Skip to content

Add regsecretdump technique#599

Merged
mpgn merged 5 commits intomainfrom
regsecret
Mar 16, 2025
Merged

Add regsecretdump technique#599
mpgn merged 5 commits intomainfrom
regsecret

Conversation

@mpgn
Copy link
Copy Markdown
Collaborator

@mpgn mpgn commented Mar 14, 2025

Description

No more file write on disk when dumping SAM and LSA following the new addition in impacket fortra/impacket#1898 from @laxa

Type of change

  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • This requires a third party update (such as Impacket, Dploot, lsassy, etc)

Screenshots (if appropriate):

image

Checklist:

  • I have ran Ruff against my changes (via poetry: poetry run python -m ruff check . --preview, use --fix to automatically fix what it can)
  • I have added or updated the tests/e2e_commands.txt file if necessary
  • New and existing e2e tests pass locally with my changes
  • My code follows the style guidelines of this project (should be covered by Ruff above)
  • If reliant on third party dependencies, such as Impacket, dploot, lsassy, etc, I have linked the relevant PRs in those projects
  • I have performed a self-review of my own code
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation (PR here: https://github.com/Pennyw0rth/NetExec-Wiki)

@mpgn mpgn mentioned this pull request Mar 14, 2025
Merged
@mpgn
Copy link
Copy Markdown
Collaborator Author

mpgn commented Mar 14, 2025

This pull request includes changes to the nxc/protocols/smb.py file to enhance the handling of remote operations by integrating the RegSecretsRemoteOperations class and improving the SAM and LSA secrets dumping processes. The most important changes include modifying the enable_remoteops method to support the new class, updating the sam and lsa methods to use the new class, and refining the handling of SAM and LSA secrets.

Enhancements to remote operations:

  • nxc/protocols/smb.py: Imported RegSecretsRemoteOperations, SAMHashes, and LSASecrets from impacket.examples.regsecrets to support the new class for remote operations.
  • nxc/protocols/smb.py: Modified the enable_remoteops method to accept a regsecret parameter and instantiate RegSecretsRemoteOperations when regsecret is True.

Improvements to SAM and LSA secrets dumping:

  • nxc/protocols/smb.py: Updated the sam method to call enable_remoteops with regsecret=True and adjusted the SAM dumping process to use the new class. [1] [2] [3]
  • nxc/protocols/smb.py: Updated the lsa method to call enable_remoteops with regsecret=True and adjusted the LSA secrets dumping process to use the new class. [1] [2] [3]

@NeffIsBack
Copy link
Copy Markdown
Member

NeffIsBack commented Mar 15, 2025 •
edited
Loading

Live footage of @mpgn getting to his PC after fortra/impacket#1898 was merged
speed gif

NeffIsBack
NeffIsBack previously approved these changes Mar 16, 2025
View reviewed changes
Copy link
Copy Markdown
Member

@NeffIsBack NeffIsBack left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Holy shit this thing is fast, easily doubled the speed:
image

LGTM

@NeffIsBack NeffIsBack mentioned this pull request Mar 16, 2025
Merged
@mpgn mpgn merged commit cbcdf3a into main Mar 16, 2025
5 checks passed
@mpgn mpgn deleted the regsecret branch March 16, 2025 08:29
@vncsb vncsb mentioned this pull request Jul 18, 2025
Merged
13 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@NeffIsBack NeffIsBack NeffIsBack approved these changes

@zblurx zblurx Awaiting requested review from zblurx zblurx is a code owner

@Marshall-Hallenbeck Marshall-Hallenbeck Awaiting requested review from Marshall-Hallenbeck Marshall-Hallenbeck is a code owner

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@mpgn @NeffIsBack