE}" ] ; then
|
|
${RM_BIN} "${SYSTEM_HIVE}" "${SAM_HIVE}"
|
|
error_exit "no usable registry hives found"
|
|
fi
|
|
|
|
${PWDUMP_BIN} "${SYSTEM_HIVE}" "${SAM_HIVE}" > "${PWDUMP}"
|
|
|
|
# cleanup some default/global/empty accounts...
|
|
${SED_BIN} --in-place '/DefaultAccount/ d' "${PWDUMP}"
|
|
${SED_BIN} --in-place '/WDAGUtilityAccount/ d' "${PWDUMP}"
|
|
${SED_BIN} --in-place '/HomeGroupUser/ d' "${PWDUMP}"
|
|
${SED_BIN} --in-place '/UpdatusUser/ d' "${PWDUMP}" # added by older nVidia graphic drivers
|
|
${SED_BIN} --in-place '/31d6cfe0d16ae931b73c59d7e0c089c0/ d' "${PWDUMP}" # empty password
|
|
fi | ${ZENITY_BIN} --progress \
|
|
--title="pwdump" \
|
|
--text="Please wait..." \
|
|
--pulsate
|
|
|
|
#-------------------------------------------------------------------------------
|
|
# Display content of the resultfile "pwdump.txt".
|
|
#-------------------------------------------------------------------------------
|
|
display_resultfile "${PWDUMP}"
|
|
|
|
exit 0
|