How to use the pypykatz.logger.debug function in pypykatz

To help you get started, we’ve selected a few pypykatz examples, based on popular ways it is used in public projects.

Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.

github skelsec / pypykatz / pypykatz / commons / winapi / processmanipulator.py View on Github external
def set_privilege(self, privilige_id, thread_or_process = False):
		"""
		Sets a given privilege
		"""
		logger.debug('[ProcessManipulator] Setting %s privilege' % privilige_id)
		return self.api.ntdll.RtlAdjustPrivilege(privilige_id, enable = True, thread_or_process = thread_or_process)
github skelsec / pypykatz / pypykatz / pypykatz.py View on Github external
def get_lsa_bruteforce(self):
		#good luck!
		logger.info('Testing all available templates! Expect warnings!')
		for lsa_dec_template in LsaTemplate.get_template_brute(self.sysinfo):
			try:
				lsa_dec = LsaDecryptor.choose(self.reader, lsa_dec_template, self.sysinfo)
				logger.debug(lsa_dec.dump())
			except:
				pass
			else:
				logger.info('Lucky you! Brutefoce method found a -probably- working template!')
				return lsa_dec
github skelsec / pypykatz / pypykatz / commons / winapi / machine.py View on Github external
def list_users(self):
		logger.debug('Listing SIDs from registry...')
		software_hive = LiveRegistryHive('SOFTWARE')
		users = {}
		for sid_str in software_hive.enum_key('Microsoft\\Windows NT\\CurrentVersion\\ProfileList'):
			if sid_str.endswith('_Classes') or sid_str.startswith('.'):
				continue
			ptr_sid = self.api.advapi32.ConvertStringSidToSid(sid_str.encode())
			name, domain, token_type = self.api.advapi32.LookupAccountSid(None, ptr_sid)
			users[sid_str] = User(name, domain, sid_str)
		return users
github skelsec / pypykatz / pypykatz / commons / winapi / processmanipulator.py View on Github external
def list_all_tokens(self, force = False):
		"""
		iterates trough all available processes, fetches all process tokens, gets user information for all tokens
		"""
		logger.debug('[ProcessManipulator] Listing all tokens...')
		try:
			res = self.set_privilege(SE_DEBUG)
		except Exception as e:
			if force is False:
				logger.error('Failed to obtain SE_DEBUG privilege!')
				raise e
			else:
				pass
				
		token_infos = []
		for pid in self.api.psapi.EnumProcesses():
			proc_handle = None
			try:
				proc_handle = self.api.kernel32.OpenProcess(PROCESS_QUERY_INFORMATION, False, pid)
				logger.log(1, '[ProcessManipulator] Proc handle for PID %s is: %s' % (proc_handle, pid))
			except Exception as e:
github skelsec / pypykatz / pypykatz / dpapi / dpapi.py View on Github external
def decrypt_blob(self, dpapi_blob, key = None):
		"""
		Decrypts a DPAPI_BLOB object
		The DPAPI blob has a GUID attributes which indicates the masterkey to be used, also it has integrity check bytes so it is possible to tell is decryption was sucsessfull.
		
		dpapi_blob: DPAPI_BLOB object
		key: raw bytes of the decryption key. If not supplied the function will look for keys already cached in the DPAPI object.
		returns: bytes of the cleartext data
		"""
		if key is None:
			logger.debug('[DPAPI] Looking for master key with GUID %s' % dpapi_blob.masterkey_guid)
			if dpapi_blob.masterkey_guid not in self.masterkeys:
				raise Exception('No matching masterkey was found for the blob!')
			key = self.masterkeys[dpapi_blob.masterkey_guid]
		return dpapi_blob.decrypt(key)
github skelsec / pypykatz / pypykatz / dpapi / dpapi.py View on Github external
def __get_registry_secrets(self, lr):
		"""
		Gets the pre-keys from an already parsed OffineRegistry or LiveRegistry object, populates the userkey/machinekey lists, returns the obtained keys
		
		lr: OffineRegistry or LiveRegistry object
		return: touple of two lists, [0] userkeys [1] machinekeys
		"""
		user = []
		machine = []
		from pypykatz.registry.security.common import LSASecretDPAPI

		if lr.security:
			for secret in lr.security.cached_secrets:
				if isinstance(secret, LSASecretDPAPI):
					logger.debug('[DPAPI] Found DPAPI user key in registry! Key: %s' % secret.user_key)
					logger.debug('[DPAPI] Found DPAPI machine key in registry! Key: %s' % secret.machine_key)
					self.user_keys.append(secret.user_key)
					user.append(secret.user_key)
					self.machine_keys.append(secret.machine_key)
					machine.append(secret.machine_key)
		
		if lr.sam is not None:
			for secret in lr.sam.secrets:
				if secret.nt_hash:
					sid = '%s-%s' % (lr.sam.machine_sid, secret.rid)
					x, key2, key3 = self.get_prekeys_from_password(sid, nt_hash = secret.nt_hash)
					logger.debug('[DPAPI] NT hash method. Calculated user key for user %s! Key2: %s Key3: %s' % (sid, key2, key3))
					user.append(key2)
					user.append(key3)
					continue
					
		return user, machine