-
Notifications
You must be signed in to change notification settings - Fork 54
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add windows credhist plugin #566
Conversation
RE: Passing the output to DPAPI,
I think I'd prefer the first option, as it is a nice way to interface credentials between plugins, but I'd like to hear one of the maintainers thoughts about this first. |
@cobyge option 1 is at least preferred for providing the "initial"/current password, as is currently in review in #541. While it would be nice, I don't immediately see a nice way how CREDHIST could provide passwords to the keychain (it would need to be invoked somehow). You could make something similar to how we have "child plugins", i.e. "keychain plugins" and bind a keychain to a target (instead of being global right now). But that feels a bit overkill, at least for the moment where we would only have a single plugin for it. I'm more than happy to hear some ideas for this, but for complexity sake, option 2 might otherwise be preferred. |
Co-authored-by: Erik Schamper <1254028+Schamper@users.noreply.github.com>
always use `sha` and `nt`
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Can you also rebase onto main.
Co-authored-by: Erik Schamper <1254028+Schamper@users.noreply.github.com>
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #566 +/- ##
==========================================
- Coverage 74.99% 73.37% -1.63%
==========================================
Files 288 289 +1
Lines 24192 24295 +103
==========================================
- Hits 18143 17826 -317
- Misses 6049 6469 +420
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
This PR adds support for decrypting CREDHIST entries on Windows targets.
Currently supports decrypting full and partial CREDHIST chains and can tell you if the decryption worked or not. Does not (yet) provide decrypted SHA1 hashes to the DPAPI plugin. Perhaps @cobyge can tell us where it's best to implement this.